codeep 2.24.0 → 3.0.0

package/dist/config/index.d.ts

@@ -83,6 +83,14 @@ export interface ConfigSchema {
     ollamaNumCtx: number;
     customBaseUrl: string;
     agentConfirmation: 'always' | 'dangerous' | 'never';
+    /** Also send a pending confirmation to Telegram, so it can be answered away
+     *  from the desk. Interactive runs only — a headless run has nobody to ask,
+     *  and waiting on an answer that cannot come would hang CI. The bot token
+     *  lives in the keychain, never here. */
+    telegramApproval: boolean;
+    /** The single chat allowed to answer. Not a secret — it identifies a
+     *  conversation, and it is useless without the token. */
+    telegramChatId: string;
     agentConfirmDeleteFile: boolean;
     agentConfirmExecuteCommand: boolean;
     agentConfirmWriteFile: boolean;

package/dist/config/index.js

@@ -151,6 +151,8 @@ function createConfig() {
         ollamaNumCtx: 0,
         customBaseUrl: '',
         agentConfirmation: 'dangerous',
+        telegramApproval: false,
+        telegramChatId: '',
         agentConfirmDeleteFile: true,
         agentConfirmExecuteCommand: true,
         agentConfirmWriteFile: false,

package/dist/config/providers.js

@@ -19,6 +19,7 @@ export const PROVIDERS = {
         },
         models: [
             { id: 'glm-5.3', name: 'GLM-5.3', description: 'Latest flagship for project-scale engineering (1M context)' },
+            { id: 'glm-5.3-flash', name: 'GLM-5.3 Flash', description: 'Same 1M context at a twentieth of the price' },
             { id: 'glm-5.2', name: 'GLM-5.2', description: 'Previous flagship for project-scale engineering (1M context)' },
             { id: 'glm-5-turbo', name: 'GLM-5 Turbo', description: 'Fast GLM-5 variant, available to all users' },
         ],
@@ -52,6 +53,7 @@ export const PROVIDERS = {
             // (`z.ai-cn*`) bills separately and is not covered by that page, so it is
             // left alone until its own listing is checked.
             { id: 'glm-5.3', name: 'GLM-5.3', description: 'Latest flagship for project-scale engineering (1M context)' },
+            { id: 'glm-5.3-flash', name: 'GLM-5.3 Flash', description: 'Same 1M context at a twentieth of the price' },
             { id: 'glm-5.2', name: 'GLM-5.2', description: 'Previous flagship for project-scale engineering (1M context)' },
             { id: 'glm-5-turbo', name: 'GLM-5 Turbo', description: 'Fast GLM-5 variant' },
         ],

package/dist/renderer/App.d.ts

@@ -124,6 +124,10 @@ export declare class App {
     private isMultilineMode;
     private loginOpen;
     private loginStep;
+    /** Overrides the masked step's heading when that screen is reused for a
+     *  secret that is not a provider API key — a Telegram bot token, say.
+     *  Empty for an ordinary login. */
+    private secretPrompt;
     private loginProviders;
     private loginProviderIndex;
     private loginApiKey;
@@ -243,6 +247,18 @@ export declare class App {
      * Show confirmation dialog
      */
     showConfirm(options: ConfirmOptions): void;
+    /**
+     * Take the confirmation down without answering it.
+     *
+     * For a question that was settled somewhere else — today that means a phone
+     * answered it over Telegram. Neither callback fires: the decision has already
+     * been made and taken, and running `onCancel` here would deny a tool the user
+     * just approved.
+     *
+     * A no-op when nothing is open, so the caller can dismiss unconditionally
+     * rather than racing to check first.
+     */
+    dismissConfirm(reason?: string): void;
     /**
      * Show the interactive hunk picker (`/apply --interactive`).
      * The caller passes pre-built items + an `onComplete` callback.
@@ -304,6 +320,16 @@ export declare class App {
         providerId: string;
         apiKey: string;
     } | null) => void): void;
+    /**
+     * Ask for one secret, masked, with no provider step.
+     *
+     * The login screen already takes a credential without echoing it, and a second
+     * implementation of that is a second place to get masking wrong. This reuses
+     * it and replaces only the heading: "Enter API Key for Z.AI" is the wrong
+     * sentence for a Telegram bot token, and a prompt naming the wrong thing is
+     * how someone pastes the wrong thing.
+     */
+    showSecret(prompt: string, callback: (secret: string | null) => void): void;
     /**
      * Reinitialize screen (after external screen takeover)
      */

package/dist/renderer/App.js

@@ -155,6 +155,10 @@ export class App {
     // Inline login state
     loginOpen = false;
     loginStep = 'provider';
+    /** Overrides the masked step's heading when that screen is reused for a
+     *  secret that is not a provider API key — a Telegram bot token, say.
+     *  Empty for an ordinary login. */
+    secretPrompt = '';
     loginProviders = [];
     loginProviderIndex = 0;
     loginApiKey = '';
@@ -529,6 +533,27 @@ export class App {
         this.confirmOpen = true;
         this.scheduleRender();
     }
+    /**
+     * Take the confirmation down without answering it.
+     *
+     * For a question that was settled somewhere else — today that means a phone
+     * answered it over Telegram. Neither callback fires: the decision has already
+     * been made and taken, and running `onCancel` here would deny a tool the user
+     * just approved.
+     *
+     * A no-op when nothing is open, so the caller can dismiss unconditionally
+     * rather than racing to check first.
+     */
+    dismissConfirm(reason) {
+        if (!this.confirmOpen)
+            return;
+        this.screen.invalidate();
+        this.confirmOptions = null;
+        this.confirmOpen = false;
+        if (reason)
+            this.notify(reason);
+        this.scheduleRender();
+    }
     /**
      * Show the interactive hunk picker (`/apply --interactive`).
      * The caller passes pre-built items + an `onComplete` callback.
@@ -659,6 +684,27 @@ export class App {
         this.loginApiKey = '';
         this.loginError = '';
         this.loginCallback = callback;
+        this.secretPrompt = '';
+        this.loginOpen = true;
+        this.scheduleRender();
+    }
+    /**
+     * Ask for one secret, masked, with no provider step.
+     *
+     * The login screen already takes a credential without echoing it, and a second
+     * implementation of that is a second place to get masking wrong. This reuses
+     * it and replaces only the heading: "Enter API Key for Z.AI" is the wrong
+     * sentence for a Telegram bot token, and a prompt naming the wrong thing is
+     * how someone pastes the wrong thing.
+     */
+    showSecret(prompt, callback) {
+        this.loginProviders = [{ id: 'secret', name: prompt }];
+        this.loginProviderIndex = 0;
+        this.loginStep = 'apikey';
+        this.loginApiKey = '';
+        this.loginError = '';
+        this.secretPrompt = prompt;
+        this.loginCallback = (result) => callback(result ? result.apiKey : null);
         this.loginOpen = true;
         this.scheduleRender();
     }
@@ -2586,7 +2632,8 @@ export class App {
         else {
             // API key entry
             const selectedProvider = this.loginProviders[this.loginProviderIndex];
-            this.screen.writeLine(y++, `Enter API Key for ${selectedProvider.name}`, fg.cyan + style.bold);
+            const heading = this.secretPrompt || `Enter API Key for ${selectedProvider.name}`;
+            this.screen.writeLine(y++, heading, fg.cyan + style.bold);
             y++;
             // API key input (masked)
             const maskedKey = this.loginApiKey.length > 0

package/dist/renderer/agentExecution.js

@@ -7,6 +7,10 @@
  */
 import { chat } from '../api/index.js';
 import { runAgent } from '../utils/agent.js';
+import { TelegramApproval, outcomeForAnswer, describePermissionOutcome } from '../utils/telegramApproval.js';
+import { loadTelegramCredentials } from '../utils/telegramCredentials.js';
+import { raceApproval } from '../utils/approvalRace.js';
+import { describeAuditTarget } from '../utils/auditLog.js';
 import { config, autoSaveSession, getCurrentSessionId } from '../config/index.js';
 import { reportStats, syncSession, generateProjectId } from '../utils/codeepCloud.js';
 import { getGitStatus, isGitRepository } from '../utils/git.js';
@@ -155,28 +159,68 @@ export async function executeAgentTask(task, dryRun, ctx) {
         const rawIterations = config.get('agentMaxIterations') || 50;
         app.setAgentMaxIterations(Math.max(5, rawIterations));
         const confirmationMode = config.get('agentConfirmation') || 'dangerous';
+        // Read the Telegram credentials once for the whole run rather than per tool
+        // call: they come from the OS keychain, and paying that on every dangerous
+        // tool would put a keychain round-trip in front of each confirmation.
+        // Null means the feature is off or half-configured, and the terminal is
+        // then the only place the question appears — exactly as before.
+        const telegramCredentials = confirmationMode === 'dangerous'
+            ? await loadTelegramCredentials()
+            : null;
         const onRequestPermission = confirmationMode === 'dangerous'
-            ? (toolCall) => new Promise((resolve) => {
-                const target = toolCall.parameters.path ||
-                    toolCall.parameters.command || 'unknown';
+            ? async (toolCall) => {
+                // `parameters.command` is the binary alone — `git`, not `git status`.
+                // Showing that asks someone to approve a command they have not been
+                // shown, which is the one thing this gate must not do. The audit
+                // record already joins the binary with its arguments; reuse it rather
+                // than writing a second, subtly different answer.
+                const target = describeAuditTarget(toolCall);
                 const shortTarget = target.length > 50 ? '...' + target.slice(-47) : target;
-                app.showConfirm({
-                    title: '⚠️  Confirm Action',
-                    message: [
-                        'The agent wants to execute:',
-                        '',
-                        `  ${toolCall.tool}`,
-                        `  ${shortTarget}`,
-                        '',
-                        'Allow this action?',
-                    ],
-                    confirmLabel: 'Allow',
-                    cancelLabel: 'Deny',
-                    extraOption: { label: 'Always Allow', onSelect: () => resolve('allow_always') },
-                    onConfirm: () => resolve('allow_once'),
-                    onCancel: () => resolve('reject_always'),
-                });
-            })
+                const inTerminal = {
+                    answer: new Promise((resolve) => {
+                        app.showConfirm({
+                            title: '⚠️  Confirm Action',
+                            message: [
+                                'The agent wants to execute:',
+                                '',
+                                `  ${toolCall.tool}`,
+                                `  ${shortTarget}`,
+                                '',
+                                telegramCredentials ? 'Allow this action? (or answer on Telegram)' : 'Allow this action?',
+                            ],
+                            confirmLabel: 'Allow',
+                            cancelLabel: 'Deny',
+                            extraOption: { label: 'Always Allow', onSelect: () => resolve('allow_always') },
+                            onConfirm: () => resolve('allow_once'),
+                            onCancel: () => resolve('reject_always'),
+                        });
+                    }),
+                    // Answered on the phone: take the dialog down without running either
+                    // callback, since the decision is already made and taken.
+                    withdraw: (winner) => app.dismissConfirm(`Answered on Telegram — ${winner}.`),
+                };
+                let onPhone = null;
+                if (telegramCredentials) {
+                    // Report a failure to *ask* once, in the terminal. Without this a
+                    // wrong chat id looks exactly like a phone nobody picked up.
+                    const telegram = new TelegramApproval(telegramCredentials, reason => app.notifyWarn(`Telegram: ${reason}`));
+                    onPhone = {
+                        answer: telegram
+                            .ask(target, toolCall.tool, true)
+                            .then(answer => (answer ? outcomeForAnswer(answer) : null))
+                            // A phone that cannot be reached is not a denial. Step aside and
+                            // let the terminal decide, however long that takes.
+                            .catch(() => null),
+                        withdraw: (winner) => telegram.withdraw(winner),
+                    };
+                }
+                const { answer } = await raceApproval(inTerminal, onPhone, outcome => describePermissionOutcome(outcome));
+                // Nobody answered — neither side could even ask. `classifyPermissionOutcome`
+                // fails closed on anything it does not recognise, and this is spelled
+                // out rather than left to that: a question that was never put must
+                // never read as a yes.
+                return answer ?? 'reject_once';
+            }
             : undefined;
         const result = await runAgent(enrichedTask, context, {
             dryRun,

package/dist/renderer/commands/registry.js

@@ -190,6 +190,7 @@ export const COMMANDS = [
     { name: 'lang', description: 'Set response language', category: 'settings' },
     { name: 'grant', description: 'Grant write permission', category: 'settings' },
     { name: 'login', aliases: ['apikey'], description: 'Login with API key', category: 'settings' },
+    { name: 'telegram', description: 'Set up answering confirmations on your phone', category: 'settings' },
     { name: 'logout', description: 'Logout from provider', category: 'settings' },
     {
         name: 'profile',

package/dist/renderer/commands.js

@@ -6,6 +6,7 @@
  * to keep startup time low.
  */
 import { config, getCurrentProvider, getModelsForCurrentProvider, PROTOCOLS, LANGUAGES, setProvider, setApiKey, clearApiKey, getApiKey, saveSession, startNewSession, loadSession, listSessionsWithInfo, deleteSession, renameSession, setProjectPermission, saveProfile, loadProfile, applyProfile, listProfiles, deleteProfile, initializeAsProject, isManuallyInitializedProject, } from '../config/index.js';
+import { setTelegramToken, clearTelegramToken, hasTelegramToken } from '../utils/telegramCredentials.js';
 import { getProjectContext } from '../utils/project.js';
 import { getCurrentVersion } from '../utils/update.js';
 import { getProviderList, getProvider, modelSupportsReasoningEffort, reasoningParamsFor, availableReasoningTiers, resolveReasoningTier, REASONING_TIERS } from '../config/providers.js';
@@ -1084,6 +1085,39 @@ Format: use headers per category, only include categories where you found issues
             });
             break;
         }
+        case 'telegram': {
+            const enabled = config.get('telegramApproval') === true;
+            const chatId = String(config.get('telegramChatId') || '').trim();
+            const hasToken = await hasTelegramToken();
+            // Say what is missing before offering to fix it. Half-configured behaves
+            // exactly like off, and without this the user turns the switch on, sees
+            // nothing arrive, and has no way to tell which half is absent.
+            ctx.app.notify([
+                `Telegram approval: ${enabled ? 'on' : 'off'}`,
+                `Bot token: ${hasToken ? 'saved' : 'missing'}`,
+                `Chat ID: ${chatId || 'missing'}`,
+            ].join(' · '));
+            ctx.app.showSecret('Paste your Telegram bot token (from @BotFather)', async (token) => {
+                if (token === null)
+                    return;
+                if (!token.trim()) {
+                    await clearTelegramToken();
+                    ctx.app.notify('Telegram bot token removed.');
+                    return;
+                }
+                try {
+                    await setTelegramToken(token);
+                }
+                catch {
+                    ctx.app.notify('Could not save the token (secure storage unavailable).');
+                    return;
+                }
+                ctx.app.notify(chatId
+                    ? 'Token saved. Turn on "Answer confirmations on Telegram" in /settings.'
+                    : 'Token saved. Now set your chat ID in /settings — open https://api.telegram.org/bot<TOKEN>/getUpdates after messaging your bot.');
+            });
+            break;
+        }
         case 'login': {
             const providers = getProviderList();
             ctx.app.showLogin(providers.map(p => ({ id: p.id, name: p.name, description: p.description, subscribeUrl: p.subscribeUrl, noApiKey: p.noApiKey })), async (result) => {

package/dist/renderer/components/Settings.js

@@ -122,6 +122,26 @@ export const SETTINGS = [
             { value: 'always', label: 'Always' },
         ],
     },
+    {
+        key: 'telegramApproval',
+        label: 'Answer confirmations on Telegram',
+        getValue: () => config.get('telegramApproval') === true,
+        type: 'select',
+        // Booleans, not the strings 'true'/'false'. With strings the option never
+        // matches what getValue returns, so the row renders the raw value and the
+        // toggle writes a string that `=== true` can never satisfy — it reads Off
+        // forever while claiming to have been turned On.
+        options: [
+            { value: true, label: 'ON' },
+            { value: false, label: 'OFF' },
+        ],
+    },
+    {
+        key: 'telegramChatId',
+        label: 'Telegram chat ID',
+        getValue: () => config.get('telegramChatId') || '',
+        type: 'text',
+    },
     {
         key: 'agentConfirmDeleteFile',
         label: 'Confirm: delete_file',

package/dist/utils/approvalRace.d.ts

@@ -0,0 +1,33 @@
+/**
+ * One question, two places it can be answered, and exactly one answer.
+ *
+ * The terminal and the phone are both live at once. Whichever comes back first
+ * decides, and the other has to be taken down — a dialog left on screen after
+ * the phone answered would ask again, and a Telegram message left with three
+ * live buttons invites a tap that can no longer do anything.
+ *
+ * Kept apart from the agent loop and from the Telegram client because the part
+ * that goes wrong is the ordering, and the ordering can be tested with two
+ * promises and no network.
+ */
+export interface RaceParticipant<T> {
+    /** Resolves when this side is answered. Must never reject: a rejection here
+     *  would take down a run over a failure to *ask*, which is not the same thing
+     *  as a denial and must not be treated as one. */
+    answer: Promise<T | null>;
+    /** Take this side down because the other one won. Must be safe to call when
+     *  this side never started, and must not itself answer anything. */
+    withdraw: (winner: string) => void | Promise<void>;
+}
+/**
+ * Settle a question from whichever side answers first.
+ *
+ * A side that resolves `null` has declined to decide — it failed to send, or it
+ * was cancelled — and is not treated as a winner. When both come back null,
+ * nobody answered, and the caller decides what that means. It must not mean
+ * approval.
+ */
+export declare function raceApproval<T>(terminal: RaceParticipant<T>, remote: RaceParticipant<T> | null, describe: (answer: T) => string): Promise<{
+    answer: T | null;
+    from: 'terminal' | 'remote' | 'nobody';
+}>;

package/dist/utils/approvalRace.js

@@ -0,0 +1,58 @@
+/**
+ * One question, two places it can be answered, and exactly one answer.
+ *
+ * The terminal and the phone are both live at once. Whichever comes back first
+ * decides, and the other has to be taken down — a dialog left on screen after
+ * the phone answered would ask again, and a Telegram message left with three
+ * live buttons invites a tap that can no longer do anything.
+ *
+ * Kept apart from the agent loop and from the Telegram client because the part
+ * that goes wrong is the ordering, and the ordering can be tested with two
+ * promises and no network.
+ */
+/**
+ * Settle a question from whichever side answers first.
+ *
+ * A side that resolves `null` has declined to decide — it failed to send, or it
+ * was cancelled — and is not treated as a winner. When both come back null,
+ * nobody answered, and the caller decides what that means. It must not mean
+ * approval.
+ */
+export async function raceApproval(terminal, remote, describe) {
+    // With no remote side there is nothing to race and nothing to withdraw.
+    if (!remote) {
+        return { answer: await terminal.answer, from: 'terminal' };
+    }
+    // Not Promise.race. Race settles on the first promise to *finish*, including
+    // one that finished by declining — and the branch for the side that answers
+    // later still runs, consuming the answer into a result nobody reads. Each
+    // side instead gets one shot at a shared resolver, and only a real answer
+    // takes it.
+    return new Promise(resolve => {
+        let settled = false;
+        const claim = async (from, answer, loser) => {
+            // A null is a side stepping aside, not an answer. Let the other run on.
+            if (answer === null || settled)
+                return;
+            settled = true;
+            // Withdrawal is best-effort: the decision is already made, and a network
+            // failure closing the other side must not undo it or throw in its place.
+            try {
+                await loser.withdraw(describe(answer));
+            }
+            catch { /* already decided */ }
+            resolve({ answer, from });
+        };
+        void terminal.answer.then(a => claim('terminal', a, remote));
+        void remote.answer.then(a => claim('remote', a, terminal));
+        // Both declined. Nobody answered — which the caller must not read as
+        // approval, and which is why this returns a name for it rather than a null
+        // that looks like every other null.
+        void Promise.all([terminal.answer, remote.answer]).then(() => {
+            if (settled)
+                return;
+            settled = true;
+            resolve({ answer: null, from: 'nobody' });
+        });
+    });
+}

package/dist/utils/telegramApproval.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Answer a pending tool confirmation from a phone.
+ *
+ * The agent already parks on `onRequestPermission` and resumes when that promise
+ * settles. This adds a second way to settle it — nothing in the gate changes,
+ * and whichever answers first wins. A run that would have sat at an empty desk
+ * until someone came back can now continue.
+ *
+ * Telegram carries it because Telegram runs the infrastructure: the bot API is
+ * polled outbound from this machine, so there is no server to host, no inbound
+ * port, and no per-user cost. Long polling, never a webhook — a webhook needs a
+ * public address, which is precisely what we do not want to need. That is also
+ * why this works identically on Linux and Windows, where the Mac app's CloudKit
+ * route does not exist.
+ *
+ * SECURITY: a Telegram bot is reachable by anyone who learns its username. Every
+ * update is checked against the configured chat id before it can decide
+ * anything. Without that check a stranger who found the bot could approve a
+ * destructive command on someone else's machine. See `isFromOwner`.
+ *
+ * PRIVACY: the message carries the command line, so Telegram sees it. Stated in
+ * the docs rather than hidden — it is the reason this is opt-in.
+ *
+ * Ported from the Mac app's `TelegramApproval.swift`; the wire format, the token
+ * matching and the ownership check are deliberately identical, so a bug found on
+ * one side is findable on the other.
+ */
+/** What the phone sent back. Mirrors the three buttons the desktop offers. */
+export type TelegramAnswer = 'run' | 'skip' | 'cancel';
+export interface TelegramCredentials {
+    /** From @BotFather. A credential — belongs in the keychain, never in config. */
+    botToken: string;
+    /** The single chat allowed to answer. Anything else is ignored. */
+    chatID: string;
+}
+/**
+ * The message text.
+ *
+ * Fenced, because a command containing underscores or asterisks would otherwise
+ * be mangled by Markdown parsing into something that is not what will run — and
+ * approving a command you were shown incorrectly is the one failure this whole
+ * feature must not have.
+ */
+export declare function composeMessage(command: string, toolName: string, isDestructive: boolean): string;
+/**
+ * Only the configured chat may decide.
+ *
+ * A bot's username is discoverable, so without this an unrelated Telegram user
+ * could approve a command on someone else's machine. Telegram sends the id as a
+ * number; it is compared as a string because that is how the user typed it.
+ */
+export declare function isFromOwner(callback: unknown, chatID: string): boolean;
+/**
+ * Split `run:<token>` into its parts.
+ *
+ * A callback whose token does not match the question in flight is ignored, and
+ * that is what stops a stale button — tapped after the run moved on — from
+ * answering a later question it was never shown.
+ */
+export declare function parseCallbackData(data: string): {
+    answer: TelegramAnswer;
+    token: string;
+} | null;
+/** The keyboard sent with the question. Shape pinned by a test — a renamed
+ *  callback_data field would leave three buttons that silently do nothing. */
+export declare function buildKeyboard(token: string): Record<string, unknown>;
+/**
+ * Advance the long-poll offset past everything just handled.
+ *
+ * Telegram redelivers any update that has not been acknowledged by a higher
+ * offset, so getting this wrong means the same tap arrives forever. Exported
+ * because it is off-by-one-shaped and cheaper to test than to debug against a
+ * live bot.
+ */
+export declare function nextOffset(current: number, updates: {
+    update_id?: unknown;
+}[]): number;
+/**
+ * Telegram's three buttons, in the terms the agent's gate speaks.
+ *
+ * The gate has four outcomes and `classifyPermissionOutcome` fails closed on
+ * anything it does not recognise, so this must be exhaustive rather than
+ * defaulted — a typo here would read as a denial, which is safe but silently
+ * wrong, and the user would tap Run and watch nothing happen.
+ */
+export declare function outcomeForAnswer(answer: TelegramAnswer): 'allow_once' | 'reject_once' | 'reject_always';
+/**
+ * How a decision reads on the other device, once it is too late to change it.
+ *
+ * The withdrawn side says what happened rather than just going blank, so
+ * someone reaching for their phone a moment late learns what they missed
+ * instead of finding a message that silently lost its buttons.
+ */
+export declare function describePermissionOutcome(outcome: string): string;
+/**
+ * Telegram's failure, phrased for someone who is setting this up.
+ *
+ * `chat not found` is the one people actually hit: the id belongs to a
+ * conversation with a *different* bot, or the bot has never been messaged from
+ * that chat at all. Repeating the API's words and adding what they mean beats
+ * a generic failure that sends them back to the docs.
+ */
+export declare function describeApiError(status: number, json: Record<string, unknown> | null): string;
+export declare class TelegramApproval {
+    private readonly credentials;
+    private outstanding;
+    private updateOffset;
+    private polling;
+    /** Called once when the question could not be put at all. Not for a missing
+     *  answer — only for a failure to ask. */
+    private readonly onProblem?;
+    constructor(credentials: TelegramCredentials, onProblem?: (reason: string) => void);
+    /**
+     * Send the question and wait.
+     *
+     * Resolves `null` when no answer arrived — the terminal was used instead, the
+     * caller aborted, or Telegram could not be reached. **A null is never
+     * approval**: the caller keeps its own gate and decides for itself.
+     */
+    ask(command: string, toolName: string, isDestructive: boolean, signal?: AbortSignal): Promise<TelegramAnswer | null>;
+    /**
+     * The terminal answered first. Close the question on the phone so nobody taps
+     * a button that would do nothing, and say where it was decided.
+     */
+    withdraw(decidedInTerminal: string): Promise<void>;
+    /**
+     * Why the last call failed, in Telegram's own words.
+     *
+     * Kept because swallowing it made a misconfiguration indistinguishable from
+     * silence: a wrong chat id answers `chat not found` on the very first send,
+     * and reporting nothing left the user watching a phone that was never going
+     * to ring.
+     */
+    private lastError;
+    private post;
+    private sendQuestion;
+    private edit;
+    private poll;
+    private handle;
+}

package/dist/utils/telegramApproval.js

@@ -0,0 +1,347 @@
+/**
+ * Answer a pending tool confirmation from a phone.
+ *
+ * The agent already parks on `onRequestPermission` and resumes when that promise
+ * settles. This adds a second way to settle it — nothing in the gate changes,
+ * and whichever answers first wins. A run that would have sat at an empty desk
+ * until someone came back can now continue.
+ *
+ * Telegram carries it because Telegram runs the infrastructure: the bot API is
+ * polled outbound from this machine, so there is no server to host, no inbound
+ * port, and no per-user cost. Long polling, never a webhook — a webhook needs a
+ * public address, which is precisely what we do not want to need. That is also
+ * why this works identically on Linux and Windows, where the Mac app's CloudKit
+ * route does not exist.
+ *
+ * SECURITY: a Telegram bot is reachable by anyone who learns its username. Every
+ * update is checked against the configured chat id before it can decide
+ * anything. Without that check a stranger who found the bot could approve a
+ * destructive command on someone else's machine. See `isFromOwner`.
+ *
+ * PRIVACY: the message carries the command line, so Telegram sees it. Stated in
+ * the docs rather than hidden — it is the reason this is opt-in.
+ *
+ * Ported from the Mac app's `TelegramApproval.swift`; the wire format, the token
+ * matching and the ownership check are deliberately identical, so a bug found on
+ * one side is findable on the other.
+ */
+const ANSWERS = ['run', 'skip', 'cancel'];
+/** Longest command we put in a message. Telegram caps at 4096 for the whole
+ *  text; this keeps room for the heading and the fences, and a command longer
+ *  than this is not something anyone reads off a phone anyway. */
+const MAX_COMMAND_CHARS = 300;
+/**
+ * The message text.
+ *
+ * Fenced, because a command containing underscores or asterisks would otherwise
+ * be mangled by Markdown parsing into something that is not what will run — and
+ * approving a command you were shown incorrectly is the one failure this whole
+ * feature must not have.
+ */
+export function composeMessage(command, toolName, isDestructive) {
+    const head = isDestructive
+        ? '⚠️ Codeep wants to run a destructive tool'
+        : 'Codeep needs approval';
+    const trimmed = command.length > MAX_COMMAND_CHARS
+        ? command.slice(0, MAX_COMMAND_CHARS - 1) + '…'
+        : command;
+    // A fence inside the command would close ours early and leak the rest as
+    // prose. Neutralise it rather than trusting the input.
+    const safe = trimmed.replace(/```/g, "'''");
+    return `${head}\n\n\`${toolName}\`\n\n\`\`\`\n${safe}\n\`\`\``;
+}
+/**
+ * Only the configured chat may decide.
+ *
+ * A bot's username is discoverable, so without this an unrelated Telegram user
+ * could approve a command on someone else's machine. Telegram sends the id as a
+ * number; it is compared as a string because that is how the user typed it.
+ */
+export function isFromOwner(callback, chatID) {
+    if (!chatID)
+        return false;
+    const message = callback?.message;
+    const chat = message?.chat;
+    const id = chat?.id;
+    if (typeof id === 'number')
+        return String(id) === chatID;
+    if (typeof id === 'string')
+        return id === chatID;
+    return false;
+}
+/**
+ * Split `run:<token>` into its parts.
+ *
+ * A callback whose token does not match the question in flight is ignored, and
+ * that is what stops a stale button — tapped after the run moved on — from
+ * answering a later question it was never shown.
+ */
+export function parseCallbackData(data) {
+    const separator = data.indexOf(':');
+    if (separator <= 0)
+        return null;
+    const answer = data.slice(0, separator);
+    const token = data.slice(separator + 1);
+    if (!token)
+        return null;
+    if (!ANSWERS.includes(answer))
+        return null;
+    return { answer: answer, token };
+}
+/** The keyboard sent with the question. Shape pinned by a test — a renamed
+ *  callback_data field would leave three buttons that silently do nothing. */
+export function buildKeyboard(token) {
+    return {
+        inline_keyboard: [[
+                { text: 'Run', callback_data: `run:${token}` },
+                { text: 'Skip', callback_data: `skip:${token}` },
+                { text: 'Cancel', callback_data: `cancel:${token}` },
+            ]],
+    };
+}
+/**
+ * Advance the long-poll offset past everything just handled.
+ *
+ * Telegram redelivers any update that has not been acknowledged by a higher
+ * offset, so getting this wrong means the same tap arrives forever. Exported
+ * because it is off-by-one-shaped and cheaper to test than to debug against a
+ * live bot.
+ */
+export function nextOffset(current, updates) {
+    let out = current;
+    for (const update of updates) {
+        if (typeof update.update_id === 'number')
+            out = Math.max(out, update.update_id + 1);
+    }
+    return out;
+}
+/**
+ * Telegram's three buttons, in the terms the agent's gate speaks.
+ *
+ * The gate has four outcomes and `classifyPermissionOutcome` fails closed on
+ * anything it does not recognise, so this must be exhaustive rather than
+ * defaulted — a typo here would read as a denial, which is safe but silently
+ * wrong, and the user would tap Run and watch nothing happen.
+ */
+export function outcomeForAnswer(answer) {
+    switch (answer) {
+        case 'run': return 'allow_once';
+        // Skip this one and carry on — not a standing refusal.
+        case 'skip': return 'reject_once';
+        // Stop asking. The phone has no "always allow": granting a blanket
+        // permission is a decision that belongs at the keyboard, where you can see
+        // what you are granting it to.
+        case 'cancel': return 'reject_always';
+    }
+}
+/**
+ * How a decision reads on the other device, once it is too late to change it.
+ *
+ * The withdrawn side says what happened rather than just going blank, so
+ * someone reaching for their phone a moment late learns what they missed
+ * instead of finding a message that silently lost its buttons.
+ */
+export function describePermissionOutcome(outcome) {
+    switch (outcome) {
+        case 'allow_once': return 'allowed';
+        case 'allow_always': return 'allowed, and always from now on';
+        case 'reject_once': return 'skipped';
+        case 'reject_always': return 'denied';
+        default: return 'decided';
+    }
+}
+/**
+ * Telegram's failure, phrased for someone who is setting this up.
+ *
+ * `chat not found` is the one people actually hit: the id belongs to a
+ * conversation with a *different* bot, or the bot has never been messaged from
+ * that chat at all. Repeating the API's words and adding what they mean beats
+ * a generic failure that sends them back to the docs.
+ */
+export function describeApiError(status, json) {
+    const description = typeof json?.description === 'string' ? json.description : '';
+    if (/chat not found/i.test(description)) {
+        return 'Telegram says "chat not found" — the chat ID does not belong to a conversation with this bot. Message the bot from that chat, then read the ID back from getUpdates.';
+    }
+    if (/bot was blocked/i.test(description)) {
+        return 'Telegram says the bot was blocked by this chat. Unblock it and try again.';
+    }
+    if (status === 401) {
+        return 'Telegram rejected the bot token. Re-enter it with /telegram.';
+    }
+    return description ? `Telegram refused the message: ${description}` : `Telegram returned HTTP ${status}.`;
+}
+// ─── The client ───────────────────────────────────────────────────────────────
+const API = 'https://api.telegram.org';
+/** Server-side long-poll window. The request blocks for up to this long. */
+const POLL_SECONDS = 25;
+/** Local ceiling, comfortably past the server's own. */
+const REQUEST_TIMEOUT_MS = (POLL_SECONDS + 10) * 1000;
+export class TelegramApproval {
+    credentials;
+    outstanding = null;
+    updateOffset = 0;
+    polling = false;
+    /** Called once when the question could not be put at all. Not for a missing
+     *  answer — only for a failure to ask. */
+    onProblem;
+    constructor(credentials, onProblem) {
+        this.credentials = credentials;
+        this.onProblem = onProblem;
+    }
+    /**
+     * Send the question and wait.
+     *
+     * Resolves `null` when no answer arrived — the terminal was used instead, the
+     * caller aborted, or Telegram could not be reached. **A null is never
+     * approval**: the caller keeps its own gate and decides for itself.
+     */
+    async ask(command, toolName, isDestructive, signal) {
+        const token = randomToken();
+        const messageID = await this.sendQuestion(composeMessage(command, toolName, isDestructive), token);
+        if (messageID === null) {
+            // Say it once, here, rather than leaving the caller to guess from a null
+            // that also means "answered elsewhere" and "cancelled".
+            this.onProblem?.(this.lastError ?? 'the question could not be sent');
+            return null;
+        }
+        return new Promise(resolve => {
+            let settled = false;
+            const finish = (answer) => {
+                if (settled)
+                    return;
+                settled = true;
+                this.outstanding = null;
+                this.polling = false;
+                resolve(answer);
+            };
+            this.outstanding = { token, messageID, resolve: finish };
+            if (signal) {
+                if (signal.aborted) {
+                    finish(null);
+                    return;
+                }
+                signal.addEventListener('abort', () => finish(null), { once: true });
+            }
+            void this.poll();
+        });
+    }
+    /**
+     * The terminal answered first. Close the question on the phone so nobody taps
+     * a button that would do nothing, and say where it was decided.
+     */
+    async withdraw(decidedInTerminal) {
+        const pending = this.outstanding;
+        if (!pending)
+            return;
+        this.outstanding = null;
+        this.polling = false;
+        pending.resolve(null);
+        await this.edit(pending.messageID, `Answered in the terminal — ${decidedInTerminal}.`);
+    }
+    // ── plumbing ──
+    /**
+     * Why the last call failed, in Telegram's own words.
+     *
+     * Kept because swallowing it made a misconfiguration indistinguishable from
+     * silence: a wrong chat id answers `chat not found` on the very first send,
+     * and reporting nothing left the user watching a phone that was never going
+     * to ring.
+     */
+    lastError = null;
+    async post(method, body) {
+        try {
+            const response = await fetch(`${API}/bot${this.credentials.botToken}/${method}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+            const json = await response.json().catch(() => null);
+            if (!response.ok || json?.ok === false) {
+                this.lastError = describeApiError(response.status, json);
+                return null;
+            }
+            this.lastError = null;
+            return json;
+        }
+        catch (error) {
+            // Network, timeout, malformed JSON. Still "no answer from the phone",
+            // but now it can say which.
+            this.lastError = error?.message || 'could not reach Telegram';
+            return null;
+        }
+    }
+    async sendQuestion(text, token) {
+        const json = await this.post('sendMessage', {
+            chat_id: this.credentials.chatID,
+            text,
+            parse_mode: 'Markdown',
+            reply_markup: buildKeyboard(token),
+        });
+        const result = json?.result;
+        return typeof result?.message_id === 'number' ? result.message_id : null;
+    }
+    async edit(messageID, text) {
+        await this.post('editMessageText', {
+            chat_id: this.credentials.chatID,
+            message_id: messageID,
+            text,
+        });
+    }
+    async poll() {
+        if (this.polling)
+            return;
+        this.polling = true;
+        while (this.polling && this.outstanding) {
+            const json = await this.post('getUpdates', {
+                offset: this.updateOffset,
+                timeout: POLL_SECONDS,
+                allowed_updates: ['callback_query'],
+            });
+            if (!this.polling || !this.outstanding)
+                return;
+            const updates = Array.isArray(json?.result) ? json.result : [];
+            this.updateOffset = nextOffset(this.updateOffset, updates);
+            for (const update of updates) {
+                if (update.callback_query)
+                    await this.handle(update.callback_query);
+                if (!this.outstanding)
+                    return;
+            }
+            // Telegram's long poll already blocks server-side; this pause only covers
+            // the error case, so a failing network cannot spin the loop.
+            if (updates.length === 0)
+                await sleep(1000);
+        }
+    }
+    async handle(callback) {
+        const pending = this.outstanding;
+        if (!pending)
+            return;
+        if (!isFromOwner(callback, this.credentials.chatID))
+            return;
+        const data = callback.data;
+        if (typeof data !== 'string')
+            return;
+        const parsed = parseCallbackData(data);
+        if (!parsed || parsed.token !== pending.token)
+            return;
+        this.outstanding = null;
+        this.polling = false;
+        const id = callback.id;
+        if (typeof id === 'string')
+            await this.post('answerCallbackQuery', { callback_query_id: id });
+        await this.edit(pending.messageID, `${capitalise(parsed.answer)} — sent to your terminal.`);
+        pending.resolve(parsed.answer);
+    }
+}
+function randomToken() {
+    return Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+function capitalise(value) {
+    return value.charAt(0).toUpperCase() + value.slice(1);
+}
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}

package/dist/utils/telegramCredentials.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Where the Telegram bot token lives, and how the two halves are read back.
+ *
+ * Deliberately separate from `telegramApproval.ts`, which stays free of I/O so
+ * the parts that decide whether a stranger may approve your commands can be
+ * tested without a keychain, a config file, or a network.
+ *
+ * The token goes in the OS keychain — it *is* the bot, and anyone holding it can
+ * send messages as you. The chat id is ordinary config: it names a conversation
+ * and is useless on its own.
+ */
+import type { TelegramCredentials } from './telegramApproval.js';
+export declare function setTelegramToken(token: string): Promise<void>;
+export declare function clearTelegramToken(): Promise<void>;
+export declare function hasTelegramToken(): Promise<boolean>;
+/**
+ * Both halves, or nothing.
+ *
+ * Returns null when the feature is off or either half is missing. Half-
+ * configured must behave exactly like off: a token with no chat id would send
+ * the question nowhere, and a chat id with no token cannot send at all — and
+ * both would otherwise stall a run waiting for an answer that was never asked.
+ */
+export declare function loadTelegramCredentials(): Promise<TelegramCredentials | null>;

package/dist/utils/telegramCredentials.js

@@ -0,0 +1,53 @@
+/**
+ * Where the Telegram bot token lives, and how the two halves are read back.
+ *
+ * Deliberately separate from `telegramApproval.ts`, which stays free of I/O so
+ * the parts that decide whether a stranger may approve your commands can be
+ * tested without a keychain, a config file, or a network.
+ *
+ * The token goes in the OS keychain — it *is* the bot, and anyone holding it can
+ * send messages as you. The chat id is ordinary config: it names a conversation
+ * and is useless on its own.
+ */
+import { config } from '../config/index.js';
+import { createSecureStorage } from './keychain.js';
+/**
+ * The keychain is keyed by provider id, and this is not a provider.
+ *
+ * Reusing the store rather than adding a second keychain integration is the
+ * point; going through `setApiKey` is not, because that also records the id in
+ * `configuredProviderIds` and Telegram would start appearing in provider lists
+ * as something you could log out of.
+ */
+const CREDENTIAL_ID = 'telegram';
+export async function setTelegramToken(token) {
+    await createSecureStorage(config).setApiKey(CREDENTIAL_ID, token.trim());
+}
+export async function clearTelegramToken() {
+    await createSecureStorage(config).deleteApiKey(CREDENTIAL_ID);
+}
+export async function hasTelegramToken() {
+    return !!(await createSecureStorage(config).getApiKey(CREDENTIAL_ID));
+}
+/**
+ * Both halves, or nothing.
+ *
+ * Returns null when the feature is off or either half is missing. Half-
+ * configured must behave exactly like off: a token with no chat id would send
+ * the question nowhere, and a chat id with no token cannot send at all — and
+ * both would otherwise stall a run waiting for an answer that was never asked.
+ */
+export async function loadTelegramCredentials() {
+    // Strictly true. A truthy check would accept the string 'true' left behind
+    // by an earlier build whose toggle wrote strings — and then the feature
+    // would be live while the settings row read OFF.
+    if (config.get('telegramApproval') !== true)
+        return null;
+    const chatID = String(config.get('telegramChatId') || '').trim();
+    if (!chatID)
+        return null;
+    const botToken = await createSecureStorage(config).getApiKey(CREDENTIAL_ID);
+    if (!botToken)
+        return null;
+    return { botToken, chatID };
+}

package/dist/utils/tokenTracker.js

@@ -10,6 +10,7 @@ import { formatResourceImpactReport } from './resourceImpact.js';
 const MODEL_CONTEXT_WINDOWS = {
     // Z.AI / ZhipuAI
     'glm-5.3': 1_000_000,
+    'glm-5.3-flash': 1_000_000,
     'glm-5.2': 1_000_000,
     'glm-5.1': 200_000,
     'glm-5-turbo': 202_752,
@@ -81,6 +82,10 @@ const MODEL_PRICING = {
     // inferred from the match — the two being equal today is a coincidence of the
     // price list, not a rule.
     'glm-5.3': { inputPer1M: 1.40, outputPer1M: 4.40 },
+    // Flash lists at $0.15/$0.50 with a 50% launch promotion in force at the
+    // time of writing. The list price is what belongs here: a promotional rate
+    // would quietly understate every session's cost the day it ends.
+    'glm-5.3-flash': { inputPer1M: 0.15, outputPer1M: 0.50 },
     'glm-5.2': { inputPer1M: 1.40, outputPer1M: 4.40 },
     'glm-5.1': { inputPer1M: 1.40, outputPer1M: 4.40 },
     'glm-5-turbo': { inputPer1M: 1.20, outputPer1M: 4.00 },
@@ -121,6 +126,9 @@ const MODEL_PRICING = {
     // subscription alias (flat-fee in reality, priced notionally like K2.7 Code).
     'kimi-k3': { inputPer1M: 3.00, outputPer1M: 15.00 },
     'kimi-k2.7-code': { inputPer1M: 0.95, outputPer1M: 4.00 },
+    // Highspeed is the same model served faster, at exactly double the rate
+    // across every token category (platform.kimi.ai/docs/pricing/chat-k27-code).
+    'kimi-k2.7-code-highspeed': { inputPer1M: 1.90, outputPer1M: 8.00 },
     // Kimi doesn't publish a distinct high-speed price in its main table.
     // Leave that variant unpriced rather than presenting an invented estimate.
     'kimi-k2.6': { inputPer1M: 0.95, outputPer1M: 4.00 },

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "2.24.0";
+export declare const VERSION = "3.0.0";

package/dist/version.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED by scripts/gen-version.js — do not edit by hand.
 // Baked from package.json at build time so the bun-compiled binary reports
 // the right version (it has no package.json on disk to read at runtime).
-export const VERSION = '2.24.0';
+export const VERSION = '3.0.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.24.0",
+  "version": "3.0.0",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",