codeep 2.25.0 → 3.1.0

package/dist/config/index.d.ts

@@ -83,6 +83,20 @@ export interface ConfigSchema {
     ollamaNumCtx: number;
     customBaseUrl: string;
     agentConfirmation: 'always' | 'dangerous' | 'never';
+    /** Also send a pending confirmation to Telegram, so it can be answered away
+     *  from the desk. Interactive runs only — a headless run has nobody to ask,
+     *  and waiting on an answer that cannot come would hang CI. The bot token
+     *  lives in the keychain, never here. */
+    telegramApproval: boolean;
+    /** Whether a message from the configured chat becomes a prompt.
+     *
+     *  Separate from telegramApproval on purpose. Approval lets the phone answer
+     *  a question the agent already chose to ask; this lets the phone ask one,
+     *  which is a keyboard attached to this machine. Off unless asked for. */
+    telegramInbox: boolean;
+    /** The single chat allowed to answer. Not a secret — it identifies a
+     *  conversation, and it is useless without the token. */
+    telegramChatId: string;
     agentConfirmDeleteFile: boolean;
     agentConfirmExecuteCommand: boolean;
     agentConfirmWriteFile: boolean;

package/dist/config/index.js

@@ -151,6 +151,9 @@ function createConfig() {
         ollamaNumCtx: 0,
         customBaseUrl: '',
         agentConfirmation: 'dangerous',
+        telegramApproval: false,
+        telegramInbox: false,
+        telegramChatId: '',
         agentConfirmDeleteFile: true,
         agentConfirmExecuteCommand: true,
         agentConfirmWriteFile: false,

package/dist/config/providers.js

@@ -477,7 +477,8 @@ export const PROVIDERS = {
             },
         },
         models: [
-            { id: 'claude-fable-5', name: 'Claude Fable 5', description: 'Most capable — hardest reasoning & long-horizon agentic work' },
+            { id: 'claude-fable-5-1', name: 'Claude Fable 5.1', description: 'Most capable — hardest reasoning & long-horizon agentic work' },
+            { id: 'claude-fable-5', name: 'Claude Fable 5', description: 'Superseded by 5.1 — same price, kept for pinned configs' },
             { id: 'claude-opus-5', name: 'Claude Opus 5', description: 'Complex agentic coding & deep reasoning — the Opus workhorse' },
             { id: 'claude-sonnet-5', name: 'Claude Sonnet 5', description: 'Best balance of speed and intelligence' },
             { id: 'claude-haiku-4-5-20251001', name: 'Claude Haiku', description: 'Fastest and most affordable' },
@@ -528,7 +529,8 @@ export const PROVIDERS = {
         // get a working dropdown.
         models: [
             { id: 'openrouter/auto', name: 'Auto-route', description: 'OpenRouter picks the best model for the task' },
-            { id: 'anthropic/claude-fable-5', name: 'Claude Fable 5', description: 'Anthropic — most capable' },
+            { id: 'anthropic/claude-fable-5-1', name: 'Claude Fable 5.1', description: 'Anthropic — most capable' },
+            { id: 'anthropic/claude-fable-5', name: 'Claude Fable 5', description: 'Anthropic — superseded by 5.1' },
             { id: 'anthropic/claude-opus-5', name: 'Claude Opus 5', description: 'Anthropic — flagship Opus tier' },
             { id: 'anthropic/claude-sonnet-5', name: 'Claude Sonnet 5', description: 'Anthropic — balanced' },
             { id: 'openai/gpt-5.6-sol', name: 'GPT-5.6 Sol', description: 'OpenAI — flagship' },

package/dist/renderer/App.d.ts

@@ -20,7 +20,7 @@ export interface ConfirmOptions {
     onConfirm: () => void;
     onCancel?: () => void;
 }
-export { HunkPickerItem, HunkPickerOptions } from './components/HunkPicker';
+export type { HunkPickerItem, HunkPickerOptions } from './components/HunkPicker';
 import { type HunkPickerOptions } from './components/HunkPicker';
 /**
  * Options for the interactive hunk picker — see components/HunkPicker.ts.
@@ -124,6 +124,10 @@ export declare class App {
     private isMultilineMode;
     private loginOpen;
     private loginStep;
+    /** Overrides the masked step's heading when that screen is reused for a
+     *  secret that is not a provider API key — a Telegram bot token, say.
+     *  Empty for an ordinary login. */
+    private secretPrompt;
     private loginProviders;
     private loginProviderIndex;
     private loginApiKey;
@@ -243,6 +247,18 @@ export declare class App {
      * Show confirmation dialog
      */
     showConfirm(options: ConfirmOptions): void;
+    /**
+     * Take the confirmation down without answering it.
+     *
+     * For a question that was settled somewhere else — today that means a phone
+     * answered it over Telegram. Neither callback fires: the decision has already
+     * been made and taken, and running `onCancel` here would deny a tool the user
+     * just approved.
+     *
+     * A no-op when nothing is open, so the caller can dismiss unconditionally
+     * rather than racing to check first.
+     */
+    dismissConfirm(reason?: string): void;
     /**
      * Show the interactive hunk picker (`/apply --interactive`).
      * The caller passes pre-built items + an `onComplete` callback.
@@ -304,6 +320,16 @@ export declare class App {
         providerId: string;
         apiKey: string;
     } | null) => void): void;
+    /**
+     * Ask for one secret, masked, with no provider step.
+     *
+     * The login screen already takes a credential without echoing it, and a second
+     * implementation of that is a second place to get masking wrong. This reuses
+     * it and replaces only the heading: "Enter API Key for Z.AI" is the wrong
+     * sentence for a Telegram bot token, and a prompt naming the wrong thing is
+     * how someone pastes the wrong thing.
+     */
+    showSecret(prompt: string, callback: (secret: string | null) => void): void;
     /**
      * Reinitialize screen (after external screen takeover)
      */
@@ -466,6 +492,10 @@ export declare class App {
     /**
      * Render status bar
      */
+    /**
+     * @param canScroll false when the caller renders instead of the transcript
+     *   rather than above it, so there is nothing on screen for PgDn to move.
+     */
     private renderStatusBar;
     /**
      * Get visible messages (including streaming)

package/dist/renderer/App.js

@@ -155,6 +155,10 @@ export class App {
     // Inline login state
     loginOpen = false;
     loginStep = 'provider';
+    /** Overrides the masked step's heading when that screen is reused for a
+     *  secret that is not a provider API key — a Telegram bot token, say.
+     *  Empty for an ordinary login. */
+    secretPrompt = '';
     loginProviders = [];
     loginProviderIndex = 0;
     loginApiKey = '';
@@ -529,6 +533,27 @@ export class App {
         this.confirmOpen = true;
         this.scheduleRender();
     }
+    /**
+     * Take the confirmation down without answering it.
+     *
+     * For a question that was settled somewhere else — today that means a phone
+     * answered it over Telegram. Neither callback fires: the decision has already
+     * been made and taken, and running `onCancel` here would deny a tool the user
+     * just approved.
+     *
+     * A no-op when nothing is open, so the caller can dismiss unconditionally
+     * rather than racing to check first.
+     */
+    dismissConfirm(reason) {
+        if (!this.confirmOpen)
+            return;
+        this.screen.invalidate();
+        this.confirmOptions = null;
+        this.confirmOpen = false;
+        if (reason)
+            this.notify(reason);
+        this.scheduleRender();
+    }
     /**
      * Show the interactive hunk picker (`/apply --interactive`).
      * The caller passes pre-built items + an `onComplete` callback.
@@ -659,6 +684,27 @@ export class App {
         this.loginApiKey = '';
         this.loginError = '';
         this.loginCallback = callback;
+        this.secretPrompt = '';
+        this.loginOpen = true;
+        this.scheduleRender();
+    }
+    /**
+     * Ask for one secret, masked, with no provider step.
+     *
+     * The login screen already takes a credential without echoing it, and a second
+     * implementation of that is a second place to get masking wrong. This reuses
+     * it and replaces only the heading: "Enter API Key for Z.AI" is the wrong
+     * sentence for a Telegram bot token, and a prompt naming the wrong thing is
+     * how someone pastes the wrong thing.
+     */
+    showSecret(prompt, callback) {
+        this.loginProviders = [{ id: 'secret', name: prompt }];
+        this.loginProviderIndex = 0;
+        this.loginStep = 'apikey';
+        this.loginApiKey = '';
+        this.loginError = '';
+        this.secretPrompt = prompt;
+        this.loginCallback = (result) => callback(result ? result.apiKey : null);
         this.loginOpen = true;
         this.scheduleRender();
     }
@@ -1423,7 +1469,7 @@ export class App {
         // Input (don't render cursor when menu/settings is open)
         this.renderInput(inputLine, width, this.menuOpen || this.settingsOpen);
         // Status bar
-        this.renderStatusBar(statusLine, width);
+        this.renderStatusBar(statusLine, width, true);
         // Inline menu renders BELOW status bar
         if (this.menuOpen && this.menuItems.length > 0) {
             this.renderInlineMenu(statusLine + 1, width);
@@ -1661,7 +1707,7 @@ export class App {
         this.renderInput(inputY, width, false);
         this.renderAgentKeyHints(hintsY, width);
         this.screen.horizontalLine(footerDividerY, '─', fg.gray);
-        this.renderStatusBar(statusY, width);
+        this.renderStatusBar(statusY, width, false);
         this.screen.render();
     }
     renderAgentContextRail(dividerX, top, bottom, railWidth, timeline) {
@@ -2378,7 +2424,11 @@ export class App {
     /**
      * Render status bar
      */
-    renderStatusBar(y, width) {
+    /**
+     * @param canScroll false when the caller renders instead of the transcript
+     *   rather than above it, so there is nothing on screen for PgDn to move.
+     */
+    renderStatusBar(y, width, canScroll) {
         // Clear the line first
         this.screen.writeLine(y, '');
         if (this.notification) {
@@ -2395,8 +2445,12 @@ export class App {
             unseenWhileScrolled: this.unseenWhileScrolled,
             isStreaming: this.isStreaming,
             isLoading: this.isLoading,
+            canScroll,
         });
-        if (this.scrollOffset > 0 && this.unseenWhileScrolled > 0) {
+        // Only the badge replaces the footer. Without the guard a run wide enough
+        // to show the timeline traded its runtime and token counts for a hint that
+        // did nothing.
+        if (canScroll && this.scrollOffset > 0 && this.unseenWhileScrolled > 0) {
             this.screen.write(width - rightText.length, y, rightText, PRIMARY_COLOR);
             return;
         }
@@ -2586,7 +2640,8 @@ export class App {
         else {
             // API key entry
             const selectedProvider = this.loginProviders[this.loginProviderIndex];
-            this.screen.writeLine(y++, `Enter API Key for ${selectedProvider.name}`, fg.cyan + style.bold);
+            const heading = this.secretPrompt || `Enter API Key for ${selectedProvider.name}`;
+            this.screen.writeLine(y++, heading, fg.cyan + style.bold);
             y++;
             // API key input (masked)
             const maskedKey = this.loginApiKey.length > 0

package/dist/renderer/agentExecution.js

@@ -7,6 +7,13 @@
  */
 import { chat } from '../api/index.js';
 import { runAgent } from '../utils/agent.js';
+import { TelegramApproval, outcomeForAnswer, describePermissionOutcome } from '../utils/telegramApproval.js';
+import { loadTelegramCredentials } from '../utils/telegramCredentials.js';
+import { composeRunSummary, sendTelegramNotice, shouldNotify } from '../utils/telegramNotify.js';
+import { takeRunFromPhone } from '../utils/telegramInbox.js';
+import { isFlatFeeProvider } from '../config/providers.js';
+import { raceApproval } from '../utils/approvalRace.js';
+import { describeAuditTarget } from '../utils/auditLog.js';
 import { config, autoSaveSession, getCurrentSessionId } from '../config/index.js';
 import { reportStats, syncSession, generateProjectId } from '../utils/codeepCloud.js';
 import { getGitStatus, isGitRepository } from '../utils/git.js';
@@ -155,28 +162,74 @@ export async function executeAgentTask(task, dryRun, ctx) {
         const rawIterations = config.get('agentMaxIterations') || 50;
         app.setAgentMaxIterations(Math.max(5, rawIterations));
         const confirmationMode = config.get('agentConfirmation') || 'dangerous';
+        // Read the Telegram credentials once for the whole run rather than per tool
+        // call: they come from the OS keychain, and paying that on every dangerous
+        // tool would put a keychain round-trip in front of each confirmation.
+        // Null means the feature is off or half-configured, and the terminal is
+        // then the only place the question appears — exactly as before.
+        const telegramCredentials = confirmationMode === 'dangerous'
+            ? await loadTelegramCredentials()
+            : null;
+        // The finish notice does not depend on the confirmation mode — a run with
+        // confirmations off is exactly the one you are most likely to walk away
+        // from. Reuse the credentials already read above when there are any, so
+        // this costs a second keychain round-trip only when there are not.
+        const noticeCredentials = telegramCredentials ?? await loadTelegramCredentials();
+        const runStartedAt = Date.now();
         const onRequestPermission = confirmationMode === 'dangerous'
-            ? (toolCall) => new Promise((resolve) => {
-                const target = toolCall.parameters.path ||
-                    toolCall.parameters.command || 'unknown';
+            ? async (toolCall) => {
+                // `parameters.command` is the binary alone — `git`, not `git status`.
+                // Showing that asks someone to approve a command they have not been
+                // shown, which is the one thing this gate must not do. The audit
+                // record already joins the binary with its arguments; reuse it rather
+                // than writing a second, subtly different answer.
+                const target = describeAuditTarget(toolCall);
                 const shortTarget = target.length > 50 ? '...' + target.slice(-47) : target;
-                app.showConfirm({
-                    title: '⚠️  Confirm Action',
-                    message: [
-                        'The agent wants to execute:',
-                        '',
-                        `  ${toolCall.tool}`,
-                        `  ${shortTarget}`,
-                        '',
-                        'Allow this action?',
-                    ],
-                    confirmLabel: 'Allow',
-                    cancelLabel: 'Deny',
-                    extraOption: { label: 'Always Allow', onSelect: () => resolve('allow_always') },
-                    onConfirm: () => resolve('allow_once'),
-                    onCancel: () => resolve('reject_always'),
-                });
-            })
+                const inTerminal = {
+                    answer: new Promise((resolve) => {
+                        app.showConfirm({
+                            title: '⚠️  Confirm Action',
+                            message: [
+                                'The agent wants to execute:',
+                                '',
+                                `  ${toolCall.tool}`,
+                                `  ${shortTarget}`,
+                                '',
+                                telegramCredentials ? 'Allow this action? (or answer on Telegram)' : 'Allow this action?',
+                            ],
+                            confirmLabel: 'Allow',
+                            cancelLabel: 'Deny',
+                            extraOption: { label: 'Always Allow', onSelect: () => resolve('allow_always') },
+                            onConfirm: () => resolve('allow_once'),
+                            onCancel: () => resolve('reject_always'),
+                        });
+                    }),
+                    // Answered on the phone: take the dialog down without running either
+                    // callback, since the decision is already made and taken.
+                    withdraw: (winner) => app.dismissConfirm(`Answered on Telegram — ${winner}.`),
+                };
+                let onPhone = null;
+                if (telegramCredentials) {
+                    // Report a failure to *ask* once, in the terminal. Without this a
+                    // wrong chat id looks exactly like a phone nobody picked up.
+                    const telegram = new TelegramApproval(telegramCredentials, reason => app.notifyWarn(`Telegram: ${reason}`));
+                    onPhone = {
+                        answer: telegram
+                            .ask(target, toolCall.tool, true)
+                            .then(answer => (answer ? outcomeForAnswer(answer) : null))
+                            // A phone that cannot be reached is not a denial. Step aside and
+                            // let the terminal decide, however long that takes.
+                            .catch(() => null),
+                        withdraw: (winner) => telegram.withdraw(winner),
+                    };
+                }
+                const { answer } = await raceApproval(inTerminal, onPhone, outcome => describePermissionOutcome(outcome));
+                // Nobody answered — neither side could even ask. `classifyPermissionOutcome`
+                // fails closed on anything it does not recognise, and this is spelled
+                // out rather than left to that: a question that was never put must
+                // never read as a yes.
+                return answer ?? 'reject_once';
+            }
             : undefined;
         const result = await runAgent(enrichedTask, context, {
             dryRun,
@@ -367,12 +420,31 @@ export async function executeAgentTask(task, dryRun, ctx) {
         // Report stats to codeep.dev (fire-and-forget, only if github_id is set)
         const { getCurrentVersion } = await import('../utils/update.js');
         const sessionId = getCurrentSessionId();
-        // Auto-name from task if no display name set yet
-        if (!ctx.sessionDisplayName && ctx.setSessionDisplayName) {
-            const taskWords = task.replace(/\s+/g, ' ').trim().split(' ').slice(0, 5).join(' ');
-            ctx.setSessionDisplayName(taskWords.length > 48 ? taskWords.slice(0, 45) + '…' : taskWords);
+        // Auto-name from the task if no display name is set yet.
+        //
+        // The derived name is kept in a local rather than read back off ctx.
+        // makeCtx() copies sessionDisplayName by value, so setSessionDisplayName
+        // updates the module's variable while this object keeps the undefined it
+        // was built with — and reading it one line after calling the setter always
+        // returned nothing. Everything downstream then fell back to the session id,
+        // so a run reported itself to the dashboard, and announced itself on
+        // Telegram, as "session-2026-09-02-ddc1f13c" instead of its task.
+        const shortLabel = (text) => {
+            const words = text.replace(/\s+/g, ' ').trim().split(' ').slice(0, 5).join(' ');
+            return words.length > 48 ? words.slice(0, 45) + '…' : words;
+        };
+        // What THIS run was asked to do. The session name below is the first task's
+        // and stays put, which is right for a session and wrong for one run inside
+        // it: the second task in a session would otherwise announce itself on
+        // Telegram under the first one's name.
+        const runLabel = shortLabel(task) || sessionId;
+        let displayName = ctx.sessionDisplayName;
+        if (!displayName) {
+            displayName = shortLabel(task);
+            ctx.setSessionDisplayName?.(displayName);
         }
-        const displayName = ctx.sessionDisplayName || sessionId;
+        if (!displayName)
+            displayName = sessionId;
         syncSession({
             sessionId,
             sessionName: displayName,
@@ -384,6 +456,29 @@ export async function executeAgentTask(task, dryRun, ctx) {
         // even if the user switched model mid-session. Only this run's delta
         // (since tokenReportStart) is reported; the cumulative store is preserved.
         const costBreakdown = getCostBreakdown(tokenReportStart);
+        // Told once the run is over, and only when it ran long enough that you
+        // could plausibly have stopped watching. Awaited so the process does not
+        // exit from under the request, but never allowed to fail the run.
+        if (noticeCredentials) {
+            const elapsedMs = Date.now() - runStartedAt;
+            // Consumed once per run either way, so a phone-started run cannot leave
+            // the flag set for whatever the terminal does next.
+            const fromPhone = takeRunFromPhone();
+            // The one-minute threshold exists so a phone is not buzzed about work you
+            // watched finish. It has no business gating a run the phone itself asked
+            // for: that answer was wanted whether it took ten seconds or ten minutes,
+            // and withholding it leaves "Started —" as the last word.
+            if (fromPhone || shouldNotify(elapsedMs, true)) {
+                const payPerUse = costBreakdown.filter(entry => !isFlatFeeProvider(entry.provider));
+                await sendTelegramNotice(noticeCredentials, composeRunSummary({
+                    task: runLabel,
+                    elapsedMs,
+                    answer: fromPhone ? result.finalResponse : undefined,
+                    tokens: costBreakdown.reduce((sum, e) => sum + e.promptTokens + e.completionTokens, 0),
+                    costUsd: payPerUse.reduce((sum, e) => sum + e.estimatedCost, 0),
+                })).catch(() => false);
+            }
+        }
         const sharedFields = {
             sessionId,
             sessionName: displayName,

package/dist/renderer/commands/registry.js

@@ -190,6 +190,7 @@ export const COMMANDS = [
     { name: 'lang', description: 'Set response language', category: 'settings' },
     { name: 'grant', description: 'Grant write permission', category: 'settings' },
     { name: 'login', aliases: ['apikey'], description: 'Login with API key', category: 'settings' },
+    { name: 'telegram', description: 'Set up answering confirmations on your phone', category: 'settings' },
     { name: 'logout', description: 'Logout from provider', category: 'settings' },
     {
         name: 'profile',

package/dist/renderer/commands.js

@@ -6,6 +6,7 @@
  * to keep startup time low.
  */
 import { config, getCurrentProvider, getModelsForCurrentProvider, PROTOCOLS, LANGUAGES, setProvider, setApiKey, clearApiKey, getApiKey, saveSession, startNewSession, loadSession, listSessionsWithInfo, deleteSession, renameSession, setProjectPermission, saveProfile, loadProfile, applyProfile, listProfiles, deleteProfile, initializeAsProject, isManuallyInitializedProject, } from '../config/index.js';
+import { setTelegramToken, clearTelegramToken, hasTelegramToken } from '../utils/telegramCredentials.js';
 import { getProjectContext } from '../utils/project.js';
 import { getCurrentVersion } from '../utils/update.js';
 import { getProviderList, getProvider, modelSupportsReasoningEffort, reasoningParamsFor, availableReasoningTiers, resolveReasoningTier, REASONING_TIERS } from '../config/providers.js';
@@ -1084,6 +1085,39 @@ Format: use headers per category, only include categories where you found issues
             });
             break;
         }
+        case 'telegram': {
+            const enabled = config.get('telegramApproval') === true;
+            const chatId = String(config.get('telegramChatId') || '').trim();
+            const hasToken = await hasTelegramToken();
+            // Say what is missing before offering to fix it. Half-configured behaves
+            // exactly like off, and without this the user turns the switch on, sees
+            // nothing arrive, and has no way to tell which half is absent.
+            ctx.app.notify([
+                `Telegram approval: ${enabled ? 'on' : 'off'}`,
+                `Bot token: ${hasToken ? 'saved' : 'missing'}`,
+                `Chat ID: ${chatId || 'missing'}`,
+            ].join(' · '));
+            ctx.app.showSecret('Paste your Telegram bot token (from @BotFather)', async (token) => {
+                if (token === null)
+                    return;
+                if (!token.trim()) {
+                    await clearTelegramToken();
+                    ctx.app.notify('Telegram bot token removed.');
+                    return;
+                }
+                try {
+                    await setTelegramToken(token);
+                }
+                catch {
+                    ctx.app.notify('Could not save the token (secure storage unavailable).');
+                    return;
+                }
+                ctx.app.notify(chatId
+                    ? 'Token saved. Turn on "Answer confirmations on Telegram" in /settings.'
+                    : 'Token saved. Now set your chat ID in /settings — open https://api.telegram.org/bot<TOKEN>/getUpdates after messaging your bot.');
+            });
+            break;
+        }
         case 'login': {
             const providers = getProviderList();
             ctx.app.showLogin(providers.map(p => ({ id: p.id, name: p.name, description: p.description, subscribeUrl: p.subscribeUrl, noApiKey: p.noApiKey })), async (result) => {

package/dist/renderer/components/Settings.js

@@ -122,6 +122,37 @@ export const SETTINGS = [
             { value: 'always', label: 'Always' },
         ],
     },
+    {
+        key: 'telegramApproval',
+        label: 'Answer confirmations on Telegram',
+        getValue: () => config.get('telegramApproval') === true,
+        type: 'select',
+        // Booleans, not the strings 'true'/'false'. With strings the option never
+        // matches what getValue returns, so the row renders the raw value and the
+        // toggle writes a string that `=== true` can never satisfy — it reads Off
+        // forever while claiming to have been turned On.
+        options: [
+            { value: true, label: 'ON' },
+            { value: false, label: 'OFF' },
+        ],
+    },
+    {
+        key: 'telegramInbox',
+        label: 'Start tasks from Telegram',
+        getValue: () => config.get('telegramInbox') === true,
+        type: 'select',
+        // Booleans, for the same reason as the row above.
+        options: [
+            { value: true, label: 'ON' },
+            { value: false, label: 'OFF' },
+        ],
+    },
+    {
+        key: 'telegramChatId',
+        label: 'Telegram chat ID',
+        getValue: () => config.get('telegramChatId') || '',
+        type: 'text',
+    },
     {
         key: 'agentConfirmDeleteFile',
         label: 'Confirm: delete_file',

package/dist/renderer/index.d.ts

@@ -6,10 +6,16 @@
  * with diff-based rendering for flicker-free updates.
  */
 export { cursor, screen, fg, bg, style, styled, stripAnsi, visibleLength, truncate, wordWrap } from './ansi';
-export { Screen, Cell } from './Screen';
-export { Input, LineEditor, KeyEvent, KeyHandler } from './Input';
-export { App, AppOptions, Message } from './App';
-export { createBox, centerBox, BoxStyle, BoxOptions } from './components/Box';
-export { renderModal, renderHelpModal, renderListModal, ModalOptions } from './components/Modal';
+export { Screen } from './Screen';
+export type { Cell } from './Screen';
+export { Input, LineEditor } from './Input';
+export type { KeyEvent, KeyHandler } from './Input';
+export { App } from './App';
+export type { AppOptions, Message } from './App';
+export { createBox, centerBox } from './components/Box';
+export type { BoxStyle, BoxOptions } from './components/Box';
+export { renderModal, renderHelpModal, renderListModal } from './components/Modal';
+export type { ModalOptions } from './components/Modal';
 export { helpCategories, keyboardShortcuts } from './components/Help';
-export { renderStatusScreen, StatusInfo } from './components/Status';
+export { renderStatusScreen } from './components/Status';
+export type { StatusInfo } from './components/Status';

package/dist/renderer/layout.d.ts

@@ -145,6 +145,13 @@ export declare function statusBarRightHint(args: {
     unseenWhileScrolled: number;
     isStreaming: boolean;
     isLoading: boolean;
+    /**
+     * False while something else owns the whole screen — the agent timeline
+     * takes it over and returns before the transcript is drawn at all, so
+     * scrolling changes an offset nothing reads. Offering PgDn there asks for a
+     * keypress that does nothing and leaves the reader hunting for the key.
+     */
+    canScroll: boolean;
 }): string;
 /** The panel that currently owns keyboard focus, in priority order. */
 export type ActivePanel = 'pasteInfo' | 'permission' | 'sessionPicker' | 'confirm' | 'status' | 'help' | 'settings' | 'search' | 'export' | 'logout' | 'login' | 'menu' | 'autocomplete' | 'hunkPicker' | 'chat';

package/dist/renderer/layout.js

@@ -213,7 +213,7 @@ export function formatTokenCount(tokens) {
  * scrolled up — otherwise the hint depends on whether work is in flight.
  */
 export function statusBarRightHint(args) {
-    if (args.scrollOffset > 0 && args.unseenWhileScrolled > 0) {
+    if (args.canScroll && args.scrollOffset > 0 && args.unseenWhileScrolled > 0) {
         return `↓ ${args.unseenWhileScrolled} new · PgDn `;
     }
     return args.isStreaming || args.isLoading ? 'Esc to stop ' : '/help · ↑↓ history ';

package/dist/renderer/main.js

@@ -22,6 +22,10 @@ import { expandFileAndFolderMentions, expandGitMentions } from '../utils/mention
 import { expandWebMentions } from '../utils/webFetch.js';
 import { handleCommand as dispatchCommand } from './commands.js';
 import { logAppError } from '../utils/logger.js';
+import { loadTelegramInboxCredentials } from '../utils/telegramCredentials.js';
+import { attachTelegramInbox } from '../utils/telegramInbox.js';
+import { sharedUpdates } from '../utils/telegramUpdates.js';
+import { sendTelegramNotice } from '../utils/telegramNotify.js';
 import { executeAgentTask, runAgentTask, } from './agentExecution.js';
 // ─── Global state ─────────────────────────────────────────────────────────────
 let projectPath = process.cwd();
@@ -50,6 +54,8 @@ export function deriveSessionName(message) {
     return words.length > 48 ? words.slice(0, 45) + '…' : words;
 }
 let isAgentRunningFlag = false;
+/** Set once the phone is allowed to send instructions; null when it is not. */
+let telegramInbox = null;
 let agentAbortController = null;
 let pendingInteractiveContext = null;
 // ─── Context factory ──────────────────────────────────────────────────────────
@@ -66,8 +72,14 @@ function makeCtx() {
         isAgentRunning: () => isAgentRunningFlag,
         // A finished run may have switched branches — drop the cache so the next
         // header render re-reads it.
-        setAgentRunning: (v) => { isAgentRunningFlag = v; if (!v)
-            gitBranchCache = null; },
+        setAgentRunning: (v) => {
+            isAgentRunningFlag = v;
+            if (!v) {
+                gitBranchCache = null;
+                // A run just ended: hand over anything the phone sent while it was busy.
+                telegramInbox?.drain();
+            }
+        },
         setAbortController: (ctrl) => { agentAbortController = ctrl; },
         formatAddedFilesContext,
         handleCommand: (cmd, args) => dispatchCommand(cmd, args, makeCtx()),
@@ -749,6 +761,38 @@ Commands (in chat):
     welcomeLines.push('  /help  ·  Ctrl+L clear  ·  Esc cancel');
     app.addMessage({ role: 'welcome', content: welcomeLines.join('\n') });
     app.start();
+    // Let the phone send instructions, if it has been switched on. Started after
+    // app.start() so a prompt that arrives immediately has somewhere to land.
+    void (async () => {
+        const credentials = await loadTelegramInboxCredentials();
+        if (!credentials)
+            return;
+        telegramInbox = attachTelegramInbox(credentials, {
+            isBusy: () => isAgentRunningFlag,
+            submit: (text) => {
+                // Through the same door the input box uses, and shown in the transcript
+                // the same way — a run started from the phone must not be invisible to
+                // whoever is sitting at the terminal.
+                app.addMessage({ role: 'user', content: text });
+                app.notify('Telegram: running an instruction from your phone');
+                app.setLoading(true);
+                void handleSubmit(text).catch(err => {
+                    app.notify(`Error: ${err.message}`);
+                    app.setLoading(false);
+                });
+            },
+            reply: (text) => { void sendTelegramNotice(credentials, text); },
+        });
+        // Say it once when the poll starts failing, and once when it recovers. A
+        // webhook left on the bot, or a revoked token, otherwise looks exactly like
+        // a phone nobody has messaged.
+        sharedUpdates(credentials.botToken).observe(({ ok, detail }) => {
+            if (ok)
+                app.notify(`Telegram: ${detail}`);
+            else
+                app.notifyWarn(`Telegram: ${detail}`);
+        });
+    })();
     // Spawn MCP servers in the background. They register against the fixed
     // session id `codeep-tui` that runAgentTask passes into runAgent's
     // `mcpSessionId` — so the agent picks up `.codeep/mcp_servers.json`