codeep 2.25.0 → 3.1.0

package/dist/utils/approvalRace.d.ts

@@ -0,0 +1,33 @@
+/**
+ * One question, two places it can be answered, and exactly one answer.
+ *
+ * The terminal and the phone are both live at once. Whichever comes back first
+ * decides, and the other has to be taken down — a dialog left on screen after
+ * the phone answered would ask again, and a Telegram message left with three
+ * live buttons invites a tap that can no longer do anything.
+ *
+ * Kept apart from the agent loop and from the Telegram client because the part
+ * that goes wrong is the ordering, and the ordering can be tested with two
+ * promises and no network.
+ */
+export interface RaceParticipant<T> {
+    /** Resolves when this side is answered. Must never reject: a rejection here
+     *  would take down a run over a failure to *ask*, which is not the same thing
+     *  as a denial and must not be treated as one. */
+    answer: Promise<T | null>;
+    /** Take this side down because the other one won. Must be safe to call when
+     *  this side never started, and must not itself answer anything. */
+    withdraw: (winner: string) => void | Promise<void>;
+}
+/**
+ * Settle a question from whichever side answers first.
+ *
+ * A side that resolves `null` has declined to decide — it failed to send, or it
+ * was cancelled — and is not treated as a winner. When both come back null,
+ * nobody answered, and the caller decides what that means. It must not mean
+ * approval.
+ */
+export declare function raceApproval<T>(terminal: RaceParticipant<T>, remote: RaceParticipant<T> | null, describe: (answer: T) => string): Promise<{
+    answer: T | null;
+    from: 'terminal' | 'remote' | 'nobody';
+}>;

package/dist/utils/approvalRace.js

@@ -0,0 +1,58 @@
+/**
+ * One question, two places it can be answered, and exactly one answer.
+ *
+ * The terminal and the phone are both live at once. Whichever comes back first
+ * decides, and the other has to be taken down — a dialog left on screen after
+ * the phone answered would ask again, and a Telegram message left with three
+ * live buttons invites a tap that can no longer do anything.
+ *
+ * Kept apart from the agent loop and from the Telegram client because the part
+ * that goes wrong is the ordering, and the ordering can be tested with two
+ * promises and no network.
+ */
+/**
+ * Settle a question from whichever side answers first.
+ *
+ * A side that resolves `null` has declined to decide — it failed to send, or it
+ * was cancelled — and is not treated as a winner. When both come back null,
+ * nobody answered, and the caller decides what that means. It must not mean
+ * approval.
+ */
+export async function raceApproval(terminal, remote, describe) {
+    // With no remote side there is nothing to race and nothing to withdraw.
+    if (!remote) {
+        return { answer: await terminal.answer, from: 'terminal' };
+    }
+    // Not Promise.race. Race settles on the first promise to *finish*, including
+    // one that finished by declining — and the branch for the side that answers
+    // later still runs, consuming the answer into a result nobody reads. Each
+    // side instead gets one shot at a shared resolver, and only a real answer
+    // takes it.
+    return new Promise(resolve => {
+        let settled = false;
+        const claim = async (from, answer, loser) => {
+            // A null is a side stepping aside, not an answer. Let the other run on.
+            if (answer === null || settled)
+                return;
+            settled = true;
+            // Withdrawal is best-effort: the decision is already made, and a network
+            // failure closing the other side must not undo it or throw in its place.
+            try {
+                await loser.withdraw(describe(answer));
+            }
+            catch { /* already decided */ }
+            resolve({ answer, from });
+        };
+        void terminal.answer.then(a => claim('terminal', a, remote));
+        void remote.answer.then(a => claim('remote', a, terminal));
+        // Both declined. Nobody answered — which the caller must not read as
+        // approval, and which is why this returns a name for it rather than a null
+        // that looks like every other null.
+        void Promise.all([terminal.answer, remote.answer]).then(() => {
+            if (settled)
+                return;
+            settled = true;
+            resolve({ answer: null, from: 'nobody' });
+        });
+    });
+}

package/dist/utils/telegramApproval.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Answer a pending tool confirmation from a phone.
+ *
+ * The agent already parks on `onRequestPermission` and resumes when that promise
+ * settles. This adds a second way to settle it — nothing in the gate changes,
+ * and whichever answers first wins. A run that would have sat at an empty desk
+ * until someone came back can now continue.
+ *
+ * Telegram carries it because Telegram runs the infrastructure: the bot API is
+ * polled outbound from this machine, so there is no server to host, no inbound
+ * port, and no per-user cost. Long polling, never a webhook — a webhook needs a
+ * public address, which is precisely what we do not want to need. That is also
+ * why this works identically on Linux and Windows, where the Mac app's CloudKit
+ * route does not exist.
+ *
+ * SECURITY: a Telegram bot is reachable by anyone who learns its username. Every
+ * update is checked against the configured chat id before it can decide
+ * anything. Without that check a stranger who found the bot could approve a
+ * destructive command on someone else's machine. See `isFromOwner`.
+ *
+ * PRIVACY: the message carries the command line, so Telegram sees it. Stated in
+ * the docs rather than hidden — it is the reason this is opt-in.
+ *
+ * Ported from the Mac app's `TelegramApproval.swift`; the wire format, the token
+ * matching and the ownership check are deliberately identical, so a bug found on
+ * one side is findable on the other.
+ */
+/** What the phone sent back. Mirrors the three buttons the desktop offers. */
+export type TelegramAnswer = 'run' | 'skip' | 'cancel';
+import { type TelegramCredentials } from './telegramUpdates';
+export type { TelegramCredentials } from './telegramUpdates';
+export { nextOffset } from './telegramUpdates';
+/**
+ * The message text.
+ *
+ * Fenced, because a command containing underscores or asterisks would otherwise
+ * be mangled by Markdown parsing into something that is not what will run — and
+ * approving a command you were shown incorrectly is the one failure this whole
+ * feature must not have.
+ */
+export declare function composeMessage(command: string, toolName: string, isDestructive: boolean): string;
+/**
+ * Only the configured chat may decide.
+ *
+ * A bot's username is discoverable, so without this an unrelated Telegram user
+ * could approve a command on someone else's machine. Telegram sends the id as a
+ * number; it is compared as a string because that is how the user typed it.
+ */
+export declare function isFromOwner(callback: unknown, chatID: string): boolean;
+/**
+ * Split `run:<token>` into its parts.
+ *
+ * A callback whose token does not match the question in flight is ignored, and
+ * that is what stops a stale button — tapped after the run moved on — from
+ * answering a later question it was never shown.
+ */
+export declare function parseCallbackData(data: string): {
+    answer: TelegramAnswer;
+    token: string;
+} | null;
+/** The keyboard sent with the question. Shape pinned by a test — a renamed
+ *  callback_data field would leave three buttons that silently do nothing. */
+export declare function buildKeyboard(token: string): Record<string, unknown>;
+/**
+ * Telegram's three buttons, in the terms the agent's gate speaks.
+ *
+ * The gate has four outcomes and `classifyPermissionOutcome` fails closed on
+ * anything it does not recognise, so this must be exhaustive rather than
+ * defaulted — a typo here would read as a denial, which is safe but silently
+ * wrong, and the user would tap Run and watch nothing happen.
+ */
+export declare function outcomeForAnswer(answer: TelegramAnswer): 'allow_once' | 'reject_once' | 'reject_always';
+/**
+ * How a decision reads on the other device, once it is too late to change it.
+ *
+ * The withdrawn side says what happened rather than just going blank, so
+ * someone reaching for their phone a moment late learns what they missed
+ * instead of finding a message that silently lost its buttons.
+ */
+export declare function describePermissionOutcome(outcome: string): string;
+/**
+ * Telegram's failure, phrased for someone who is setting this up.
+ *
+ * `chat not found` is the one people actually hit: the id belongs to a
+ * conversation with a *different* bot, or the bot has never been messaged from
+ * that chat at all. Repeating the API's words and adding what they mean beats
+ * a generic failure that sends them back to the docs.
+ */
+export declare function describeApiError(status: number, json: Record<string, unknown> | null): string;
+export declare class TelegramApproval {
+    private readonly credentials;
+    private outstanding;
+    /** Set while a question is open; called to stop listening once it closes. */
+    private unlisten;
+    /** Called once when the question could not be put at all. Not for a missing
+     *  answer — only for a failure to ask. */
+    private readonly onProblem?;
+    constructor(credentials: TelegramCredentials, onProblem?: (reason: string) => void);
+    /**
+     * Send the question and wait.
+     *
+     * Resolves `null` when no answer arrived — the terminal was used instead, the
+     * caller aborted, or Telegram could not be reached. **A null is never
+     * approval**: the caller keeps its own gate and decides for itself.
+     */
+    ask(command: string, toolName: string, isDestructive: boolean, signal?: AbortSignal): Promise<TelegramAnswer | null>;
+    /**
+     * The terminal answered first. Close the question on the phone so nobody taps
+     * a button that would do nothing, and say where it was decided.
+     */
+    withdraw(decidedInTerminal: string): Promise<void>;
+    /**
+     * Why the last call failed, in Telegram's own words.
+     *
+     * Kept because swallowing it made a misconfiguration indistinguishable from
+     * silence: a wrong chat id answers `chat not found` on the very first send,
+     * and reporting nothing left the user watching a phone that was never going
+     * to ring.
+     */
+    private lastError;
+    private post;
+    private sendQuestion;
+    private edit;
+    private handle;
+}

package/dist/utils/telegramApproval.js

@@ -0,0 +1,308 @@
+/**
+ * Answer a pending tool confirmation from a phone.
+ *
+ * The agent already parks on `onRequestPermission` and resumes when that promise
+ * settles. This adds a second way to settle it — nothing in the gate changes,
+ * and whichever answers first wins. A run that would have sat at an empty desk
+ * until someone came back can now continue.
+ *
+ * Telegram carries it because Telegram runs the infrastructure: the bot API is
+ * polled outbound from this machine, so there is no server to host, no inbound
+ * port, and no per-user cost. Long polling, never a webhook — a webhook needs a
+ * public address, which is precisely what we do not want to need. That is also
+ * why this works identically on Linux and Windows, where the Mac app's CloudKit
+ * route does not exist.
+ *
+ * SECURITY: a Telegram bot is reachable by anyone who learns its username. Every
+ * update is checked against the configured chat id before it can decide
+ * anything. Without that check a stranger who found the bot could approve a
+ * destructive command on someone else's machine. See `isFromOwner`.
+ *
+ * PRIVACY: the message carries the command line, so Telegram sees it. Stated in
+ * the docs rather than hidden — it is the reason this is opt-in.
+ *
+ * Ported from the Mac app's `TelegramApproval.swift`; the wire format, the token
+ * matching and the ownership check are deliberately identical, so a bug found on
+ * one side is findable on the other.
+ */
+const ANSWERS = ['run', 'skip', 'cancel'];
+import { sharedUpdates } from './telegramUpdates.js';
+export { nextOffset } from './telegramUpdates.js';
+/** Longest command we put in a message. Telegram caps at 4096 for the whole
+ *  text; this keeps room for the heading and the fences, and a command longer
+ *  than this is not something anyone reads off a phone anyway. */
+const MAX_COMMAND_CHARS = 300;
+/**
+ * The message text.
+ *
+ * Fenced, because a command containing underscores or asterisks would otherwise
+ * be mangled by Markdown parsing into something that is not what will run — and
+ * approving a command you were shown incorrectly is the one failure this whole
+ * feature must not have.
+ */
+export function composeMessage(command, toolName, isDestructive) {
+    const head = isDestructive
+        ? '⚠️ Codeep wants to run a destructive tool'
+        : 'Codeep needs approval';
+    const trimmed = command.length > MAX_COMMAND_CHARS
+        ? command.slice(0, MAX_COMMAND_CHARS - 1) + '…'
+        : command;
+    // A fence inside the command would close ours early and leak the rest as
+    // prose. Neutralise it rather than trusting the input.
+    const safe = trimmed.replace(/```/g, "'''");
+    return `${head}\n\n\`${toolName}\`\n\n\`\`\`\n${safe}\n\`\`\``;
+}
+/**
+ * Only the configured chat may decide.
+ *
+ * A bot's username is discoverable, so without this an unrelated Telegram user
+ * could approve a command on someone else's machine. Telegram sends the id as a
+ * number; it is compared as a string because that is how the user typed it.
+ */
+export function isFromOwner(callback, chatID) {
+    if (!chatID)
+        return false;
+    const message = callback?.message;
+    const chat = message?.chat;
+    const id = chat?.id;
+    if (typeof id === 'number')
+        return String(id) === chatID;
+    if (typeof id === 'string')
+        return id === chatID;
+    return false;
+}
+/**
+ * Split `run:<token>` into its parts.
+ *
+ * A callback whose token does not match the question in flight is ignored, and
+ * that is what stops a stale button — tapped after the run moved on — from
+ * answering a later question it was never shown.
+ */
+export function parseCallbackData(data) {
+    const separator = data.indexOf(':');
+    if (separator <= 0)
+        return null;
+    const answer = data.slice(0, separator);
+    const token = data.slice(separator + 1);
+    if (!token)
+        return null;
+    if (!ANSWERS.includes(answer))
+        return null;
+    return { answer: answer, token };
+}
+/** The keyboard sent with the question. Shape pinned by a test — a renamed
+ *  callback_data field would leave three buttons that silently do nothing. */
+export function buildKeyboard(token) {
+    return {
+        inline_keyboard: [[
+                { text: 'Run', callback_data: `run:${token}` },
+                { text: 'Skip', callback_data: `skip:${token}` },
+                { text: 'Cancel', callback_data: `cancel:${token}` },
+            ]],
+    };
+}
+/**
+ * Telegram's three buttons, in the terms the agent's gate speaks.
+ *
+ * The gate has four outcomes and `classifyPermissionOutcome` fails closed on
+ * anything it does not recognise, so this must be exhaustive rather than
+ * defaulted — a typo here would read as a denial, which is safe but silently
+ * wrong, and the user would tap Run and watch nothing happen.
+ */
+export function outcomeForAnswer(answer) {
+    switch (answer) {
+        case 'run': return 'allow_once';
+        // Skip this one and carry on — not a standing refusal.
+        case 'skip': return 'reject_once';
+        // Stop asking. The phone has no "always allow": granting a blanket
+        // permission is a decision that belongs at the keyboard, where you can see
+        // what you are granting it to.
+        case 'cancel': return 'reject_always';
+    }
+}
+/**
+ * How a decision reads on the other device, once it is too late to change it.
+ *
+ * The withdrawn side says what happened rather than just going blank, so
+ * someone reaching for their phone a moment late learns what they missed
+ * instead of finding a message that silently lost its buttons.
+ */
+export function describePermissionOutcome(outcome) {
+    switch (outcome) {
+        case 'allow_once': return 'allowed';
+        case 'allow_always': return 'allowed, and always from now on';
+        case 'reject_once': return 'skipped';
+        case 'reject_always': return 'denied';
+        default: return 'decided';
+    }
+}
+/**
+ * Telegram's failure, phrased for someone who is setting this up.
+ *
+ * `chat not found` is the one people actually hit: the id belongs to a
+ * conversation with a *different* bot, or the bot has never been messaged from
+ * that chat at all. Repeating the API's words and adding what they mean beats
+ * a generic failure that sends them back to the docs.
+ */
+export function describeApiError(status, json) {
+    const description = typeof json?.description === 'string' ? json.description : '';
+    if (/chat not found/i.test(description)) {
+        return 'Telegram says "chat not found" — the chat ID does not belong to a conversation with this bot. Message the bot from that chat, then read the ID back from getUpdates.';
+    }
+    if (/bot was blocked/i.test(description)) {
+        return 'Telegram says the bot was blocked by this chat. Unblock it and try again.';
+    }
+    if (status === 401) {
+        return 'Telegram rejected the bot token. Re-enter it with /telegram.';
+    }
+    return description ? `Telegram refused the message: ${description}` : `Telegram returned HTTP ${status}.`;
+}
+// ─── The client ───────────────────────────────────────────────────────────────
+const API = 'https://api.telegram.org';
+/** Sending a message or editing one — no long poll lives here any more. */
+const REQUEST_TIMEOUT_MS = 15_000;
+export class TelegramApproval {
+    credentials;
+    outstanding = null;
+    /** Set while a question is open; called to stop listening once it closes. */
+    unlisten = null;
+    /** Called once when the question could not be put at all. Not for a missing
+     *  answer — only for a failure to ask. */
+    onProblem;
+    constructor(credentials, onProblem) {
+        this.credentials = credentials;
+        this.onProblem = onProblem;
+    }
+    /**
+     * Send the question and wait.
+     *
+     * Resolves `null` when no answer arrived — the terminal was used instead, the
+     * caller aborted, or Telegram could not be reached. **A null is never
+     * approval**: the caller keeps its own gate and decides for itself.
+     */
+    async ask(command, toolName, isDestructive, signal) {
+        const token = randomToken();
+        const messageID = await this.sendQuestion(composeMessage(command, toolName, isDestructive), token);
+        if (messageID === null) {
+            // Say it once, here, rather than leaving the caller to guess from a null
+            // that also means "answered elsewhere" and "cancelled".
+            this.onProblem?.(this.lastError ?? 'the question could not be sent');
+            return null;
+        }
+        return new Promise(resolve => {
+            let settled = false;
+            const finish = (answer) => {
+                if (settled)
+                    return;
+                settled = true;
+                this.outstanding = null;
+                this.unlisten?.();
+                this.unlisten = null;
+                resolve(answer);
+            };
+            this.outstanding = { token, messageID, resolve: finish };
+            if (signal) {
+                if (signal.aborted) {
+                    finish(null);
+                    return;
+                }
+                signal.addEventListener('abort', () => finish(null), { once: true });
+            }
+            // Listen on the bot's one poller rather than opening a second. Two
+            // cursors on the same bot silently eat each other's updates.
+            this.unlisten = sharedUpdates(this.credentials.botToken)
+                .subscribe('callback_query', callback => this.handle(callback));
+        });
+    }
+    /**
+     * The terminal answered first. Close the question on the phone so nobody taps
+     * a button that would do nothing, and say where it was decided.
+     */
+    async withdraw(decidedInTerminal) {
+        const pending = this.outstanding;
+        if (!pending)
+            return;
+        this.outstanding = null;
+        this.unlisten?.();
+        this.unlisten = null;
+        pending.resolve(null);
+        await this.edit(pending.messageID, `Answered in the terminal — ${decidedInTerminal}.`);
+    }
+    // ── plumbing ──
+    /**
+     * Why the last call failed, in Telegram's own words.
+     *
+     * Kept because swallowing it made a misconfiguration indistinguishable from
+     * silence: a wrong chat id answers `chat not found` on the very first send,
+     * and reporting nothing left the user watching a phone that was never going
+     * to ring.
+     */
+    lastError = null;
+    async post(method, body) {
+        try {
+            const response = await fetch(`${API}/bot${this.credentials.botToken}/${method}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+            const json = await response.json().catch(() => null);
+            if (!response.ok || json?.ok === false) {
+                this.lastError = describeApiError(response.status, json);
+                return null;
+            }
+            this.lastError = null;
+            return json;
+        }
+        catch (error) {
+            // Network, timeout, malformed JSON. Still "no answer from the phone",
+            // but now it can say which.
+            this.lastError = error?.message || 'could not reach Telegram';
+            return null;
+        }
+    }
+    async sendQuestion(text, token) {
+        const json = await this.post('sendMessage', {
+            chat_id: this.credentials.chatID,
+            text,
+            parse_mode: 'Markdown',
+            reply_markup: buildKeyboard(token),
+        });
+        const result = json?.result;
+        return typeof result?.message_id === 'number' ? result.message_id : null;
+    }
+    async edit(messageID, text) {
+        await this.post('editMessageText', {
+            chat_id: this.credentials.chatID,
+            message_id: messageID,
+            text,
+        });
+    }
+    async handle(callback) {
+        const pending = this.outstanding;
+        if (!pending)
+            return;
+        if (!isFromOwner(callback, this.credentials.chatID))
+            return;
+        const data = callback.data;
+        if (typeof data !== 'string')
+            return;
+        const parsed = parseCallbackData(data);
+        if (!parsed || parsed.token !== pending.token)
+            return;
+        this.outstanding = null;
+        this.unlisten?.();
+        this.unlisten = null;
+        const id = callback.id;
+        if (typeof id === 'string')
+            await this.post('answerCallbackQuery', { callback_query_id: id });
+        await this.edit(pending.messageID, `${capitalise(parsed.answer)} — sent to your terminal.`);
+        pending.resolve(parsed.answer);
+    }
+}
+function randomToken() {
+    return Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+function capitalise(value) {
+    return value.charAt(0).toUpperCase() + value.slice(1);
+}

package/dist/utils/telegramCredentials.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Where the Telegram bot token lives, and how the two halves are read back.
+ *
+ * Deliberately separate from `telegramApproval.ts`, which stays free of I/O so
+ * the parts that decide whether a stranger may approve your commands can be
+ * tested without a keychain, a config file, or a network.
+ *
+ * The token goes in the OS keychain — it *is* the bot, and anyone holding it can
+ * send messages as you. The chat id is ordinary config: it names a conversation
+ * and is useless on its own.
+ */
+import type { TelegramCredentials } from './telegramApproval.js';
+export declare function setTelegramToken(token: string): Promise<void>;
+export declare function clearTelegramToken(): Promise<void>;
+export declare function hasTelegramToken(): Promise<boolean>;
+/**
+ * Both halves, or nothing.
+ *
+ * Returns null when the feature is off or either half is missing. Half-
+ * configured must behave exactly like off: a token with no chat id would send
+ * the question nowhere, and a chat id with no token cannot send at all — and
+ * both would otherwise stall a run waiting for an answer that was never asked.
+ */
+export declare function loadTelegramCredentials(): Promise<TelegramCredentials | null>;
+/**
+ * The same pair, for the inbox, behind its own switch.
+ *
+ * Not folded into the call above: someone can want the phone to be told a run
+ * finished without wanting the phone to be able to start one, and the reverse.
+ * One flag serving both would make turning either off turn both off.
+ */
+export declare function loadTelegramInboxCredentials(): Promise<TelegramCredentials | null>;

package/dist/utils/telegramCredentials.js

@@ -0,0 +1,68 @@
+/**
+ * Where the Telegram bot token lives, and how the two halves are read back.
+ *
+ * Deliberately separate from `telegramApproval.ts`, which stays free of I/O so
+ * the parts that decide whether a stranger may approve your commands can be
+ * tested without a keychain, a config file, or a network.
+ *
+ * The token goes in the OS keychain — it *is* the bot, and anyone holding it can
+ * send messages as you. The chat id is ordinary config: it names a conversation
+ * and is useless on its own.
+ */
+import { config } from '../config/index.js';
+import { createSecureStorage } from './keychain.js';
+/**
+ * The keychain is keyed by provider id, and this is not a provider.
+ *
+ * Reusing the store rather than adding a second keychain integration is the
+ * point; going through `setApiKey` is not, because that also records the id in
+ * `configuredProviderIds` and Telegram would start appearing in provider lists
+ * as something you could log out of.
+ */
+const CREDENTIAL_ID = 'telegram';
+export async function setTelegramToken(token) {
+    await createSecureStorage(config).setApiKey(CREDENTIAL_ID, token.trim());
+}
+export async function clearTelegramToken() {
+    await createSecureStorage(config).deleteApiKey(CREDENTIAL_ID);
+}
+export async function hasTelegramToken() {
+    return !!(await createSecureStorage(config).getApiKey(CREDENTIAL_ID));
+}
+/**
+ * Both halves, or nothing.
+ *
+ * Returns null when the feature is off or either half is missing. Half-
+ * configured must behave exactly like off: a token with no chat id would send
+ * the question nowhere, and a chat id with no token cannot send at all — and
+ * both would otherwise stall a run waiting for an answer that was never asked.
+ */
+export async function loadTelegramCredentials() {
+    // Strictly true. A truthy check would accept the string 'true' left behind
+    // by an earlier build whose toggle wrote strings — and then the feature
+    // would be live while the settings row read OFF.
+    if (config.get('telegramApproval') !== true)
+        return null;
+    return readCredentials();
+}
+/**
+ * The same pair, for the inbox, behind its own switch.
+ *
+ * Not folded into the call above: someone can want the phone to be told a run
+ * finished without wanting the phone to be able to start one, and the reverse.
+ * One flag serving both would make turning either off turn both off.
+ */
+export async function loadTelegramInboxCredentials() {
+    if (config.get('telegramInbox') !== true)
+        return null;
+    return readCredentials();
+}
+async function readCredentials() {
+    const chatID = String(config.get('telegramChatId') || '').trim();
+    if (!chatID)
+        return null;
+    const botToken = await createSecureStorage(config).getApiKey(CREDENTIAL_ID);
+    if (!botToken)
+        return null;
+    return { botToken, chatID };
+}