loopengine 0.3.0 → 0.3.2

package/dist/web/agents-config-page.js

@@ -860,7 +860,7 @@ ${consoleShellScript}
     started: ['good', 'Started a run'], filtered: ['', 'Skipped by the filter'], duplicate: ['', 'A retry, skipped'],
     busy: ['', 'Already running'], rejected: ['bad', 'Signature check failed'], invalid: ['bad', 'Couldn' + String.fromCharCode(8217) + 't start'], error: ['bad', 'Failed'],
   };
-  var HOOK_SENDERS = { stripe: 'Stripe', github: 'GitHub', shopify: 'Shopify', standard: 'Standard Webhooks' };
+  var HOOK_SENDERS = { stripe: 'Stripe', github: 'GitHub', shopify: 'Shopify', standard: 'Standard Webhooks', custom: 'your app' };
 
   function hookRowHtml(t) {
     var last = (t.deliveries || []).slice(0, 3).map(function (d) {
@@ -870,20 +870,30 @@ ${consoleShellScript}
     }).join('');
     var rules = [];
     if (t.verify) rules.push(t.verify.sender === 'custom'
-      ? 'checks the signature in ' + escapeHtml(t.verify.header) + ' (' + escapeHtml(t.verify.algorithm || 'sha256') + ', ' + escapeHtml(t.verify.encoding || 'hex') + ')'
+      ? 'checks the signature in ' + escapeHtml(t.verify.header || '(header not set yet)') + ' (' + escapeHtml(t.verify.algorithm || 'sha256') + ', ' + escapeHtml(t.verify.encoding || 'hex') + ')'
       : 'checks the ' + escapeHtml(HOOK_SENDERS[t.verify.sender] || t.verify.sender) + ' signature');
     if (t.filter) rules.push('only when ' + escapeHtml(t.filter.path) + ' is ' + t.filter.values.map(escapeHtml).join(' or '));
     if (t.mapping) rules.push(Object.keys(t.mapping).map(function (p) { return escapeHtml(p) + ' ' + String.fromCharCode(8592) + ' ' + escapeHtml(t.mapping[p]); }).join(', '));
     if (t.payload_param) rules.push('the whole payload goes to ' + escapeHtml(t.payload_param));
     if (t.notify) rules.push('sends each result to you');
     if (t.callback_url) rules.push('reports to ' + escapeHtml(t.callback_url));
+    // Made by the workflow planner without its secret: it turns on once
+    // the sender's signing secret is added.
+    var needsSecret = t.verify && !t.verify.secret_set;
     return '<div class="workflow-hook" data-trigger="' + escapeHtml(t.trigger_id) + '">' +
       '<div style="display:flex;justify-content:space-between;gap:8px;flex-wrap:wrap;align-items:baseline"><strong>' + escapeHtml(t.name) + '</strong>' +
-        '<code class="hint">/hooks/workflows/' + escapeHtml(t.token_hint) + '</code>' + (t.enabled ? '' : ' <span class="le-pill">Off</span>') + '</div>' +
+        '<code class="hint">/hooks/workflows/' + escapeHtml(t.token_hint) + '</code>' + (needsSecret ? ' <span class="le-pill warn">Needs its signing secret</span>' : t.enabled ? '' : ' <span class="le-pill">Off</span>') + '</div>' +
       (rules.length ? '<p class="hint" style="margin:2px 0">' + rules.join(' ' + String.fromCharCode(183) + ' ') + '</p>' : '') +
+      (needsSecret
+        ? '<div class="workflow-param-row" style="margin:4px 0">' +
+            (t.verify.sender === 'custom' && !t.verify.header ? '<input class="hook-secret-header" placeholder="Signature header, e.g. X-Signature">' : '') +
+            '<input class="hook-secret-input" type="password" autocomplete="off" placeholder="' + escapeHtml(t.verify.sender === 'custom' ? 'The secret your app signs with' : 'The signing secret ' + (HOOK_SENDERS[t.verify.sender] || 'the sender') + ' shows') + '" style="flex:1">' +
+            '<button type="button" class="primary hook-secret-save">Add and turn on</button></div>' +
+          '<p class="hint" style="margin:0">Paste the URL into the sender first. Lost it? New URL makes another.</p>'
+        : '') +
       (last ? '<ul class="schedule-history">' + last + '</ul>' : '<p class="hint" style="margin:2px 0">No deliveries yet.</p>') +
       '<div style="display:flex;gap:6px;flex-wrap:wrap;margin-top:4px">' +
-        '<button type="button" class="hook-toggle">' + (t.enabled ? 'Turn off' : 'Turn on') + '</button>' +
+        (needsSecret ? '' : '<button type="button" class="hook-toggle">' + (t.enabled ? 'Turn off' : 'Turn on') + '</button>') +
         '<button type="button" class="hook-rotate">New URL</button>' +
         '<button type="button" class="delete-btn hook-delete">Delete</button></div></div>';
   }
@@ -930,11 +940,14 @@ ${consoleShellScript}
     workflowEditing = true;
     box.hidden = false;
     var base = '/agents/' + encodeURIComponent(name) + '/workflows/' + encodeURIComponent(w.id) + '/triggers';
+    var hooksById = {};
     function render(shownUrl) {
       box.innerHTML = '<p class="hint" style="margin:0">Loading' + String.fromCharCode(8230) + '</p>';
       fetchJsonRetryOnce(base).then(function (r) {
         if (!r.ok) { box.innerHTML = '<p class="error">' + escapeHtml(r.body.error || 'Could not load webhooks') + '</p>'; return; }
         var list = r.body.triggers || [];
+        hooksById = {};
+        list.forEach(function (t) { hooksById[t.trigger_id] = t; });
         box.innerHTML = '<h4 style="margin:10px 0 4px">Webhooks</h4>' +
           '<p class="hint" style="margin:0 0 6px">A secret URL an outside service (Stripe, GitHub, a form, monitoring) posts its events to; each one starts a run.</p>' +
           (shownUrl ? hookUrlHtml(shownUrl) : '') +
@@ -953,9 +966,25 @@ ${consoleShellScript}
       for (var i = 0; i < rows.length; i++) {
         (function (row) {
           var id = row.dataset.trigger;
-          row.querySelector('.hook-toggle').addEventListener('click', function (ev) {
+          var toggle = row.querySelector('.hook-toggle');
+          if (toggle) toggle.addEventListener('click', function (ev) {
             act(id, '', { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ enabled: ev.currentTarget.textContent === 'Turn on' }) });
           });
+          var saveSecret = row.querySelector('.hook-secret-save');
+          if (saveSecret) saveSecret.addEventListener('click', function () {
+            var t = hooksById[id];
+            var secret = row.querySelector('.hook-secret-input').value.trim();
+            if (!secret || !t) return;
+            var verify = { sender: t.verify.sender, secret: secret };
+            if (t.verify.sender === 'custom') {
+              var headerInput = row.querySelector('.hook-secret-header');
+              verify.header = headerInput ? headerInput.value.trim() : t.verify.header;
+              verify.algorithm = t.verify.algorithm || 'sha256';
+              verify.encoding = t.verify.encoding || 'hex';
+              if (t.verify.prefix) verify.prefix = t.verify.prefix;
+            }
+            act(id, '', { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ verify: verify, enabled: true }) });
+          });
           row.querySelector('.hook-rotate').addEventListener('click', function (ev) {
             var btn = ev.currentTarget;
             if (btn.dataset.confirming !== '1') { btn.dataset.confirming = '1'; btn.textContent = 'Click again: the old URL stops working'; return; }
@@ -1576,17 +1605,34 @@ ${consoleShellScript}
     return '<strong>Nowhere yet.</strong> Set up an app below; the first messaging app you save becomes primary.' + fallback + rule;
   }
 
-  // Slack only: whether replies in a request's thread are answered. On
+  // Slack and Telegram: whether replies to a request are answered. On
   // unless turned off; locked on LoopEngine Cloud's free plan.
-  function renderConversationsField(n, f) {
+  function renderConversationsField(n, f, app) {
     var free = n.plan === 'free';
     var on = !free && f.conversations !== false;
+    var where = app === 'telegram' ? 'Answer replies to a request' : 'Answer replies in a request&#39;s thread';
     return '<div class="body-field" style="margin:4px 0 0">' +
-      '<label class="tool-picker-item" style="border:0;padding:0;justify-content:flex-start"><input type="checkbox" name="conversations" id="slackConversations"' + (on ? ' checked' : '') + (free ? ' disabled' : '') + '> ' +
-      'Answer replies in a request&#39;s thread' + (free ? ' <span class="le-pill accent">Pro</span>' : '') + '</label>' +
+      '<label class="tool-picker-item" style="border:0;padding:0;justify-content:flex-start"><input type="checkbox" name="conversations" id="' + app + 'Conversations"' + (on ? ' checked' : '') + (free ? ' disabled' : '') + '> ' +
+      where + (free ? ' <span class="le-pill accent">Pro</span>' : '') + '</label>' +
       '<p class="hint" style="margin:2px 0 0">' + (free
-        ? 'Talking a request through in Slack needs LoopEngine Pro. Approve and Deny buttons work on every plan.'
-        : 'People can ask the agent about a request in its thread, and it answers there. Approvers (below) can also decide it there.') + '</p></div>';
+        ? 'Talking a request through in ' + CHANNEL_TITLES[app] + ' needs LoopEngine Pro. Approve and Deny buttons work on every plan.'
+        : (app === 'telegram'
+          ? 'People can reply to a request to ask the agent about it, and it answers there. Approvers (below) can also decide it that way.'
+          : 'People can ask the agent about a request in its thread, and it answers there. Approvers (below) can also decide it there.')) + '</p></div>';
+  }
+
+  // Slack and Telegram: whether a DM to the bot, or a mention of it,
+  // runs the agent. Off unless turned on; locked on the free plan.
+  function renderJobsField(n, f, app) {
+    var free = n.plan === 'free';
+    var on = !free && f.jobs === true;
+    var how = app === 'telegram'
+      ? 'A private chat with the bot, or @mentioning it in a group, runs the agent on that message, and it answers with a reply. Replying to its answer carries the job on. In a group the bot only sees mentions when it&#39;s an admin or its privacy mode is off (@BotFather, /setprivacy); replies to its messages always reach it.'
+      : 'A DM to the bot, or @mentioning it in a channel, runs the agent on that message, and it answers in a thread. Replies in the thread carry the job on.';
+    return '<div class="body-field" style="margin:4px 0 0">' +
+      '<label class="tool-picker-item" style="border:0;padding:0;justify-content:flex-start"><input type="checkbox" name="jobs" id="' + app + 'Jobs"' + (on ? ' checked' : '') + (free ? ' disabled' : '') + '> ' +
+      'Start jobs from messages' + (free ? ' <span class="le-pill accent">Pro</span>' : '') + '</label>' +
+      '<p class="hint" style="margin:2px 0 0">' + (free ? 'Starting jobs from ' + CHANNEL_TITLES[app] + ' needs LoopEngine Pro.' : how + ' Only approvers (below) can give it jobs; with none listed, anyone in its ' + (app === 'telegram' ? 'chat' : 'channel') + ' can, but not by direct message. A request it needs approved waits in the same thread.') + '</p></div>';
   }
 
   // A secret's state at a glance: a pill by the label, and a placeholder
@@ -1631,7 +1677,15 @@ ${consoleShellScript}
           '</ol></details>' +
         secretField(n, 'telegram', 'Bot token') +
         '<label>Chat ID <span class="hint">(a group or channel id like -1001234567890, or @channelname)</span><input name="chatId" placeholder="-1001234567890" value="' + escapeHtml(f.chatId || '') + '"></label>' +
-        '<p class="hint" style="margin:0">Each message links to a page where the person approves, denies or answers; there are no buttons in Telegram yet.</p>';
+        '<div class="body-field" style="margin:0">Replies and buttons' +
+          '<p class="hint" style="margin:2px 0 6px">' + (n.telegram && n.telegram.webhookSet
+            ? 'Telegram sends the bot&#39;s messages and button clicks to this server, so requests have Approve and Deny buttons and replies reach the agent.'
+            : 'Each message links to a page where the person approves, denies or answers. Connect the bot to this server (save the bot token first) to add Approve and Deny buttons and let people reply.') + '</p>' +
+          '<span style="display:flex;gap:6px;flex-wrap:wrap"><button type="button" id="telegramWebhookSet"' + (n.secretsSet && n.secretsSet.telegram ? '' : ' disabled') + '>' + (n.telegram && n.telegram.webhookSet ? 'Connect again' : 'Connect the bot') + '</button>' +
+          (n.telegram && n.telegram.webhookSet ? '<button type="button" id="telegramWebhookCheck">Check connection</button>' : '') + '</span>' +
+          '<div class="hint" id="telegramWebhookResult"></div></div>' +
+        renderConversationsField(n, f, 'telegram') +
+        renderJobsField(n, f, 'telegram');
     }
     if (channel === 'slack') {
       return '<details class="slack-step"' + (n.secretsSet && n.secretsSet.slack ? '' : ' open') + '><summary>Create the Slack app (once)</summary>' +
@@ -1652,7 +1706,8 @@ ${consoleShellScript}
           (n.slack && n.slack.signingSecretSet ? 'buttons and replies in Slack are on' : 'needed for buttons and replies in Slack; without it, messages only carry the approval link') + ')</span>' +
           '<input type="password" name="signingSecret" autocomplete="off" placeholder="' + escapeHtml(secretPlaceholder(n.slack && n.slack.signingSecretSet, 'Paste the Signing Secret')) + '"></label>' +
         '<p class="hint" style="margin:0">Buttons send their clicks to <code id="slackInteractivityUrl"></code> (the manifest already points there).</p>' +
-        renderConversationsField(n, f) +
+        renderConversationsField(n, f, 'slack') +
+        renderJobsField(n, f, 'slack') +
         '<p class="hint" style="margin:0" id="slackEventsNote"></p>';
     }
     if (channel === 'lark') {
@@ -1757,40 +1812,48 @@ ${consoleShellScript}
     return html;
   }
 
-  // Slack only: the people who can decide by replying in a request's
-  // thread, and whose button clicks count once any are listed. Shown once
-  // a Slack connection is saved; they only act while Slack is primary.
-  function renderApproversHtml(n) {
-    var slack = connectionFor(n, 'slack');
-    if (n.source === 'code' || !slack) return '';
-    var approvers = slack.approvers || [];
+  // Slack and Telegram: the people who can decide by replying to a
+  // request, whose button clicks count once any are listed, and who can
+  // give the agent jobs. Shown once that app's connection is saved.
+  function renderApproversHtml(n, app) {
+    var conn = connectionFor(n, app);
+    if (n.source === 'code' || !conn) return '';
+    var title = CHANNEL_TITLES[app];
+    var approvers = conn.approvers || [];
     var rows = approvers.map(function (a) {
       return '<tr><td>' + escapeHtml(a.name || a.user) + '</td><td><code>' + escapeHtml(a.user) + '</code></td>' +
         '<td><button type="button" class="delete-btn approver-remove" data-user="' + escapeHtml(a.user) + '"' + (n.canSave === false ? ' disabled' : '') + '>Remove</button></td></tr>';
     }).join('');
-    return '<section id="approversSection"><h3>Slack approvers</h3>' +
-      (n.primary !== 'slack' ? '<p class="hint" style="margin:0 0 8px">Slack isn&#39;t primary, so these take effect once it is.</p>' : '') +
-      '<p class="muted" style="margin:0 0 10px">People who can approve, deny, change or answer a request by replying in its thread, like &ldquo;yes, go ahead&rdquo; or &ldquo;make it $40&rdquo;. A plain &ldquo;yes&rdquo; runs it; a reply that&#39;s less clear (&ldquo;sure, send it&rdquo;, &ldquo;yes but check the amount&rdquo;) shows exactly what will run with a Confirm button first, and a change is shown to approve first. Once anyone is listed, only approvers&#39; button clicks count too. Anyone in the channel can still ask about a request.</p>' +
+    var where = app === 'telegram' ? 'by replying to it' : 'by replying in its thread';
+    return '<section class="approvers-section" data-app="' + app + '"><h3>' + title + ' approvers</h3>' +
+      (n.primary !== app ? '<p class="hint" style="margin:0 0 8px">' + title + ' isn&#39;t primary, so requests aren&#39;t sent there until it is. Jobs started there still use this list.</p>' : '') +
+      '<p class="muted" style="margin:0 0 10px">People who can approve, deny, change or answer a request ' + where + ', like &ldquo;yes, go ahead&rdquo; or &ldquo;make it $40&rdquo;. A plain &ldquo;yes&rdquo; runs it; a reply that&#39;s less clear (&ldquo;sure, send it&rdquo;, &ldquo;yes but check the amount&rdquo;) shows exactly what will run with a Confirm button first, and a change is shown to approve first. Once anyone is listed, only approvers&#39; button clicks count, and only approvers can give the agent jobs. Anyone can still ask about a request.</p>' +
       (approvers.length
-        ? '<div class="le-table-wrap" style="max-width:560px"><table><thead><tr><th>Name</th><th>Slack ID</th><th></th></tr></thead><tbody>' + rows + '</tbody></table></div>'
-        : '<p class="hint">No approvers yet. Until you add someone, anyone in the channel can use the buttons, and deciding by reply is off.</p>') +
+        ? '<div class="le-table-wrap" style="max-width:560px"><table><thead><tr><th>Name</th><th>' + title + ' ID</th><th></th></tr></thead><tbody>' + rows + '</tbody></table></div>'
+        : '<p class="hint">No approvers yet. Until you add someone, anyone can use the buttons, and deciding by reply is off.</p>') +
       (n.canSave === false
         ? '<p class="hint">Changing approvers needs <code>LOOPENGINE_ADMIN_AUTH</code> set on the server.</p>'
-        : '<p style="margin:10px 0 0"><button type="button" id="approversLoad">Add people from the channel</button></p>' +
-          '<div id="approversPicker"></div>') +
-      '<div id="approversResult" class="hint"></div></section>';
+        : '<p style="margin:10px 0 0"><button type="button" class="approvers-load">' + (app === 'telegram' ? 'Add people who messaged the bot' : 'Add people from the channel') + '</button></p>' +
+          (app === 'telegram' ? '<p class="hint" style="margin:6px 0 0">Telegram can&#39;t list a chat&#39;s members, so people show up here once they&#39;ve written to the bot (a private message to it is enough), or add someone by their numeric user id:</p>' +
+            '<span style="display:flex;gap:6px;max-width:560px;margin-top:6px"><input class="approver-manual-id" placeholder="User id, like 123456789" style="flex:1;min-width:0"><input class="approver-manual-name" placeholder="Name" style="flex:1;min-width:0"><button type="button" class="approver-manual-add">Add</button></span>' : '') +
+          '<div class="approvers-picker"></div>') +
+      '<div class="hint approvers-result"></div></section>';
   }
 
   function wireApproversHandlers(name, n) {
-    var section = detail.querySelector('#approversSection');
-    if (!section) return;
-    var result = section.querySelector('#approversResult');
-    var slack = connectionFor(n, 'slack');
-    var current = (slack && slack.approvers) || [];
+    var sections = detail.querySelectorAll('.approvers-section');
+    for (var s = 0; s < sections.length; s++) wireApproversSection(name, n, sections[s]);
+  }
+
+  function wireApproversSection(name, n, section) {
+    var app = section.dataset.app;
+    var result = section.querySelector('.approvers-result');
+    var conn = connectionFor(n, app);
+    var current = (conn && conn.approvers) || [];
     function save(list, message) {
       result.textContent = 'Saving' + String.fromCharCode(8230);
       fetchJsonRetryOnce('/agents/' + encodeURIComponent(name) + '/notifier/approvers', {
-        method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ approvers: list }),
+        method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ app: app, approvers: list }),
       }).then(function (r) {
         if (!r.ok) { result.textContent = r.body.error || 'Could not save'; return; }
         loadApprovalsSection(name, message);
@@ -1801,31 +1864,46 @@ ${consoleShellScript}
       removes[i].addEventListener('click', function (ev) {
         var btn = ev.currentTarget;
         if (btn.dataset.confirming !== '1') { btn.dataset.confirming = '1'; btn.textContent = 'Click again to remove'; return; }
-        save(current.filter(function (a) { return a.user !== btn.dataset.user; }), 'Approver removed.');
+        save(current.filter(function (a) { return a.user !== btn.dataset.user; }), CHANNEL_TITLES[app] + ' approver removed.');
       });
     }
-    var load = section.querySelector('#approversLoad');
+    var manualAdd = section.querySelector('.approver-manual-add');
+    if (manualAdd) {
+      manualAdd.addEventListener('click', function () {
+        var id = section.querySelector('.approver-manual-id').value.trim();
+        var who = section.querySelector('.approver-manual-name').value.trim();
+        if (!/^[0-9]{1,20}$/.test(id)) { result.textContent = 'A Telegram user id is a number, like 123456789.'; return; }
+        if (current.some(function (a) { return a.user === id; })) { result.textContent = 'They are already an approver.'; return; }
+        save(current.concat([who ? { user: id, name: who } : { user: id }]), 'Added 1 ' + CHANNEL_TITLES[app] + ' approver.');
+      });
+    }
+    var load = section.querySelector('.approvers-load');
     if (!load) return;
     load.addEventListener('click', function () {
       load.disabled = true;
       result.textContent = 'Loading people' + String.fromCharCode(8230);
-      fetchJsonRetryOnce('/agents/' + encodeURIComponent(name) + '/notifier/slack-members').then(function (r) {
+      var path = app === 'telegram' ? '/notifier/telegram-people' : '/notifier/slack-members';
+      fetchJsonRetryOnce('/agents/' + encodeURIComponent(name) + path).then(function (r) {
         load.disabled = false;
         if (!r.ok) { result.textContent = r.body.error || 'Could not load people'; return; }
         var taken = current.map(function (a) { return a.user; });
-        var people = r.body.members.filter(function (m) { return taken.indexOf(m.id) === -1; });
+        var people = (r.body.members || r.body.people || []).filter(function (m) { return taken.indexOf(m.id) === -1; });
         result.textContent = '';
-        var picker = section.querySelector('#approversPicker');
-        if (!people.length) { picker.innerHTML = '<p class="hint">Everyone in the channel is already an approver.</p>'; return; }
+        var picker = section.querySelector('.approvers-picker');
+        if (!people.length) {
+          picker.innerHTML = '<p class="hint">' + (app === 'telegram' ? (taken.length ? 'Everyone who has written to the bot is already an approver.' : 'Nobody has written to the bot yet. Send it a message, then try again.') : 'Everyone in the channel is already an approver.') + '</p>';
+          return;
+        }
         picker.innerHTML = '<div class="tool-picker" style="max-width:560px;margin-top:8px">' + people.map(function (m) {
-          return '<label class="tool-picker-item" style="justify-content:flex-start"><input type="checkbox" value="' + escapeHtml(m.id) + '" data-name="' + escapeHtml(m.name) + '"> ' + escapeHtml(m.name) + ' <span class="hint">' + escapeHtml(m.id) + '</span></label>';
-        }).join('') + '</div><p style="margin:8px 0 0"><button type="button" class="primary" id="approversAdd">Add selected</button></p>';
-        picker.querySelector('#approversAdd').addEventListener('click', function () {
+          var label = m.name + (m.username && m.name !== '@' + m.username ? ' (@' + m.username + ')' : '');
+          return '<label class="tool-picker-item" style="justify-content:flex-start"><input type="checkbox" value="' + escapeHtml(m.id) + '" data-name="' + escapeHtml(m.name) + '"> ' + escapeHtml(label) + ' <span class="hint">' + escapeHtml(m.id) + '</span></label>';
+        }).join('') + '</div><p style="margin:8px 0 0"><button type="button" class="primary approvers-add">Add selected</button></p>';
+        picker.querySelector('.approvers-add').addEventListener('click', function () {
           var picked = picker.querySelectorAll('input:checked');
           if (!picked.length) { result.textContent = 'Pick at least one person.'; return; }
           var list = current.slice();
           for (var k = 0; k < picked.length; k++) list.push({ user: picked[k].value, name: picked[k].dataset.name });
-          save(list, picked.length === 1 ? 'Added 1 approver.' : 'Added ' + picked.length + ' approvers.');
+          save(list, picked.length === 1 ? 'Added 1 ' + CHANNEL_TITLES[app] + ' approver.' : 'Added ' + picked.length + ' ' + CHANNEL_TITLES[app] + ' approvers.');
         });
       });
     });
@@ -1837,7 +1915,8 @@ ${consoleShellScript}
       '<p class="muted" style="margin:0 0 12px">' + renderNotifierStatus(n) + '</p>' +
         (n.error ? '<p class="error">' + escapeHtml(n.error) + '</p>' : '') +
         (n.source === 'code' ? '' : renderConnectionsHtml(n)) + '</section>' +
-      renderApproversHtml(n) +
+      renderApproversHtml(n, 'slack') +
+      renderApproversHtml(n, 'telegram') +
       '<section><h3>Recent deliveries</h3>' + renderDeliveries(n.deliveries || []) + '</section>';
   }
 
@@ -1901,6 +1980,7 @@ ${consoleShellScript}
       });
     }
     if (channel === 'slack') wireSlackFields(name, form, result);
+    if (channel === 'telegram') wireTelegramFields(name, form);
 
     form.addEventListener('submit', function (ev) {
       ev.preventDefault();
@@ -1913,12 +1993,15 @@ ${consoleShellScript}
       if (channel === 'email') { body.to = data.get('emailTo'); body.from = data.get('emailFrom'); body.provider = data.get('emailProvider'); }
       if (data.get('secret')) body.secret = data.get('secret');
       if (channel === 'slack' && data.get('signingSecret')) body.signingSecret = data.get('signingSecret');
-      if (channel === 'slack') {
-        var conversationsBox = form.querySelector('#slackConversations');
-        var savedSlack = lastNotifier && connectionFor(lastNotifier, 'slack');
+      if (channel === 'slack' || channel === 'telegram') {
+        var conversationsBox = form.querySelector('#' + channel + 'Conversations');
+        var jobsBox = form.querySelector('#' + channel + 'Jobs');
+        var savedConn = lastNotifier && connectionFor(lastNotifier, channel);
         // A locked switch (free plan) keeps whatever was saved before.
         if (conversationsBox && !conversationsBox.disabled) body.conversations = conversationsBox.checked;
-        else if (savedSlack && savedSlack.conversations !== undefined) body.conversations = savedSlack.conversations;
+        else if (savedConn && savedConn.conversations !== undefined) body.conversations = savedConn.conversations;
+        if (jobsBox && !jobsBox.disabled) body.jobs = jobsBox.checked;
+        else if (savedConn && savedConn.jobs !== undefined) body.jobs = savedConn.jobs;
       }
       // Ticked "Make this the primary messaging app" (or none is primary yet,
       // which the server treats the same) makes this one primary.
@@ -1958,6 +2041,37 @@ ${consoleShellScript}
     }
   }
 
+  // Telegram's section: Connect the bot points its updates at this
+  // server; Check connection says where they go now.
+  function wireTelegramFields(name, form) {
+    var out = form.querySelector('#telegramWebhookResult');
+    var url = '/agents/' + encodeURIComponent(name) + '/notifier/telegram-webhook';
+    var setBtn = form.querySelector('#telegramWebhookSet');
+    if (setBtn) {
+      setBtn.addEventListener('click', function () {
+        setBtn.disabled = true;
+        out.textContent = 'Connecting' + String.fromCharCode(8230);
+        fetchJsonRetryOnce(url, { method: 'POST' }).then(function (r) {
+          setBtn.disabled = false;
+          if (!r.ok) { out.textContent = r.body.error || 'Could not connect the bot'; return; }
+          loadApprovalsSection(name, 'Telegram connected' + (r.body.botUsername ? ': people can now reply to @' + r.body.botUsername + String.fromCharCode(8217) + 's requests.' : '.'));
+        });
+      });
+    }
+    var checkBtn = form.querySelector('#telegramWebhookCheck');
+    if (checkBtn) {
+      checkBtn.addEventListener('click', function () {
+        out.textContent = 'Checking' + String.fromCharCode(8230);
+        fetchJsonRetryOnce(url).then(function (r) {
+          if (!r.ok) { out.textContent = r.body.error || 'Could not check'; return; }
+          var b = r.body;
+          out.textContent = (b.pointsHere ? 'Connected' + (b.botUsername ? ' (@' + b.botUsername + ')' : '') + '.' : b.url ? 'The bot sends its updates somewhere else: ' + b.url + '. Connect again to point it here.' : 'The bot isn' + String.fromCharCode(8217) + 't sending its updates anywhere. Connect again.') +
+            (b.lastError ? ' Telegram' + String.fromCharCode(8217) + 's last delivery error: ' + b.lastError : '');
+        });
+      });
+    }
+  }
+
   // Slack's section: the manifest follows the link address; Load channels
   // fills the picker.
   function wireSlackFields(name, form, result) {
@@ -2040,7 +2154,11 @@ ${consoleShellScript}
       }
       showPendingCount(pending.length);
       if (message) {
-        var r = content.querySelector(message.indexOf('pprover') !== -1 ? '#approversResult' : '#notifierResult');
+        var approverApp = message.indexOf('Telegram') !== -1 ? 'telegram' : 'slack';
+        // Otherwise the section that was open, which is the one just saved.
+        var r = message.indexOf('pprover') !== -1
+          ? content.querySelector('.approvers-section[data-app="' + approverApp + '"] .approvers-result')
+          : content.querySelector('details.msg-conn[open] .notifier-result') || content.querySelector('#notifierResult');
         if (r) r.textContent = message;
       }
     }).catch(function (err) {

package/dist/web/notifier-admin.d.ts

@@ -4,6 +4,7 @@ import { type DeliveryResult } from '../core/http-notify-triggers/webhook.js';
 import type { HttpNotifierConfig } from '../core/agent-config.js';
 import { type MessagingApprover, type NotifierFile, type NotifierFileChannel } from '../core/notifier-file.js';
 import { type SlackChannel, type SlackMember } from '../core/messaging/connectors/slack/index.js';
+import { type TelegramPerson } from '../core/messaging/connectors/telegram/index.js';
 /** The deployment-wide default webhook (LOOPENGINE_DEFAULT_WEBHOOK_URL /
  * _SECRET), which applies to the plain /messages route when an agent has
  * no notifier of its own. */
@@ -31,6 +32,10 @@ export declare function describeAgentNotifier(config: AgentConfig, defaultWebhoo
         eventsPath: string;
         manifestTemplate: Record<string, unknown>;
     };
+    telegram: {
+        webhookSet: boolean;
+        webhookPath: string;
+    };
     deliveries: import("../core/notifier-deliveries.js").NotifierDelivery[];
     channel?: HttpNotifierConfig["channel"];
     events?: string[];
@@ -56,24 +61,75 @@ export declare function slackCredentialsFor(config: AgentConfig): {
     botToken?: string;
     signingSecret?: string;
 };
-/** Whether replies in a Slack request's thread are answered: on unless
- * the Messaging tab turned Conversations off. An agent whose Slack
- * notifier is set in code always answers. */
+/** The apps people can talk to an agent in (core/messaging/). */
+export type TwoWayApp = 'slack' | 'telegram';
+/** Whether replies in an app's request threads are answered: on unless
+ * that app's section of the Messaging tab turned Conversations off. An
+ * agent whose notifier is set in code answers in that app only. */
+export declare function conversationsOn(config: AgentConfig, app: TwoWayApp): boolean;
 export declare function slackConversationsOn(config: AgentConfig): boolean;
-/** The people who can decide this agent's requests from Slack: from
- * messaging.yml; none when the Slack notifier is set in code. */
-export declare function agentApprovers(config: AgentConfig): MessagingApprover[];
-/** Whether a Slack user's button click counts: anyone's does while the
- * agent has no approvers (as before approvers existed), only theirs once
- * it has some. `message` says who can, for a refused click. */
+/** Whether a DM to the agent's bot in `app`, or a mention of it, starts a
+ * job (core/messaging/jobs.ts). Off unless turned on in that app's
+ * section; never for a notifier set in code. */
+export declare function jobsOn(config: AgentConfig, app: TwoWayApp): boolean;
+/** The people who can decide this agent's requests from `app`: from that
+ * app's connection in messaging.yml; none when the notifier is set in
+ * code. */
+export declare function agentApprovers(config: AgentConfig, app?: TwoWayApp): MessagingApprover[];
+/** Whether a person's button click counts: anyone's does while the
+ * agent has no approvers in that app (as before approvers existed), only
+ * theirs once it has some. `message` says who can, for a refused click. */
+export declare function clickAllowed(config: AgentConfig, app: TwoWayApp, user: string | undefined): {
+    allowed: boolean;
+    message?: string;
+};
 export declare function slackClickAllowed(config: AgentConfig, user: string | undefined): {
     allowed: boolean;
     message?: string;
 };
-/** Replaces the approver list on the agent's saved Slack connection,
- * primary or not. Throws NotifierFileError when there's no Slack
- * connection to add them to. */
-export declare function setAgentApprovers(config: AgentConfig, approvers: unknown): MessagingApprover[];
+/** Whether a person may start a job from a message, or continue one: an
+ * approver, once the app has any; with none, anyone in the agent's own
+ * channel or chat, but nobody by DM. */
+export declare function jobAllowed(config: AgentConfig, app: TwoWayApp, message: {
+    user: string;
+    conversation: string;
+    direct?: boolean;
+}): {
+    allowed: boolean;
+    message?: string;
+};
+/** Replaces the approver list on the agent's saved connection for `app`,
+ * primary or not. Throws NotifierFileError when there's no connection
+ * for that app to add them to. */
+export declare function setAgentApprovers(config: AgentConfig, approvers: unknown, app?: TwoWayApp): MessagingApprover[];
+/** The bot token behind an agent's Telegram notifier and the secret its
+ * webhook was set up with, like slackCredentialsFor. */
+export declare function telegramCredentialsFor(config: AgentConfig): {
+    botToken?: string;
+    webhookSecret?: string;
+};
+/** The address remembered for links when the app's connection was saved. */
+export declare function connectionPublicUrl(config: AgentConfig, app: TwoWayApp): string | undefined;
+/** The Telegram chat the agent posts requests in, if any. */
+export declare function telegramHomeChat(config: AgentConfig): string | undefined;
+/** People who have written to the agent's Telegram bot, newest first,
+ * for picking approvers: the Bot API can't list a chat's members. */
+export declare function listAgentTelegramPeople(config: AgentConfig): TelegramPerson[];
+/** Points the agent's Telegram bot at POST /hooks/telegram/<agent> on
+ * `baseUrl` (LOOPENGINE_PUBLIC_URL wins), with a secret made once and
+ * kept in the agent's env. From then on requests get buttons and replies
+ * reach the agent. */
+export declare function setupAgentTelegramWebhook(config: AgentConfig, baseUrl: string): Promise<{
+    url: string;
+    botUsername?: string;
+}>;
+/** Where the agent's Telegram bot sends its updates now. */
+export declare function agentTelegramWebhookInfo(config: AgentConfig): Promise<{
+    url?: string;
+    lastError?: string;
+    pointsHere: boolean;
+    botUsername?: string;
+}>;
 /** The people in the agent's Slack channel, for picking approvers. */
 export declare function listAgentSlackMembers(config: AgentConfig): Promise<SlackMember[]>;
 /** Channels for the console's picker, with the token being typed in or,