metheus-governance-mcp-cli 0.2.96 → 0.2.98

package/README.md

@@ -23,7 +23,6 @@ npm install -g metheus-governance-mcp-cli@latest
 
 Install creates local provider settings templates here:
 
-- `~/.metheus/telegram.env`
 - `~/.metheus/telegram-bots/`
 - `~/.metheus/slack.env`
 - `~/.metheus/kakaotalk.env`
@@ -32,7 +31,8 @@ Install creates local provider settings templates here:
 These files are for local provider bot secrets, local transport options, and optional per-bot local AI binding.
 
 - Store locally:
-  - `TELEGRAM_BOT_TOKEN` as a legacy Telegram fallback in `telegram.env`
+  - Telegram-wide settings in `~/.metheus/telegram-bots/_global.env`
+  - `TELEGRAM_BOT_TOKEN` as a legacy Telegram fallback in `_global.env`
   - one Telegram bot file per entry in `~/.metheus/telegram-bots/<bot-key>.env`
   - `SLACK_BOT_TOKEN`
   - `KAKAOTALK_BOT_TOKEN`
@@ -41,12 +41,12 @@ These files are for local provider bot secrets, local transport options, and opt
   - `chat_id` / channel / room identifier
   - label / active state
 - Do not put project chat destination identifiers in local env files.
-- Telegram-wide settings stay in `telegram.env`; Telegram per-bot secrets and AI fields live in `telegram-bots/*.env`.
+- Telegram-wide settings now live in `telegram-bots/_global.env`; Telegram per-bot secrets and AI fields live in `telegram-bots/*.env`.
 
 Example templates:
 
 ```env
-# ~/.metheus/telegram.env
+# ~/.metheus/telegram-bots/_global.env
 TELEGRAM_API_BASE_URL=
 TELEGRAM_AUTO_CLEAR_WEBHOOK=true
 TELEGRAM_ALLOWED_UPDATES=message,edited_message
@@ -164,7 +164,6 @@ metheus-governance-mcp-cli setup --project-id <project_uuid> --ctxpack-key "<ctx
 
 `setup` also ensures local provider templates exist:
 
-- `~/.metheus/telegram.env`
 - `~/.metheus/telegram-bots/`
 - `~/.metheus/slack.env`
 - `~/.metheus/kakaotalk.env`
@@ -172,7 +171,7 @@ metheus-governance-mcp-cli setup --project-id <project_uuid> --ctxpack-key "<ctx
 
 When Telegram local config already exists, bootstrap/setup keeps your secrets but auto-normalizes the layout to the latest split structure:
 
-- Telegram-wide settings stay in `~/.metheus/telegram.env`
+- Telegram-wide settings stay in `~/.metheus/telegram-bots/_global.env`
 - per-bot secrets move to `~/.metheus/telegram-bots/<bot-key>.env`
 - stale inline keys such as `TELEGRAM_BOT_<NAME>_BOT_*` are rewritten into generic per-bot keys
 
@@ -183,7 +182,7 @@ Fill provider bot secrets and provider-local transport options locally. Project
 - which provider/role bot profile to use
 - which `project_id -> workspace_dir` mapping to apply locally
 - which role profile maps to which local CLI/model/permission/reasoning policy
-- which server bot maps to which local LLM execution profile via `telegram.env` or fallback `bot_bindings`
+- which server bot maps to which local LLM execution profile via `telegram-bots/_global.env`, `telegram-bots/*.env`, or fallback `bot_bindings`
 
 Built-in helper command for legacy fallback/testing:
 
@@ -398,7 +397,7 @@ Recommended production path:
 - keep `project_mappings.<project_id>.workspace_dir` aligned to that teammate's actual local project folder
 - let `ctxpack pull` or project connection refresh the mapping automatically
 - keep per-role execution policy under `role_profiles`
-- keep per-bot LLM binding primarily in `~/.metheus/telegram.env`
+- keep Telegram-wide binding defaults in `~/.metheus/telegram-bots/_global.env`
 - use `bot_bindings` in `bot-runner.json` only as local fallback/override
 - runner resolution order is: explicit `route.role_profile` -> provider env bot binding -> `bot_bindings` -> server bot role -> `route.role`
 
@@ -471,7 +470,7 @@ Notes:
 - `local-bot-bridge` reads stdin JSON from the runner and can call Codex/Claude/Gemini for you
 - `route.command` fallback is disabled by default; enable it only temporarily with `METHEUS_ALLOW_LEGACY_RUNNER_COMMAND=1`
 - today this automation path is implemented for Telegram end-to-end
-- prefer `TELEGRAM_API_BASE_URL=` inside `~/.metheus/telegram.env` for per-bot local Telegram API overrides; `METHEUS_TELEGRAM_API_BASE_URL` remains a process-level fallback mainly for mock/regression testing
+- prefer `TELEGRAM_API_BASE_URL=` inside `~/.metheus/telegram-bots/_global.env` for local Telegram API overrides; `METHEUS_TELEGRAM_API_BASE_URL` remains a process-level fallback mainly for mock/regression testing
 - Slack can use direct local send, but automatic inbound runner flow is not completed yet
 - KakaoTalk config can be stored now, but direct send/runner flow is not implemented yet
 - `doctor` now reports provider support for both enabled runner routes and active project chat destinations

package/cli.mjs

@@ -154,9 +154,11 @@ const AUTH_STORE_RELATIVE_PATH = path.join(".metheus", "governance-mcp-auth.json
 const BOT_RUNNER_CONFIG_RELATIVE_PATH = path.join(".metheus", "bot-runner.json");
 const BOT_RUNNER_STATE_RELATIVE_PATH = path.join(".metheus", "bot-runner-state.json");
 const BOT_RUNNER_CONFIG_VERSION = 2;
+const TELEGRAM_LEGACY_ENV_RELATIVE_PATH = path.join(".metheus", "telegram.env");
+const TELEGRAM_GLOBAL_ENV_RELATIVE_PATH = path.join(".metheus", "telegram-bots", "_global.env");
 const PROVIDER_ENV_CONFIG = {
   telegram: {
-    relativePath: path.join(".metheus", "telegram.env"),
+    relativePath: TELEGRAM_GLOBAL_ENV_RELATIVE_PATH,
     tokenKey: "TELEGRAM_BOT_TOKEN",
     label: "Telegram",
     verifyURL: "https://api.telegram.org",
@@ -736,6 +738,10 @@ function providerEnvFilePath(provider) {
   return resolveHomeFilePath(providerEnvConfig(provider).relativePath);
 }
 
+function telegramLegacyEnvFilePath() {
+  return resolveHomeFilePath(TELEGRAM_LEGACY_ENV_RELATIVE_PATH);
+}
+
 function telegramBotEntriesDirPath() {
   return resolveHomeFilePath(".metheus/telegram-bots");
 }
@@ -751,7 +757,8 @@ function providerEnvTemplate(provider) {
     return [
       "# Metheus local Telegram bot settings",
       "# Keep this file on your machine only. Do not commit it.",
-      "# Store only Telegram-wide settings here.",
+      "# Store Telegram-wide settings here.",
+      "# This global file now lives in ~/.metheus/telegram-bots/_global.env.",
       "# Per-bot secrets and AI settings live in ~/.metheus/telegram-bots/<bot-key>.env.",
       "# Project chat destinations must be managed on the Metheus server.",
       "",
@@ -1037,6 +1044,23 @@ function isCompatibleLegacyLocalBotBridgeCommand(command, roleProfile) {
 }
 
 function ensureProviderEnvTemplate(provider) {
+  if (normalizeBotProvider(provider) === "telegram") {
+    const filePath = providerEnvFilePath(provider);
+    const legacyFilePath = telegramLegacyEnvFilePath();
+    const existedBefore = fs.existsSync(filePath) || fs.existsSync(legacyFilePath);
+    try {
+      const state = readTelegramEnvState();
+      writeTelegramEnvState(state.parsed);
+      return {
+        filePath,
+        created: !existedBefore,
+        existed: existedBefore,
+        normalized: true,
+      };
+    } catch (err) {
+      return { filePath, created: false, existed: false, error: String(err?.message || err) };
+    }
+  }
   const filePath = providerEnvFilePath(provider);
   try {
     if (fs.existsSync(filePath)) {
@@ -2737,7 +2761,7 @@ function loadTelegramBotEntriesFromFiles() {
   const dirPath = telegramBotEntriesDirPath();
   if (!fs.existsSync(dirPath)) return [];
   return fs.readdirSync(dirPath, { withFileTypes: true })
-    .filter((item) => item.isFile() && /\.env$/i.test(item.name))
+    .filter((item) => item.isFile() && /\.env$/i.test(item.name) && item.name.toLowerCase() !== "_global.env")
     .map((item) => path.join(dirPath, item.name))
     .sort((left, right) => left.localeCompare(right))
     .map((filePath) => {
@@ -2775,14 +2799,20 @@ function buildMergedTelegramEnvParsed(globalParsed, entries) {
 
 function readTelegramEnvState() {
   const filePath = providerEnvFilePath("telegram");
+  const legacyFilePath = telegramLegacyEnvFilePath();
+  let sourceFilePath = filePath;
   try {
-    if (!fs.existsSync(filePath)) {
+    if (!fs.existsSync(filePath) && fs.existsSync(legacyFilePath)) {
+      sourceFilePath = legacyFilePath;
+    } else if (!fs.existsSync(filePath)) {
       fs.mkdirSync(path.dirname(filePath), { recursive: true });
       fs.writeFileSync(filePath, providerEnvTemplate("telegram"), "utf8");
     }
   } catch (err) {
     return {
       filePath,
+      legacyFilePath,
+      sourceFilePath,
       entriesDirPath: telegramBotEntriesDirPath(),
       parsed: {},
       globalParsed: {},
@@ -2790,7 +2820,7 @@ function readTelegramEnvState() {
       error: String(err?.message || err),
     };
   }
-  const raw = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : "";
+  const raw = fs.existsSync(sourceFilePath) ? fs.readFileSync(sourceFilePath, "utf8") : "";
   const globalParsedRaw = parseSimpleEnvText(raw);
   const inlineEntries = collectTelegramEnvBotEntries(globalParsedRaw);
   const fileEntries = loadTelegramBotEntriesFromFiles();
@@ -2806,6 +2836,8 @@ function readTelegramEnvState() {
   const entries = Array.from(mergedEntries.values());
   return {
     filePath,
+    legacyFilePath,
+    sourceFilePath,
     entriesDirPath: telegramBotEntriesDirPath(),
     parsed: buildMergedTelegramEnvParsed(globalParsed, entries),
     globalParsed,
@@ -2833,7 +2865,8 @@ function renderNormalizedTelegramEnv(parsedEnv) {
   const lines = [
     "# Metheus local Telegram bot settings",
     "# Keep this file on your machine only. Do not commit it.",
-    "# Store only Telegram-wide settings here.",
+    "# Store Telegram-wide settings here.",
+    "# This global file lives in ~/.metheus/telegram-bots/_global.env.",
     "# Per-bot secrets and AI settings live in ~/.metheus/telegram-bots/<bot-key>.env.",
     "",
     `TELEGRAM_API_BASE_URL=${formatProviderEnvValue(parsed.TELEGRAM_API_BASE_URL || "")}`,
@@ -2906,6 +2939,7 @@ function writeTelegramEnvState(parsedEnv) {
     }
   });
   const globalFilePath = providerEnvFilePath("telegram");
+  const legacyFilePath = telegramLegacyEnvFilePath();
   fs.mkdirSync(path.dirname(globalFilePath), { recursive: true });
   fs.writeFileSync(globalFilePath, renderNormalizedTelegramEnv(globalParsed), {
     encoding: "utf8",
@@ -2923,13 +2957,16 @@ function writeTelegramEnvState(parsedEnv) {
     });
   });
   fs.readdirSync(entriesDirPath, { withFileTypes: true })
-    .filter((item) => item.isFile() && /\.env$/i.test(item.name))
+    .filter((item) => item.isFile() && /\.env$/i.test(item.name) && item.name.toLowerCase() !== "_global.env")
     .forEach((item) => {
       const filePath = path.resolve(path.join(entriesDirPath, item.name));
       if (!activeFiles.has(filePath)) {
         fs.rmSync(filePath, { force: true });
       }
     });
+  if (legacyFilePath !== globalFilePath && fs.existsSync(legacyFilePath)) {
+    fs.rmSync(legacyFilePath, { force: true });
+  }
   return globalFilePath;
 }
 
@@ -3622,8 +3659,10 @@ function buildBotCommandDeps() {
     loadBotRunnerConfig,
     saveBotRunnerConfig,
     listServerBots: async ({ provider, baseURL, timeoutSeconds }) => {
-      const authFlowDeps = buildAuthFlowDeps();
-      const resolved = resolveCurrentAccessToken(authFlowDeps);
+      const resolved = await resolveAccessTokenForCommand(
+        baseURL || DEFAULT_SITE_URL,
+        intFromRaw(timeoutSeconds, 15),
+      );
       if (!resolved.token) {
         return {
           ok: false,
@@ -5372,7 +5411,7 @@ TELEGRAM_BOT_REVIEW_TOKEN=review-token
   try {
     process.env.USERPROFILE = telegramEnvNormalizeTempHome;
     process.env.HOME = telegramEnvNormalizeTempHome;
-    const normalizeTestEnvPath = providerEnvFilePath("telegram");
+    const normalizeTestEnvPath = telegramLegacyEnvFilePath();
     fs.mkdirSync(path.dirname(normalizeTestEnvPath), { recursive: true });
     fs.writeFileSync(
       normalizeTestEnvPath,
@@ -5385,7 +5424,7 @@ TELEGRAM_BOT_REVIEW_TOKEN=review-token
       "utf8",
     );
     ensureProviderEnvTemplate("telegram");
-    normalizedGlobalText = fs.readFileSync(normalizeTestEnvPath, "utf8");
+    normalizedGlobalText = fs.readFileSync(providerEnvFilePath("telegram"), "utf8");
     normalizedBotText = fs.readFileSync(telegramBotEntryFilePath("ryoai"), "utf8");
   } finally {
     if (previousUserProfile === undefined) delete process.env.USERPROFILE;

package/lib/selftest-bot-commands.mjs

@@ -288,8 +288,8 @@ export async function runSelftestBotCommands(push, deps) {
     const env = buildSpawnEnv(tempHome);
     const baseURL = `http://127.0.0.1:${mock.port}`;
     const telegramApiBaseURL = `${baseURL}/telegram`;
-    const telegramEnvPath = path.join(tempHome, ".metheus", "telegram.env");
     const telegramBotEntriesDir = path.join(tempHome, ".metheus", "telegram-bots");
+    const telegramEnvPath = path.join(telegramBotEntriesDir, "_global.env");
     const readTelegramGlobals = () => parseSimpleEnvText(fs.readFileSync(telegramEnvPath, "utf8"));
     const readTelegramBotEntry = (botKey) => {
       const filePath = path.join(telegramBotEntriesDir, `${String(botKey || "").trim()}.env`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "metheus-governance-mcp-cli",
-  "version": "0.2.96",
+  "version": "0.2.98",
   "description": "Metheus Governance MCP CLI (setup + stdio proxy)",
   "type": "module",
   "files": [