nio-cat 0.5.1 → 0.8.0

package/src/server.js

@@ -13,6 +13,7 @@ const github = require('./github');
 const { addServer, knownHosts } = require('./ssh');
 const { agentCommands } = require('./commands');
 const { pairLink, qrSvg, makeCode, codeLink } = require('./pair');
+const directory = require('./directory');
 
 // L'app web: copiada dins del paquet en publicar-lo, o l'arrel del repositori en desenvolupament.
 const WEB_DIRS = [path.join(__dirname, '..', 'web'), path.join(__dirname, '..', '..')];
@@ -42,14 +43,6 @@ function originAllowed(cfg, origin) {
   });
 }
 
-function tokenOk(cfg, req) {
-  const h = req.headers.authorization || '';
-  const t = h.startsWith('Bearer ') ? h.slice(7) : '';
-  const a = Buffer.from(t);
-  const b = Buffer.from(cfg.token);
-  return a.length === b.length && crypto.timingSafeEqual(a, b);
-}
-
 function isLoopbackDirect(req) {
   const ip = req.socket.remoteAddress || '';
   const local = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
@@ -141,26 +134,53 @@ function listDir(cfg, raw) {
 // Noms de model d'Ollama: «qwen3:4b», «hf.co/usuari/model:Q4_K_M»…
 const MODEL_NAME = /^[\w][\w.\-/]{0,100}(:[\w.\-]{1,60})?$/;
 
-function createServer({ cfg, hub, getPublicUrl, getApp }) {
-  const streams = new Set();
+// Rutes que afegeixen altres mòduls (memòria, feines, Telegram, veu, navegador…).
+// Cada ruta: { method, path: RegExp|string, handler: async ({ req, res, url, params, body, device }), raw?, limit? }.
+function matchRoute(routes, method, p) {
+  for (const r of routes) {
+    if (r.method !== method) continue;
+    if (typeof r.path === 'string') {
+      if (r.path === p) return { r, params: [] };
+    } else {
+      const m = p.match(r.path);
+      if (m) return { r, params: m.slice(1).map((x) => decodeURIComponent(x)) };
+    }
+  }
+  return null;
+}
+
+function createServer({ cfg, hub, auth, audit, getPublicUrl, getApp, routes = [], info = () => ({}), beforeApproval = null }) {
+  const streams = new Map(); // res -> id del dispositiu
+  auth.onRevoke((d) => {
+    for (const [res, dev] of streams) if (dev === d.id) { res.end(); streams.delete(res); }
+    const before = (cfg.pushSubs || []).length;
+    cfg.pushSubs = (cfg.pushSubs || []).filter((x) => x.device !== d.id);
+    if (cfg.pushSubs.length !== before) save(cfg);
+  });
   const seenDevices = new Map(); // mòbils que s'han connectat (per avisar l'ordinador que mostra el QR)
   const pulls = new Map(); // descàrregues de models d'Ollama en curs
 
   hub.on('out', (msg) => {
     const data = `data: ${JSON.stringify(msg)}\n\n`;
-    for (const res of streams) res.write(data);
+    for (const res of streams.keys()) res.write(data);
   });
   setInterval(() => {
-    for (const res of streams) res.write(': ping\n\n');
+    for (const res of streams.keys()) res.write(': ping\n\n');
   }, 15000).unref();
 
   const hookUrl = () => `http://127.0.0.1:${cfg.port}/internal/approval`;
 
-  async function api(req, res, url) {
+  async function api(req, res, url, device) {
     const p = url.pathname;
     const m = (re) => p.match(re);
     const method = req.method;
 
+    const hit = matchRoute(routes, method, p);
+    if (hit) {
+      const body = method === 'GET' || method === 'DELETE' || hit.r.raw ? undefined : await readBody(req, hit.r.limit);
+      return hit.r.handler({ req, res, url, params: hit.params, body, device });
+    }
+
     if (p === '/api/info' && method === 'GET') {
       return {
         name: 'nio',
@@ -173,8 +193,32 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
         roots: cfg.roots,
         vapidKey: cfg.vapid.publicKey,
         id: cfg.id,
+        device: { id: device.id, name: device.name, primary: !!device.primary },
+        identity: directory.identity(cfg),
+        ...(await info()),
       };
     }
+    if (p === '/api/devices' && method === 'GET') return auth.list(device.id);
+    let dv;
+    if ((dv = m(/^\/api\/devices\/([\w-]+)$/))) {
+      if (method === 'PATCH') {
+        const b = await readBody(req);
+        const r = auth.rename(dv[1], b.name);
+        if (!r) throw httpErr(404, 'Aquest dispositiu no existeix');
+        return r;
+      }
+      if (method === 'DELETE') {
+        const r = auth.revoke(dv[1]);
+        if (!r) throw httpErr(404, 'Aquest dispositiu no existeix');
+        audit.add({ type: 'device', what: `Accés revocat: ${r.name}`, by: device.name });
+        return r;
+      }
+    }
+    if (p === '/api/audit' && method === 'GET') {
+      const limit = Math.min(1000, Number(url.searchParams.get('limit')) || 200);
+      const type = url.searchParams.get('type');
+      return audit.recent(limit, type ? (e) => e.type === type : null);
+    }
     if (p === '/api/ssh/hosts' && method === 'GET') return knownHosts();
     if (p === '/api/projects' && method === 'GET') return listProjects(cfg);
     if (p === '/api/fs' && method === 'GET') return listDir(cfg, url.searchParams.get('path'));
@@ -236,9 +280,11 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
       // Enllaç i QR per connectar un altre dispositiu (el mòbil) amb aquest ordinador.
       const pub = getPublicUrl();
       if (!pub || /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:|\/|$)/i.test(pub)) return { link: null };
-      const link = pairLink(getApp ? getApp() : cfg.app, pub, cfg.token);
-      const code = makeCode(pub, cfg.token);
-      return { link, code, svg: qrSvg(codeLink(getApp ? getApp() : cfg.app, code)), url: pub, lan: /^http:\/\//.test(pub) };
+      // Un secret d'un sol ús (no la clau principal): el mòbil el canvia per una clau pròpia i revocable.
+      const { code: secret, expires } = auth.createCode({ secret: true });
+      const link = pairLink(getApp ? getApp() : cfg.app, pub, secret);
+      const code = makeCode(pub, secret);
+      return { link, code, svg: qrSvg(codeLink(getApp ? getApp() : cfg.app, code)), url: pub, lan: /^http:\/\//.test(pub), expires };
     }
     if (p === '/api/github' && method === 'GET') return github.status();
     if (p === '/api/github/repos' && method === 'GET') return github.repos(url.searchParams.get('owner') || '');
@@ -293,7 +339,7 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
     if (p === '/api/approvals' && method === 'GET') return hub.pendingApprovals();
     if ((r = m(/^\/api\/approvals\/([\w-]+)$/)) && method === 'POST') {
       const b = await readBody(req);
-      const a = hub.decide(r[1], b.decision === 'allow' ? 'allow' : 'deny', b.reason);
+      const a = hub.decide(r[1], b.decision === 'allow' ? 'allow' : 'deny', b.reason, device.name);
       if (!a) throw httpErr(404, 'Aquesta petició ja s’ha resolt');
       return a;
     }
@@ -301,9 +347,10 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
     if (p === '/api/push' && method === 'POST') {
       const b = await readBody(req);
       if (!b.endpoint || !/^https:\/\//.test(b.endpoint)) throw httpErr(400, 'La subscripció als avisos no és vàlida');
+      const keys = b.keys && typeof b.keys.p256dh === 'string' && typeof b.keys.auth === 'string' ? { p256dh: b.keys.p256dh.slice(0, 200), auth: b.keys.auth.slice(0, 100) } : null;
       cfg.pushSubs = (cfg.pushSubs || []).filter((x) => x.endpoint !== b.endpoint);
-      cfg.pushSubs.push({ endpoint: b.endpoint, added: Date.now() });
-      cfg.pushSubs = cfg.pushSubs.slice(-10);
+      cfg.pushSubs.push({ endpoint: String(b.endpoint).slice(0, 1000), keys, device: device.id, added: Date.now() });
+      cfg.pushSubs = cfg.pushSubs.slice(-20);
       save(cfg);
       return { ok: true };
     }
@@ -314,7 +361,7 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
     throw httpErr(404, 'Aquesta ruta no existeix');
   }
 
-  const PUBLIC = /^\/(?:$|index\.html$|app(?:\/|$)|test(?:\/|$)|[\w.-]+\.(?:css|js|svg|png|webmanifest|json|ico|txt|html)$)/;
+  const PUBLIC = /^\/(?:$|index\.html$|app(?:\/|$)|privadesa$|[\w.-]+\.(?:css|js|svg|png|webmanifest|json|ico|txt|html)$)/;
   function serveStatic(req, res, url) {
     let rel = decodeURIComponent(url.pathname);
     if (!PUBLIC.test(rel) || rel.split('/').some((p) => p.startsWith('.')) || /^\/(daemon|node_modules)\b/.test(rel)) {
@@ -361,7 +408,9 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
         if (!isLoopbackDirect(req)) throw httpErr(403, 'Només s’accepta des d’aquest ordinador');
         const b = await readBody(req);
         if (!hub.checkHookKey(b.session, req.headers['x-nio-key'])) throw httpErr(403, 'La clau no és correcta');
-        const decision = await hub.requestApproval({ session: b.session, tool: b.tool, input: b.input });
+        // Si l'ordre actua sobre el navegador o l'escriptori, hi afegim una captura de la pantalla.
+        const extra = beforeApproval ? await beforeApproval(b.tool, b.input).catch(() => ({})) : {};
+        const decision = await hub.requestApproval({ session: b.session, tool: b.tool, input: b.input, extra });
         res.writeHead(200, { 'content-type': 'application/json' });
         return res.end(JSON.stringify({ decision }));
       } catch (e) {
@@ -376,11 +425,26 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
       return res.end(JSON.stringify({ nio: true, id: cfg.id, name: os.hostname() }));
     }
 
-    if (url.pathname.startsWith('/api/')) {
-      if (!tokenOk(cfg, req)) {
-        res.writeHead(401, { 'content-type': 'application/json' });
-        return res.end(JSON.stringify({ error: 'La clau no és vàlida. Torna a connectar el mòbil amb el codi QR.' }));
+    const json = (status, obj) => {
+      res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+      res.end(JSON.stringify(obj));
+    };
+
+    // Aparellament: canvia un codi d'un sol ús per una clau pròpia d'aquest dispositiu. No demana clau.
+    if (url.pathname === '/api/pair' && req.method === 'POST') {
+      try {
+        const b = await readBody(req, 4096);
+        const r = auth.redeem(b.code, b.name);
+        audit.add({ type: 'device', what: `Dispositiu aparellat: ${r.device.name}`, by: r.device.name });
+        return json(200, { ...r, id: cfg.id, host: os.hostname(), identity: directory.identity(cfg) });
+      } catch (e) {
+        return json(e.status || 500, { error: e.message });
       }
+    }
+
+    if (url.pathname.startsWith('/api/')) {
+      const device = auth.fromRequest(req);
+      if (!device) return json(401, { error: 'Aquest dispositiu no té accés (o l’has revocat). Torna a aparellar-lo amb un codi nou.' });
       if (url.pathname === '/api/stream') {
         res.writeHead(200, {
           'content-type': 'text/event-stream; charset=utf-8',
@@ -392,10 +456,10 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
         const dev = String(url.searchParams.get('d') || '').slice(0, 40), kind = url.searchParams.get('k') === 'phone' ? 'phone' : 'desktop';
         if (dev && kind === 'phone' && Date.now() - (seenDevices.get(dev) || 0) > 10 * 60 * 1000) {
           const data = `data: ${JSON.stringify({ type: 'device', device: dev, kind })}\n\n`;
-          for (const o of streams) o.write(data);
+          for (const o of streams.keys()) o.write(data);
         }
         if (dev) seenDevices.set(dev, Date.now());
-        streams.add(res);
+        streams.set(res, device.id);
         req.on('close', () => streams.delete(res));
         return;
       }
@@ -414,12 +478,12 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
         return res.end();
       }
       try {
-        const out = await api(req, res, url);
-        res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
-        res.end(JSON.stringify(out));
+        const out = await api(req, res, url, device);
+        if (res.headersSent) return; // la ruta ja ha respost (p. ex. àudio o imatges)
+        json(200, out);
       } catch (e) {
-        res.writeHead(e.status || 500, { 'content-type': 'application/json; charset=utf-8' });
-        res.end(JSON.stringify({ error: e.message }));
+        if (res.headersSent) return res.end();
+        json(e.status || 500, { error: e.message });
       }
       return;
     }
@@ -433,4 +497,4 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
   return server;
 }
 
-module.exports = { createServer, originAllowed };
+module.exports = { createServer, originAllowed, readBody };

package/src/service.js

@@ -0,0 +1,123 @@
+'use strict';
+// Servei del sistema perquè nio arrenqui sol amb l'ordinador (systemd a Linux, launchd a macOS).
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { HOME } = require('./config');
+const { searchPath } = require('./proc');
+
+const LABEL = 'cat.nio.daemon';
+
+function entry() {
+  return fs.realpathSync(path.join(__dirname, '..', 'bin', 'nio.js'));
+}
+
+function q(s) {
+  // Cometes per a ExecStart de systemd.
+  return /[\s"\\]/.test(s) ? `"${String(s).replace(/(["\\])/g, '\\$1')}"` : s;
+}
+
+function systemdUnit({ roots, system }) {
+  const env = [`PATH=${searchPath().join(':')}`, process.env.NIO_HOME ? `NIO_HOME=${process.env.NIO_HOME}` : null].filter(Boolean);
+  return `[Unit]
+Description=nio · els teus agents, des del mòbil
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${[process.execPath, entry(), '--no-open', ...roots].map(q).join(' ')}
+WorkingDirectory=${roots[0] || os.homedir()}
+${env.map((e) => `Environment=${q(e)}`).join('\n')}
+Environment=NO_COLOR=1
+Restart=always
+RestartSec=3
+${system ? `User=${os.userInfo().username}\n` : ''}
+[Install]
+WantedBy=${system ? 'multi-user.target' : 'default.target'}
+`;
+}
+
+function launchdPlist({ roots }) {
+  const x = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;');
+  const args = [process.execPath, entry(), '--no-open', ...roots].map((a) => `    <string>${x(a)}</string>`).join('\n');
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>WorkingDirectory</key><string>${x(roots[0] || os.homedir())}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key><string>${x(searchPath().join(':'))}</string>
+    <key>NO_COLOR</key><string>1</string>${process.env.NIO_HOME ? `\n    <key>NIO_HOME</key><string>${x(process.env.NIO_HOME)}</string>` : ''}
+  </dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${x(path.join(HOME, 'nio.log'))}</string>
+  <key>StandardErrorPath</key><string>${x(path.join(HOME, 'nio.log'))}</string>
+</dict>
+</plist>
+`;
+}
+
+function sh(cmd, args) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8' });
+  return { ok: r.status === 0, out: `${r.stdout || ''}${r.stderr || ''}`.trim() };
+}
+
+function install({ roots, log = console.log }) {
+  if (entry().includes(`${path.sep}_npx${path.sep}`)) {
+    log('  Avís: nio s’executa des de la memòria cau de npx, que es pot esborrar.');
+    log('  Per a un servei estable, instal·la’l primer: npm install -g https://www.nio.cat/nio.tgz\n');
+  }
+  if (process.platform === 'darwin') {
+    const file = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    sh('launchctl', ['unload', file]);
+    fs.writeFileSync(file, launchdPlist({ roots }));
+    const r = sh('launchctl', ['load', '-w', file]);
+    if (!r.ok) throw new Error(`launchctl no l’ha pogut carregar: ${r.out}`);
+    return { file, logs: `tail -f ${path.join(HOME, 'nio.log')}` };
+  }
+  if (process.platform !== 'linux') throw new Error('El servei automàtic només funciona a Linux (systemd) i macOS (launchd).');
+  if (!sh('systemctl', ['--version']).ok) throw new Error('Aquest sistema no té systemd.');
+  const system = process.getuid && process.getuid() === 0;
+  const file = system ? '/etc/systemd/system/nio.service' : path.join(os.homedir(), '.config', 'systemd', 'user', 'nio.service');
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, systemdUnit({ roots, system }));
+  const ctl = system ? ['systemctl'] : ['systemctl', '--user'];
+  sh(ctl[0], [...ctl.slice(1), 'daemon-reload']);
+  const r = sh(ctl[0], [...ctl.slice(1), 'enable', '--now', 'nio.service']);
+  if (!r.ok) throw new Error(`systemctl no l’ha pogut engegar: ${r.out}`);
+  sh(ctl[0], [...ctl.slice(1), 'restart', 'nio.service']);
+  let linger = null;
+  if (!system) {
+    // Sense «linger», el servei d'usuari s'atura quan tanques la sessió (i no arrenca en reiniciar).
+    linger = sh('loginctl', ['enable-linger', os.userInfo().username]).ok;
+  }
+  return { file, linger, logs: system ? 'journalctl -u nio -f' : 'journalctl --user -u nio -f' };
+}
+
+function uninstall() {
+  if (process.platform === 'darwin') {
+    const file = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
+    sh('launchctl', ['unload', '-w', file]);
+    fs.rmSync(file, { force: true });
+    return file;
+  }
+  const system = process.getuid && process.getuid() === 0;
+  const ctl = system ? ['systemctl'] : ['systemctl', '--user'];
+  sh(ctl[0], [...ctl.slice(1), 'disable', '--now', 'nio.service']);
+  const file = system ? '/etc/systemd/system/nio.service' : path.join(os.homedir(), '.config', 'systemd', 'user', 'nio.service');
+  fs.rmSync(file, { force: true });
+  sh(ctl[0], [...ctl.slice(1), 'daemon-reload']);
+  return file;
+}
+
+module.exports = { install, uninstall, systemdUnit, launchdPlist };

package/src/telegram.js

@@ -0,0 +1,311 @@
+'use strict';
+// Telegram: el teu bot (BotFather) parla amb aquest ordinador per long polling. És una connexió
+// de sortida, així que no necessita túnel. Només els xats de la llista blanca poden donar ordres;
+// la resta s'ignoren (només en queda constància perquè els puguis autoritzar des de l'app).
+//
+// Des de Telegram: escriure o enviar una nota de veu (continua la conversa o n'obre una de nova),
+// /nova <text>, /estat, /atura, /ajuda. Hi arriben els avisos, i les aprovacions amb botons.
+const config = require('./config');
+const voice = require('./voice');
+
+const httpErr = (status, message) => Object.assign(new Error(message), { status });
+const TOKEN_RE = /^\d{5,15}:[\w-]{30,60}$/;
+const clip = (s, n) => (String(s).length > n ? `${String(s).slice(0, n)}…` : String(s));
+
+class Telegram {
+  constructor({ cfg, hub, audit, available = () => ['claude', 'codex'] }) {
+    this.cfg = cfg;
+    this.hub = hub;
+    this.audit = audit || { add() {} };
+    this.available = available;
+    this.chatOf = new Map(); // sessió -> xat que l'ha començada
+    this.running = false;
+    this.me = null;
+    hub.on('notice', (n, s) => this.onNotice(n, s).catch(() => {}));
+    hub.on('out', (m) => this.onHub(m));
+  }
+
+  get t() {
+    return this.cfg.telegram || {};
+  }
+  base() {
+    return (this.t.api || 'https://api.telegram.org').replace(/\/$/, '');
+  }
+  async call(method, body, { timeout = 15000 } = {}) {
+    const r = await fetch(`${this.base()}/bot${this.t.token}/${method}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body || {}),
+      signal: AbortSignal.timeout(timeout),
+    });
+    const j = await r.json().catch(() => ({}));
+    if (!j.ok) throw httpErr(r.status === 401 ? 400 : 502, `Telegram: ${j.description || r.status}`);
+    return j.result;
+  }
+
+  allowed(id) {
+    return (this.t.allowed || []).some((a) => String(a.id) === String(id));
+  }
+
+  // ---------- bucle de long polling
+  start() {
+    if (this.running || !this.t.token) return;
+    this.running = true;
+    this.loop();
+  }
+  stop() {
+    this.running = false;
+    this.ctrl?.abort();
+  }
+  async loop() {
+    let wait = 1000;
+    while (this.running && this.t.token) {
+      try {
+        if (!this.me) this.me = await this.call('getMe');
+        this.ctrl = new AbortController();
+        const r = await fetch(`${this.base()}/bot${this.t.token}/getUpdates`, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ offset: this.offset, timeout: this.t.pollTimeout ?? 50, allowed_updates: ['message', 'callback_query'] }),
+          signal: this.ctrl.signal,
+        });
+        const j = await r.json();
+        if (!j.ok) throw new Error(j.description || r.status);
+        for (const u of j.result) {
+          this.offset = u.update_id + 1;
+          await this.onUpdate(u).catch((e) => this.audit.add({ type: 'telegram', what: `Error: ${e.message}` }));
+        }
+        wait = 1000;
+      } catch (e) {
+        if (!this.running) return;
+        await new Promise((res) => setTimeout(res, wait));
+        wait = Math.min(60000, wait * 2);
+      }
+    }
+  }
+
+  // ---------- missatges entrants
+  async onUpdate(u) {
+    if (u.callback_query) return this.onCallback(u.callback_query);
+    const m = u.message;
+    if (!m || !m.chat) return;
+    const chat = m.chat.id;
+    const who = [m.from?.first_name, m.from?.last_name].filter(Boolean).join(' ') || m.chat.title || m.from?.username || String(chat);
+    if (!this.allowed(chat)) {
+      // Fora de la llista: no responem res. Només ho anotem perquè el puguis autoritzar des de l'app.
+      const t = (this.cfg.telegram.pending = (this.t.pending || []).filter((p) => String(p.id) !== String(chat)));
+      t.unshift({ id: chat, name: who, username: m.from?.username || null, t: Date.now() });
+      this.cfg.telegram.pending = t.slice(0, 10);
+      config.save(this.cfg);
+      return;
+    }
+    let text = (m.text || m.caption || '').trim();
+    if (m.voice || m.audio) {
+      const f = m.voice || m.audio;
+      try {
+        const audio = await this.download(f.file_id);
+        text = (await voice.transcribe(this.cfg, audio, f.mime_type || 'audio/ogg')).text;
+        if (!text) return this.send(chat, 'No he entès la nota de veu.');
+        await this.send(chat, `🎙 «${clip(text, 500)}»`);
+      } catch (e) {
+        return this.send(chat, `No he pogut transcriure la nota de veu: ${e.message}`);
+      }
+    }
+    if (!text) return;
+    const [cmd, ...rest] = text.split(/\s+/);
+    const arg = rest.join(' ').trim();
+    switch (cmd.replace(/@.*$/, '').toLowerCase()) {
+      case '/start':
+      case '/ajuda':
+      case '/help':
+        return this.send(chat, 'Escriu-me què vols que facin els agents d’aquest ordinador (o envia una nota de veu).\n\n/nova <text> — comença una conversa nova\n/estat — què està fent cada agent\n/atura — atura la conversa en curs\n\nT’avisaré quan calgui una aprovació o quan acabi una feina.');
+      case '/estat': {
+        const list = this.hub.list().filter((s) => s.state === 'running' || s.state === 'waiting').slice(0, 10);
+        return this.send(chat, list.length ? list.map((s) => `• ${s.title || 'Sessió'} — ${s.state === 'waiting' ? 'espera el teu permís' : 'treballant'}`).join('\n') : 'Cap agent treballant ara mateix.');
+      }
+      case '/atura': {
+        const sid = this.t.last?.[chat];
+        return this.send(chat, sid && this.hub.stop(sid) ? 'Aturat.' : 'No hi ha res en marxa.');
+      }
+      case '/nova':
+        if (!arg) return this.send(chat, 'Escriu què ha de fer després de /nova.');
+        return this.startSession(chat, arg, who, true);
+      default:
+        if (cmd.startsWith('/')) return this.send(chat, 'No conec aquesta ordre. Escriu /ajuda.');
+        return this.startSession(chat, text, who, false);
+    }
+  }
+
+  async startSession(chat, text, who, fresh) {
+    const last = this.t.last?.[chat];
+    const s = !fresh && last ? this.hub.get(last) : null;
+    try {
+      if (s && (s.state === 'running' || s.state === 'waiting')) return this.send(chat, 'L’agent encara està treballant en l’anterior. Espera o escriu /atura.');
+      let sid = s?.id;
+      if (!sid) {
+        const avail = this.available();
+        const agent = avail.includes(this.t.agent) ? this.t.agent : ['claude', 'codex'].find((a) => avail.includes(a)) || avail[0];
+        const ns = this.hub.create({ agent, cwd: this.t.cwd || this.cfg.roots?.[0], mode: this.t.mode || 'preguntar', title: '' });
+        sid = ns.id;
+        this.cfg.telegram.last = { ...(this.t.last || {}), [chat]: sid };
+        config.save(this.cfg);
+      }
+      this.chatOf.set(sid, chat);
+      this.hub.send(sid, text, this.hookUrl ? this.hookUrl() : undefined);
+      this.audit.add({ type: 'telegram', what: `Missatge de Telegram: ${clip(text, 120)}`, by: `Telegram · ${who}`, session: sid });
+      return this.send(chat, '👌 Hi treballo.');
+    } catch (e) {
+      return this.send(chat, `No he pogut començar: ${e.message}`);
+    }
+  }
+
+  async onCallback(q) {
+    const chat = q.message?.chat?.id;
+    if (!this.allowed(chat)) return this.call('answerCallbackQuery', { callback_query_id: q.id, text: 'No autoritzat' }).catch(() => {});
+    const m = String(q.data || '').match(/^a:([\w-]+):(allow|deny)$/);
+    if (!m) return this.call('answerCallbackQuery', { callback_query_id: q.id }).catch(() => {});
+    const who = [q.from?.first_name, q.from?.last_name].filter(Boolean).join(' ') || q.from?.username || 'Telegram';
+    const a = this.hub.decide(m[1], m[2], undefined, `Telegram · ${who}`);
+    await this.call('answerCallbackQuery', { callback_query_id: q.id, text: a ? (m[2] === 'allow' ? 'Aprovat' : 'Rebutjat') : 'Ja estava resolt' }).catch(() => {});
+    if (q.message) {
+      const verdict = a ? (m[2] === 'allow' ? '✅ Aprovat' : '❌ Rebutjat') : 'Ja estava resolt';
+      await this.call('editMessageText', { chat_id: chat, message_id: q.message.message_id, text: `${q.message.text || ''}\n\n${verdict}` }).catch(() => {});
+    }
+  }
+
+  // ---------- avisos sortints
+  async onNotice(n, s) {
+    if (!this.t.token || this.t.notify === false) return;
+    const chats = (this.t.allowed || []).map((a) => a.id);
+    if (!chats.length) return;
+    const text = `${n.title}\n${n.body || ''}`.trim();
+    if (n.approval) {
+      const a = this.hub.approvals.get(n.approval);
+      const why = a?.reason ? `\n\nMotiu: ${clip(a.reason, 300)}` : '';
+      const detail = a ? `\n\n${clip(a.input?.command || a.input?.file_path || JSON.stringify(a.input || {}), 600)}` : '';
+      for (const c of chats) {
+        await this.call('sendMessage', {
+          chat_id: c,
+          text: clip(`${text}${detail}${why}`, 3800),
+          reply_markup: { inline_keyboard: [[{ text: '✅ Aprova', callback_data: `a:${n.approval}:allow` }, { text: '❌ Rebutja', callback_data: `a:${n.approval}:deny` }]] },
+        }).catch(() => {});
+      }
+      return;
+    }
+    // Les feines que ha començat Telegram ja reben la resposta sencera (onHub); aquí la resta.
+    if (s && this.chatOf.has(s.id)) return;
+    for (const c of chats) await this.send(c, text);
+  }
+
+  onHub(m) {
+    if (m.type !== 'event' || m.event?.kind !== 'status' || m.event.state === 'running') return;
+    const chat = this.chatOf.get(m.session);
+    if (!chat) return;
+    const s = this.hub.get(m.session);
+    const evs = s ? s.events : [];
+    const start = evs.map((e) => e.kind).lastIndexOf('user');
+    const texts = evs.slice(start + 1).filter((e) => e.kind === 'text').map((e) => e.text);
+    const err = evs.slice(start + 1).reverse().find((e) => e.kind === 'error');
+    const out = m.event.state === 'error' ? `⚠️ ${err?.text || 'Hi ha hagut un error'}` : texts.join('\n\n') || 'Fet.';
+    this.send(chat, clip(out, 3900)).catch(() => {});
+  }
+
+  send(chat, text) {
+    return this.call('sendMessage', { chat_id: chat, text: clip(text, 4000) }).catch(() => {});
+  }
+
+  async download(fileId) {
+    const f = await this.call('getFile', { file_id: fileId });
+    const r = await fetch(`${this.base()}/file/bot${this.t.token}/${f.file_path}`, { signal: AbortSignal.timeout(30000) });
+    if (!r.ok) throw new Error(`no he pogut baixar l’àudio (${r.status})`);
+    return Buffer.from(await r.arrayBuffer());
+  }
+
+  // ---------- configuració des de l'app (el testimoni del bot no surt mai de l'ordinador)
+  status() {
+    const t = this.t;
+    return {
+      configured: !!t.token,
+      bot: this.me ? { username: this.me.username, name: this.me.first_name } : null,
+      running: this.running,
+      allowed: t.allowed || [],
+      pending: (t.pending || []).filter((p) => !this.allowed(p.id)),
+      agent: t.agent || null,
+      cwd: t.cwd || this.cfg.roots?.[0] || null,
+      mode: t.mode || 'preguntar',
+      notify: t.notify !== false,
+      voice: !!voice.pick(this.cfg, 'stt'),
+    };
+  }
+
+  routes() {
+    const save = () => config.save(this.cfg);
+    return [
+      { method: 'GET', path: '/api/telegram', handler: () => this.status() },
+      {
+        method: 'PUT',
+        path: '/api/telegram',
+        handler: async ({ body }) => {
+          const t = (this.cfg.telegram = this.cfg.telegram || {});
+          if (body.token === null) {
+            this.stop();
+            delete t.token;
+            this.me = null;
+          } else if (typeof body.token === 'string' && body.token.trim()) {
+            const tok = body.token.trim();
+            if (!TOKEN_RE.test(tok)) throw httpErr(400, 'Aquest no sembla un testimoni de BotFather (123456:ABC…)');
+            const prev = t.token;
+            t.token = tok;
+            try {
+              this.me = await this.call('getMe');
+            } catch (e) {
+              t.token = prev;
+              throw httpErr(400, `Telegram no accepta aquest testimoni: ${e.message}`);
+            }
+            this.stop();
+            this.offset = undefined;
+          }
+          if (['claude', 'codex', 'demo'].includes(body.agent)) t.agent = body.agent;
+          if (['llegir', 'preguntar', 'tot'].includes(body.mode)) t.mode = body.mode;
+          if (typeof body.cwd === 'string' && body.cwd) t.cwd = body.cwd;
+          if (typeof body.notify === 'boolean') t.notify = body.notify;
+          save();
+          if (t.token) setTimeout(() => this.start(), 0);
+          return this.status();
+        },
+      },
+      {
+        method: 'POST',
+        path: '/api/telegram/allow',
+        handler: ({ body, device }) => {
+          const t = (this.cfg.telegram = this.cfg.telegram || {});
+          const id = Number(body.id);
+          if (!Number.isSafeInteger(id)) throw httpErr(400, 'Identificador de xat no vàlid');
+          const p = (t.pending || []).find((x) => Number(x.id) === id);
+          t.allowed = (t.allowed || []).filter((a) => Number(a.id) !== id);
+          t.allowed.push({ id, name: String(body.name || p?.name || id).slice(0, 60), added: Date.now() });
+          t.pending = (t.pending || []).filter((x) => Number(x.id) !== id);
+          save();
+          this.audit.add({ type: 'device', what: `Xat de Telegram autoritzat: ${t.allowed.at(-1).name}`, by: device?.name });
+          this.send(id, 'Fet: ja pots parlar amb els agents d’aquest ordinador. Escriu /ajuda.');
+          return this.status();
+        },
+      },
+      {
+        method: 'DELETE',
+        path: /^\/api\/telegram\/allow\/(-?\d+)$/,
+        handler: ({ params, device }) => {
+          const t = this.cfg.telegram || {};
+          const gone = (t.allowed || []).find((a) => String(a.id) === params[0]);
+          t.allowed = (t.allowed || []).filter((a) => String(a.id) !== params[0]);
+          t.pending = (t.pending || []).filter((a) => String(a.id) !== params[0]);
+          save();
+          if (gone) this.audit.add({ type: 'device', what: `Xat de Telegram tret: ${gone.name}`, by: device?.name });
+          return this.status();
+        },
+      },
+    ];
+  }
+}
+
+module.exports = { Telegram, TOKEN_RE };