omni-notify-mcp 1.3.21 → 1.3.23

package/dist/ui/messaging/telegramError.js

@@ -0,0 +1,6 @@
+export async function telegramSendErrorHint(r) {
+    if (r.status === 401) {
+        return "the bot token is invalid or has been revoked — open @BotFather, check the bot behind this token (or create a new one), and update it in the settings UI";
+    }
+    return r.text();
+}

package/dist/ui/server.js

@@ -13,6 +13,7 @@ import nodemailer from "nodemailer";
 import { PinpointSMSVoiceV2Client, SendTextMessageCommand, DescribePhoneNumbersCommand, DescribeVerifiedDestinationNumbersCommand } from "@aws-sdk/client-pinpoint-sms-voice-v2";
 import { tmpdir } from "os";
 import { sendWithRouting, idleReading, formatIdleReading, describePriorityRouting } from "./messaging/notificationEngine.js";
+import { telegramSendErrorHint } from "./messaging/telegramError.js";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -152,32 +153,37 @@ const LEGACY_SECRETS_PATH = join(homedir(), ".notify-mcp-secrets");
 function e164(s) {
     return String(s ?? "").replace(/[^\d+]/g, "");
 }
+// The ONE list of credential-shaped fields, read by both maskSecrets() (out)
+// and mergePreservingSecrets() (back in). Before story #442 these were two
+// hand-written lists of `if`/`guard` calls kept in sync by hand — that's
+// exactly how ntfy.token got added to a channel (story #427's "brainless
+// config" import) without ever being added to either list, and leaked in the
+// clear over `GET /api/config` for as long as the channel existed. A field
+// belongs here the moment its channel gets one that authenticates outbound
+// (a token, password, or bearer webhook URL) — see
+// tests/smoke.test.mjs's naming-convention test, which independently catches
+// a field like this one being added to defaultConfig() but not to this list.
+const SENSITIVE_FIELDS = [
+    ["email", "pass"],
+    ["email", "clientSecret"],
+    ["email", "refreshToken"],
+    ["email", "accessToken"],
+    ["sms", "secretAccessKey"],
+    ["telegram", "token"],
+    ["ntfy", "token"],
+    ["discord", "webhookUrl"],
+    ["discord", "clientSecret"],
+    ["slack", "webhookUrl"],
+    ["slack", "botToken"],
+    ["slack", "clientSecret"],
+    ["teams", "webhookUrl"],
+];
 function maskSecrets(config) {
     const c = JSON.parse(JSON.stringify(config));
-    if (c.email?.pass)
-        c.email.pass = MASKED;
-    if (c.email?.clientSecret)
-        c.email.clientSecret = MASKED;
-    if (c.email?.refreshToken)
-        c.email.refreshToken = MASKED;
-    if (c.email?.accessToken)
-        c.email.accessToken = MASKED;
-    if (c.sms?.secretAccessKey)
-        c.sms.secretAccessKey = MASKED;
-    if (c.telegram?.token)
-        c.telegram.token = MASKED;
-    if (c.discord?.webhookUrl)
-        c.discord.webhookUrl = MASKED;
-    if (c.discord?.clientSecret)
-        c.discord.clientSecret = MASKED;
-    if (c.slack?.webhookUrl)
-        c.slack.webhookUrl = MASKED;
-    if (c.slack?.botToken)
-        c.slack.botToken = MASKED;
-    if (c.slack?.clientSecret)
-        c.slack.clientSecret = MASKED;
-    if (c.teams?.webhookUrl)
-        c.teams.webhookUrl = MASKED;
+    for (const [sec, field] of SENSITIVE_FIELDS) {
+        if (c[sec]?.[field])
+            c[sec][field] = MASKED;
+    }
     delete c.whatsapp;
     return c;
 }
@@ -192,24 +198,11 @@ function mergePreservingSecrets(existing, update) {
     }
     if (typeof update.muteAll === "boolean")
         merged.muteAll = update.muteAll;
-    const guard = (path) => {
-        const [sec, field] = path;
+    for (const [sec, field] of SENSITIVE_FIELDS) {
         if (update[sec]?.[field] === MASKED) {
             merged[sec][field] = existing[sec]?.[field] ?? "";
         }
-    };
-    guard(["email", "pass"]);
-    guard(["email", "clientSecret"]);
-    guard(["email", "refreshToken"]);
-    guard(["email", "accessToken"]);
-    guard(["sms", "secretAccessKey"]);
-    guard(["telegram", "token"]);
-    guard(["discord", "webhookUrl"]);
-    guard(["discord", "clientSecret"]);
-    guard(["slack", "webhookUrl"]);
-    guard(["slack", "botToken"]);
-    guard(["slack", "clientSecret"]);
-    guard(["teams", "webhookUrl"]);
+    }
     return merged;
 }
 const app = express();
@@ -562,7 +555,7 @@ app.post("/api/test/telegram", async (_req, res) => {
             if (r.ok)
                 sent++;
             else
-                errors.push(`${chatId}: ${r.status} ${await r.text()}`);
+                errors.push(`${chatId}: ${await telegramSendErrorHint(r)}`);
         }
         catch (err) {
             errors.push(`${chatId}: ${err instanceof Error ? err.message : String(err)}`);
@@ -1518,10 +1511,11 @@ async function sendNotification(message, priority, client) {
                         headers: { "Content-Type": "application/json" },
                         body: JSON.stringify(body),
                     });
-                    if (r.ok)
+                    if (r.ok) {
                         sent++;
-                    else
-                        errors.push(`${chatId}: ${await r.text()}`);
+                        continue;
+                    }
+                    errors.push(`${chatId}: ${await telegramSendErrorHint(r)}`);
                 }
                 if (sent === 0 && errors.length)
                     throw new Error(errors.join("; "));
@@ -2843,6 +2837,10 @@ function createMcpServer(clientId, sessionTag) {
                 ? `\n\nReply with: @${sessionTag} <your answer>`
                 : `\n\nReply to this message with your answer.`;
             for (const chatId of cfg.telegram.chatIds) {
+                // A non-2xx Telegram response does NOT reject this fetch — only a
+                // network-level failure does — so this used to silently do nothing
+                // on e.g. a revoked token: no error, no log line, just a question
+                // the user never saw and no clue why. Story #443: check r.ok too.
                 await fetch(`https://api.telegram.org/bot${cfg.telegram.token}/sendMessage`, {
                     method: "POST",
                     headers: { "Content-Type": "application/json" },
@@ -2850,7 +2848,10 @@ function createMcpServer(clientId, sessionTag) {
                         chat_id: chatId,
                         text: `${askPrefix} ${question}${replyHint}`,
                     }),
-                }).catch((err) => log("→", "ask:telegram", `ERROR: ${err}`, clientId));
+                })
+                    .then(async (r) => { if (!r.ok)
+                    log("→", "ask:telegram", `ERROR: ${chatId}: ${await telegramSendErrorHint(r)}`, clientId); })
+                    .catch((err) => log("→", "ask:telegram", `ERROR: ${chatId}: ${err}`, clientId));
             }
         }
         const email = cfg.email ?? {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omni-notify-mcp",
-  "version": "1.3.21",
+  "version": "1.3.23",
   "description": "Reach your AI agents from anywhere — and let them reach you. Every notification channel is set up in one config UI with one-click server launch: desktop, Telegram, Slack, SMS, email, ntfy. Agents then notify you when long work finishes or a decision is needed, ask you a question and wait for your answer, and receive and reply to the messages you send them — with Do Not Disturb and idle detection deciding what actually gets through.",
   "main": "dist/index.js",
   "type": "module",