opencode-router 0.11.113 → 0.11.115

package/README.md

@@ -63,6 +63,7 @@ Important for direct sends and bindings:
 - Telegram targets must use numeric `chat_id` values.
 - `@username` values are not valid direct `peerId` targets for router sends.
 - If a user has not started a chat with the bot yet, Telegram may return `chat not found`.
+- Private Telegram identities can require first-chat pairing with `/pair <code>` before commands are accepted.
 
 ## Slack (Socket Mode)
 

package/dist/bridge.js

@@ -1,4 +1,5 @@
 import { setTimeout as delay } from "node:timers/promises";
+import { createHash } from "node:crypto";
 import { readFile, stat } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { readConfigFile, writeConfigFile } from "./config.js";
@@ -90,6 +91,30 @@ function invalidTelegramPeerIdError() {
     error.status = 400;
     return error;
 }
+const PAIRING_CODE_HASH_PATTERN = /^[a-f0-9]{64}$/;
+function normalizeTelegramAccess(value) {
+    const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+    return raw === "private" ? "private" : "public";
+}
+function normalizePairingCodeHash(value) {
+    const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+    if (!PAIRING_CODE_HASH_PATTERN.test(raw))
+        return "";
+    return raw;
+}
+function normalizePairingCodeValue(value) {
+    return value.trim().toUpperCase().replace(/[^A-Z0-9]/g, "");
+}
+function hashPairingCode(value) {
+    return createHash("sha256").update(normalizePairingCodeValue(value)).digest("hex");
+}
+function extractPairingCodeFromCommand(text) {
+    const trimmed = text.trim();
+    const match = trimmed.match(/^\/pair(?:@[A-Za-z0-9_]+)?\s+(.+)$/i);
+    if (!match?.[1])
+        return "";
+    return normalizePairingCodeValue(match[1]);
+}
 function normalizeIdentityId(value) {
     const trimmed = (value ?? "").trim();
     if (!trimmed)
@@ -194,6 +219,22 @@ export async function startBridge(config, logger, reporter, deps = {}) {
         const app = config.slackApps.find((entry) => entry.id === id);
         return typeof app?.directory === "string" ? String(app.directory).trim() : "";
     };
+    const resolveTelegramIdentityAccess = (identityId) => {
+        const id = identityId.trim();
+        if (!id) {
+            return { access: "public", pairingCodeHash: "" };
+        }
+        const bot = config.telegramBots.find((entry) => entry.id === id);
+        if (!bot) {
+            return { access: "public", pairingCodeHash: "" };
+        }
+        const access = normalizeTelegramAccess(bot.access);
+        const pairingCodeHash = normalizePairingCodeHash(bot.pairingCodeHash);
+        if (access !== "private") {
+            return { access: "public", pairingCodeHash: "" };
+        }
+        return { access: "private", pairingCodeHash };
+    };
     const listIdentityConfigs = (channel) => {
         if (channel === "telegram") {
             return config.telegramBots.map((bot) => ({ id: bot.id, directory: (bot.directory ?? "").trim() }));
@@ -465,6 +506,8 @@ export async function startBridge(config, logger, reporter, deps = {}) {
                         id: bot.id,
                         enabled: bot.enabled !== false,
                         running: adapters.has(adapterKey("telegram", bot.id)),
+                        access: normalizeTelegramAccess(bot.access),
+                        pairingRequired: normalizeTelegramAccess(bot.access) === "private",
                     })),
                 };
             },
@@ -477,6 +520,8 @@ export async function startBridge(config, logger, reporter, deps = {}) {
                     throw new Error("identity id 'env' is reserved");
                 const enabled = input.enabled !== false;
                 const directoryInput = typeof input.directory === "string" ? input.directory.trim() : "";
+                const requestedAccess = typeof input.access === "string" && input.access.trim() ? normalizeTelegramAccess(input.access) : undefined;
+                const requestedPairingCodeHash = normalizePairingCodeHash(input.pairingCodeHash);
                 // Persist to config file.
                 const { config: current } = readConfigFile(config.configPath);
                 const telegram = current.channels?.telegram;
@@ -495,10 +540,36 @@ export async function startBridge(config, logger, reporter, deps = {}) {
                     found = true;
                     const existingDirectory = typeof record.directory === "string" ? record.directory.trim() : "";
                     const directory = directoryInput || existingDirectory;
-                    nextBots.push({ id, token, enabled, ...(directory ? { directory } : {}) });
+                    const existingAccess = normalizeTelegramAccess(record.access);
+                    const existingPairingCodeHash = normalizePairingCodeHash(record.pairingCodeHash);
+                    const access = requestedAccess ?? existingAccess;
+                    const pairingCodeHash = access === "private" ? requestedPairingCodeHash || existingPairingCodeHash : "";
+                    if (access === "private" && !pairingCodeHash) {
+                        throw new Error("pairingCodeHash is required when Telegram access is private");
+                    }
+                    nextBots.push({
+                        id,
+                        token,
+                        enabled,
+                        ...(directory ? { directory } : {}),
+                        access,
+                        ...(access === "private" ? { pairingCodeHash } : {}),
+                    });
                 }
                 if (!found) {
-                    nextBots.push({ id, token, enabled, ...(directoryInput ? { directory: directoryInput } : {}) });
+                    const access = requestedAccess ?? "public";
+                    const pairingCodeHash = access === "private" ? requestedPairingCodeHash : "";
+                    if (access === "private" && !pairingCodeHash) {
+                        throw new Error("pairingCodeHash is required when Telegram access is private");
+                    }
+                    nextBots.push({
+                        id,
+                        token,
+                        enabled,
+                        ...(directoryInput ? { directory: directoryInput } : {}),
+                        access,
+                        ...(access === "private" ? { pairingCodeHash } : {}),
+                    });
                 }
                 const next = {
                     ...current,
@@ -516,13 +587,41 @@ export async function startBridge(config, logger, reporter, deps = {}) {
                 config.configFile = next;
                 // Update runtime identity list.
                 const existingIdx = config.telegramBots.findIndex((bot) => bot.id === id);
+                let runtimeAccess = requestedAccess ?? "public";
+                let runtimePairingCodeHash = requestedPairingCodeHash;
                 if (existingIdx >= 0) {
                     const prev = config.telegramBots[existingIdx];
                     const nextDirectory = directoryInput || prev?.directory || undefined;
-                    config.telegramBots[existingIdx] = { id, token, enabled, ...(nextDirectory ? { directory: String(nextDirectory).trim() } : {}) };
+                    const prevAccess = normalizeTelegramAccess(prev?.access);
+                    const prevPairingCodeHash = normalizePairingCodeHash(prev?.pairingCodeHash);
+                    runtimeAccess = requestedAccess ?? prevAccess;
+                    runtimePairingCodeHash = runtimeAccess === "private" ? requestedPairingCodeHash || prevPairingCodeHash : "";
+                    if (runtimeAccess === "private" && !runtimePairingCodeHash) {
+                        throw new Error("pairingCodeHash is required when Telegram access is private");
+                    }
+                    config.telegramBots[existingIdx] = {
+                        id,
+                        token,
+                        enabled,
+                        ...(nextDirectory ? { directory: String(nextDirectory).trim() } : {}),
+                        access: runtimeAccess,
+                        ...(runtimeAccess === "private" ? { pairingCodeHash: runtimePairingCodeHash } : {}),
+                    };
                 }
                 else {
-                    config.telegramBots.push({ id, token, enabled, ...(directoryInput ? { directory: directoryInput } : {}) });
+                    runtimeAccess = requestedAccess ?? "public";
+                    runtimePairingCodeHash = runtimeAccess === "private" ? requestedPairingCodeHash : "";
+                    if (runtimeAccess === "private" && !runtimePairingCodeHash) {
+                        throw new Error("pairingCodeHash is required when Telegram access is private");
+                    }
+                    config.telegramBots.push({
+                        id,
+                        token,
+                        enabled,
+                        ...(directoryInput ? { directory: directoryInput } : {}),
+                        access: runtimeAccess,
+                        ...(runtimeAccess === "private" ? { pairingCodeHash: runtimePairingCodeHash } : {}),
+                    });
                 }
                 // Start/stop adapter.
                 const key = adapterKey("telegram", id);
@@ -537,7 +636,13 @@ export async function startBridge(config, logger, reporter, deps = {}) {
                         }
                         adapters.delete(key);
                     }
-                    return { id, enabled: false, applied: true };
+                    return {
+                        id,
+                        enabled: false,
+                        access: runtimeAccess,
+                        pairingRequired: runtimeAccess === "private",
+                        applied: true,
+                    };
                 }
                 if (existing) {
                     try {
@@ -548,7 +653,16 @@ export async function startBridge(config, logger, reporter, deps = {}) {
                     }
                     adapters.delete(key);
                 }
-                const base = createTelegramAdapter({ id, token, enabled, ...(directoryInput ? { directory: directoryInput } : {}) }, config, logger, handleInbound);
+                const base = createTelegramAdapter({
+                    id,
+                    token,
+                    enabled,
+                    ...(directoryInput ? { directory: directoryInput } : {}),
+                    access: runtimeAccess,
+                    ...(runtimeAccess === "private" && runtimePairingCodeHash
+                        ? { pairingCodeHash: runtimePairingCodeHash }
+                        : {}),
+                }, config, logger, handleInbound);
                 const adapter = { ...base, key };
                 adapters.set(key, adapter);
                 const startResult = await startAdapterBounded(adapter, {
@@ -559,12 +673,32 @@ export async function startBridge(config, logger, reporter, deps = {}) {
                     },
                 });
                 if (startResult.status === "timeout") {
-                    return { id, enabled: true, applied: false, starting: true };
+                    return {
+                        id,
+                        enabled: true,
+                        access: runtimeAccess,
+                        pairingRequired: runtimeAccess === "private",
+                        applied: false,
+                        starting: true,
+                    };
                 }
                 if (startResult.status === "error") {
-                    return { id, enabled: true, applied: false, error: String(startResult.error) };
+                    return {
+                        id,
+                        enabled: true,
+                        access: runtimeAccess,
+                        pairingRequired: runtimeAccess === "private",
+                        applied: false,
+                        error: String(startResult.error),
+                    };
                 }
-                return { id, enabled: true, applied: true };
+                return {
+                    id,
+                    enabled: true,
+                    access: runtimeAccess,
+                    pairingRequired: runtimeAccess === "private",
+                    applied: true,
+                };
             },
             deleteTelegramIdentity: async (rawId) => {
                 const id = normalizeIdentityId(rawId);
@@ -1135,6 +1269,50 @@ export async function startBridge(config, logger, reporter, deps = {}) {
             await adapter.sendText(peerId, chunk);
         }
     }
+    async function handleTelegramPairingGate(input) {
+        const access = resolveTelegramIdentityAccess(input.identityId);
+        if (access.access !== "private") {
+            return "continue";
+        }
+        const hasKnownBinding = Boolean(input.bindingDirectory?.trim() || input.sessionDirectory?.trim());
+        if (hasKnownBinding) {
+            return "continue";
+        }
+        const pairingCode = extractPairingCodeFromCommand(input.text);
+        if (!pairingCode) {
+            await sendText("telegram", input.identityId, input.peerId, "This Telegram bot is private. Ask your OpenWork host for the pairing code, then send /pair <code>.", { kind: "system" });
+            return "handled";
+        }
+        if (!access.pairingCodeHash) {
+            await sendText("telegram", input.identityId, input.peerId, "This Telegram bot is private but missing a pairing code. Ask your OpenWork host to reconnect it.", { kind: "system" });
+            return "handled";
+        }
+        if (hashPairingCode(pairingCode) !== access.pairingCodeHash) {
+            await sendText("telegram", input.identityId, input.peerId, "Invalid pairing code. Try again with /pair <code>.", {
+                kind: "system",
+            });
+            return "handled";
+        }
+        const identityDirectory = resolveIdentityDirectory("telegram", input.identityId);
+        const boundDirectoryCandidate = identityDirectory || defaultDirectory;
+        const hasExplicitBinding = Boolean(identityDirectory);
+        if (!boundDirectoryCandidate || (!hasExplicitBinding && isDangerousRootDirectory(boundDirectoryCandidate))) {
+            await sendText("telegram", input.identityId, input.peerId, "No workspace directory configured for this identity. Ask your OpenWork host to set it, or reply with /dir <path>.", { kind: "system" });
+            return "handled";
+        }
+        const scopedBound = resolveScopedDirectory(boundDirectoryCandidate);
+        if (!scopedBound.ok) {
+            await sendText("telegram", input.identityId, input.peerId, scopedBound.error, { kind: "system" });
+            return "handled";
+        }
+        const boundDirectory = scopedBound.directory;
+        store.upsertBinding("telegram", input.identityId, input.peerKey, boundDirectory);
+        store.deleteSession("telegram", input.identityId, input.peerKey);
+        ensureEventSubscription(boundDirectory);
+        logger.info({ channel: "telegram", identityId: input.identityId, peerId: input.peerKey, directory: boundDirectory }, "telegram private identity paired");
+        await sendText("telegram", input.identityId, input.peerId, "Pairing successful. This chat is now linked to your worker.", { kind: "system" });
+        return "handled";
+    }
     async function handleInbound(message) {
         const adapter = adapters.get(adapterKey(message.channel, message.identityId));
         if (!adapter)
@@ -1151,8 +1329,24 @@ export async function startBridge(config, logger, reporter, deps = {}) {
         }, "inbound received");
         logger.info({ channel: inbound.channel, identityId: inbound.identityId, peerId: inbound.peerId, length: inbound.text.length }, "received message");
         const peerKey = inbound.peerId;
-        // Handle bot commands
         const trimmedText = inbound.text.trim();
+        let binding = store.getBinding(inbound.channel, inbound.identityId, peerKey);
+        let session = store.getSession(inbound.channel, inbound.identityId, peerKey);
+        if (inbound.channel === "telegram") {
+            const pairingGate = await handleTelegramPairingGate({
+                identityId: inbound.identityId,
+                peerKey,
+                peerId: inbound.peerId,
+                text: trimmedText,
+                ...(binding?.directory?.trim() ? { bindingDirectory: binding.directory } : {}),
+                ...(session?.directory?.trim() ? { sessionDirectory: session.directory ?? undefined } : {}),
+            });
+            if (pairingGate === "handled")
+                return;
+            binding = store.getBinding(inbound.channel, inbound.identityId, peerKey);
+            session = store.getSession(inbound.channel, inbound.identityId, peerKey);
+        }
+        // Handle bot commands
         if (trimmedText.startsWith("/")) {
             const commandHandled = await handleCommand(inbound.channel, inbound.identityId, peerKey, inbound.peerId, trimmedText);
             if (commandHandled)
@@ -1165,8 +1359,6 @@ export async function startBridge(config, logger, reporter, deps = {}) {
             text: inbound.text,
             fromMe: inbound.fromMe,
         });
-        const binding = store.getBinding(inbound.channel, inbound.identityId, peerKey);
-        const session = store.getSession(inbound.channel, inbound.identityId, peerKey);
         const identityDirectory = resolveIdentityDirectory(inbound.channel, inbound.identityId);
         const boundDirectoryCandidate = binding?.directory?.trim() || session?.directory?.trim() || identityDirectory || defaultDirectory;
         const hasExplicitBinding = Boolean(binding?.directory?.trim() || session?.directory?.trim() || identityDirectory);
@@ -1180,7 +1372,8 @@ export async function startBridge(config, logger, reporter, deps = {}) {
             return;
         }
         const boundDirectory = scopedBound.directory;
-        if (!binding?.directory?.trim()) {
+        const shouldAutoBind = !(inbound.channel === "telegram" && resolveTelegramIdentityAccess(inbound.identityId).access === "private");
+        if (shouldAutoBind && !binding?.directory?.trim()) {
             store.upsertBinding(inbound.channel, inbound.identityId, peerKey, boundDirectory);
         }
         ensureEventSubscription(boundDirectory);
@@ -1353,6 +1546,28 @@ export async function startBridge(config, logger, reporter, deps = {}) {
             logger.info({ channel, peerId: peerKey }, "session and model reset");
             return true;
         }
+        if (command === "pair") {
+            if (channel !== "telegram") {
+                await sendText(channel, identityId, peerId, "Pairing is only available for Telegram private bots.", {
+                    kind: "system",
+                });
+                return true;
+            }
+            const binding = store.getBinding(channel, identityId, peerKey);
+            const session = store.getSession(channel, identityId, peerKey);
+            const pairingGate = await handleTelegramPairingGate({
+                identityId,
+                peerKey,
+                peerId,
+                text,
+                ...(binding?.directory?.trim() ? { bindingDirectory: binding.directory } : {}),
+                ...(session?.directory?.trim() ? { sessionDirectory: session.directory ?? undefined } : {}),
+            });
+            if (pairingGate === "handled")
+                return true;
+            await sendText(channel, identityId, peerId, "This chat is already paired.", { kind: "system" });
+            return true;
+        }
         if (command === "dir" || command === "cd") {
             const next = args.join(" ").trim();
             if (!next) {
@@ -1385,7 +1600,7 @@ export async function startBridge(config, logger, reporter, deps = {}) {
         }
         // /help command
         if (command === "help") {
-            const helpText = `/opus - Claude Opus 4.5\n/codex - GPT 5.2 Codex\n/dir <path> - bind this chat to a workspace directory\n/dir - show current directory\n/agent - show workspace agent scope/path\n/model - show current\n/reset - start fresh\n/help - this`;
+            const helpText = `/opus - Claude Opus 4.5\n/codex - GPT 5.2 Codex\n/pair <code> - pair this chat with a private Telegram bot\n/dir <path> - bind this chat to a workspace directory\n/dir - show current directory\n/agent - show workspace agent scope/path\n/model - show current\n/reset - start fresh\n/help - this`;
             await sendText(channel, identityId, peerId, helpText, { kind: "system" });
             return true;
         }

package/dist/config.js

@@ -73,6 +73,17 @@ function normalizeId(value) {
     const safe = trimmed.replace(/[^a-zA-Z0-9_.-]+/g, "-");
     return safe.replace(/^-+|-+$/g, "").slice(0, 48) || "default";
 }
+const PAIRING_CODE_HASH_PATTERN = /^[a-f0-9]{64}$/;
+function normalizeTelegramAccess(value) {
+    const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+    return raw === "private" ? "private" : "public";
+}
+function normalizePairingCodeHash(value) {
+    const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+    if (!PAIRING_CODE_HASH_PATTERN.test(raw))
+        return "";
+    return raw;
+}
 function coerceTelegramBots(file) {
     const telegram = file.channels?.telegram;
     const bots = Array.isArray(telegram?.bots) ? telegram.bots : [];
@@ -86,11 +97,14 @@ function coerceTelegramBots(file) {
             continue;
         const id = normalizeId(typeof record.id === "string" ? record.id : "default");
         const directory = typeof record.directory === "string" ? record.directory.trim() : "";
+        const access = normalizeTelegramAccess(record.access);
+        const pairingCodeHash = normalizePairingCodeHash(record.pairingCodeHash);
         normalized.push({
             id,
             token,
             enabled: record.enabled === undefined ? true : record.enabled === true,
             ...(directory ? { directory } : {}),
+            ...(access === "private" ? { access, ...(pairingCodeHash ? { pairingCodeHash } : {}) } : { access: "public" }),
         });
     }
     if (normalized.length)

package/dist/health.js

@@ -155,6 +155,8 @@ export async function startHealthServer(port, getStatus, logger, handlers = {})
                     const token = typeof payload.token === "string" ? payload.token.trim() : "";
                     const id = typeof payload.id === "string" ? payload.id.trim() : undefined;
                     const directory = typeof payload.directory === "string" ? payload.directory.trim() : undefined;
+                    const access = typeof payload.access === "string" ? payload.access.trim() : undefined;
+                    const pairingCodeHash = typeof payload.pairingCodeHash === "string" ? payload.pairingCodeHash.trim() : undefined;
                     const enabled = payload.enabled === undefined ? undefined : payload.enabled === true || payload.enabled === "true";
                     if (!token) {
                         res.writeHead(400, { "Content-Type": "application/json" });
@@ -166,14 +168,18 @@ export async function startHealthServer(port, getStatus, logger, handlers = {})
                         token,
                         ...(enabled === undefined ? {} : { enabled }),
                         ...(directory ? { directory } : {}),
+                        ...(access ? { access: access } : {}),
+                        ...(pairingCodeHash ? { pairingCodeHash } : {}),
                     });
                     res.writeHead(200, { "Content-Type": "application/json" });
                     res.end(JSON.stringify({ ok: true, telegram: result }));
                     return;
                 }
                 catch (error) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ ok: false, error: String(error) }));
+                    const statusRaw = error?.status;
+                    const status = typeof statusRaw === "number" && statusRaw >= 400 && statusRaw < 600 ? statusRaw : 500;
+                    res.writeHead(status, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: String(error instanceof Error ? error.message : error) }));
                     return;
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-router",
-  "version": "0.11.113",
+  "version": "0.11.115",
   "description": "opencode-router: Slack + Telegram bridge + directory routing for a running opencode server",
   "private": false,
   "type": "module",