pi-harness-runtime 1.1.161 → 1.1.162

package/packages/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Session management system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/session-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session-api",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/session-export/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/session-export",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/shared-context/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/shared-context",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — shared-context",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skill-mcp-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/skill-mcp-client",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "MCP client for Skills SaaS backend",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skill-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skill-registry",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Skill Registry for pi-harness-runtime — dynamic skill discovery and invocation",
   "type": "module",
   "main": "./dist/index.js",

package/packages/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/skills",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "File-based skill system with pi.dev compatibility and Hermes self-improvement",
   "type": "module",
   "main": "src/index.ts",

package/packages/sprint-planner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/sprint-planner",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "type": "module",
   "description": "Sprint planning engine for pi-harness",
   "main": "dist/index.js",

package/packages/subscription-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/subscription-engine",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/task-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/task-compiler",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Task Compiler for pi-harness-runtime — produces deterministic task DAG from CompiledRequirement",
   "type": "module",
   "main": "./dist/index.js",

package/packages/tencentdb-memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/tencentdb-memory",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "TencentDB Agent Memory client - sync skills to centralized knowledge base",
   "type": "module",
   "main": "src/index.ts",

package/packages/tencentdb-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tencentdb-sync",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Sync SKILL.md skills to TencentDB-Agent-Memory server (RFC-0105/0106)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-data-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/test-data-generator",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Test data generation for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/test-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/test-generator",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Auto-Test Generator — generate unit and E2E tests from source code (RFC-0013)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/todo-bd-sync/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/todo-bd-sync",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Two-way sync between rpiv-todo overlay and bd issue tracker",
   "type": "module",
   "main": "src/index.ts",

package/packages/token-estimation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-estimation",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — token-estimation",
   "type": "module",
   "main": "./dist/index.js",

package/packages/token-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-optimizer",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Token Budget Optimizer — maximize prompt value within token limits (RFC-0011)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/trajectory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/trajectory",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Trajectory capture for the write-review loop — persists cycle records for learning",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tui",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — tui",
   "type": "module",
   "main": "./dist/index.js",

package/packages/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/types",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Shared TypeScript types for pi-harness-runtime packages",
   "type": "module",
   "main": "./src/index.js",

package/packages/workflow-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workflow-events",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/workspace-scanner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workspace-scanner",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/worktree/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/worktree",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "pi-harness-runtime — worktree",
   "type": "module",
   "main": "./dist/index.js",

package/packages/write-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/write-review",
-  "version": "1.1.161",
+  "version": "1.1.162",
   "description": "Two-agent write-review loop with blackboard coordination",
   "type": "module",
   "main": "src/index.ts",

package/scripts/telegram-webhook-server.ts

@@ -17,7 +17,8 @@ import { createServer } from "node:http";
 
 // --- Configuration ---
 const BOT_TOKEN = process.env.TELEGRAM_BOT_TOKEN;
-const WEBHOOK_SECRET = process.env.TELEGRAM_WEBHOOK_SECRET || "default-secret-change-me";
+// SECURITY: Require webhook secret - fail closed if not set
+const WEBHOOK_SECRET = process.env.TELEGRAM_WEBHOOK_SECRET;
 const WEBHOOK_URL = process.env.TELEGRAM_WEBHOOK_URL;
 const CALLBACK_QUEUE_FILE = process.env.CALLBACK_QUEUE_FILE || join(process.env.HOME || "/tmp", ".pi-harness-runtime", "callback-queue.jsonl");
 const PORT = parseInt(process.env.PORT || "3000", 10);
@@ -26,10 +27,70 @@ const PORT = parseInt(process.env.PORT || "3000", 10);
 if (!BOT_TOKEN) {
   console.error("[TelegramWebhook] ERROR: TELEGRAM_BOT_TOKEN not set");
   console.error("[TelegramWebhook] Usage:");
-  console.error("[TelegramWebhook]   TELEGRAM_BOT_TOKEN=xxx bun run scripts/telegram-webhook-server.ts");
+  console.error("[TelegramWebhook]   TELEGRAM_BOT_TOKEN=xxx TELEGRAM_WEBHOOK_SECRET=xxx bun run scripts/telegram-webhook-server.ts");
   process.exit(1);
 }
 
+// SECURITY: Require webhook secret - fail closed in production
+if (!WEBHOOK_SECRET) {
+  console.error("[TelegramWebhook] ERROR: TELEGRAM_WEBHOOK_SECRET not set");
+  console.error("[TelegramWebhook] SECURITY: Webhook secret is required for production");
+  console.error("[TelegramWebhook] Usage:");
+  console.error("[TelegramWebhook]   TELEGRAM_WEBHOOK_SECRET=<high-entropy-secret> bun run scripts/telegram-webhook-server.ts");
+  process.exit(1);
+}
+
+// --- Authorization helpers ---
+function getAllowedUserIds(): Set<number> {
+  const ids = new Set<number>();
+
+  // Priority 1: Environment variable
+  const envUsers = process.env.TELEGRAM_ALLOWED_USERS;
+  if (envUsers) {
+    for (const part of envUsers.split(",")) {
+      const num = parseInt(part.trim(), 10);
+      if (!isNaN(num) && num > 0) ids.add(num);
+    }
+  }
+
+  // Priority 2: Key file (telegram-allowed-users.txt)
+  const allowedFile = join(process.env.HOME || "/tmp", ".pi-harness-runtime", "keys", "telegram-allowed-users.txt");
+  if (existsSync(allowedFile)) {
+    const content = readFileSync(allowedFile, "utf8").trim();
+    for (const part of content.split(",")) {
+      const num = parseInt(part.trim(), 10);
+      if (!isNaN(num) && num > 0) ids.add(num);
+    }
+  }
+
+  // Priority 3: Legacy chat ID file
+  const legacyFile = join(process.env.HOME || "/tmp", ".pi-harness-runtime", "keys", "telegram-chat-id.txt");
+  if (existsSync(legacyFile) && ids.size === 0) {
+    const content = readFileSync(legacyFile, "utf8").trim();
+    const num = parseInt(content, 10);
+    if (!isNaN(num) && num > 0) ids.add(num);
+  }
+
+  return ids;
+}
+
+function isAuthorizedUser(userId: number): boolean {
+  const allowed = getAllowedUserIds();
+  // SECURITY: Fail closed - deny if no allowlist configured
+  if (allowed.size === 0) {
+    console.warn("[TelegramWebhook] SECURITY: No TELEGRAM_ALLOWED_USERS configured - denying access");
+    return false;
+  }
+  return allowed.has(userId);
+}
+
+// SECURITY: Sanitize URLs from error messages
+function sanitizeError(error: unknown): string {
+  const msg = String(error);
+  // Remove any bot token URLs
+  return msg.replace(/https?:\/\/[^/]*\/bot[^/]+\/[^\s]*/gi, "[REDACTED_URL]");
+}
+
 // --- Types ---
 interface CallbackQuery {
   id: string;
@@ -275,7 +336,24 @@ function handleRequest(req: import("node:http").IncomingMessage, res: import("no
         const cq = update.callback_query;
         const parsed = parseCallbackData(cq.data);
 
-        console.log(`[TelegramWebhook] Callback: ${cq.data} from ${cq.from.username || cq.from.first_name}`);
+        // SECURITY: Validate sender is authorized user
+        if (!isAuthorizedUser(cq.from.id)) {
+          console.warn(`[TelegramWebhook] Unauthorized user: ${cq.from.id} (${cq.from.username || cq.from.first_name})`);
+          // Answer callback query to remove loading state
+          await fetch(`https://api.telegram.org/bot${BOT_TOKEN}/answerCallbackQuery`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              callback_query_id: cq.id,
+              text: "Unauthorized. Please contact the bot owner.",
+            }),
+          });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true }));
+          return;
+        }
+
+        console.log(`[TelegramWebhook] Callback: ${cq.data} from user_id=${cq.from.id}`);
 
         // Queue for pi-harness to process
         const queued: QueuedCallback = {
@@ -318,7 +396,7 @@ function handleRequest(req: import("node:http").IncomingMessage, res: import("no
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
     } catch (err) {
-      console.error("[TelegramWebhook] Error:", err);
+      console.error("[TelegramWebhook] Error:", sanitizeError(err));
       res.writeHead(500, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: "Internal error" }));
     }
@@ -330,7 +408,8 @@ async function setupWebhook(): Promise<void> {
   if (!WEBHOOK_URL) {
     console.log("[TelegramWebhook] TELEGRAM_WEBHOOK_URL not set — skipping webhook setup");
     console.log("[TelegramWebhook] To set webhook manually:");
-    console.log(`[TelegramWebhook]   curl -X POST https://api.telegram.org/bot${BOT_TOKEN}/setWebhook -d '{"url":"YOUR_WEBHOOK_URL","secret_token":"${WEBHOOK_SECRET}"}'`);
+    console.log("[TelegramWebhook]   Configure webhook URL via environment or secret provider");
+    console.log("[TelegramWebhook]   Then run: curl -X POST https://api.telegram.org/botYOUR_BOT_TOKEN/setWebhook -d json_with_secrets_removed");
     return;
   }
 
@@ -347,7 +426,7 @@ async function setupWebhook(): Promise<void> {
   if (result.ok) {
     console.log(`[TelegramWebhook] Webhook set to: ${WEBHOOK_URL}`);
   } else {
-    console.error(`[TelegramWebhook] Webhook setup failed: ${result.description}`);
+    console.error(`[TelegramWebhook] Webhook setup failed: ${sanitizeError(result.description)}`);
   }
 }
 

package/scripts/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "types": ["node"]
+  },
+  "include": ["./**/*.ts"]
+}