pi-harness-runtime 1.1.161 → 1.1.163

package/README.md

@@ -844,6 +844,27 @@ USER A (you):
 
 See [docs/Telegram-2-Way-Setup.md](docs/Telegram-2-Way-Setup.md) for full guide.
 
+### User Authorization
+
+Telegram callbacks are validated against an allowlist. Sources checked in order:
+
+1. `TELEGRAM_ALLOWED_USERS` environment variable (comma-separated IDs)
+2. `telegram-allowed-users.txt` key file (comma-separated IDs)
+3. `telegram-chat-id.txt` (legacy fallback, single ID)
+
+```bash
+# Option 1: Environment variable
+TELEGRAM_ALLOWED_USERS=123456789,987654321
+
+# Option 2: Key file (~/.pi-harness-runtime/keys/)
+echo "123456789,987654321" > ~/.pi-harness-runtime/keys/telegram-allowed-users.txt
+
+# Option 3: Legacy single user
+echo "123456789" > ~/.pi-harness-runtime/keys/telegram-chat-id.txt
+```
+
+Unauthorized callback queries are rejected before processing.
+
 ## License
 
 MIT © 2026 MooCoding

package/harness/telegram-auth.ts

@@ -0,0 +1,150 @@
+/**
+ * Telegram Authorization Module
+ *
+ * Validates Telegram user access from multiple sources:
+ * - Environment variable (TELEGRAM_ALLOWED_USERS)
+ * - Key file (~/.pi-harness-runtime/keys/telegram-allowed-users.txt)
+ * - Legacy chat ID file (~/.pi-harness-runtime/keys/telegram-chat-id.txt)
+ * - Infisical (future)
+ *
+ * Priority: Environment > Key file > Legacy chat ID file
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+const KEYS_DIR = join(homedir(), ".pi-harness-runtime", "keys");
+
+/**
+ * Parse comma-separated user IDs
+ */
+function parseUserIds(content: string): Set<number> {
+	const ids = new Set<number>();
+	const parts = content.split(",").map(s => s.trim()).filter(Boolean);
+
+	for (const part of parts) {
+		const num = parseInt(part, 10);
+		if (!isNaN(num) && num > 0) {
+			ids.add(num);
+		}
+	}
+
+	return ids;
+}
+
+/**
+ * Load allowed users from environment variable
+ */
+function loadFromEnv(): Set<number> | null {
+	const envValue = process.env.TELEGRAM_ALLOWED_USERS;
+	if (!envValue) return null;
+
+	return parseUserIds(envValue);
+}
+
+/**
+ * Load allowed users from key file
+ */
+function loadFromKeyFile(filename: string): Set<number> | null {
+	const filePath = join(KEYS_DIR, filename);
+	if (!existsSync(filePath)) return null;
+
+	try {
+		const content = readFileSync(filePath, "utf8").trim();
+		if (!content) return null;
+		return parseUserIds(content);
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Get allowed Telegram user IDs from all sources
+ *
+ * Priority:
+ * 1. TELEGRAM_ALLOWED_USERS environment variable
+ * 2. telegram-allowed-users.txt key file
+ * 3. telegram-chat-id.txt (legacy, single user)
+ */
+export function getAllowedUserIds(): Set<number> {
+	// 1. Check environment variable first (highest priority)
+	const fromEnv = loadFromEnv();
+	if (fromEnv && fromEnv.size > 0) {
+		return fromEnv;
+	}
+
+	// 2. Check dedicated allowed users file
+	const fromKeyFile = loadFromKeyFile("telegram-allowed-users.txt");
+	if (fromKeyFile && fromKeyFile.size > 0) {
+		return fromKeyFile;
+	}
+
+	// 3. Check legacy chat ID file (single user)
+	const fromLegacy = loadFromKeyFile("telegram-chat-id.txt");
+	if (fromLegacy && fromLegacy.size > 0) {
+		return fromLegacy;
+	}
+
+	// No allowed users configured
+	return new Set();
+}
+
+/**
+ * Check if a Telegram user ID is authorized
+ */
+export function isAuthorizedUser(userId: number): boolean {
+	const allowed = getAllowedUserIds();
+	// If no allowlist is configured, deny by default (fail closed)
+	if (allowed.size === 0) {
+		return false;
+	}
+	return allowed.has(userId);
+}
+
+/**
+ * Validate callback query sender
+ * Returns true if authorized, false if unauthorized
+ */
+export function validateSender(senderId: number): {
+	authorized: boolean;
+	reason?: string;
+} {
+	if (isAuthorizedUser(senderId)) {
+		return { authorized: true };
+	}
+
+	// Fail closed - deny unauthorized users
+	return {
+		authorized: false,
+		reason: "unauthorized_user",
+	};
+}
+
+/**
+ * Get allowlist source for diagnostics
+ */
+export function getAllowlistSource(): string {
+	if (process.env.TELEGRAM_ALLOWED_USERS) {
+		return "environment";
+	}
+
+	const allowedPath = join(KEYS_DIR, "telegram-allowed-users.txt");
+	if (existsSync(allowedPath)) {
+		return "key_file:telegram-allowed-users.txt";
+	}
+
+	const legacyPath = join(KEYS_DIR, "telegram-chat-id.txt");
+	if (existsSync(legacyPath)) {
+		return "legacy:telegram-chat-id.txt";
+	}
+
+	return "none";
+}
+
+/**
+ * Get count of allowed users (for diagnostics, not values)
+ */
+export function getAllowedUserCount(): number {
+	return getAllowedUserIds().size;
+}

package/harness/telegram-content-filter.ts

@@ -0,0 +1,223 @@
+/**
+ * Telegram Content Filter — Jev-Powered Sensitive Content Detection
+ *
+ * Before sending to Telegram, Jev analyzes the content to determine
+ * if it contains sensitive credentials that should NOT be transmitted.
+ *
+ * If Jev is unavailable or returns BLOCK, the message is:
+ * - Not sent to Telegram
+ * - Logged with safe metadata (no secrets)
+ * - Optionally redirected to secure alternative (TUI only)
+ */
+
+import type { NotificationPayload } from "../packages/notification/dist/types.js";
+import { maskString } from "../packages/notification/dist/mask-secrets.js";
+import { getKey } from "./key-loader.js";
+
+/**
+ * Jev judgment result for content filtering
+ */
+export type ContentJudgment = "SEND" | "BLOCK" | "UNKNOWN";
+
+/**
+ * Result of content filtering decision
+ */
+export interface FilterResult {
+	/** Whether to send to Telegram */
+	shouldSend: boolean;
+	/** Jev's judgment */
+	judgment: ContentJudgment;
+	/** Reason for blocking (if blocked) */
+	reason?: string;
+	/** Confidence score (0-1) */
+	confidence?: number;
+}
+
+/**
+ * Extract text content from notification payload
+ */
+function extractContent(payload: NotificationPayload): string {
+	const parts: string[] = [];
+
+	// Title
+	if (payload.title) {
+		parts.push(payload.title);
+	}
+
+	// Main message
+	if (payload.message) {
+		parts.push(payload.message);
+	}
+
+	// Details
+	if (payload.details) {
+		for (const [key, value] of Object.entries(payload.details)) {
+			if (typeof value === "string" && value) {
+				parts.push(value);
+			}
+		}
+	}
+
+	return parts.join("\n");
+}
+
+/**
+ * Simple heuristic check for obvious credentials (fallback when Jev unavailable)
+ */
+function heuristicCheck(content: string): FilterResult {
+	// Check for common credential patterns
+	const sensitivePatterns = [
+		/\d+:[-A-Za-z0-9_]{35,}/, // Telegram bot token
+		/sk-[a-zA-Z0-9]{20,}/,    // OpenAI-style keys
+		/[a-zA-Z0-9_-]{32,}/,     // Long API keys
+		/Bearer\s+[a-zA-Z0-9_-]{20,}/i, // Bearer tokens
+		/(api[_-]?key|secret|token|password|credential)[=:\s]+[^\s]{16,}/i,
+		/-----BEGIN\s+(RSA|EC|OPENSSH|DSA)\s+PRIVATE\s+KEY-----/,
+		/infisical[_-]?(client[_-])?(secret|id)/i,
+	];
+
+	let matchFound = false;
+	let matchType = "";
+
+	for (const pattern of sensitivePatterns) {
+		if (pattern.test(content)) {
+			matchFound = true;
+			// Determine what type of credential was found
+			if (/\d+:[-A-Za-z0-9_]{35,}/.test(content)) {
+				matchType = "telegram_bot_token";
+			} else if (/sk-[a-zA-Z0-9]{20,}/.test(content)) {
+				matchType = "openai_style_key";
+			} else if (/-----BEGIN\s+(RSA|EC|OPENSSH|DSA)\s+PRIVATE\s+KEY-----/.test(content)) {
+				matchType = "private_key";
+			} else if (/infisical/i.test(content)) {
+				matchType = "infisical_credential";
+			} else {
+				matchType = "api_key_or_secret";
+			}
+			break;
+		}
+	}
+
+	if (matchFound) {
+		return {
+			shouldSend: false,
+			judgment: "BLOCK",
+			reason: `Sensitive content detected: ${matchType}`,
+			confidence: 0.95,
+		};
+	}
+
+	return {
+		shouldSend: true,
+		judgment: "SEND",
+		confidence: 0.9,
+	};
+}
+
+/**
+ * Call Jev to analyze content for sensitive credentials
+ */
+async function callJev(content: string): Promise<FilterResult | null> {
+	const apiKey = getKey("typesafe-api-key") || process.env.TYPESAFE_API_KEY;
+
+	if (!apiKey) {
+		return null; // Jev not available
+	}
+
+	try {
+		const response = await fetch("https://api.typesafe.ai/v1/jev/decide", {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${apiKey}`,
+			},
+			body: JSON.stringify({
+				question:
+					"Does this message contain any API keys, tokens, secrets, passwords, or other sensitive credentials that should NOT be sent to a third-party service like Telegram? Answer only YES or NO.",
+				context: {
+					message: content,
+					action: "telegram_notification",
+					security_level: "high",
+				},
+			}),
+		});
+
+		if (!response.ok) {
+			return null;
+		}
+
+		const data = (await response.json()) as {
+			decision?: string;
+			confidence?: number;
+			reasoning?: string;
+		};
+
+		const decision = data.decision?.toUpperCase() ?? "UNKNOWN";
+		const isSensitive = decision === "YES" || decision === "BLOCK";
+
+		return {
+			shouldSend: !isSensitive,
+			judgment: isSensitive ? "BLOCK" : "SEND",
+			reason: data.reasoning,
+			confidence: data.confidence,
+		};
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Filter notification content before sending to Telegram
+ *
+ * @param payload - The notification payload
+ * @returns Filter result with decision
+ */
+export async function filterTelegramContent(
+	payload: NotificationPayload,
+): Promise<FilterResult> {
+	// Extract content to analyze
+	const content = extractContent(payload);
+
+	// First, run heuristic check (always available)
+	const heuristicResult = heuristicCheck(content);
+	if (heuristicResult.judgment === "BLOCK") {
+		logFilterDecision("BLOCK", heuristicResult.reason ?? "Heuristic match", payload.jobId);
+		return heuristicResult;
+	}
+
+	// Try Jev if available
+	const jevResult = await callJev(content);
+	if (jevResult) {
+		if (jevResult.judgment === "BLOCK") {
+			logFilterDecision("BLOCK", jevResult.reason ?? "Jev judgment", payload.jobId);
+		}
+		return jevResult;
+	}
+
+	// Jev unavailable - use heuristic result
+	return heuristicResult;
+}
+
+/**
+ * Log filter decision securely (no content, just metadata)
+ */
+function logFilterDecision(
+	decision: ContentJudgment,
+	reason: string,
+	jobId: string,
+): void {
+	console.warn(
+		`[TelegramFilter] ${decision} job=${jobId} reason=${reason} channel=telegram`,
+	);
+}
+
+/**
+ * Get safe notification version (masked) for logging
+ */
+export function getSafeNotificationLog(payload: NotificationPayload): string {
+	const maskedTitle = maskString(payload.title);
+	const maskedMessage = maskString(payload.message);
+	const maskedJobId = maskString(payload.jobId);
+
+	return `event=${payload.event} job=${maskedJobId} title=${maskedTitle} message_len=${maskedMessage.length}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-runtime",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",
   "type": "module",
   "scripts": {

package/packages/a2a-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/a2a-adapter",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "description": "Google Agent-to-Agent (A2A) protocol adapter for pi-harness",
   "main": "dist/index.js",

package/packages/agent-policy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/agent-policy",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Agent policy runtime for pi-harness - enforces mandatory rule delivery and mutation gating",
   "type": "module",
   "main": "./dist/index.js",

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/code-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-review",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Automated code review engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/codex-watcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/codex-watcher",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Watches Codex CLI sessions and emits visible messages for PING-PONG monitoring",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/config-capture/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/config-capture",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Auto-capture API-fetched configuration values to AGENTS.md",
   "type": "module",
   "main": "src/index.ts",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-discovery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-discovery",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cookie-sanitizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cookie-sanitizer",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "pi-harness-runtime — cookie sanitizer (provider-quota cookie file normaliser)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cost-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cost-optimizer",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Cost Optimizer for pi-harness-runtime — budget tracking, forecasting, and model selection optimization",
   "type": "module",
   "main": "./dist/index.js",

package/packages/dependency-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/dependency-analyzer",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/django-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/django-plugin",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Django framework analysis — models, management commands, settings",
   "type": "module",
   "main": "./dist/index.js",

package/packages/doc-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/doc-generator",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Auto-Doc Generator — generate documentation from source code (RFC-0014)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/evaluation-engine",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "description": "Evaluation engine for pi-harness runtime (RFC-0057)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/evaluation-runner",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "description": "Framework-agnostic evaluation framework for AI outputs (RFC-0020)",
   "main": "dist/index.js",

package/packages/event-bus/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-bus",
-  "version": "1.1.161",
+  "version": "1.1.163",
   "type": "module",
   "main": "src/index.ts",
   "exports": {