pi-telegram-plus 0.0.1

package/lib/attachments.ts

@@ -0,0 +1,154 @@
+import { stat } from "node:fs/promises";
+import { basename, resolve } from "node:path";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import type { TelegramTransport, TelegramTurn } from "./types.ts";
+
+const MAX_ATTACHMENTS_PER_TURN = 10;
+const DEFAULT_MAX_BYTES = 50 * 1024 * 1024;
+
+function outboundAttachmentLimit(): number {
+  for (const name of ["PI_TELEGRAM_OUTBOUND_ATTACHMENT_MAX_BYTES", "TELEGRAM_MAX_ATTACHMENT_SIZE_BYTES"]) {
+    const raw = process.env[name]?.trim();
+    const value = raw ? Number(raw) : NaN;
+    if (Number.isSafeInteger(value) && value > 0) return value;
+  }
+  return DEFAULT_MAX_BYTES;
+}
+
+const SENSITIVE_PATH_PREFIXES = ["/etc", "/.ssh", "/root/.ssh"];
+
+function isSensitivePath(resolved: string): boolean {
+  const home = process.env.HOME ?? "";
+  for (const prefix of SENSITIVE_PATH_PREFIXES) {
+    if (resolved.startsWith(prefix)) return true;
+  }
+  if (home && resolved.startsWith(home + "/.ssh")) return true;
+  return false;
+}
+
+function isPhotoPath(path: string): boolean {
+  const normalized = path.toLowerCase();
+  return normalized.endsWith(".jpg") || normalized.endsWith(".jpeg") || normalized.endsWith(".png") || normalized.endsWith(".webp");
+}
+
+function sizeLimitError(path: string, size: number, max: number): string {
+  return `Attachment exceeds size limit (${size} bytes > ${max} bytes): ${path}`;
+}
+
+type ResolvedTelegramAttachment = {
+  path: string;
+  fileName: string;
+};
+
+async function sendTelegramAttachment(
+  chatId: number,
+  attachment: ResolvedTelegramAttachment,
+  transport: TelegramTransport,
+  maxBytes: number,
+  onError?: (message: string) => Promise<void>,
+): Promise<void> {
+  try {
+    const stats = await stat(attachment.path);
+    if (stats.size > maxBytes) {
+      throw new Error(sizeLimitError(attachment.path, stats.size, maxBytes));
+    }
+    if (isPhotoPath(attachment.path)) {
+      try {
+        await transport.sendChatAction(chatId, "upload_photo");
+        await transport.sendPhoto(chatId, attachment.path, attachment.fileName, true);
+        return;
+      } catch {
+        await transport.sendChatAction(chatId, "upload_document");
+        await transport.sendDocument(chatId, attachment.path, attachment.fileName);
+        return;
+      }
+    }
+    await transport.sendChatAction(chatId, "upload_document");
+    await transport.sendDocument(chatId, attachment.path, attachment.fileName);
+    return;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (onError) {
+      await onError(`Failed to send attachment ${attachment.fileName}: ${message}`);
+      return;
+    }
+    throw error;
+  }
+}
+
+function formatDirectAttachmentErrorSummary(errors: string[]): string {
+  if (errors.length === 0) return "";
+  return ` (${errors.length} failed, first: ${errors[0]})`;
+}
+
+export function registerTelegramAttachmentTool(
+  pi: ExtensionAPI,
+  deps: {
+    getActiveTurn: () => TelegramTurn | undefined;
+    getDefaultChatId?: () => number | undefined;
+    transport: TelegramTransport;
+  },
+): void {
+  pi.registerTool({
+    name: "tg_attach",
+    label: "Telegram Attach",
+    description: "Send one or more local files to Telegram immediately (uses current active turn chat, or default chat config when no active turn exists).",
+    promptSnippet: "Send local files to Telegram immediately.",
+    promptGuidelines: [
+      "When handling a Telegram-originated request and the user asked for a file or generated artifact, call tg_attach with the local path instead of only mentioning the path in text.",
+    ],
+    parameters: Type.Object({
+      paths: Type.Array(Type.String({ description: "Local file path to attach" }), { minItems: 1, maxItems: MAX_ATTACHMENTS_PER_TURN }),
+    }),
+    async execute(_toolCallId, params) {
+      const maxBytes = outboundAttachmentLimit();
+      const pendingAttachments: ResolvedTelegramAttachment[] = [];
+      for (const rawPath of params.paths) {
+        const resolved = resolve(rawPath);
+        if (isSensitivePath(resolved)) throw new Error(`Attachment path not allowed (sensitive): ${rawPath}`);
+        const stats = await stat(resolved);
+        if (!stats.isFile()) throw new Error(`Not a file: ${rawPath}`);
+        if (stats.size > maxBytes) throw new Error(sizeLimitError(rawPath, stats.size, maxBytes));
+        pendingAttachments.push({ path: resolved, fileName: basename(resolved) });
+      }
+
+      if (params.paths.length > MAX_ATTACHMENTS_PER_TURN) {
+        throw new Error(`Attachment limit reached (${MAX_ATTACHMENTS_PER_TURN})`);
+      }
+      const turn = deps.getActiveTurn();
+      const chatId = turn?.chatId ?? deps.getDefaultChatId?.();
+      if (chatId === undefined) {
+        throw new Error("tg_attach can only be used with an active Telegram chat or configured default chat id");
+      }
+      const failed: string[] = [];
+      for (const attachment of pendingAttachments) {
+        await sendTelegramAttachment(chatId, attachment, deps.transport, maxBytes, async (message) => {
+          failed.push(message);
+          await deps.transport.sendText(chatId, message).catch(() => undefined);
+        });
+      }
+      return {
+        content: [{
+          type: "text" as const,
+          text: `\nSent ${pendingAttachments.length} Telegram attachment(s).${formatDirectAttachmentErrorSummary(failed)}`,
+        }],
+        details: { paths: pendingAttachments.map((attachment) => attachment.path) },
+      };
+    },
+  });
+}
+
+export async function sendQueuedTelegramAttachments(
+  turn: TelegramTurn,
+  transport: TelegramTransport,
+): Promise<void> {
+  if (turn.attachmentsSent) return;
+  turn.attachmentsSent = true;
+  const maxBytes = outboundAttachmentLimit();
+  for (const attachment of turn.queuedAttachments) {
+    await sendTelegramAttachment(turn.chatId, attachment, transport, maxBytes, async (message) => {
+      await transport.sendText(turn.chatId, message).catch(() => undefined);
+    });
+  }
+}

package/lib/callback-protocol.ts

@@ -0,0 +1,9 @@
+export const UI_CALLBACK_PREFIX = "tgplus:ui:";
+
+export function encodeUiCallback(value: string): string {
+  return `${UI_CALLBACK_PREFIX}${value}`;
+}
+
+export function decodeUiCallback(data: string): string | undefined {
+  return data.startsWith(UI_CALLBACK_PREFIX) ? data.slice(UI_CALLBACK_PREFIX.length) : undefined;
+}

package/lib/command-parser.ts

@@ -0,0 +1,15 @@
+/**
+ * Parse and normalize Telegram slash commands.
+ */
+
+export function parseLeadingCommand(text: string): { name: string; args: string } | undefined {
+  const match = text.match(/^\/([^\s@]+)(?:\s+([\s\S]*))?$/);
+  if (!match) return undefined;
+  return { name: match[1], args: match[2] ?? "" };
+}
+
+export function normalizeLeadingCommand(text: string, botUsername: string | undefined): string {
+  if (!botUsername) return text;
+  const escaped = botUsername.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return text.replace(new RegExp(`^(\\/[^\\s@]+)@${escaped}(\\s|$)`, "i"), "$1$2");
+}

package/lib/commands/auth.ts

@@ -0,0 +1,365 @@
+import type { CommandRegistry } from "./register.ts";
+import type { CapturedAgentSession } from "../types.ts";
+
+// ── Types ───────────────────────────────────────────────────────────────
+
+type AuthType = "oauth" | "api_key";
+
+type ProviderOption = {
+  id: string;
+  name: string;
+  authType: AuthType;
+};
+
+// ── Helpers ──────────────────────────────────────────────────────────────
+
+/**
+ * Get the auth status label for a provider (shown on button labels).
+ * Aligns with p-tui OAuthSelectorComponent.formatStatusIndicator().
+ */
+function getProviderStatusLabel(
+  session: CapturedAgentSession,
+  providerId: string,
+  authType: AuthType,
+): string {
+  const authStorage = session.modelRegistry.authStorage;
+  const cred = authStorage.get(providerId);
+
+  if (authType === "oauth") {
+    if (cred?.type === "oauth") return "✓ configured";
+    return "";
+  }
+
+  // API key
+  if (cred?.type === "api_key") return "✓ configured";
+  const status = session.modelRegistry.getProviderAuthStatus(providerId);
+  if (status.configured) {
+    switch (status.source) {
+      case "environment":
+        return "✓ env";
+      case "runtime":
+        return "✓ runtime";
+      case "fallback":
+      case "models_json_key":
+      case "models_json_command":
+        return "✓ configured";
+    }
+  }
+  return "";
+}
+
+/** Format as a select option label (name + status). */
+function formatLabel(option: ProviderOption, session: CapturedAgentSession): string {
+  const status = getProviderStatusLabel(session, option.id, option.authType);
+  return status ? `${option.name} ${status}` : option.name;
+}
+
+/**
+ * Collect OAuth providers from AuthStorage.getOAuthProviders().
+ * Aligns with p-tui's OAuth section in getLoginProviderOptions().
+ */
+function collectOAuthProviders(session: CapturedAgentSession): ProviderOption[] {
+  return session.modelRegistry.authStorage.getOAuthProviders().map((p) => ({
+    id: p.id,
+    name: p.name,
+    authType: "oauth" as AuthType,
+  }));
+}
+
+/**
+ * Collect API key providers from ModelRegistry's unique provider list.
+ * Excludes provider IDs already present in the OAuth list (OAuth-only providers
+ * should not appear twice). Aligns with p-tui's API key section in
+ * getLoginProviderOptions() + isApiKeyLoginProvider().
+ */
+function collectApiKeyProviders(session: CapturedAgentSession): ProviderOption[] {
+  const authStorage = session.modelRegistry.authStorage;
+  const oauthIds = new Set(authStorage.getOAuthProviders().map((p) => p.id));
+  const modelProviderIds = [
+    ...new Set(session.modelRegistry.getAll().map((m) => m.provider)),
+  ];
+
+  return modelProviderIds
+    .filter((id) => !oauthIds.has(id))
+    .map((id) => ({
+      id,
+      name: session.modelRegistry.getProviderDisplayName(id),
+      authType: "api_key" as AuthType,
+    }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Run the OAuth login flow (Telegram-specific mode).
+ *
+ * Unlike p-tui, Telegram cannot auto-open a browser. This uses a
+ * "show URL → user manually pastes back" flow:
+ * 1. Bot sends the auth URL as inline text (copyable)
+ * 2. User completes OAuth in their browser
+ * 3. User replies with the redirect URL
+ * 4. onManualCodeInput captures the URL and finishes auth
+ */
+async function runOAuthLogin(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ui: any,
+  session: CapturedAgentSession,
+  provider: ProviderOption,
+): Promise<boolean> {
+  const authStorage = session.modelRegistry.authStorage;
+  const oauthProviders = authStorage.getOAuthProviders();
+  const oauthProvider = oauthProviders.find((p) => p.id === provider.id);
+  if (!oauthProvider) {
+    ui.notify(`OAuth provider not found: ${provider.id}`, "error");
+    return false;
+  }
+
+  try {
+    await authStorage.login(provider.id, {
+      onAuth: (info: { url: string; instructions?: string }) => {
+        const lines = [
+          `🔗 Open this URL in your browser to authenticate <b>${provider.name}</b>:`,
+          ``,
+          info.url,
+        ];
+        if (info.instructions) {
+          lines.push(``, info.instructions);
+        }
+        lines.push(``, `Then reply with the redirect URL or authorization code.`);
+        ui.notify(lines.join("\n"), "info");
+      },
+      onDeviceCode: (info: {
+        verificationUri: string;
+        userCode: string;
+        expiresInSeconds?: number;
+      }) => {
+        const lines = [
+          `🔗 Open this URL in your browser:`,
+          info.verificationUri,
+          ``,
+          `Code: <b>${info.userCode}</b>`,
+        ];
+        if (info.expiresInSeconds) {
+          lines.push(`Expires in ${info.expiresInSeconds}s`);
+        }
+        lines.push(``, `Then reply with the redirect URL after authorization.`);
+        ui.notify(lines.join("\n"), "info");
+      },
+      onPrompt: async (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+      }) => {
+        const value = await ui.input(prompt.message, prompt.placeholder);
+        if (!value && !prompt.allowEmpty) throw new Error("Login cancelled");
+        return value ?? "";
+      },
+      onManualCodeInput: async () => {
+        const value = await ui.input(
+          "Paste the redirect URL or authorization code after completing authentication in your browser",
+        );
+        if (!value) throw new Error("Login cancelled");
+        return value;
+      },
+      onSelect: async (prompt: {
+        message: string;
+        options: Array<{ label: string; id: string }>;
+      }) => {
+        const labels = prompt.options.map((o) => o.label);
+        const choice = await ui.select(prompt.message, labels);
+        if (!choice) return undefined;
+        return prompt.options[labels.indexOf(choice)]?.id;
+      },
+      onProgress: (message: string) => ui.notify(message, "info"),
+    });
+    session.modelRegistry.refresh();
+    ui.notify(`✅ OAuth login complete: ${provider.name}`, "info");
+    return true;
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (msg !== "Login cancelled") {
+      ui.notify(`OAuth login failed: ${msg}`, "error");
+    }
+    return false;
+  }
+}
+
+/**
+ * Run the API key login flow.
+ * Uses inputSecret when available; the user's message is auto-deleted
+ * to protect the sensitive key.
+ */
+async function runApiKeyLogin(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ui: any,
+  session: CapturedAgentSession,
+  provider: ProviderOption,
+): Promise<boolean> {
+  const authStorage = session.modelRegistry.authStorage;
+
+  const apiKey = await (ui.inputSecret?.(`API key for ${provider.name}`, "sk-...") ??
+    ui.input(`API key for ${provider.name}`, "sk-..."));
+  if (!apiKey) {
+    ui.notify("Login cancelled.", "info");
+    return false;
+  }
+
+  authStorage.set(provider.id, { type: "api_key", key: apiKey.trim() });
+  session.modelRegistry.refresh();
+  ui.notify(
+    `✅ API key set for ${provider.name}. The message with your API key has been deleted for safety.`,
+    "info",
+  );
+  return true;
+}
+
+// ── Register commands ───────────────────────────────────────────────────
+
+export function registerAuthCommands(
+  registry: CommandRegistry,
+  deps: { getSession: () => CapturedAgentSession | undefined },
+): void {
+  // ── /login ────────────────────────────────────────────────────────────
+  registry.registerCommand("login", {
+    description: "Set API key or run OAuth login for a provider",
+    handler: async (args, ctx) => {
+      const ui = ctx.ui as typeof ctx.ui & {
+        inputSecret?: (
+          title: string,
+          placeholder?: string,
+        ) => Promise<string | undefined>;
+      };
+      const session = deps.getSession();
+      if (!session) {
+        ui.notify("No active session", "error");
+        return;
+      }
+
+      // ── Quick arg: pass a provider ID to jump straight to input ────
+      // e.g. /login anthropic              → API key prompt (Anthropic)
+      //      /login anthropic-subscription  → OAuth flow
+      const directId = args.trim();
+      if (directId) {
+        const oauthProviders =
+          session.modelRegistry.authStorage.getOAuthProviders();
+        const oauthProvider = oauthProviders.find((p) => p.id === directId);
+        if (oauthProvider) {
+          await runOAuthLogin(ui, session, {
+            id: directId,
+            name: oauthProvider.name,
+            authType: "oauth",
+          });
+        } else {
+          await runApiKeyLogin(ui, session, {
+            id: directId,
+            name: session.modelRegistry.getProviderDisplayName(directId),
+            authType: "api_key",
+          });
+        }
+        return;
+      }
+
+      // ═════════════════════════════════════════════════════════════════
+      // Phase 1: Select auth type (aligns with p-tui showLoginAuthTypeSelector)
+      // ═════════════════════════════════════════════════════════════════
+      const SUBSCRIPTION_LABEL = "Use a subscription";
+      const API_KEY_LABEL = "Use an API key";
+      const authTypeChoice = await ui.select("Select authentication method:", [
+        SUBSCRIPTION_LABEL,
+        API_KEY_LABEL,
+      ]);
+      if (!authTypeChoice) return;
+
+      const authType: AuthType =
+        authTypeChoice === SUBSCRIPTION_LABEL ? "oauth" : "api_key";
+
+      // ═════════════════════════════════════════════════════════════════
+      // Phase 2: Select provider (filtered by authType + status + back nav)
+      // Aligns with p-tui showLoginProviderSelector(authType)
+      // ═════════════════════════════════════════════════════════════════
+      const providers: ProviderOption[] =
+        authType === "oauth"
+          ? collectOAuthProviders(session).sort((a, b) =>
+              a.name.localeCompare(b.name),
+            )
+          : collectApiKeyProviders(session);
+
+      const typeLabel = authType === "oauth" ? "subscription" : "API key";
+      if (providers.length === 0) {
+        ui.notify(`No ${typeLabel} providers available.`, "warning");
+        return;
+      }
+
+      const BACK_LABEL = "← Back";
+      const labels = [
+        BACK_LABEL,
+        ...providers.map((p) => formatLabel(p, session)),
+      ];
+      const choice = await ui.select(`Select provider (${typeLabel}):`, labels);
+      if (!choice || choice === BACK_LABEL) return;
+
+      const idx = labels.indexOf(choice) - 1;
+      const provider = providers[idx];
+      if (!provider) return;
+
+      // ═════════════════════════════════════════════════════════════════
+      // Phase 3: Execute login
+      // ═════════════════════════════════════════════════════════════════
+      if (provider.authType === "oauth") {
+        await runOAuthLogin(ui, session, provider);
+      } else {
+        await runApiKeyLogin(ui, session, provider);
+      }
+    },
+  });
+
+  // ── /logout ───────────────────────────────────────────────────────────
+  // Improvement: shows each provider's auth type (subscription / API key)
+  registry.registerCommand("logout", {
+    description: "Remove stored credentials for a provider",
+    handler: async (_args, ctx) => {
+      const ui = ctx.ui;
+      const session = deps.getSession();
+      if (!session) {
+        ui.notify("No active session", "error");
+        return;
+      }
+
+      const stored = session.modelRegistry.authStorage.list();
+      if (stored.length === 0) {
+        ui.notify("No stored credentials to remove.", "info");
+        return;
+      }
+
+      // Show auth type context
+      const oauthIds = new Set(
+        session.modelRegistry.authStorage
+          .getOAuthProviders()
+          .map((p) => p.id),
+      );
+      const labels = stored.map((id) => {
+        const name = session.modelRegistry.getProviderDisplayName(id);
+        const typeLabel = oauthIds.has(id) ? "subscription" : "API key";
+        return `${name} (${typeLabel})`;
+      });
+
+      const choice = await ui.select("Remove credentials for:", labels);
+      if (!choice) return;
+      const idx = labels.indexOf(choice);
+      if (idx < 0) return;
+      const providerId = stored[idx];
+
+      const confirmed = await ui.confirm(
+        "Logout",
+        `Remove stored credentials for ${session.modelRegistry.getProviderDisplayName(providerId)}?`,
+      );
+      if (!confirmed) return;
+
+      session.modelRegistry.authStorage.logout(providerId);
+      session.modelRegistry.refresh();
+      ui.notify(
+        `Logged out from ${session.modelRegistry.getProviderDisplayName(providerId)}.`,
+        "info",
+      );
+    },
+  });
+}