shadok-ai 0.16.19 → 0.16.21

package/README.md

@@ -341,12 +341,21 @@ Enter to skip; you can add it later from the web UI).
 The Telegram panel (header icon) carries a folded *How to set it up, step by step*
 guide, open until a token is saved and a group is bound.
 
+**Pairing.** The bot answers nobody until it is paired from the cockpit. In the
+Telegram panel (admin only), click **Pair Telegram**: it shows an 8-digit code,
+valid 10 minutes, single-use, cancelled after 5 wrong tries. Send `/setup <code>`
+in the group to make it the board, or in a private chat with the bot to make its
+DMs yours — or use the panel's one-click links, which pass the code for you.
+Whoever enters the code becomes the owner of the bot's DMs. A group bound before
+pairing existed stays bound; to move to another group, unbind it in the panel
+and pair again.
+
 Add your bot to a group with **Topics** enabled, make it an admin with *Manage
 topics* (and *Delete messages* so `/secret` can scrub values), then in the group:
 
 | Command | |
 |---|---|
-| `/setup` | bind this group as the board (one group per instance) |
+| `/setup <code>` | bind this group as the board (one group per instance), with the code from the panel's **Pair Telegram** |
 | `/spawn [profile] <name>` | new isolated agent in its own topic (also a web tab) |
 | `/stop` (alias `/esc`) | interrupt the current turn — does **not** end the session |
 | `/new` · `/end` | reset · kill the session |

package/dist/server.js

@@ -39,6 +39,7 @@ import { getUsage } from "./usage.js";
 import { loadChannels, loadGroups, saveGroups, upsertChannel, removeChannel, mergeClientChannels, channelWriteAllowed, profilePatch, loadTgGroup, saveTgGroup, isHomeChannel, homeAdoptionTarget, resolveSessionTarget, resolveResumeId, resumeTarget, } from "./channels.js";
 import { deliverWithRetry } from "./reload.js";
 import { startTelegram, renameTelegramTopic, closeTelegramTopic, probeToken, isStalePreface, announceLoggedOut, resetLoggedOutNotice, attachmentPrompt, pasteFileName, MEDIA_DIR, } from "./telegram.js";
+import { cancelPairingCode, issuePairingCode, pairingStatus } from "./tg-pairing.js";
 import { migrateTgBindings } from "./channels.js";
 import { instanceKey } from "./paths.js";
 import { peerFileFor, loadPeers, savePeers, peerFromToken, signPeerToken, newPeer, withSalts, redeemVerdict, redeemPeer, normPeerName, removePeer, ownedByPeer, peersOutFileFor, agentInvitePrompt, peerScope, } from "./peers.js";
@@ -1709,7 +1710,29 @@ app.put("/channels", (req, res) => {
     // drop a live or Telegram-bound session or strip server-owned fields.
     const live = new Set([...sessions.values()].filter((s) => !s.pilot.hasExited).map((s) => s.id));
     const before = new Map(loadChannels().map((c) => [c.sessionId, c.name]));
-    const merged = mergeClientChannels(Array.isArray(req.body) ? req.body : [], live);
+    const body = (Array.isArray(req.body) ? req.body : []);
+    // Mirroring is admin-managed (cf. the Telegram config gate and the `start`
+    // handler): a non-admin may reorder / rename / regroup their agents, but must
+    // not flip an agent's Telegram mirror through a channel write (the agent-menu
+    // toggle persists via this endpoint). Pin each incoming `mirror` to its stored
+    // value for a non-admin; a brand-new channel they create is left un-mirrored.
+    // Admins — and agents, who authenticate as the bootstrap admin — pass through.
+    if (currentAccount(req)?.role !== "admin") {
+        const storedMirror = new Map(loadChannels().map((c) => [c.sessionId, c.mirror]));
+        for (const c of body) {
+            if (!c || typeof c.sessionId !== "string") {
+                if (c)
+                    delete c.mirror;
+                continue;
+            }
+            const prev = storedMirror.get(c.sessionId);
+            if (prev === undefined)
+                delete c.mirror;
+            else
+                c.mirror = prev;
+        }
+    }
+    const merged = mergeClientChannels(body, live);
     // A web-side rename of a Telegram-bound channel → rename its topic too.
     for (const c of merged) {
         if (c.telegram?.threadId && c.name && c.name !== before.get(c.sessionId)) {
@@ -1845,7 +1868,10 @@ function accountAdmin(req, res,
  * CHANGE something, where the browser does send the header. A read stays
  * admin-only, which is what it was designed to be.
  */
-browserOnly = true) {
+browserOnly = true, 
+/** What the 403 says the caller is not allowed to do. The guard is reused
+ *  beyond accounts (e.g. the Telegram config), so the message names the act. */
+what = "manage accounts") {
     if (browserOnly && !requestFromBrowser(req)) {
         res.status(403).json({ error: "same-origin browser only" });
         return null;
@@ -1854,7 +1880,7 @@ browserOnly = true) {
     // is the bootstrap admin, and must not be able to reset anyone.
     const me = twoFactorOn() ? cookieAccount(req) : currentAccount(req);
     if (me?.role !== "admin") {
-        res.status(403).json({ error: "only an admin can manage accounts" });
+        res.status(403).json({ error: `only an admin can ${what}` });
         return null;
     }
     return me;
@@ -2666,8 +2692,19 @@ async function telegramState() {
 // Telegram bot config — token/on-off/allowed-chats, applied hot (no restart).
 // Behind the GUI password gate like the rest. The token is write-only: never
 // returned here, only set/removed.
-app.get("/telegram", async (_req, res) => res.json(await telegramState()));
+// The Telegram bot config is an instance-wide integration (one bot, one board,
+// owned by whoever runs the cockpit), so reading or changing it is ADMIN-ONLY —
+// a `member` has no business touching the bot token, the allowed chats or the
+// on/off switch. GET is browserOnly:false (a same-origin read sends no Origin);
+// PUT keeps the write-side CSRF guard.
+app.get("/telegram", async (req, res) => {
+    if (!accountAdmin(req, res, false, "view or change the Telegram configuration"))
+        return;
+    res.json(await telegramState());
+});
 app.put("/telegram", async (req, res) => {
+    if (!accountAdmin(req, res, true, "view or change the Telegram configuration"))
+        return;
     const b = req.body ?? {};
     const patch = {};
     if (typeof b.token === "string" || b.token === null)
@@ -2692,6 +2729,37 @@ app.put("/telegram", async (req, res) => {
     }
     res.json(await telegramState());
 });
+// Pairing code for the bot (`src/tg-pairing.ts`): binding the board group or
+// owning the DMs needs a code only this admin-only panel shows. POST issues a
+// fresh one (revoking any previous code) and is the ONE response that carries
+// it; GET reports whether one is live, never the code itself. Browser-only
+// writes, like the rest of the Telegram config: an agent must not be able to
+// mint a code and pair a Telegram account of its choosing.
+app.get("/telegram/pairing", (req, res) => {
+    if (!accountAdmin(req, res, false, "pair the Telegram bot"))
+        return;
+    res.json(pairingStatus());
+});
+app.post("/telegram/pairing", async (req, res) => {
+    if (!accountAdmin(req, res, true, "pair the Telegram bot"))
+        return;
+    const p = issuePairingCode();
+    const username = (await telegramState()).username;
+    const bot = username ? String(username).replace(/^@/, "") : null;
+    res.json({
+        code: p.code,
+        expiresAt: p.expiresAt,
+        // Deep links: Telegram delivers `/start <code>` by itself, so one tap pairs.
+        groupLink: bot ? `https://t.me/${bot}?startgroup=${p.code}` : null,
+        dmLink: bot ? `https://t.me/${bot}?start=${p.code}` : null,
+    });
+});
+app.delete("/telegram/pairing", (req, res) => {
+    if (!accountAdmin(req, res, true, "pair the Telegram bot"))
+        return;
+    cancelPairingCode();
+    res.json(pairingStatus());
+});
 const server = http.createServer(app);
 const wss = new WebSocketServer({
     server,
@@ -4765,6 +4833,15 @@ wss.on("connection", (ws, req) => {
                         cwd: effectiveCwd,
                         branch: worktree?.branch ?? null,
                     });
+                    // Mirroring drops an agent into the (admin-owned) Telegram board, so
+                    // only an admin may enable it. A non-admin's `true` is DROPPED (not a
+                    // spawn failure — same spirit as a refused parent link); an explicit
+                    // `false`, or an absent field, is left untouched. Agents authenticate
+                    // as the bootstrap admin (session key), so pilotctl-driven mirroring
+                    // is unaffected.
+                    const effMirror = typeof msg.mirror === "boolean" ? msg.mirror && me?.role === "admin" : undefined;
+                    if (msg.mirror === true && me?.role !== "admin")
+                        console.log(`mirror: refused for non-admin ${me?.name ?? "anon"} on ${id.slice(0, 8)}`);
                     upsertChannel({
                         sessionId: id,
                         cwd: effectiveCwd,
@@ -4803,8 +4880,8 @@ wss.on("connection", (ws, req) => {
                         // The form's choice, recorded as soon as we're `ready` — that's
                         // where the Telegram loop reads it. Absent (a client that ignores
                         // the field) → decide nothing, and `isMirrored` falls back to the
-                        // binding.
-                        ...(typeof msg.mirror === "boolean" ? { mirror: msg.mirror } : {}),
+                        // binding. Admin-gated just above (`effMirror`).
+                        ...(effMirror !== undefined ? { mirror: effMirror } : {}),
                         // Who launched this agent, sent by pilotctl from its own
                         // SHADOK_SESSION_ID. ASSERT-only, like `branch` and `repo`: a
                         // client that omits the key must not erase a link that already