shadok-ai 0.16.19 → 0.16.21

package/dist/tg-pairing.js

@@ -0,0 +1,97 @@
+/**
+ * The Telegram pairing code: the ONLY way a Telegram account gets to bind this
+ * instance's board group, or to become the owner of its DMs.
+ *
+ * It replaces two first-come rules. `/setup` bound whichever group sent it
+ * first, with no check on the sender, so anyone who found the bot's username
+ * could add it to their own group, send `/setup`, and drive agents — i.e. run
+ * commands on the host. And DMs belonged to whoever wrote to the bot first.
+ * Both now require a code shown in the web cockpit's Telegram panel, which is
+ * admin-only: whoever can read the code is someone the cockpit already trusts,
+ * and the Telegram account that types it is the one that account vouches for.
+ *
+ * The code is 8 digits, single-use, lives 10 minutes, and dies after
+ * `MAX_ATTEMPTS` wrong guesses — 10^8 codes against 5 tries leaves a guesser
+ * nothing. Issuing a new one revokes the previous one. It lives in memory only:
+ * a server restart invalidating a 10-minute code costs one click.
+ *
+ * The state transitions are pure (`redeemPairing`), so the rules are tested
+ * without a clock or a bot.
+ */
+import { randomInt, timingSafeEqual } from "node:crypto";
+export const PAIRING_DIGITS = 8;
+export const PAIRING_TTL_MS = 10 * 60_000;
+export const PAIRING_MAX_ATTEMPTS = 5;
+/** A fresh code. `rand` is injectable for the tests. */
+export function newPairing(now, rand = randomInt) {
+    let code = "";
+    for (let i = 0; i < PAIRING_DIGITS; i++)
+        code += String(rand(10));
+    return { code, expiresAt: now + PAIRING_TTL_MS, failures: 0 };
+}
+/** Pull the code out of what was typed: tolerant of spaces and dashes
+ *  ("1234 5678", "1234-5678"), since people copy codes the way they read them. */
+export function normalizeCode(input) {
+    return input.replace(/[\s-]/g, "");
+}
+function sameCode(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+/**
+ * Try a code against the current state. Returns the verdict and the state to
+ * keep: `null` once the code is spent (used, expired or locked out), so nothing
+ * can be retried against a dead code. Pure — unit tested.
+ */
+export function redeemPairing(state, input, now) {
+    if (!state)
+        return { verdict: "none", next: null };
+    if (now >= state.expiresAt)
+        return { verdict: "expired", next: null };
+    if (sameCode(normalizeCode(input), state.code))
+        return { verdict: "ok", next: null };
+    const failures = state.failures + 1;
+    if (failures >= PAIRING_MAX_ATTEMPTS)
+        return { verdict: "locked", next: null };
+    return { verdict: "invalid", next: { ...state, failures } };
+}
+/** What a refused redemption tells the Telegram sender. Never says how many
+ *  tries are left: that is information for the guesser, not for the owner. */
+export function pairingRefusal(verdict) {
+    const where = "Open the cockpit's Telegram panel (admin) and click “Pair Telegram” to get a code.";
+    switch (verdict) {
+        case "none":
+            return `🔒 This bot is not paired yet. ${where}`;
+        case "expired":
+            return `⌛ That code has expired. ${where}`;
+        case "locked":
+            return `⛔ Too many wrong codes — that code is cancelled. ${where}`;
+        case "invalid":
+            return "❌ Wrong code.";
+    }
+}
+// The live code. One per process: the server and the bridge share it.
+let current = null;
+/** Issue a new code, revoking any previous one. */
+export function issuePairingCode(now = Date.now()) {
+    current = newPairing(now);
+    return current;
+}
+/** Redeem against the live code, advancing its state. */
+export function redeemPairingCode(input, now = Date.now()) {
+    const { verdict, next } = redeemPairing(current, input, now);
+    current = next;
+    return verdict;
+}
+/** Revoke the live code, if any (the panel's "cancel"). */
+export function cancelPairingCode() {
+    current = null;
+}
+/** Is a code live right now, and until when? For the panel, never the code. */
+export function pairingStatus(now = Date.now()) {
+    if (current && now < current.expiresAt)
+        return { active: true, expiresAt: current.expiresAt };
+    return { active: false, expiresAt: null };
+}
+//# sourceMappingURL=tg-pairing.js.map

package/dist/tg-pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tg-pairing.js","sourceRoot":"","sources":["../src/tg-pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAWtC,wDAAwD;AACxD,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAI,GAA4B,SAAS;IAC/E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA0B,EAC1B,KAAa,EACb,GAAW;IAEX,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,IAAI,oBAAoB;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,cAAc,CAAC,OAAsC;IACnE,MAAM,KAAK,GAAG,oFAAoF,CAAC;IACnG,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,kCAAkC,KAAK,EAAE,CAAC;QACnD,KAAK,SAAS;YACZ,OAAO,4BAA4B,KAAK,EAAE,CAAC;QAC7C,KAAK,QAAQ;YACX,OAAO,oDAAoD,KAAK,EAAE,CAAC;QACrE,KAAK,SAAS;YACZ,OAAO,eAAe,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,IAAI,OAAO,GAAwB,IAAI,CAAC;AAExC,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/C,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,GAAG,IAAI,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5C,IAAI,OAAO,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAC9F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shadok-ai",
-  "version": "0.16.19",
+  "version": "0.16.21",
   "main": "dist/session.js",
   "scripts": {
     "test": "node --import tsx --test --test-timeout=120000 test/*.ts context/*/test/*.test.mjs",

package/public/index.html

@@ -1066,6 +1066,9 @@
   .tg-guide ol { margin: 8px 0 0; padding-left: 20px; font-size: 13px; line-height: 1.5; }
   .tg-guide li { margin-bottom: 4px; }
   .tg-guide code { font-size: 12px; }
+  .tg-pair { margin-bottom: 12px; }
+  .tg-pair-code { font: 600 26px/1.2 ui-monospace, SFMono-Regular, Menlo, monospace; letter-spacing: 3px; margin: 6px 0; user-select: all; }
+  .tg-pair-links { display: flex; gap: 8px; flex-wrap: wrap; margin: 6px 0; }
   /* A field with no effect in the current mode (resume/continue) — visible but inert. */
   .na { opacity: .45; pointer-events: none; }
 
@@ -2958,11 +2961,23 @@
         <li>Paste that token below and click <b>Save</b>. The status above turns 🟢 with the bot's name.</li>
         <li>Create a Telegram <b>group</b>, open its settings and turn on <b>Topics</b>.</li>
         <li>Add your bot to the group and make it an <b>admin</b> with <i>Manage topics</i> (and <i>Delete messages</i>, so <code>/secret</code> can scrub values).</li>
-        <li>In the group, send <code>/setup</code>. The status above now shows the bound group.</li>
+        <li>Click <b>Pair Telegram</b> below, then send <code>/setup &lt;code&gt;</code> in the group (or use the one-click link). The status above now shows the bound group, and you own the bot's DMs.</li>
         <li>Send <code>/spawn &lt;name&gt;</code> (or create a topic by hand): each topic is one agent, also visible here as a tab.</li>
       </ol>
       <p class="check-hint">Optional: list chat ids under <i>Allowed chats</i> so only they can reach the bot.</p>
     </details>
+    <div class="tg-pair">
+      <button id="tgPair" title="Show a one-time code: only the Telegram account that enters it can bind the board group or own the bot's DMs">Pair Telegram</button>
+      <div id="tgPairBox" hidden>
+        <div class="tg-pair-code" id="tgPairCode"></div>
+        <p class="check-hint">Send <code>/setup <span id="tgPairCodeInline"></span></code> in the group to make it the board, or in a private chat with the bot to own its DMs. Single use · <span id="tgPairLeft"></span></p>
+        <div class="tg-pair-links">
+          <a id="tgPairGroup" target="_blank" rel="noopener noreferrer" hidden>Add to a group ↗</a>
+          <a id="tgPairDm" target="_blank" rel="noopener noreferrer" hidden>Open a private chat ↗</a>
+          <button id="tgPairCancel">Cancel code</button>
+        </div>
+      </div>
+    </div>
     <button id="tgUnbind" hidden title="Unbind the board group so you can /setup a fresh one (e.g. after it became a supergroup)">Unbind group</button>
     <label class="check"><input type="checkbox" id="tgEnabled"><span>Bot enabled</span></label>
     <div class="field">
@@ -4319,7 +4334,9 @@
     // The Telegram mirror. The label states the action AND its cost: turning it
     // off deletes the topic, hence the conversation on the phone — so we confirm.
     // The main channel (the General) is the board's home base: not un-mirrorable.
-    if (!tab.isMain) {
+    // Admin-only, like the rest of the Telegram surface (the server refuses a
+    // member's mirror write regardless; this just doesn't offer it).
+    if (!tab.isMain && me?.role === "admin") {
       items.push([
         tab.mirror ? "✈️ Stop mirroring (deletes the topic)" : "✈️ Mirror to Telegram",
         () => {
@@ -10240,6 +10257,14 @@
     // Every signed-in PERSON opens it — a member manages their own passkeys
     // there; only an admin sees the accounts below.
     if (b) b.hidden = !(me?.role === "admin" || me?.name);
+    // The Telegram bot config (header ✈️ button) and the "Mirror to Telegram"
+    // creation checkbox are ADMIN-ONLY — the server enforces it (GET/PUT
+    // /telegram, and the `start` / PUT /channels mirror gate); hiding the
+    // controls just avoids offering a member a door that 403s. The agent-menu
+    // mirror item is gated where that menu is built.
+    const amAdmin = me?.role === "admin";
+    const tgb = $("telegramBtn"); if (tgb) tgb.hidden = !amAdmin;
+    const mf = $("mirrorField"); if (mf) mf.hidden = !amAdmin;
     // No password on this instance means no session at all: nothing to name and
     // nothing to leave. Showing "Sign out" there would promise a door that does
     // not exist.
@@ -10740,7 +10765,7 @@
     tgAllowed = s.allowedChats.slice();
     const dot = s.running && s.username ? "🟢" : s.tokenError ? "🟠" : "⚪";
     const who = s.username ? s.username : s.hasToken ? "(token set)" : "no token";
-    const grp = s.boundGroup ? ` · group ${s.boundGroup.chatId}` : " · no group bound (run /setup in Telegram)";
+    const grp = s.boundGroup ? ` · group ${s.boundGroup.chatId}` : " · no group bound (pair it below)";
     const err = s.tokenError ? ` — ${s.tokenError}` : "";
     $("tgStatus").textContent = `${dot} ${who}${grp}${err}`;
     $("tgUnbind").hidden = !s.boundGroup; // only offer unbind when a group is bound
@@ -10767,6 +10792,41 @@
       ul.appendChild(li);
     }
   }
+  // Pairing code: shown once, as issued — the server never returns it again.
+  let tgPairTimer = null;
+  function hidePairing() {
+    clearInterval(tgPairTimer);
+    tgPairTimer = null;
+    $("tgPairBox").hidden = true;
+  }
+  function showPairing(p) {
+    $("tgPairCode").textContent = p.code.slice(0, 4) + " " + p.code.slice(4);
+    $("tgPairCodeInline").textContent = p.code;
+    for (const [id, href] of [["tgPairGroup", p.groupLink], ["tgPairDm", p.dmLink]]) {
+      const a = $(id);
+      a.hidden = !href;
+      if (href) a.href = href;
+    }
+    $("tgPairBox").hidden = false;
+    const tick = () => {
+      const left = Math.max(0, p.expiresAt - Date.now());
+      if (left === 0) { hidePairing(); return; }
+      const m = Math.floor(left / 60000), sec = Math.floor((left % 60000) / 1000);
+      $("tgPairLeft").textContent = `expires in ${m}:${String(sec).padStart(2, "0")}`;
+    };
+    clearInterval(tgPairTimer);
+    tick();
+    tgPairTimer = setInterval(tick, 1000);
+  }
+  async function issuePairing() {
+    const r = await fetch("/telegram/pairing", { method: "POST" });
+    if (r.ok) showPairing(await r.json());
+    else alert((await r.json().catch(() => ({}))).error || "could not issue a pairing code");
+  }
+  async function cancelPairing() {
+    await fetch("/telegram/pairing", { method: "DELETE" });
+    hidePairing();
+  }
   async function loadTelegram() {
     delete $("tgGuide").dataset.auto; // each opening of the panel re-decides the fold
     renderTelegram(await (await fetch("/telegram")).json());
@@ -11174,7 +11234,9 @@
   // Backdrop click closes a dismissable (voluntary) card; the panel itself does not.
   $("authOverlay").addEventListener("click", (e) => { if (e.target === $("authOverlay")) closeAuthCard(); });
 
-  $("tgUnbind").addEventListener("click", () => { if (confirm("Unbind the current board group? You'll need to /setup a group again in Telegram.")) putTelegram({ unbindGroup: true }); });
+  $("tgPair").addEventListener("click", issuePairing);
+  $("tgPairCancel").addEventListener("click", cancelPairing);
+  $("tgUnbind").addEventListener("click", () => { if (confirm("Unbind the current board group? You'll need to pair a group again (Pair Telegram, then /setup <code>).")) putTelegram({ unbindGroup: true }); });
   $("telegramBtn").addEventListener("click", () => { $("telegramOverlay").hidden = false; loadTelegram(); });
   $("telegramClose").addEventListener("click", () => { $("telegramOverlay").hidden = true; });
   $("telegramOverlay").addEventListener("click", (e) => { if (e.target === $("telegramOverlay")) $("telegramOverlay").hidden = true; });