shadok-ai 0.16.20 → 0.16.22

package/README.md

@@ -341,12 +341,21 @@ Enter to skip; you can add it later from the web UI).
 The Telegram panel (header icon) carries a folded *How to set it up, step by step*
 guide, open until a token is saved and a group is bound.
 
+**Pairing.** The bot answers nobody until it is paired from the cockpit. In the
+Telegram panel (admin only), click **Pair Telegram**: it shows an 8-digit code,
+valid 10 minutes, single-use, cancelled after 5 wrong tries. Send `/setup <code>`
+in the group to make it the board, or in a private chat with the bot to make its
+DMs yours — or use the panel's one-click links, which pass the code for you.
+Whoever enters the code becomes the owner of the bot's DMs. A group bound before
+pairing existed stays bound; to move to another group, unbind it in the panel
+and pair again.
+
 Add your bot to a group with **Topics** enabled, make it an admin with *Manage
 topics* (and *Delete messages* so `/secret` can scrub values), then in the group:
 
 | Command | |
 |---|---|
-| `/setup` | bind this group as the board (one group per instance) |
+| `/setup <code>` | bind this group as the board (one group per instance), with the code from the panel's **Pair Telegram** |
 | `/spawn [profile] <name>` | new isolated agent in its own topic (also a web tab) |
 | `/stop` (alias `/esc`) | interrupt the current turn — does **not** end the session |
 | `/new` · `/end` | reset · kill the session |

package/dist/server.js

@@ -39,6 +39,7 @@ import { getUsage } from "./usage.js";
 import { loadChannels, loadGroups, saveGroups, upsertChannel, removeChannel, mergeClientChannels, channelWriteAllowed, profilePatch, loadTgGroup, saveTgGroup, isHomeChannel, homeAdoptionTarget, resolveSessionTarget, resolveResumeId, resumeTarget, } from "./channels.js";
 import { deliverWithRetry } from "./reload.js";
 import { startTelegram, renameTelegramTopic, closeTelegramTopic, probeToken, isStalePreface, announceLoggedOut, resetLoggedOutNotice, attachmentPrompt, pasteFileName, MEDIA_DIR, } from "./telegram.js";
+import { cancelPairingCode, issuePairingCode, pairingStatus } from "./tg-pairing.js";
 import { migrateTgBindings } from "./channels.js";
 import { instanceKey } from "./paths.js";
 import { peerFileFor, loadPeers, savePeers, peerFromToken, signPeerToken, newPeer, withSalts, redeemVerdict, redeemPeer, normPeerName, removePeer, ownedByPeer, peersOutFileFor, agentInvitePrompt, peerScope, } from "./peers.js";
@@ -2728,6 +2729,37 @@ app.put("/telegram", async (req, res) => {
     }
     res.json(await telegramState());
 });
+// Pairing code for the bot (`src/tg-pairing.ts`): binding the board group or
+// owning the DMs needs a code only this admin-only panel shows. POST issues a
+// fresh one (revoking any previous code) and is the ONE response that carries
+// it; GET reports whether one is live, never the code itself. Browser-only
+// writes, like the rest of the Telegram config: an agent must not be able to
+// mint a code and pair a Telegram account of its choosing.
+app.get("/telegram/pairing", (req, res) => {
+    if (!accountAdmin(req, res, false, "pair the Telegram bot"))
+        return;
+    res.json(pairingStatus());
+});
+app.post("/telegram/pairing", async (req, res) => {
+    if (!accountAdmin(req, res, true, "pair the Telegram bot"))
+        return;
+    const p = issuePairingCode();
+    const username = (await telegramState()).username;
+    const bot = username ? String(username).replace(/^@/, "") : null;
+    res.json({
+        code: p.code,
+        expiresAt: p.expiresAt,
+        // Deep links: Telegram delivers `/start <code>` by itself, so one tap pairs.
+        groupLink: bot ? `https://t.me/${bot}?startgroup=${p.code}` : null,
+        dmLink: bot ? `https://t.me/${bot}?start=${p.code}` : null,
+    });
+});
+app.delete("/telegram/pairing", (req, res) => {
+    if (!accountAdmin(req, res, true, "pair the Telegram bot"))
+        return;
+    cancelPairingCode();
+    res.json(pairingStatus());
+});
 const server = http.createServer(app);
 const wss = new WebSocketServer({
     server,