talon-agent 3.34.1 → 3.36.0

package/src/frontend/telegram/callbacks/whatsapp.ts

@@ -0,0 +1,50 @@
+/**
+ * `whatsapp:*` callbacks — the /whatsapp panel's buttons.
+ *
+ *   whatsapp:pair     run one bounded pairing attempt
+ *   whatsapp:refresh  re-read link state and redraw the panel
+ */
+
+import type { Context } from "grammy";
+import {
+  runWhatsAppPairing,
+  whatsAppPanel,
+} from "../commands/whatsapp-pairing.js";
+import { isAuthorizedAdmin } from "../commands/state.js";
+import { answerCallbackQuerySafe } from "./shared.js";
+
+export async function handleWhatsAppCallback(
+  ctx: Context,
+  data: string,
+): Promise<void> {
+  if (!isAuthorizedAdmin(ctx)) {
+    await answerCallbackQuerySafe(ctx, { text: "Not authorized." });
+    return;
+  }
+  const [, action] = data.split(":");
+
+  if (action === "refresh") {
+    await answerCallbackQuerySafe(ctx);
+    const panel = whatsAppPanel();
+    const chatId = ctx.chat?.id;
+    const messageId = ctx.callbackQuery?.message?.message_id;
+    if (chatId === undefined || messageId === undefined) return;
+    await ctx.api
+      .editMessageText(chatId, messageId, panel.text, {
+        parse_mode: "HTML",
+        ...(panel.keyboard.length
+          ? { reply_markup: { inline_keyboard: panel.keyboard } }
+          : {}),
+      })
+      .catch(() => {});
+    return;
+  }
+
+  if (action === "pair") {
+    await answerCallbackQuerySafe(ctx, { text: "Starting pairing…" });
+    await runWhatsAppPairing(ctx);
+    return;
+  }
+
+  await answerCallbackQuerySafe(ctx, { text: "Invalid callback data" });
+}

package/src/frontend/telegram/commands/auth.ts

@@ -0,0 +1,58 @@
+/**
+ * /auth — backend login panel (admin only). Also captures the code an
+ * admin replies with during a Claude sign-in, before the message reaches
+ * the agent.
+ */
+
+import type { Bot } from "grammy";
+import type { LoginBinaries } from "../../../core/auth/login-flow.js";
+import {
+  currentAuthPanel,
+  pendingCodePrompt,
+  submitPendingCode,
+} from "../auth-panel.js";
+import { isAuthorizedAdmin, type RegisterDeps } from "./state.js";
+
+export function loginBinariesFrom(
+  config: RegisterDeps["config"],
+): LoginBinaries {
+  return {
+    claude: config.claudeBinary,
+    codex: process.env.TALON_CODEX_BINARY || config.codexBinary,
+  };
+}
+
+export function registerAuthCommand(bot: Bot): void {
+  bot.command("auth", async (ctx) => {
+    if (!isAuthorizedAdmin(ctx)) {
+      await ctx.reply("Not authorized.");
+      return;
+    }
+    const panel = await currentAuthPanel();
+    await ctx.reply(panel.text, {
+      parse_mode: "HTML",
+      reply_markup: { inline_keyboard: panel.keyboard },
+    });
+  });
+
+  // A reply to the sign-in prompt carries the pasted code. Only admins,
+  // only while a flow is waiting, only as a reply to that exact message —
+  // anything else falls through to the normal pipeline untouched.
+  bot.on("message:text", async (ctx, next) => {
+    const chatId = String(ctx.chat.id);
+    const pending = pendingCodePrompt(chatId);
+    if (
+      !pending ||
+      !isAuthorizedAdmin(ctx) ||
+      ctx.message.reply_to_message?.message_id !== pending.messageId
+    ) {
+      await next();
+      return;
+    }
+    if (submitPendingCode(chatId, ctx.message.text)) {
+      await ctx.reply("Got it — finishing sign-in…");
+      return;
+    }
+    await next();
+  });
+}

package/src/frontend/telegram/commands/definitions.ts

@@ -33,6 +33,10 @@ export const TELEGRAM_COMMANDS: ReadonlyArray<{
   { command: "reset", description: "Clear session and start fresh" },
   { command: "restart", description: "Restart the bot (admin)" },
   { command: "whatsapp", description: "WhatsApp link status / pair (admin)" },
+  {
+    command: "auth",
+    description: "Backend logins — sign in to Claude/Codex (admin)",
+  },
   { command: "usage", description: "Plan limits across every backend" },
   { command: "metrics", description: "Aggregate performance metrics" },
   {

package/src/frontend/telegram/commands/index.ts

@@ -10,9 +10,9 @@
  *   - `admin`       — /admin /metrics /doctor /dream /soul /restart /update
  *                     + the unknown-command suggester
  *
- * `registerCommands` wires every group onto the bot, preserving the original
- * registration order (info → session → settings → admin, with the
- * unknown-command catch-all registered last).
+ * `registerCommands` wires every group onto the bot in an order that ends
+ * with `admin`, because admin owns the unknown-command catch-all and that
+ * must be the last handler to see a bare /command.
  */
 
 import type { Bot } from "grammy";
@@ -23,6 +23,7 @@ import { registerSessionCommands } from "./session.js";
 import { registerSettingsCommands } from "./settings.js";
 import { registerAdminCommands } from "./admin.js";
 import { registerWhatsAppPairingCommand } from "./whatsapp-pairing.js";
+import { registerAuthCommand } from "./auth.js";
 
 export { telegramCommandMenu } from "./definitions.js";
 export { setAdminUserId } from "./state.js";
@@ -36,6 +37,11 @@ export function registerCommands(
   registerInfoCommands(bot);
   registerSessionCommands(bot, deps);
   registerSettingsCommands(bot, deps);
-  registerAdminCommands(bot, deps);
   registerWhatsAppPairingCommand(bot);
+  registerAuthCommand(bot);
+  // admin LAST: it owns the unknown-command catch-all, which must only
+  // be reached after every real command has had its chance to match.
+  // Registering anything after it makes that command look unknown
+  // ("Unknown command /whatsapp — did you mean /whatsapp?").
+  registerAdminCommands(bot, deps);
 }

package/src/frontend/telegram/commands/whatsapp-pairing.ts

@@ -1,19 +1,125 @@
 /**
  * /whatsapp — drive WhatsApp device pairing from Telegram.
  *
- * `/whatsapp` reports link state; `/whatsapp pair` runs ONE bounded
- * pairing attempt via the core pairing broker and replies with the QR as
- * a photo (plus the phone-number code when the account has one
- * configured). The human runs it when they are holding the phone —
- * pairing is never automatic, because automatic retries are how the
- * account got rate-limited into "couldn't connect device".
+ * Bare `/whatsapp` draws a status panel with a button per sub-command;
+ * `/whatsapp pair` runs ONE bounded pairing attempt via the core pairing
+ * broker and replies with the QR as a photo (plus the phone-number code
+ * when the account has one configured). The human runs it when they are
+ * holding the phone — pairing is never automatic, because automatic
+ * retries are how the account got rate-limited into "couldn't connect
+ * device".
  */
 
-import { InputFile, type Bot } from "grammy";
+import { InputFile, type Bot, type Context } from "grammy";
 import { getPairingProvider } from "../../../core/pairing-broker.js";
 import { log } from "../../../util/log.js";
 import { isAuthorizedAdmin } from "./state.js";
 
+const WHATSAPP_NOT_ENABLED =
+  'WhatsApp isn\'t enabled on this daemon — add "whatsapp" to the ' +
+  "frontend list and configure the whatsapp block, then restart.";
+
+export type WhatsAppPanel = {
+  text: string;
+  keyboard: Array<Array<{ text: string; callback_data: string }>>;
+};
+
+/**
+ * The bare-`/whatsapp` panel: link state plus one button per
+ * sub-command, so the commands are discoverable instead of folklore.
+ */
+export function whatsAppPanel(): WhatsAppPanel {
+  const provider = getPairingProvider();
+  if (!provider) {
+    return { text: WHATSAPP_NOT_ENABLED, keyboard: [] };
+  }
+  const linked = provider.isLinked();
+  const text = linked
+    ? "<b>WhatsApp</b>\n✅ Linked and connected.\n\n" +
+      "Re-link only if the phone has unlinked this device."
+    : "<b>WhatsApp</b>\n📴 Not linked.\n\n" +
+      "Tap <b>Pair device</b> when you're holding the phone — I'll reply " +
+      "with a QR to scan (WhatsApp → ⋮ → Linked devices → Link a device).";
+  return {
+    text,
+    keyboard: [
+      [
+        {
+          text: linked ? "🔗 Re-pair" : "🔗 Pair device",
+          callback_data: "whatsapp:pair",
+        },
+        { text: "🔄 Refresh", callback_data: "whatsapp:refresh" },
+      ],
+    ],
+  };
+}
+
+/**
+ * One bounded pairing attempt, shared by `/whatsapp pair` and the panel
+ * button so both paths behave identically.
+ */
+export async function runWhatsAppPairing(ctx: Context): Promise<void> {
+  const provider = getPairingProvider();
+  if (!provider) {
+    await ctx.reply(WHATSAPP_NOT_ENABLED);
+    return;
+  }
+
+  if (provider.isLinked()) {
+    await ctx.reply(
+      "WhatsApp is already linked. Unlink it on the phone first if you " +
+        "want to re-pair.",
+    );
+    return;
+  }
+
+  let attempt;
+  try {
+    attempt = await provider.begin();
+  } catch (err) {
+    await ctx.reply(
+      `Couldn't start pairing: ${err instanceof Error ? err.message : err}`,
+    );
+    return;
+  }
+
+  if (attempt.qrPng) {
+    const codeLine = attempt.code
+      ? `\nOr enter code: ${attempt.code} (Link with phone number instead)`
+      : "";
+    await ctx.replyWithPhoto(new InputFile(attempt.qrPng, "whatsapp-qr.png"), {
+      caption:
+        "Scan within ~2 minutes:\n" +
+        "WhatsApp → ⋮ → Linked devices → Link a device" +
+        codeLine,
+    });
+  } else {
+    await ctx.reply(
+      "No QR came back — WhatsApp may still be rate-limiting. Try later.",
+    );
+  }
+
+  const outcome = await attempt.result;
+  if (outcome.ok) {
+    log("bot", `WhatsApp paired via /whatsapp pair (${outcome.identity})`);
+    await ctx.reply(
+      `✅ Linked as ${outcome.identity}. WhatsApp is connecting now.`,
+    );
+  } else if (outcome.reason === "expired") {
+    await ctx.reply(
+      "⌛ That window expired without a successful scan. Run " +
+        "/whatsapp pair again when you're ready — if the phone says " +
+        '"couldn\'t connect device", WhatsApp is still rate-limiting; ' +
+        "wait an hour and try once more.",
+    );
+  } else if (outcome.reason !== "cancelled") {
+    await ctx.reply(
+      `❌ Pairing failed${outcome.detail ? `: ${outcome.detail}` : ""}. ` +
+        "Run /whatsapp pair to try again.",
+    );
+  }
+}
+
 export function registerWhatsAppPairingCommand(bot: Bot): void {
   bot.command("whatsapp", async (ctx) => {
     if (!isAuthorizedAdmin(ctx)) {
@@ -21,82 +127,18 @@ export function registerWhatsAppPairingCommand(bot: Bot): void {
       return;
     }
 
-    const provider = getPairingProvider();
-    if (!provider) {
-      await ctx.reply(
-        'WhatsApp isn\'t enabled on this daemon — add "whatsapp" to the ' +
-          "frontend list and configure the whatsapp block, then restart.",
-      );
-      return;
-    }
-
     const arg = (ctx.match ?? "").trim().toLowerCase();
     if (arg !== "pair") {
-      await ctx.reply(
-        provider.isLinked()
-          ? "✅ WhatsApp is linked and connected.\nSend /whatsapp pair to re-link."
-          : "📴 WhatsApp is not linked.\nSend /whatsapp pair when you're " +
-              "holding the phone — I'll reply with a QR to scan " +
-              "(WhatsApp → Linked devices → Link a device).",
-      );
+      const panel = whatsAppPanel();
+      await ctx.reply(panel.text, {
+        parse_mode: "HTML",
+        ...(panel.keyboard.length
+          ? { reply_markup: { inline_keyboard: panel.keyboard } }
+          : {}),
+      });
       return;
     }
 
-    if (provider.isLinked()) {
-      await ctx.reply(
-        "WhatsApp is already linked. Unlink it on the phone first if you " +
-          "want to re-pair.",
-      );
-      return;
-    }
-
-    let attempt;
-    try {
-      attempt = await provider.begin();
-    } catch (err) {
-      await ctx.reply(
-        `Couldn't start pairing: ${err instanceof Error ? err.message : err}`,
-      );
-      return;
-    }
-
-    if (attempt.qrPng) {
-      const codeLine = attempt.code
-        ? `\nOr enter code: ${attempt.code} (Link with phone number instead)`
-        : "";
-      await ctx.replyWithPhoto(
-        new InputFile(attempt.qrPng, "whatsapp-qr.png"),
-        {
-          caption:
-            "Scan within ~2 minutes:\n" +
-            "WhatsApp → ⋮ → Linked devices → Link a device" +
-            codeLine,
-        },
-      );
-    } else {
-      await ctx.reply(
-        "No QR came back — WhatsApp may still be rate-limiting. Try later.",
-      );
-    }
-
-    const outcome = await attempt.result;
-    if (outcome.ok) {
-      log("bot", `WhatsApp paired via /whatsapp pair (${outcome.identity})`);
-      await ctx.reply(
-        `✅ Linked as ${outcome.identity}. WhatsApp is connecting now.`,
-      );
-    } else if (outcome.reason === "expired") {
-      await ctx.reply(
-        "⌛ That window expired without a successful scan. Run " +
-          "/whatsapp pair again when you're ready — if the phone says " +
-          '"couldn\'t connect device", WhatsApp is still rate-limiting; ' +
-          "wait an hour and try once more.",
-      );
-    } else if (outcome.reason !== "cancelled") {
-      await ctx.reply(
-        `❌ Pairing failed${outcome.detail ? `: ${outcome.detail}` : ""}. ` +
-          "Run /whatsapp pair to try again.",
-      );
-    }
+    await runWhatsAppPairing(ctx);
   });
 }

package/src/frontend/whatsapp/actions/chat-info.ts

@@ -3,10 +3,10 @@
  *
  * Group data comes from `groupMetadata`, which WhatsApp serves per JID
  * and Baileys caches; DMs have no metadata endpoint, so their answers are
- * assembled from the registry and the profile endpoints.
+ * assembled from the registry and the profile endpoints. Message
+ * retrieval (get_message_by_id, download_media) lives in history.ts.
  */
 
-import { lookupMessage } from "../message-store.js";
 import { toUserJid, tryAction } from "./shared.js";
 import type { WhatsAppActionHandlers } from "./types.js";
 
@@ -188,38 +188,4 @@ export const chatInfoHandlers: WhatsAppActionHandlers = {
       );
       return { ok: true };
     }),
-
-  /**
-   * Re-download a message's media on demand. Inbound media is already
-   * saved to the workspace as it arrives; this covers anything the model
-   * wants to pull again by id.
-   */
-  download_media: (body, _chatId, ctx) =>
-    tryAction("download_media", async () => {
-      const raw = body.message_id;
-      const msgId = typeof raw === "number" ? raw : Number(raw);
-      const stored = Number.isFinite(msgId) ? lookupMessage(msgId) : undefined;
-      if (!stored || stored.chatId !== ctx.chat!.chatId) {
-        return { ok: false, error: `Unknown message_id ${String(raw)}` };
-      }
-      if (!stored.message) {
-        return {
-          ok: false,
-          error: `Message ${msgId} is no longer retained in full`,
-        };
-      }
-      const { saveInboundMedia } = await import("../media-store.js");
-      const saved = await saveInboundMedia(
-        stored.message,
-        ctx.chat!.chatId,
-        msgId,
-        stored.senderName,
-      );
-      return saved
-        ? { ok: true, text: saved.filePath, file_path: saved.filePath }
-        : {
-            ok: false,
-            error: `Message ${msgId} carries no downloadable media`,
-          };
-    }),
 };

package/src/frontend/whatsapp/actions/history.ts

@@ -0,0 +1,100 @@
+/**
+ * History retrieval actions — the WhatsApp side of `get_message_by_id`
+ * and `download_media`.
+ *
+ * Reading and searching history need nothing WhatsApp-specific: the
+ * core's shared handlers serve `read_history` / `search_history` from
+ * the persistent store every inbound and outbound message lands in.
+ * Fetching one message by id and pulling its media do: the id has to
+ * resolve to a WhatsApp key, and a file that was never saved (or has
+ * since expired from the workspace) has to come back down from
+ * WhatsApp — via the sender's re-upload when the CDN copy is gone.
+ */
+
+import { existsSync } from "node:fs";
+import {
+  getHistoryMessage,
+  getMessageById,
+  setMessageFilePath,
+} from "../../../storage/history.js";
+import { saveInboundMedia } from "../media-store.js";
+import { lookupMessage, resolveKey } from "../message-store.js";
+import { tryAction } from "./shared.js";
+import type { WhatsAppActionHandlers } from "./types.js";
+
+function toMsgId(raw: unknown): number {
+  return typeof raw === "number" ? raw : Number(raw);
+}
+
+export const historyHandlers: WhatsAppActionHandlers = {
+  get_message_by_id: (body, _chatId, ctx) =>
+    tryAction("get_message_by_id", async () => {
+      const chatId = ctx.chat!.chatId;
+      const msgId = toMsgId(body.message_id);
+      if (!Number.isFinite(msgId)) {
+        return {
+          ok: false,
+          error: `Invalid message_id: ${String(body.message_id)}`,
+        };
+      }
+      const row = getHistoryMessage(chatId, msgId);
+      const stored = lookupMessage(msgId);
+      if (!row && (!stored || stored.chatId !== chatId)) {
+        return { ok: false, error: `Message ${msgId} not found in this chat.` };
+      }
+      const lines = [
+        row
+          ? getMessageById(chatId, msgId)
+          : `[${new Date(stored!.timestamp).toISOString()}] ${stored!.senderName}: ${stored!.text}`,
+      ];
+      if (row?.replyToMsgId) lines.push(`reply to: msg_id ${row.replyToMsgId}`);
+      if (row?.mediaType) {
+        const saved = row.filePath && existsSync(row.filePath);
+        lines.push(
+          saved
+            ? `${row.mediaType}: ${row.filePath}`
+            : `${row.mediaType}: not on disk — download_media ${msgId} fetches it`,
+        );
+      }
+      return { ok: true, text: lines.join("\n") };
+    }),
+
+  /**
+   * Media for a message by id. Inbound media is saved as it arrives, so
+   * the saved file is answered first; otherwise the retained proto is
+   * downloaded again, asking the sender to re-upload when WhatsApp's
+   * CDN copy has expired.
+   */
+  download_media: (body, _chatId, ctx) =>
+    tryAction("download_media", async () => {
+      const chatId = ctx.chat!.chatId;
+      const resolved = resolveKey(body.message_id, chatId);
+      if ("error" in resolved) return { ok: false, error: resolved.error };
+      const { stored } = resolved;
+      const row = getHistoryMessage(chatId, stored.msgId);
+      if (row?.filePath && existsSync(row.filePath)) {
+        return { ok: true, text: row.filePath, file_path: row.filePath };
+      }
+      if (!stored.message) {
+        return {
+          ok: false,
+          error: `Message ${stored.msgId} was not retained in full, so its media cannot be re-downloaded`,
+        };
+      }
+      const saved = await saveInboundMedia(
+        stored.message,
+        chatId,
+        stored.msgId,
+        stored.senderName,
+        { reuploadRequest: ctx.sock.updateMediaMessage },
+      );
+      if (!saved) {
+        return {
+          ok: false,
+          error: `Message ${stored.msgId} carries no downloadable media`,
+        };
+      }
+      setMessageFilePath(chatId, stored.msgId, saved.filePath);
+      return { ok: true, text: saved.filePath, file_path: saved.filePath };
+    }),
+};

package/src/frontend/whatsapp/actions/index.ts

@@ -12,7 +12,8 @@
  *   - shared     — tryAction, media/quote resolution, send helpers
  *   - messaging  — text, replies, reactions, edits, deletes, pins, presence
  *   - media      — images, video, audio, documents, polls, locations, …
- *   - chat-info  — group metadata, members, titles, media download
+ *   - chat-info  — group metadata, members, titles
+ *   - history    — get_message_by_id, download_media (re-upload aware)
  *   - moderation — the `moderate` op switch
  */
 
@@ -25,6 +26,7 @@ import {
   type WhatsAppChatInfo,
 } from "../registry.js";
 import { chatInfoHandlers } from "./chat-info.js";
+import { historyHandlers } from "./history.js";
 import { mediaHandlers } from "./media.js";
 import { messagingHandlers } from "./messaging.js";
 import { moderationHandlers } from "./moderation.js";
@@ -36,6 +38,7 @@ const handlers: WhatsAppActionHandlers = Object.assign(Object.create(null), {
   ...messagingHandlers,
   ...mediaHandlers,
   ...chatInfoHandlers,
+  ...historyHandlers,
   ...moderationHandlers,
 });