telecodex 0.1.0 → 0.1.2

package/README.md

@@ -28,6 +28,7 @@ The bot talks to local Codex through `@openai/codex-sdk`, which wraps the local
 - One topic maps to one Codex SDK thread.
 - Each topic has at most one active SDK run.
 - Follow-up messages during an active run are queued and processed in order.
+- The pending queue is in-memory only and is cleared on restart.
 - Text and image messages are mapped to Codex SDK input.
 - A run immediately creates a normal Telegram status message; progress edits that message.
 - telecodex does not use pinned messages for live state.
@@ -73,6 +74,30 @@ npm run dev
 For a production-style local install during development, `npm link` exposes the
 same `telecodex` command globally from the current checkout.
 
+## Automated npm release
+
+This repository is set up for npm trusted publishing from GitHub Actions.
+
+1. On npm, open the `telecodex` package settings and configure a trusted publisher:
+   - Organization or user: `jiangege`
+   - Repository: `telecodex`
+   - Workflow filename: `publish.yml`
+2. Bump the version locally:
+
+```bash
+npm version patch
+```
+
+3. Push the branch and tag:
+
+```bash
+git push origin main --follow-tags
+```
+
+Pushing a `v*` tag runs `.github/workflows/publish.yml`, which installs dependencies,
+runs `npm run check`, runs `npm test`, and publishes the package to npm when the tag
+matches the version in `package.json`.
+
 ## First launch
 
 On first launch, `telecodex`:
@@ -83,6 +108,8 @@ On first launch, `telecodex`:
 4. Generates a one-time bootstrap code if no Telegram admin is bound yet.
 5. Waits for that code in a private chat. The first successful sender becomes the permanent admin for this bot instance.
 
+Bootstrap codes are time-limited and attempt-limited. When a code expires or is exhausted, start telecodex again locally to issue a fresh one.
+
 There are no required environment variables in the normal startup path.
 
 Optional security override:
@@ -96,13 +123,18 @@ Optional security override:
 - The project root is bound once with `/project bind <absolute-path>`.
 - Each topic in that supergroup is one Codex thread.
 - Work happens by sending normal messages inside the topic.
+- `/thread list` shows the saved Codex threads already recorded for the bound project root or its subdirectories.
 - `/thread new <topic-name>` automatically creates a new topic; the first normal message inside it starts a fresh Codex thread.
 - `/thread resume <threadId>` automatically creates a new topic and binds it to an existing thread id.
+- On startup, telecodex probes stored topic bindings once and removes bindings whose Telegram topics no longer exist.
+- On first launch after upgrading from the old SQLite state format, telecodex imports the legacy state once and then deletes the old SQLite files (`state.sqlite` plus sidecars such as `-wal`/`-shm`).
 
 ## Stored state
 
 - Telegram bot token: stored in the system keychain when available. Plaintext local fallback is disabled by default and must be opted into explicitly.
-- Admin binding, project bindings, and topic/session state: stored in a local SQLite database under `~/.telecodex/`.
+- Codex thread history: read directly from Codex session files under `$CODEX_HOME/sessions` (or `~/.codex/sessions` by default).
+- Admin binding, project bindings, and durable Telegram topic configuration: stored as local JSON files under `~/.telecodex/state/`.
+- Legacy upgrade path: if `~/.telecodex/state.sqlite` exists from an older telecodex version, it is imported once into the JSON state files and then cleaned up together with any SQLite sidecar files that remain.
 - Runtime logs: written by `pino` to `~/.telecodex/logs/telecodex.log`.
 - Working directory: defaults to the directory where you ran `telecodex`.
 
@@ -116,12 +148,16 @@ Optional security override:
 
 - `/start` or `/help` - show the current usage model.
 - `/status` - in private chat shows global state; in a project topic shows project/thread runtime state.
+- `/admin` - in private chat, show admin binding and handoff status.
+- `/admin rebind` - in private chat, issue a time-limited handoff code for transferring control to another Telegram account.
+- `/admin cancel` - in private chat, cancel a pending admin handoff code.
 - `/project` - show the current supergroup's project binding.
 - `/project bind <absolute-path>` - bind the current supergroup to a project root.
 - `/project unbind` - remove the current supergroup's project binding.
 - `/thread` - in a topic, show the current attached thread id.
+- `/thread list` - list saved Codex threads whose working directory is inside the current project root.
 - `/thread new <topic-name>` - create a new topic for a fresh Codex thread.
-- `/thread resume <threadId>` - create a new topic and bind it to an existing Codex thread id.
+- `/thread resume <threadId>` - create a new topic and bind it to an existing saved Codex thread id from the current project.
 - Normal text in a topic - send that message to the current Codex thread.
 - `/stop` - interrupt the active SDK run.
 - `/cwd <absolute-path>` - switch the topic working directory inside the current project root.
@@ -134,7 +170,7 @@ Optional security override:
 - `/web default|disabled|cached|live` - set Codex SDK web search mode.
 - `/network on|off` - set workspace network access for Codex SDK runs.
 - `/gitcheck skip|enforce` - control Codex SDK git repository checks.
-- `/adddir list|add <absolute-path>|drop <index>|clear` - manage Codex SDK additional directories.
+- `/adddir list|add <path-inside-project>|add-external <absolute-path>|drop <index>|clear` - manage Codex SDK additional directories. `add` stays inside the project root; `add-external` is the explicit escape hatch.
 - `/schema show|set <JSON object>|clear` - manage Codex SDK output schema for the current topic.
 - `/codexconfig show|set <JSON object>|clear` - manage global non-auth Codex SDK config overrides for future runs.
 - Image messages in a topic - download the Telegram image locally and send it as SDK `local_image` input.
@@ -144,6 +180,7 @@ Optional security override:
 - Long polling is managed by `@grammyjs/runner`.
 - Streaming updates are throttled before editing Telegram messages.
 - Final answers are rendered from Markdown to Telegram-safe HTML.
-- Because the SDK run is in-process, a telecodex restart cannot resume a partially streamed Telegram turn; the topic is reset and the user is asked to resend.
+- Project-scoped path checks resolve symlinks before enforcing the root boundary, so topic cwd changes cannot escape the bound project through symlink paths.
+- Because the SDK run and pending queue are in-process, a telecodex restart cannot resume a partially streamed Telegram turn and clears queued follow-up messages.
 - Authentication and provider switching remain owned by the local Codex installation; telecodex does not manage API keys or login state.
 - Interactive terminal stdin bridging and native Codex approval UI are intentionally not part of the Telegram contract. For unattended remote work, use the topic's sandbox/approval preset deliberately.

package/dist/bot/auth.js

@@ -15,11 +15,30 @@ export function authMiddleware(input) {
             return;
         }
         const authorizedUserId = input.store.getAuthorizedUserId();
+        const binding = input.store.getBindingCodeState();
+        const messageText = ctx.message?.text?.trim();
         if (authorizedUserId != null) {
             if (authorizedUserId === userId) {
                 await next();
                 return;
             }
+            if (ctx.chat?.type === "private" && binding?.mode === "rebind" && messageText) {
+                const handled = await handleBindingCodeMessage({
+                    ctx,
+                    userId,
+                    text: messageText,
+                    binding,
+                    store: input.store,
+                    success: async () => {
+                        input.store.rebindAuthorizedUserId(userId);
+                        await ctx.reply("Admin handoff succeeded. This Telegram account is now authorized to use telecodex.");
+                    },
+                    mismatchLabel: "Admin handoff code did not match.",
+                    exhaustedLabel: "Admin handoff code exhausted its attempt limit and was invalidated. Issue a new one from the currently authorized account.",
+                });
+                if (handled)
+                    return;
+            }
             input.logger?.warn("telegram update denied because user is not authorized", {
                 chatId: ctx.chat?.id ?? null,
                 chatType: ctx.chat?.type ?? null,
@@ -30,29 +49,59 @@ export function authMiddleware(input) {
             await deny(ctx, "Unauthorized.");
             return;
         }
-        if (!input.bootstrapCode) {
-            await deny(ctx, "Authentication is not configured for this bot yet.");
+        if (!binding || binding.mode !== "bootstrap") {
+            await deny(ctx, "This bot is not initialized yet, or the binding code expired. Restart telecodex locally to issue a new binding code.");
             return;
         }
         if (ctx.chat?.type !== "private") {
             await deny(ctx, "Send the admin bootstrap code to the bot in a private chat first.");
             return;
         }
-        const messageText = ctx.message?.text?.trim();
-        if (messageText === input.bootstrapCode) {
-            const claimedUserId = input.store.claimAuthorizedUserId(userId);
-            if (claimedUserId === userId) {
-                input.onAdminBound?.(userId);
-                await ctx.reply("Admin binding succeeded. Only this Telegram account can use this bot from now on.");
-            }
-            else {
-                await deny(ctx, "An admin account has already claimed this bot.");
-            }
-            return;
+        if (messageText) {
+            const handled = await handleBindingCodeMessage({
+                ctx,
+                userId,
+                text: messageText,
+                binding,
+                store: input.store,
+                success: async () => {
+                    const claimedUserId = input.store.claimAuthorizedUserId(userId);
+                    if (claimedUserId === userId) {
+                        input.onAdminBound?.(userId);
+                        await ctx.reply("Admin binding succeeded. Only this Telegram account can use this bot from now on.");
+                        return;
+                    }
+                    await deny(ctx, "An admin account has already claimed this bot.");
+                },
+                mismatchLabel: "Binding code did not match.",
+                exhaustedLabel: "Binding code exhausted its attempt limit and was invalidated. Restart telecodex locally to issue a new one.",
+            });
+            if (handled)
+                return;
         }
         await ctx.reply("This bot is not initialized yet. Send the binding code shown in the startup logs to complete the one-time admin binding.");
     };
 }
+async function handleBindingCodeMessage(input) {
+    if (input.text === input.binding.code) {
+        await input.success();
+        return true;
+    }
+    if (input.text.startsWith("/")) {
+        return false;
+    }
+    const attempt = input.store.recordBindingCodeFailure();
+    if (!attempt) {
+        await input.ctx.reply("The binding code is no longer active. Issue a new one and try again.");
+        return true;
+    }
+    if (attempt.exhausted) {
+        await input.ctx.reply(input.exhaustedLabel);
+        return true;
+    }
+    await input.ctx.reply(`${input.mismatchLabel}\nRemaining attempts: ${attempt.remaining}`);
+    return true;
+}
 async function deny(ctx, text) {
     if (ctx.callbackQuery) {
         await ctx.answerCallbackQuery({ text, show_alert: false });

package/dist/bot/commandSupport.js

@@ -1,4 +1,4 @@
-import { statSync } from "node:fs";
+import { realpathSync, statSync } from "node:fs";
 import path from "node:path";
 import { APPROVAL_POLICIES, MODE_PRESETS, REASONING_EFFORTS, SANDBOX_MODES, } from "../config.js";
 import { makeSessionKey } from "../store/sessions.js";
@@ -47,6 +47,7 @@ export function formatHelpText(ctx, projects) {
             "/project bind <absolute-path>",
             "",
             "Then manage threads in the group:",
+            "/thread list",
             "/thread new <topic-name>",
             "/thread resume <threadId>",
             "",
@@ -56,6 +57,7 @@ export function formatHelpText(ctx, projects) {
             "/queue drop <id>",
             "/queue clear",
             "/stop",
+            "/admin",
             "",
             formatPrivateProjectSummary(projects),
         ].join("\n");
@@ -79,6 +81,7 @@ export function formatHelpText(ctx, projects) {
         "",
         "/project show the project binding",
         "/project bind <absolute-path> update the project root",
+        "/thread list show saved Codex threads already recorded for this project",
         "/thread new <topic-name> create a new topic; the first message starts a new thread",
         "/thread resume <threadId> create a topic bound to an existing thread",
         "send a normal message inside a topic to the current thread",
@@ -97,15 +100,17 @@ export function formatHelpText(ctx, projects) {
         "/web default|disabled|cached|live",
         "/network on|off",
         "/gitcheck skip|enforce",
-        "/adddir list|add|drop|clear",
+        "/adddir list|add|add-external|drop|clear",
         "/schema show|set|clear",
         "/codexconfig show|set|clear",
     ].join("\n");
 }
 export function formatPrivateStatus(store, projects) {
+    const binding = store.getBindingCodeState();
     return [
         "telecodex admin",
         `authorized telegram user id: ${store.getAuthorizedUserId() ?? "not bound"}`,
+        binding?.mode === "rebind" ? `pending handoff: active until ${binding.expiresAt}` : "pending handoff: none",
         "",
         formatPrivateProjectSummary(projects),
     ].join("\n");
@@ -132,7 +137,7 @@ export function formatProjectStatus(project) {
         "Project status",
         `project: ${project.name}`,
         `root: ${project.cwd}`,
-        "This supergroup represents one project. Use /thread new or /thread resume to create topics.",
+        "This supergroup represents one project. Use /thread list, /thread new, or /thread resume to manage topics.",
     ].join("\n");
 }
 export function ensureTopicSession(input) {
@@ -199,11 +204,12 @@ export function resolveExistingDirectory(input) {
     if (!stat.isDirectory()) {
         throw new Error(`Not a directory: ${resolved}`);
     }
-    return resolved;
+    return canonicalizeBoundaryPath(resolved);
 }
 export function assertProjectScopedPath(input, projectRoot) {
-    const resolved = path.resolve(input.trim());
-    if (!isPathWithinRoot(resolved, projectRoot)) {
+    const resolved = resolveExistingDirectory(input);
+    const canonicalRoot = resolveExistingDirectory(projectRoot);
+    if (!isPathWithinRoot(resolved, canonicalRoot)) {
         throw new Error(["Path must stay within the project root.", `project root: ${projectRoot}`, `input: ${resolved}`].join("\n"));
     }
     return resolved;
@@ -233,7 +239,16 @@ export function hasTopicContext(ctx) {
     return ctx.message?.message_thread_id != null || ctx.callbackQuery?.message?.message_thread_id != null;
 }
 export function isPathWithinRoot(candidate, root) {
-    const resolvedCandidate = path.resolve(candidate);
-    const resolvedRoot = path.resolve(root);
+    const resolvedCandidate = canonicalizeBoundaryPath(candidate);
+    const resolvedRoot = canonicalizeBoundaryPath(root);
     return resolvedCandidate === resolvedRoot || resolvedCandidate.startsWith(`${resolvedRoot}${path.sep}`);
 }
+function canonicalizeBoundaryPath(input) {
+    const resolved = path.resolve(input);
+    try {
+        return realpathSync.native(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}

package/dist/bot/createBot.js

@@ -3,12 +3,12 @@ import { MessageBuffer } from "../telegram/messageBuffer.js";
 import { authMiddleware } from "./auth.js";
 import { recoverActiveTopicSessions } from "./inputService.js";
 import { registerHandlers } from "./registerHandlers.js";
+import { cleanupMissingTopicBindings } from "./topicCleanup.js";
 export { handleUserText, refreshSessionIfActiveTurnIsStale } from "./inputService.js";
 export function wireBot(input) {
-    const { bot, config, store, projects, codex, bootstrapCode, logger, onAdminBound } = input;
+    const { bot, config, store, projects, codex, threadCatalog, bootstrapCode, logger, onAdminBound } = input;
     const buffers = new MessageBuffer(bot, config.updateIntervalMs, logger?.child("message-buffer"));
     bot.use(authMiddleware({
-        bootstrapCode,
         store,
         ...(logger ? { logger: logger.child("auth") } : {}),
         ...(onAdminBound ? { onAdminBound } : {}),
@@ -31,10 +31,23 @@ export function wireBot(input) {
         store,
         projects,
         codex,
+        threadCatalog,
         buffers,
         ...(logger ? { logger } : {}),
     });
-    void recoverActiveTopicSessions(store, codex, buffers, bot, logger);
+    void (async () => {
+        try {
+            await cleanupMissingTopicBindings({
+                bot,
+                store,
+                ...(logger ? { logger: logger.child("topic-cleanup") } : {}),
+            });
+            await recoverActiveTopicSessions(store, codex, buffers, bot, logger);
+        }
+        catch (error) {
+            logger?.error("startup topic reconciliation failed", error);
+        }
+    })();
     return {
         bot,
         buffers,

package/dist/bot/handlers/operationalHandlers.js

@@ -1,4 +1,5 @@
 import { presetFromProfile } from "../../config.js";
+import { generateBindingCode } from "../../runtime/bindingCodes.js";
 import { formatSessionRuntimeStatus } from "../../runtime/sessionRuntime.js";
 import { refreshSessionIfActiveTurnIsStale } from "../inputService.js";
 import { contextLogFields, formatHelpText, formatPrivateStatus, formatProjectStatus, formatReasoningEffort, getProjectForContext, getScopedSession, hasTopicContext, isPrivateChat, parseSubcommand, } from "../commandSupport.js";
@@ -8,6 +9,57 @@ export function registerOperationalHandlers(deps) {
     bot.command(["start", "help"], async (ctx) => {
         await ctx.reply(formatHelpText(ctx, projects));
     });
+    bot.command("admin", async (ctx) => {
+        if (!isPrivateChat(ctx)) {
+            await ctx.reply("Use /admin in the bot private chat.");
+            return;
+        }
+        const authorizedUserId = store.getAuthorizedUserId();
+        if (authorizedUserId == null) {
+            await ctx.reply("Admin binding is not completed yet.");
+            return;
+        }
+        const { command } = parseSubcommand(ctx.match.trim());
+        const binding = store.getBindingCodeState();
+        if (!command || command === "status") {
+            await ctx.reply([
+                "Admin status",
+                `authorized telegram user id: ${authorizedUserId}`,
+                binding?.mode === "rebind"
+                    ? `pending handoff: active until ${formatIsoTimestamp(binding.expiresAt)} (${binding.maxAttempts - binding.attempts} attempts remaining)`
+                    : "pending handoff: none",
+                "Usage: /admin | /admin rebind | /admin cancel",
+            ].join("\n"));
+            return;
+        }
+        if (command === "rebind") {
+            const next = store.issueBindingCode({
+                code: generateBindingCode("rebind"),
+                mode: "rebind",
+                issuedByUserId: authorizedUserId,
+            });
+            await ctx.reply([
+                "Admin handoff code created.",
+                `expires at: ${formatIsoTimestamp(next.expiresAt)}`,
+                `max failed attempts: ${next.maxAttempts}`,
+                "",
+                next.code,
+                "",
+                "Send this code from the target Telegram account in this bot's private chat to transfer control.",
+            ].join("\n"));
+            return;
+        }
+        if (command === "cancel") {
+            if (binding?.mode !== "rebind") {
+                await ctx.reply("No pending admin handoff.");
+                return;
+            }
+            store.clearBindingCode();
+            await ctx.reply("Cancelled the pending admin handoff.");
+            return;
+        }
+        await ctx.reply("Usage: /admin | /admin rebind | /admin cancel");
+    });
     bot.command("status", async (ctx) => {
         if (isPrivateChat(ctx)) {
             await ctx.reply(formatPrivateStatus(store, projects));

package/dist/bot/handlers/projectHandlers.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { contextLogFields, ensureTopicSession, formatPrivateProjectList, formatProjectStatus, formatTopicName, getProjectForContext, getScopedSession, hasTopicContext, isPrivateChat, isSupergroupChat, parseSubcommand, postTopicReadyMessage, resolveExistingDirectory, } from "../commandSupport.js";
 import { formatSessionRuntimeStatus } from "../../runtime/sessionRuntime.js";
 const PROJECT_REQUIRED_MESSAGE = "This supergroup has no project bound yet.\nRun /project bind <absolute-path> first.";
@@ -82,12 +83,17 @@ export function registerProjectHandlers(deps) {
                     `queue: ${store.getQueuedInputCount(session.sessionKey)}`,
                     `cwd: ${session.cwd}`,
                     "Manage threads in this project:",
+                    "/thread list",
                     "/thread resume <threadId>",
                     "/thread new <topic-name>",
                 ].join("\n"));
                 return;
             }
-            await ctx.reply("Usage:\n/thread resume <threadId>\n/thread new <topic-name>");
+            await ctx.reply("Usage:\n/thread list\n/thread resume <threadId>\n/thread new <topic-name>");
+            return;
+        }
+        if (command === "list") {
+            await listProjectThreads(ctx, deps);
             return;
         }
         if (command === "resume") {
@@ -102,7 +108,7 @@ export function registerProjectHandlers(deps) {
             await createFreshThreadTopic(ctx, deps, args);
             return;
         }
-        await ctx.reply("Usage:\n/thread resume <threadId>\n/thread new <topic-name>");
+        await ctx.reply("Usage:\n/thread list\n/thread resume <threadId>\n/thread new <topic-name>");
     });
     bot.on(["message:forum_topic_created", "message:forum_topic_edited"], async (ctx) => {
         const threadId = ctx.message.message_thread_id;
@@ -119,13 +125,26 @@ export function registerProjectHandlers(deps) {
     });
 }
 async function resumeThreadIntoTopic(ctx, deps, threadId) {
-    const { bot, config, store, projects, logger } = deps;
+    const { bot, config, store, projects, logger, threadCatalog } = deps;
     const project = getProjectForContext(ctx, projects);
     if (!project) {
         await ctx.reply(PROJECT_REQUIRED_MESSAGE);
         return;
     }
-    const topicName = formatTopicName(`Resumed ${threadId.slice(0, 8)}`, "Resumed Thread");
+    const thread = await threadCatalog.findProjectThreadById({
+        projectRoot: project.cwd,
+        threadId,
+    });
+    if (!thread) {
+        await ctx.reply([
+            "Could not find a saved Codex thread with that id under this project.",
+            `project root: ${project.cwd}`,
+            `thread: ${threadId}`,
+            "Run /thread list to inspect the saved project threads first.",
+        ].join("\n"));
+        return;
+    }
+    const topicName = formatTopicName(thread.preview, `Resumed ${thread.id.slice(0, 8)}`);
     const forumTopic = await bot.api.createForumTopic(ctx.chat.id, topicName);
     const session = ensureTopicSession({
         store,
@@ -134,24 +153,25 @@ async function resumeThreadIntoTopic(ctx, deps, threadId) {
         chatId: ctx.chat.id,
         messageThreadId: forumTopic.message_thread_id,
         topicName: forumTopic.name,
-        threadId,
+        threadId: thread.id,
     });
     logger?.info("thread id bound into topic", {
         ...contextLogFields(ctx),
         sessionKey: session.sessionKey,
-        threadId,
+        threadId: thread.id,
         topicName: forumTopic.name,
     });
     await ctx.reply([
         "Created a topic and bound it to the existing thread id.",
         `topic: ${forumTopic.name}`,
         `topic id: ${forumTopic.message_thread_id}`,
-        `thread: ${threadId}`,
+        `thread: ${thread.id}`,
+        `cwd: ${thread.cwd}`,
         "Future messages in this topic will continue on that thread through the Codex SDK.",
     ].join("\n"));
     await postTopicReadyMessage(bot, session, [
         "This topic is now bound to an existing Codex thread id.",
-        `thread: ${threadId}`,
+        `thread: ${thread.id}`,
         "Send a message to continue.",
     ].join("\n"));
 }
@@ -190,3 +210,42 @@ async function createFreshThreadTopic(ctx, deps, requestedName) {
         `model: ${session.model}`,
     ].join("\n"));
 }
+async function listProjectThreads(ctx, deps) {
+    const { projects, store, threadCatalog } = deps;
+    const project = getProjectForContext(ctx, projects);
+    if (!project) {
+        await ctx.reply(PROJECT_REQUIRED_MESSAGE);
+        return;
+    }
+    const threads = await threadCatalog.listProjectThreads({
+        projectRoot: project.cwd,
+        limit: 8,
+    });
+    if (threads.length === 0) {
+        await ctx.reply([
+            "No saved Codex threads were found for this project yet.",
+            `project root: ${project.cwd}`,
+        ].join("\n"));
+        return;
+    }
+    const lines = [
+        `Saved Codex threads for ${project.name}:`,
+        ...threads.flatMap((thread, index) => {
+            const relativeCwd = path.relative(project.cwd, thread.cwd) || ".";
+            const bound = store.getByThreadId(thread.id);
+            return [
+                `${index + 1}. ${thread.preview}`,
+                `   id: ${thread.id}`,
+                `   cwd: ${relativeCwd}`,
+                `   updated: ${thread.updatedAt}`,
+                `   source: ${thread.source ?? "unknown"}`,
+                ...(bound
+                    ? [`   bound: ${bound.telegramTopicName ?? bound.messageThreadId ?? bound.sessionKey}`]
+                    : []),
+            ];
+        }),
+        "",
+        "Resume one with /thread resume <threadId>",
+    ];
+    await ctx.reply(lines.join("\n"));
+}

package/dist/bot/handlers/sessionConfigHandlers.js

@@ -177,28 +177,29 @@ export function registerSessionConfigHandlers(deps) {
         await ctx.reply(`Set git repo check: ${value}`);
     });
     bot.command("adddir", async (ctx) => {
+        const project = getProjectForContext(ctx, projects);
         const session = getScopedSession(ctx, store, projects, config);
-        if (!session)
+        if (!project || !session)
             return;
         const [command, ...rest] = ctx.match.trim().split(/\s+/).filter(Boolean);
         const args = rest.join(" ");
         if (!command || command === "list") {
             await ctx.reply(session.additionalDirectories.length === 0
-                ? "additional directories: none\nUsage: /adddir add <absolute-path> | /adddir drop <index> | /adddir clear"
+                ? "additional directories: none\nUsage: /adddir add <path-inside-project> | /adddir add-external <absolute-path> | /adddir drop <index> | /adddir clear"
                 : [
                     "additional directories:",
                     ...session.additionalDirectories.map((directory, index) => `${index + 1}. ${directory}`),
-                    "Usage: /adddir add <absolute-path> | /adddir drop <index> | /adddir clear",
+                    "Usage: /adddir add <path-inside-project> | /adddir add-external <absolute-path> | /adddir drop <index> | /adddir clear",
                 ].join("\n"));
             return;
         }
         if (command === "add") {
             if (!args) {
-                await ctx.reply("Usage: /adddir add <absolute-path>");
+                await ctx.reply("Usage: /adddir add <path-inside-project>");
                 return;
             }
             try {
-                const directory = resolveExistingDirectory(args);
+                const directory = assertProjectScopedPath(args, project.cwd);
                 const next = [...session.additionalDirectories.filter((entry) => entry !== directory), directory];
                 store.setAdditionalDirectories(session.sessionKey, next);
                 await ctx.reply(`Added additional directory:\n${directory}`);
@@ -208,6 +209,26 @@ export function registerSessionConfigHandlers(deps) {
             }
             return;
         }
+        if (command === "add-external") {
+            if (!args) {
+                await ctx.reply("Usage: /adddir add-external <absolute-path>");
+                return;
+            }
+            try {
+                const directory = resolveExistingDirectory(args);
+                const next = [...session.additionalDirectories.filter((entry) => entry !== directory), directory];
+                store.setAdditionalDirectories(session.sessionKey, next);
+                await ctx.reply([
+                    "Added external additional directory outside the project root.",
+                    directory,
+                    "Codex can now read files there during future runs.",
+                ].join("\n"));
+            }
+            catch (error) {
+                await ctx.reply(error instanceof Error ? error.message : String(error));
+            }
+            return;
+        }
         if (command === "drop") {
             const index = Number(args);
             if (!Number.isInteger(index) || index <= 0 || index > session.additionalDirectories.length) {
@@ -224,7 +245,7 @@ export function registerSessionConfigHandlers(deps) {
             await ctx.reply("Cleared additional directories.");
             return;
         }
-        await ctx.reply("Usage: /adddir list | /adddir add <absolute-path> | /adddir drop <index> | /adddir clear");
+        await ctx.reply("Usage: /adddir list | /adddir add <path-inside-project> | /adddir add-external <absolute-path> | /adddir drop <index> | /adddir clear");
     });
     bot.command("schema", async (ctx) => {
         const session = getScopedSession(ctx, store, projects, config);