Release: tool permission system + webui refont + TON tx confirmations

.github/workflows/ci.yml

@@ -2,33 +2,36 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
   pull_request:
     branches: [main]
 
-jobs:
-  build:
-    runs-on: ubuntu-latest
+# Cancel superseded runs on the same ref (rapid pushes / PR force-pushes).
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 
-    strategy:
-      matrix:
-        node-version: [20, 22]
+# Least privilege. The notify job authenticates to Telegram via its own secrets,
+# not GITHUB_TOKEN, so read-only repo access is enough everywhere.
+permissions:
+  contents: read
 
+jobs:
+  # Node-version-independent static analysis — run once, not per matrix entry.
+  checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: 20
           cache: npm
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Install WebUI dependencies
-        run: cd web && npm ci
-
       - name: Build SDK workspace
         run: npm run build -w packages/sdk
 
@@ -50,14 +53,128 @@ jobs:
       - name: Duplicate code check
         run: npm run dupcheck
 
+      - name: Security audit
+        run: npm run audit:ci
+
+  # Build + test on each supported Node version.
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    strategy:
+      matrix:
+        node-version: [20, 22]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            web/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install WebUI dependencies
+        run: cd web && npm ci
+
+      - name: Build SDK workspace
+        run: npm run build -w packages/sdk
+
       - name: Build
         run: npm run build
 
       - name: Test with coverage
         run: npm run test:coverage
 
-      - name: Security audit
-        run: npm run audit:ci
-
       - name: CLI smoke test
         run: node dist/cli/index.js --help
+
+  # ---- Telegram notification (after the full CI passes, pushes only) ----
+  # dev  : one message PER COMMIT, prefixed [DEV], paced 1/sec.
+  # main : one clean summary of how many stable commits were merged.
+  # Both walk the push range (before..after), not just the HEAD commit.
+  notify:
+    needs: [checks, test]
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Notify Telegram
+        env:
+          TG_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          TG_CHAT: ${{ secrets.TELEGRAM_CHAT_ID }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.ref_name }}
+          BEFORE: ${{ github.event.before }}
+          AFTER: ${{ github.sha }}
+        run: |
+          set -uo pipefail
+          ZERO=0000000000000000000000000000000000000000
+
+          # Resolve the commits in this push, oldest -> newest (merge commits excluded).
+          # Fallbacks (first push / force-push / unknown before) -> HEAD only.
+          if [ "$BEFORE" = "$ZERO" ] \
+             || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null \
+             || ! git merge-base --is-ancestor "$BEFORE" "$AFTER" 2>/dev/null; then
+            SHAS=$(git log -1 --format=%H "$AFTER")
+            RANGE_OK=0
+          else
+            SHAS=$(git log --reverse --no-merges --format=%H "${BEFORE}..${AFTER}")
+            RANGE_OK=1
+          fi
+
+          COUNT=$(printf '%s\n' "$SHAS" | grep -c . || true)
+          if [ "$COUNT" -eq 0 ]; then echo "Nothing to notify"; exit 0; fi
+
+          esc() { printf '%s' "$1" | sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g'; }
+          # Send one message, retrying until Telegram accepts it. IMPORTANT: no
+          # curl --fail here — on a 429 we must READ the body to get retry_after;
+          # --fail discards it, which silently drops rate-limited messages.
+          send() {
+            local text="$1" attempt resp ra
+            for attempt in 1 2 3 4 5 6; do
+              resp=$(curl -sS -m 25 -X POST "https://api.telegram.org/bot${TG_TOKEN}/sendMessage" \
+                -d chat_id="${TG_CHAT}" -d parse_mode=HTML -d disable_web_page_preview=true \
+                --data-urlencode "text=${text}" 2>/dev/null || true)
+              case "$resp" in
+                *'"ok":true'*) return 0 ;;
+              esac
+              # 429 -> honor retry_after; other transient error -> small backoff.
+              ra=$(printf '%s' "$resp" | grep -o '"retry_after":[0-9]*' | grep -o '[0-9]*' || true)
+              sleep "$(( ${ra:-2} + 1 ))"
+            done
+            echo "WARN: gave up sending after retries: ${text%%$'\n'*}"
+            return 1
+          }
+
+          if [ "$BRANCH" = "main" ]; then
+            # Clean summary: number of stable commits merged to main.
+            noun="commits"; [ "$COUNT" -eq 1 ] && noun="commit"
+            if [ "$RANGE_OK" = 1 ]; then
+              link="https://github.com/${REPO}/compare/${BEFORE}...${AFTER}"
+            else
+              link="https://github.com/${REPO}/commit/${AFTER}"
+            fi
+            send "🟢 <b>${COUNT}</b> stable ${noun} merged to <b>main</b>"$'\n'"<a href=\"${link}\">View changes</a>"
+          else
+            # Per-commit feed for dev (and any other non-main branch), [DEV] prefixed.
+            tag="[${BRANCH^^}]"
+            if [ "$COUNT" -gt 1 ]; then
+              send "📦 <b>${COUNT}</b> commits pushed to <b>${BRANCH}</b>"
+              sleep 1
+            fi
+            for sha in $SHAS; do
+              title=$(esc "$(git log -1 --format=%s "$sha")")
+              url="https://github.com/${REPO}/commit/${sha}"
+              send "${tag} <b>${title}</b>"$'\n'"<a href=\"${url}\">${sha:0:7}</a>"
+              sleep 1
+            done
+          fi

.github/workflows/release.yml

@@ -4,21 +4,25 @@ on:
   push:
     tags: ["v*"]
 
+# Least privilege by default; jobs opt into the extra scopes they need.
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   # ---- Build & Verify ----
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
           node-version: 20
           cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            web/package-lock.json
 
       - run: npm ci
       - run: cd web && npm ci
@@ -39,6 +43,10 @@ jobs:
   publish-npm:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write # npm provenance
     steps:
       - uses: actions/checkout@v4
 
@@ -47,6 +55,9 @@ jobs:
           node-version: 20
           registry-url: https://registry.npmjs.org
           cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            web/package-lock.json
 
       - name: Check if version already published
         id: check
@@ -71,7 +82,7 @@ jobs:
           name: dist
           path: dist/
 
-      - run: npm publish --access public
+      - run: npm publish --provenance --access public
         if: steps.check.outputs.publish == 'true'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -80,6 +91,10 @@ jobs:
   publish-sdk:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write # npm provenance
     steps:
       - uses: actions/checkout@v4
 
@@ -108,14 +123,18 @@ jobs:
 
       - name: Build and publish SDK
         if: steps.check.outputs.publish == 'true'
-        run: npm run build -w packages/sdk && cd packages/sdk && npm publish --access public
+        run: npm run build -w packages/sdk && cd packages/sdk && npm publish --provenance --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # ---- Publish Docker image ----
   publish-docker:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write # push to ghcr.io
     steps:
       - uses: actions/checkout@v4
 
@@ -137,6 +156,8 @@ jobs:
         with:
           context: .
           push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           tags: |
             ghcr.io/${{ steps.meta.outputs.repo }}:${{ steps.meta.outputs.version }}
             ghcr.io/${{ steps.meta.outputs.repo }}:latest
@@ -145,6 +166,9 @@ jobs:
   create-release:
     needs: [publish-npm]
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write # create the GitHub release
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/telegram-notify.yml

@@ -2,46 +2,13 @@ name: Telegram Notify
 
 on:
   workflow_run:
-    workflows: ["CI", "Release"]
+    workflows: ["Release"]
     types: [completed]
 
-jobs:
-  # ---- Commit notification (only after CI passes) ----
-  commit:
-    if: >-
-      github.event.workflow_run.name == 'CI'
-      && github.event.workflow_run.conclusion == 'success'
-      && github.event.workflow_run.head_branch == 'main'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Build message file
-        env:
-          FULL: ${{ github.event.workflow_run.head_commit.message }}
-          COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
-          REPO: ${{ github.repository }}
-        run: |
-          TITLE=$(echo "$FULL" | head -1)
-          BODY=$(echo "$FULL" | tail -n +3)
-          COMMIT_URL="https://github.com/${REPO}/commit/${COMMIT_SHA}"
-          {
-            echo "<b>${TITLE}</b>"
-            if [ -n "$BODY" ]; then
-              echo ""
-              echo "$BODY"
-            fi
-            echo ""
-            echo "<a href=\"${COMMIT_URL}\">View commit</a>"
-          } > "$GITHUB_WORKSPACE/.tg_message.txt"
-
-      - name: Send commit to Telegram
-        uses: appleboy/telegram-action@master
-        with:
-          to: ${{ secrets.TELEGRAM_CHAT_ID }}
-          token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          format: html
-          disable_web_page_preview: true
-          message_file: .tg_message.txt
+permissions:
+  contents: read
 
+jobs:
   # ---- Release notification (only after Release workflow passes) ----
   release:
     if: >-
@@ -68,7 +35,7 @@ jobs:
 
       - name: Send release to Telegram
         if: steps.ver.outputs.found == 'true'
-        uses: appleboy/telegram-action@master
+        uses: appleboy/telegram-action@v1.0.1
         with:
           to: ${{ secrets.TELEGRAM_CHAT_ID }}
           token: ${{ secrets.TELEGRAM_BOT_TOKEN }}

.gitignore

@@ -36,3 +36,6 @@ TODOS/
 # TTS voice models (large binaries)
 piper-voices/
 
+
+# Claude Code session logs
+.claude-session/

README.md

@@ -85,7 +85,7 @@
 ## Prerequisites
 
 - **Node.js 20.0.0+** - [Download](https://nodejs.org/)
-- **LLM API Key** - One of: [Anthropic](https://console.anthropic.com/) (recommended), [OpenAI](https://platform.openai.com/), [Google](https://aistudio.google.com/), [xAI](https://console.x.ai/), [Groq](https://console.groq.com/), [OpenRouter](https://openrouter.ai/), [Moonshot](https://platform.moonshot.ai/), [Mistral](https://console.mistral.ai/), [Cerebras](https://cloud.cerebras.ai/), [ZAI](https://open.bigmodel.cn/), [MiniMax](https://platform.minimaxi.com/), [Hugging Face](https://huggingface.co/settings/tokens) — or keyless: Claude Code (auto-detect), Cocoon (TON), Local (Ollama/vLLM)
+- **LLM API Key** - One of: [Anthropic](https://console.anthropic.com/) (recommended), [OpenAI](https://platform.openai.com/), [Google](https://aistudio.google.com/), [xAI](https://console.x.ai/), [Groq](https://console.groq.com/), [OpenRouter](https://openrouter.ai/), [Moonshot](https://platform.moonshot.ai/), [Mistral](https://console.mistral.ai/), [Cerebras](https://cloud.cerebras.ai/), [ZAI](https://open.bigmodel.cn/), [MiniMax](https://platform.minimaxi.com/), [Hugging Face](https://huggingface.co/settings/tokens) — or keyless: Codex (auto-detect), Cocoon (TON), Local (Ollama/vLLM)
 - **Telegram Account** - Dedicated account recommended for security
 - **Telegram API Credentials** - From [my.telegram.org/apps](https://my.telegram.org/apps)
 - **Your Telegram User ID** - Message [@userinfobot](https://t.me/userinfobot)
@@ -172,7 +172,7 @@ The `teleton setup` wizard generates a fully configured `~/.teleton/config.yaml`
 
 ```yaml
 agent:
-  provider: "anthropic"              # anthropic | claude-code | openai | google | xai | groq | openrouter | moonshot | mistral | cerebras | zai | minimax | huggingface | cocoon | local
+  provider: "anthropic"              # anthropic | openai | google | xai | groq | openrouter | moonshot | mistral | cerebras | zai | minimax | huggingface | cocoon | local
   api_key: "sk-ant-api03-..."
   model: "claude-haiku-4-5-20251001"
   utility_model: "claude-haiku-4-5-20251001"  # for summarization, compaction, vision
@@ -219,7 +219,7 @@ ton_proxy:                   # Optional: .ton domain proxy
 <table>
 <tr>
 <td align="center" width="20%"><br><b>Anthropic</b><br>Claude Opus 4.6<br><br></td>
-<td align="center" width="20%"><br><b>Claude Code</b><br>Auto-detected<br><br></td>
+<td align="center" width="20%"><br><b>Codex</b><br>Auto-detected<br><br></td>
 <td align="center" width="20%"><br><b>OpenAI</b><br>GPT-5<br><br></td>
 <td align="center" width="20%"><br><b>Google</b><br>Gemini 3 Pro<br><br></td>
 <td align="center" width="20%"><br><b>xAI</b><br>Grok 4.1<br><br></td>
@@ -475,7 +475,7 @@ The SDK provides namespaced access to core services:
 
 | Layer | Technology |
 |-------|------------|
-| LLM | Multi-provider via [pi-ai](https://github.com/mariozechner/pi-ai) (15 providers: Anthropic, Claude Code, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cerebras, ZAI, MiniMax, Hugging Face, Cocoon, Local) |
+| LLM | Multi-provider via [pi-ai](https://github.com/mariozechner/pi-ai) (15 providers: Anthropic, Codex, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cerebras, ZAI, MiniMax, Hugging Face, Cocoon, Local) |
 | Telegram Userbot | [GramJS](https://gram.js.org/) Layer 223 fork (MTProto) |
 | Inline Bot | [Grammy](https://grammy.dev/) (Bot API, for deals) |
 | Blockchain | [TON SDK](https://github.com/ton-org/ton) (W5R1 wallet) |