[futurepaul]

Stacked on #807 (page secrets). The Telegram connector: templates/telegram, a blessed chat that is also its owner's direct messages with a bot of their own. It's an ordinary connector fragment built only from the generic pieces below it.

Reworked after the security review and Alex's review. Only the owner's words count as the owner's. telegram is a connector (blessed::CONNECTORS), so under #804's rule no one but its owner edits a Telegram chat. Its agent, acting for its owner or as an editor member, can't set its webhook secret (path a), push code to rewrite its pairing (path b), or write a page on its origin (path c), and a fork makes it no door for good.

How it works

• Setup (the owner, on its page):
  • The bot's token is pasted, and a webhook secret is made by the browser. Each is set as this fragment's secret toward api.telegram.org (__secrets; never through its code or a model).
  • connect checks the token (getMe) and points the bot's webhook at the chat's inbox (setWebhook, with the secret as its secret_token), both filled into the URL at the egress point.
  • The inbox takes a delivery only with that secret in Telegram's header (inbox), so no member can forge one.
• Pairing (browser confirmation):
  • A single-use /start <nonce> link, good for ten minutes. The account that answers it is proposed.
  • The owner confirms it on the page (confirm, an owner's operation an agent can't call, whomever it acts for).
  • Its numeric user and chat ids are bound; its name is only shown. Another bot's token forgets the account.
  • Members can read the inbox's records, so one could race the owner's own /start with an account of its choosing. When two accounts answer one link, nobody is proposed and the owner pairs again.
• The door: the owner links it to their agent on the page (__door, A connector its owner alone edits, bound by them as their agent's door #804).
  • intake (its inbox's trigger alone; a direct call is refused) publishes each DM from the paired account as their words to their agent.
  • mirror sends each reply the agent posts back to Telegram, in at most four messages.
  • It publishes what job.door says, to the bound agent; no guessing among members (Alex's second point).
  • mirror sends only the bound agent's replies (record.principal === job.door.to); another agent's in the chat stay there (re-review, leftover 4).
  • The agent joins as a viewer. The template's work takes viewer posts, and a reply whose file a viewer can't upload goes with its words, saying so (the bridge used to drop the whole reply).
  • Strangers, groups, bots and repeated updates reach no one. Unlinked or turned off, nothing is relayed or sent; unlinked, Telegram is told, and the agent stays a viewer of the chat.
• Labels (Paul, 10-31): both connectors are tagged "Experimental". SimpleX is tagged "Secure" (end to end, to the computer) in Settings, and Telegram "Less secure" on its page; that tag's tooltip says the literal reason, that Telegram's servers can read these messages. These are short tags under the heading, with no new paragraph; the page's old encryption sentence went, since the tag now says it. The Settings heading stays plain because the nav copies its text.
• Plaintext: the template's description says Telegram messages aren't end-to-end encrypted. Direct messages and text only for now; a reply's files are named, not sent. Topics later: each connector chat is its own door.
• The page is the chat's (its files linked, as the brain links the notes viewer), with a compact setup card above it, for the owner only.

Tests

• A Bot API fake (crates/fakes/src/telegram.rs).
• The computers lane runs it end to end on the stub agent:
  • connect, then pairing, including two accounts racing one link, a wrong nonce, a stranger's confirm, and a used link;
  • a forged delivery (403), and the owner's rotation of the webhook secret (the old one refused, the new one taken);
  • the binding, with the agent a viewer;
  • a DM reaching the agent asked as its owner (turn.start.asker), to it, through the telegram door, and the reply arriving at the fake;
  • interim words not sent, and a file named;
  • a stranger and a duplicate update;
  • the agent, for its owner, refused the secret, a page, a code token, seen and propose; no one made an editor of it (400), and the agent, as itself, refused the secret;
  • the agent, for its owner, refused visibility, an invite and the share link (rotation, and none shown in status), while on another fragment of its owner's it does all four (A connector its owner alone edits, bound by them as their agent's door #804's sharing rule);
  • Telegram off by policy: nothing published or sent;
  • an unlink from the page session (__door), after which the agent's web reply isn't sent;
  • a fork, then the template again: no door, and a DM is published nowhere.
• The labels: the shell lane checks Settings' SimpleX tags (and that its nav link still reads "SimpleX"); the templates lane opens the Telegram page in Chrome as its owner and checks its tags and tooltip.
• The templates crate holds it to the blessed rules, and the docs list it.

On by default (Paul, 10-31): telegram is in the deployment's default connectors beside simplex. A deployment that wants it off names connectors without it, and org policy will narrow it per org. #709's check of a connector the deployment doesn't name uses signal now.

Not yet: a real bot. No real Telegram bot was created or messaged; that needs the coordinator's say-so, then a preview check.

Complexity: +1024 / −21 (without docs, e2e and the fake: +593 / −14). The template (manifest, app, setup page) is most of it; the platform adds only its name to the blessed list, and the shell two tags.

🤖 Generated with Claude Code

[alexlwn123]

Fail for now at f6a6929a1d79c81684be11211d25ee23729ae188, reviewing this layer against #807 at 51691138de1b1c37434fb91eecd88de5790efac8.

The connector fits the intended template boundary, but two flows violate its identity/routing contract.

Blocking:

1. An editor can substitute the pairing candidate by suppressing the authentic update. templates/telegram/fragment.json exposes propose and seen as ordinary editor mutations; neither checks its caller (app.mjs:143–175). An editor (including an agent member) can read the incoming /start nonce and update id from inbox, call seen before the asynchronous intake reaches that step, then call propose with their own user/chat ids and the owner's display name. Intake now returns “taken already,” so the claimed two-account conflict protection never runs. The page displays only the supplied name, and the owner's normal confirmation binds the attacker's account, whose later DMs speak as the owner. Direct seen calls also let editors suppress ordinary incoming messages. Restrict both state transitions to authenticated connector-internal processing, rather than trusting possession of a readable nonce or an editor role. Test direct editor and agent calls, including this interleaving with the genuine /start; keep genuine duplicate delivery coverage.

2. Linking another agent does not change the selected recipient. door() (templates/telegram/app.mjs:56–63) chooses the first owner-owned agent in membership order rather than the actual door binding. Link A, unlink, then link B using the setup page: bind_door retains A's membership and adds B, so door() still selects A. The platform correctly rejects the resulting relayed.agent mismatch; intake swallows it as “not linked” and drops the DM even though B is linked. This also affects an initial binding to a non-first agent in a chat with multiple agents. Resolve the authoritative bound agent and test both cases, including delivery of the DM and its reply.

Validation: reproduced both template paths on pinned Node 24.22.1 with disposable in-memory SQLite and mocked job capabilities (the second fixture enforces the platform's binding check). These are focused reproductions, not full workerd/e2e runs. CI check and images check pass; e2e shards and real-Hermes Docker are still pending. No real Telegram bot was used. The prescribed external engineering-style file was unavailable on this machine.

Complexity pass: the template, shared chat assets, fake, and integration coverage are proportionate; these fixes belong at the existing trust and binding boundaries.

[futurepaul]

Both fixed:

1. seen/propose substitution. Under A connector its owner alone edits, bound by them as their agent's door #804's rework, no one but its owner edits a connector, so the agent (for its owner, or as an editor member) can't call seen or propose. The lane checks both refusals. The two-account conflict stays for the remaining case, a member who reads the owner's own /start nonce.
2. Recipient selection. door() is gone. The platform tells the job its binding (job.door: the relayed and the agent's identity), and intake publishes that, to the bound agent. Rebinding to another agent changes job.door.

Also from the security review:

• mirror stops while unlinked;
• seen clears on a bot change;
• work lists outcome;
• the lane asserts the DM's turn is asked as the owner, and covers the policy fence, interim words, __door from the page session, a fork, and rotation.

🤖 Generated with Claude Code

[alexlwn123]

Pass for this stack layer at 6fdba2610b82b9423309fdfbf3762ac309f2c770, against #807 at 47e5b46c30ebb69b2d46ef89a9783c911db0357d.

Both earlier blockers are fixed. Registering Telegram in blessed::CONNECTORS activates the platform's owner-only editing boundary, so other members and agents (including agents acting for the owner) cannot call seen/propose or replace its secrets/code/pages. Intake now publishes the authoritative job.door.relayed and addresses job.door.to, removing membership-order routing. The added integration checks exercise mutation refusals and verify the relayed owner and recipient.

The connector stays within the template boundary, reuses the chat assets, and the bridge's attachment-refusal fallback preserves the reply's words. The implementation and integration coverage are proportionate; I found no blocking regression in this layer.

Validation: cargo test -p fragment-core connectors:: --quiet passed (2 tests). CI check and images check pass; e2e shards and real-Hermes Docker remain pending. Earlier duplicate-run cancellations are not demonstrated code failures. I did not run local workerd/e2e or use a real Telegram bot. The prescribed external engineering-style file is unavailable on this machine.

Non-blocking: add the earlier A → unlink → B and initial non-first-agent cases to the integration lane. The source now uses the correct binding, but the new single-agent assertion does not directly preserve those regression scenarios.

[alexlwn123]

Pass for this stack layer at 43f2c38488b16dc60c8dfc3a518904e46d6bcbb9, against #807 at 88482d2c239c1ecd775b3e4426aa2698bf269536.

Both original blockers remain fixed: connector editing is owner-only, and intake uses the authoritative door binding. Since my previous approval, mirror now checks the posting principal against job.door.to, so another agent's replies stay in the chat. The updated integration assertions match the inherited viewer-only membership rule. This is a small, appropriate correction at the existing boundary; I found no new blocking regression.

Validation: traced the binding identity and channel-record principal through the platform; a focused fixture on pinned Node 24.22.1 passed for the bound reply, another agent's reply, unlink, direct invocation, and interim reply. This used mocked job capabilities, not workerd. Current CI checks, e2e shards, and real-Hermes Docker are still running; the older duplicate run was cancelled. No local full e2e or real Telegram bot test was run. The prescribed external engineering-style file remains unavailable on this machine.

Non-blocking: retain the earlier request for integration coverage of A → unlink → B and initial non-first-agent binding, including suppression of the other agent's reply. The source uses the correct identity, but the single-agent lane does not preserve those scenarios directly.

[alexlwn123]

Pass for this stack layer at a04de83cfaeb30e4ad46e99b606e26d4bbdf5b90, against #807 at 27241fa2efbb81552f42d7ab1275ba0286ace0a1.

The earlier identity and routing blockers remain fixed. Since my last approval, this layer adds sharing-permission probes: agents cannot change connector visibility, invite, rotate its share link, or retrieve it, while sharing their owner's ordinary fragment still works. The ordinary-fragment comparison now uses a separate fixture, preserving the lane chat's existing share link for later checks. The small extension to the existing scripted probes is proportionate; I found no new blocking regression.

Validation: cargo check -p fragment-e2e --quiet and git diff --check against the stack base passed. Traced the probes through the sharing guard and status response. Active CI checks, e2e shards and real-Hermes Docker remain pending; the apparent failures in run 41195514941 are cancelled jobs in a cancelled duplicate run, not demonstrated code failures. No local full workerd/e2e or real Telegram bot test was run. The prescribed external engineering-style file is unavailable on this machine.

Non-blocking: the previously requested A → unlink → B and initial non-first-agent integration cases remain useful follow-up coverage, including suppression of the other agent's reply.

[alexlwn123]

Pass for this stack layer at 886a205558db17f2e69a9ce4a36a6827debfd3df, against #807 at 27241fa2efbb81552f42d7ab1275ba0286ace0a1.

The earlier identity and routing blockers remain fixed. Since my previous approval, this adds Experimental/security labels and browser assertions. The Telegram labels cover its setup states and linked state; the SimpleX tags leave the navigation heading unchanged. The small shared heading/tag helpers are proportionate, and I found no new blocking regression.

Validation: cargo check -p fragment-e2e --quiet and git diff --check against the stack base passed. CI check fails because master now requires step Fragment 4 search_forget 06450019092243ac; this layer's migration tree is unchanged from #807, so that failure is inherited and the stack needs updating before merge. Other CI/e2e/image checks remain pending. I did not run local full workerd/browser e2e or use a real Telegram bot. The prescribed external engineering-style file is unavailable on this machine.

Non-blocking: the previously requested A → unlink → B and initial non-first-agent integration cases remain useful follow-up coverage, including suppression of the other agent's reply.

[alexlwn123]

Fail for now at 12a9c651336e0b9c0d4449c1e53644853f4889a0, reviewing this stack layer against #807 at a94281ee3bceb654ece68a0caecc860b23ec21a9.

The earlier identity and routing blockers remain fixed. All ten patches match the previously approved layer (git range-diff), but the rebase introduces a shared-asset integration failure.

Blocking:

1. The Telegram page cannot initialize because control.js is missing. templates/telegram/site/chat.js links to the shared chat module, which now imports ./control.js (line 52). Telegram's site has no such file/link. The release builder indexes only files present under each template, and blessed::site_file resolves within that template; it does not inherit the chat template's other files. Opening a fresh Telegram page therefore fails module loading at /control.js. The inline module at templates/telegram/site/index.html:60–64 never executes either mount(document.body) or setup(document.body), breaking both chat and bot setup in normal use.

Include the shared control.js in Telegram's release assets (as with its other shared modules), and check the complete relative-import closure, excluding platform-provided modules such as __fragment.js and __markdown.js. A browser check should assert successful chat/setup initialization, not just static labels.

Validation: a local import/file check identified the missing ./control.js; traced release indexing and serving through crates/templates/build.rs, blessed::site_file, and cell/src/serve.rs. cargo test -p fragment-core connectors:: --quiet passed (2 tests), cargo check -p fragment-e2e --quiet passed, and the layer's git diff --check passed. CI check and images check pass; e2e shards and real-Hermes Docker remain pending. No local full workerd/browser e2e or real Telegram bot test was run. The prescribed external engineering-style file is unavailable on this machine.

Complexity pass: the existing shared-module approach remains proportionate; this needs its missing dependency packaged, not a new abstraction.

[alexlwn123]

Fail for now at 5426d4db810df6d7984515d7ca80e7ef62a2c109.

The previous missing-asset blocker remains unfixed. All ten PR patches match the last reviewed head in git range-diff; this rebase does not add the missing dependency. The earlier identity and routing fixes remain unchanged.

Blocking:

1. Telegram's page still cannot initialize. templates/telegram/site/chat.js:52 (the shared chat module) imports ./control.js, but templates/telegram/site/ contains no such file or link. The release builder indexes each template's files, and blessed::site_file resolves only within that template. A fresh Telegram page therefore cannot load its module graph; neither mount nor setup in templates/telegram/site/index.html:60–64 executes, breaking chat and bot setup.

Package the shared control.js alongside Telegram's other shared modules. Check the relative-import closure (excluding platform-provided modules), and assert successful chat/setup initialization in the browser test.

Validation: the local relative-import/file check reproduces the missing dependency; traced release indexing and serving through crates/templates/build.rs, blessed::site_file, and cell/src/serve.rs. git diff --check passes. CI check, images check, and real-Hermes Docker were pending; e2e build/shards were skipped. No local full workerd/browser e2e or real Telegram bot test was run. The prescribed external engineering-style file is unavailable on this machine.

Complexity pass: the shared-module approach remains proportionate; the correction is to package its dependency.

[futurepaul]

Thanks. Fixed at fa644f8, with master merged in (no force-push).

1. control.js is missing. It's linked now (templates/telegram/site/control.js -> ../../chat/site/control.js), as Telegram's other shared chat modules are (2d12456).

The relative-import closure. crates/templates/tests/page_imports.rs (every_module_a_page_imports_is_its_own) reads every .js, .mjs and .html file under each template's site/, and requires each relative import to name a file that template serves. Platform modules (__fragment.js, __markdown.js) are skipped.

• Every file is checked, including linked ones, so this covers the whole closure: control.js's own imports are checked too, now that it's one of Telegram's files.
• Without the link it fails with telegram/site/chat.js imports ./control.js, which telegram does not serve: link it. With the link it passes, and every other template passes too.
• It lives in tests/ because xtask's eval-sinks pass reads src/ as runtime code, and it flags the import( patterns the test searches for.

The browser check proves the page starts (fa644f8). The templates lane opens a fresh Telegram connector as its owner. It now waits for:

• the chat to be live: #say data-ready="1" and the composer enabled;
• the still-loading line to be gone;
• the setup card to be drawn from state ("Connect Telegram", with its two tags).

With control.js missing, this is the check CI failed ([null]).

Master merge. Master rewrote docs/api.md, docs/bridge.md and docs/computers.md. I kept its text and re-applied this PR's three facts:

• telegram is in the blessed list;
• telegram is in the default connectors;
• a refused upload sends the reply's words alone.

Validation on the exact heads:

• cargo xtask check passes.
• The release Wasm is 6,473,165 bytes, within the 6,500,000 budget. Master alone builds at 6,484,317, so this PR adds nothing measurable.
• e2e --only computers,templates passes 333/0 at 2d12456. After the e2e-only change, --only templates passes 57/0 at fa644f8.
• The shell-ui SimpleX tag check passed in CI on the previous head; locally the lane stalls from this box's IPv6 network changes (ci: e2e shards give new links no IPv6, so Chrome sees no network change (the module stalls) #796).

Non-blocking: the A → unlink → B and first-binding-to-a-non-first-agent cases are now #875, so they aren't lost.

[alexlwn123]

Pass at fa644f84d5fcf024559397cafdcb35584059868d.

The previous missing-asset blocker is fixed: Telegram now packages the shared control.js through the existing symlink/release-index path. The new import check passes, and the browser assertion now requires the chat's ready composer, enabled input, removed loading notice, and rendered setup. The earlier identity and routing fixes remain unchanged. I found no new blocking regression after the merge from master.

The correction is proportionate: one shared asset link and focused regression coverage, without new runtime machinery.

Validation: cargo test -p fragment-templates --test page_imports --quiet, cargo check -p fragment-e2e --quiet, and git diff --check against the master merge base passed. CI images check passes; main check and real-Hermes Docker are pending, and e2e build/shards were skipped. I did not run local workerd/browser e2e or use a real Telegram bot. The prescribed external engineering-style file is unavailable on this machine.

Non-blocking: the previously requested A → unlink → B and initial non-first-agent integration cases remain useful follow-up coverage, including suppression of the other agent's reply.