54 lines
3.1 KiB
Markdown
54 lines
3.1 KiB
Markdown
# Iteration 3 Results — 2026-05-28 (FR-2 plumbing)
|
|
|
|
## Shipped this iteration
|
|
|
|
### FR-2 · Telegram outbound digest (server-side plumbing)
|
|
**Files:**
|
|
- `packages/server/src/local/routes/telegram.ts` (new) — 4 endpoints
|
|
- `packages/server/src/local/index.ts` — registered
|
|
|
|
**Endpoints (smoke-verified):**
|
|
| Method | Path | Purpose | Verified |
|
|
|---|---|---|---|
|
|
| `GET` | `/api/telegram/status` | reports `{configured, hasToken, hasChatId}` | `{"configured":false,"hasToken":false,"hasChatId":false}` ✓ |
|
|
| `POST` | `/api/telegram/config` | save `{botToken, chatId}` to vault | bad-token reject 400 with format hint ✓ |
|
|
| `POST` | `/api/telegram/test` | send "Waggle is connected ✓" | 400 "not configured" pre-config ✓ |
|
|
| `POST` | `/api/telegram/send` | push arbitrary text — the integration point for ScheduledJobs | shipped, not invoked from UI yet |
|
|
|
|
**Validation:**
|
|
- Bot token pattern: `/^\d{6,12}:[A-Za-z0-9_-]{30,}$/`
|
|
- Chat ID pattern: `/^-?\d{4,18}$/` (signed integer string, negative for groups)
|
|
- Text capped at 4096 chars (Telegram's own limit, rejected client-side before API hit)
|
|
|
|
**Security:**
|
|
- URL is `https://api.telegram.org/bot${token}/sendMessage` — host is hard-coded, token is interpolated into the path of a fixed host → no SSRF surface
|
|
- Token + chat_id stored in vault under `telegram_bot_token` + `telegram_chat_id` (credentialType: api_key)
|
|
- No webhook receiver — pure outbound — so no public-endpoint exposure
|
|
|
|
## What's NOT shipped (honest scope)
|
|
- **Settings UI tile** — user has to `curl POST /api/telegram/config` today. Self-serve UX requires a tile in SettingsApp.tsx.
|
|
- **ScheduledJobs output channel** — the `/api/telegram/send` endpoint exists but isn't called by any scheduled job. The persona-level "daily digest" workflow needs ScheduledJobs to grow a "send result to Telegram" dropdown.
|
|
- **No score movement until the above land.** Plumbing-only means a power user could wire it themselves; persona uplift requires the UI loop.
|
|
|
|
## Score movement (honest: zero this iter)
|
|
Same 5.9/10 average as iter-2. The wiring is in place; the score-move comes when ScheduledJobs uses it.
|
|
|
|
## Next iteration candidates
|
|
- **FR-2 §UI · Settings tile** (~30 min) — input fields, save button, test button, status pill. Closes the self-serve gap.
|
|
- **FR-2 §UI · ScheduledJobs output channel** (~1-2 hr) — dropdown on the job-create form, server-side branch in the scheduler runtime to POST results to `/api/telegram/send`. Closes the daily-digest loop. **This is what actually moves persona P10/P6/P8 scores.**
|
|
- **FR-5 sample workspace import** (parallel option) — different cell-impact path, lifts P1/P2/P3/P5/P7 first-session.
|
|
|
|
## Manual verification path (when user has a bot)
|
|
```bash
|
|
# 1. Set up bot via @BotFather, get token + chat_id
|
|
# 2. Configure
|
|
curl -X POST http://127.0.0.1:3333/api/telegram/config \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{"botToken":"<TOKEN>","chatId":"<CHAT_ID>"}'
|
|
|
|
# 3. Test
|
|
curl -X POST http://127.0.0.1:3333/api/telegram/test
|
|
|
|
# Expected: Telegram DM "✓ Waggle is connected to this chat. Scheduled digests will appear here."
|
|
```
|