feat(api): add message injection endpoint

src/commands/start.ts

@@ -353,21 +353,21 @@ export async function start(args: string[] = []) {
   let telegramSend: ((chatId: number, text: string) => Promise<void>) | null = null;
   let telegramToken = "";
 
-  async function initTelegram(token: string) {
+  async function initTelegram(token: string, receiveEnabled = true) {
     if (token && token !== telegramToken) {
       const { startPolling, sendMessage } = await import("./telegram");
-      startPolling(debugFlag);
+      if (receiveEnabled) startPolling(debugFlag);
       telegramSend = (chatId, text) => sendMessage(token, chatId, text);
       telegramToken = token;
-      console.log(`[${ts()}] Telegram: enabled`);
+      console.log(`[${ts()}] Telegram: enabled${receiveEnabled ? "" : " (send-only)"}`);
     } else if (!token && telegramToken) {
       telegramSend = null;
       telegramToken = "";
       console.log(`[${ts()}] Telegram: disabled`);
     }
   }
 
-  await initTelegram(currentSettings.telegram.token);
+  await initTelegram(currentSettings.telegram.token, currentSettings.telegram.receiveEnabled);
   if (!telegramToken) console.log("  Telegram: not configured");
 
   // --- Discord ---
@@ -654,7 +654,7 @@ export async function start(args: string[] = []) {
       currentJobs = newJobs;
 
       // Telegram changes
-      await initTelegram(newSettings.telegram.token);
+      await initTelegram(newSettings.telegram.token, newSettings.telegram.receiveEnabled);
 
       // Discord changes
       await initDiscord(newSettings.discord.token);

src/config.ts

@@ -24,7 +24,7 @@ const DEFAULT_SETTINGS: Settings = {
     excludeWindows: [],
     forwardToTelegram: true,
   },
-  telegram: { token: "", allowedUserIds: [] },
+  telegram: { token: "", allowedUserIds: [], receiveEnabled: true },
   discord: { token: "", allowedUserIds: [] },
   security: { level: "moderate", allowedTools: [], disallowedTools: [] },
   web: { enabled: false, host: "127.0.0.1", port: 4632 },
@@ -48,6 +48,8 @@ export interface HeartbeatConfig {
 export interface TelegramConfig {
   token: string;
   allowedUserIds: number[];
+  /** When false, skip Telegram polling (incoming messages). Useful for send-only instances. Default: true */
+  receiveEnabled: boolean;
 }
 
 export interface DiscordConfig {
@@ -79,6 +81,7 @@ export interface Settings {
   security: SecurityConfig;
   web: WebConfig;
   stt: SttConfig;
+  apiToken?: string;
 }
 
 export interface ModelConfig {
@@ -148,6 +151,7 @@ function parseSettings(raw: Record<string, any>, discordUserIds?: string[]): Set
     telegram: {
       token: raw.telegram?.token ?? "",
       allowedUserIds: raw.telegram?.allowedUserIds ?? [],
+      receiveEnabled: raw.telegram?.receiveEnabled !== false,
     },
     discord: {
       token: typeof raw.discord?.token === "string" ? raw.discord.token.trim() : "",
@@ -175,6 +179,7 @@ function parseSettings(raw: Record<string, any>, discordUserIds?: string[]): Set
       baseUrl: typeof raw.stt?.baseUrl === "string" ? raw.stt.baseUrl.trim() : "",
       model: typeof raw.stt?.model === "string" ? raw.stt.model.trim() : "",
     },
+    apiToken: typeof raw.apiToken === "string" && raw.apiToken.trim() ? raw.apiToken.trim() : undefined,
   };
 }
 

src/ui/auth.ts

@@ -0,0 +1,8 @@
+import { json } from "./http";
+
+export function checkBearer(req: Request, token: string | undefined): Response | null {
+  if (!token) return json({ ok: false, error: "API token not configured" }, 503);
+  const header = req.headers.get("Authorization");
+  if (header !== `Bearer ${token}`) return json({ ok: false, error: "Unauthorized" }, 401);
+  return null;
+}

src/ui/http.ts

@@ -1,5 +1,6 @@
-export function json(data: unknown): Response {
+export function json(data: unknown, status = 200): Response {
   return new Response(JSON.stringify(data), {
+    status,
     headers: { "Content-Type": "application/json; charset=utf-8" },
   });
 }

src/ui/server.ts

@@ -1,10 +1,12 @@
 import { htmlPage } from "./page/html";
 import { clampInt, json } from "./http";
+import { checkBearer } from "./auth";
 import type { StartWebUiOptions, WebServerHandle } from "./types";
 import { buildState, buildTechnicalInfo, sanitizeSettings } from "./services/state";
 import { readHeartbeatSettings, updateHeartbeatSettings } from "./services/settings";
 import { createQuickJob, deleteJob } from "./services/jobs";
 import { readLogs } from "./services/logs";
+import { runUserMessage } from "../runner";
 
 export function startWebUi(opts: StartWebUiOptions): WebServerHandle {
   const server = Bun.serve({
@@ -148,6 +150,30 @@ export function startWebUi(opts: StartWebUiOptions): WebServerHandle {
         return json(await readLogs(tail));
       }
 
+      if (url.pathname === "/api/inject" && req.method === "POST") {
+        const authErr = checkBearer(req, opts.getSnapshot().settings.apiToken);
+        if (authErr) return authErr;
+        try {
+          const body = await req.json();
+          const message = typeof body.message === "string" ? body.message.trim() : "";
+          if (!message) return json({ ok: false, error: "message is required" }, 400);
+          const result = await runUserMessage("inject", message);
+          const text = result.stdout.trim();
+          const { telegram } = opts.getSnapshot().settings;
+          if (text && telegram.token && telegram.allowedUserIds.length > 0) {
+            const chatId = telegram.allowedUserIds[0];
+            fetch(`https://api.telegram.org/bot${telegram.token}/sendMessage`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ chat_id: chatId, text }),
+            }).catch(() => {});
+          }
+          return json({ ok: true, result: result.stdout, exitCode: result.exitCode });
+        } catch (err) {
+          return json({ ok: false, error: String(err) }, 500);
+        }
+      }
+
       return new Response("Not found", { status: 404 });
     },
   });