Contributing

Thanks for looking. Issues and pull requests are welcome.

Getting set up

git clone https://github.com/sazzadurrahmaan/dsh-telegram.git
cd dsh-telegram
npm install --legacy-peer-deps
npm run build
npm test

--legacy-peer-deps is required: @deepseek-ai/dsh-agent@0.1.0-rc.6 wants dsh-invariants ^0.1.0-rc.6 while the dsh-llm@0.0.1-rc.1 chain wants ^0.0.1-rc.1. Those are peer dependencies here, resolved from the host harness at runtime, so the conflict affects local type-checking only.

Before you open a pull request

• npx tsc -p tsconfig.json --noEmit passes
• npm test passes
• New behaviour has a test. The access checks and the tool gate are the two places where a missing test is a security problem, not a style problem.

Things to keep true

These are the reasons this plugin exists rather than being one of the other Telegram bridges. A change that breaks one of them needs a very good argument.

1. The allowlist denies by default. No "allow everyone" option, ever.
2. Access is checked before the agent sees a message, not inside a handler.
3. Destructive tools ask in the chat. Chat has no approval UI of its own, so the plugin supplies one.
4. One agent per chat, disposed with the plugin. No shared sessions.
5. No bot framework. The Bot API client stays a small file you can read in one sitting.

Commit messages

<TYPE>: <description>, type in uppercase — FIX, FEAT, DOCS, REFACTOR, CHORE, TEST. Explain why in the body when the change is not obvious.