mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 07:41:28 +02:00
A third transport over the MCP tool layer, beside HTTP and stdio. The `channels` compose service long-polls the Bot API, so an instance needs no public URL, certificate or open port; the listener runs on the api image because MCP tools lazy-import app.services. Commands are curated at the tool: a tool joins chat by declaring one short `command` (/scan, /add, /vulns, /progress); no command means MCP-only. Twenty-three commands in five groups, pinned by a test, with replies rendered through ToolResult.blocks instead of the data dump. An unknown chat gets a device code approved under Toolkit, Remote control; anything above read is confirmed with the account's own authenticator and capped at read when none is enrolled. The bot token is the Telegram API key, shared with notifications. Replies are text plus entities with UTF-16 offsets, never parse_mode, so target-written text is literal by construction. Also fixes Dimension.search passing scan_id= to a service that takes scope, and gives query_assets an optional target for project-wide search. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VckaDx6mBB4TsG76u61gvv