feat(client): Telegram-like messenger UI at /client (Draft) - #32
Draft
EpicStarAi wants to merge 1 commit into
Draft
feat(client): Telegram-like messenger UI at /client (Draft)#32EpicStarAi wants to merge 1 commit into
EpicStarAi wants to merge 1 commit into
Conversation
Replace the operator "cabinet" landing with a familiar two-pane Telegram interface. Real data only, honest empty states, security model untouched. - components/tg/: TgClient shell + ChatList, MessageThread (bubbles, grouping, date separators, autoscroll, load-older), Composer (Enter=send / Shift+Enter=newline, server-gated), Avatar (photo or tinted initials), Info + AI-operator side panels, real-API data hook. - globals.css: isolated .tgx palette (authentic Telegram look), dark default + optional light, scoped so it never disturbs the app-wide red tg-* tokens. - No mock data: chats/messages/photo/status all come from /api/telegram/*; send passes the server approval gate; no MTProto in the browser. Also restores the pre-existing missing `resolveBoundAccount` glue in telegramGuard.ts (imported by 7 routes but undefined on this base branch, so the branch did not compile). It is a thin deny-by-default wrapper over the existing resolveBoundAccountId and preserves the exact incident-containment posture — flagged for the security owner to review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Brings the EPICGRAM
/clientsurface to a familiar Telegram look so that,after EPICGRAM login, the user lands in a recognisable two-pane messenger
instead of the operator "cabinet".
Base branch:
backup/operator-ui-account-fetch(the full foundation livesthere, not on
main). Isolated build done in a dedicated git worktree; theshared
agent-controltree was not touched.Scope delivered
components/tg/shell wired intoapp/client/page.tsx(server-sideauth gate preserved). The large red-neon
EpicGramShellis left untouched.AI-operator). Collapsible sidebar; single-pane on mobile.
preview, timestamp, unread counter, active highlight, folder tabs, pinned
section (rendered only if the backend ever exposes a pin flag — honest).
grouping, date separators, time + a sent check, autoscroll, load-older on
scroll-up.
.tgxscope — dark bydefault, optional light — so it never re-skins the app-wide red
tg-*tokens.draft; the human still sends.
Security posture — unchanged
Server resolves the slot, the approval gate stays authoritative, audit intact.
The browser sends no
accountIdfor auth and no MTProto;sendalwayspasses
/api/telegram/send(denied whileTELEGRAM_MUTATION=false). No demochats, no hardcoded messages, no fake avatars — honest empty states only. The
5 security tests still pass;
TELEGRAM_MUTATIONnot changed.resolveBoundAccountwas imported by 7 route files but defined nowhere onthis base branch, so it did not compile. This PR restores it in
lib/telegramGuard.tsas a thin deny-by-default wrapper over the existingresolveBoundAccountId(which returnsnullfor everyone). It cannot returnokwhile the resolver returnsnull, so the incident-containment posture ispreserved exactly — but please confirm the intent.
Verification
npm run build(type-check) ✅ ·npm run lint✅ (new files clean; only thepre-existing warnings-only baseline elsewhere) ·
npm test✅ (5/5).browser had no bound Telegram account): see
docs/tg-client/README.md.Known gap (not faked)
Populated chat screenshots need a bound, authorized Telegram account, which
depends on the owner-matched binding model (
P-EPICGRAM-CLIENT-PLATFORM-1) andthe
:8788TDLib backend — neither available on the candidate. The clienttherefore renders honest empty/connect states rather than fabricated data.
🤖 Generated with Claude Code