EPICGRAM client: Replit development snapshot

[EpicStarAi]

Что опубликовано

Текущий локальный снимок EPICGRAM Client для точечной доработки через Replit.

• стабильная Telegram-авторизация без циклических переходов;
• активный 2FA flow;
• плавающее окно EPIC CLAW AI Operator и operator tools;
• локальный AI/vision routing;
• n8n/OpenClaw integration probes;
• referral provisioning и EPIC CRM ledger.

Безопасность

.env.local, runtime cookies, TDLib database/session files и локальные credentials в ветку не включены. Реальные секреты должны добавляться через Replit Secrets.

Проверка

• npm run test: 20 passed, 2 skipped live E2E;
• npm run build: completed successfully;
• дерево опубликованной ветки совпадает с локальным checkpoint.

Production и main не изменялись.

[EpicStarAi]

Replit staging handoff is ready on replit/epicgram-client-dev.

• Added .replit Preview/Publishing config on 0.0.0.0:3015.
• Added an owner-scoped read-only gateway; TDLib sessions remain on the VPS.
• Staging API: https://epicgram-stage.194-163-140-26.sslip.io
• Verified: anonymous 401; authenticated account list exposes one alias (owner); 80 chats and messages load; real slot ID is not returned; all mutations are denied with 403 READ_ONLY_GATEWAY.
• Replit requires EPICGRAM_API_BASE_URL, EPICGRAM_BACKEND_SERVICE_TOKEN, EPICGRAM_STAGING_OWNER_MODE=true, EPICGRAM_STAGING_OWNER_ACCOUNT_ID=owner, TELEGRAM_MUTATION=false, and a Replit-only EPIC_DEV_REFERRAL in both Development and Publishing Secrets.

No production process was restarted or changed. No gateway token, access code, Telegram credential, or TDLib database is committed.

[EpicStarAi]

Staging access update is ready.

• Release branch: 2d5c312
• Replit branch: 9338a24
• Owner-scoped multi-account TDLib: create/select, QR/phone/code/2FA, reset and selected-slot deletion
• Read access: chats, messages, avatars and media proxy
• Text send/publish: separate staging capability plus explicit human action; AI/background sends remain blocked
• VPS gateway state/audit: 0600, message text excluded from audit
• Verification: npm run test (24 passed, 2 live tests skipped), npm run build, real disposable-slot QR/create/delete E2E

Required Replit secret names and operating notes are documented in docs/REPLIT_STAGING_GATEWAY.md; no secret values are committed.

[EpicStarAi]

Real staging send E2E completed after the previous status update: one test message was sent to the owner's own Saved Messages/self chat, returned HTTP 200 with a Telegram message id, and was visible in refreshed TDLib history. The gateway audit recorded outcome=ok with a SHA-256 payload hash and no message text.