feat: agent endpoints — notify in, captured Telegram replies out

[MMTE]

Adds the missing inbound half of the agent bridge contract that gholam's tg-bridge/_notify expect:

• POST /api/agent — accepts {repo, summary, kind, issue?, issue_url?}, fans out as plain text (no Markdown parse mode — summaries are arbitrary agent output).
• GET /api/agent/replies — bare JSON array of messages captured from the authorized TELEGRAM_CHAT_ID chat, each {id, text, reference, ts} with the issue reference extracted from the replied-to message (or the text itself). id is the Telegram message_id, monotonic per chat, so pollers keep a high-water mark.
• Captured messages get no bot auto-reply; /status from the agent chat defers to the polling agent (fleet status) instead of answering with uptime. Bot utility commands (/ping, /id, …) are unaffected.
• Reply store is a capped JSON file under data/ (gitignored, compose volume added). Auth middleware moved to src/auth.js and now shared; accepts x-api-key, ?key=, or Bearer.
• 3 new smoke tests; full suite green (14/14), no network needed.

Verified live: delivered: ["telegram","bale"] end-to-end from gholam's _notify.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added agent API endpoint with API key authentication for handling notifications and managing replies.
  • Implemented inbound reply capture and persistent storage system.

• Chores

  • Updated Docker configuration to support persistent reply data storage.
  • Refactored API key authentication as a reusable module.

• Tests

  • Added comprehensive tests for agent API authentication, validation, and reply storage functionality.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 57acf5e0-5ce0-489d-9388-623658011667

📥 Commits

Reviewing files that changed from the base of the PR and between 5da01fa and 0823d37.

📒 Files selected for processing (8)

• .gitignore
• docker-compose.yml
• src/agent.js
• src/app.js
• src/auth.js
• src/bot.js
• src/replies.js
• test/smoke.js

---

📝 Walkthrough

Walkthrough

This PR adds an inbound reply store and agent notification API to integrate external alerts with a Telegram bot. The changes introduce JSON-backed persistence for bot replies, extract shared auth functions, route Telegram messages from an authorized agent chat for polling, and expose REST endpoints for alert submission and reply retrieval.

Changes

Inbound reply store and agent notification API

Layer / File(s)	Summary
Shared authentication module src/auth.js, src/app.js	getApiKey and requireApiKey are extracted to a dedicated module, supporting extraction from headers, query parameters, and Bearer tokens; app imports and re-exports them.
Inbound reply capture and storage src/replies.js, test/smoke.js	New JSON-backed store persists Telegram bot replies with capture filtering (ignoring non-text, utility commands, non-agent chats), issue reference extraction, and capping by MAX_REPLIES. Smoke tests verify capture rules and storage round-tripping.
Bot message routing integration src/bot.js	Bot handler routes authorized agent chat messages through replies.capture() and defers /status responses to the agent API, enabling bidirectional message exchange.
Agent notification and reply polling API src/agent.js, src/app.js, test/smoke.js	New /api/agent router validates API key, accepts POST / notifications with summary and optional kind, repo, issue, and channels, dispatches via channels.notify, and exposes GET /replies to retrieve stored replies. App mounts the router; smoke tests verify auth, validation, and response shapes including 502 error handling.
Persistent storage infrastructure docker-compose.yml, .gitignore	Docker compose defines watch-tower-data named volume mounted at /app/data; .gitignore excludes the runtime data directory.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

A rabbit in the tower, now stands tall,
With data stored and agents calling,
Telegram replies in JSON keep,
While alerts flow in and secrets deep,
The bridge is built, the store runs true! 🐰📬

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent-replies-endpoint

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Biome (2.4.16)

src/bot.js

File contains syntax errors that prevent linting: Line 12: Illegal return statement outside of a function

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}