fix: resolve diagnostic paths and recover time injection

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- `Time Injection`: Reject non-finite configured intervals and resume time annotations after the wall clock moves backwards.
+- `Paths`: Resolve diagnostic paths from the current agent directory and profile instead of reporting hard-coded `~/.pi` locations.
+- `Security`: Apply the `brace-expansion` `5.0.12` override at both root and coding-agent scopes to address the latest recursion and expansion denial-of-service advisories.
+
 - **Security overrides refreshed** — `protobufjs` `7.6.4` → `7.6.6`, `undici` `8.5.0` → `8.10.2`, and a new `brace-expansion` `5.0.9` override keep `npm audit` at 0 vulnerabilities; the `validate` gate (`typecheck` → `test` → `audit` → `pack:check`) passes again.
 - **README rewritten** to the repository audit standard: verified install/build/test commands, the real `omp install` syntax, omp agent-directory resolution, and an explicit limitations section.
 - **Release notes extraction fixed** — the `0.22.0-evandro.1` fork section promoted from `###` to `##` so `.github/workflows/release.yml` can build release notes for tag `v0.22.0-evandro.1`.

README.md

@@ -12,7 +12,7 @@
 
 > Fork of [`@llblab/[email protected]`](https://github.com/llblab/pi-telegram/tree/v0.22.0) (SHA `afe09c5`), republished as `@evandrodevbr/oh-my-pi-telegram` for `omp`.
 > Lineage: `badlogic/pi-telegram` → `llblab/pi-telegram` (0.22.0) → **this fork**.
-> The fork adds `omp` compatibility metadata in `package.json` and this README; the runtime code is upstream 0.22.0.
+> The fork is based on upstream 0.22.0, with `omp` compatibility metadata and local runtime fixes recorded in `CHANGELOG.md`.
 
 ## About
 
@@ -249,3 +249,9 @@ The test suite is deterministic and offline: transport calls are injected, so no
 ## License
 
 MIT. See [`LICENSE`](LICENSE), which keeps the copyright notices of the upstream chain (`badlogic/pi-telegram`, `llblab/pi-telegram`) alongside this fork's.
+
+## Review checks (2026-09-30)
+
+Diagnostics report the resolved agent directory, including `omp` and `PI_CODING_AGENT_DIR` overrides, with isolated profile suffixes. Interval time injection recovers after a backward wall-clock adjustment and rejects non-finite intervals. The `brace-expansion` security override is updated to 5.0.12.
+
+Focused offline checks: `node --experimental-strip-types --test tests/time-injection.test.ts tests/paths.test.ts tests/config.test.ts tests/status.test.ts`, followed by `npm run typecheck`. The Domain DAG check remains part of architecture validation. Run `npm run validate` in an environment that permits Unix-domain sockets; this review's restricted environment blocks the bus socket tests. No live bot, Telegram client or Windows IPC session was used.

lib/config.ts

@@ -669,7 +669,7 @@ export function resolveTelegramTimeConfig(
       ? raw.injectionMode
       : "hidden";
   const interval =
-    typeof raw?.interval === "number" && raw.interval > 0
+    typeof raw?.interval === "number" && Number.isFinite(raw.interval) && raw.interval > 0
       ? raw.interval
       : 60 * 60 * 1000;
   const timezone = getSystemTimezone();

lib/paths.ts

@@ -75,11 +75,10 @@ export function getTelegramDiagnosticsDisplayPaths(profileName?: string): {
   state: string;
   logs: string;
 } {
-  const suffix = getTelegramProfilePathSuffix(profileName);
+  const agentDir = resolveAgentDir();
-  const profileSlug = suffix.slice(1);
   return {
-    state: `~/.pi/agent/tmp/telegram/state${suffix}.json`,
+    state: resolveTelegramProfileTempFilePath("state", "json", agentDir, profileName),
-    logs: `~/.pi/agent/tmp/telegram/logs${profileSlug ? `.${profileSlug}` : ""}.jsonl`,
+    logs: resolveTelegramProfileTempFilePath("logs", "jsonl", agentDir, profileName),
   };
 }
 

lib/time-injection.ts

@@ -67,6 +67,7 @@ export function createTimeInjectionRuntime(
       const nowMs = now.getTime();
       if (
         previous !== undefined &&
+        nowMs >= previous &&
         nowMs - previous < config.interval
       ) {
         return null;

package-lock.json

@@ -1362,9 +1362,9 @@
       "peer": true
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
+      "version": "5.0.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "peer": true,
       "dependencies": {

package.json

@@ -83,12 +83,12 @@
   "overrides": {
     "protobufjs": "7.6.6",
     "undici": "8.10.2",
-    "brace-expansion": "5.0.9",
+    "brace-expansion": "5.0.12",
     "ws": "8.21.0",
     "@earendil-works/pi-coding-agent": {
       "protobufjs": "7.6.6",
       "undici": "8.10.2",
-      "brace-expansion": "5.0.9",
+      "brace-expansion": "5.0.12",
       "ws": "8.21.0",
       "@google/genai": {
         "protobufjs": "7.6.6",
@@ -104,4 +104,4 @@
       }
     }
   }
-}
+}

tests/paths.test.ts

@@ -14,8 +14,20 @@ import {
   resolveTelegramLocksPath,
   resolveTelegramTempDir,
   resolveTelegramRuntimeLogPath,
+  getTelegramDiagnosticsDisplayPaths,
+  resolveTelegramProfileTempFilePath,
 } from "../lib/paths.ts";
 
+test("Diagnostics use the resolved agent root and profile suffix", () => {
+  const agentDir = resolveAgentDir();
+  for (const profile of [undefined, "work"]) {
+    assert.deepEqual(getTelegramDiagnosticsDisplayPaths(profile), {
+      state: resolveTelegramProfileTempFilePath("state", "json", agentDir, profile),
+      logs: resolveTelegramProfileTempFilePath("logs", "jsonl", agentDir, profile),
+    });
+  }
+});
+
 await test("resolveAgentDir", async (t) => {
   await t.test("returns PI_CODING_AGENT_DIR when env is set", () => {
     assert.equal(

tests/time-injection.test.ts

@@ -47,6 +47,20 @@ test("Time config rejects non-positive interval", () => {
   assert.equal(resolved.interval, 60 * 60 * 1000);
 });
 
+test("Time config rejects non-finite intervals", () => {
+  for (const interval of [NaN, Infinity, -Infinity]) {
+    assert.equal(resolveTelegramTimeConfig({ injectionMode: "interval", interval }).interval, 3_600_000);
+  }
+});
+
+test("Time injection recovers when the wall clock moves backwards", () => {
+  const runtime = makeRuntime({ injectionMode: "interval", interval: 60_000, timezone: "UTC" });
+  assert.ok(runtime.resolveLine(1, new Date("2026-05-16T15:00:00Z")));
+  assert.ok(runtime.resolveLine(1, new Date("2026-05-16T14:00:00Z")));
+  assert.equal(runtime.resolveLine(1, new Date("2026-05-16T14:00:30Z")), null);
+  assert.ok(runtime.resolveLine(1, new Date("2026-05-16T14:01:00Z")));
+});
+
 test("Time injection runtime returns null for every call when injectionMode is hidden", () => {
   const runtime = makeRuntime({ injectionMode: "hidden", timezone: "UTC" });
   for (let i = 0; i < 5; i++) {