Release v0.10.1

.github/workflows/ci.yml

@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -60,7 +60,7 @@ jobs:
         run: npm run dupcheck
 
       - name: Security audit
-        run: npm run audit:ci
+        run: npm run audit:ci && npm run audit:web
 
   # Build + test on each supported Node version.
   test:
@@ -70,10 +70,10 @@ jobs:
       matrix:
         node-version: ["22.22.2", "24.15.0"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -102,14 +102,30 @@ jobs:
       - name: CLI smoke test
         run: node dist/cli/index.js --help
 
+  # Keep the release image buildable before a tag can trigger publication.
+  docker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          cache-from: type=gha,scope=teleton-docker
+          cache-to: type=gha,mode=max,scope=teleton-docker
+
   # ---- Telegram notification (one summary per push, pushes only) ----
   notify:
-    needs: [checks, test]
+    needs: [checks, test, docker]
     if: always() && github.event_name == 'push'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -122,6 +138,7 @@ jobs:
           AFTER_SHA: ${{ github.event.after }}
           CHECKS_RESULT: ${{ needs.checks.result }}
           TEST_RESULT: ${{ needs.test.result }}
+          DOCKER_RESULT: ${{ needs.docker.result }}
         run: |
           set -uo pipefail
           NULL_SHA="0000000000000000000000000000000000000000"
@@ -167,7 +184,7 @@ jobs:
             REPO_NAME=${REPO_URL##*/}
             LABEL=$(printf '%s' "$BRANCH" | tr '[:lower:]' '[:upper:]')
             TEXT="<b>[$LABEL] $REPO_NAME</b>"
-            if [ "$CHECKS_RESULT" = "success" ] && [ "$TEST_RESULT" = "success" ]; then
+            if [ "$CHECKS_RESULT" = "success" ] && [ "$TEST_RESULT" = "success" ] && [ "$DOCKER_RESULT" = "success" ]; then
               printf -v TEXT '%s\n%s %s pushed to %s' "$TEXT" "$COUNT" "$NOUN" "$BRANCH"
             else
               printf -v TEXT '%s\nCI failed on %s (%s %s)' "$TEXT" "$BRANCH" "$COUNT" "$NOUN"

.github/workflows/release.yml

@@ -14,16 +14,22 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm
           cache-dependency-path: |
             package-lock.json
             web/package-lock.json
 
+      - name: Verify release metadata
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          test "$GITHUB_REF_NAME" = "v$VERSION"
+          grep -Fq "## [$VERSION]" CHANGELOG.md
+
       - run: npm ci
       - run: cd web && npm ci
       - run: npm run build -w packages/sdk
@@ -43,18 +49,34 @@ jobs:
           name: dist
           path: dist/
 
+  # Verify the image before any registry publication starts.
+  verify-docker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          cache-from: type=gha,scope=teleton-docker
+          cache-to: type=gha,mode=max,scope=teleton-docker
+
   # ---- Publish to npm ----
   publish-npm:
-    needs: build
+    needs: [build, verify-docker]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
       id-token: write # npm provenance
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org
@@ -93,16 +115,16 @@ jobs:
 
   # ---- Publish SDK to npm (if version changed) ----
   publish-sdk:
-    needs: build
+    needs: [build, verify-docker]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
       id-token: write # npm provenance
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org
@@ -133,14 +155,14 @@ jobs:
 
   # ---- Publish Docker image ----
   publish-docker:
-    needs: build
+    needs: [build, verify-docker]
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       contents: read
       packages: write # push to ghcr.io
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Buildx
         uses: docker/setup-buildx-action@v3
@@ -163,8 +185,8 @@ jobs:
         with:
           context: .
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=teleton-docker
+          cache-to: type=gha,mode=max,scope=teleton-docker
           tags: |
             ghcr.io/${{ steps.meta.outputs.repo }}:${{ steps.meta.outputs.version }}
             ghcr.io/${{ steps.meta.outputs.repo }}:latest
@@ -177,7 +199,7 @@ jobs:
     permissions:
       contents: write # create the GitHub release
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/telegram-notify.yml

@@ -16,7 +16,7 @@ jobs:
       && github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.10.1] - 2026-07-27
+
+### Added
+
+- Global Telegram account search with filters, page-local sorting, and cursor pagination, plus public channel post/hashtag search with quota preflight and no automatic Stars spending.
+- Telegram MTProto Layer 228 compatibility, including the new invite-result union.
+- Persistent privacy-bounded agent-turn traces, paged artifacts for large tool results, safe provider/model fallbacks, and a per-turn time budget.
+- Turn-scoped idempotency records for external actions.
+
+### Fixed
+
+- Isolated iterative compaction summaries per conversation, preventing one chat summary from entering another chat.
+- Persist Telegram admin changes from `/model`, `/loop`, `/policy`, and `/rag` to the validated YAML config before applying them at runtime.
+- Removed the unintended `/approve` and `/reject` interruption so authorized actions execute directly.
+- Ignore Layer 228 Community pseudo-dialog entities during dialog indexing, preventing `Cannot cast Community` startup errors.
+- Return a clear guard-bot WebView result instead of falsely reporting a successfully joined chat.
+
 ## [0.10.0] - 2026-07-11
 
 ### Added
@@ -470,7 +487,8 @@ Git history rewritten to fix commit attribution (email update from `tonresistor@
 - Professional distribution (npm, Docker, CI/CD)
 - Pre-commit hooks and linting infrastructure
 
-[Unreleased]: https://github.com/TONresistor/teleton-agent/compare/v0.10.0...HEAD
+[Unreleased]: https://github.com/TONresistor/teleton-agent/compare/v0.10.1...HEAD
+[0.10.1]: https://github.com/TONresistor/teleton-agent/compare/v0.10.0...v0.10.1
 [0.10.0]: https://github.com/TONresistor/teleton-agent/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/TONresistor/teleton-agent/compare/v0.8.6...v0.9.0
 [0.8.6]: https://github.com/TONresistor/teleton-agent/compare/v0.8.5...v0.8.6

GETTING_STARTED.md

@@ -98,7 +98,7 @@ You should see:
 ✅ Knowledge indexed
 ✅ Telegram: @your_agent connected
 ✅ TON Blockchain: connected
-✅ Agent is ready! (128 base tools)
+✅ Agent is ready! (131 base tools)
 ```
 
 **Verify:** Send `/ping` to your agent on Telegram.
@@ -154,7 +154,6 @@ Admin commands are only available to users listed in `admin_ids`. All commands w
 | `/clear <chat_id>` | Clear specific chat history |
 | `/model <name>` | Switch LLM model at runtime |
 | `/wallet` | Show wallet address and balance |
-| `/approve <request_id>` / `/reject <request_id>` | Resolve a pending financial action |
 | `/policy dm open` | Change DM policy at runtime |
 | `/modules set\|info\|reset` | Manage per-group tool permissions |
 | `/plugin set\|unset\|keys` | Manage plugin secrets |
@@ -170,7 +169,7 @@ Admin commands are only available to users listed in `admin_ids`. All commands w
 
 ## Tool Categories
 
-Teleton has **128 always-registered tools**, plus 5 optional system tools:
+Teleton has **131 always-registered tools**, plus 5 optional system tools:
 
 | Category | Count | Highlights |
 |----------|-------|------------|

README.md

@@ -15,7 +15,7 @@
 
 ---
 
-<p align="center">Teleton is an autonomous AI agent platform that operates as a real Telegram user account or a Telegram Bot. It thinks through an agentic loop with tool calling, remembers conversations across sessions with hybrid RAG, and natively integrates the TON blockchain: send crypto, swap on DEXs, bid on domains, verify payments - all from a chat message. It can schedule tasks to run autonomously at any time. It ships with 128 always-registered tools plus 5 optional system tools, supports 16 LLM providers, and exposes a Plugin SDK so you can build your own tools on top of the platform.</p>
+<p align="center">Teleton is an autonomous AI agent platform that operates as a real Telegram user account or a Telegram Bot. It thinks through an agentic loop with tool calling, remembers conversations across sessions with hybrid RAG, and natively integrates the TON blockchain: send crypto, swap on DEXs, bid on domains, verify payments - all from a chat message. It can schedule tasks to run autonomously at any time. It ships with 131 always-registered tools plus 5 optional system tools, supports 16 LLM providers, and exposes a Plugin SDK so you can build your own tools on top of the platform.</p>
 
 ### Key Highlights
 
@@ -28,7 +28,7 @@
 <tr>
 <td align="center"><br><b><ins>TON Blockchain</ins></b><br>Wallet, jettons, DEX swaps, DNS, NFTs<br><br></td>
 <td align="center"><br><b><ins>Persistent Memory</ins></b><br>Hybrid RAG, vector + keyword, auto-compaction<br><br></td>
-<td align="center"><br><b><ins>128+ Built-in Tools</ins></b><br>Messaging, media, crypto, DEX, DNS, files<br><br></td>
+<td align="center"><br><b><ins>129+ Built-in Tools</ins></b><br>Messaging, media, crypto, DEX, DNS, files<br><br></td>
 </tr>
 <tr>
 <td align="center"><br><b><ins>Plugin SDK</ins></b><br>Custom tools, isolated DBs, secrets, hooks<br><br></td>
@@ -153,7 +153,7 @@ Teleton can run as a **user account** (MTProto) or a **Telegram bot** (Bot API).
 |---|---|---|
 | **Auth** | Phone + api_id + api_hash | Bot token from @BotFather |
 | **Protocol** | MTProto (GramJS) | Bot API (Grammy) |
-| **Tools** | 128 base, up to 133 with optional system modules | Registry filtered automatically by bot-compatible capabilities |
+| **Tools** | 129 base, up to 134 with optional system modules | Registry filtered automatically by bot-compatible capabilities |
 | **Risk** | Account ban possible | No ban risk |
 | **Dialogs/History** | Full access | Not available |
 | **Media sending** | All types | Photos only (v1) |
@@ -366,7 +366,6 @@ All admin commands support `/`, `!`, or `.` prefix:
 | `/policy <dm\|group> <value>` | Change access policies live |
 | `/loop <1-50>` | Set max agentic iterations |
 | `/wallet` | Show wallet address + balance |
-| `/approve <request_id>` / `/reject <request_id>` | Resolve a pending financial action |
 | `/modules set\|info\|reset` | Per-group tool permissions |
 | `/plugin set\|unset\|keys` | Manage plugin secrets |
 | `/task <description>` | Assign a task to the agent |
@@ -495,9 +494,9 @@ The SDK provides namespaced access to core services:
 src/
 ├── index.ts                # Entry point, TeletonApp lifecycle, graceful shutdown
 ├── agent/                  # Core agent runtime
-│   ├── runtime.ts          # Agentic loop (5 iterations, tool calling, masking, compaction)
+│   ├── runtime.ts          # Budgeted agentic loop, tool calling, masking, compaction
 │   ├── client.ts           # Multi-provider LLM client
-│   └── tools/              # 128 base tools plus 5 optional system tools
+│   └── tools/              # 131 base tools plus 5 optional system tools
 │       ├── register-all.ts # Central tool registration (9 categories)
 │       ├── registry.ts     # Tool registry, scope filtering, provider limits
 │       ├── module-loader.ts    # Built-in module loading (TON Proxy + exec)

TOOLS.md

@@ -1,6 +1,6 @@
-# Tools — 133 total
+# Tools — 135 total
 
-## Telegram — Messaging (13)
+## Telegram — Messaging (15)
 
 | Tool | Description |
 |------|-------------|
@@ -10,7 +10,9 @@
 | `telegram_forward_message` | Forward messages to another chat |
 | `telegram_quote_reply` | Reply to a specific excerpt within a message |
 | `telegram_get_replies` | Fetch all replies in a message thread |
-| `telegram_search_messages` | Search messages by text query |
+| `telegram_search_messages` | Search messages by text query within one chat |
+| `telegram_search_global` | Search live messages across all account chats |
+| `telegram_search_posts` | Search posts across public Telegram channels |
 | `telegram_schedule_message` | Queue a message for delayed delivery |
 | `telegram_get_scheduled_messages` | List pending scheduled messages |
 | `telegram_delete_scheduled_message` | Cancel scheduled messages |

audit-ci.jsonc

@@ -1,6 +1,7 @@
 {
   "package-manager": "npm",
   "report-type": "full",
+  "high": true,
   "critical": true,
   "allowlist": []
 }

docs-sdk/TEMPLATE.md

@@ -7,7 +7,7 @@ Use this exact HTML structure for every page. Replace PLACEHOLDERS in CAPS.
 ```html
 <div class="nav-section"><div class="nav-section-title">Start Here</div><ul class="nav-list"><div class="nav-list-inner"><li><a href="/index.html" class="nav-link">Introduction</a></li><li><a href="installation.html" class="nav-link">Installation</a></li><li><a href="quickstart.html" class="nav-link">Quick Start</a></li><li><a href="configuration.html" class="nav-link">Configuration</a></li></div></ul></div>
 <div class="nav-section"><div class="nav-section-title">Understand</div><ul class="nav-list"><div class="nav-list-inner"><li><a href="architecture.html" class="nav-link">Architecture</a></li><li><a href="agentic-loop.html" class="nav-link">Agentic Loop</a></li><li><a href="memory-system.html" class="nav-link">Memory System</a></li><li><a href="security.html" class="nav-link">Security</a></li></div></ul></div>
-<div class="nav-section"><div class="nav-section-title">Tools</div><ul class="nav-list"><div class="nav-list-inner"><li><a href="tools-telegram.html" class="nav-link">Telegram (83)</a></li><li><a href="tools-ton.html" class="nav-link">TON Blockchain (15)</a></li><li><a href="tools-dex.html" class="nav-link">DEX Trading (10)</a></li><li><a href="tools-dns.html" class="nav-link">DNS &amp; Domains (8)</a></li><li><a href="tools-other.html" class="nav-link">Utilities</a></li></div></ul></div>
+<div class="nav-section"><div class="nav-section-title">Tools</div><ul class="nav-list"><div class="nav-list-inner"><li><a href="tools-telegram.html" class="nav-link">Telegram (85)</a></li><li><a href="tools-ton.html" class="nav-link">TON Blockchain (15)</a></li><li><a href="tools-dex.html" class="nav-link">DEX Trading (10)</a></li><li><a href="tools-dns.html" class="nav-link">DNS &amp; Domains (8)</a></li><li><a href="tools-other.html" class="nav-link">Utilities</a></li></div></ul></div>
 <div class="nav-section"><div class="nav-section-title">Configure</div><ul class="nav-list"><div class="nav-list-inner"><li><a href="multi-llm.html" class="nav-link">Multi-LLM Providers</a></li><li><a href="scheduled-tasks.html" class="nav-link">Scheduled Tasks</a></li><li><a href="webui.html" class="nav-link">WebUI Dashboard</a></li></div></ul></div>
 <div class="nav-section"><div class="nav-section-title">Build Plugins</div><ul class="nav-list"><div class="nav-list-inner"><li><a href="plugin-sdk.html" class="nav-link">Plugin SDK</a></li><li><a href="create-plugin.html" class="nav-link">Create a Plugin</a></li><li><a href="api-events.html" class="nav-link">Plugin Lifecycle</a></li><li><a href="mcp-servers.html" class="nav-link">MCP Servers</a></li></div></ul></div>
 <div class="nav-section"><div class="nav-section-title">SDK Reference</div><ul class="nav-list"><div class="nav-list-inner"><li><a href="sdk-overview.html" class="nav-link">Overview</a></li><li><a href="sdk-ton.html" class="nav-link">TON Blockchain</a></li><li><a href="sdk-dex.html" class="nav-link">DEX Trading</a></li><li><a href="sdk-dns.html" class="nav-link">DNS &amp; Domains</a></li><li><a href="sdk-telegram.html" class="nav-link">Telegram</a></li><li><a href="sdk-bot.html" class="nav-link">Bot SDK</a></li><li><a href="sdk-utilities.html" class="nav-link">Utilities</a></li><li><a href="sdk-errors.html" class="nav-link">Error Handling</a></li><li><a href="tutorial-payment-bot.html" class="nav-link">Tutorial: Payment Bot</a></li><li><a href="tutorial-dex-bot.html" class="nav-link">Tutorial: DEX Bot</a></li><li><a href="tutorial-inline-bot.html" class="nav-link">Tutorial: Inline Bot</a></li></div></ul></div>

docs-sdk/llms-full.txt

@@ -309,7 +309,7 @@ interface SimpleToolDef {
   execute: (params, context) => Promise<ToolResult>;
   scope?: "open" | "always" | "dm-only" | "group-only" | "admin-only" | "allowlist" | "disabled";
   category?: "data-bearing" | "action";
-  requiresApproval?: boolean;
+  requiresApproval?: boolean; // Deprecated compatibility field; ignored by the runtime
 }
 
 interface ToolResult {