initial: webhook telegram adapter for pi with streaming replies

- webhook server with secret validation, rate limiting, body guards
- streaming replies via sendMessage + editMessageText throttled loop
- RPC session management for persistent conversations
- 15/15 tests passing

.pi/agents/worker.md

@@ -0,0 +1,30 @@
+---
+name: worker
+description: Build pi-telegram-webhook extension
+tools: read, bash, edit, write
+model: anthropic/claude-sonnet-4-5
+thinking: xhigh
+---
+
+You are building a new pi extension package called pi-telegram-webhook.
+
+You have access to these reference codebases:
+- OpenClaw telegram extension (webhook + streaming): ~/Documents/GitHub/nix/tmp/openclaw/extensions/telegram/
+- Pi mono repo (pi SDK, agent core, TUI): ~/Documents/GitHub/nix/tmp/pi-mono/
+- Pi channels (existing telegram polling adapter): ~/.local/share/npm/lib/node_modules/@e9n/pi-channels/
+- Pi coding agent (extension API): ~/.local/share/npm/lib/node_modules/@mariozechner/pi-coding-agent/
+
+Follow pi extension/package conventions from the pi mono repo. This is a pi package installable via `pi install npm:pi-telegram-webhook`.
+
+Key requirements:
+- Telegram webhook ingress (HTTP server, setWebhook, secret token validation, rate limiting)
+- Streaming message delivery (sendMessage then editMessageText on throttled loop)
+- Clean, tested, concise TypeScript
+- No grammy dependency — use raw Telegram Bot API via fetch like pi-channels does
+- Must work behind nginx reverse proxy (support X-Forwarded-For, trusted proxies)
+- Health check endpoint
+- Graceful shutdown (deleteWebhook on stop)
+- Configurable via pi settings.json under "pi-telegram-webhook" key
+- Follow the same adapter/bridge pattern as pi-channels for compatibility
+
+Do NOT use markdown formatting in any user-facing output. Write code only.

.pi/task.md

@@ -0,0 +1,22 @@
+Build the pi-telegram-webhook extension. Read these references first:
+
+1. ~/Documents/GitHub/nix/tmp/openclaw/extensions/telegram/src/webhook.ts
+2. ~/Documents/GitHub/nix/tmp/openclaw/extensions/telegram/src/draft-stream.ts
+3. ~/.local/share/npm/lib/node_modules/@e9n/pi-channels/src/index.ts
+4. ~/.local/share/npm/lib/node_modules/@e9n/pi-channels/src/adapters/telegram.ts
+5. ~/.local/share/npm/lib/node_modules/@e9n/pi-channels/src/bridge/bridge.ts
+6. ~/.local/share/npm/lib/node_modules/@e9n/pi-channels/src/bridge/rpc-runner.ts
+7. ~/Documents/GitHub/nix/tmp/pi-mono/packages/coding-agent/package.json
+
+Then build a focused pi extension package in this repo with:
+- package.json with pi.extensions entry for npm publish
+- src/index.ts (pi extension entry via ExtensionAPI)
+- src/webhook-server.ts (HTTP server, secret validation, rate limiting, health endpoint, trusted proxy)
+- src/streaming-reply.ts (sendMessage + editMessageText throttled loop, 4096 cap, generation tracking)
+- src/telegram-api.ts (thin fetch wrapper for Telegram Bot API)
+- src/bridge.ts (incoming message queue, RPC session management, connect webhook to agent)
+- src/types.ts and src/config.ts
+- tests/ with vitest
+- tsconfig.json, vitest.config.ts, README.md
+
+Config key: "pi-telegram-webhook" in settings.json. No grammy. Raw fetch only. Concise.