feat(groups): ephemeral messages instead of deletion

[Endxxr]

Closes #150

I just started writing in Typescript a month ago after years of Java, so I accept suggestions to improve my code, I still have to fully understand this messy language.

I (tbh Copilot) had to change the start and dev scripts in order to run the bot on my Window host. I don't know if there are better methods to do that, check package.json

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 04ffc27e-daba-4063-8585-60d7ca317765

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lorenzocorallo]

@Endxxr there are some issues with package install. Try run pnpm install to see if there are changes to commit.

Also, double check that there are no Biome issues pnpm check / pnpm check:fix

[lorenzocorallo]

@Endxxr @toto04 I reviewed this change at 5ac3771 after the latest typecheck fix. CI is green, and a clean local install passed all 154 tests, typechecking, Biome, and the production build. However, I found two runtime blockers. Since the PR has already been merged, please treat these as urgent follow-up fixes.

1. The production start command is broken. package.json now runs cross-env NODE_ENV=production node --env-file=.env dist/bot.js, but cross-env is a dev dependency while the final Docker image installs production dependencies only. The final image also does not contain .env. This means pnpm start cannot launch in production. I also reproduced the missing-file failure directly: Node exits with code 9 and .env: not found.

2. Private-chat command errors now use a group-only Telegram feature. The wrongScope and missingPermissions hooks call ephemeral() regardless of chat type. Telegram ephemeral messages are for groups and supergroups, so private invocations such as running /report privately, or failing authorization on a private command, lose the former error response. These calls also discard an uncaught promise, so an API rejection may become an unhandled rejection. ephemeral() needs a normal-reply fallback outside groups and error handling for fire-and-forget calls.

Two non-blocking omissions from issue #150 are worth following up:

• src/middlewares/group-specific-actions.ts still posts rule-violation feedback publicly for two minutes.
• The managed-command handlerError hook still posts String(error) publicly in groups.

There is also no behavioral test for ephemeral routing, private-chat fallback, or send failures. I did not find any documented coding-standard violations; all commits follow Conventional Commits.