@justfortytwo/telegram 0.1.4 → 1.0.0-0

package/README.md

@@ -1,21 +1,66 @@
 # @justfortytwo/telegram
 
 The **Telegram channel adapter** for [fortytwo](https://github.com/justfortytwo) — a
-standalone, always-on **bridge** that connects a Telegram bot to a headless
-[`claude`](https://docs.claude.com/en/docs/claude-code) turn loop.
-
-It does three jobs:
-
-1. **Turn loop.** Long-poll Telegram, and for each authorized inbound message
-   drive a headless `claude -p --output-format json` turn (resuming the per-chat
-   session), then transport the assistant's reply back.
-2. **Approval UX.** When the safety gate defers an external/irreversible tool
-   call, the turn ends with `stop_reason: tool_deferred`. The bridge surfaces an
-   **inline-keyboard approval card** (Approve / Deny, plus "Allow _N_h" for exact
-   Bash commands). The tap records the decision and resumes the turn so the
-   one-shot allow fires.
-3. **Proactive wakes.** A scheduler invokes `claude -p` at fixed cron-like slots
-   (daily briefing, open-thread sweeps, weekly learn-review).
+standalone, always-on **bridge** connecting a Telegram bot to persistent Claude
+Code sessions through `@justfortytwo/runner`.
+
+1. **Transport.** Each active authorized chat normally has one live RunnerSession.
+   After authorization, attachment ingestion and optional journaling, input waits
+   only for `session.send()` to write it. Polling continues while Claude works;
+   another message goes to the same session immediately after preprocessing.
+2. **Output and approvals.** Complete assistant-message events are coalesced into
+   an evolving Telegram reply, edited at most once per second during streaming.
+   A result finalizes the reply; long replies use additional messages of at most
+   4000 UTF-16 units. Typing refreshes while submitted inputs await results.
+   Existing gate deferrals produce approval cards. Approving sends the existing
+   continuation prompt to the live session, or recreates it using a saved ID.
+3. **Scheduler separation.** Proactive wakes remain the responsibility of the
+   external `@justfortytwo/scheduler` daemon.
+
+## Session lifecycle and recovery
+
+The bridge owns the chat-to-session mapping. Runner owns the Claude process and
+stream-json transport; Claude Code owns the agent. Telegram makes no provider or
+model decisions. The runner inherits process configuration and receives
+`CLAUDE_CODE_DISABLE_AUTO_MEMORY=1` explicitly, without changing `process.env`.
+Persistent sessions have no default wall-clock turn timeout.
+
+Claude stays alive between messages. When runner exposes a session ID, the bridge
+writes it to `sessions` in `state/bridge-state.json`. Following a bridge restart,
+the next authorized message lazily creates a session with `resumeSessionId`.
+These IDs are recovery hints: the state file is not a transactional message queue,
+and in-flight inputs, partial replies, or unobserved IDs can be lost on a crash.
+Recovery also requires Claude Code's underlying session data to remain available.
+
+An unexpected Claude exit removes the live mapping, retains the last known ID,
+and reports an error if input was awaiting a result. The next message attempts
+resumption; there is no automatic restart supervisor or input replay. Stderr is
+logged locally. Asynchronous Telegram delivery failures are logged; there is no
+new durable output queue. Assistant events are complete messages, not token-level
+streaming, and concurrent inputs share the session's output stream.
+
+SIGINT/SIGTERM abort polling, stop new session work and deterministically close
+live RunnerSessions. `/logout` closes the chat's live process and removes its
+binding, while retaining durable conversation IDs and existing pending approval
+recovery data. The existing `ALLOWED_CHAT_IDS` bootstrap authorization still applies
+independently of bindings.
+
+The runner dependency is pinned to the published prerelease
+`@justfortytwo/runner@1.0.0-0` (npm dist-tag `next`), the first release with
+persistent sessions. Move to a stable `^1` range once runner publishes one.
+
+### Manual check against a real Claude Code
+
+The automated suite uses fake runners only. To verify concurrency end to end, run
+the bridge with a test bot (`TELEGRAM_BOT_TOKEN`, `ALLOWED_CHAT_IDS=<your chat>`,
+`claude` on `PATH`), then:
+
+1. Send a message that makes Claude work for a while (e.g. "count slowly to 20
+   using a Bash `sleep 1` between numbers").
+2. While typing is shown, send a second message. The bridge log should print the
+   second `inbound` line immediately, and `ps` should show a single `claude` child.
+3. Stop the bridge with Ctrl-C and confirm no `claude` process remains; restart
+   it and send a message: the reply should continue the same conversation.
 
 ## Pairing / login binding model
 
@@ -33,7 +78,7 @@ channel side:  /login <code>                  ->  verify(chatId, code) -> bindin
   bind.
 - `/login <code>` verifies the code and, on success, **persists a binding**
   `(channelType, channelUserId) -> owner`.
-- `/logout` removes the binding.
+- `/logout` removes the binding and closes the live session (recovery IDs remain).
 - Every inbound message is authorized against **persisted bindings ∪ the
   optional `ALLOWED_CHAT_IDS` bootstrap set**. The bootstrap set lets the first
   owner chat reach the bridge before any binding exists; it is not required once
@@ -64,20 +109,23 @@ sqlite db exists:
 > table, swap the default store for a memory-backed `BindingStore`. The login
 > flow is unaffected.
 
-## Peer dependencies
+## fortytwo package dependencies
 
-This package orchestrates two **peer** packages — they are referenced, not
-bundled:
+`@justfortytwo/gate` is a regular dependency: `attachments.ts` imports its
+`createSourceEnvelope` provenance helper at runtime (gate has no dependencies of
+its own). Using gate as a *policy hook* remains optional and is configured
+separately. `@justfortytwo/memory` is an **optional peer**: it is loaded
+dynamically, and it is also a devDependency so types and tests resolve.
 
-| Peer | Used for | Contract |
+| Package | Used for | Contract |
 | --- | --- | --- |
 | `@justfortytwo/memory` | Memory store, jobs, pending-decision records, embeddings | `MEMORY_TOOL_CONTRACT_VERSION` (tools `mcp__fortytwo-memory__*`) |
 | `@justfortytwo/gate` | Bash exact-command allowlist behind "Allow _N_h"; provenance envelopes | `POLICY_SCHEMA_VERSION` |
 
-Install them alongside this package:
+Install memory alongside this package to enable persistence:
 
 ```sh
-npm install @justfortytwo/telegram @justfortytwo/memory @justfortytwo/gate
+npm install @justfortytwo/telegram @justfortytwo/memory
 ```
 
 The **memory** data path is wired: the bridge opens + migrates the memory DB at
@@ -85,8 +133,8 @@ startup and **persists each channel event** to `@justfortytwo/memory`; recall
 happens inside the headless `claude` turn via the Memory MCP tools. If the memory
 peer is absent, the bridge degrades to **channel-only** (messages relay but are
 not persisted) rather than refusing to start. The **gate** "Allow _N_h" path
-still uses a local bash-allowlist fallback; wiring it to `@justfortytwo/gate`'s
-exact-command allowlist is the remaining seam.
+still uses a local placeholder; wiring it to `@justfortytwo/gate`'s
+exact-command allowlist remains a stub, as does the cross-process pending-decision write. This migration preserves those existing seams; it does not implement gate permissions.
 
 ## Environment
 
@@ -95,7 +143,6 @@ exact-command allowlist is the remaining seam.
 | `TELEGRAM_BOT_TOKEN` | yes | Bot token. The bridge is the **only** long-poller on this bot. |
 | `ALLOWED_CHAT_IDS` | bootstrap | Comma-separated chat IDs allowed before any binding exists. Optional once bindings exist. |
 | `CLAUDE_BIN` | no | Path to the `claude` binary (default `claude`). |
-| `FORTYTWO_TURN_TIMEOUT` | no | Hard cap (seconds) on a single turn so a stalled model can't wedge the bridge (default 300). |
 | `FORTYTWO_BASH_ALLOW_TTL_HOURS` | no | Default TTL (hours) for "Allow _N_h" bash approvals (default 8). |
 | `TELEGRAM_BINDINGS_DB` | no | Path to the self-owned bindings db (default `state/telegram-bindings.db`). |
 | `DB_PATH` | no | Path to the memory DB the bridge opens/migrates at startup (default `db/fortytwo.db`, relative to `FORTYTWO_ROOT`). |
@@ -104,7 +151,7 @@ exact-command allowlist is the remaining seam.
 | `ASSISTANT_NAME` / `ASSISTANT_ACTOR` / `OWNER_ACTOR` | no | Display name + journal actor labels. |
 | `FORTYTWO_ROOT` | no | Working root for the headless `claude` process + state files. |
 
-> The historical `FORD_*` names (`FORD_ROOT`, `FORD_TURN_TIMEOUT`,
+> The historical `FORD_*` names (`FORD_ROOT`,
 > `FORD_BASH_ALLOW_TTL_HOURS`) are still honored as deprecated aliases — set the
 > `FORTYTWO_*` equivalents in new deployments.
 

package/dist/bridge.d.ts

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
-import { type TgMessage, type AttachmentSpec } from './telegram.js';
+import { ChatSessions } from './chat-sessions.js';
+import { Telegram, type TgMessage, type AttachmentSpec } from './telegram.js';
 import { type Attachment } from './attachments.js';
+import { type AuthContext } from './login.js';
 import type { SourceKind } from '@justfortytwo/gate';
-import type { MemoryInput } from '@justfortytwo/memory';
+import type { DbHandles as MemDbHandles, Embedder as MemEmbedder, MemoryInput } from '@justfortytwo/memory';
+type DbHandles = MemDbHandles | null;
+type Embedder = MemEmbedder | null;
 interface ChannelEvent {
     channel: string;
     direction: string;
@@ -15,6 +19,16 @@ interface ChannelEvent {
 }
 /** Map a channel event onto memory's generic MemoryInput (content + provenance). */
 export declare function mapChannelEventToMemoryInput(entry: ChannelEvent): MemoryInput;
+/**
+ * Load the optional memory engine: open + migrate the DB and build an embedder
+ * (Ollama when EMBED_MODEL is set, else a deterministic fake). Returns null
+ * handles when memory is not installed or fails to open — the bridge then runs
+ * channel-only rather than refusing to start.
+ */
+export declare function loadMemoryEngine(dbPath: string): Promise<{
+    h: DbHandles;
+    embedder: Embedder;
+}>;
 export interface DeferredTool {
     id: string;
     name: string;
@@ -28,13 +42,6 @@ export interface Interpreted {
 /** Read a `claude -p --output-format json` result into a reply OR a deferred tool. */
 export declare function interpretResult(r: any): Interpreted;
 export declare function formatApprovalCard(d: DeferredTool, bashTtlHours?: number): string;
-export interface Schedule {
-    name: string;
-    minute: number;
-    hour: number;
-    dow?: number;
-    trigger: string;
-}
 export declare function telegramSourceKind(message: TgMessage): SourceKind;
 export declare function hasHandleableContent(message: TgMessage): boolean;
 export declare function telegramCommandReply(text: string): string | undefined;
@@ -57,7 +64,19 @@ export declare function ingestMessageAttachments(io: AttachmentIo, message: TgMe
     attachments: Attachment[];
     skipped: AttachmentSpec[];
 }>;
-export declare const SCHEDULES: Schedule[];
-/** Schedules whose cron slot matches `now` and haven't fired in this slot yet. */
-export declare function dueSchedules(now: Date, fired: Record<string, string>): Schedule[];
+export interface BridgeState {
+    lastUpdateId: number;
+    sessions: Record<number, string>;
+    pending: Record<number, {
+        toolUseId: string;
+        sessionId?: string;
+        toolName?: string;
+        input?: Record<string, unknown>;
+    }>;
+}
+export declare function createBridgeSessions(tg: Telegram, state: BridgeState, h: DbHandles, embedder: Embedder): ChatSessions;
+export declare function handleInbound(tg: Telegram, auth: AuthContext, state: BridgeState, h: DbHandles, embedder: Embedder, chatId: number, message: TgMessage, sessions: ChatSessions): Promise<void>;
+/** Handle an inline-keyboard tap on an approval card. */
+export declare function handleCallback(tg: Telegram, state: BridgeState, h: DbHandles, embedder: Embedder, chatId: number, cbId: string, data: string, cardMessageId: number, sessions: ChatSessions): Promise<void>;
+export declare function pollLoop(tg: Telegram, auth: AuthContext, state: BridgeState, h: DbHandles, embedder: Embedder, sessions: ChatSessions, signal: AbortSignal): Promise<void>;
 export {};

package/dist/bridge.js

@@ -2,12 +2,12 @@
 // Telegram bridge adapter. Always-on process (tmux / wakeup loop). It does:
 //   1. Long-poll Telegram, authorize each inbound against persisted bindings ∪
 //      ALLOWED_CHAT_IDS bootstrap (login.ts), journal inbound on receipt, drive a
-//      headless `claude -p` per chat, and transport the assistant's reply back.
+//      persistent RunnerSession per chat, and transport the assistant's reply back.
 //   2. Approval UX: when the gate defers an [external]/[irreversible] call the
 //      headless turn ends with stop_reason tool_deferred; surface a card with an
 //      inline keyboard (Approve/Deny). The tap records the decision + resumes so
 //      the one-shot allow fires.
-//   3. Proactive wakes (scheduler): invoke `claude -p` at the spec's cron times.
+//   3. Proactive wakes are handled by @justfortytwo/scheduler (external daemon).
 //
 // CROSS-PACKAGE NOTE: this bridge orchestrates two PEER packages —
 //   - @justfortytwo/memory : memory store, jobs, pending-decision records, embeds.
@@ -15,10 +15,12 @@
 // Their imports below are STUBBED with `// TODO(wire):` markers. We do not
 // copy their code; we declare them as peerDependencies and reference the
 // contract names (MEMORY_TOOL_CONTRACT_VERSION, POLICY_SCHEMA_VERSION).
-import { spawn } from 'node:child_process';
 import { readFileSync, writeFileSync, existsSync, mkdirSync, realpathSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRunner } from '@justfortytwo/runner';
+import { ChatSessions } from './chat-sessions.js';
+import { enqueueReply } from './notify.js';
 import { Telegram, parseAllowed, approvalKeyboard, messageAttachmentSpecs } from './telegram.js';
 import { buildAttachment, inboxRelPath, withinSizeLimit, extensionFor } from './attachments.js';
 import { loadAdaptersConfig } from './adapters-config.js';
@@ -45,13 +47,16 @@ export function mapChannelEventToMemoryInput(entry) {
 }
 // memory.store, captured by loadMemoryEngine when the peer is present.
 let memStore = null;
+// memory job helpers, captured when the peer is present.
+let memEnqueue = null;
+let memExistsPending = null;
 /**
  * Load the optional memory engine: open + migrate the DB and build an embedder
  * (Ollama when EMBED_MODEL is set, else a deterministic fake). Returns null
  * handles when memory is not installed or fails to open — the bridge then runs
  * channel-only rather than refusing to start.
  */
-async function loadMemoryEngine(dbPath) {
+export async function loadMemoryEngine(dbPath) {
     let mod;
     try {
         mod = (await import('@justfortytwo/memory'));
@@ -69,6 +74,8 @@ async function loadMemoryEngine(dbPath) {
             ? new mod.OllamaEmbedder(embedModel, process.env.OLLAMA_BASE_URL)
             : new mod.FakeEmbedder();
         memStore = mod.store;
+        memEnqueue = mod.enqueue;
+        memExistsPending = mod.existsPending;
         console.log(`[bridge] memory wired (db=${dbPath}, embedder=${embedModel ? 'ollama:' + embedModel : 'fake'}).`);
         return { h, embedder };
     }
@@ -77,16 +84,30 @@ async function loadMemoryEngine(dbPath) {
         return { h: null, embedder: null };
     }
 }
+/**
+ * Build an EnqueueReplyDeps bound to the bridge's memory handle.
+ * Returns null when memory is not wired (channel-only mode).
+ *
+ * FLAG: the trigger condition for enqueueReply is best-effort. The bridge
+ * does not have a hard "busy/unreachable" state — it's used here in the
+ * pollLoop error handler when a message cannot be delivered inline, so the
+ * scheduler can drain it later. The dedup + DI is the primary deliverable.
+ */
+function makeEnqueueReplyDeps(h) {
+    if (!h || !memEnqueue || !memExistsPending)
+        return null;
+    const boundEnqueue = memEnqueue.bind(null, h);
+    const boundExistsPending = memExistsPending.bind(null, h);
+    return {
+        enqueue: (j) => boundEnqueue(j),
+        existsPending: (kind, id) => boundExistsPending(kind, id),
+    };
+}
 async function store(h, e, entry) {
     if (!h || !e || !memStore)
         return 0; // channel-only mode
     return memStore(h, e, mapChannelEventToMemoryInput(entry));
 }
-async function addJob(_h, _item) {
-    // No-op: the standalone memory server embeds inline on `store`, so there is no
-    // separate reembed job, and the deferred-jobs runner was left out of memory's scope.
-    return 0;
-}
 async function setPendingDecisionByToolUseId(_h, _tuid, _status, _by) {
     // Best-effort no-op: the authoritative one-shot approval lives in the gate's
     // store and is consumed when the headless turn re-fires the deferred call; the
@@ -220,86 +241,33 @@ function telegramSourceMeta(message) {
         },
     };
 }
-export const SCHEDULES = [
-    { name: 'daily-briefing', minute: 57, hour: 7, trigger: 'Run the daily-briefing skill and send me the rundown for today.' },
-    { name: 'sweep-afternoon', minute: 3, hour: 13, trigger: 'Open-thread sweep: check pending approvals and threads awaiting a reply; give me a one-line status.' },
-    { name: 'sweep-evening', minute: 3, hour: 18, trigger: 'Open-thread sweep: check pending approvals and threads awaiting reply; one-line status.' },
-    { name: 'learn-review', minute: 17, hour: 9, dow: 0, trigger: 'Run the learn-review skill: scan the recent Journal for patterns worth promoting. Propose-only — nothing installed.' },
-];
-/** Schedules whose cron slot matches `now` and haven't fired in this slot yet. */
-export function dueSchedules(now, fired) {
-    const slot = (s) => `${s.name}-${now.toISOString().slice(0, 13)}`; // dedupe within the hour
-    return SCHEDULES.filter((s) => {
-        if (now.getMinutes() !== s.minute || now.getHours() !== s.hour)
-            return false;
-        if (s.dow !== undefined && now.getDay() !== s.dow)
-            return false;
-        return fired[slot(s)] !== '1';
-    });
-}
 function loadState() {
     if (existsSync(STATE_PATH)) {
         try {
-            return { lastUpdateId: 0, sessions: {}, pending: {}, fired: {}, ...JSON.parse(readFileSync(STATE_PATH, 'utf8')) };
+            return { lastUpdateId: 0, sessions: {}, pending: {}, ...JSON.parse(readFileSync(STATE_PATH, 'utf8')) };
         }
         catch { /* fall through */ }
     }
-    return { lastUpdateId: 0, sessions: {}, pending: {}, fired: {} };
+    return { lastUpdateId: 0, sessions: {}, pending: {} };
 }
 function saveState(s) {
     mkdirSync(dirname(STATE_PATH), { recursive: true });
     writeFileSync(STATE_PATH, JSON.stringify(s, null, 2));
 }
-// --- claude driver ---
-function runClaude(prompt, sessionId) {
-    const args = ['-p', prompt, '--output-format', 'json'];
-    if (sessionId)
-        args.push('--resume', sessionId);
-    // Hard cap so a stalled proxy/model turn can't wedge the bridge. Seconds;
-    // generous default so legit long turns (orient/briefing) still complete.
-    const timeoutSec = Number(envCompat(process.env, 'FORTYTWO_TURN_TIMEOUT', 'FORD_TURN_TIMEOUT') ?? 300);
-    return new Promise((resolveTurn) => {
-        const child = spawn(CLAUDE_BIN, args, {
-            cwd: ROOT,
-            // The assistant's canonical memory is the Memory MCP — skip Claude Code's
-            // built-in file-memory so context isn't double-booked. Scoped to bridge turns.
-            env: { ...process.env, CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1' },
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        let out = '';
-        let err = '';
-        let settled = false;
-        const finish = (r) => { if (!settled) {
-            settled = true;
-            clearTimeout(timer);
-            resolveTurn(r);
-        } };
-        const timer = setTimeout(() => {
-            child.kill('SIGTERM');
-            console.error(`[bridge] turn aborted after ${timeoutSec}s (timeout)`);
-            finish({ result: `⏳ ${ASSISTANT_NAME}'s turn exceeded ${timeoutSec}s and was aborted (the proxy/model may have stalled). Try again.` });
-        }, timeoutSec * 1000);
-        child.stdout.on('data', (d) => { out += d; });
-        child.stderr.on('data', (d) => { err += d; });
-        child.on('error', (e) => finish({ result: `(claude failed to start: ${e.message})` }));
-        child.on('close', () => {
-            try {
-                finish(JSON.parse(out));
-            }
-            catch {
-                finish({ result: (out || err).slice(0, 4000) || '(empty claude response)' });
-            }
-        });
+// --- persistent Claude sessions ---
+export function createBridgeSessions(tg, state, h, embedder) {
+    const runner = createRunner({ bin: CLAUDE_BIN, cwd: ROOT, env: { CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1' } });
+    return new ChatSessions(runner, tg, {
+        ids: state.sessions,
+        persist: () => saveState(state),
+        onResult: (chatId, result, text) => respond(tg, h, embedder, state, chatId, result, text),
     });
 }
 // --- I/O glue ---
 async function logBridgeEntry(h, embedder, entry) {
-    // TODO(wire): @justfortytwo/memory `store` (mcp__fortytwo-memory__store) — the
-    //   generic memory write that replaces the original assistant's old logEntry/log_entry tool.
-    const id = await store(h, embedder, entry);
-    // TODO(wire): @justfortytwo/memory job kind 'reembed_memory'.
-    await addJob(h, { kind: 'reembed_memory', payload: { memory_id: id }, max_attempts: 5 });
-    return id;
+    // memory's store() inline-enqueues a reembed_memory job when needed; no
+    // separate addJob call required here (that stub has been removed).
+    return store(h, embedder, entry);
 }
 async function sendReply(tg, chatId, placeholderId, text) {
     if (placeholderId !== null && text && text.length <= 4000) {
@@ -311,27 +279,23 @@ async function sendReply(tg, chatId, placeholderId, text) {
     }
     await tg.sendMessage(chatId, text || '(no reply)');
 }
-async function respond(tg, h, embedder, state, chatId, placeholderId, result) {
-    if (result?.session_id)
-        state.sessions[chatId] = result.session_id;
-    const interp = interpretResult(result);
-    if (interp.deferred) {
+async function respond(tg, h, embedder, state, chatId, result, text) {
+    // Raw result access is confined to the existing gate compatibility seam.
+    const deferred = interpretResult(result.raw).deferred;
+    if (deferred) {
         state.pending[chatId] = {
-            toolUseId: interp.deferred.id, sessionId: result?.session_id,
-            toolName: interp.deferred.name, input: interp.deferred.input,
+            toolUseId: deferred.id, sessionId: state.sessions[chatId],
+            toolName: deferred.name, input: deferred.input,
         };
-        console.log(`[bridge] chat ${chatId}: action deferred (${interp.deferred.name}) — approval card sent`);
-        const keyboardOpts = interp.deferred.name === 'Bash' ? { bashTtlHours: BASH_ALLOW_TTL_HOURS } : {};
-        await tg.sendMessage(chatId, formatApprovalCard(interp.deferred), approvalKeyboard(interp.deferred.id, keyboardOpts));
-    }
-    else {
-        const text = interp.reply ?? '(no reply)';
-        await logBridgeEntry(h, embedder, { channel: 'telegram', direction: 'outbound', actor: ASSISTANT_ACTOR, kind: 'message', content: text });
-        console.log(`[bridge] chat ${chatId}: replied (${text.length} chars)`);
-        await sendReply(tg, chatId, placeholderId, text);
+        saveState(state);
+        const keyboardOpts = deferred.name === 'Bash' ? { bashTtlHours: BASH_ALLOW_TTL_HOURS } : {};
+        await tg.sendMessage(chatId, formatApprovalCard(deferred), approvalKeyboard(deferred.id, keyboardOpts));
+        return true;
     }
+    await logBridgeEntry(h, embedder, { channel: 'telegram', direction: 'outbound', actor: ASSISTANT_ACTOR, kind: 'message', content: text });
+    return false;
 }
-async function handleInbound(tg, auth, state, h, embedder, chatId, message) {
+export async function handleInbound(tg, auth, state, h, embedder, chatId, message, sessions) {
     const text = message.text ?? '';
     // --- AUTH GATE (lockdown) -------------------------------------------------
     // Auth commands (/login, /logout) and the unbound-sender drop are handled
@@ -345,6 +309,7 @@ async function handleInbound(tg, auth, state, h, embedder, chatId, message) {
                 await sendReply(tg, chatId, null, action.reply);
                 return;
             case 'logout':
+                await sessions.close(chatId);
                 console.log(`[bridge] chat ${chatId}: unbound`);
                 await sendReply(tg, chatId, null, action.reply);
                 return;
@@ -363,7 +328,6 @@ async function handleInbound(tg, auth, state, h, embedder, chatId, message) {
         }
     }
     // --- end auth gate --------------------------------------------------------
-    const t0 = Date.now();
     const io = {
         download: async (fileId) => tg.downloadFile(await tg.getFilePath(fileId)),
         write: (relPath, bytes) => { const abs = resolve(ROOT, relPath); mkdirSync(dirname(abs), { recursive: true }); writeFileSync(abs, bytes); },
@@ -399,14 +363,10 @@ async function handleInbound(tg, auth, state, h, embedder, chatId, message) {
     }
     const prompt = buildInboundPrompt(text, attachments);
     console.log(`[bridge] chat ${chatId}: inbound "${journalContent.slice(0, 50)}" (${attachments.length} att) — waking assistant`);
-    const t1 = Date.now();
-    const result = await withTyping(tg, chatId, () => runClaude(prompt, state.sessions[chatId]));
-    const claudeMs = Date.now() - t1;
-    await respond(tg, h, embedder, state, chatId, null, result);
-    console.log(`[bridge] chat ${chatId}: turn ${Date.now() - t0}ms (claude ${claudeMs}ms)`);
+    await sessions.send(chatId, prompt);
 }
 /** Handle an inline-keyboard tap on an approval card. */
-async function handleCallback(tg, state, h, embedder, chatId, cbId, data, cardMessageId) {
+export async function handleCallback(tg, state, h, embedder, chatId, cbId, data, cardMessageId, sessions) {
     const sep = data.indexOf(':');
     const action = sep >= 0 ? data.slice(0, sep) : data;
     const tuid = sep >= 0 ? data.slice(sep + 1) : '';
@@ -443,8 +403,8 @@ async function handleCallback(tg, state, h, embedder, chatId, cbId, data, cardMe
         delete state.pending[chatId];
         await tg.answerCallbackQuery(cbId, statusText).catch(() => { });
         await tg.editMessageText(chatId, cardMessageId, `${statusText}...`).catch(() => { });
-        const result = await withTyping(tg, chatId, () => runClaude('Approved - proceed with the deferred action now.', pending.sessionId));
-        await respond(tg, h, embedder, state, chatId, null, result);
+        saveState(state);
+        await sessions.send(chatId, 'Approved - proceed with the deferred action now.', pending.sessionId);
     }
     else {
         console.log(`[bridge] chat ${chatId}: denied ${tuid}`);
@@ -454,18 +414,24 @@ async function handleCallback(tg, state, h, embedder, chatId, cbId, data, cardMe
         await tg.editMessageText(chatId, cardMessageId, 'Denied - the action was not run.').catch(() => { });
     }
 }
-async function pollLoop(tg, auth, state, h, embedder) {
-    while (true) {
+export async function pollLoop(tg, auth, state, h, embedder, sessions, signal) {
+    // Pre-build dedup deps once; null when memory is unavailable (channel-only).
+    const replyDeps = makeEnqueueReplyDeps(h);
+    while (!signal.aborted) {
         let updates = [];
         try {
-            updates = await tg.getUpdates(state.lastUpdateId + 1);
+            updates = await tg.getUpdates(state.lastUpdateId + 1, 30, signal);
         }
         catch (e) {
+            if (signal.aborted)
+                break;
             console.error(`[bridge] getUpdates error: ${e?.message}; retrying in 5s`);
             await sleep(5000);
             continue;
         }
         for (const u of updates) {
+            if (signal.aborted)
+                break;
             state.lastUpdateId = Math.max(state.lastUpdateId, u.update_id);
             const chatId = u.message?.chat?.id ?? u.callback_query?.message?.chat?.id;
             if (chatId === undefined)
@@ -475,60 +441,44 @@ async function pollLoop(tg, auth, state, h, embedder) {
             // chat has no pending card, but we still gate to be safe.
             try {
                 if (u.message && hasHandleableContent(u.message)) {
-                    await handleInbound(tg, auth, state, h, embedder, chatId, u.message);
+                    await handleInbound(tg, auth, state, h, embedder, chatId, u.message, sessions);
                 }
                 else if (u.callback_query?.data && u.callback_query.message) {
                     if (!isAuthorized(auth, chatId)) {
                         console.log(`[bridge] chat ${chatId}: callback dropped (unbound, lockdown)`);
                         continue;
                     }
-                    await handleCallback(tg, state, h, embedder, chatId, u.callback_query.id, u.callback_query.data, u.callback_query.message.message_id);
+                    await handleCallback(tg, state, h, embedder, chatId, u.callback_query.id, u.callback_query.data, u.callback_query.message.message_id, sessions);
                 }
             }
             catch (e) {
+                if (signal.aborted)
+                    break;
                 console.error(`[bridge] handler error: ${e?.message}`);
                 if (isAuthorized(auth, chatId)) {
+                    const errMsg = `⚠️ Something went wrong handling that: ${e?.message ?? e}`;
+                    // Best-effort inline reply; on failure, enqueue via scheduler so the
+                    // reply is delivered when the bridge recovers (dedup guards against
+                    // double-delivery if the inline send succeeds on retry).
+                    // FLAG: this is a conservative wiring — the "unreachable" trigger is
+                    // a handler exception, not a true busy/offline state. The dedup
+                    // helper + its tests are the primary deliverable of Part C.
+                    let inlineSent = false;
                     try {
-                        await tg.sendMessage(chatId, `⚠️ Something went wrong handling that: ${e?.message ?? e}`);
+                        await tg.sendMessage(chatId, errMsg);
+                        inlineSent = true;
                     }
                     catch { /* ignore */ }
+                    if (!inlineSent && replyDeps) {
+                        await enqueueReply(replyDeps, chatId, errMsg, new Date().toISOString());
+                    }
                 }
             }
             saveState(state);
         }
     }
 }
-async function schedulerLoop(tg, state, h, embedder, ownerChatId) {
-    while (true) {
-        const now = new Date();
-        for (const s of dueSchedules(now, state.fired)) {
-            state.fired[`${s.name}-${now.toISOString().slice(0, 13)}`] = '1';
-            saveState(state);
-            console.log(`[bridge] scheduled wake: ${s.name}`);
-            try {
-                await logBridgeEntry(h, embedder, { channel: 'internal', direction: 'internal', actor: ASSISTANT_ACTOR, kind: 'wake', content: `scheduled: ${s.name}` });
-                const result = await runClaude(s.trigger);
-                await respond(tg, h, embedder, state, ownerChatId, null, result);
-            }
-            catch (e) {
-                console.error(`[bridge] schedule ${s.name} failed: ${e?.message}`);
-            }
-        }
-        await sleep(60_000);
-    }
-}
 function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
-/** Shows Telegram's native "typing…" indicator (refreshed every 4s) while `fn` runs. */
-async function withTyping(tg, chatId, fn) {
-    await tg.sendChatAction(chatId, 'typing').catch(() => { });
-    const iv = setInterval(() => tg.sendChatAction(chatId, 'typing').catch(() => { }), 4000);
-    try {
-        return await fn();
-    }
-    finally {
-        clearInterval(iv);
-    }
-}
 // --- main ---
 async function main() {
     const token = process.env.TELEGRAM_BOT_TOKEN;
@@ -550,16 +500,27 @@ async function main() {
         console.error('[bridge] no ALLOWED_CHAT_IDS bootstrap and no existing bindings — nobody can reach the bridge. Set ALLOWED_CHAT_IDS or pre-seed a binding.');
         process.exit(1);
     }
-    const ownerChatId = bootstrap.size ? [...bootstrap][0] : Number(store.list('telegram')[0].channelUserId);
     // Persist channel events to the memory store (optional peer; channel-only if absent).
     const dbPath = process.env.DB_PATH ? resolve(ROOT, process.env.DB_PATH) : resolve(ROOT, 'db', 'fortytwo.db');
     const { h, embedder } = await loadMemoryEngine(dbPath);
     const tg = new Telegram(token, bootstrap);
     const state = loadState();
-    console.log(`[bridge] up. owner chat=${ownerChatId}, bootstrap=${bootstrap.size}, bindings=${store.list('telegram').length}, bindingsDb=${BINDINGS_DB_PATH}`);
-    // Proactive wakes + polling run concurrently. (jobLoop runs once memory is wired.)
-    void schedulerLoop(tg, state, h, embedder, ownerChatId);
-    await pollLoop(tg, auth, state, h, embedder);
+    console.log(`[bridge] up. bootstrap=${bootstrap.size}, bindings=${store.list('telegram').length}, bindingsDb=${BINDINGS_DB_PATH}`);
+    // Proactive wakes are now handled by @justfortytwo/scheduler (external daemon).
+    const sessions = createBridgeSessions(tg, state, h, embedder);
+    const controller = new AbortController();
+    const shutdown = () => { controller.abort(); void sessions.closeAll(); };
+    process.once('SIGINT', shutdown);
+    process.once('SIGTERM', shutdown);
+    try {
+        await pollLoop(tg, auth, state, h, embedder, sessions, controller.signal);
+    }
+    finally {
+        controller.abort();
+        await sessions.closeAll();
+        process.off('SIGINT', shutdown);
+        process.off('SIGTERM', shutdown);
+    }
 }
 // Run only when invoked directly (the bin / node dist/bridge.js), not when
 // imported by tests. Realpath comparison so the npm bin symlink resolves here.
@@ -574,6 +535,11 @@ function invokedAsBin() {
         return false;
     }
 }
-if (invokedAsBin())
-    main();
+// main() resolves only after polling stopped and closeAll() awaited every Claude
+// process and queued delivery. Exit naturally so piped stdout/stderr can flush; the
+// unref'd timer forces exit only if an unrelated handle would keep the process up.
+if (invokedAsBin()) {
+    main().then(() => { process.exitCode = 0; }, (e) => { console.error('[bridge] fatal:', e); process.exitCode = 1; })
+        .finally(() => { setTimeout(() => process.exit(), 2000).unref(); });
+}
 //# sourceMappingURL=bridge.js.map