omp-conductor 0.15.7 → 0.15.8

package/README.md

@@ -1497,7 +1497,10 @@ omitted — so an orchestrator that helpfully supplied `chat_id` (and nothing
 else) answered three topic messages in the main chat instead (#366). The
 orchestrator floor now says to name **neither** target or **both**, and the
 dispatcher refuses `chat_id` without `thread_id` for a project that configured
-`escalation.telegramTopicId`. A flat-chat project is unaffected.
+`escalation.telegramTopicId`. A flat-chat project is unaffected. When a pinned
+topic id has gone stale — the bridge re-claims pane topics across restarts — the
+live claim named for the project is used instead, so a restart does not quietly
+move every page into the main chat (#407).
 
 A locally injected tick has no inbound message to inherit a topic from, so a
 bare `telegram_send` there has nothing to preserve. That turn addresses the
@@ -1924,6 +1927,7 @@ Field notes:
 | `migrations` | Optional, per repo: `{ "dir": "backend/alembic/versions" }`. Names the repo-relative directory of an Alembic-style ordered migration chain (`revision` / `down_revision` in `*.py`). When set, `conductor_pr_merge` **refuses** a merge that would corrupt the chain at the base tip: reusing a revision id another file already declares, deleting a published migration, or a merge that would leave the combined graph with more than one head (so a stale parent is refused, and a fork-repair merge migration that unifies the heads passes). Absent means the repo opts out of the chain check entirely. Repo-relative only: a leading `/` or `..` is an error. |
 | `caps` | Per-project overrides; omit it or pin only the fields you want to change. |
 | `escalation.fallbackToIssueComment` | Defaults to `true`. Absent means "yes, still tell me". |
+| `escalation.telegramTopicId` | Optional forum topic for everything conductor sends: tier-2 pages, reports, digests, arm challenges, `omp-conductor message`. Setup offers the topics omp-telegram has claimed. The bridge re-claims a pane's topic across restarts — including the restarts `upgrade` and `restart` perform — so a pinned id that is no longer claimed is replaced at send time by the live claim whose name matches the project, logged without ids (#407). A pin that is still claimed always wins, so a deliberately separate topic is never hijacked. Absent keeps flat-chat behaviour. |
 | `escalation.orchestrator` | Optional; `"embedded"` (default) or `"external"`. `external` means an orchestrator session already runs elsewhere: the daemon starts none, and tier-1 escalations post as issue comments for that session to drain. Any other value is an error. |
 | `authority` | Optional; `{ "merge": …, "release": … }`, each `"human"` (default) or `"orchestrator"`. It grants nothing to the daemon — it words the orchestrator's standing orders and the Releases paragraph of the rendered brief, so the config and the prompt cannot disagree about who holds the merge button. Unknown keys and any other value are errors, never folded to the default. |
 | `releasePolicy` | Optional; a per-shape map whose values are `"human"` (default) or `"orchestrator"`. Shapes are `version-bump-pr`, `git-tag`, `git-push-tags`, `package-publish`, `github-release`, and `deploy`. The legacy `"none"` denies every shape; legacy `"operator-brief"` grants the artifact-producing shapes, including reviewed version preparation, but keeps deploy human-owned. The in-session tripwire blocks recognised raw release/deploy calls before execution. Every rejection is written to `release-policy-blocks.jsonl`; the heartbeat carries that day's count into the daily digest. This is the mechanical gate; `authority.release` still says who owns the decision. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.15.7",
+  "version": "0.15.8",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/cli.ts

@@ -1367,8 +1367,9 @@ try {
       }
       process.stdout.write(
         outcome.kind === "sent"
-          ? `message delivered to ${project.name}'s configured Telegram ` +
-              `${project.escalation.telegramTopicId === undefined ? "chat" : "project topic"} (${outcome.category})\n`
+          ? // Not "into the topic": a stale topic degrades to the flat chat with
+            // its own warning on stderr, and this line must not contradict it.
+            `message delivered to ${project.name}'s configured Telegram target (${outcome.category})\n`
           : `held notice ${outcome.noticeId} queued for ${project.name} (${outcome.category}; ` +
               `${outcome.reason === "availability" ? "outside the availability window" : "a digest-only category"})\n` +
               "nothing was sent; the daemon releases it with the next digest or working-hours catch-up\n",

package/src/escalate.ts

@@ -269,7 +269,7 @@ export function createEscalator(
           // the tick re-raises it. A *report* has no such source — it exists
           // once, in the model's head, and nothing regenerates it — which is
           // why that one needed a ledger and this one does not.
-          await sendTelegram(token, chatId, text, { topicId: p.escalation.telegramTopicId });
+          await sendTelegram(token, chatId, text, { topicId: resolveProjectTopicId(p) });
           store.markNotified(key);
           return;
         }
@@ -350,6 +350,74 @@ export function readTelegramToken(): string | undefined {
   return undefined;
 }
 
+/**
+ * The forum topic a project's Telegram actually lives in *now*.
+ *
+ * `escalation.telegramTopicId` is pinned by the wizard from the topics
+ * omp-telegram had claimed at setup time — but the bridge re-claims a pane's
+ * topic across restarts, and conductor restarts that service itself during
+ * `upgrade` and `restart`. The pinned id therefore goes stale on the fleet's
+ * own maintenance, and every topic-addressed send silently degrades to the main
+ * chat: tier-2 pages, reports, digests, arm challenges, direct messages (#407).
+ *
+ * The operator's pin still wins whenever it is live. Only a pin that is
+ * *provably* absent from the current claims is replaced, and only by the claim
+ * whose name is this project's — so a deliberately separate alerts topic is
+ * never hijacked by the pane's own thread. Unreadable bridge state changes
+ * nothing, and #318's stale-topic retry remains the last line of defence.
+ *
+ * The substitution is logged, naming the project and the claim's name. Never an
+ * id: a log line is a place these leak from.
+ */
+export function resolveProjectTopicId(project: ProjectConfig): number | undefined {
+  const pinned = project.escalation.telegramTopicId;
+  if (pinned === undefined) return undefined;
+  const claims = claimedTelegramTopics();
+  if (claims.length === 0) return pinned;
+  if (claims.some((claim) => claim.threadId === pinned)) return pinned;
+  const named = claims.find((claim) => claim.name === project.name);
+  if (named === undefined) return pinned;
+  warn(
+    `escalation.telegramTopicId for ${project.name} is no longer a claimed topic; ` +
+      `following omp-telegram's current "${named.name}" claim instead`,
+  );
+  return named.threadId;
+}
+
+/**
+ * omp-telegram's live topic claims: `{ threads: { "<threadId>": { name } } }`.
+ * Borrowed exactly as the token is, and tolerant of every shape it might not
+ * be — a bridge that has never run a forum pane has no file at all.
+ *
+ * `stateDir` is passed by the setup wizard, which has already probed for the
+ * bridge; send-time callers let it resolve the same way the token does.
+ */
+export function claimedTelegramTopics(stateDir?: string): Array<{ threadId: number; name: string }> {
+  const override = stateDir?.trim() ?? process.env.OMP_TELEGRAM_STATE_DIR?.trim();
+  const dir = override ? override : join(homedir(), ".omp", "agent", "telegram");
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(join(dir, "threads.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw) || !("threads" in raw)) return [];
+  const threads = raw.threads;
+  if (typeof threads !== "object" || threads === null || Array.isArray(threads)) return [];
+  const out: Array<{ threadId: number; name: string }> = [];
+  for (const [id, entry] of Object.entries(threads)) {
+    const threadId = Number(id);
+    if (!Number.isFinite(threadId) || !Number.isSafeInteger(threadId)) continue;
+    let name = id;
+    if (typeof entry === "object" && entry !== null && "name" in entry) {
+      const candidate = entry.name;
+      if (typeof candidate === "string" && candidate.trim() !== "") name = candidate.trim();
+    }
+    out.push({ threadId, name });
+  }
+  return out;
+}
+
 /**
  * The one Telegram send in this package. Exported so the report outbox (#123)
  * reuses it rather than forking it: the response handling below is load-bearing

package/src/fleet.ts

@@ -29,7 +29,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { formatZonedMinute } from "./availability.ts";
 import { findProject, loadConfig, stateDir } from "./config.ts";
-import { sendTelegram } from "./escalate.ts";
+import { resolveProjectTopicId, sendTelegram } from "./escalate.ts";
 import { planUsageLine, readPlanUsage, sharedUsageSource } from "./usage.ts";
 import { readApprovalSurface, readDaemonProfile } from "./approval-surface.ts";
 import { inspectBriefLayout } from "./brief-upgrade.ts";
@@ -349,12 +349,13 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
     `Reply to this chat with exactly:\n${code}\n` +
     `Nothing will be dispatched until that reply is seen in the orchestrator session.`;
 
-  // Prefer the project's configured forum topic so arm challenges land where
-  // escalations already do (#318). Missing project config keeps flat-chat 0.13.
+  // Prefer the project's live forum topic so arm challenges land where
+  // escalations already do (#318), following the bridge's current claim when the
+  // pinned id has gone stale (#407). Missing project config keeps flat-chat 0.13.
   let topicId: number | undefined;
   if (named !== undefined) {
     try {
-      topicId = findProject(loadConfig(), named).escalation.telegramTopicId;
+      topicId = resolveProjectTopicId(findProject(loadConfig(), named));
     } catch {
       /* no project config */
     }

package/src/reports.ts

@@ -37,7 +37,7 @@
  */
 
 import { availabilityDisposition, interruptDisposition } from "./availability.ts";
-import { readTelegramToken, sendTelegram, TelegramSendError } from "./escalate.ts";
+import { readTelegramToken, resolveProjectTopicId, sendTelegram, TelegramSendError } from "./escalate.ts";
 import { localDayKey } from "./digest-schedule.ts";
 import {
   DIGEST_BACKLOG_LIMIT,
@@ -284,7 +284,7 @@ export function telegramReportSend(p: ProjectConfig): ReportSend {
         "definitive",
       );
     }
-    return await sendTelegram(token, chatId, text, { topicId: p.escalation.telegramTopicId });
+    return await sendTelegram(token, chatId, text, { topicId: resolveProjectTopicId(p) });
   };
 }
 

package/src/setup-wizard.ts

@@ -21,6 +21,7 @@ import {
   resolveCaps,
   saveConfig,
 } from "./config.ts";
+import { claimedTelegramTopics } from "./escalate.ts";
 import { hostRamBytes, recommendedMaxWorkers, workerOvercommit } from "./host.ts";
 import {
   prepareConductor,
@@ -1208,7 +1209,7 @@ async function askTelegramTopicId(
   stateDir: string,
   prior: number | undefined,
 ): Promise<number | undefined> {
-  const claimed = readClaimedTelegramTopics(stateDir);
+  const claimed = claimedTelegramTopics(stateDir);
   const manual = "Enter thread id manually";
   const none = "None — flat chat (0.13 behaviour)";
   if (claimed.length > 0) {
@@ -1246,29 +1247,6 @@ async function askTelegramTopicId(
   return n;
 }
 
-function readClaimedTelegramTopics(stateDir: string): Array<{ threadId: number; name: string }> {
-  try {
-    const raw: unknown = JSON.parse(readFileSync(join(stateDir, "threads.json"), "utf8"));
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return [];
-    if (!("threads" in raw)) return [];
-    const threads = raw.threads;
-    if (typeof threads !== "object" || threads === null || Array.isArray(threads)) return [];
-    const out: Array<{ threadId: number; name: string }> = [];
-    for (const [id, entry] of Object.entries(threads)) {
-      const threadId = Number(id);
-      if (!Number.isFinite(threadId) || !Number.isSafeInteger(threadId)) continue;
-      let name = id;
-      if (typeof entry === "object" && entry !== null && "name" in entry) {
-        const candidate = entry.name;
-        if (typeof candidate === "string" && candidate.trim() !== "") name = candidate.trim();
-      }
-      out.push({ threadId, name });
-    }
-    return out;
-  } catch {
-    return [];
-  }
-}
 
 /** How loud the orchestrator is and when the operator permits interruptions. */
 const askReporting: AreaAsker = async (ui, a) => {