polygram 0.10.0-rc.32 → 0.10.0-rc.34

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.10.0-rc.32",
+  "version": "0.10.0-rc.34",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/lib/process/tmux-process.js

@@ -726,13 +726,19 @@ class TmuxProcess extends Process {
       // ~1-2KB → the claude TUI collapses it into a `[Pasted text #N]`
       // placeholder whose single post-paste Enter can be absorbed
       // mid-ingest, leaving the prompt UNSUBMITTED — the turn never
-      // starts. `_confirmSubmitViaJsonl` confirms the submit landed by
+      // starts. `_scheduleSubmitRetries` confirms the submit landed by
       // waiting for this paste's correlation token to surface in a
       // JSONL `user-message` (the ONLY reliable signal — capture-pane
       // false-positives on the collapsed placeholder); it re-sends
       // Enter on a miss and, after bounded retries, REJECTS with
       // TMUX_SUBMIT_FAILED.
       //
+      // 0.10.0 Commit 2: `_scheduleSubmitRetries` is `paste-parked`-
+      // aware. If the predicate observed our paste queued by a busy
+      // TUI (the C1 trace), it waits for the eventual user-message
+      // instead of re-sending Enter / failing loud. See the method
+      // doc.
+      //
       // The confirm drives TWO derived promises below:
       //   submitConfirmP — rejects TMUX_SUBMIT_FAILED → a racer that
       //     fails the turn fast and loud; on success it never settles.
@@ -743,8 +749,10 @@ class TmuxProcess extends Process {
       //     prompt sitting unsubmitted reads as an idle (=="complete")
       //     pane, so the capture racer would win with TMUX_NO_JSONL_TEXT
       //     and mask the real TMUX_SUBMIT_FAILED cause.
+      // (submitConfirmP / submitOkP plumbing is retired in Commit 3's
+      // _runTurn race rewrite — kept here so Commit 2 stays surgical.)
       const confirmP = turn.token
-        ? this._confirmSubmitViaJsonl(turn.token, turn)
+        ? this._scheduleSubmitRetries(turn.token, turn)
         : Promise.resolve();             // no token — nothing to confirm
       const submitConfirmP = confirmP.then(() => new Promise(() => {}));
       const submitOkP = confirmP.then(() => true, () => new Promise(() => {}));
@@ -1021,6 +1029,13 @@ class TmuxProcess extends Process {
     // without a terminal `result` (e.g. turnTimeoutMs) cannot leak
     // its buffered message into turn N+1.
     this._sessionLogTail?.flushParser?.();
+    // Commit 2: clear any lingering submit-confirm waiter for this
+    // turn's token. The parked branch of `_scheduleSubmitRetries`
+    // races the turn's own settle promises so it normally self-cleans,
+    // but a turn that ends via the hard W1 deadline (turnDeadlineP
+    // rejects in `_runTurn`, never resolving `resultPromise`) would
+    // otherwise leave a dangling Map entry. Defensive + cheap.
+    if (turn?.token) this._submitConfirms.delete(turn.token);
     const qi = this.pendingQueue.indexOf(turn);
     if (qi >= 0) this.pendingQueue.splice(qi, 1);
     this._dropFromActiveGroup(turn);
@@ -1674,7 +1689,7 @@ class TmuxProcess extends Process {
     this._confirmPaste(tokens);
     // B7: a user-message is the proof that a primary paste actually
     // STARTED a turn (claude registered the prompt). Release any
-    // _confirmSubmitViaJsonl waiter for these tokens.
+    // _scheduleSubmitRetries waiter for these tokens.
     this._confirmSubmit(tokens);
     let matched = [];
     for (const tok of tokens) {
@@ -1829,7 +1844,7 @@ class TmuxProcess extends Process {
    * TUI into a `[Pasted text #N]` placeholder whose single post-paste
    * Enter can be absorbed mid-ingest, leaving the prompt unsubmitted —
    * but that submit-confirmation runs as a concurrent racer in
-   * `_runTurn` (`_confirmSubmitViaJsonl`), NOT here. Blocking
+   * `_runTurn` (`_scheduleSubmitRetries`), NOT here. Blocking
    * `_pasteAndEnter` on the confirm would hold `_pasteLock` across the
    * whole confirm window and stall every following paste — an autosteer
    * that should fold into the primary turn could never paste.
@@ -1843,7 +1858,7 @@ class TmuxProcess extends Process {
       // (it false-positived on `[Pasted text #N]`). The runner just
       // pastes + Enter. Submit confirmation for a PRIMARY turn is
       // JSONL-token-based and runs as a CONCURRENT racer in `_runTurn`
-      // (`_confirmSubmitViaJsonl`) — NOT here. Blocking `_pasteAndEnter`
+      // (`_scheduleSubmitRetries`) — NOT here. Blocking `_pasteAndEnter`
       // on the confirm would hold `_pasteLock` across the whole confirm
       // window and stall every following paste (an autosteer that
       // SHOULD fold into the primary turn could never paste). The
@@ -1869,17 +1884,33 @@ class TmuxProcess extends Process {
   }
 
   /**
-   * B7: confirm a primary paste actually submitted by waiting for its
+   * Confirm a primary paste actually submitted by waiting for its
    * correlation `token` to surface in a JSONL `user-message`. On each
    * miss, re-send Enter (the prior Enter was absorbed by the TUI's
    * bracketed-paste ingest of a `[Pasted text #N]` block). After
    * `submitConfirmRetries` exhausted misses, throw `TMUX_SUBMIT_FAILED`.
    *
-   * The signal is the `user-message` ONLY — not `queue-operation`. A
-   * `queue-operation enqueue` means the paste was parked in the TUI
-   * queue, which for a primary paste into an idle TUI would itself be
-   * wrong; the genuine "the prompt started a turn" proof is the
-   * `user-message` claude writes when it registers the prompt.
+   * 0.10.0 Commit 2 — `paste-parked`-aware (the C1 fix). The B7
+   * predecessor (`_confirmSubmitViaJsonl`) re-sent Enter on every miss
+   * and failed loud after 5, with NO way to tell "the Enter was
+   * absorbed, the prompt is stuck" (genuine submit failure) apart from
+   * "the TUI was busy and legitimately PARKED the paste in its queue"
+   * (a paste that WILL submit when the prior turn finishes). The
+   * 2026-05-20 C1 trace was the latter failing loud: a paste the TUI
+   * queued got 5 spurious Enter re-sends then `TMUX_SUBMIT_FAILED`.
+   *
+   * The turn-phase predicate now distinguishes them: a
+   * `queue-operation enqueue` carrying THIS turn's `corr-id` (or the
+   * `Press up to edit queued messages` capture-pane fallback) sets
+   * `turn.parked = true`. Once parked:
+   *   - STOP re-sending Enter — the paste is in the TUI queue; another
+   *     Enter could submit a DIFFERENT queued item or double-submit.
+   *   - Do NOT fail loud — the turn is legitimately in flight.
+   *   - Wait (unbounded here) for the eventual `user-message`. The
+   *     `_runTurn` turn deadline (W1) is the only floor; a paste that
+   *     is truly never released fails as `TMUX_TURN_TIMEOUT` (correct
+   *     attribution — the wedged thing is the prior turn, not our
+   *     submission), not `TMUX_SUBMIT_FAILED`.
    *
    * Runs as a concurrent racer in `_runTurn` (NOT a blocking gate in
    * `_pasteAndEnter` — that would hold `_pasteLock` across the confirm
@@ -1888,17 +1919,37 @@ class TmuxProcess extends Process {
    * racer already won, or the turn was killed) the retry loop bails so
    * a stray retry Enter cannot land in an unrelated turn.
    */
-  async _confirmSubmitViaJsonl(token, turn = null) {
+  async _scheduleSubmitRetries(token, turn = null) {
     for (let attempt = 0; attempt <= this.submitConfirmRetries; attempt += 1) {
+      // C1: parked → the paste is safely queued in the TUI. Wait for
+      // the eventual user-message; never re-send Enter, never fail
+      // loud. Checked at the TOP so a paste parked before the first
+      // confirm-wait skips the wait entirely.
+      if (turn && turn.parked) {
+        this.emit('submit-parked', {
+          token,
+          turnId: turn.turnId,
+          attempt,
+          sessionId: this.claudeSessionId,
+          backend: 'tmux',
+        });
+        await this._awaitSubmitOrTerminal(token, turn);
+        return;
+      }
       const confirmed = await this._awaitSubmitConfirm(token);
       if (confirmed) return;                            // submitted ✓
       // The turn already settled some other way (result/capture/kill)
       // — the submit clearly is no longer the open question. Stop:
       // re-sending Enter or throwing now would be wrong.
       if (turn && (turn.state === 'done' || turn.state === 'failed')) return;
+      // The enqueue may have landed DURING the submitConfirmMs wait —
+      // re-check before deciding to re-send Enter. The loop top then
+      // handles the parked branch.
+      if (turn && turn.parked) continue;
       if (attempt === this.submitConfirmRetries) break; // out of retries
-      // The tokened user-message never arrived — the prompt is still
-      // sitting in the input box as `[Pasted text #N]`. Re-send Enter.
+      // The tokened user-message never arrived AND the paste was not
+      // parked — the prompt is still sitting in the input box as
+      // `[Pasted text #N]`. Re-send Enter.
       this.logger.debug?.(
         `[${this.label}] paste not submitted (no user-message for ${token}), `
         + `re-sending Enter (attempt ${attempt + 1})`,
@@ -1920,6 +1971,34 @@ class TmuxProcess extends Process {
     );
   }
 
+  /**
+   * Parked-branch wait (Commit 2): resolve when `token` surfaces in a
+   * JSONL `user-message` (submit landed), or when the owning turn goes
+   * terminal another way (result flushed / interrupted / killed). NO
+   * timeout — the caller's `_runTurn` turn deadline (W1) is the floor.
+   *
+   * Racing the turn's own settle promises prevents a leaked
+   * `_submitConfirms` entry on a turn that ends without ever
+   * producing our user-message (e.g. the prior turn wedges and W1
+   * fires).
+   */
+  _awaitSubmitOrTerminal(token, turn) {
+    return new Promise((resolve) => {
+      let done = false;
+      const finish = () => {
+        if (done) return;
+        done = true;
+        this._submitConfirms.delete(token);
+        resolve();
+      };
+      this._submitConfirms.set(token, finish);   // user-message → finish
+      // Bail if the turn settles via result / interrupt before the
+      // user-message lands.
+      turn?.resultPromise?.then(finish, finish);
+      turn?.interruptP?.then(finish, finish);
+    });
+  }
+
   /**
    * Resolve `true` once `token` surfaces in a JSONL `user-message`
    * (via `_confirmSubmit`), or `false` after `submitConfirmMs`.
@@ -2663,12 +2742,12 @@ class TmuxProcess extends Process {
       try { finish(); } catch { /* swallow */ }
     }
     // B7: release any pending submit-confirm waiters too — a
-    // `_confirmSubmitViaJsonl` blocked on a tokened user-message from a
+    // `_scheduleSubmitRetries` blocked on a tokened user-message from a
     // now-dead session would otherwise burn its whole retry budget.
     // Each waiter's stored fn resolves it as confirmed, so the confirm
     // loop returns at once instead of retrying; the in-flight turn is
     // already rejected by `drainQueue` above, so the turn settles loud
-    // regardless. (`_confirmSubmitViaJsonl` also bails on its own when
+    // regardless. (`_scheduleSubmitRetries` also bails on its own when
     // the owning turn reaches a terminal state — this is belt-and-
     // braces for a confirm whose turn ref it never received.)
     for (const finish of [...this._submitConfirms.values()]) {

package/lib/sdk/callbacks.js

@@ -20,6 +20,9 @@
 
 'use strict';
 
+const { getTopicConfig } = require('../session-key');
+const { pickBackend } = require('../process/factory');
+
 function createSdkCallbacks({
   db,
   dbWrite,
@@ -97,15 +100,35 @@ function createSdkCallbacks({
 
   return {
     onInit: (sessionKey, event, entry) => {
+      // Resolve the spawn-time identity the SAME way the backends do
+      // (topic override merged over chat-level + factory's
+      // pickBackend) — must match what `buildSpawnContext` in
+      // polygram.js compares against, otherwise every spawn re-poisons
+      // the row with chat-level values and S2 drift fires forever.
+      //
+      // The shumorobot 2026-05-21 Music topic bug was this: chat-
+      // level agent='shumabit' + cwd=$HOME got written into the row
+      // every turn, but the topic-level resolved to
+      // music-curation:music-curator + .../Music/rekordbox. Next turn
+      // → drift → drop row → fresh sid → context lost. Forever.
+      //
+      // pm_backend MUST also be persisted explicitly; otherwise
+      // db.upsertSession defaults it to 'sdk' for every spawn,
+      // making historical telemetry meaningless.
+      const chatConfig = config.chats[entry.chatId] || {};
+      const topicConfig = getTopicConfig(chatConfig, entry.threadId || null);
       dbWrite(() => db.upsertSession({
         session_key: sessionKey,
         chat_id: entry.chatId,
         thread_id: entry.threadId,
         claude_session_id: event.session_id,
-        agent: config.chats[entry.chatId]?.agent || null,
-        cwd: config.chats[entry.chatId]?.cwd || null,
-        model: config.chats[entry.chatId]?.model || null,
-        effort: config.chats[entry.chatId]?.effort || null,
+        agent: topicConfig.agent || chatConfig.agent || null,
+        cwd: topicConfig.cwd || chatConfig.cwd || null,
+        model: topicConfig.model || chatConfig.model || null,
+        effort: topicConfig.effort || chatConfig.effort || null,
+        pm_backend: pickBackend({
+          config, chatId: entry.chatId, threadId: entry.threadId || null,
+        }),
       }), `upsert session ${sessionKey}`);
     },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.10.0-rc.32",
+  "version": "0.10.0-rc.34",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {