polygram 0.12.0-rc.38 → 0.12.0-rc.39

package/lib/handlers/abort.js

@@ -8,14 +8,16 @@
  *   1. Mark the session aborted BEFORE the SDK interrupt fires —
  *      pm-sdk's close handler races; if we marked after, the
  *      generic error-reply could slip through.
- *   2. pm.interrupt() — non-destructive cancel of the in-flight
- *      turn (preserves Query for the next user message).
+ *   2. Tiered cancel (cheap by default, 2026-06-12): in-place
+ *      interrupt keeps the proc warm (no --resume); kill only for
+ *      ghosts / detached background shells / unverifiable state.
  *   3. pm.drainQueue() — rejects queued pendings with
  *      err.code='INTERRUPTED' so the abort-grace classifier
  *      suppresses error replies on the way out.
  *   4. Clear ✍ reactions on already-autosteered messages from
  *      this turn (now dead context).
- *   5. Acknowledge in the language the user aborted in (en/ru).
+ *   5. Acknowledge with a 👍 reaction on the stop message when
+ *      something was stopped; silence otherwise. Never text.
  *
  * Returns true when the message was handled as an abort, false
  * otherwise. Caller short-circuits on true.
@@ -33,6 +35,9 @@ function createHandleAbort({
   clearAutosteeredReactions,
   getSessionKey,
   botName,
+  // Cancel-cheap (spec Finding 5): delay before the second background-shell
+  // probe — catches a shell whose TUI mode-line hadn't rendered at probe #1.
+  dualProbeDelayMs = 1000,
   logger = console,
 } = {}) {
 
@@ -100,21 +105,59 @@ function createHandleAbort({
     // classifier suppresses their error replies AND each turn's finally clears
     // its reactor + typing), THEN stop the live work.
     pm.drainQueue(sessionKey, 'INTERRUPTED');
+    // Cancel-cheap tiered gate (docs/0.13-cancel-efficiency-and-delete-trigger-
+    // spec.md, locked 2026-06-12; supersedes the 2026-06-04 always-kill
+    // decision). kill→--resume is the resume-death-race path AND a full
+    // re-prefill on aged sessions, so the cli backend now interrupts IN PLACE
+    // (C-c; claude stays resident, next message reuses the warm proc — live-
+    // verified on 2.1.173: subagents die with the turn) and kills ONLY when
+    // an in-place interrupt genuinely can't reach the work:
+    //   - a GHOST busy-state (no pending turn but still streaming — interrupt
+    //     can't clear its feedback; the close-drain can),
+    //   - detached run_in_background shells (they survive C-c — live-verified;
+    //     the pane scrape false-negatives, so cross-check the bg-work watchdog
+    //     and dual-probe, and FAIL TOWARD KILL when unverifiable).
+    let cancelMode = 'none';
+    let killReason = null;
     if (hadActive && proc && proc.backend === 'cli') {
-      // Channels HARD stop (user decision 2026-06-04: "/stop should stop
-      // everything including background, like the SDK backend"). A soft C-c
-      // interrupt leaves detached background shells + subagents running and
-      // can't clear a ghost (no-pending-turn) busy state — the symptom was
-      // "Stopped." with the reaction + typing still going. Kill the session: the
-      // whole process tree (claude + every subagent + all background shells)
-      // dies at once, the close drains the in-flight turn (clearing its
-      // reactor/typing), and the next message respawns fresh (--resume restores
-      // the conversation). This is what makes channels /stop "stop everything".
-      await pm.kill(sessionKey, 'abort').catch((err) =>
-        logger.error?.(`[${botName}] abort kill failed: ${err.message}`));
+      let mustKill = false;
+      if (!proc.inFlight) {
+        // hadActive came from the busy probe with no pending turn = ghost.
+        mustKill = true; killReason = 'ghost';
+      } else if (typeof proc.probeBusyState !== 'function') {
+        mustKill = true; killReason = 'no-probe';
+      } else {
+        try {
+          const p1 = busyProbe || await proc.probeBusyState();
+          let bg = !!p1?.backgroundShell;
+          if (!bg && typeof proc.hasActiveBackgroundWork === 'function'
+              && await proc.hasActiveBackgroundWork()) {
+            bg = true;
+          }
+          if (!bg) {
+            await new Promise((r) => setTimeout(r, dualProbeDelayMs));
+            const p2 = await proc.probeBusyState();
+            bg = !!p2?.backgroundShell;
+          }
+          if (bg) { mustKill = true; killReason = 'background-shell'; }
+        } catch (err) {
+          logger.error?.(`[${botName}] cancel bg-probe failed: ${err.message}`);
+          mustKill = true; killReason = 'probe-failed';
+        }
+      }
+      if (mustKill) {
+        cancelMode = 'kill';
+        await pm.kill(sessionKey, 'abort').catch((err) =>
+          logger.error?.(`[${botName}] abort kill failed: ${err.message}`));
+      } else {
+        cancelMode = 'interrupt';
+        await pm.interrupt(sessionKey).catch((err) =>
+          logger.error?.(`[${botName}] interrupt failed: ${err.message}`));
+      }
     } else {
       // SDK (or nothing active): non-destructive interrupt cancels the in-flight
       // Query turn WITHOUT tearing down the Query (cheap to reuse next message).
+      if (hadActive) cancelMode = 'interrupt';
       await pm.interrupt(sessionKey).catch((err) =>
         logger.error?.(`[${botName}] interrupt failed: ${err.message}`));
     }
@@ -123,6 +166,10 @@ function createHandleAbort({
     logEvent('abort-requested', {
       chat_id: chatId, user_id: msg.from?.id || null,
       had_active: hadActive,
+      // Cancel-cheap soak signals: which tier fired, and why a kill was chosen
+      // (ghost / background-shell / no-probe / probe-failed / null).
+      cancel_mode: cancelMode,
+      kill_reason: killReason,
       killed_background_shell: killedBackgroundShell,
       // "Stop" incident forensics: the raw busy-probe signals at decision
       // time. Lets us query, across real aborts, where the esc-hint /
@@ -140,35 +187,22 @@ function createHandleAbort({
       trigger: cleanText.slice(0, 40),
     });
 
-    // Reply in the same language the user aborted in. Cyrillic-
-    // detection is crude but reliable for ru/en.
-    const lang = /[а-яё]/i.test(cleanText) ? 'ru' : 'en';
-    const strs = {
-      en: {
-        stopped: 'Stopped.',
-        bgStopped: 'Stopped the background task.',
-        nothing: 'Nothing to stop.',
-      },
-      ru: {
-        stopped: 'Остановлено.',
-        bgStopped: 'Фоновая задача остановлена.',
-        nothing: 'Нечего останавливать.',
-      },
-    }[lang];
-    // Truthful ack: a stopped in-flight turn → "Stopped"; a stopped
-    // background shell → "Stopped the background task"; neither →
-    // "Nothing to stop".
-    const reply = hadActive ? strs.stopped
-      : killedBackgroundShell ? strs.bgStopped
-      : strs.nothing;
-    try {
-      await tg(bot, 'sendMessage', {
-        chat_id: chatId, text: reply,
-        reply_parameters: { message_id: msg.message_id, allow_sending_without_reply: true },
-        ...(threadId && { message_thread_id: threadId }),
-      }, { source: 'abort-ack', botName });
-    } catch (err) {
-      logger.error?.(`[${botName}] abort-ack send failed: ${err.message}`);
+    // Ack (locked design 2026-06-12, Ivan): a 👍 reaction on the user's stop
+    // message when something was actually stopped — NEVER a text reply. The
+    // old "Stopped." text was eventually-true at best (the interrupt settles
+    // up to graceMs later) and chat noise at worst; the reaction is just
+    // "got it, stopping" and is language-neutral. Nothing-to-stop → complete
+    // silence (a 👍 there would lie).
+    if (hadActive || killedBackgroundShell) {
+      try {
+        await tg(bot, 'setMessageReaction', {
+          chat_id: chatId,
+          message_id: msg.message_id,
+          reaction: [{ type: 'emoji', emoji: '👍' }],
+        }, { source: 'abort-ack', botName });
+      } catch (err) {
+        logger.error?.(`[${botName}] abort-ack reaction failed: ${err.message}`);
+      }
     }
     return true;
   };

package/lib/process/cli-process.js

@@ -926,7 +926,17 @@ class CliProcess extends Process {
       // "Channels (experimental) messages from server:polygram-bridge inject
       // directly in this session · …". Keep the 2.1.158 text too so a
       // POLYGRAM_CLAUDE_BIN override to an older binary still gates correctly.
-      readySignal: /(?:Listening for channel messages from:|Channels \(experimental\) messages from) server:polygram-bridge/i,
+      //
+      // 2026-06-12 (caught by the cancel-cheap E2E before prod): in 2.1.173
+      // the banner lives in a COLLAPSIBLE notice list — with ≥3 notices the
+      // pane shows "+N more · /status" and the banner is hidden, stalling a
+      // banner-only gate into a false CHANNELS_DIALOG_TIMEOUT. An interactive
+      // prompt footer ("(shift+tab to cycle)" / "? for shortcuts") with no
+      // pending dialog is equally READY: the gate's job is dialog navigation;
+      // channel liveness is separately guaranteed by mcp-ready (send() gate)
+      // + the delivery watchdog. Dialog panes render "Enter to confirm"
+      // instead of the footer, so the footer can't match mid-dialog.
+      readySignal: /(?:Listening for channel messages from:|Channels \(experimental\) messages from) server:polygram-bridge|shift\+tab to cycle|\? for shortcuts/i,
       timeoutCode: 'CHANNELS_DIALOG_TIMEOUT',
       // Progress-aware gate (shumorobot General incident 2026-05-30): a
       // cold spawn that's mid-download (runtime fetch, "24%" progress bar)
@@ -2147,6 +2157,13 @@ class CliProcess extends Process {
   async interrupt() {
     if (this.closed) return;
     if (!this.tmuxSession) return;
+    // Cancel-cheap C2 (spec Finding 7): a cancel is already in flight — a
+    // SECOND C-c would land at the now-idle prompt, which is claude's exit
+    // chord ("press ctrl+c again to exit") and would convert the cheap cancel
+    // into an accidental process exit. Also: resetting the grace timer would
+    // DELAY the synthetic resolution for a user double-tapping "stop".
+    // Idempotent no-op instead.
+    if (this._interruptGraceTimer) return;
     // tmux SIGINT — hard interrupt for the running turn.
     try {
       await this.runner.sendControl(this.tmuxSession, 'C-c');
@@ -2157,18 +2174,37 @@ class CliProcess extends Process {
     this.emit('interrupt-applied', { backend: this.backend });
     this._logEvent('interrupt-applied', {});
 
+    // Cancel-cheap C1 — the spec's O2 BLOCKER: the cancelled work's inputs
+    // must never re-deliver. The grace below synthesizes the resolution
+    // WITHOUT _finalizeTurn, so without this, an autosteer/fold entry stays
+    // 'written' and a LATER cycle-end sweep declares it dropped →
+    // drop-redeliver re-injects the user's CANCELLED message minutes later.
+    // 'cancelled' is terminal: the sweep only targets 'written', and
+    // _ledgerTransition clears the entry's drop/watchdog timers.
+    for (const [id, e] of this.inputLedger) {
+      if (e.state === 'written' || e.state === 'seen') {
+        this._ledgerTransition(id, 'cancelled');
+        this._logEvent('cli-input-cancelled', { turn_id: id, source: e.source });
+      }
+    }
+
     // Review P3 C8: after Ctrl-C, Claude may or may not call reply with an
     // "I was interrupted" message. If it doesn't (5s grace), resolve pending
     // turns with subtype 'interrupted' instead of letting them wait the full
-    // 10-min hardTimer. The grace window is reset if a new interrupt fires.
-    if (this._interruptGraceTimer) clearTimeout(this._interruptGraceTimer);
+    // 10-min hardTimer.
     this._interruptGraceTimer = setTimeout(() => {
       let resolvedAny = false;
       for (const [turnId, pending] of this.pendingTurns) {
         // Synthesize an interrupted resolution: empty text, 'interrupted' subtype.
+        // Cancel-cheap C3: clear ALL per-pending machinery (mirrors
+        // _finalizeTurn) — stray timers/listeners on the kept-warm proc are
+        // exactly what the cheap-cancel design must not leak.
         if (pending.quietTimer) clearTimeout(pending.quietTimer);
         if (pending.hardTimer) clearTimeout(pending.hardTimer);
-      if (pending.absoluteTimer) clearTimeout(pending.absoluteTimer);
+        if (pending.absoluteTimer) clearTimeout(pending.absoluteTimer);
+        if (pending._stopGraceTimer) clearTimeout(pending._stopGraceTimer);
+        if (pending._activityQuietTimer) clearTimeout(pending._activityQuietTimer);
+        if (pending._onStop) { this.off('stop-hook', pending._onStop); pending._onStop = null; }
         this.pendingTurns.delete(turnId);
         const qIdx = this.pendingQueue.findIndex(e => e.turnId === turnId);
         if (qIdx >= 0) this.pendingQueue.splice(qIdx, 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.12.0-rc.38",
+  "version": "0.12.0-rc.39",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {