polygram 0.13.0 → 0.13.2

package/lib/config-scope.js

@@ -46,4 +46,22 @@ function filterConfigToBot(config, botName) {
   };
 }
 
-module.exports = { parseBotArg, parseDbArg, filterConfigToBot };
+/**
+ * Resolve the active bot's effective config: the per-bot block
+ * `config.bots[botName]` layered OVER the shared top-level `bot` block, so
+ * shared fields (e.g. `apiRoot`) set once at the top level survive, and any
+ * per-bot field of the same name wins.
+ *
+ * Without this merge, a plain `config.bot = config.bots[botName]` silently
+ * DROPS every top-level shared field. That orphaned `apiRoot` and ran both VPS
+ * bots on cloud Telegram (20/50) instead of the 2 GB local Bot API server for
+ * weeks (discovered 2026-06-16) — createBot reads `config.bot.apiRoot` after
+ * the alias, so the top-level value never reached it.
+ */
+function activeBotConfig(config, botName) {
+  const top = (config && config.bot) || {};
+  const perBot = (config && config.bots && config.bots[botName]) || {};
+  return { ...top, ...perBot };
+}
+
+module.exports = { parseBotArg, parseDbArg, filterConfigToBot, activeBotConfig };

package/lib/handlers/download.js

@@ -106,10 +106,19 @@ function createDownloadAttachments({
           } catch (e) {
             if (e.code === 'EEXIST') {
               logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (race: already on disk)`);
-            } else if (e.code === 'EXDEV') {
-              fs.copyFileSync(fileInfo.file_path, localPath);   // cross-device fallback
             } else {
-              throw e;
+              // A hard link can fail even when a byte copy succeeds: EXDEV (the
+              // bot-api data dir is a different device/overlay than the inbox) or
+              // EPERM (the volume's filesystem refuses a cross-fs / cross-owner
+              // hard link — the local Bot API container writes files as a
+              // different user, e.g. `messagebus`, and polygram reads them via
+              // group membership). Copy works whenever we can READ the source
+              // (group perm) + WRITE the inbox; if the source read is genuinely
+              // denied, copyFileSync throws EACCES and the outer handler marks
+              // the attachment failed. Falling back on EXDEV only (the old
+              // behaviour) left EPERM uncaught → every inbound file failed once
+              // the local Bot API server was a Docker volume (2026-06-16).
+              fs.copyFileSync(fileInfo.file_path, localPath);
             }
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {

package/polygram.js

@@ -88,7 +88,7 @@ const agentLoader = require('./lib/agents/loader');
 const { createSender } = require('./lib/telegram/api');
 const { createAsyncLock } = require('./lib/async-lock');
 const { sweepInbox } = require('./lib/db/inbox');
-const { parseBotArg, parseDbArg, filterConfigToBot } = require('./lib/config-scope');
+const { parseBotArg, parseDbArg, filterConfigToBot, activeBotConfig } = require('./lib/config-scope');
 const { createStore: createPairingsStore, parseTtl: parsePairingTtl } = require('./lib/db/pairings');
 const { transcribe: transcribeVoice, isVoiceAttachment } = require('./lib/telegram/voice');
 const { createStreamer } = require('./lib/telegram/streamer');
@@ -2136,10 +2136,12 @@ async function main() {
   }
   try {
     config = filterConfigToBot(config, BOT_NAME);
-    // Convenience: config.bot is the current bot's config block. After the
-    // filter, config.bots has exactly one entry; this alias keeps call sites
-    // from re-indexing by name.
-    config.bot = config.bots[BOT_NAME];
+    // Convenience: config.bot is the current bot's EFFECTIVE config — the
+    // per-bot block layered over the shared top-level `bot` block (so shared
+    // fields like apiRoot survive; per-bot fields win). A plain
+    // `= config.bots[BOT_NAME]` silently dropped top-level shared fields and
+    // orphaned apiRoot (both bots ran on cloud, not the 2GB local server).
+    config.bot = activeBotConfig(config, BOT_NAME);
   } catch (err) {
     console.error(`[fatal] ${err.message}`);
     process.exit(2);