polygram 0.16.0 → 0.17.0

package/lib/claude-bin.js

@@ -3,6 +3,7 @@
 const os = require('os');
 const path = require('path');
 const fs = require('fs');
+const { execFileSync } = require('child_process');
 
 // 0.12 Phase 4: moved from lib/process/tmux-process.js into the helper module
 // that consumes it, so the constant survives TmuxProcess deletion. CliProcess
@@ -41,9 +42,13 @@ const CLAUDE_CLI_PINNED_VERSION = '2.1.173';
  * lands — so a $PATH spawn silently drifts (shumorobot 2026-05-16:
  * CLI auto-updated 2.1.142 → 2.1.143 between deploys).
  *
- * Spawning the ABSOLUTE versioned path is immune to that: the
- * updater only ADDS new version files, it never overwrites an
- * existing one. `versions/2.1.142` stays byte-identical forever.
+ * Spawning the ABSOLUTE versioned path avoids the symlink-drift, but is
+ * NOT immune to the updater: claude keeps only the ~3 newest versions
+ * and PRUNES (deletes) the rest. Once the pin falls out of the top 3 the
+ * pinned path is a dead file → every cli spawn exits in ~14ms (prod
+ * outages 2026-06-21/22). So `verifyPinnedClaudeBin` (point-in-time check)
+ * is not enough; `ensureVendoredClaudeBin` (below, 0.17) keeps a
+ * polygram-owned copy the pruner can't touch.
  */
 
 /**
@@ -92,4 +97,150 @@ function verifyPinnedClaudeBin(version) {
   }
 }
 
-module.exports = { resolvePinnedClaudeBin, verifyPinnedClaudeBin, CLAUDE_CLI_PINNED_VERSION };
+// ─── 0.17: vendored pinned binary (immune to claude's auto-pruner) ──────────
+//
+// claude's updater deletes all but the ~3 newest versions, so the pinned
+// version eventually vanishes from ~/.local/share/claude/versions and every
+// cli spawn dies. We can't fall forward (the cli backend reads version-specific
+// TUI internals). Fix: polygram keeps its OWN copy of the exact pinned binary
+// in a dir the pruner never touches, and spawns from there. Once vendored it
+// never depends on the system copy or the network again.
+
+/**
+ * polygram-owned vendor dir for claude binaries. Under ~/.local/share/polygram
+ * (XDG data) — claude's pruner only touches ~/.local/share/claude/versions, and
+ * `npm i -g polygram` only replaces the package dir, so this survives both.
+ * Override with POLYGRAM_CLAUDE_VENDOR_DIR.
+ */
+function vendorDir() {
+  return process.env.POLYGRAM_CLAUDE_VENDOR_DIR
+    || path.join(os.homedir(), '.local', 'share', 'polygram', 'claude-bin');
+}
+
+function isExecutable(p) {
+  try { fs.accessSync(p, fs.constants.X_OK); return true; } catch { return false; }
+}
+
+// Atomic: copy to a unique tmp in the same dir, chmod, then rename over.
+function _atomicCopyExec(src, dst) {
+  const tmp = `${dst}.tmp.${process.pid}.${Date.now()}`;
+  fs.copyFileSync(src, tmp);
+  fs.chmodSync(tmp, 0o755);
+  fs.renameSync(tmp, dst);
+}
+
+// Remove vendored binaries (and stale .tmp.*) that aren't the live version.
+function _gcVendored(dir, keepVersion, logger) {
+  let entries = [];
+  try { entries = fs.readdirSync(dir); } catch { return; }
+  for (const name of entries) {
+    if (name === keepVersion) continue;
+    // Never delete an in-flight copy: a CONCURRENT boot (multi-bot host shares
+    // this dir) may be mid-copy into `<keepVersion>.tmp.<pid>.<ts>`; removing it
+    // ENOENTs that boot's rename → it falls back to SDK. Skip all .tmp.* — a
+    // genuinely orphaned tmp is cheap to leave (cleaned when its version is GC'd
+    // by name, or harmless). Defense-in-depth: only GC version-shaped names so a
+    // misconfigured vendor dir can't nuke unrelated files.
+    if (name.includes('.tmp.')) continue;
+    if (!/^\d+\.\d+\.\d+$/.test(name)) continue;
+    try { fs.rmSync(path.join(dir, name), { force: true }); } catch (e) {
+      logger?.warn?.(`[claude-bin] vendor GC: could not remove ${name}: ${e.message}`);
+    }
+  }
+}
+
+/**
+ * Ensure a polygram-owned copy of the pinned claude binary exists and return
+ * its path. Steady state is a single stat (fast). On a cold/pruned host it
+ * obtains the binary once (copy from the system install, else `claude install`
+ * then copy) and caches it forever.
+ *
+ * @param {string} version
+ * @param {{ logger?: object }} [opts]
+ * @returns {{ ok: boolean, path: string, vendored?: boolean, reason?: string }}
+ */
+function ensureVendoredClaudeBin(version, { logger = console } = {}) {
+  // Explicit override wins, unchanged — non-standard installs / CI / tests.
+  const override = process.env.POLYGRAM_CLAUDE_BIN;
+  if (override) {
+    return isExecutable(override)
+      ? { ok: true, path: override, vendored: false }
+      : { ok: false, path: override, reason: `POLYGRAM_CLAUDE_BIN=${override} not executable` };
+  }
+
+  const dir = vendorDir();
+  const vendored = path.join(dir, version);
+
+  // Fast path: already vendored.
+  if (isExecutable(vendored)) {
+    _gcVendored(dir, version, logger);
+    return { ok: true, path: vendored, vendored: true };
+  }
+
+  // Need to obtain it. Ensure the dir exists.
+  try { fs.mkdirSync(dir, { recursive: true }); } catch (e) {
+    return { ok: false, path: vendored, reason: `cannot create vendor dir ${dir}: ${e.message}` };
+  }
+
+  const versionsDir = process.env.POLYGRAM_CLAUDE_VERSIONS_DIR
+    || path.join(os.homedir(), '.local', 'share', 'claude', 'versions');
+  const systemPath = path.join(versionsDir, version);
+
+  // (a) copy from the system install if present.
+  if (isExecutable(systemPath)) {
+    try {
+      _atomicCopyExec(systemPath, vendored);
+      logger?.log?.(`[claude-bin] vendored claude v${version} ← ${systemPath} → ${vendored}`);
+    } catch (e) {
+      return { ok: false, path: vendored, reason: `copy ${systemPath} → ${vendored} failed: ${e.message}` };
+    }
+  } else {
+    // (b) try to install the exact version, then copy. If
+    // POLYGRAM_CLAUDE_INSTALL_BIN is set, use it VERBATIM (no fallback — an
+    // explicit override that's wrong must fail loudly, not silently shell out to
+    // a different claude). Otherwise prefer ~/.local/bin/claude, else PATH.
+    let installerBin = process.env.POLYGRAM_CLAUDE_INSTALL_BIN;
+    if (!installerBin) {
+      const localBin = path.join(os.homedir(), '.local', 'bin', 'claude');
+      installerBin = isExecutable(localBin) ? localBin : 'claude';
+    }
+    logger?.warn?.(`[claude-bin] pinned claude v${version} absent from ${systemPath}; installing via ${installerBin}…`);
+    try {
+      // Synchronous: blocks boot until the install completes. Rare (deploys
+      // pre-install the pin → the fast copy path above is the norm). On the VPS
+      // polygram boots DETACHED in tmux (Type=oneshot start-sessions.sh), so
+      // this block is NOT gated by systemd's TimeoutStartSec; on the Mac launchd
+      // has no hard start-timeout. Timeout kept under the VPS unit's 120s anyway.
+      execFileSync(installerBin, ['install', version], { timeout: 110_000, stdio: 'ignore' });
+    } catch (e) {
+      return {
+        ok: false, path: vendored,
+        reason: `claude v${version} not present and \`claude install ${version}\` failed (${e.message}). `
+          + 'Install it manually or set POLYGRAM_CLAUDE_BIN.',
+      };
+    }
+    if (!isExecutable(systemPath)) {
+      return { ok: false, path: vendored, reason: `claude install ${version} ran but ${systemPath} still missing` };
+    }
+    try {
+      _atomicCopyExec(systemPath, vendored);
+      logger?.log?.(`[claude-bin] installed + vendored claude v${version} → ${vendored}`);
+    } catch (e) {
+      return { ok: false, path: vendored, reason: `copy after install failed: ${e.message}` };
+    }
+  }
+
+  _gcVendored(dir, version, logger);
+  if (!isExecutable(vendored)) {
+    return { ok: false, path: vendored, reason: `vendored copy ${vendored} is not executable after copy` };
+  }
+  return { ok: true, path: vendored, vendored: true };
+}
+
+module.exports = {
+  resolvePinnedClaudeBin,
+  verifyPinnedClaudeBin,
+  ensureVendoredClaudeBin,
+  vendorDir,
+  CLAUDE_CLI_PINNED_VERSION,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {

package/polygram.js

@@ -2484,12 +2484,16 @@ async function main() {
   // 0.11.0: binCheck reused for channels backend wiring below.
   let pinnedClaudeBin = null;
   {
-    const { CLAUDE_CLI_PINNED_VERSION } = require('./lib/claude-bin');
-    const { verifyPinnedClaudeBin } = require('./lib/claude-bin');
-    const binCheck = verifyPinnedClaudeBin(CLAUDE_CLI_PINNED_VERSION);
+    // 0.17: vendor a polygram-owned copy of the pinned binary so claude's
+    // auto-pruner (keeps only ~3 newest, deletes the rest) can't take cli chats
+    // down. Spawns from ~/.local/share/polygram/claude-bin/<version>, immune to
+    // pruning. Self-heals on boot (copy from the system install, else install).
+    const { CLAUDE_CLI_PINNED_VERSION, ensureVendoredClaudeBin } = require('./lib/claude-bin');
+    const binCheck = ensureVendoredClaudeBin(CLAUDE_CLI_PINNED_VERSION, { logger: console });
     if (binCheck.ok) {
       console.log(
-        `[polygram] CliProcess pinned to claude CLI v${CLAUDE_CLI_PINNED_VERSION}: ${binCheck.path}`,
+        `[polygram] CliProcess pinned to claude CLI v${CLAUDE_CLI_PINNED_VERSION}: ${binCheck.path}`
+        + `${binCheck.vendored ? ' (vendored)' : ''}`,
       );
       pinnedClaudeBin = binCheck.path;
     } else {