polygram 0.17.11 → 0.17.12

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.11.0-rc.15",
+  "version": "0.17.12",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/lib/error/classify.js

@@ -236,6 +236,20 @@ const CODES = {
     isTransient: false,
     autoRecover: null,
   },
+  // AUTH_DISABLED: Anthropic has disabled Claude Code / subscription access on
+  // this account (e.g. non-payment) — orchestra's cli-process.js detects the
+  // streamed policy-string signature and rejects every pending turn
+  // immediately (see docs/AUTH_DISABLED_HANDLING_SPEC.md) instead of letting
+  // it wedge for 10 minutes into a generic TURN_TIMEOUT. Distinct from
+  // AUTH_EXPIRED (a token refresh problem, user-recoverable by re-login):
+  // this is an infra/billing condition on our end, so userMessage is null —
+  // the operator gets notified (dispatcher.js), the chat does not.
+  AUTH_DISABLED: {
+    kind: 'authDisabled',
+    userMessage: null,
+    isTransient: false,
+    autoRecover: null,
+  },
 };
 
 /**

package/lib/handlers/dispatcher.js

@@ -22,6 +22,8 @@
 
 'use strict';
 
+const { createAuthDisabledGate } = require('../ops/auth-disabled-gate');
+
 const CONCURRENT_WARN_THRESHOLD_DEFAULT = 20;
 
 // Startup auto-retry (option a, 2026-06-04): a short breath before silently
@@ -58,6 +60,13 @@ function createDispatcher({
   // Delay before a silent startup auto-retry re-dispatches (TMUX_SESSION_GONE).
   // Injected so tests can drive it to 0; production uses STARTUP_RETRY_DELAY_MS.
   startupRetryDelayMs = STARTUP_RETRY_DELAY_MS,
+  // AUTH_DISABLED dedupe/re-arm gate (docs/AUTH_DISABLED_HANDLING_SPEC.md).
+  // Defaulted (rather than required) so a missing DI param at some future
+  // call site degrades to "always notify, never dedupe" instead of throwing
+  // — AUTH_DISABLED is account-wide, so an unguarded throw here would hit
+  // every concurrent chat within seconds and risk tripping the storm circuit
+  // breaker (polygram.js uncaughtException handler) on a wiring bug alone.
+  authDisabledGate = createAuthDisabledGate(),
   // State accessors (need late binding because polygram.js mutates):
   getIsShuttingDown,              // () → boolean
   logger = console,
@@ -224,12 +233,56 @@ function createDispatcher({
           chat_id: chatId, session_key: sessionKey, msg_id: msg?.message_id, code: err.code,
         });
       }
+      // AUTH_DISABLED (docs/AUTH_DISABLED_HANDLING_SPEC.md): Anthropic has
+      // disabled Claude Code access on this account (e.g. non-payment).
+      // Runs unconditionally — independent of wasAborted/isReplay/
+      // isShuttingDown — because the account-disabled condition is real
+      // regardless of what else was happening to this particular message.
+      // The chat itself is never told (classify.js maps this code to
+      // userMessage: null, so errorReplyText(err) below naturally suppresses
+      // it) — this only notifies the operator, once per outage window.
+      if (err.code === 'AUTH_DISABLED') {
+        logger.error?.(`[auth] (${botName}) Claude access DISABLED by Anthropic — turn rejected immediately instead of wedging; check the account/billing.`);
+        logEvent('auth-disabled', {
+          chat_id: chatId, session_key: sessionKey, msg_id: msg?.message_id,
+          error: err.message?.slice(0, 500),
+        });
+        // Never let the gate itself become a new failure mode — AUTH_DISABLED
+        // is account-wide, so a bad gate would throw on every concurrent
+        // chat within seconds of each other (see the storm circuit breaker
+        // this repo already has for exactly that shape of cascading failure).
+        let shouldNotify = false;
+        try {
+          shouldNotify = authDisabledGate.noteFailure();
+        } catch (gateErr) {
+          logger.error?.(`[auth] authDisabledGate.noteFailure failed: ${gateErr.message}`);
+        }
+        if (shouldNotify) {
+          const adminChatId = config.bot?.approvals?.adminChatId;
+          if (adminChatId) {
+            tg(bot, 'sendMessage', {
+              chat_id: adminChatId,
+              text: `🚫 Claude Code access appears DISABLED for this account (Anthropic-side, e.g. non-payment) — turns are failing instead of replying. Check the Anthropic account/billing. (bot: ${botName})`,
+            }, { source: 'auth-disabled-notify', botName }).catch((notifyErr) => {
+              logger.error?.(`[auth] operator notify failed: ${notifyErr.message}`);
+            });
+          } else {
+            logger.error?.(`[auth] AUTH_DISABLED fired but no config.bot.approvals.adminChatId configured — operator was not notified`);
+          }
+        }
+      }
       // rc.55: surface replay failures with a meaningful message.
       // Pre-rc.55 any boot-replay turn that failed for ANY reason
       // was silently dropped. The rc.51-onward boot-replay path is
       // a recovery primitive, not stale-message handling — when it
       // fails, the user IS still waiting.
-      if (isReplay && !wasAborted && !isShuttingDown) {
+      // AUTH_DISABLED is excluded: it's an unconditional block like this
+      // one, gated on isReplay rather than err.code, so without this
+      // exclusion a replayed message failing with AUTH_DISABLED would fall
+      // through into this hardcoded reply — contradicting the "chat is
+      // never told, only the operator is" contract classify.js establishes
+      // via userMessage: null (found in code review).
+      if (isReplay && !wasAborted && !isShuttingDown && err.code !== 'AUTH_DISABLED') {
         tg(bot, 'sendMessage', {
           chat_id: chatId,
           text: '⚠️ This turn was interrupted and didn\'t complete on retry — please rephrase or simplify, or split into smaller steps.',

package/lib/handlers/drop-redeliver.js

@@ -59,6 +59,25 @@ function createDropRedeliverer({ db, redeliver, logEvent = () => {}, logger = co
         ...(row.thread_id && { message_thread_id: Number(row.thread_id) }),
         ...(row.reply_to_id && { reply_to_message: { message_id: row.reply_to_id } }),
       };
+      // Persisted attachments ride _mergedAttachments (boot-replay parity):
+      // the native photo/voice fields can't be restored from the DB, and
+      // without this an attachment-only drop is blocked by the presence
+      // gate while a text+media drop silently loses its attachments.
+      // Isolated in its own try/catch (review: reliability+adversarial): this
+      // redelivery only fires ONCE, so a lookup failure here must degrade to
+      // a text-only redelivery, not abandon the whole drop.
+      let attRows = [];
+      try {
+        attRows = db.getAttachmentsByMessage?.(row.id) || [];
+      } catch (err) {
+        logger.error?.(`[drop-redeliver] attachment lookup failed for msg ${row.id}: ${err?.message || err}`);
+      }
+      if (attRows.length) {
+        reconstructed._mergedAttachments = attRows.map((a) => ({
+          kind: a.kind, name: a.name, mime_type: a.mime_type,
+          size: a.size_bytes, file_id: a.file_id, file_unique_id: a.file_unique_id,
+        }));
+      }
       await redeliver({ chatId: String(chatId), msg: reconstructed, source: 'drop' });
     } catch (err) {
       logger.error?.(`[drop-redeliver] ${err?.message || err}`);

package/lib/handlers/should-handle.js

@@ -0,0 +1,52 @@
+/**
+ * shouldHandle — the content-presence + chat-allowlist + mention/pairing
+ * intake gate. Runs for every tier of the D5 unified gate (fresh, edit,
+ * redelivery — see lib/handlers/gate-inbound.js).
+ *
+ * Extracted from polygram.js as a factory so the logic is unit-testable;
+ * deps are getters because polygram wires config / pairings / BOT_NAME
+ * at boot, after module load.
+ */
+
+'use strict';
+
+function createShouldHandle({ getConfig, getPairings, getBotName } = {}) {
+  return function shouldHandle(msg, chatConfig, botUsername) {
+    const config = getConfig();
+    // A replayed / drop-redelivered message is reconstructed from the DB and
+    // carries its attachments ONLY in _mergedAttachments — the native
+    // photo/document/voice fields can't be restored. Count them as content,
+    // or every attachment-only turn (voice note, caption-less photo) becomes
+    // unrecoverable after a crash: blocked here as "empty" before dispatch.
+    const hasAttachment = !!(msg.document || msg.photo || msg.voice || msg.audio || msg.video)
+      || (Array.isArray(msg._mergedAttachments) && msg._mergedAttachments.length > 0);
+    if (!msg.text && !msg.caption && !hasAttachment) return false;
+    const chatId = msg.chat.id.toString();
+    if (!config.chats[chatId]) return false;
+
+    if (chatConfig.requireMention && msg.chat.type !== 'private') {
+      const text = msg.text || msg.caption || '';
+      const isReplyToBot = msg.reply_to_message?.from?.username === botUsername;
+      const hasMention = text.includes(`@${botUsername}`);
+      // A reply targeting some other user (not the bot) is a strong signal
+      // "this message is for that person, not me". Paired users normally
+      // bypass requireMention, but not in this case — without the guard a
+      // paired user saying "Gotcha!" to a teammate gets processed by the
+      // bot just because the user is paired, which is what bit us in
+      // UMI Group on 0.5.9 (bot leaked reasoning as a reply to "Gotcha!").
+      const repliesToOtherUser = !!msg.reply_to_message
+        && msg.reply_to_message.from?.username !== botUsername;
+      // Paired users bypass requireMention — operator-trusted, no @ needed
+      // every time. Skipped when they're replying to a non-bot user (above).
+      const pairings = getPairings();
+      const paired = !repliesToOtherUser && pairings && msg.from?.id
+        ? pairings.hasLivePairing({ bot_name: getBotName(), user_id: msg.from.id, chat_id: chatId })
+        : false;
+      if (!isReplyToBot && !hasMention && !paired) return false;
+    }
+
+    return true;
+  };
+}
+
+module.exports = { createShouldHandle };

package/lib/media-group-buffer.js

@@ -101,9 +101,38 @@ function createMediaGroupBuffer({
     }
   };
 
+  // Read-only view of everything still buffered, without flushing.
+  // Shutdown uses this to mark undispatched album siblings replay-pending
+  // in the DB — flushing at exit would race process.exit and lose them.
+  const peekAll = () => {
+    const out = [];
+    for (const entry of entries.values()) out.push(...entry.messages);
+    return out;
+  };
+
+  // Atomically cancel every group's pending flush timer AND remove it from
+  // the buffer, WITHOUT calling onFlush. Unlike peekAll(), the caller now
+  // OWNS these groups — none of them can self-flush afterward. Shutdown
+  // uses this (not peekAll()) so a timer firing during the shutdown drain
+  // can't double-process a group that's already been DB-marked
+  // replay-pending. Groups stay separated by key (not flattened) so the
+  // caller can coalesce each one onto a single primary row, matching the
+  // live onFlush path's own semantics.
+  const takeAllForShutdown = () => {
+    const out = [];
+    for (const [key, entry] of entries) {
+      if (entry.timer) clearTimerFn(entry.timer);
+      out.push({ key, messages: entry.messages });
+    }
+    entries.clear();
+    return out;
+  };
+
   return {
     add,
     flushAll,
+    peekAll,
+    takeAllForShutdown,
     get size() { return entries.size; },
   };
 }

package/lib/ops/auth-disabled-gate.js

@@ -0,0 +1,43 @@
+/**
+ * Dedupe/re-arm gate for AUTH_DISABLED operator notifications
+ * (docs/AUTH_DISABLED_HANDLING_SPEC.md).
+ *
+ * Fires the operator DM once per outage window: the first AUTH_DISABLED
+ * occurrence after construction (or after the last successful Claude turn)
+ * notifies; every occurrence after that is deduped until a turn succeeds
+ * again. `noteSuccess()` must only be called on a genuine Claude-turn
+ * success (see polygram.js handleMessage's non-error branch) — calling it
+ * on unrelated bot traffic (slash commands, unconfigured chats) would
+ * falsely clear an ongoing outage and cause repeat pages.
+ *
+ * `count`/`lastAt` track every occurrence regardless of dedupe, for the
+ * heartbeat counter (lib/ops/heartbeat.js).
+ */
+
+'use strict';
+
+function createAuthDisabledGate({ now = Date.now } = {}) {
+  let armed = true;
+  let count = 0;
+  let lastAt = null;
+
+  function noteFailure() {
+    count += 1;
+    lastAt = now();
+    if (!armed) return false;
+    armed = false;
+    return true;
+  }
+
+  function noteSuccess() {
+    armed = true;
+  }
+
+  function snapshot() {
+    return { count, lastAt, armed };
+  }
+
+  return { noteFailure, noteSuccess, snapshot };
+}
+
+module.exports = { createAuthDisabledGate };

package/lib/ops/heartbeat.js

@@ -0,0 +1,56 @@
+/**
+ * Minimal file-based heartbeat for AUTH_DISABLED Netdata visibility
+ * (docs/AUTH_DISABLED_HANDLING_SPEC.md, Layer 3.3).
+ *
+ * File-only equivalent of water's lib/ops/heartbeat.js pattern — no
+ * /healthz endpoint, since this repo has no HTTP server to hang a route on.
+ * Wiring heartbeat.json into an actual Netdata alert (netdata_watch_units /
+ * a filecheck-or-cron-parses-JSON entry) is a VPS-side ops/ansible change
+ * outside this repo's scope; this only builds the code-side signal.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+function createHeartbeat({ dataDir, authDisabledGate, intervalMs = 60_000, now = Date.now }) {
+  const file = path.join(dataDir, 'heartbeat.json');
+  let timer = null;
+
+  function snapshot() {
+    const gate = authDisabledGate.snapshot();
+    return { ts: now(), authDisabled: gate.count, authDisabledLastAt: gate.lastAt };
+  }
+
+  function beat() {
+    const snap = snapshot();
+    try {
+      const tmp = `${file}.tmp`;
+      fs.writeFileSync(tmp, JSON.stringify(snap));
+      fs.renameSync(tmp, file); // atomic
+    } catch (err) {
+      // Best-effort (matches water's heartbeat.js) — must never throw into the
+      // interval timer or affect a turn. Logged (water's version doesn't) because
+      // this file's whole purpose is surfacing a silent failure; a heartbeat that
+      // can go silently stale defeats that purpose the same way the bug it's
+      // meant to catch does.
+      console.error(`[auth] heartbeat write failed: ${err.message}`);
+    }
+    return snap;
+  }
+
+  function start() {
+    beat();
+    timer = setInterval(beat, intervalMs);
+    timer.unref?.();
+  }
+
+  function stop() {
+    if (timer) clearInterval(timer);
+  }
+
+  return { start, stop, beat, snapshot, file };
+}
+
+module.exports = { createHeartbeat };

package/lib/process/channels-tool-dispatcher.js

@@ -142,12 +142,23 @@ function createChannelsToolDispatcher({
   // session's bubble (review 2026-06-12). Bounded per session (insertion-order
   // eviction) so a long session can't grow it without limit.
   const ownedMessageIds = new Map();   // sessionKey → Set<number>
+  // The dispatcher is created once per daemon and shared by every CliProcess,
+  // so the OUTER map also needs a bound: one entry per sessionKey ever seen,
+  // never dropped on session kill/eviction → slow unbounded growth on a
+  // long-lived multi-chat bot. Insertion-order eviction; re-touching a key
+  // re-inserts it so active sessions stay resident.
+  const OWNED_SESSION_CAP = 128;
   const rememberOwned = (sk, id) => {
     if (id == null || sk == null) return;
     const n = Number(id);
     if (!Number.isFinite(n)) return;
     let set = ownedMessageIds.get(sk);
-    if (!set) { set = new Set(); ownedMessageIds.set(sk, set); }
+    if (!set) { set = new Set(); }
+    else ownedMessageIds.delete(sk);   // re-insert → freshest in iteration order
+    ownedMessageIds.set(sk, set);
+    while (ownedMessageIds.size > OWNED_SESSION_CAP) {
+      ownedMessageIds.delete(ownedMessageIds.keys().next().value);
+    }
     set.add(n);
     while (set.size > OWNED_MSG_CAP) set.delete(set.values().next().value);
   };

package/lib/sdk/callbacks.js

@@ -21,7 +21,7 @@
 'use strict';
 
 const { getTopicConfig } = require('../session-key');
-const { pickBackend } = require('../process/factory');
+const { pickBackend } = require('@shumkov/orchestra');
 
 function createSdkCallbacks({
   db,
@@ -102,6 +102,7 @@ function createSdkCallbacks({
         effort: topicConfig.effort || chatConfig.effort || null,
         pm_backend: pickBackend({
           config, chatId: entry.chatId, threadId: entry.threadId || null,
+          pmDefault: 'sdk',   // polygram's default backend (orchestra defaults to 'cli')
         }),
       }), `upsert session ${sessionKey}`);
     },

package/lib/secret-detect.js

@@ -31,7 +31,19 @@ const RULES = [
   { name: 'github-pat',   tier: 'high', re: /\bgithub_pat_[A-Za-z0-9_]{60,}\b/g },
   { name: 'github-token', tier: 'high', re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
   { name: 'anthropic',    tier: 'high', re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
-  { name: 'openai',       tier: 'high', re: /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
+  // OpenAI keys come in two real shapes: sk-proj-<token> (project keys,
+  // hyphens/underscores allowed in the body) and legacy sk-<base62, 40+>.
+  // The body class must NOT allow hyphens after a bare `sk-` — ordinary
+  // hyphenated slugs ("sk-refactor-the-database-layer") would auto-redact
+  // at high tier, irreversibly destroying user/bot text. `sk-ant-` and
+  // `sk-proj-` can't reach the legacy rule: their 3-4 alnum chars end at
+  // a hyphen long before the 40-char floor.
+  { name: 'openai',       tier: 'high', re: /\bsk-proj-[A-Za-z0-9_-]{20,}\b/g },
+  // Review (security + adversarial): sk-proj- isn't the only hyphenated-
+  // prefix shape OpenAI issues — service-account and admin keys follow the
+  // same pattern and were slipping past undetected after the tighten above.
+  { name: 'openai',       tier: 'high', re: /\bsk-(?:svcacct|admin)-[A-Za-z0-9_-]{20,}\b/g },
+  { name: 'openai',       tier: 'high', re: /\bsk-[A-Za-z0-9]{40,}\b/g },
   { name: 'slack',        tier: 'high', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
   { name: 'stripe',       tier: 'high', re: /\bsk_live_[A-Za-z0-9]{20,}\b/g },
   { name: 'tg-bot-token', tier: 'high', re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g },

package/lib/telegram/chunk.js

@@ -124,6 +124,20 @@ function resolveChunkEarlyReturn(text, limit) {
   return undefined;
 }
 
+// A hard cut at a fixed UTF-16 offset can land between the two code units
+// of a surrogate pair (astral chars: emoji, rare CJK, math symbols) — the
+// pair then renders as U+FFFD on both sides of the boundary. Back the cut
+// off one unit when it would split a pair. Never returns 0 (a degenerate
+// limit of 1 keeps the raw cut rather than looping forever on an empty
+// chunk).
+function surrogateSafeCut(text, idx) {
+  if (idx > 1 && idx < text.length) {
+    const c = text.charCodeAt(idx - 1);
+    if (c >= 0xD800 && c <= 0xDBFF) return idx - 1;
+  }
+  return idx;
+}
+
 // Generic break-resolver loop shared with markdown variant. The resolver
 // receives a `window` (text.slice(0, limit)) and returns where to break.
 // Negative / out-of-range break indices fall back to hard-cut at limit.
@@ -136,7 +150,7 @@ function chunkTextByBreakResolver(text, limit, resolveBreakIndex) {
     const candidateBreak = resolveBreakIndex(remaining.slice(0, limit));
     const breakIdx = Number.isFinite(candidateBreak) && candidateBreak > 0 && candidateBreak <= limit
       ? candidateBreak
-      : limit;
+      : surrogateSafeCut(remaining, limit);
     const chunk = remaining.slice(0, breakIdx).trimEnd();
     if (chunk.length > 0) chunks.push(chunk);
     // If we broke on a separator (whitespace), consume it — don't carry it
@@ -202,7 +216,7 @@ function chunkMarkdownText(text, limit) {
   while (remaining.length > limit) {
     const spans = parseFenceSpans(remaining);
     const softBreak = pickSafeBreakIndex(remaining.slice(0, limit), spans);
-    let breakIdx = softBreak > 0 ? softBreak : limit;
+    let breakIdx = softBreak > 0 ? softBreak : surrogateSafeCut(remaining, limit);
     const initialFence = isSafeFenceBreak(spans, breakIdx) ? undefined : findFenceSpanAt(spans, breakIdx);
     let fenceToSplit = initialFence;
     if (initialFence) {
@@ -215,7 +229,7 @@ function chunkMarkdownText(text, limit) {
         // Caller will see a malformed chunk, but that's a degenerate
         // input case (limit smaller than the close marker).
         fenceToSplit = undefined;
-        breakIdx = limit;
+        breakIdx = surrogateSafeCut(remaining, limit);
       } else {
         // Look for a newline inside the fence body that's late enough
         // to make progress (past the open line + at least one body line)
@@ -243,11 +257,11 @@ function chunkMarkdownText(text, limit) {
             // No safe in-fence newline found and no room to add one —
             // give up on splitting this fence; hard-cut at limit.
             fenceToSplit = undefined;
-            breakIdx = limit;
+            breakIdx = surrogateSafeCut(remaining, limit);
           } else {
             // Force the break; chunker will append a synthetic newline
             // before the close line.
-            breakIdx = Math.max(minProgressIdx, maxIdxIfNeedNewline);
+            breakIdx = surrogateSafeCut(remaining, Math.max(minProgressIdx, maxIdxIfNeedNewline));
           }
         }
       }
@@ -294,7 +308,7 @@ function chunkMarkdownText(text, limit) {
       // limit (cheap heuristic — much better than mid-word).
       const window = rest.slice(0, limit);
       const lastNl = window.lastIndexOf('\n', limit - 1);
-      const cutAt = lastNl > limit - 200 ? lastNl + 1 : limit;
+      const cutAt = lastNl > limit - 200 ? lastNl + 1 : surrogateSafeCut(rest, limit);
       safe.push(rest.slice(0, cutAt));
       rest = rest.slice(cutAt);
     }

package/lib/telegram/process-agent-reply.js

@@ -51,7 +51,9 @@
  * @param {object} opts.bot                  — grammy bot instance
  * @param {Function} opts.tg                 — (bot, method, params, meta) → Promise<res>
  * @param {string|number} opts.chatId
- * @param {?number} opts.threadId            — Telegram message_thread_id (or null)
+ * @param {?(number|string)} opts.threadId   — Telegram message_thread_id (or null).
+ *   Treated as opaque, deliver.js-style: the cli backend passes a STRING, so an
+ *   integer-only guard would drop the id and send stickers to the General topic.
  * @param {?number} opts.replyToMessageId    — inbound msg_id this reply targets; null for unsolicited
  * @param {boolean} [opts.applyReactions]    — apply [react:EMOJI] tags to replyToMessageId. False for
  *                                              unsolicited (autonomous-wakeup) where there IS no target;
@@ -173,7 +175,7 @@ async function processAndDeliverAgentText({
       await tg(bot, 'sendSticker', {
         chat_id: chatId,
         sticker: parsed.sticker,
-        ...(Number.isInteger(threadId) && { message_thread_id: threadId }),
+        ...(threadId != null && { message_thread_id: threadId }),
       }, {
         ...meta,
         source: `${source}-sticker`,
@@ -192,7 +194,7 @@ async function processAndDeliverAgentText({
       await tg(bot, 'sendSticker', {
         chat_id: chatId,
         sticker: s.fileId,
-        ...(Number.isInteger(threadId) && { message_thread_id: threadId }),
+        ...(threadId != null && { message_thread_id: threadId }),
       }, {
         ...meta,
         source: `${source}-inline-sticker`,

package/lib/telegram/streamer.js

@@ -121,7 +121,12 @@ function createStreamer({
   // which preserves all content without any byte-cut.
   function truncateForLive(s) {
     if (s.length <= maxLen) return s;
-    return s.slice(0, maxLen - 3) + '...';
+    // Back off one unit if the cut would split a surrogate pair (emoji /
+    // astral chars) — a lone high surrogate renders as � in the live bubble.
+    let cut = maxLen - 3;
+    const cc = s.charCodeAt(cut - 1);
+    if (cc >= 0xD800 && cc <= 0xDBFF) cut -= 1;
+    return s.slice(0, cut) + '...';
   }
 
   // rc.67: scrub recognised inline tags BEFORE the streamer commits text

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.17.11",
+  "version": "0.17.12",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {
@@ -63,6 +63,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.123",
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "@shumkov/orchestra": "^0.4.0",
     "better-sqlite3": "^12.9.0",
     "grammy": "^1.42.0",
     "markdown-it": "^14.1.1",