polygram 0.21.0 → 0.23.0

package/lib/handlers/codex-reconciliation.js

@@ -0,0 +1,230 @@
+'use strict';
+
+const { createHash, randomUUID } = require('node:crypto');
+
+const CALLBACK_PREFIX = 'cxr';
+const CALLBACK_TOKEN_BYTES = 16;
+
+const ACTIONS = Object.freeze({
+  incorporated: Object.freeze({
+    callback: 'i',
+    disposition: 'incorporated',
+    reason: 'owner marked the ambiguous input incorporated via Telegram',
+    acknowledgement: 'Marked incorporated. No retry was authorized.',
+  }),
+  dismissed: Object.freeze({
+    callback: 'd',
+    disposition: 'dismissed',
+    reason: 'owner dismissed the ambiguous input without retry via Telegram',
+    acknowledgement: 'Dismissed without retry.',
+  }),
+  retry: Object.freeze({
+    callback: 'r',
+    disposition: 'retry-authorized',
+    reason: 'owner authorized one retry after the duplicate-risk warning via Telegram',
+    acknowledgement: 'One retry was authorized. It remains fenced by containment.',
+  }),
+});
+
+const ACTION_BY_CALLBACK = new Map(
+  Object.values(ACTIONS).map((action) => [action.callback, action]),
+);
+
+function attemptToken(attemptId) {
+  if (typeof attemptId !== 'string' || attemptId.length === 0) {
+    throw new TypeError('Codex reconciliation attempt ID is required');
+  }
+  return createHash('sha256')
+    .update(attemptId)
+    .digest('hex')
+    .slice(0, CALLBACK_TOKEN_BYTES * 2);
+}
+
+function callbackData(action, attemptId) {
+  const value = `${CALLBACK_PREFIX}:${action.callback}:${attemptToken(attemptId)}`;
+  if (Buffer.byteLength(value, 'utf8') > 64) {
+    throw new TypeError('Codex reconciliation callback exceeds Telegram limits');
+  }
+  return value;
+}
+
+function buildCodexReconciliationView(attempt) {
+  if (
+    !attempt
+    || typeof attempt.attempt_id !== 'string'
+    || typeof attempt.telegram_message_id !== 'string'
+  ) {
+    throw new TypeError('Codex reconciliation view requires a located attempt');
+  }
+  const quarantined = attempt.containment_status === 'quarantined';
+  const containment = quarantined
+    ? 'This decision does not release containment quarantine; the prescribed host reboot is still required.'
+    : 'This decision does not release containment quarantine.';
+  return {
+    text: [
+      '⚠️ Codex input needs reconciliation',
+      `Original Telegram message #${attempt.telegram_message_id} may already have been incorporated.`,
+      'Choose one owner action. Retrying can duplicate output or side effects.',
+      containment,
+    ].join('\n'),
+    reply_markup: {
+      inline_keyboard: [
+        [
+          {
+            text: '✓ Mark incorporated',
+            callback_data: callbackData(ACTIONS.incorporated, attempt.attempt_id),
+          },
+          {
+            text: 'Dismiss without retry',
+            callback_data: callbackData(ACTIONS.dismissed, attempt.attempt_id),
+          },
+        ],
+        [{
+          text: '⚠ Authorize one retry (duplicate risk)',
+          callback_data: callbackData(ACTIONS.retry, attempt.attempt_id),
+        }],
+      ],
+    },
+  };
+}
+
+function configuredOperatorUserId(config) {
+  const configured = config?.bot?.operatorUserId
+    ?? config?.bot?.adminChatId;
+  const value = Number(configured);
+  return Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+
+async function acknowledge(ctx, text, showAlert = false) {
+  if (typeof ctx?.answerCallbackQuery !== 'function') return;
+  await ctx.answerCallbackQuery({
+    text,
+    ...(showAlert ? { show_alert: true } : {}),
+  }).catch(() => {});
+}
+
+function createHandleCodexReconciliationCallback({
+  config,
+  db,
+  intentLock,
+  getSessionKey,
+  retryAttemptId = randomUUID,
+  now = Date.now,
+  isAuthorizedActor = null,
+  logger = console,
+} = {}) {
+  if (
+    !config
+    || typeof db?.listUnresolvedCodexAttempts !== 'function'
+    || typeof db?.reconcileCodexAttempt !== 'function'
+    || typeof intentLock?.acquire !== 'function'
+    || typeof getSessionKey !== 'function'
+    || typeof retryAttemptId !== 'function'
+    || typeof now !== 'function'
+  ) {
+    throw new TypeError('Codex reconciliation handler dependencies are incomplete');
+  }
+
+  return async function handleCodexReconciliationCallback(ctx) {
+    const data = String(ctx?.callbackQuery?.data ?? '');
+    const match = /^cxr:([idr]):([a-f0-9]{32})$/.exec(data);
+    if (!match) return false;
+
+    const action = ACTION_BY_CALLBACK.get(match[1]);
+    const token = match[2];
+    const message = ctx.callbackQuery?.message;
+    const chatId = message?.chat?.id == null
+      ? null
+      : String(message.chat.id);
+    const chatConfig = chatId == null ? null : config.chats?.[chatId];
+    if (!chatConfig) {
+      await acknowledge(ctx, 'This reconciliation is not available.', true);
+      return true;
+    }
+
+    const actorId = ctx.from?.id ?? ctx.callbackQuery?.from?.id;
+    const operatorUserId = configuredOperatorUserId(config);
+    const allowed = typeof isAuthorizedActor === 'function'
+      ? await isAuthorizedActor({ actorId, chatId, ctx })
+      : (
+        operatorUserId != null
+        && Number(actorId) === operatorUserId
+      );
+    if (!allowed) {
+      await acknowledge(ctx, 'Not authorised to reconcile Codex input.', true);
+      return true;
+    }
+
+    const threadId = message.message_thread_id?.toString() ?? null;
+    const sessionKey = getSessionKey(chatId, threadId, chatConfig);
+    const release = await intentLock.acquire(sessionKey);
+    try {
+      const matching = db.listUnresolvedCodexAttempts({
+        session_key: sessionKey,
+      }).filter((attempt) => attemptToken(attempt.attempt_id) === token);
+      if (matching.length !== 1) {
+        await acknowledge(
+          ctx,
+          matching.length === 0
+            ? 'This input was already resolved or is no longer available.'
+            : 'Reconciliation identity conflict; no action was recorded.',
+          true,
+        );
+        return true;
+      }
+
+      const attempt = matching[0];
+      const input = {
+        attempt_id: attempt.attempt_id,
+        disposition: action.disposition,
+        actor: `telegram-user:${actorId}`,
+        reason: action.reason,
+        ts: now(),
+      };
+      if (action.disposition === 'retry-authorized') {
+        input.retry_attempt_id = retryAttemptId();
+        input.duplicate_risk_acknowledged = true;
+      }
+
+      try {
+        db.reconcileCodexAttempt(input);
+      } catch (error) {
+        if (
+          error?.code === 'CODEX_ATTEMPT_ALREADY_RECONCILED'
+          || error?.code === 'CODEX_ATTEMPT_NOT_AMBIGUOUS'
+        ) {
+          await acknowledge(ctx, 'This input was already resolved.', true);
+          return true;
+        }
+        if (error?.code === 'CODEX_RETRY_GENERATION_NOT_TERMINAL') {
+          await acknowledge(
+            ctx,
+            'Wait for the prior Codex generation to finish before authorizing retry.',
+            true,
+          );
+          return true;
+        }
+        throw error;
+      }
+
+      if (typeof ctx.editMessageReplyMarkup === 'function') {
+        await ctx.editMessageReplyMarkup({ inline_keyboard: [] }).catch((error) => {
+          logger.error?.(
+            `Codex reconciliation UI update failed: ${error?.message || error}`,
+          );
+        });
+      }
+      await acknowledge(ctx, action.acknowledgement);
+      return true;
+    } finally {
+      release();
+    }
+  };
+}
+
+module.exports = {
+  ACTIONS,
+  attemptToken,
+  buildCodexReconciliationView,
+  createHandleCodexReconciliationCallback,
+};

package/lib/handlers/config-callback.js

@@ -4,8 +4,8 @@
  * When a user taps a button on the config card, this routes:
  *   1. validate the new value;
  *   2. mutate chatConfig in-place + persist via db.logConfigChange;
- *   3. apply the change live to the running SDK Query via
- *      pm.applyFlagSettings (effort) or pm.setModel (model);
+ *   3. apply the change live to Claude via its legacy methods, or select one
+ *      complete Codex pair for the next turn via pm.selectModelSettings;
  *   4. re-render the card with the new ✓ marker;
  *   5. acknowledge the button press with a context-aware toast.
  *
@@ -19,6 +19,15 @@
 const { toTelegramHtml } = require('../telegram/format');
 const { resolveRichTextEnabled } = require('../telegram/rich');
 const { getTopicConfig, getConfigWriteScope } = require('../session-key');
+const {
+  configuredRuntimeValue,
+  formatCodexSettingsOutcome,
+  getCodexCatalogEfforts,
+  getCodexCatalogModels,
+  isCodexRuntimeView,
+  resolveCodexEffortForModel,
+  withCodexSettingsOutcome,
+} = require('./config-ui');
 
 const MODEL_OPTIONS = ['opus', 'sonnet', 'haiku'];
 const EFFORT_OPTIONS = ['low', 'medium', 'high', 'xhigh', 'max'];
@@ -31,6 +40,8 @@ function createHandleConfigCallback({
   getSessionKey,
   formatConfigInfoText,
   buildConfigKeyboard,
+  resolveRuntimeView = null,
+  intentLock,
   saveConfig = () => {},
   botName,
   logger = console,
@@ -58,101 +69,325 @@ function createHandleConfigCallback({
       return;
     }
 
-    if (isRichText) {
-      if (value !== 'on' && value !== 'off') {
-        await ctx.answerCallbackQuery({ text: 'Invalid richtext value' }).catch(() => {});
-        return;
+    const callbackThreadIdEarly = ctx.callbackQuery.message?.message_thread_id?.toString() || null;
+    const callbackSessionKey = getSessionKey(
+      chatId,
+      callbackThreadIdEarly,
+      chatConfig,
+    );
+    const releaseIntent = await intentLock.acquire(callbackSessionKey);
+    let intentHeld = true;
+    const releaseConfigIntent = () => {
+      if (!intentHeld) return;
+      intentHeld = false;
+      releaseIntent();
+    };
+    let runtimeView = null;
+    try {
+      if (typeof resolveRuntimeView === 'function') {
+        try {
+          runtimeView = await resolveRuntimeView({
+            sessionKey: callbackSessionKey,
+            chatId,
+            threadId: callbackThreadIdEarly,
+          });
+        } catch (error) {
+          logger.error?.(
+            `[${botName}] config-callback runtime view failed: `
+              + `${error?.code || error?.name || 'unknown'}`,
+          );
+          releaseConfigIntent();
+          await ctx.answerCallbackQuery({
+            text: 'Configuration is temporarily unavailable',
+            show_alert: true,
+          }).catch(() => {});
+          return;
+        }
       }
-    } else {
-      const validValues = setting === 'model' ? MODEL_OPTIONS : EFFORT_OPTIONS;
-      if (!validValues.includes(value)) {
-        await ctx.answerCallbackQuery({ text: `Invalid ${setting}` }).catch(() => {});
+      const codex = isCodexRuntimeView(runtimeView);
+      let currentModel = null;
+
+      if (isRichText) {
+        if (value !== 'on' && value !== 'off') {
+          releaseConfigIntent();
+          await ctx.answerCallbackQuery({ text: 'Invalid richtext value' })
+            .catch(() => {});
+          return;
+        }
+      } else {
+        const topicConfig = getTopicConfig(chatConfig, callbackThreadIdEarly);
+        currentModel = configuredRuntimeValue(
+          chatConfig,
+          topicConfig,
+          runtimeView,
+          'model',
+        );
+        const validValues = codex
+          ? setting === 'model'
+            ? getCodexCatalogModels(runtimeView).map((entry) => entry.model)
+            : getCodexCatalogEfforts(runtimeView, currentModel)
+          : setting === 'model' ? MODEL_OPTIONS : EFFORT_OPTIONS;
+        if (!validValues.includes(value)) {
+          releaseConfigIntent();
+          await ctx.answerCallbackQuery({ text: `Invalid ${setting}` })
+            .catch(() => {});
+          return;
+        }
+      }
+
+      // Write to the scope the card belongs to: a topic card targets THAT topic
+      // (so Music ≠ General), a chat-level card the chat root. Resolving the
+      // thread BEFORE the already-set check so "Already X" compares against the
+      // topic's effective value, not the chat root (2026-06-12 bug).
+      const { scope: writeScope, threadId: writeThreadId } =
+        getConfigWriteScope(chatConfig, callbackThreadIdEarly, {
+          allowNonIsolatedTopic: setting === 'richtext',
+        });
+      // The persisted camel-case key differs from the lowercase callback
+      // label used alongside model and effort.
+      const configField = isRichText
+        ? 'richText'
+        : codex
+          ? setting === 'model' ? 'codexModel' : 'codexEffort'
+          : setting;
+      const oldValue = isRichText
+        ? resolveRichTextEnabled(config, chatId, callbackThreadIdEarly)
+        : (
+          writeScope[configField] != null
+            ? writeScope[configField]
+            : chatConfig[configField] != null
+              ? chatConfig[configField]
+              : codex ? runtimeView[setting] : chatConfig[configField]
+        );
+      const snapshots = new Map([
+        [configField, {
+          present: Object.hasOwn(writeScope, configField),
+          value: writeScope[configField],
+        }],
+      ]);
+      if (codex && setting === 'model') {
+        snapshots.set('codexEffort', {
+          present: Object.hasOwn(writeScope, 'codexEffort'),
+          value: writeScope.codexEffort,
+        });
+      }
+      let effortAdjustment = null;
+      let selectedEffort = setting === 'effort' ? value : null;
+      if (codex && setting === 'model') {
+        const oldEffort = writeScope.codexEffort != null
+          ? writeScope.codexEffort
+          : chatConfig.codexEffort != null
+            ? chatConfig.codexEffort
+            : runtimeView.effort;
+        const nextEffort = resolveCodexEffortForModel(
+          runtimeView,
+          value,
+          oldEffort,
+        );
+        if (nextEffort == null) {
+          releaseConfigIntent();
+          await ctx.answerCallbackQuery({
+            text: 'Selected model has no authenticated default effort',
+            show_alert: true,
+          }).catch(() => {});
+          return;
+        }
+        selectedEffort = nextEffort;
+        if (nextEffort !== oldEffort) {
+          effortAdjustment = { oldValue: oldEffort, newValue: nextEffort };
+        }
+      }
+      if (oldValue === parsedValue) {
+        releaseConfigIntent();
+        await ctx.answerCallbackQuery({ text: `Already ${value}` })
+          .catch(() => {});
         return;
       }
-    }
 
-    // Write to the scope the card belongs to: a topic card targets THAT topic
-    // (so Music ≠ General), a chat-level card the chat root. Resolving the
-    // thread BEFORE the already-set check so "Already X" compares against the
-    // topic's effective value, not the chat root (2026-06-12 bug).
-    const callbackThreadIdEarly = ctx.callbackQuery.message?.message_thread_id?.toString() || null;
-    const { scope: writeScope, threadId: writeThreadId } =
-      getConfigWriteScope(chatConfig, callbackThreadIdEarly, {
-        allowNonIsolatedTopic: setting === 'richtext',
-      });
-    // The persisted camel-case key differs from the lowercase callback
-    // label used alongside model and effort.
-    const configField = isRichText ? 'richText' : setting;
-    const oldValue = isRichText
-      ? resolveRichTextEnabled(config, chatId, callbackThreadIdEarly)
-      : (writeScope[configField] != null ? writeScope[configField] : chatConfig[configField]);
-    if (oldValue === parsedValue) {
-      await ctx.answerCallbackQuery({ text: `Already ${value}` }).catch(() => {});
-      return;
-    }
+      writeScope[configField] = parsedValue;
+      if (effortAdjustment) {
+        writeScope.codexEffort = effortAdjustment.newValue;
+      }
+      try {
+        await saveConfig();
+      } catch (error) {
+        for (const [field, snapshot] of snapshots) {
+          if (snapshot.present) writeScope[field] = snapshot.value;
+          else delete writeScope[field];
+        }
+        logger.error?.(
+          `[${botName}] config-callback saveConfig failed: ${error.message}`,
+        );
+        releaseConfigIntent();
+        await ctx.answerCallbackQuery({
+          text: `Couldn't save ${setting}; nothing changed`,
+          show_alert: true,
+        }).catch(() => {});
+        return;
+      }
+      const cmdUserId = ctx.callbackQuery.from?.id || null;
+      const cmdUser = ctx.callbackQuery.from?.first_name
+        || ctx.callbackQuery.from?.username
+        || null;
+      const auditRows = [{
+          chat_id: chatId, thread_id: writeThreadId,
+          // The audit schema intentionally keeps provider-neutral field names.
+          field: isRichText ? configField : setting,
+          old_value: oldValue, new_value: parsedValue,
+          user: cmdUser, user_id: cmdUserId, source: 'inline-button',
+        }];
+      if (effortAdjustment) {
+        auditRows.push({
+            chat_id: chatId,
+            thread_id: writeThreadId,
+            field: 'effort',
+            old_value: effortAdjustment.oldValue,
+            new_value: effortAdjustment.newValue,
+            user: cmdUser,
+            user_id: cmdUserId,
+            source: 'inline-button',
+        });
+      }
+      if (codex && !isRichText) {
+        try {
+          db.logConfigChanges(auditRows);
+        } catch (error) {
+          for (const [field, snapshot] of snapshots) {
+            if (snapshot.present) writeScope[field] = snapshot.value;
+            else delete writeScope[field];
+          }
+          let rollbackFailed = false;
+          try {
+            await saveConfig();
+          } catch (rollbackError) {
+            rollbackFailed = true;
+            logger.error?.(
+              `[${botName}] config-callback rollback failed: `
+                + rollbackError.message,
+            );
+          }
+          logger.error?.(
+            `[${botName}] config-callback audit failed: ${error.message}`,
+          );
+          releaseConfigIntent();
+          await ctx.answerCallbackQuery({
+            text: rollbackFailed
+              ? `Couldn't audit ${setting}; live process unchanged, `
+                + 'persisted config needs attention'
+              : `Couldn't audit ${setting}; nothing changed`,
+            show_alert: true,
+          }).catch(() => {});
+          return;
+        }
+      } else {
+        dbWrite(() => {
+          for (const row of auditRows) db.logConfigChange(row);
+        }, `log ${configField} change`);
+      }
 
-    writeScope[configField] = parsedValue;
-    // Persist to config.json so the change survives a restart — without this,
-    // every /model tap was lost on the next deploy (2026-06-12). Best-effort:
-    // never let a disk hiccup swallow the in-memory change + live application.
-    try { saveConfig(); }
-    catch (err) { logger.error?.(`[${botName}] config-callback saveConfig failed: ${err.message}`); }
-    const cmdUserId = ctx.callbackQuery.from?.id || null;
-    const cmdUser = ctx.callbackQuery.from?.first_name || ctx.callbackQuery.from?.username || null;
-    dbWrite(() => db.logConfigChange({
-      chat_id: chatId, thread_id: writeThreadId, field: configField,
-      old_value: oldValue, new_value: parsedValue,
-      user: cmdUser, user_id: cmdUserId, source: 'inline-button',
-    }), `log ${configField} change`);
+      // Graceful application to the topic's session. Claude keeps its
+      // existing live SDK calls. Codex receives one complete pair; expected
+      // lifecycle states are reported by a discriminated outcome.
+      const callbackThreadId = callbackThreadIdEarly;
+      let applied = false;
+      let settingsResult = null;
+      if (codex && !isRichText) {
+        const selectedModel = setting === 'model' ? value : currentModel;
+        try {
+          settingsResult = await pm.selectModelSettings(callbackSessionKey, {
+            model: selectedModel,
+            effort: selectedEffort,
+          });
+        } catch (error) {
+          logger.error?.(
+            `[${botName}] config-callback Codex selection failed: `
+              + `${error?.code || error?.name || 'unknown'}`,
+          );
+          settingsResult = {
+            outcome: 'live-status-unknown',
+            nextTurn: {
+              model: selectedModel,
+              effort: selectedEffort,
+            },
+          };
+        }
+        runtimeView = withCodexSettingsOutcome(runtimeView, settingsResult);
+      } else if (!codex && setting === 'effort') {
+        applied = await pm.applyFlagSettings(
+          callbackSessionKey,
+          { effortLevel: value },
+        );
+      } else if (!codex && setting === 'model') {
+        applied = await pm.setModel(callbackSessionKey, value);
+      }
+      const anyActive = !applied;
+      releaseConfigIntent();
 
-    // Graceful application to the topic's session. SDK pm applies live
-    // via setModel / applyFlagSettings; chatConfig is already updated
-    // on disk above so a missing live session still picks up the new
-    // value on its next cold spawn. richText is NOT a spawn-time flag —
-    // delivery reads it live at send time (lib/telegram/rich.js), so
-    // there is nothing to apply to a running session; only the system-
-    // prompt authoring hint lags to the next spawn, which the rich-text
-    // acknowledgement explains separately from model/effort changes.
-    const callbackThreadId = callbackThreadIdEarly;
-    const callbackSessionKey = getSessionKey(chatId, callbackThreadId, chatConfig);
-    let applied = false;
-    if (setting === 'effort') {
-      applied = await pm.applyFlagSettings(callbackSessionKey, { effortLevel: value });
-    } else if (setting === 'model') {
-      applied = await pm.setModel(callbackSessionKey, value);
-    }
-    const anyActive = !applied;
+      // Re-render the card with the new ✓ marker. Detect original card
+      // type (model-only / effort-only / both) by counting rows in the
+      // existing reply_markup so the user sees the same layout they
+      // tapped into.
+      const existingRows =
+        ctx.callbackQuery.message?.reply_markup?.inline_keyboard?.length || 0;
+      const showRow = existingRows >= 2 ? 'all' : setting;
+      const _cbTopicCfg = getTopicConfig(chatConfig, callbackThreadId);
+      const effectiveRichText = resolveRichTextEnabled(
+        config,
+        chatId,
+        callbackThreadId,
+      );
+      const newInfo = await formatConfigInfoText(
+        chatConfig,
+        showRow,
+        codex ? callbackSessionKey : chatId,
+        _cbTopicCfg,
+        effectiveRichText,
+        runtimeView,
+      );
+      const newKeyboard = buildConfigKeyboard(
+        chatConfig,
+        showRow,
+        _cbTopicCfg,
+        effectiveRichText,
+        runtimeView,
+      );
+      try {
+        const { text: html, parseMode } = toTelegramHtml(newInfo);
+        await ctx.editMessageText(html, {
+          reply_markup: newKeyboard,
+          ...(parseMode && { parse_mode: parseMode }),
+        });
+      } catch (err) {
+        logger.error?.(`[${botName}] config-card edit failed: ${err.message}`);
+      }
 
-    // Re-render the card with the new ✓ marker. Detect original card
-    // type (model-only / effort-only / both) by counting rows in the
-    // existing reply_markup so the user sees the same layout they
-    // tapped into.
-    const existingRows = ctx.callbackQuery.message?.reply_markup?.inline_keyboard?.length || 0;
-    const showRow = existingRows >= 2 ? 'all' : setting;
-    // Re-render with per-topic overrides resolved (topic > chat), so the agent
-    // line doesn't flip back to the chat-level default after a button tap —
-    // mirrors the /model command card (polygram.js). getTopicConfig returns {}
-    // for the chat-level card.
-    const _cbTopicCfg = getTopicConfig(chatConfig, callbackThreadId);
-    const effectiveRichText = resolveRichTextEnabled(config, chatId, callbackThreadId);
-    const newInfo = formatConfigInfoText(chatConfig, showRow, chatId, _cbTopicCfg, effectiveRichText);
-    const newKeyboard = buildConfigKeyboard(chatConfig, showRow, _cbTopicCfg, effectiveRichText);
-    try {
-      const { text: html, parseMode } = toTelegramHtml(newInfo);
-      await ctx.editMessageText(html, {
-        reply_markup: newKeyboard,
-        ...(parseMode && { parse_mode: parseMode }),
-      });
-    } catch (err) {
-      logger.error?.(`[${botName}] config-card edit failed: ${err.message}`);
+      // Rich delivery changes immediately, but its authoring hint changes
+      // on the next session spawn; surface both timings in the acknowledgement.
+      const ackText = isRichText
+        ? (
+          parsedValue
+            ? 'Rich text → on (delivery live; agent authors for it next session)'
+            : 'Rich text → off'
+        )
+        : codex
+          ? (
+            `${setting} → ${value}`
+            + (
+              effortAdjustment
+                ? `; effort → ${effortAdjustment.newValue}`
+                : ''
+            )
+            + formatCodexSettingsOutcome(settingsResult)
+          )
+          : (
+            anyActive
+              ? `${setting} → ${value} — switching when finished`
+              : `${setting} → ${value}`
+          );
+      await ctx.answerCallbackQuery({ text: ackText }).catch(() => {});
+    } finally {
+      releaseConfigIntent();
     }
-
-    // Rich delivery changes immediately, but its authoring hint changes
-    // on the next session spawn; surface both timings in the acknowledgement.
-    const ackText = isRichText
-      ? (parsedValue ? 'Rich text → on (delivery live; agent authors for it next session)' : 'Rich text → off')
-      : (anyActive ? `${setting} → ${value} — switching when finished` : `${setting} → ${value}`);
-    await ctx.answerCallbackQuery({ text: ackText }).catch(() => {});
   };
 }