polygram 0.21.0 → 0.23.0

package/lib/ipc/runtime-directory.js

@@ -0,0 +1,208 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const DEFAULT_DIRECTORY_NAME = '.ipc';
+const BOT_NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
+const MAX_BOT_NAME_BYTES = 64;
+const MAX_UNIX_SOCKET_PATH_BYTES = 103;
+
+function ipcDirectoryError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function currentUid() {
+  if (typeof process.getuid !== 'function') {
+    throw ipcDirectoryError(
+      'IPC_DIR_UID_UNAVAILABLE',
+      'IPC directory ownership cannot be verified on this platform',
+    );
+  }
+  return process.getuid();
+}
+
+function isWithin(candidate, root) {
+  const relative = path.relative(root, candidate);
+  return (
+    relative === ''
+    || (
+      !relative.startsWith(`..${path.sep}`)
+      && relative !== '..'
+      && !path.isAbsolute(relative)
+    )
+  );
+}
+
+function existingRealpath(candidate) {
+  try {
+    return fs.realpathSync.native(candidate);
+  } catch {
+    return null;
+  }
+}
+
+function temporaryRoots() {
+  const roots = new Set([
+    '/tmp',
+    '/private/tmp',
+    '/var/tmp',
+    '/private/var/tmp',
+    path.resolve(os.tmpdir()),
+  ]);
+  for (const root of [...roots]) {
+    const canonical = existingRealpath(root);
+    if (canonical) roots.add(canonical);
+  }
+  return [...roots];
+}
+
+function assertNonTemporary(candidate) {
+  const paths = [candidate];
+  const canonical = existingRealpath(candidate);
+  if (canonical) paths.push(canonical);
+  if (paths.some((item) => temporaryRoots().some((root) => isWithin(item, root)))) {
+    throw ipcDirectoryError(
+      'IPC_DIR_TEMPORARY',
+      'IPC directory must not be located in a temporary directory',
+    );
+  }
+}
+
+function assertOwnedDirectory(candidate, { exactMode = null, label = 'IPC directory' } = {}) {
+  let entry;
+  try {
+    entry = fs.lstatSync(candidate);
+  } catch (cause) {
+    throw ipcDirectoryError('IPC_DIR_UNAVAILABLE', `${label} is unavailable`);
+  }
+  if (entry.isSymbolicLink()) {
+    throw ipcDirectoryError('IPC_DIR_SYMLINK', `${label} must not be a symlink`);
+  }
+  if (!entry.isDirectory()) {
+    throw ipcDirectoryError('IPC_DIR_NOT_DIRECTORY', `${label} must be a directory`);
+  }
+
+  const canonical = existingRealpath(candidate);
+  if (!canonical || canonical !== candidate) {
+    throw ipcDirectoryError('IPC_DIR_NOT_CANONICAL', `${label} must be canonical and contain no symlinks`);
+  }
+
+  const stat = fs.statSync(candidate);
+  if (stat.uid !== currentUid()) {
+    throw ipcDirectoryError('IPC_DIR_WRONG_OWNER', `${label} must be owned by the current user`);
+  }
+  const mode = stat.mode & 0o777;
+  if (exactMode !== null && mode !== exactMode) {
+    throw ipcDirectoryError('IPC_DIR_WRONG_MODE', `${label} must have mode 0700`);
+  }
+  return stat;
+}
+
+function assertSafeCreationParent(candidate) {
+  const parent = path.dirname(candidate);
+  const stat = assertOwnedDirectory(parent, { label: 'IPC directory parent' });
+  if ((stat.mode & 0o022) !== 0) {
+    throw ipcDirectoryError(
+      'IPC_DIR_UNSAFE_PARENT',
+      'IPC directory parent must not be group- or world-writable',
+    );
+  }
+}
+
+/**
+ * Resolve the one IPC runtime directory used by the daemon and its clients.
+ *
+ * The default stays under Polygram's DATA_DIR (`process.cwd()`), which is
+ * already outside agent write access. An override is accepted only as an
+ * absolute, canonical, non-temporary path.
+ */
+function runtimeDirectory({ cwd = process.cwd(), env = process.env } = {}) {
+  const hasOverride = Object.prototype.hasOwnProperty.call(env, 'POLYGRAM_IPC_DIR');
+  const configured = hasOverride
+    ? env.POLYGRAM_IPC_DIR
+    : path.join(cwd, DEFAULT_DIRECTORY_NAME);
+
+  if (typeof configured !== 'string' || configured.length === 0) {
+    throw ipcDirectoryError('IPC_DIR_INVALID', 'IPC directory must be a non-empty path');
+  }
+  if (!path.isAbsolute(configured)) {
+    throw ipcDirectoryError('IPC_DIR_RELATIVE', 'IPC directory must be absolute');
+  }
+
+  const resolved = path.resolve(configured);
+  if (resolved !== configured) {
+    throw ipcDirectoryError('IPC_DIR_NOT_CANONICAL', 'IPC directory path must be canonical');
+  }
+  assertNonTemporary(resolved);
+  assertSafeCreationParent(resolved);
+
+  if (fs.existsSync(resolved)) {
+    assertOwnedDirectory(resolved, { exactMode: 0o700 });
+  }
+  return resolved;
+}
+
+/**
+ * Create the resolved runtime directory exactly once with owner-only access,
+ * then revalidate it to catch pre-existing or raced unsafe filesystem state.
+ */
+function ensureRuntimeDirectory(options) {
+  const directory = runtimeDirectory(options);
+  if (!fs.existsSync(directory)) {
+    try {
+      fs.mkdirSync(directory, { mode: 0o700 });
+    } catch (error) {
+      if (error.code !== 'EEXIST') {
+        throw ipcDirectoryError('IPC_DIR_CREATE_FAILED', 'IPC directory could not be created');
+      }
+    }
+  }
+  assertOwnedDirectory(directory, { exactMode: 0o700 });
+  return directory;
+}
+
+function validateBotName(botName) {
+  if (
+    typeof botName !== 'string'
+    || Buffer.byteLength(botName, 'utf8') > MAX_BOT_NAME_BYTES
+    || !BOT_NAME_PATTERN.test(botName)
+  ) {
+    throw ipcDirectoryError(
+      'IPC_BOT_NAME_INVALID',
+      'IPC bot name may contain only letters, numbers, underscores, and hyphens',
+    );
+  }
+  return botName;
+}
+
+function socketPathFor(botName, options) {
+  const safeBotName = validateBotName(botName);
+  const socketPath = path.join(
+    runtimeDirectory(options),
+    `polygram-${safeBotName}.sock`,
+  );
+  if (Buffer.byteLength(socketPath, 'utf8') > MAX_UNIX_SOCKET_PATH_BYTES) {
+    throw ipcDirectoryError(
+      'IPC_SOCKET_PATH_TOO_LONG',
+      'IPC socket path exceeds the portable Unix-domain socket limit',
+    );
+  }
+  return socketPath;
+}
+
+function secretPathFor(botName, options) {
+  const safeBotName = validateBotName(botName);
+  return path.join(runtimeDirectory(options), `polygram-${safeBotName}.secret`);
+}
+
+module.exports = {
+  runtimeDirectory,
+  ensureRuntimeDirectory,
+  socketPathFor,
+  secretPathFor,
+  validateBotName,
+};

package/lib/ipc/server.js

@@ -1,7 +1,7 @@
 /**
  * Unix socket IPC server for the polygram daemon.
  *
- * One socket per bot process at `/tmp/polygram-<bot>.sock`. Clients
+ * One socket per bot process in Polygram's owner-only IPC runtime directory. Clients
  * (Claude Code approval hooks, future cron) send newline-delimited
  * JSON requests; the server invokes a registered handler and writes back a
  * newline-delimited JSON response.
@@ -13,14 +13,12 @@
 const net = require('net');
 const fs = require('fs');
 const crypto = require('crypto');
-
-function socketPathFor(botName) {
-  return `/tmp/polygram-${botName}.sock`;
-}
-
-function secretPathFor(botName) {
-  return `/tmp/polygram-${botName}.secret`;
-}
+const {
+  runtimeDirectory,
+  ensureRuntimeDirectory,
+  socketPathFor,
+  secretPathFor,
+} = require('./runtime-directory');
 
 /**
  * Generate and persist a fresh IPC secret. Written 0600 so only same-UID
@@ -29,9 +27,10 @@ function secretPathFor(botName) {
  * us a cheap way to reject stray processes that stumbled onto the socket
  * without intent — and makes the auth model explicit rather than implicit.
  */
-function writeSecret(botName) {
+function writeSecret(botName, options) {
   const secret = crypto.randomBytes(32).toString('base64url');
-  const p = secretPathFor(botName);
+  const p = secretPathFor(botName, options);
+  ensureRuntimeDirectory(options);
   fs.writeFileSync(p, secret, { mode: 0o600 });
   // Re-chmod in case umask overrode our mode on create.
   try { fs.chmodSync(p, 0o600); } catch {}
@@ -146,4 +145,11 @@ function writeReply(sock, obj) {
   } catch {}
 }
 
-module.exports = { start, socketPathFor, secretPathFor, writeSecret };
+module.exports = {
+  start,
+  runtimeDirectory,
+  ensureRuntimeDirectory,
+  socketPathFor,
+  secretPathFor,
+  writeSecret,
+};

package/lib/model-costs.js

@@ -28,10 +28,11 @@ const MODEL_COSTS = {
   'claude-haiku-4-5': { input: 0.80, output: 4, cacheRead: 0.08, cacheCreation: 1 },
   // Claude Opus 4.7 (1M context)
   'claude-opus-4-7': { input: 15, output: 75, cacheRead: 1.50, cacheCreation: 18.75 },
-  // Claude Opus 4.8 — what `--model opus` resolves to now (verified in the
-  // Music-topic transcript 2026-06-10). Same Opus pricing; without this entry
-  // opus turns fall back to the Sonnet `default` and undercount cost ~5×.
+  // Claude Opus 4.8 — kept for turns recorded before the CLI pin moved to
+  // 2.1.220; without an entry those fall back to the Sonnet `default`.
   'claude-opus-4-8': { input: 15, output: 75, cacheRead: 1.50, cacheCreation: 18.75 },
+  // Claude Opus 5 — what `--model opus` resolves to on the pinned CLI.
+  'claude-opus-5': { input: 5, output: 25, cacheRead: 0.50, cacheCreation: 6.25 },
   // Default fallback — Sonnet rates (safest mid-tier estimate).
   default: { input: 3, output: 15, cacheRead: 0.30, cacheCreation: 3.75 },
 };

package/lib/pm-interface.js

@@ -22,6 +22,10 @@
  * @property {string} sessionKey
  * @property {string|null} chatId
  * @property {string|null} threadId
+ * @property {string} label
+ * @property {'claude'|'codex'} runtime
+ * @property {string} backend
+ * @property {string|null} spawnProfileId
  * @property {boolean} closed
  * @property {boolean} inFlight
  * @property {Array<object>} pendingQueue   — array of pending sends
@@ -53,6 +57,24 @@
  * @property {string|null} chatId
  * @property {string|null} threadId
  * @property {string} label
+ * @property {'claude'|'codex'} runtime
+ *   Canonical runtime selected before process creation. Explicit Codex
+ *   selection reaches Orchestra through this field; it is not passed to
+ *   Claude's pickBackend() compatibility resolver.
+ * @property {string} backend
+ *   Canonical provider backend (`sdk`, `cli`, or `codex`).
+ * @property {string|null} spawnProfileId
+ *   Opaque identity from the successful runtime preflight. Codex process
+ *   creation must receive the exact profile it was preflighted with.
+ * @property {string} [runtimeConfigIdentity]
+ *   Polygram-owned identity of its resolved configuration. Orchestra ignores
+ *   this field and enforces runtime/backend/spawnProfileId with its own
+ *   identity; Polygram may use it for config audit or UI comparisons.
+ * @property {string|null} [cwd]
+ *   Resolved topic/chat/default working directory included in spawn identity.
+ * @property {string|null} [agent]
+ *   Resolved Claude agent. Always null for Codex; Codex instructions are
+ *   attested independently and must not reuse Claude's named-agent bundle.
  *
  * @typedef {object} Pm
  *   The unified ProcessManager interface.
@@ -61,6 +83,12 @@
  * @property {(sessionKey: string) => boolean} has
  * @property {(sessionKey: string) => PmEntry|null} get
  * @property {(sessionKey: string, ctx: PmSpawnContext) => Promise<PmEntry>} getOrSpawn
+ * @property {(sessionKey: string, ctx: PmSpawnContext) => Promise<PmEntry>} replaceRuntime
+ *   — strict serialized replacement. Same identity returns the current entry.
+ *   Live/pinned/blocked or conflicting replacement throws
+ *   `RUNTIME_SWITCH_IN_FLIGHT`; unsafe retirement throws
+ *   `RUNTIME_SWITCH_EVICTION_FAILED`; unknown runtime throws
+ *   `RUNTIME_UNKNOWN`; provider lease/config errors propagate.
  * @property {(sessionKey: string, prompt: string, opts?: PmSendOptions) => Promise<PmSendResult>} send
  * @property {(sessionKey: string) => Promise<void>} kill
  * @property {(chatId: string|number) => Promise<void>} killChat
@@ -76,6 +104,11 @@
  *     Returns false when sessionKey not found.
  * @property {((sessionKey: string, model: string) => Promise<boolean>)=} setModel
  *   — Query.setModel live (no respawn).
+ * @property {((sessionKey: string, settings: {model: string, effort: string}) => Promise<object>)=} selectModelSettings
+ * @property {((sessionKey: string) => Promise<object>)=} getModelSettingsStatus
+ *   — Atomically select the complete Codex pair for the next admitted turn.
+ *     Expected lifecycle states return a discriminated `outcome`; malformed
+ *     inputs and unexpected internal failures reject.
  * @property {((sessionKey: string, settings: {effortLevel?: string}) => Promise<boolean>)=} applyFlagSettings
  *   — Query.applyFlagSettings live (no respawn).
  * @property {((sessionKey: string, mode: string) => Promise<boolean>)=} setPermissionMode

package/lib/prompt.js

@@ -5,15 +5,19 @@
  * Telegram payload → polygram DB → unresolvable marker.
  */
 
-const { pickBackend } = require('@shumkov/orchestra');
+const { resolveRuntimeDescriptor } = require('./runtime-config');
 
 function resolvePromptBackend({ config, chatId, threadId = null }) {
-  return pickBackend({
+  const normalizedChatId = String(chatId);
+  const normalizedThreadId = threadId == null || threadId === ''
+    ? null
+    : String(threadId);
+  return resolveRuntimeDescriptor({
     config,
-    chatId: String(chatId),
-    threadId: threadId == null || threadId === '' ? null : String(threadId),
-    pmDefault: 'sdk',
-  });
+    chatId: normalizedChatId,
+    threadId: normalizedThreadId,
+    defaultPm: 'sdk',
+  }).backend;
 }
 
 /**
@@ -22,13 +26,15 @@ function resolvePromptBackend({ config, chatId, threadId = null }) {
  * must not be told to emit stickers it doesn't have. The emoji list is the bot's OWN
  * pack (its emojiToSticker keys), not a hard-coded set, so it always matches reality.
  *
- * @param {{ stickerEmojis?: string[], backend?: 'sdk'|'cli' }} [opts]
+ * @param {{ stickerEmojis?: string[], backend?: 'sdk'|'cli'|'codex' }} [opts]
  */
 function polygramInfo({ stickerEmojis = [], backend = 'sdk' } = {}) {
   const hasStickers = stickerEmojis.length > 0;
   const deliveryContract = backend === 'cli'
     ? `You are connected via a Telegram daemon (polygram) in channels mode. Inline final text is invisible to the Telegram user. For every user-visible response, you MUST call \`mcp__polygram-bridge__reply\` within this turn. Only a successful reply-tool receipt proves delivery. Do not claim something was already sent or posted above based only on the transcript; transcript content is not a delivery receipt. If delivery is uncertain, send it now with the reply tool.`
-    : `You are connected via a Telegram daemon (polygram). Just reply with text — polygram delivers your response automatically. Do NOT use Telegram MCP tools.`;
+    : backend === 'codex'
+      ? `You are connected to Telegram through polygram's Codex app-server runtime. Reply with inline text — polygram streams and delivers your final response automatically. Do NOT use Telegram MCP tools. This is a native macOS beta: command network and model-native web search are disabled, and product MCP tools and interactive approvals are unavailable. Keep long-running commands in the foreground. Do not start detached or background servers; they are unsupported and may survive hard runtime loss.`
+      : `You are connected via a Telegram daemon (polygram). Just reply with text — polygram delivers your response automatically. Do NOT use Telegram MCP tools.`;
   const emojiLine = hasStickers
     ? `Single emoji reply = auto-converted: ${stickerEmojis.join('')} become your stickers, any other emoji (🔥👍💪❤️) becomes a reaction on the user's message.`
     : `Single emoji reply = auto-converted to a reaction on the user's message (any Telegram emoji: 🔥👍💪❤️ …).`;
@@ -196,7 +202,7 @@ function buildVoiceTags(attachments) {
  * @param {string} params.sessionCtx - session context file contents (optional)
  * @param {Array} params.attachments - downloaded attachments
  * @param {Object} params.replyTo - input for buildReplyToBlock (optional)
- * @param {'sdk'|'cli'} params.backend - delivery contract for the selected process backend
+ * @param {'sdk'|'cli'|'codex'} params.backend - delivery contract for the selected process backend
  */
 function buildPrompt({ msg, topicName = '', sessionCtx = '', attachments = [], replyTo = null, polygramHistory = '', stickerEmojis = [], backend = 'sdk' }) {
   const chatId = msg.chat.id.toString();

package/lib/rewind/rewind.js

@@ -148,8 +148,28 @@ function createRewindHandler({ pm, tg, bot, botName = 'bot', executeRewind, logE
    * Dispatcher hook. Returns { consumed }. Consumes any `/rewind` (valid → queued, invalid →
    * the operator is told why) so it never starts a normal turn.
    */
-  async function tryConsume({ sessionKey, chatId, threadId = null, msg, cleanText, botUsername, rewindSafe, isOperatorIdentity, paired, accessMode }) {
+  async function tryConsume({
+    sessionKey,
+    chatId,
+    threadId = null,
+    msg,
+    cleanText,
+    runtime = 'claude',
+    botUsername,
+    rewindSafe,
+    isOperatorIdentity,
+    paired,
+    accessMode,
+  }) {
     if (!isRewindCommand(cleanText)) return { consumed: false };
+    if (runtime === 'codex') {
+      await ack(
+        chatId,
+        threadId,
+        'Codex thread rewind is not supported yet; the active Codex thread was unchanged.',
+      );
+      return { consumed: true };
+    }
     const gate = gateRewindRequest({ msg, botUsername, rewindSafe, isOperatorIdentity, paired, accessMode });
     if (!gate.ok) {
       await ack(chatId, threadId, `↩️ ${gate.reason}`);