polygram 0.22.0 → 0.23.0

package/lib/handlers/edit-redelivery.js

@@ -1,10 +1,14 @@
 'use strict';
 
 /**
- * Post-turn edit re-delivery (0.12.0). When the user edits a Telegram message AFTER claude's turn
- * has finished, re-dispatch the edited message as a NEW turn so claude acts on the change — the
- * "an edit is just a message" model. The mid-turn case (turn still in flight) stays with the
- * existing injector (lib/handlers/edit-correction.js); this is the post-turn path.
+ * Post-turn edit re-delivery. When the user edits a Telegram message after a
+ * turn has finished, re-dispatch the edited message as a new turn so the model
+ * acts on the change — the "an edit is just a message" model.
+ *
+ * Claude retains its per-message mid-turn injection behavior. Codex edits are
+ * deferred and dispatched as normal visible turns only when the exact process
+ * generation that observed them becomes idle. Teardown or replacement cancels
+ * the deferred content.
  *
  * Spec: docs/0.12.0-edit-redelivery-spec.md (twice-reviewed). Key correctness points the review
  * surfaced:
@@ -47,8 +51,195 @@ function createEditRedelivery({
   // redelivery (dispatchHandleMessage autosteers it naturally if a turn is in
   // flight — through the formatted-prompt path, not a hand-built string).
   const redeliveredAt = new Map();   // `${chatId}:${msgId}` → ts
+  const deferredCodexBySession = new Map();
   const INTERLOCK_TTL_MS = 10 * 60 * 1000;
 
+  function codexGenerationId(proc) {
+    return typeof proc?.generationId === 'string' && proc.generationId.length > 0
+      ? proc.generationId
+      : null;
+  }
+
+  function isCodexProcess(sessionKey, proc) {
+    const backend = typeof pm?.getBackend === 'function'
+      ? pm.getBackend(sessionKey)
+      : proc?.backend ?? proc?.runtime;
+    return backend === 'codex' || proc?.backend === 'codex' || proc?.runtime === 'codex';
+  }
+
+  function removeDeferredListeners(state) {
+    state.proc.removeListener?.('idle', state.onIdle);
+    state.proc.removeListener?.('close', state.onClose);
+    state.proc.removeListener?.('session-reset', state.onSessionReset);
+    state.proc.removeListener?.('codex-settled', state.onCodexSettled);
+    state.proc.removeListener?.('codex-lifecycle', state.onCodexLifecycle);
+  }
+
+  function safeLogDeferredEvent(kind, detail) {
+    try {
+      logEvent(kind, detail);
+    } catch (error) {
+      try {
+        logger.error?.(`[edit-redelivery] deferred event log failed: ${error.message}`);
+      } catch {
+        // Process lifecycle listeners must never throw back into supervision.
+      }
+    }
+  }
+
+  function cancelDeferred(state, reason) {
+    if (deferredCodexBySession.get(state.sessionKey) !== state) return;
+    deferredCodexBySession.delete(state.sessionKey);
+    removeDeferredListeners(state);
+    safeLogDeferredEvent('edit-redelivery-deferred-cancelled', {
+      session_key: state.sessionKey,
+      generation_id: state.generationId,
+      reason,
+      message_count: state.entries.size,
+    });
+  }
+
+  function dispatchDeferredSynthetic({
+    sessionKey,
+    chatId,
+    msgId,
+    synthetic,
+    oldLength,
+    newLength,
+  }) {
+    dispatchHandleMessage(sessionKey, chatId, synthetic, bot);
+    safeLogDeferredEvent('edit-redelivered', {
+      chat_id: chatId,
+      session_key: sessionKey,
+      msg_id: msgId,
+      old_len: oldLength,
+      new_len: newLength,
+    });
+  }
+
+  function flushDeferred(state) {
+    if (deferredCodexBySession.get(state.sessionKey) !== state) return;
+    const current = pm?.get?.(state.sessionKey);
+    if (
+      current !== state.proc
+      || codexGenerationId(current) !== state.generationId
+    ) {
+      cancelDeferred(state, 'generation-replaced');
+      return;
+    }
+    if (current.closed) {
+      cancelDeferred(state, 'close');
+      return;
+    }
+    // An idle-shaped event is not enough: process state is the final fence
+    // against dispatching while the generation still owns a live turn.
+    if (current.inFlight) return;
+
+    deferredCodexBySession.delete(state.sessionKey);
+    removeDeferredListeners(state);
+    for (const entry of state.entries.values()) {
+      try {
+        dispatchDeferredSynthetic(entry);
+      } catch (error) {
+        try {
+          logger.error?.(`[edit-redelivery] deferred dispatch failed: ${error.message}`);
+        } catch {
+          // Process lifecycle listeners must never throw back into supervision.
+        }
+        safeLogDeferredEvent('edit-redelivery-deferred-cancelled', {
+          session_key: state.sessionKey,
+          generation_id: state.generationId,
+          reason: 'dispatch-failed',
+          message_count: 1,
+          msg_id: entry.msgId,
+        });
+      }
+    }
+  }
+
+  function deferCodexEdit(entry, proc) {
+    const generationId = codexGenerationId(proc);
+    if (!generationId) {
+      safeLogDeferredEvent('edit-redelivery-deferred-cancelled', {
+        session_key: entry.sessionKey,
+        generation_id: null,
+        reason: 'missing-generation-id',
+        message_count: 1,
+        msg_id: entry.msgId,
+      });
+      return false;
+    }
+    if (
+      typeof proc.on !== 'function'
+      || typeof proc.removeListener !== 'function'
+    ) {
+      safeLogDeferredEvent('edit-redelivery-deferred-cancelled', {
+        session_key: entry.sessionKey,
+        generation_id: generationId,
+        reason: 'event-interface-unavailable',
+        message_count: 1,
+        msg_id: entry.msgId,
+      });
+      return false;
+    }
+
+    let state = deferredCodexBySession.get(entry.sessionKey);
+    if (
+      state
+      && (
+        state.proc !== proc
+        || state.generationId !== generationId
+      )
+    ) {
+      cancelDeferred(state, 'generation-replaced');
+      state = null;
+    }
+    if (!state) {
+      state = {
+        sessionKey: entry.sessionKey,
+        generationId,
+        proc,
+        entries: new Map(),
+      };
+      state.onIdle = () => flushDeferred(state);
+      state.onClose = () => cancelDeferred(state, 'close');
+      state.onSessionReset = () => cancelDeferred(state, 'session-reset');
+      state.onCodexSettled = (event) => {
+        if (event?.kind === 'stopped') cancelDeferred(state, 'stop');
+      };
+      state.onCodexLifecycle = () => cancelDeferred(state, 'lifecycle-failed');
+      deferredCodexBySession.set(entry.sessionKey, state);
+      proc.on('idle', state.onIdle);
+      proc.on('close', state.onClose);
+      proc.on('session-reset', state.onSessionReset);
+      proc.on('codex-settled', state.onCodexSettled);
+      proc.on('codex-lifecycle', state.onCodexLifecycle);
+    }
+
+    const interlockKey = `${entry.chatId}:${entry.msgId}`;
+    const coalesced = state.entries.has(interlockKey);
+    // Map#set replaces the value without changing insertion order.
+    state.entries.set(interlockKey, entry);
+    safeLogDeferredEvent('edit-redelivery-deferred', {
+      chat_id: entry.chatId,
+      session_key: entry.sessionKey,
+      generation_id: generationId,
+      msg_id: entry.msgId,
+      coalesced,
+    });
+    // Close the check→listener registration race. If the turn settled (or the
+    // process was replaced) while the edit was being gated, release or cancel
+    // through the same generation-fenced path immediately.
+    if (
+      pm?.get?.(entry.sessionKey) !== proc
+      || proc.closed
+      || !proc.inFlight
+    ) {
+      flushDeferred(state);
+    }
+    return true;
+  }
+
   return function maybePostTurnEdit(editedMsg, oldText, botUsername, mentionRe = null) {
   try {
     if (!editedMsg?.chat) return false;
@@ -77,6 +268,41 @@ function createEditRedelivery({
     // BEFORE the gate; the gate now runs upstream in the edited_message
     // handler, so every path through here is already gated).
     const proc = pm?.get?.(sessionKey);
+    if (proc?.inFlight && isCodexProcess(sessionKey, proc)) {
+      // Re-run the real-message gate before retaining content in memory. The
+      // outer edited-message path already gates today, but this handler keeps
+      // its own contract when reused independently.
+      if (!shouldHandle(editedMsg, chatConfig, botUsername)) return false;
+      const cleanNew = mentionRe ? newText.replace(mentionRe, '').trim() : newText.trim();
+      const synthetic = {
+        chat: editedMsg.chat,
+        message_id: editedMsg.message_id,
+        from: editedMsg.from,
+        text: cleanNew,
+        date: editedMsg.date,
+        ...(threadId && { message_thread_id: Number(threadId) }),
+        reply_to_message: {
+          message_id: editedMsg.message_id,
+          from: editedMsg.from,
+          text: oldText || '',
+          date: editedMsg.date,
+        },
+        _isReplay: true,
+        _requiredProvider: 'codex',
+      };
+      const deferred = deferCodexEdit({
+        sessionKey,
+        chatId,
+        msgId: editedMsg.message_id,
+        synthetic,
+        oldLength: (oldText || '').length,
+        newLength: newText.length,
+      }, proc);
+      if (!deferred) return false;
+      try { react?.(chatId, editedMsg.message_id); } catch { /* best-effort */ }
+      return false;
+    }
+
     const interlockKey = `${chatId}:${editedMsg.message_id}`;
     const lastRedeliveredAt = redeliveredAt.get(interlockKey) || 0;
     if (proc?.inFlight && (Date.now() - lastRedeliveredAt) < INTERLOCK_TTL_MS && lastRedeliveredAt > 0) {

package/lib/handlers/gate-inbound.js

@@ -50,6 +50,7 @@ function createGateInbound({
   handleAbortIfRequested,
   getRewindHandler = () => null,
   isRewindCommand = () => false,
+  resolveRuntime = () => 'claude',
   getQuestionHandlers = () => null,
   shouldHandle,
   getSessionKey,
@@ -158,6 +159,12 @@ function createGateInbound({
           const rewindSafe = msg.chat?.type === 'private' || chatConfig?.isolateTopics === true;
           const r = await rewindHandler.tryConsume({
             sessionKey, chatId, threadId, msg, cleanText,
+            runtime: resolveRuntime({
+              sessionKey,
+              chatId,
+              threadId,
+              chatConfig,
+            }),
             botUsername: getBotUsername?.() || '',
             rewindSafe, isOperatorIdentity, paired, accessMode,
           });

package/lib/handlers/replay-disposition.js

@@ -1,5 +1,47 @@
 'use strict';
 
+const {
+  classifyCodexRecoveryEvidence,
+} = require('../db/auto-resume');
+
+function providerReplayDisposition(candidate, getProviderRecovery) {
+  if (typeof getProviderRecovery === 'function') {
+    let evidence;
+    try {
+      evidence = getProviderRecovery(candidate);
+    } catch {
+      return {
+        provider: 'unknown',
+        action: 'defer',
+        reason: 'provider-recovery-unavailable',
+      };
+    }
+    if (evidence?.provider === 'claude') {
+      return { provider: 'claude', action: 'legacy' };
+    }
+    if (evidence?.provider === 'codex') {
+      return {
+        provider: 'codex',
+        ...classifyCodexRecoveryEvidence(evidence),
+      };
+    }
+    return {
+      provider: 'unknown',
+      action: 'defer',
+      reason: 'provider-recovery-unavailable',
+    };
+  }
+
+  const provider = candidate?.provider ?? candidate?.runtime;
+  if (provider === 'codex') {
+    return {
+      provider: 'codex',
+      ...classifyCodexRecoveryEvidence(candidate),
+    };
+  }
+  return { provider: provider || 'claude', action: 'legacy' };
+}
+
 /**
  * Boot-replay disposition (0.14) — decide what to do with the replay candidate
  * set, given whether the last shutdown was a DELIBERATE restart or a CRASH.
@@ -30,15 +72,53 @@
  * @param {(candidate)=>boolean} [opts.hasCompletedTurn]  already-answered predicate (default: none)
  * @param {(candidate)=>boolean} [opts.announceable]  notice-eligible predicate (default: all). Excludes
  *   admin/slash + abort-shaped rows so we don't announce "I didn't resume your /new".
- * @returns {{recover: Array, skip: Array, notices: Array<{chat_id, thread_id, items: Array}>}}
+ * @param {(candidate)=>object} [opts.getProviderRecovery] authoritative provider
+ *   and durable-recovery evidence. When supplied, unknown/error results defer
+ *   rather than enter the legacy recovery path.
+ * @returns {{recover: Array, recoverCodex?: Array, skip: Array,
+ *   defer?: Array, notices: Array<{chat_id, thread_id, items: Array}>}}
  */
-function classifyReplay({ candidates = [], cleanShutdown = false, hasCompletedTurn, announceable } = {}) {
+function classifyReplay({
+  candidates = [],
+  cleanShutdown = false,
+  hasCompletedTurn,
+  announceable,
+  getProviderRecovery,
+} = {}) {
   const answered = typeof hasCompletedTurn === 'function' ? hasCompletedTurn : () => false;
   const pending = (candidates || []).filter((c) => !answered(c));
+  const legacy = [];
+  const recoverCodex = [];
+  const cancelled = [];
+  const defer = [];
+
+  for (const candidate of pending) {
+    const disposition = providerReplayDisposition(
+      candidate,
+      getProviderRecovery,
+    );
+    if (disposition.action === 'legacy') {
+      legacy.push(candidate);
+    } else if (disposition.action === 'recover') {
+      recoverCodex.push(candidate);
+    } else if (disposition.action === 'skip') {
+      cancelled.push(candidate);
+    } else {
+      defer.push(candidate);
+    }
+  }
 
   if (!cleanShutdown) {
-    // Crash: recover everything unanswered (unchanged rc.57 behavior).
-    return { recover: pending, skip: [], notices: [] };
+    // Legacy providers retain crash recovery. Codex requests use a separate
+    // recoverer so they cannot accidentally fail over to Claude.
+    const plan = {
+      recover: legacy,
+      skip: cancelled,
+      notices: [],
+    };
+    if (recoverCodex.length > 0) plan.recoverCodex = recoverCodex;
+    if (defer.length > 0) plan.defer = defer;
+    return plan;
   }
 
   // Deliberate restart: skip ALL pending (none re-answered), and group the
@@ -49,7 +129,8 @@ function classifyReplay({ candidates = [], cleanShutdown = false, hasCompletedTu
   const isAnnounceable = typeof announceable === 'function' ? announceable : () => true;
   const SEP = String.fromCharCode(0); // NUL separator (H8, collision-proof)
   const groups = new Map();
-  for (const c of pending) {
+  const restartSkipped = [...legacy, ...recoverCodex];
+  for (const c of restartSkipped) {
     if (!isAnnounceable(c)) continue;
     const thread = c.thread_id == null ? null : c.thread_id;
     const key = `${c.chat_id}${SEP}${thread == null ? '' : thread}`;
@@ -57,7 +138,13 @@ function classifyReplay({ candidates = [], cleanShutdown = false, hasCompletedTu
     if (!g) { g = { chat_id: c.chat_id, thread_id: thread, items: [] }; groups.set(key, g); }
     g.items.push(c);
   }
-  return { recover: [], skip: pending, notices: Array.from(groups.values()) };
+  const plan = {
+    recover: [],
+    skip: [...restartSkipped, ...cancelled],
+    notices: Array.from(groups.values()),
+  };
+  if (defer.length > 0) plan.defer = defer;
+  return plan;
 }
 
 /**
@@ -73,18 +160,29 @@ function classifyReplay({ candidates = [], cleanShutdown = false, hasCompletedTu
  * skip items (not in any notice group) are marked terminal silently.
  *
  * @param {object} opts
- * @param {{recover:Array, skip:Array, notices:Array}} opts.plan
+ * @param {{recover:Array, recoverCodex?:Array, skip:Array, defer?:Array,
+ *   notices:Array}} opts.plan
  * @param {object} opts.deps
  * @param {(candidate)=>Promise<{ok:boolean}>} opts.deps.recover  crash-path re-dispatch
+ * @param {(candidate)=>Promise<{ok:boolean}>} [opts.deps.recoverCodex]
+ *   exact-runtime Codex crash-path re-dispatch
  * @param {(group)=>Promise<{ok:boolean, messageId?:any, error?:string}>} opts.deps.sendNotice
  * @param {(candidate)=>void} opts.deps.markSkipped  mark row terminal 'replay-skipped'
  * @param {(kind, detail)=>void} [opts.deps.logEvent]
- * @returns {Promise<{recovered:number, skipped:number, noticed:number, noticeFailed:number}>}
+ * @returns {Promise<{recovered:number, skipped:number, noticed:number,
+ *   noticeFailed:number, deferred?:number}>}
  */
 async function executeReplayPlan({ plan, deps }) {
-  const { recover = [], skip = [], notices = [] } = plan || {};
+  const {
+    recover = [],
+    recoverCodex = [],
+    skip = [],
+    notices = [],
+    defer = [],
+  } = plan || {};
   const log = (deps && deps.logEvent) || (() => {});
   let recovered = 0; let skipped = 0; let noticed = 0; let noticeFailed = 0;
+  let deferred = defer.length;
 
   // CRASH branch — recover each (unchanged rc.57 behavior).
   for (const c of recover) {
@@ -93,6 +191,24 @@ async function executeReplayPlan({ plan, deps }) {
     if (r && r.ok) recovered += 1; else skipped += 1;
   }
 
+  // Codex recovery is deliberately separate from the legacy recoverer. If the
+  // caller has not wired an exact-runtime path, leave the row pending.
+  for (const c of recoverCodex) {
+    if (typeof deps.recoverCodex !== 'function') {
+      deferred += 1;
+      log('codex-replay-deferred', {
+        chat_id: c.chat_id,
+        thread_id: c.thread_id == null ? null : c.thread_id,
+        msg_id: c.msg_id,
+        reason: 'codex-recoverer-unavailable',
+      });
+      continue;
+    }
+    // eslint-disable-next-line no-await-in-loop
+    const r = await deps.recoverCodex(c);
+    if (r && r.ok) recovered += 1; else deferred += 1;
+  }
+
   // CLEAN branch — notice-then-mark, per group.
   const inNotices = new Set();
   for (const g of notices) for (const c of g.items) inNotices.add(c);
@@ -114,7 +230,13 @@ async function executeReplayPlan({ plan, deps }) {
   for (const c of skip) {
     if (!inNotices.has(c)) { deps.markSkipped(c); skipped += 1; }
   }
-  return { recovered, skipped, noticed, noticeFailed };
+  const result = { recovered, skipped, noticed, noticeFailed };
+  if (deferred > 0) result.deferred = deferred;
+  return result;
 }
 
-module.exports = { classifyReplay, executeReplayPlan };
+module.exports = {
+  classifyReplay,
+  executeReplayPlan,
+  classifyCodexRecoveryEvidence,
+};