polygram 0.34.1 → 0.36.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.34.1",
+  "version": "0.36.0",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/config.example.json

@@ -66,7 +66,7 @@
   },
 
   "codex": {
-    "_comment": "Optional native macOS arm64 or Linux x64 Codex app-server beta. Codex stays disabled unless a chat/topic explicitly sets pm:'codex' and exact target-specific startup preflight succeeds; other host targets, including Windows, are rejected. `home` must be a dedicated non-temporary 0700 CODEX_HOME already authenticated with ChatGPT; polygram never copies or reads credential contents. `binary` must be the canonical immutable path to the reviewed target's pinned Codex CLI, not a PATH symlink. On Linux set POLYGRAM_CODEX_TMPDIR to an owner-only 0700 runtime directory; otherwise Codex inherits the daemon TMPDIR after the same safety checks. Every directory containing daemon credentials or control data must be listed in daemonSecretRoots and must not overlap a Codex workspace or CODEX_HOME. Command network and model-native web search are disabled; product MCP tools and interactive approvals are unavailable. Keep long-running commands in the foreground. Detached/background servers are unsupported and may survive hard runtime loss.",
+    "_comment": "Optional native macOS arm64 or Linux x64 Codex app-server beta. Codex is default-off: a chat/topic must explicitly set codexEnabled:true before pm:'codex' can be selected or dispatched, and exact target-specific startup preflight must succeed; other host targets, including Windows, are rejected. `home` must be a dedicated non-temporary 0700 CODEX_HOME already authenticated with ChatGPT; polygram never copies or reads credential contents. `binary` must be the canonical immutable path to the reviewed target's pinned Codex CLI, not a PATH symlink. On Linux set POLYGRAM_CODEX_TMPDIR to an owner-only 0700 runtime directory; otherwise Codex inherits the daemon TMPDIR after the same safety checks. Every directory containing daemon credentials or control data must be listed in daemonSecretRoots and must not overlap a Codex workspace or CODEX_HOME. Command network and model-native web search are disabled; product MCP tools and interactive approvals are unavailable. Keep long-running commands in the foreground. Detached/background servers are unsupported and may survive hard runtime loss.",
     "home": "/Users/you/.codex-polygram",
     "binary": "/Users/you/.local/share/codex/versions/0.145.0/codex",
     "daemonSecretRoots": [
@@ -94,6 +94,7 @@
       "name": "Codex beta DM",
       "bot": "admin-bot",
       "_comment_pm": "Codex uses the pinned app-server SDK surface directly (no tmux). Native macOS arm64 and Linux x64 beta: command network and model-native web search are disabled; product MCP tools and interactive approvals are unavailable; long-running commands must stay in the foreground; detached/background servers are unsupported and may survive hard runtime loss. The model and effort are accepted only when returned by this deployment's authenticated ChatGPT-backed model catalog.",
+      "codexEnabled": true,
       "pm": "codex",
       "codexModel": "gpt-5.6-sol",
       "codexEffort": "xhigh",

package/lib/error/classify.js

@@ -145,6 +145,14 @@ function mapCodes(codes, shape) {
 }
 
 const CODEX_ERROR_SHAPES = Object.freeze({
+  scopeDisabled: stableCodeShape(
+    'codexScopeDisabled',
+    'Codex is not enabled for this chat',
+  ),
+  runtimeSelectionIncomplete: stableCodeShape(
+    'codexRuntimeSelectionIncomplete',
+    'Codex is enabled, but its model, effort, or workspace is not configured for this chat',
+  ),
   auth: stableCodeShape(
     'codexAuthUnavailable',
     '🔑 Codex authentication is unavailable. The operator needs to re-authenticate the pinned deployment.',
@@ -192,6 +200,9 @@ const CODEX_ERROR_SHAPES = Object.freeze({
 });
 
 const CODEX_ERROR_CODES = {
+  CODEX_SCOPE_DISABLED: CODEX_ERROR_SHAPES.scopeDisabled,
+  CODEX_RUNTIME_SELECTION_INCOMPLETE:
+    CODEX_ERROR_SHAPES.runtimeSelectionIncomplete,
   ...mapCodes([
     'CODEX_AUTH_UNAVAILABLE',
   ], CODEX_ERROR_SHAPES.auth),

package/lib/handlers/config-callback.js

@@ -18,7 +18,11 @@
 const { toTelegramHtml } = require('../telegram/format');
 const { resolveRichTextEnabled } = require('../telegram/rich');
 const { getTopicConfig, getConfigWriteScope } = require('../session-key');
-const { resolveRuntimeDescriptor } = require('../runtime-config');
+const {
+  resolveCodexEnabled,
+  resolveRuntimeDescriptor,
+} = require('../runtime-config');
+const { classify } = require('../error/classify');
 const {
   configuredRuntimeValue,
   formatCodexSettingsOutcome,
@@ -49,7 +53,19 @@ const BLOCKED_RUNTIME_STATES = new Set([
 ]);
 
 function runtimeLabel(runtime) {
-  return RUNTIME_OPTION_BY_BACKEND.get(runtime)?.label ?? 'Claude SDK';
+  // Only ever called for a runtime that has a button — the callback rejects
+  // anything else as an invalid runtime before this point.
+  return RUNTIME_OPTION_BY_BACKEND.get(runtime).label;
+}
+
+function codexSelectionErrorMessage(error) {
+  if (
+    error?.code === 'CODEX_SCOPE_DISABLED'
+    || error?.code === 'CODEX_RUNTIME_SELECTION_INCOMPLETE'
+  ) {
+    return classify(error).userMessage;
+  }
+  return 'Codex is unavailable; check login and runtime diagnostics';
 }
 
 function runtimeSwitchBlocked(proc) {
@@ -133,6 +149,17 @@ function createHandleConfigCallback({
             .catch(() => {});
           return;
         }
+        if (
+          value === 'codex'
+          && !resolveCodexEnabled(config, chatId, callbackThreadIdEarly)
+        ) {
+          releaseConfigIntent();
+          await ctx.answerCallbackQuery({
+            text: codexSelectionErrorMessage({ code: 'CODEX_SCOPE_DISABLED' }),
+            show_alert: true,
+          }).catch(() => {});
+          return;
+        }
         const currentSelection = resolveRuntimeDescriptor({
           config,
           chatId,
@@ -188,7 +215,7 @@ function createHandleConfigCallback({
             );
             releaseConfigIntent();
             await ctx.answerCallbackQuery({
-              text: 'Codex is unavailable; check login and runtime diagnostics',
+              text: codexSelectionErrorMessage(error),
               show_alert: true,
             }).catch(() => {});
             return;
@@ -387,6 +414,11 @@ function createHandleConfigCallback({
             backend: value,
             configuredPm: value,
             selectionSource: writeThreadId ? 'topic' : 'chat',
+            codexEnabled: resolveCodexEnabled(
+              config,
+              chatId,
+              callbackThreadIdEarly,
+            ),
           };
         }
         const topicConfig = getTopicConfig(
@@ -485,10 +517,15 @@ function createHandleConfigCallback({
       // (so Music ≠ General), a chat-level card the chat root. Resolving the
       // thread BEFORE the already-set check so "Already X" compares against the
       // topic's effective value, not the chat root (2026-06-12 bug).
+      //
+      // Rich text follows session isolation like every other setting. Delivery
+      // resolves it per message with the real thread, but the agent's authoring
+      // hint is spawn-time state resolved with the SESSION's thread — which a
+      // chat without isolateTopics collapses to null. A topic-level write there
+      // would flip delivery while the hint never drifts: no respawn, and an ack
+      // promising a change that never arrives.
       const { scope: writeScope, threadId: writeThreadId } =
-        getConfigWriteScope(chatConfig, callbackThreadIdEarly, {
-          allowNonIsolatedTopic: setting === 'richtext',
-        });
+        getConfigWriteScope(chatConfig, callbackThreadIdEarly);
       // The persisted camel-case key differs from the lowercase callback
       // label used alongside model and effort.
       const configField = isRichText
@@ -543,13 +580,78 @@ function createHandleConfigCallback({
           effortAdjustment = { oldValue: oldEffort, newValue: nextEffort };
         }
       }
+      // Rich text has no per-topic scope in a chat whose topics share one
+      // session: there is a single hint, so there can be a single value. Any
+      // topics[tid].richText there was written by the pre-fix behavior and can
+      // never be honored by the agent — but delivery resolves topic-first, so
+      // it still shadows the chat value in its own topic. Clearing every one of
+      // them is part of writing at chat level, not a separate cleanup.
+      const clearStaleTopicRichText = () => {
+        if (!isRichText || chatConfig?.isolateTopics === true) return [];
+        const cleared = [];
+        for (const [tid, topic] of Object.entries(chatConfig.topics || {})) {
+          if (
+            topic
+            && typeof topic === 'object'
+            && Object.hasOwn(topic, configField)
+          ) {
+            cleared.push({ threadId: String(tid), scope: topic, value: topic[configField] });
+            delete topic[configField];
+          }
+        }
+        return cleared;
+      };
+      const restoreTopicRichText = (cleared) => {
+        for (const { scope, value } of cleared) scope[configField] = value;
+      };
+      // The user tapped one card; topics they never touched can change value
+      // with it. Record which ones and what they held, so a config that moved
+      // on its own is still explicable afterwards. Logged only once the sweep
+      // is persisted — an event for a rolled-back sweep is worse than none.
+      const logTopicRichTextSweep = (cleared) => {
+        if (!cleared.length) return;
+        dbWrite(() => {
+          db.logEvent('config-topic-override-swept', {
+            chat_id: chatId,
+            field: configField,
+            topics: cleared.map(({ threadId, value }) => ({
+              thread_id: threadId,
+              old_value: value,
+            })),
+          });
+        }, 'log topic-override sweep');
+      };
+
       if (oldValue === parsedValue) {
+        // Nothing to write — but a stale override is exactly why this tap can
+        // be a no-op, and leaving it keeps delivery and the session's hint
+        // disagreeing. Normalize the scope and keep the value the ack states:
+        // the chat level is the only place the shared session reads.
+        const cleared = clearStaleTopicRichText();
+        if (cleared.length) {
+          const hadChatValue = Object.hasOwn(chatConfig, configField);
+          const previousChatValue = chatConfig[configField];
+          chatConfig[configField] = parsedValue;
+          try {
+            await saveConfig();
+            logTopicRichTextSweep(cleared);
+          } catch (error) {
+            restoreTopicRichText(cleared);
+            if (hadChatValue) chatConfig[configField] = previousChatValue;
+            else delete chatConfig[configField];
+            logger.error?.(
+              `[${botName}] config-callback scope normalization failed: `
+                + error.message,
+            );
+          }
+        }
         releaseConfigIntent();
         await ctx.answerCallbackQuery({ text: `Already ${value}` })
           .catch(() => {});
         return;
       }
 
+      const clearedTopicRichText = clearStaleTopicRichText();
       writeScope[configField] = parsedValue;
       if (effortAdjustment) {
         writeScope.codexEffort = effortAdjustment.newValue;
@@ -561,6 +663,7 @@ function createHandleConfigCallback({
           if (snapshot.present) writeScope[field] = snapshot.value;
           else delete writeScope[field];
         }
+        restoreTopicRichText(clearedTopicRichText);
         logger.error?.(
           `[${botName}] config-callback saveConfig failed: ${error.message}`,
         );
@@ -571,6 +674,7 @@ function createHandleConfigCallback({
         }).catch(() => {});
         return;
       }
+      logTopicRichTextSweep(clearedTopicRichText);
       const cmdUserId = ctx.callbackQuery.from?.id || null;
       const cmdUser = ctx.callbackQuery.from?.first_name
         || ctx.callbackQuery.from?.username
@@ -707,14 +811,11 @@ function createHandleConfigCallback({
         logger.error?.(`[${botName}] config-card edit failed: ${err.message}`);
       }
 
-      // Rich delivery changes immediately, but its authoring hint changes
-      // on the next session spawn; surface both timings in the acknowledgement.
+      // Delivery changes immediately and the authoring hint follows on the
+      // user's next message: a hint drift reloads the session (conversation
+      // preserved), so there is no lag left worth a caveat.
       const ackText = isRichText
-        ? (
-          parsedValue
-            ? 'Rich text → on (delivery live; agent authors for it next session)'
-            : 'Rich text → off'
-        )
+        ? `Rich text → ${parsedValue ? 'on' : 'off'}`
         : codex
           ? (
             `${setting} → ${value}`

package/lib/handlers/config-ui.js

@@ -4,23 +4,31 @@
  * the runtime/model/effort callback re-render paths
  * (lib/handlers/config-callback.js).
  *
- * Pure functions (no DB / fs) but `formatConfigInfoText` needs
- * runtime context (pm to check warm/cold, db + getClaudeSessionId
- * to fetch session id) → factory wraps it. Keyboard builder is a
- * top-level export.
+ * Pure functions (no DB / fs). `formatConfigInfoText` is factory-wrapped
+ * only so a caller can supply the async runtime-view resolver; the
+ * keyboard builder is a top-level export.
  *
  * MODEL_VERSIONS_DESC bumps with each Claude release — see polygram's
  * release notes for the verification step (`claude --model <alias>`
- * + check the system:init event's `model` field).
+ * + check the system:init event's `model` field). Surfaced by the
+ * /model reply, not by the card.
  */
 
 'use strict';
 
 const MODEL_OPTIONS = ['opus', 'sonnet', 'haiku'];
 const EFFORT_OPTIONS = ['low', 'medium', 'high', 'xhigh', 'max'];
+const CODEX_MODEL_OPTIONS = new Set([
+  'gpt-5.6-sol',
+  'gpt-5.6-terra',
+  'gpt-5.6-luna',
+]);
+// Which runtimes the card offers. The sdk backend stays fully supported in
+// code and config files — it is per-token and nobody picks it from a chat, so
+// it has no button. Codex is filtered below unless enabled for the current
+// scope. A chat configured on sdk simply shows no ✓ on this row.
 const RUNTIME_OPTIONS = Object.freeze([
-  Object.freeze({ backend: 'sdk', label: 'Claude SDK' }),
-  Object.freeze({ backend: 'cli', label: 'Claude CLI' }),
+  Object.freeze({ backend: 'cli', label: 'Claude' }),
   Object.freeze({ backend: 'codex', label: 'Codex' }),
 ]);
 
@@ -44,22 +52,6 @@ function canonicalRuntimeBackend(runtimeView) {
   return 'sdk';
 }
 
-function runtimeSelectionSource(runtimeView) {
-  const source = runtimeView?.selectionSource
-    ?? runtimeView?.source
-    ?? runtimeView?.sources?.pm;
-  return typeof source === 'string' && source.length > 0 ? source : null;
-}
-
-function formatRuntimeLine(runtimeView) {
-  const backend = canonicalRuntimeBackend(runtimeView);
-  const label = backend === 'codex'
-    ? 'Codex app-server'
-    : backend === 'cli' ? 'Claude CLI' : 'Claude SDK';
-  const source = runtimeSelectionSource(runtimeView);
-  return `Runtime: ${label}${source ? ` (source: ${source})` : ''}`;
-}
-
 function uniqueStrings(values) {
   if (!Array.isArray(values)) return [];
   return [...new Set(values.filter(
@@ -77,6 +69,7 @@ function getCodexCatalogModels(runtimeView) {
       !entry
       || typeof entry.model !== 'string'
       || entry.model.length === 0
+      || !CODEX_MODEL_OPTIONS.has(entry.model)
       || seen.has(entry.model)
     ) {
       return false;
@@ -118,13 +111,6 @@ function formatSettingsPair(settings) {
   return `${settings.model}/${settings.effort}`;
 }
 
-function sameSettingsPair(left, right) {
-  return (
-    left?.model === right?.model
-    && left?.effort === right?.effort
-  );
-}
-
 function formatCodexSettingsOutcome(result) {
   const next = formatSettingsPair(result?.nextTurn);
   switch (result?.outcome) {
@@ -265,10 +251,14 @@ function buildConfigKeyboard(
   const rows = [];
   if (show === 'all') {
     const currentBackend = canonicalRuntimeBackend(runtimeView);
-    rows.push(RUNTIME_OPTIONS.map(({ backend, label }) => ({
-      text: backend === currentBackend ? `✓ ${label}` : label,
-      callback_data: `cfg:runtime:${backend}`,
-    })));
+    rows.push(RUNTIME_OPTIONS
+      .filter(({ backend }) => (
+        backend !== 'codex' || runtimeView?.codexEnabled === true
+      ))
+      .map(({ backend, label }) => ({
+        text: backend === currentBackend ? `✓ ${label}` : label,
+        callback_data: `cfg:runtime:${backend}`,
+      })));
   }
   if ((show === 'model' || show === 'all') && modelOptions.length > 0) {
     rows.push(modelOptions.map((entry) => {
@@ -301,18 +291,14 @@ function buildConfigKeyboard(
 }
 
 /**
- * Factory for the card-body formatter. Needs runtime pm + db + a
- * getClaudeSessionId fetcher.
+ * Factory for the card-body formatter.
  *
- * @param {object} deps
- * @param {object} deps.pm
- * @param {object} deps.db
- * @param {(db, sessionKey) => string|null} deps.getClaudeSessionId
+ * @param {object} [deps]
+ * @param {(ctx: {sessionKey: string, chatId: string, threadId: ?string}) => object} [deps.resolveRuntimeView]
+ *   — resolves the runtime view for callers that don't pass one; the view
+ *   decides which runtime's help sections the card carries.
  */
 function createFormatConfigInfoText({
-  pm,
-  db,
-  getClaudeSessionId,
   resolveRuntimeView = null,
 } = {}) {
   function formatWithRuntimeView(
@@ -323,148 +309,18 @@ function createFormatConfigInfoText({
     effectiveRichText,
     runtimeView,
   ) {
-    const alive = pm.has(sessionKey) && !pm.get(sessionKey).closed;
     const codex = isCodexRuntimeView(runtimeView);
-    // Per-topic overrides win over chat-level for the displayed values,
-    // mirroring the spawn path (polygram.js: topicConfig.agent ||
-    // chatConfig.agent). Pre-fix the card always read chat-level, so a topic's
-    // /model showed the WRONG agent — shumorobot Music topic (thread 3) showed
-    // "Agent: shumabit" instead of its music-curation:music-curator override
-    // (2026-06-03). topicConfig defaults to null (chat-level) for callers with
-    // no active topic.
-    const model = configuredRuntimeValue(
-      chatConfig,
-      topicConfig,
-      runtimeView,
-      'model',
-    );
-    const effort = configuredRuntimeValue(
-      chatConfig,
-      topicConfig,
-      runtimeView,
-      'effort',
-    );
+    // The selected Codex model decides which reasoning efforts its help section
+    // may list — per-topic overrides win over chat-level, mirroring the spawn
+    // path. Nothing else about the configuration is read here: the buttons under
+    // the card carry it, each with its own ✓.
     const codexModels = codex ? getCodexCatalogModels(runtimeView) : [];
+    const codexModel = codex
+      ? configuredRuntimeValue(chatConfig, topicConfig, runtimeView, 'model')
+      : null;
     const codexEfforts = codex
-      ? getCodexCatalogEfforts(runtimeView, model)
+      ? getCodexCatalogEfforts(runtimeView, codexModel)
       : [];
-    const agent = (topicConfig && topicConfig.agent) || chatConfig.agent;
-    const codexModelEntry = codex
-      ? codexModels
-        .find((entry) => entry.model === model)
-      : null;
-    const codexDisplayName = codexModelEntry?.displayName;
-    const ver = codex
-      ? (
-        typeof codexDisplayName === 'string'
-        && codexDisplayName.length > 0
-        && codexDisplayName !== model
-          ? codexDisplayName
-          : model
-      )
-      : MODEL_VERSIONS_DESC[model] || model;
-    const sess = codex
-      ? 'managed by Codex'
-      : getClaudeSessionId(db, sessionKey)?.slice(0, 8) || 'new';
-    // Running vs configured: cli can't hot-swap model/effort, so a /model or
-    // /effort change is PENDING until the session reloads (on the next message).
-    // Show the truth — the live proc's spawn-time value (proc.model/proc.effort)
-    // vs the configured one — so the card never claims a model the session
-    // isn't actually running (the "says opus, runs sonnet" confusion). SDK
-    // applies live (its proc value tracks config) so no drift line ever shows.
-    const proc = alive ? pm.get(sessionKey) : null;
-    const runModel = proc && proc.model;
-    const runEffort = proc && proc.effort;
-    const modelLine = (runModel && runModel !== model)
-      ? `Model: ${runModel} (running) → ${model} (pending — applies on your next message)`
-      : `Model: ${model} (${ver})`;
-    const effortLine = (runEffort && runEffort !== effort)
-      ? `Effort: ${runEffort} (running) → ${effort} (pending — applies on your next message)`
-      : `Effort: ${effort}`;
-    // Delivery reads richText live, while the authoring hint is fixed at
-    // session spawn. Explain that lag separately from model/effort,
-    // which have concrete running and configured values to compare.
-    const richText = resolveDisplayRichText(chatConfig, topicConfig, effectiveRichText);
-    const richTextLine = richText
-      ? 'Rich text: on (headings/tables/checklists on qualifying replies; agent authors for it once this session next (re)spawns)'
-      : 'Rich text: off';
-    const runtimeLine = formatRuntimeLine(runtimeView);
-    let head;
-    if (codex) {
-      const desired = runtimeView.desiredSettings ?? { model, effort };
-      const desiredPair = formatSettingsPair(desired)
-        ?? 'incomplete Codex selection';
-      const activePair = formatSettingsPair(runtimeView.activeTurnSettings);
-      const nextTurn = runtimeView.nextTurnSettings;
-      const nextTurnPair = formatSettingsPair(nextTurn);
-      const observedPair = formatSettingsPair(
-        runtimeView.observedThreadSettings,
-      );
-      const processStatus = runtimeView.processStatus
-        ?? (alive ? 'loaded' : 'not-loaded');
-      const settingsLines = [];
-      if (processStatus === 'loaded') {
-        if (activePair) {
-          settingsLines.push(`Current turn: ${activePair}`);
-          settingsLines.push(`Next turn: ${nextTurnPair ?? desiredPair}`);
-        } else {
-          settingsLines.push(
-            `Selected for next turn: ${nextTurnPair ?? desiredPair}`,
-          );
-        }
-        if (
-          nextTurnPair
-          && !sameSettingsPair(nextTurn, desired)
-        ) {
-          settingsLines.push(
-            `Saved selection awaiting live reconciliation: ${desiredPair}`,
-          );
-        }
-      } else if (processStatus === 'not-loaded') {
-        settingsLines.push(
-          `Selected for this chat's next session: ${desiredPair}`,
-        );
-      } else {
-        settingsLines.push(`Selected: ${desiredPair}`);
-      }
-      if (observedPair) {
-        settingsLines.push(`Observed thread: ${observedPair}`);
-      }
-      let processLine;
-      if (processStatus === 'daemon-busy') {
-        processLine = 'Process: not loaded; its next message may be busy';
-      } else if (processStatus === 'unavailable') {
-        processLine = 'Process: unavailable'
-          + (
-            runtimeView.unavailableReason
-              ? ` (${runtimeView.unavailableReason})`
-              : ''
-          );
-      } else if (processStatus === 'unknown') {
-        processLine = 'Process: live status unknown';
-      } else {
-        processLine = `Process: ${
-          processStatus === 'loaded' ? 'warm' : 'not loaded'
-        }`;
-      }
-      head = [
-        ...settingsLines,
-        richTextLine,
-        runtimeLine,
-        processLine,
-        `Session: ${sess}`,
-      ].join('\n');
-    } else {
-      head =
-        `${modelLine}\n` +
-        `${effortLine}\n` +
-        `${richTextLine}\n` +
-        `${runtimeLine}\n` +
-        `Agent: ${agent}\n` +
-        `Process: ${alive ? 'warm' : 'cold'}\n` +
-        `Session: ${sess}`;
-    }
-
     const modelHelp = codex
       ? codexModels.length > 0 ? [
         '',
@@ -493,7 +349,7 @@ function createFormatConfigInfoText({
     const effortHelp = codex
       ? codexEfforts.length > 0 ? [
         '',
-        `**Effort** — authenticated options for ${model}:`,
+        `**Effort** — authenticated options for ${codexModel}:`,
         ...codexEfforts.map((value) => `• **${value}**`),
         'Model and effort changes apply to the next turn; an active turn is unchanged.',
       ].join('\n') : [
@@ -510,7 +366,12 @@ function createFormatConfigInfoText({
         '• **xhigh** / **max** — heaviest. Hard reasoning, edge cases.',
       ].join('\n');
 
-    let body = head;
+    // The card is its buttons. Everything the body used to state — model,
+    // effort, rich text, runtime, agent, process, session — is already on a
+    // button below it, with a ✓ on the current value. What is left is the
+    // header (Telegram rejects an empty message) and the help that has no
+    // button to live on.
+    let body = '⚙️ Settings';
     if (codex) {
       body += '\n\nNative Codex beta: command network and web search are disabled. '
         + 'Product MCP tools and interactive approvals are unavailable. '

package/lib/handlers/gate-inbound.js

@@ -170,6 +170,10 @@ function createGateInbound({
           });
           if (r.consumed) return { action: 'handled', stage: 'rewind' };
         } catch (err) {
+          if (err?.code === 'CODEX_SCOPE_DISABLED') {
+            dispatchHandleMessage(sessionKey, chatId, msg, bot);
+            return { action: 'dispatched', stage: 'rewind' };
+          }
           // The text IS a recognized /rewind — on an internal error, consume it
           // anyway; falling through would send "/rewind" to claude as a prompt.
           logger.error?.(`[${botName}] rewind tryConsume failed: ${err?.message || err}`);

package/lib/handlers/replay-disposition.js

@@ -184,10 +184,23 @@ async function executeReplayPlan({ plan, deps }) {
   let recovered = 0; let skipped = 0; let noticed = 0; let noticeFailed = 0;
   let deferred = defer.length;
 
-  // CRASH branch — recover each (unchanged rc.57 behavior).
+  // Legacy provider crash recovery.
   for (const c of recover) {
-    // eslint-disable-next-line no-await-in-loop
-    const r = await deps.recover(c);
+    let r;
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      r = await deps.recover(c);
+    } catch (error) {
+      if (error?.code !== 'CODEX_SCOPE_DISABLED') throw error;
+      deferred += 1;
+      log('codex-replay-deferred', {
+        chat_id: c.chat_id,
+        thread_id: c.thread_id == null ? null : c.thread_id,
+        msg_id: c.msg_id,
+        reason: 'scope-disabled',
+      });
+      continue;
+    }
     if (r && r.ok) recovered += 1; else skipped += 1;
   }
 
@@ -204,8 +217,21 @@ async function executeReplayPlan({ plan, deps }) {
       });
       continue;
     }
-    // eslint-disable-next-line no-await-in-loop
-    const r = await deps.recoverCodex(c);
+    let r;
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      r = await deps.recoverCodex(c);
+    } catch (error) {
+      if (error?.code !== 'CODEX_SCOPE_DISABLED') throw error;
+      deferred += 1;
+      log('codex-replay-deferred', {
+        chat_id: c.chat_id,
+        thread_id: c.thread_id == null ? null : c.thread_id,
+        msg_id: c.msg_id,
+        reason: 'scope-disabled',
+      });
+      continue;
+    }
     if (r && r.ok) recovered += 1; else deferred += 1;
   }
 

package/lib/prompt.js

@@ -5,19 +5,26 @@
  * Telegram payload → polygram DB → unresolvable marker.
  */
 
-const { resolveRuntimeDescriptor } = require('./runtime-config');
+const {
+  requireCodexEnabled,
+  resolveRuntimeDescriptor,
+} = require('./runtime-config');
 
 function resolvePromptBackend({ config, chatId, threadId = null }) {
   const normalizedChatId = String(chatId);
   const normalizedThreadId = threadId == null || threadId === ''
     ? null
     : String(threadId);
-  return resolveRuntimeDescriptor({
+  const descriptor = resolveRuntimeDescriptor({
     config,
     chatId: normalizedChatId,
     threadId: normalizedThreadId,
     defaultPm: 'sdk',
-  }).backend;
+  });
+  if (descriptor.backend === 'codex') {
+    requireCodexEnabled(config, normalizedChatId, normalizedThreadId);
+  }
+  return descriptor.backend;
 }
 
 /**

package/lib/runtime-config.js

@@ -12,6 +12,7 @@
 
 const { createHash } = require('crypto');
 const { pickBackend } = require('@shumkov/orchestra');
+const { resolveBoolOverride } = require('./config-override');
 
 const PM_DESCRIPTORS = Object.freeze({
   sdk: Object.freeze({
@@ -93,6 +94,39 @@ class RuntimeConfigError extends Error {
   }
 }
 
+function resolveCodexEnabled(config, chatId, threadId = null) {
+  return resolveBoolOverride(
+    config,
+    'codexEnabled',
+    chatId,
+    threadId,
+  );
+}
+
+function requireCodexEnabled(config, chatId, threadId = null) {
+  if (resolveCodexEnabled(config, chatId, threadId)) return true;
+  throw new RuntimeConfigError(
+    'Codex is not enabled for this chat.',
+    {
+      code: 'CODEX_SCOPE_DISABLED',
+      runtime: 'codex',
+      reason: 'effective codexEnabled policy is false',
+      action: 'Enable Codex for this chat before selecting or dispatching it.',
+    },
+  );
+}
+
+function requireCodexDispatchEnabled({
+  config,
+  chatId,
+  threadId = null,
+  selectedProvider,
+  liveCodexGeneration = false,
+}) {
+  if (selectedProvider !== 'codex' && !liveCodexGeneration) return false;
+  return requireCodexEnabled(config, chatId, threadId);
+}
+
 /**
  * Convert an Orchestra-branded preflight receipt into the only availability
  * object that can enable Codex. The assertion is required lazily so a
@@ -192,6 +226,7 @@ function resolveRuntimeConfig({
   let spawnProfileId = null;
 
   if (isCodex) {
+    requireCodexEnabled(config, chatId, threadId);
     const receipt = validateCodexAvailability(codexAvailability);
     modelChoice = resolveScopedValue(
       scopes.providerOptions,
@@ -365,6 +400,7 @@ function resolveCodexRuntimeCandidate({
   threadId = null,
 } = {}) {
   if (!chatId) return null;
+  requireCodexEnabled(config, chatId, threadId);
 
   const scopes = configScopes(config, chatId, threadId);
   const modelChoice = resolveScopedValue(
@@ -491,9 +527,11 @@ function resolveRuntimeDescriptor({
     : pickedBackend === 'cli'
       ? 'cli'
       : 'sdk';
+  const codexEnabled = resolveCodexEnabled(config, chatId, threadId);
   return Object.freeze({
     configuredPm: pmChoice.value,
     source: pmChoice.source,
+    codexEnabled,
     runtime: PM_DESCRIPTORS[canonicalBackend].runtime,
     backend: canonicalBackend,
     promptMode: PM_DESCRIPTORS[canonicalBackend].promptMode,
@@ -636,7 +674,10 @@ function stableRuntimeConfigIdentity(fields) {
 module.exports = {
   createCodexRuntimeAvailability,
   processMatchesRuntime,
+  requireCodexDispatchEnabled,
+  requireCodexEnabled,
   RuntimeConfigError,
+  resolveCodexEnabled,
   resolveCodexRuntimeCandidate,
   resolveCodexRuntimeRequest,
   resolveRuntimeConfig,

package/lib/session-key.js

@@ -107,17 +107,15 @@ function getTopicConfig(chatConfig, threadId) {
 }
 
 /**
- * Resolve the config object a per-chat/topic setting should be written to.
- * Process-level settings use topic scope only for isolated sessions. A live
- * delivery setting can opt into topic scope even when sessions are shared.
+ * Resolve the config object a per-chat/topic setting should be written to:
+ * topic scope only where the session itself is topic-scoped, so a setting can
+ * never be stored somewhere the session that must honor it cannot see.
  *
  * @returns {{ scope: object, threadId: (string|null) }}
  */
-function getConfigWriteScope(chatConfig, threadId, { allowNonIsolatedTopic = false } = {}) {
+function getConfigWriteScope(chatConfig, threadId) {
   const tid = (threadId == null || threadId === '') ? null : String(threadId);
-  // Process-scoped settings follow session isolation. Live delivery settings
-  // may explicitly keep topic scope because they are resolved per message.
-  if (tid && (chatConfig?.isolateTopics === true || allowNonIsolatedTopic)) {
+  if (tid && chatConfig?.isolateTopics === true) {
     chatConfig.topics = chatConfig.topics || {};
     // A topic can be stored in the legacy / hand-edited form where the entry
     // is the bare name string (topics["329"] = "Advertising") rather than the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.34.1",
+  "version": "0.36.0",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {
@@ -24,8 +24,8 @@
     "config.example.json"
   ],
   "scripts": {
-    "test": "node --test --test-force-exit tests/*.test.js",
-    "coverage": "node --test --test-force-exit --experimental-test-coverage tests/*.test.js",
+    "test": "node --test --test-concurrency=4 tests/*.test.js",
+    "coverage": "node --test --test-concurrency=4 --experimental-test-coverage tests/*.test.js",
     "coverage:lcov": "mkdir -p coverage && node --test --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=coverage/lcov.info tests/*.test.js",
     "start": "node polygram.js",
     "split-db": "node scripts/split-db.js",
@@ -63,7 +63,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.123",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@shumkov/orchestra": "0.10.10",
+    "@shumkov/orchestra": "0.10.11",
     "better-sqlite3": "^12.9.0",
     "grammy": "^1.42.0",
     "markdown-it": "^14.1.1",

package/polygram.js

@@ -79,6 +79,7 @@ const {
 } = require('./lib/codex/spawn-context');
 const {
   processMatchesRuntime,
+  requireCodexDispatchEnabled,
   resolveCodexRuntimeCandidate,
   resolveRuntimeDescriptor,
 } = require('./lib/runtime-config');
@@ -631,15 +632,17 @@ function buildUnavailableCodexRuntimeView({
   runtimeView = null,
 }) {
   let candidate = null;
-  try {
-    candidate = resolveCodexRuntimeCandidate({
-      config,
-      chatId,
-      threadId,
-    });
-  } catch {
-    // The runtime button must remain available even when the saved Codex
-    // model, effort, or cwd is incomplete.
+  if (runtimeSelection.codexEnabled) {
+    try {
+      candidate = resolveCodexRuntimeCandidate({
+        config,
+        chatId,
+        threadId,
+      });
+    } catch {
+      // The runtime button must remain available even when the saved Codex
+      // model, effort, or cwd is incomplete.
+    }
   }
   const model = runtimeView?.model ?? candidate?.model ?? null;
   const effort = runtimeView?.effort ?? candidate?.effort ?? null;
@@ -653,6 +656,7 @@ function buildUnavailableCodexRuntimeView({
     backend: runtimeSelection.backend,
     configuredPm: runtimeSelection.configuredPm,
     selectionSource: runtimeSelection.source,
+    codexEnabled: runtimeSelection.codexEnabled,
     model,
     effort,
     models: runtimeView?.models ?? Object.freeze([]),
@@ -684,10 +688,19 @@ async function resolveSessionRuntimeView({
     backend: runtimeSelection.backend,
     configuredPm: runtimeSelection.configuredPm,
     selectionSource: runtimeSelection.source,
+    codexEnabled: runtimeSelection.codexEnabled,
   };
   if (runtimeSelection.runtime !== 'codex') {
     return Object.freeze(runtimeMetadata);
   }
+  if (!runtimeSelection.codexEnabled) {
+    return buildUnavailableCodexRuntimeView({
+      runtimeSelection,
+      chatId,
+      threadId,
+      error: { code: 'CODEX_SCOPE_DISABLED' },
+    });
+  }
   if (!codexRuntimeController) {
     return buildUnavailableCodexRuntimeView({
       runtimeSelection,
@@ -896,6 +909,16 @@ async function buildSpawnContext(
     // the inbound filter and the send() choke point use, so CliProcess's
     // pre-check + system-prompt line can't drift from actual enforcement.
     localApi: !!config.bot?.apiRoot,
+    // The display hint this chat should be running under, resolved fresh on
+    // every context build. It is spawn-time state (woven into the appended
+    // system prompt), so a warm session only picks up a rich-text toggle if the
+    // context carries the new hint for getOrSpawn to notice the drift against.
+    // MUST be built exactly like the factory-side resolver below — a difference
+    // in either argument is permanent drift, i.e. a respawn per message.
+    displayHint: buildPolygramDisplayHint(
+      resolveRichTextEnabled(config, chatId, threadId || null),
+      { inlineMedia: true },
+    ),
     // Pre-resolve through the SAME backend-aware resolver origin's CliProcess used, so
     // orchestra (which now uses opts.outboundCapOverride verbatim, without its own
     // resolveFileCaps clamp) gets the backend default (2GB local / 50MB cloud) AND the
@@ -1113,9 +1136,9 @@ let handleSendOverIpc = null;
 // formatToolInputForCard).
 
 // Config card UI moved to lib/handlers/config-ui.js. polygram.js
-// keeps a thin formatConfigInfoText wrapper since it needs the
-// runtime pm + db + getClaudeSessionId; buildConfigKeyboard is
-// pure and re-exported.
+// keeps a thin formatConfigInfoText wrapper since it supplies the
+// async runtime-view resolver; buildConfigKeyboard is pure and
+// re-exported.
 const {
   buildConfigKeyboard,
   createFormatConfigInfoText,
@@ -1181,11 +1204,32 @@ function parsePairCodeArgs(text) {
 async function handleMessage(sessionKey, chatId, msg, bot) {
   const chatConfig = config.chats[chatId];
   if (!chatConfig) return;
-  const selectedInboundProvider = resolvePromptBackend({
-    config,
-    chatId,
-    threadId: msg.message_thread_id?.toString() || null,
-  }) === 'codex'
+  const text = msg.text || msg.caption || '';
+  const threadId = msg.message_thread_id;
+  const threadIdStr = threadId?.toString() || null;
+  const botAllowsCommands = !!config.bot?.allowConfigCommands;
+  const runtimeInspectionCommand = (
+    botAllowsCommands
+    && (
+      text === '/config'
+      || text === '/model'
+      || text === '/effort'
+    )
+  );
+  const selectedBackend = runtimeInspectionCommand
+    ? resolveRuntimeDescriptor({
+      config,
+      chatId,
+      threadId: threadIdStr,
+      defaultPm: 'sdk',
+      logger: console,
+    }).backend
+    : resolvePromptBackend({
+      config,
+      chatId,
+      threadId: threadIdStr,
+    });
+  const selectedInboundProvider = selectedBackend === 'codex'
     ? 'codex'
     : 'claude';
   if (
@@ -1221,9 +1265,6 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
     });
   }
 
-  const text = msg.text || msg.caption || '';
-  const threadId = msg.message_thread_id;
-  const threadIdStr = threadId?.toString() || null;
   const label = getSessionLabel(chatConfig, threadIdStr);
 
   const replyOpts = (tid) => ({
@@ -1235,7 +1276,6 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
   // comment there for the bump procedure.
   const MODEL_VERSIONS = MODEL_VERSIONS_DESC;
 
-  const botAllowsCommands = !!config.bot?.allowConfigCommands;
   const cmdUser = msg.from?.first_name || msg.from?.username || null;
   const cmdUserId = msg.from?.id || null;
 
@@ -1281,7 +1321,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
     }, { source: 'command-reply', botName: BOT_NAME, model: chatConfig.model, effort: chatConfig.effort, ...metaTags });
   };
 
-  if (botAllowsCommands && (text === '/model' || text === '/config' || text === '/effort')) {
+  if (runtimeInspectionCommand) {
     const show = text === '/effort' ? 'effort' : text === '/model' ? 'model' : 'all';
     // Resolve per-topic overrides so a topic's card shows its REAL
     // agent/model/effort, not the chat-level default — Music topic (thread 3)
@@ -2000,6 +2040,13 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
         || current.backend === 'codex'
       ),
     );
+    requireCodexDispatchEnabled({
+      config,
+      chatId,
+      threadId: threadIdStr || null,
+      selectedProvider: selectedInboundProvider,
+      liveCodexGeneration,
+    });
     if (liveCodexGeneration) {
       if (!codexRuntimeController) {
         codexDispatchDecision = 'unavailable';
@@ -4188,7 +4235,6 @@ async function main() {
   // call time and captures the value (closure-by-value). v4 reviewer
   // caught this as the same class as the v3 BLOCKER.
   formatConfigInfoText = createFormatConfigInfoText({
-    pm, db, getClaudeSessionId,
     resolveRuntimeView: resolveSessionRuntimeView,
   });
   handleConfigCallback = createHandleConfigCallback({
@@ -5037,7 +5083,10 @@ async function main() {
       // (rc.65+) AND a session_id to resume into.
       if (o.text && savedSessionId) {
         try {
-          const entry = await pm.getOrSpawn(o.session_key, buildSpawnContext(o.session_key));
+          const entry = await pm.getOrSpawn(
+            o.session_key,
+            await buildSpawnContext(o.session_key),
+          );
           // 0.10.0 P0.4: route through Process.fireUserMessage so both
           // SDK and tmux backends work. Pre-0.10.0-P0.4 reached into
           // entry.inputController.push directly — broken on tmux.