polygram 0.35.0 → 0.36.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.35.0",
+  "version": "0.36.1",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/config.example.json

@@ -66,7 +66,7 @@
   },
 
   "codex": {
-    "_comment": "Optional native macOS arm64 or Linux x64 Codex app-server beta. Codex stays disabled unless a chat/topic explicitly sets pm:'codex' and exact target-specific startup preflight succeeds; other host targets, including Windows, are rejected. `home` must be a dedicated non-temporary 0700 CODEX_HOME already authenticated with ChatGPT; polygram never copies or reads credential contents. `binary` must be the canonical immutable path to the reviewed target's pinned Codex CLI, not a PATH symlink. On Linux set POLYGRAM_CODEX_TMPDIR to an owner-only 0700 runtime directory; otherwise Codex inherits the daemon TMPDIR after the same safety checks. Every directory containing daemon credentials or control data must be listed in daemonSecretRoots and must not overlap a Codex workspace or CODEX_HOME. Command network and model-native web search are disabled; product MCP tools and interactive approvals are unavailable. Keep long-running commands in the foreground. Detached/background servers are unsupported and may survive hard runtime loss.",
+    "_comment": "Optional native macOS arm64 or Linux x64 Codex app-server beta. Codex is default-off: a chat/topic must explicitly set codexEnabled:true before pm:'codex' can be selected or dispatched, and exact target-specific startup preflight must succeed; other host targets, including Windows, are rejected. `home` must be a dedicated non-temporary 0700 CODEX_HOME already authenticated with ChatGPT; polygram never copies or reads credential contents. `binary` must be the canonical immutable path to the reviewed target's pinned Codex CLI, not a PATH symlink. On Linux set POLYGRAM_CODEX_TMPDIR to an owner-only 0700 runtime directory; otherwise Codex inherits the daemon TMPDIR after the same safety checks. Every directory containing daemon credentials or control data must be listed in daemonSecretRoots and must not overlap a Codex workspace or CODEX_HOME. Command network and model-native web search are disabled; product MCP tools and interactive approvals are unavailable. Keep long-running commands in the foreground. Detached/background servers are unsupported and may survive hard runtime loss.",
     "home": "/Users/you/.codex-polygram",
     "binary": "/Users/you/.local/share/codex/versions/0.145.0/codex",
     "daemonSecretRoots": [
@@ -94,6 +94,7 @@
       "name": "Codex beta DM",
       "bot": "admin-bot",
       "_comment_pm": "Codex uses the pinned app-server SDK surface directly (no tmux). Native macOS arm64 and Linux x64 beta: command network and model-native web search are disabled; product MCP tools and interactive approvals are unavailable; long-running commands must stay in the foreground; detached/background servers are unsupported and may survive hard runtime loss. The model and effort are accepted only when returned by this deployment's authenticated ChatGPT-backed model catalog.",
+      "codexEnabled": true,
       "pm": "codex",
       "codexModel": "gpt-5.6-sol",
       "codexEffort": "xhigh",

package/lib/error/classify.js

@@ -145,6 +145,14 @@ function mapCodes(codes, shape) {
 }
 
 const CODEX_ERROR_SHAPES = Object.freeze({
+  scopeDisabled: stableCodeShape(
+    'codexScopeDisabled',
+    'Codex is not enabled for this chat',
+  ),
+  runtimeSelectionIncomplete: stableCodeShape(
+    'codexRuntimeSelectionIncomplete',
+    'Codex is enabled, but its model, effort, or workspace is not configured for this chat',
+  ),
   auth: stableCodeShape(
     'codexAuthUnavailable',
     '🔑 Codex authentication is unavailable. The operator needs to re-authenticate the pinned deployment.',
@@ -192,6 +200,9 @@ const CODEX_ERROR_SHAPES = Object.freeze({
 });
 
 const CODEX_ERROR_CODES = {
+  CODEX_SCOPE_DISABLED: CODEX_ERROR_SHAPES.scopeDisabled,
+  CODEX_RUNTIME_SELECTION_INCOMPLETE:
+    CODEX_ERROR_SHAPES.runtimeSelectionIncomplete,
   ...mapCodes([
     'CODEX_AUTH_UNAVAILABLE',
   ], CODEX_ERROR_SHAPES.auth),

package/lib/handlers/config-callback.js

@@ -18,7 +18,11 @@
 const { toTelegramHtml } = require('../telegram/format');
 const { resolveRichTextEnabled } = require('../telegram/rich');
 const { getTopicConfig, getConfigWriteScope } = require('../session-key');
-const { resolveRuntimeDescriptor } = require('../runtime-config');
+const {
+  resolveCodexEnabled,
+  resolveRuntimeDescriptor,
+} = require('../runtime-config');
+const { classify } = require('../error/classify');
 const {
   configuredRuntimeValue,
   formatCodexSettingsOutcome,
@@ -54,6 +58,16 @@ function runtimeLabel(runtime) {
   return RUNTIME_OPTION_BY_BACKEND.get(runtime).label;
 }
 
+function codexSelectionErrorMessage(error) {
+  if (
+    error?.code === 'CODEX_SCOPE_DISABLED'
+    || error?.code === 'CODEX_RUNTIME_SELECTION_INCOMPLETE'
+  ) {
+    return classify(error).userMessage;
+  }
+  return 'Codex is unavailable; check login and runtime diagnostics';
+}
+
 function runtimeSwitchBlocked(proc) {
   if (!proc || proc.closed) return false;
   try {
@@ -135,6 +149,17 @@ function createHandleConfigCallback({
             .catch(() => {});
           return;
         }
+        if (
+          value === 'codex'
+          && !resolveCodexEnabled(config, chatId, callbackThreadIdEarly)
+        ) {
+          releaseConfigIntent();
+          await ctx.answerCallbackQuery({
+            text: codexSelectionErrorMessage({ code: 'CODEX_SCOPE_DISABLED' }),
+            show_alert: true,
+          }).catch(() => {});
+          return;
+        }
         const currentSelection = resolveRuntimeDescriptor({
           config,
           chatId,
@@ -190,7 +215,7 @@ function createHandleConfigCallback({
             );
             releaseConfigIntent();
             await ctx.answerCallbackQuery({
-              text: 'Codex is unavailable; check login and runtime diagnostics',
+              text: codexSelectionErrorMessage(error),
               show_alert: true,
             }).catch(() => {});
             return;
@@ -389,6 +414,11 @@ function createHandleConfigCallback({
             backend: value,
             configuredPm: value,
             selectionSource: writeThreadId ? 'topic' : 'chat',
+            codexEnabled: resolveCodexEnabled(
+              config,
+              chatId,
+              callbackThreadIdEarly,
+            ),
           };
         }
         const topicConfig = getTopicConfig(

package/lib/handlers/config-ui.js

@@ -18,9 +18,15 @@
 
 const MODEL_OPTIONS = ['opus', 'sonnet', 'haiku'];
 const EFFORT_OPTIONS = ['low', 'medium', 'high', 'xhigh', 'max'];
+const CODEX_MODEL_OPTIONS = new Set([
+  'gpt-5.6-sol',
+  'gpt-5.6-terra',
+  'gpt-5.6-luna',
+]);
 // Which runtimes the card offers. The sdk backend stays fully supported in
 // code and config files — it is per-token and nobody picks it from a chat, so
-// it has no button. A chat configured on it simply shows no ✓ on this row.
+// it has no button. Codex is filtered below unless enabled for the current
+// scope. A chat configured on sdk simply shows no ✓ on this row.
 const RUNTIME_OPTIONS = Object.freeze([
   Object.freeze({ backend: 'cli', label: 'Claude' }),
   Object.freeze({ backend: 'codex', label: 'Codex' }),
@@ -63,6 +69,7 @@ function getCodexCatalogModels(runtimeView) {
       !entry
       || typeof entry.model !== 'string'
       || entry.model.length === 0
+      || !CODEX_MODEL_OPTIONS.has(entry.model)
       || seen.has(entry.model)
     ) {
       return false;
@@ -244,10 +251,14 @@ function buildConfigKeyboard(
   const rows = [];
   if (show === 'all') {
     const currentBackend = canonicalRuntimeBackend(runtimeView);
-    rows.push(RUNTIME_OPTIONS.map(({ backend, label }) => ({
-      text: backend === currentBackend ? `✓ ${label}` : label,
-      callback_data: `cfg:runtime:${backend}`,
-    })));
+    rows.push(RUNTIME_OPTIONS
+      .filter(({ backend }) => (
+        backend !== 'codex' || runtimeView?.codexEnabled === true
+      ))
+      .map(({ backend, label }) => ({
+        text: backend === currentBackend ? `✓ ${label}` : label,
+        callback_data: `cfg:runtime:${backend}`,
+      })));
   }
   if ((show === 'model' || show === 'all') && modelOptions.length > 0) {
     rows.push(modelOptions.map((entry) => {

package/lib/handlers/gate-inbound.js

@@ -170,6 +170,10 @@ function createGateInbound({
           });
           if (r.consumed) return { action: 'handled', stage: 'rewind' };
         } catch (err) {
+          if (err?.code === 'CODEX_SCOPE_DISABLED') {
+            dispatchHandleMessage(sessionKey, chatId, msg, bot);
+            return { action: 'dispatched', stage: 'rewind' };
+          }
           // The text IS a recognized /rewind — on an internal error, consume it
           // anyway; falling through would send "/rewind" to claude as a prompt.
           logger.error?.(`[${botName}] rewind tryConsume failed: ${err?.message || err}`);

package/lib/handlers/replay-disposition.js

@@ -184,10 +184,23 @@ async function executeReplayPlan({ plan, deps }) {
   let recovered = 0; let skipped = 0; let noticed = 0; let noticeFailed = 0;
   let deferred = defer.length;
 
-  // CRASH branch — recover each (unchanged rc.57 behavior).
+  // Legacy provider crash recovery.
   for (const c of recover) {
-    // eslint-disable-next-line no-await-in-loop
-    const r = await deps.recover(c);
+    let r;
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      r = await deps.recover(c);
+    } catch (error) {
+      if (error?.code !== 'CODEX_SCOPE_DISABLED') throw error;
+      deferred += 1;
+      log('codex-replay-deferred', {
+        chat_id: c.chat_id,
+        thread_id: c.thread_id == null ? null : c.thread_id,
+        msg_id: c.msg_id,
+        reason: 'scope-disabled',
+      });
+      continue;
+    }
     if (r && r.ok) recovered += 1; else skipped += 1;
   }
 
@@ -204,8 +217,21 @@ async function executeReplayPlan({ plan, deps }) {
       });
       continue;
     }
-    // eslint-disable-next-line no-await-in-loop
-    const r = await deps.recoverCodex(c);
+    let r;
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      r = await deps.recoverCodex(c);
+    } catch (error) {
+      if (error?.code !== 'CODEX_SCOPE_DISABLED') throw error;
+      deferred += 1;
+      log('codex-replay-deferred', {
+        chat_id: c.chat_id,
+        thread_id: c.thread_id == null ? null : c.thread_id,
+        msg_id: c.msg_id,
+        reason: 'scope-disabled',
+      });
+      continue;
+    }
     if (r && r.ok) recovered += 1; else deferred += 1;
   }
 

package/lib/prompt.js

@@ -5,19 +5,26 @@
  * Telegram payload → polygram DB → unresolvable marker.
  */
 
-const { resolveRuntimeDescriptor } = require('./runtime-config');
+const {
+  requireCodexEnabled,
+  resolveRuntimeDescriptor,
+} = require('./runtime-config');
 
 function resolvePromptBackend({ config, chatId, threadId = null }) {
   const normalizedChatId = String(chatId);
   const normalizedThreadId = threadId == null || threadId === ''
     ? null
     : String(threadId);
-  return resolveRuntimeDescriptor({
+  const descriptor = resolveRuntimeDescriptor({
     config,
     chatId: normalizedChatId,
     threadId: normalizedThreadId,
     defaultPm: 'sdk',
-  }).backend;
+  });
+  if (descriptor.backend === 'codex') {
+    requireCodexEnabled(config, normalizedChatId, normalizedThreadId);
+  }
+  return descriptor.backend;
 }
 
 /**

package/lib/runtime-config.js

@@ -12,6 +12,7 @@
 
 const { createHash } = require('crypto');
 const { pickBackend } = require('@shumkov/orchestra');
+const { resolveBoolOverride } = require('./config-override');
 
 const PM_DESCRIPTORS = Object.freeze({
   sdk: Object.freeze({
@@ -93,6 +94,39 @@ class RuntimeConfigError extends Error {
   }
 }
 
+function resolveCodexEnabled(config, chatId, threadId = null) {
+  return resolveBoolOverride(
+    config,
+    'codexEnabled',
+    chatId,
+    threadId,
+  );
+}
+
+function requireCodexEnabled(config, chatId, threadId = null) {
+  if (resolveCodexEnabled(config, chatId, threadId)) return true;
+  throw new RuntimeConfigError(
+    'Codex is not enabled for this chat.',
+    {
+      code: 'CODEX_SCOPE_DISABLED',
+      runtime: 'codex',
+      reason: 'effective codexEnabled policy is false',
+      action: 'Enable Codex for this chat before selecting or dispatching it.',
+    },
+  );
+}
+
+function requireCodexDispatchEnabled({
+  config,
+  chatId,
+  threadId = null,
+  selectedProvider,
+  liveCodexGeneration = false,
+}) {
+  if (selectedProvider !== 'codex' && !liveCodexGeneration) return false;
+  return requireCodexEnabled(config, chatId, threadId);
+}
+
 /**
  * Convert an Orchestra-branded preflight receipt into the only availability
  * object that can enable Codex. The assertion is required lazily so a
@@ -192,6 +226,7 @@ function resolveRuntimeConfig({
   let spawnProfileId = null;
 
   if (isCodex) {
+    requireCodexEnabled(config, chatId, threadId);
     const receipt = validateCodexAvailability(codexAvailability);
     modelChoice = resolveScopedValue(
       scopes.providerOptions,
@@ -365,6 +400,7 @@ function resolveCodexRuntimeCandidate({
   threadId = null,
 } = {}) {
   if (!chatId) return null;
+  requireCodexEnabled(config, chatId, threadId);
 
   const scopes = configScopes(config, chatId, threadId);
   const modelChoice = resolveScopedValue(
@@ -491,9 +527,11 @@ function resolveRuntimeDescriptor({
     : pickedBackend === 'cli'
       ? 'cli'
       : 'sdk';
+  const codexEnabled = resolveCodexEnabled(config, chatId, threadId);
   return Object.freeze({
     configuredPm: pmChoice.value,
     source: pmChoice.source,
+    codexEnabled,
     runtime: PM_DESCRIPTORS[canonicalBackend].runtime,
     backend: canonicalBackend,
     promptMode: PM_DESCRIPTORS[canonicalBackend].promptMode,
@@ -636,7 +674,10 @@ function stableRuntimeConfigIdentity(fields) {
 module.exports = {
   createCodexRuntimeAvailability,
   processMatchesRuntime,
+  requireCodexDispatchEnabled,
+  requireCodexEnabled,
   RuntimeConfigError,
+  resolveCodexEnabled,
   resolveCodexRuntimeCandidate,
   resolveCodexRuntimeRequest,
   resolveRuntimeConfig,

package/lib/telegram/rich.js

@@ -52,6 +52,12 @@ function resolveRichTextEnabled(config, chatId, threadId = null) {
 // crafted string. See tests/rich.test.js for the ReDoS regression guard.
 
 const TASK_ITEM_RE = /^[ \t]{0,3}[-*+][ \t]+\[[ xX]\][ \t]+/m;
+// Any markdown list is structure: plain stays for a paragraph or two of
+// prose, and a reply organized as bullets or numbered items renders as a
+// rich document. Line-anchored, marker + space + content — a dash inside a
+// sentence or a lone '-' line (divider territory) does not match. Matches
+// marked's own list tokenization, so the gate and the renderer agree.
+const LIST_ITEM_RE = /^[ \t]{0,3}(?:[-*+]|\d{1,9}[.)])[ \t]+\S/m;
 const TABLE_ROW_RE = /^[ \t]{0,3}\|?[ \t]*:?-{2,}:?[ \t]*\|/m;
 const DETAILS_RE = /<details[ \t>]/i;
 const HEADING_RE = /^#{1,6}[ \t]+\S/m;
@@ -109,6 +115,7 @@ function stripFencedCodeBlocks(markdown) {
 // than rendering prose-only rich blocks (the oversized-prose problem).
 function hasNonMediaTrigger(scoped) {
   return TASK_ITEM_RE.test(scoped)
+      || LIST_ITEM_RE.test(scoped)
       || TABLE_ROW_RE.test(scoped)
       || DETAILS_RE.test(scoped)
       || HEADING_RE.test(scoped)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.35.0",
+  "version": "0.36.1",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {
@@ -24,8 +24,8 @@
     "config.example.json"
   ],
   "scripts": {
-    "test": "node --test --test-force-exit tests/*.test.js",
-    "coverage": "node --test --test-force-exit --experimental-test-coverage tests/*.test.js",
+    "test": "node --test --test-concurrency=4 tests/*.test.js",
+    "coverage": "node --test --test-concurrency=4 --experimental-test-coverage tests/*.test.js",
     "coverage:lcov": "mkdir -p coverage && node --test --experimental-test-coverage --test-reporter=spec --test-reporter-destination=stdout --test-reporter=lcov --test-reporter-destination=coverage/lcov.info tests/*.test.js",
     "start": "node polygram.js",
     "split-db": "node scripts/split-db.js",

package/polygram.js

@@ -79,6 +79,7 @@ const {
 } = require('./lib/codex/spawn-context');
 const {
   processMatchesRuntime,
+  requireCodexDispatchEnabled,
   resolveCodexRuntimeCandidate,
   resolveRuntimeDescriptor,
 } = require('./lib/runtime-config');
@@ -631,15 +632,17 @@ function buildUnavailableCodexRuntimeView({
   runtimeView = null,
 }) {
   let candidate = null;
-  try {
-    candidate = resolveCodexRuntimeCandidate({
-      config,
-      chatId,
-      threadId,
-    });
-  } catch {
-    // The runtime button must remain available even when the saved Codex
-    // model, effort, or cwd is incomplete.
+  if (runtimeSelection.codexEnabled) {
+    try {
+      candidate = resolveCodexRuntimeCandidate({
+        config,
+        chatId,
+        threadId,
+      });
+    } catch {
+      // The runtime button must remain available even when the saved Codex
+      // model, effort, or cwd is incomplete.
+    }
   }
   const model = runtimeView?.model ?? candidate?.model ?? null;
   const effort = runtimeView?.effort ?? candidate?.effort ?? null;
@@ -653,6 +656,7 @@ function buildUnavailableCodexRuntimeView({
     backend: runtimeSelection.backend,
     configuredPm: runtimeSelection.configuredPm,
     selectionSource: runtimeSelection.source,
+    codexEnabled: runtimeSelection.codexEnabled,
     model,
     effort,
     models: runtimeView?.models ?? Object.freeze([]),
@@ -684,10 +688,19 @@ async function resolveSessionRuntimeView({
     backend: runtimeSelection.backend,
     configuredPm: runtimeSelection.configuredPm,
     selectionSource: runtimeSelection.source,
+    codexEnabled: runtimeSelection.codexEnabled,
   };
   if (runtimeSelection.runtime !== 'codex') {
     return Object.freeze(runtimeMetadata);
   }
+  if (!runtimeSelection.codexEnabled) {
+    return buildUnavailableCodexRuntimeView({
+      runtimeSelection,
+      chatId,
+      threadId,
+      error: { code: 'CODEX_SCOPE_DISABLED' },
+    });
+  }
   if (!codexRuntimeController) {
     return buildUnavailableCodexRuntimeView({
       runtimeSelection,
@@ -1191,11 +1204,32 @@ function parsePairCodeArgs(text) {
 async function handleMessage(sessionKey, chatId, msg, bot) {
   const chatConfig = config.chats[chatId];
   if (!chatConfig) return;
-  const selectedInboundProvider = resolvePromptBackend({
-    config,
-    chatId,
-    threadId: msg.message_thread_id?.toString() || null,
-  }) === 'codex'
+  const text = msg.text || msg.caption || '';
+  const threadId = msg.message_thread_id;
+  const threadIdStr = threadId?.toString() || null;
+  const botAllowsCommands = !!config.bot?.allowConfigCommands;
+  const runtimeInspectionCommand = (
+    botAllowsCommands
+    && (
+      text === '/config'
+      || text === '/model'
+      || text === '/effort'
+    )
+  );
+  const selectedBackend = runtimeInspectionCommand
+    ? resolveRuntimeDescriptor({
+      config,
+      chatId,
+      threadId: threadIdStr,
+      defaultPm: 'sdk',
+      logger: console,
+    }).backend
+    : resolvePromptBackend({
+      config,
+      chatId,
+      threadId: threadIdStr,
+    });
+  const selectedInboundProvider = selectedBackend === 'codex'
     ? 'codex'
     : 'claude';
   if (
@@ -1231,9 +1265,6 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
     });
   }
 
-  const text = msg.text || msg.caption || '';
-  const threadId = msg.message_thread_id;
-  const threadIdStr = threadId?.toString() || null;
   const label = getSessionLabel(chatConfig, threadIdStr);
 
   const replyOpts = (tid) => ({
@@ -1245,7 +1276,6 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
   // comment there for the bump procedure.
   const MODEL_VERSIONS = MODEL_VERSIONS_DESC;
 
-  const botAllowsCommands = !!config.bot?.allowConfigCommands;
   const cmdUser = msg.from?.first_name || msg.from?.username || null;
   const cmdUserId = msg.from?.id || null;
 
@@ -1291,7 +1321,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
     }, { source: 'command-reply', botName: BOT_NAME, model: chatConfig.model, effort: chatConfig.effort, ...metaTags });
   };
 
-  if (botAllowsCommands && (text === '/model' || text === '/config' || text === '/effort')) {
+  if (runtimeInspectionCommand) {
     const show = text === '/effort' ? 'effort' : text === '/model' ? 'model' : 'all';
     // Resolve per-topic overrides so a topic's card shows its REAL
     // agent/model/effort, not the chat-level default — Music topic (thread 3)
@@ -2010,6 +2040,13 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
         || current.backend === 'codex'
       ),
     );
+    requireCodexDispatchEnabled({
+      config,
+      chatId,
+      threadId: threadIdStr || null,
+      selectedProvider: selectedInboundProvider,
+      liveCodexGeneration,
+    });
     if (liveCodexGeneration) {
       if (!codexRuntimeController) {
         codexDispatchDecision = 'unavailable';