polygram 0.38.1 → 0.38.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.38.1",
+  "version": "0.38.3",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/lib/approvals/store.js

@@ -12,6 +12,10 @@
 
 const crypto = require('crypto');
 const { canonicalizeToolInput } = require('../canonical-json');
+const {
+  sanitizeDurableStructured,
+  sanitizeDurableJsonText,
+} = require('../secret-detect');
 
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
 // 16 random bytes → 22 base64url chars ≈ 128 bits of entropy. Prevents
@@ -164,10 +168,41 @@ function createStore(rawDb, now = () => Date.now()) {
       if (!approver_chat_id) throw new Error('approver_chat_id required');
       if (!tool_name) throw new Error('tool_name required');
 
-      const tool_input_json = typeof tool_input === 'string'
-        ? tool_input
-        : JSON.stringify(tool_input || {});
-      const tool_input_digest = digestInput(tool_input_json);
+      // The row is an audit + display copy: the card renders it and the digest
+      // dedups repeated hook fires. The tool itself runs on the caller's own
+      // in-memory input, so masking recognized credentials here removes them
+      // from durable storage without touching what gets executed. Digesting
+      // the masked form also stops the digest from being a fingerprint of the
+      // credential, while staying deterministic for dedupe.
+      // Sanitize the STRUCTURE before serializing: a value the serializer
+      // escapes no longer looks like a declared credential to the detector,
+      // masking the serialized form can splice across its delimiters, and a
+      // credential named only by its key (`{"password":"…"}`) is invisible to
+      // a text pass. A caller that hands over an already-serialized document
+      // gets the same treatment — it is parsed back first, and only genuinely
+      // non-JSON input falls back to text masking.
+      let tool_input_json;
+      let sanitized;
+      if (typeof tool_input === 'string') {
+        const res = sanitizeDurableJsonText(tool_input);
+        tool_input_json = res.text;
+        sanitized = res.changed;
+      } else {
+        const source = tool_input || {};
+        tool_input_json = JSON.stringify(sanitizeDurableStructured(source));
+        sanitized = tool_input_json !== JSON.stringify(source);
+      }
+      // The legacy dedupe key is (turn, digest of the stored input), which is
+      // only sound while the stored input distinguishes two calls. Once a
+      // credential is masked it no longer does: two different secrets mask to
+      // the same text, so a shared digest would let one operator decision
+      // authorize a different command. A sanitized row therefore gets a
+      // random per-row identity — unique, and derived from nothing — and skips
+      // legacy reuse entirely. Dedupe by the provider's stable tool_use_id is
+      // unaffected: that key never depended on the input.
+      const tool_input_digest = sanitized
+        ? crypto.randomBytes(8).toString('hex')
+        : digestInput(tool_input_json);
       const requested_ts = now();
       const timeout_ts = requested_ts + timeoutMs;
       const callback_token = newToken();
@@ -186,9 +221,12 @@ function createStore(rawDb, now = () => Date.now()) {
       // which existing row counts as a "match."
       let row, reused = false;
       const tx = rawDb.transaction(() => {
-        const existing = tool_use_id
-          ? findDedupByToolUseIdStmt.get(bot_name, tool_use_id)
-          : findDedupStmt.get(bot_name, turn_id, tool_input_digest);
+        let existing = null;
+        if (tool_use_id) {
+          existing = findDedupByToolUseIdStmt.get(bot_name, tool_use_id);
+        } else if (!sanitized) {
+          existing = findDedupStmt.get(bot_name, turn_id, tool_input_digest);
+        }
         if (existing) { row = existing; reused = true; return; }
         const res = insertStmt.run({
           bot_name,

package/lib/codex/runtime-controller.js

@@ -222,6 +222,7 @@ function createCodexRuntimeController({
     || typeof db.settleCodexQueuedDispatch !== 'function'
     || typeof db.settleCodexStoppedGeneration !== 'function'
     || typeof db.settleCodexFailedGeneration !== 'function'
+    || typeof db.prepareCodexCleanRetirement !== 'function'
     || typeof db.recordCodexDeliveryCheckpoint !== 'function'
     || typeof resolveHostIdentity !== 'function'
     || typeof resolveBinary !== 'function'
@@ -416,6 +417,7 @@ function createCodexRuntimeController({
           codexHostIdentity: identity.stableHostId,
           codexBootSessionIdentity: identity.bootSessionId,
           codexRecoveryState,
+          codexRetirementPreparer: prepareCodexRetirement,
           codexRetirementVerifier: verifyCodexRetirement,
         }),
       });
@@ -1137,7 +1139,11 @@ function createCodexRuntimeController({
         checkpoint,
         retireGeneration,
       });
-      if (retireGeneration && persisted.retired !== true) {
+      if (
+        retireGeneration
+        && persisted.retired !== true
+        && persisted.deferred !== true
+      ) {
         throw controllerError(
           'Codex delivery did not retire the verified stopped generation.',
           'CODEX_RETIREMENT_UNVERIFIED',
@@ -1239,6 +1245,106 @@ function createCodexRuntimeController({
     }
   }
 
+  function prepareCodexRetirement(input = {}) {
+    const expectedKeys = [
+      'sessionKey',
+      'generationId',
+      'attemptId',
+      'providerSessionId',
+      'providerTurnId',
+      'sourceMsgId',
+    ];
+    const keys = input && typeof input === 'object'
+      ? Reflect.ownKeys(input)
+      : [];
+    const reject = (message, cause) => {
+      throw controllerError(
+        message,
+        'CODEX_RETIREMENT_PREPARATION_REJECTED',
+        'Do not interrupt or continue the unproven Codex turn.',
+        cause,
+      );
+    };
+    if (
+      keys.length !== expectedKeys.length
+      || expectedKeys.some((key) => !Object.hasOwn(input, key))
+    ) {
+      reject('Codex retirement preparation binding is incomplete.');
+    }
+    for (const key of expectedKeys.slice(0, 5)) {
+      if (
+        typeof input[key] !== 'string'
+        || input[key].length === 0
+        || input[key].length > 512
+      ) {
+        reject('Codex retirement preparation binding is malformed.');
+      }
+    }
+    if (!(
+      (
+        typeof input.sourceMsgId === 'string'
+        && input.sourceMsgId.length > 0
+        && input.sourceMsgId.length <= 512
+      )
+      || (
+        Number.isSafeInteger(input.sourceMsgId)
+        && input.sourceMsgId > 0
+      )
+    )) {
+      reject('Codex retirement source message binding is malformed.');
+    }
+
+    const record = processesByGeneration.get(input.generationId);
+    if (
+      !record
+      || currentProcessBySession.get(input.sessionKey) !== record
+      || record.proc.sessionKey !== input.sessionKey
+      || record.proc.generationId !== input.generationId
+      || record.proc.providerSessionId !== input.providerSessionId
+      || !record.durable
+      || record.durabilityBlocked
+      || record.retired
+      || !(
+        record.proc.runtime === 'codex'
+        || record.proc.backend === 'codex'
+      )
+    ) {
+      reject('Codex retirement preparation does not own the exact live turn.');
+    }
+
+    const state = requireAvailableInitialization();
+    let result;
+    try {
+      result = db.prepareCodexCleanRetirement({
+        generation_id: input.generationId,
+        session_key: input.sessionKey,
+        attempt_id: input.attemptId,
+        provider_session_id: input.providerSessionId,
+        provider_turn_id: input.providerTurnId,
+        source_message_id: String(input.sourceMsgId),
+        stable_host_id: state.identity.stableHostId,
+        boot_session_id: state.identity.bootSessionId,
+        ts: Date.now(),
+      });
+    } catch (cause) {
+      reject('Codex retirement preparation was not committed.', cause);
+    }
+    if (
+      !result
+      || ![0, 1].includes(result.changes)
+      || result.disposition !== 'retirement-requested'
+      || result.generationId !== input.generationId
+      || result.attemptId !== input.attemptId
+    ) {
+      reject('Codex retirement preparation acknowledgement is inexact.');
+    }
+    return Object.freeze({
+      committed: true,
+      disposition: 'retirement-requested',
+      ...input,
+    });
+  }
+
   async function verifyCodexRetirement({
     sessionKey,
     generationId,