polygram 0.38.1 → 0.38.3

package/lib/handlers/slash-commands.js

@@ -55,14 +55,21 @@ function createSlashCommands({
   saveConfig = () => {},
   botName,
   logEvent,
+  // Narrow async hook: retire the question state of a session whose process
+  // this command is retiring. A callback, so this module never learns the
+  // question store.
+  retireQuestionSession = null,
   logger = console,
 } = {}) {
 
   return async function dispatchSlashCommand(ctx) {
     const {
-      text, sessionKey, chatId, threadIdStr, chatConfig,
+      text, msgId, sessionKey, chatId, threadIdStr, chatConfig,
       cmdUser, cmdUserId, label, sendReply,
     } = ctx;
+    // Commands are logged by their recognized verb, never by the typed line:
+    // the arguments are message content and telemetry stays content-free.
+    const commandVerb = () => String(text || '').trim().split(/\s+/)[0] || null;
     const botAllowsCommands = !!config.bot?.allowConfigCommands;
 
     // /context — route through pm.getContextUsage(sessionKey) so the
@@ -184,10 +191,11 @@ function createSlashCommands({
         logEvent('compact-command', {
           chat_id: chatId, thread_id: threadIdStr, session_key: sessionKey,
           text_len: text.length,
-          // rc.65: store full text so boot-time orphan recovery can
-          // silently re-push after a deploy interrupted compaction.
-          text,
-          user: cmdUser, user_id: cmdUserId,
+          // The id of the inbound message carrying the hint. Boot-time orphan
+          // recovery joins it back to the stored row to re-push silently; the
+          // hint itself is message content and never enters telemetry.
+          msg_id: msgId ?? null,
+          user_id: cmdUserId,
         });
         const hasHint = text.length > '/compact'.length + 1;
         await sendReply(hasHint ? '🗜️ Compacting with your hint…' : '🗜️ Compacting…');
@@ -236,10 +244,18 @@ function createSlashCommands({
           );
           return true;
         }
+        // The process that owned any open question is gone; retire its state.
+        // Ordered after the kill so a refused reload leaves the still-live
+        // interaction intact.
+        await retireQuestionSession?.(sessionKey);
+      } else {
+        // No process to retire, but an open question has nothing to deliver to
+        // either.
+        await retireQuestionSession?.(sessionKey);
       }
       logEvent('session-reload-command', {
-        chat_id: chatId, command: text,
-        user: cmdUser, user_id: cmdUserId,
+        chat_id: chatId, command: commandVerb(),
+        user_id: cmdUserId,
       });
       await sendReply(
         codex
@@ -273,6 +289,10 @@ function createSlashCommands({
       const codex = isCodexRuntimeView(runtimeView);
       let drained = 0;
       try {
+        // A fresh session retires the process that owns any open question.
+        // Deliberately before the reset: if the reset then fails, the safe
+        // outcome is still that nothing exact was kept.
+        await retireQuestionSession?.(sessionKey);
         const r = await pm.resetSession(sessionKey, { reason: text.slice(1) });
         drained = r?.drainedPendings ?? 0;
       } catch (err) {
@@ -286,8 +306,8 @@ function createSlashCommands({
       }
       contextHintShown.delete(sessionKey);
       logEvent('session-reset-command', {
-        chat_id: chatId, command: text, drained_pendings: drained,
-        user: cmdUser, user_id: cmdUserId,
+        chat_id: chatId, command: commandVerb(), drained_pendings: drained,
+        user_id: cmdUserId,
       });
       await sendReply(
         codex
@@ -431,7 +451,7 @@ function createSlashCommands({
               const auditRows = [{
                   chat_id: chatId, thread_id: wThread, field: 'model',
                   old_value: oldModel, new_value: newModel,
-                  user: cmdUser, user_id: cmdUserId, source: 'command',
+                  user_id: cmdUserId, source: 'command',
                 }];
               if (effortAdjustment) {
                 auditRows.push({
@@ -594,7 +614,7 @@ function createSlashCommands({
               const auditRow = {
                 chat_id: chatId, thread_id: wThread, field: 'effort',
                 old_value: oldEffort, new_value: newEffort,
-                user: cmdUser, user_id: cmdUserId, source: 'command',
+                user_id: cmdUserId, source: 'command',
               };
               if (codex) {
                 try {
@@ -689,7 +709,9 @@ function createSlashCommands({
         });
         logEvent('pair-code-issued', {
           bot: botName, by: issuerId, scope: out.scope,
-          chat_id: out.chat_id, note: out.note,
+          chat_id: out.chat_id,
+          // The note is operator-typed text; record only that one was given.
+          noticed: Boolean(out.note),
         });
         const ttlLabel = args.ttl || '10m';
         const chatLabel = out.chat_id ? `chat ${out.chat_id}` : 'the chat where it is redeemed';
@@ -765,4 +787,23 @@ function createSlashCommands({
   };
 }
 
-module.exports = { createSlashCommands };
+/**
+ * Normalize a stored line into the exact `/compact [hint]` form, or return
+ * null when it is not a compact command at all.
+ *
+ * Boot-time recovery re-pushes a stored line into a live session, so the line
+ * has to be proven to BE a compact command first: an arbitrary message, or a
+ * different command, must never be fired at the agent as if the user had
+ * asked to compact. Telegram also delivers group commands with the bot's
+ * username attached (`/compact@bot hint`), which the agent's own parser does
+ * not accept — that suffix is stripped here.
+ */
+function normalizeCompactCommand(text) {
+  if (typeof text !== 'string') return null;
+  const match = /^\/compact(?:@[A-Za-z0-9_]+)?(?:\s+([\s\S]*))?$/.exec(text.trim());
+  if (!match) return null;
+  const hint = (match[1] || '').trim();
+  return hint ? `/compact ${hint}` : '/compact';
+}
+
+module.exports = { createSlashCommands, normalizeCompactCommand };

package/lib/handlers/voice.js

@@ -75,7 +75,7 @@ function createTranscribeVoiceAttachments({
       } catch (err) {
         logger.error?.(`[${label}] transcribe failed for ${a.name}: ${err.message}`);
         logEvent('voice-transcribe-failed', {
-          chat_id: chatId, msg_id: msgId, name: a.name, error: err.message,
+          chat_id: chatId, msg_id: msgId, error_class: err.name || 'Error',
         });
       }
     }));

package/lib/ipc/handlers.js

@@ -22,6 +22,7 @@ const {
  *   reload, so a value bound at wiring time can go stale.
  * @param {(req) => any} opts.handleSendOverIpc
  * @param {(req) => any} opts.requestDeployRestart
+ * @param {(req) => any} opts.requestForegroundCanaryTarget
  * @param {() => any} opts.inspectCleanRestartQualification
  */
 function createIpcHandlers({
@@ -30,6 +31,7 @@ function createIpcHandlers({
   getInFlightHandlers,
   handleSendOverIpc,
   requestDeployRestart,
+  requestForegroundCanaryTarget,
   inspectCleanRestartQualification,
 } = {}) {
   return {
@@ -46,6 +48,8 @@ function createIpcHandlers({
 
     deploy_restart: (req) => requestDeployRestart(req),
 
+    foreground_canary_target: (req) => requestForegroundCanaryTarget(req),
+
     clean_restart_qualification: async (req) => {
       assertClosedQualificationRequest(req);
       let observation = null;

package/lib/ops/clean-restart-qualification.js

@@ -130,6 +130,7 @@ function normalizeDeployQualificationExpectation(request) {
   const requestKeys = Object.keys(request);
   const allowedRequestKeys = new Set([
     'op', 'id', 'secret', 'qualification_expectation',
+    'foreground_expectation',
   ]);
   const hasUnknownRequestField = requestKeys.some(
     (key) => !allowedRequestKeys.has(key),

package/lib/ops/clean-shutdown.js

@@ -6,6 +6,7 @@ async function prepareCleanRetirement({
   awaitIngressSettlement,
   awaitHandlerSettlement,
   settlementTimeoutMs = 30_000,
+  continuationAuthorized = false,
   qualificationExpectation,
 } = {}) {
   if (typeof deliveryBarrier?.fenceAndDrain !== 'function'
@@ -21,9 +22,13 @@ async function prepareCleanRetirement({
   if (typeof awaitHandlerSettlement !== 'function') {
     throw new TypeError('clean shutdown requires handler settlement');
   }
+  if (typeof continuationAuthorized !== 'boolean') {
+    throw new TypeError('clean shutdown continuation authorization must be boolean');
+  }
 
   const deliveryDrain = captureSettlement(() => deliveryBarrier.fenceAndDrain());
   const processRetirement = captureSettlement(() => pm.retireForCleanRestart({
+    continuationAuthorized,
     getDeliveryEvidence: (sessionKey, sourceMsgId) => (
       deliveryBarrier.inspect(sessionKey, sourceMsgId)
     ),

package/lib/ops/deploy-restart-handler.js

@@ -0,0 +1,111 @@
+'use strict';
+
+const {
+  requireRestartRequestId,
+} = require('../ipc/restart-request-id');
+const {
+  normalizeDeployQualificationExpectation,
+} = require('./clean-restart-qualification');
+const {
+  normalizeDeployForegroundExpectation,
+} = require('./foreground-canary-target');
+
+function createDeployRestartHandler({
+  getIsShuttingDown,
+  getPid,
+  foregroundCanaryAuthorizer,
+  persistForegroundCanaryAuthorization,
+  shutdown,
+  logger = console,
+} = {}) {
+  if (typeof getIsShuttingDown !== 'function') {
+    throw new TypeError('deploy restart shutdown-state reader is required');
+  }
+  if (typeof getPid !== 'function') {
+    throw new TypeError('deploy restart PID reader is required');
+  }
+  if (typeof persistForegroundCanaryAuthorization !== 'function') {
+    throw new TypeError('foreground canary authorization persistence is required');
+  }
+  if (typeof shutdown !== 'function') {
+    throw new TypeError('deploy restart shutdown function is required');
+  }
+
+  function rejected(oldPid, restartRequestId, rejectionCode) {
+    return {
+      accepted: false,
+      old_pid: oldPid,
+      restart_request_id: restartRequestId,
+      rejection_code: rejectionCode,
+    };
+  }
+
+  return function requestDeployRestart(request) {
+    const oldPid = getPid();
+    const isForegroundRequest = request != null
+      && typeof request === 'object'
+      && Object.hasOwn(request, 'foreground_expectation');
+    if (getIsShuttingDown() && !isForegroundRequest) {
+      const error = new Error('shutdown already in progress');
+      error.code = 'SHUTDOWN_IN_PROGRESS';
+      throw error;
+    }
+    let restartRequestId;
+    try {
+      restartRequestId = requireRestartRequestId(request?.id);
+    } catch {
+      return rejected(oldPid, null, 'invalid-request');
+    }
+    if (getIsShuttingDown()) {
+      return rejected(oldPid, restartRequestId, 'shutdown-in-progress');
+    }
+
+    const qualificationExpectation = normalizeDeployQualificationExpectation(request);
+    const foregroundExpectation = normalizeDeployForegroundExpectation(request);
+    if (qualificationExpectation === null || foregroundExpectation === null) {
+      return rejected(oldPid, restartRequestId, 'invalid-request');
+    }
+
+    if (foregroundExpectation !== undefined) {
+      if (typeof foregroundCanaryAuthorizer?.authorizeRestart !== 'function') {
+        return rejected(oldPid, restartRequestId, 'target-unavailable');
+      }
+      const authorization = foregroundCanaryAuthorizer.authorizeRestart({
+        requestId: restartRequestId,
+        expectation: foregroundExpectation,
+      });
+      if (!authorization?.accepted) {
+        return rejected(
+          oldPid,
+          restartRequestId,
+          authorization?.rejectionCode || 'target-unavailable',
+        );
+      }
+      try {
+        persistForegroundCanaryAuthorization(authorization.authorizationEvent);
+      } catch {
+        return rejected(
+          oldPid,
+          restartRequestId,
+          'authorization-evidence-unavailable',
+        );
+      }
+    }
+
+    shutdown({
+      continuationAuthorized: true,
+      trigger: 'deploy-ipc',
+      restartRequestId,
+      qualificationExpectation,
+    }).catch((error) => {
+      logger.error?.(`[shutdown] deploy restart failed: ${error.message}`);
+    });
+    return {
+      accepted: true,
+      old_pid: oldPid,
+      restart_request_id: restartRequestId,
+    };
+  };
+}
+
+module.exports = { createDeployRestartHandler };