polygram 0.38.1 → 0.38.3

package/lib/ops/foreground-canary-target.js

@@ -0,0 +1,454 @@
+'use strict';
+
+const {
+  createHash,
+  createHmac,
+  timingSafeEqual,
+} = require('node:crypto');
+const {
+  getSessionKey,
+  getTopicName,
+} = require('../session-key');
+
+const SHA256_RE = /^[a-f0-9]{64}$/;
+const TOKEN_RE = /^[a-f0-9]{64}$/;
+const UUID_RE = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i;
+const PROVIDERS = new Set(['claude', 'codex']);
+const LIVE_HANDLER_STATUSES = new Set(['dispatched', 'processing']);
+const DEPLOY_REQUEST_KEYS = new Set([
+  'op',
+  'id',
+  'secret',
+  'foreground_expectation',
+  'qualification_expectation',
+]);
+const EXPECTATION_KEYS = [
+  'schema_version',
+  'daemon_instance_id',
+  'pid',
+  'provider',
+  'configured_scope_sha256',
+  'target_token',
+];
+const PROBE_KEYS = [
+  'op',
+  'id',
+  'secret',
+  'provider',
+  'configured_scope_sha256',
+];
+
+function isPlainObject(value) {
+  return value != null
+    && typeof value === 'object'
+    && !Array.isArray(value)
+    && Object.getPrototypeOf(value) === Object.prototype;
+}
+
+function hasExactKeys(value, keys) {
+  if (!isPlainObject(value)) return false;
+  const actual = Object.keys(value);
+  return actual.length === keys.length
+    && keys.every((key) => Object.hasOwn(value, key));
+}
+
+function isBoundedString(value, maxBytes = 256) {
+  return typeof value === 'string'
+    && value.length > 0
+    && Buffer.byteLength(value, 'utf8') <= maxBytes
+    && !/[\x00-\x1f\x7f]/.test(value);
+}
+
+function validRequestId(value) {
+  return UUID_RE.test(value ?? '');
+}
+
+function configuredScopeSha256({
+  botName,
+  chatId,
+  threadId,
+  chatName,
+  topicName,
+  isolateTopics,
+} = {}) {
+  return createHash('sha256').update(JSON.stringify([
+    String(botName),
+    String(chatId),
+    threadId == null ? null : String(threadId),
+    String(chatName),
+    topicName == null ? null : String(topicName),
+    isolateTopics === true,
+  ])).digest('hex');
+}
+
+function configuredScopes({ config, botName } = {}) {
+  const scopes = [];
+  for (const [chatId, chatConfig] of Object.entries(config?.chats ?? {})) {
+    if (!chatConfig || typeof chatConfig !== 'object') continue;
+    const base = {
+      botName,
+      chatId: String(chatId),
+      threadId: null,
+      chatName: String(chatConfig.name ?? ''),
+      topicName: null,
+      isolateTopics: chatConfig.isolateTopics === true,
+      sessionKey: getSessionKey(String(chatId), null, chatConfig),
+    };
+    scopes.push(Object.freeze({
+      ...base,
+      digest: configuredScopeSha256(base),
+    }));
+    for (const threadId of Object.keys(chatConfig.topics ?? {})) {
+      const topic = {
+        ...base,
+        threadId: String(threadId),
+        topicName: getTopicName(chatConfig, String(threadId)),
+        sessionKey: getSessionKey(String(chatId), String(threadId), chatConfig),
+      };
+      scopes.push(Object.freeze({
+        ...topic,
+        digest: configuredScopeSha256(topic),
+      }));
+    }
+  }
+  return scopes;
+}
+
+function resolveConfiguredScope({ config, botName, digest } = {}) {
+  if (!SHA256_RE.test(digest ?? '')) return null;
+  const matches = configuredScopes({ config, botName })
+    .filter((scope) => scope.digest === digest);
+  return matches.length === 1 ? matches[0] : null;
+}
+
+function normalizeDeployForegroundExpectation(request) {
+  if (!isPlainObject(request)) return null;
+  const keys = Object.keys(request);
+  const unknown = keys.some((key) => !DEPLOY_REQUEST_KEYS.has(key));
+  const present = Object.hasOwn(request, 'foreground_expectation');
+  if (!present && !unknown) return undefined;
+  if (
+    unknown
+    || request.op !== 'deploy_restart'
+    || !validRequestId(request.id)
+    || !isBoundedString(request.secret, 1024)
+  ) return null;
+
+  const expectation = request.foreground_expectation;
+  if (
+    !hasExactKeys(expectation, EXPECTATION_KEYS)
+    || expectation.schema_version !== 1
+    || !UUID_RE.test(expectation.daemon_instance_id ?? '')
+    || !Number.isSafeInteger(expectation.pid)
+    || expectation.pid <= 0
+    || !PROVIDERS.has(expectation.provider)
+    || !SHA256_RE.test(expectation.configured_scope_sha256 ?? '')
+    || !TOKEN_RE.test(expectation.target_token ?? '')
+  ) {
+    return null;
+  }
+  return Object.freeze({
+    daemonInstanceId: expectation.daemon_instance_id,
+    pid: expectation.pid,
+    provider: expectation.provider,
+    configuredScopeSha256: expectation.configured_scope_sha256,
+    targetToken: expectation.target_token,
+  });
+}
+
+function normalizedActiveTarget(value) {
+  if (!isPlainObject(value)) return null;
+  const sessionKey = value.sessionKey;
+  const chatId = value.chatId;
+  const threadId = value.threadId;
+  const telegramMessageId = value.telegramMessageId;
+  if (
+    !isBoundedString(sessionKey, 512)
+    || !isBoundedString(chatId, 128)
+    || !(threadId === null || isBoundedString(threadId, 128))
+    || !isBoundedString(telegramMessageId, 128)
+  ) return null;
+  return {
+    sessionKey,
+    chatId,
+    threadId,
+    telegramMessageId,
+  };
+}
+
+function normalizedSelectedTarget(value) {
+  if (!isPlainObject(value)) return null;
+  if (
+    !Number.isSafeInteger(value.messageId)
+    || value.messageId <= 0
+    || !isBoundedString(value.chatId, 128)
+    || !(value.threadId === null || isBoundedString(value.threadId, 128))
+    || !isBoundedString(value.telegramMessageId, 128)
+    || !isBoundedString(value.sessionKey, 512)
+    || !PROVIDERS.has(value.provider)
+    || !isBoundedString(value.handlerStatus, 64)
+  ) return null;
+  return {
+    messageId: value.messageId,
+    chatId: value.chatId,
+    threadId: value.threadId,
+    telegramMessageId: value.telegramMessageId,
+    sessionKey: value.sessionKey,
+    provider: value.provider,
+    handlerStatus: value.handlerStatus,
+  };
+}
+
+function sameTarget(left, right) {
+  return left.sessionKey === right.sessionKey
+    && left.chatId === right.chatId
+    && left.threadId === right.threadId
+    && left.telegramMessageId === right.telegramMessageId;
+}
+
+function sameBinding(left, right) {
+  return sameTarget(left, right)
+    && left.messageId === right.messageId
+    && left.provider === right.provider
+    && left.scopeDigest === right.scopeDigest;
+}
+
+function safeTokenEqual(left, right) {
+  if (!TOKEN_RE.test(left ?? '') || !TOKEN_RE.test(right ?? '')) return false;
+  return timingSafeEqual(Buffer.from(left), Buffer.from(right));
+}
+
+function createForegroundCanaryAuthorizer({
+  botName,
+  daemonIdentity,
+  config,
+  tokenSecret,
+  getActiveHandlerCount,
+  getActiveHandlerTargets,
+  getForegroundCanaryTarget,
+  now = Date.now,
+  tokenTtlMs = 300_000,
+  tokenLimit = 64,
+} = {}) {
+  if (!isBoundedString(botName, 128)) {
+    throw new TypeError('foreground canary bot name is required');
+  }
+  if (
+    !isPlainObject(daemonIdentity)
+    || !UUID_RE.test(daemonIdentity.daemon_instance_id ?? '')
+    || !Number.isSafeInteger(daemonIdentity.pid)
+    || daemonIdentity.pid <= 0
+    || !isBoundedString(daemonIdentity.package_version, 128)
+  ) {
+    throw new TypeError('foreground canary daemon identity is invalid');
+  }
+  if (!isBoundedString(tokenSecret, 1024)) {
+    throw new TypeError('foreground canary token secret is required');
+  }
+  if (typeof getActiveHandlerCount !== 'function') {
+    throw new TypeError('foreground canary active-handler count reader is required');
+  }
+  if (typeof getActiveHandlerTargets !== 'function') {
+    throw new TypeError('foreground canary active-handler reader is required');
+  }
+  if (typeof getForegroundCanaryTarget !== 'function') {
+    throw new TypeError('foreground canary database reader is required');
+  }
+  if (!Number.isSafeInteger(tokenTtlMs) || tokenTtlMs <= 0) {
+    throw new TypeError('foreground canary token TTL is invalid');
+  }
+  if (!Number.isSafeInteger(tokenLimit) || tokenLimit <= 0) {
+    throw new TypeError('foreground canary token limit is invalid');
+  }
+
+  const tokens = new Map();
+
+  function reject(rejectionCode) {
+    return { rejectionCode };
+  }
+
+  function inspectLiveTarget({ provider, scopeDigest }) {
+    const scope = resolveConfiguredScope({ config, botName, digest: scopeDigest });
+    if (!scope) return reject('configured-scope-mismatch');
+
+    let activeCount;
+    let active;
+    try {
+      activeCount = getActiveHandlerCount();
+      active = getActiveHandlerTargets();
+    } catch {
+      return reject('target-unavailable');
+    }
+    if (activeCount !== 1 || !Array.isArray(active) || active.length !== 1) {
+      return reject('daemon-busy');
+    }
+    const activeTarget = normalizedActiveTarget(active[0]);
+    if (!activeTarget) return reject('source-mismatch');
+    if (
+      activeTarget.chatId !== scope.chatId
+      || activeTarget.threadId !== scope.threadId
+      || activeTarget.sessionKey !== scope.sessionKey
+    ) {
+      return reject('source-mismatch');
+    }
+
+    let selected;
+    try {
+      selected = normalizedSelectedTarget(getForegroundCanaryTarget({
+        botName,
+        chatId: activeTarget.chatId,
+        telegramMessageId: activeTarget.telegramMessageId,
+      }));
+    } catch {
+      return reject('target-unavailable');
+    }
+    if (!selected) return reject('target-not-live');
+    if (!sameTarget(activeTarget, selected)) return reject('source-mismatch');
+    if (selected.provider !== provider) return reject('provider-mismatch');
+    if (!LIVE_HANDLER_STATUSES.has(selected.handlerStatus)) {
+      return reject('target-not-live');
+    }
+    return {
+      binding: Object.freeze({
+        ...selected,
+        scopeDigest,
+      }),
+    };
+  }
+
+  function probe(request) {
+    if (
+      !hasExactKeys(request, PROBE_KEYS)
+      || request.op !== 'foreground_canary_target'
+      || !validRequestId(request.id)
+      || !isBoundedString(request.secret, 1024)
+      || !PROVIDERS.has(request.provider)
+      || !SHA256_RE.test(request.configured_scope_sha256 ?? '')
+    ) {
+      return {
+        outcome: 'rejected',
+        rejection_code: 'invalid-request',
+      };
+    }
+
+    const issuedAt = now();
+    for (const [requestId, stored] of tokens) {
+      if (issuedAt > stored.expiresAt) tokens.delete(requestId);
+    }
+    if (!tokens.has(request.id) && tokens.size >= tokenLimit) {
+      return {
+        outcome: 'rejected',
+        rejection_code: 'target-unavailable',
+      };
+    }
+
+    const inspected = inspectLiveTarget({
+      provider: request.provider,
+      scopeDigest: request.configured_scope_sha256,
+    });
+    if (!inspected.binding) {
+      return {
+        outcome: 'rejected',
+        rejection_code: inspected.rejectionCode,
+      };
+    }
+
+    const token = createHmac('sha256', tokenSecret).update(JSON.stringify([
+      request.id,
+      daemonIdentity.daemon_instance_id,
+      daemonIdentity.pid,
+      inspected.binding.provider,
+      inspected.binding.scopeDigest,
+      inspected.binding.sessionKey,
+      inspected.binding.messageId,
+      inspected.binding.telegramMessageId,
+      issuedAt,
+    ])).digest('hex');
+    tokens.set(request.id, Object.freeze({
+      token,
+      binding: inspected.binding,
+      expiresAt: issuedAt + tokenTtlMs,
+    }));
+    return {
+      outcome: 'live',
+      bot: botName,
+      daemon_instance_id: daemonIdentity.daemon_instance_id,
+      pid: daemonIdentity.pid,
+      package_version: daemonIdentity.package_version,
+      provider: request.provider,
+      configured_scope_sha256: request.configured_scope_sha256,
+      target_token: token,
+    };
+  }
+
+  function authorizeRestart({ requestId, expectation } = {}) {
+    if (!validRequestId(requestId) || !isPlainObject(expectation)) {
+      return { accepted: false, rejectionCode: 'invalid-request' };
+    }
+    if (
+      expectation.daemonInstanceId !== daemonIdentity.daemon_instance_id
+      || expectation.pid !== daemonIdentity.pid
+    ) {
+      return { accepted: false, rejectionCode: 'daemon-identity-mismatch' };
+    }
+
+    const stored = tokens.get(requestId);
+    if (!stored || !safeTokenEqual(stored.token, expectation.targetToken)) {
+      return { accepted: false, rejectionCode: 'target-token-invalid' };
+    }
+    if (now() > stored.expiresAt) {
+      tokens.delete(requestId);
+      return { accepted: false, rejectionCode: 'target-token-expired' };
+    }
+    if (
+      expectation.provider !== stored.binding.provider
+      || expectation.configuredScopeSha256 !== stored.binding.scopeDigest
+    ) {
+      tokens.delete(requestId);
+      return { accepted: false, rejectionCode: 'target-binding-mismatch' };
+    }
+
+    const inspected = inspectLiveTarget({
+      provider: expectation.provider,
+      scopeDigest: expectation.configuredScopeSha256,
+    });
+    if (!inspected.binding) {
+      tokens.delete(requestId);
+      return { accepted: false, rejectionCode: inspected.rejectionCode };
+    }
+    if (!sameBinding(stored.binding, inspected.binding)) {
+      tokens.delete(requestId);
+      return { accepted: false, rejectionCode: 'source-mismatch' };
+    }
+
+    tokens.delete(requestId);
+    return {
+      accepted: true,
+      authorizationEvent: Object.freeze({
+        bot: botName,
+        daemon_instance_id: daemonIdentity.daemon_instance_id,
+        pid: daemonIdentity.pid,
+        package_version: daemonIdentity.package_version,
+        provider: stored.binding.provider,
+        configured_scope_sha256: stored.binding.scopeDigest,
+        session_key: stored.binding.sessionKey,
+        source_message_id: stored.binding.messageId,
+        restart_request_sha256: createHash('sha256')
+          .update(requestId)
+          .digest('hex'),
+      }),
+    };
+  }
+
+  return Object.freeze({
+    probe,
+    authorizeRestart,
+  });
+}
+
+module.exports = {
+  configuredScopeSha256,
+  createForegroundCanaryAuthorizer,
+  normalizeDeployForegroundExpectation,
+  resolveConfiguredScope,
+};

package/lib/questions/questions.js

@@ -16,6 +16,8 @@
 
 'use strict';
 
+const { sanitizeForDurableWrite } = require('../secret-detect');
+
 const MAX_LABEL = 40;       // Telegram button labels truncate ~64; keep well under
 const MAX_OTHER = 1000;     // cap on the user's free-text answer entering claude's context
 const MAX_PREVIEW = 500;
@@ -168,6 +170,51 @@ function applyFreeText(state, text) {
   return { state: next, kind: 'advanced', receipt: other, done: isDone(next) };
 }
 
+/**
+ * Whether a recorded answer carries a credential the durable boundary would
+ * mask. It lives beside the answer shape so a new field cannot be added
+ * without this seeing it. Every text-bearing part counts: the header copied
+ * from the agent's question, the selected option labels, and a typed value.
+ * The durable-write sanitizer decides, so its allowlist applies — "password:
+ * required" is ordinary vocabulary, not a secret.
+ */
+function answerIsFlagged(answer) {
+  const parts = [
+    ...(answer?.header != null ? [answer.header] : []),
+    ...(answer?.selected || []),
+    ...(answer?.other != null ? [answer.other] : []),
+  ];
+  return parts.some((part) => sanitizeForDurableWrite(String(part)).changed);
+}
+
+/**
+ * The durable stand-in for an answer whose text is being held live. It carries
+ * no answer text at all — a placeholder string would be indistinguishable from
+ * something the user actually chose, and could be delivered as one. The header
+ * is sanitized because it is copied from the agent's question.
+ */
+function markOmitted(answer) {
+  return {
+    header: sanitizeForDurableWrite(String(answer?.header ?? '')).text,
+    selected: [],
+    secret_omitted: true,
+  };
+}
+
+const isOmitted = (answer) => !!(answer && answer.secret_omitted);
+
+/**
+ * Resolve the answers for delivery. Returns a discriminated result rather than
+ * throwing or substituting: a marker means the exact answer was held live and
+ * the holder is gone, and the caller must cancel instead of sending anything
+ * upstream. No value or marker is ever put in an error.
+ */
+function resolveForDelivery(state) {
+  const answers = Array.isArray(state?.answers) ? state.answers : [];
+  if (answers.some(isOmitted)) return { ok: false, reason: 'live-answer-missing' };
+  return { ok: true, result: { answers } };
+}
+
 /** Final tool result once the set is done. */
 function assemble(state) {
   return { answers: state.answers };
@@ -182,6 +229,10 @@ module.exports = {
   applyTap,
   applyFreeText,
   assemble,
+  answerIsFlagged,
+  markOmitted,
+  isOmitted,
+  resolveForDelivery,
   MAX_LABEL,
   MAX_OTHER,
 };

package/lib/questions/store.js

@@ -10,6 +10,39 @@
 'use strict';
 
 const { newToken, tokensEqual } = require('../approvals/store');
+const { sanitizeDurableStructured, sanitizeDurableJsonText } = require('../secret-detect');
+
+// Two copies of the agent's questions, both durable:
+//
+//   questions_json — the audit copy of what the agent asked.
+//   state_json     — the state machine, which re-reads its own `questions`
+//                    copy on every tap to render the card and to match the
+//                    option the user picked.
+//
+// Both are sanitized. The exact array lives only in the handler's live
+// question context, for as long as the owning process does, and is hydrated
+// back for each live interaction. A typed answer carrying a credential is held
+// the same way: the row keeps a marker with no text, and a marked row that
+// outlives its process is cancelled rather than replayed. Terminal masking of
+// the whole retained state stays as the last line of defense for text no
+// detector flagged.
+
+// Both columns hold JSON, so they are sanitized as structure before
+// serialization — masking a serialized document can splice across its
+// delimiters, and an escaped quote hides a declared value from the detector.
+const maskDurableJson = (value) => JSON.stringify(sanitizeDurableStructured(value));
+const maskDurableJsonText = (json) => sanitizeDurableJsonText(json).text;
+
+// `state.questions` is a second copy of the array `questions_json` holds, and
+// the state machine reads it on every tap. Sanitizing only the column would
+// leave the provider's exact question in the row, so the state's copy is
+// sanitized on every write; the handler hydrates the exact array back for the
+// live interaction.
+const withSanitizedQuestions = (state) => {
+  const value = state && typeof state === 'object' ? state : {};
+  if (!Array.isArray(value.questions)) return value;
+  return { ...value, questions: sanitizeDurableStructured(value.questions) };
+};
 
 // A question waits for the user — the turn no longer times out while an `ask` is open
 // (cli-process defers its ceilings during a question wait, docs/progress-is-not-turn-end-spec.md),
@@ -42,8 +75,19 @@ function createQuestionStore(rawDb, now = () => Date.now()) {
     UPDATE pending_questions SET from_id = @from_id
      WHERE id = @id AND from_id IS NULL AND status = 'pending'`);
   const resolveStmt        = rawDb.prepare(`
-    UPDATE pending_questions SET status = @status, answered_ts = @answered_ts
+    UPDATE pending_questions SET status = @status, answered_ts = @answered_ts,
+           state_json = @state_json
      WHERE id = @id AND status = 'pending'`);
+  const resolveTxn = rawDb.transaction((id, status) => {
+    const current = getByIdStmt.get(id);
+    if (!current || current.status !== 'pending') return 0;
+    return resolveStmt.run({
+      id,
+      status,
+      answered_ts: now(),
+      state_json: maskDurableJsonText(current.state_json ?? '{}'),
+    }).changes;
+  });
   const listTimedOutStmt   = rawDb.prepare(`SELECT * FROM pending_questions WHERE status = 'pending' AND timeout_ts < ?`);
   const listOpenStmt       = rawDb.prepare(`SELECT * FROM pending_questions WHERE bot_name = ? AND status = 'pending'`);
 
@@ -61,8 +105,8 @@ function createQuestionStore(rawDb, now = () => Date.now()) {
         turn_id,
         tool_call_id,
         callback_token: newToken(),
-        questions_json: JSON.stringify(questions ?? []),
-        state_json: JSON.stringify(state ?? {}),
+        questions_json: maskDurableJson(questions ?? []),
+        state_json: JSON.stringify(withSanitizedQuestions(state)),
         created_ts,
         timeout_ts: created_ts + timeoutMs,
       });
@@ -75,7 +119,11 @@ function createQuestionStore(rawDb, now = () => Date.now()) {
     setMessageIds(id, ids) { return setMsgIdsStmt.run(JSON.stringify(ids ?? []), id).changes; },
 
     updateState(id, state, awaitingOther = false) {
-      return updateStateStmt.run({ id, state_json: JSON.stringify(state ?? {}), awaiting_other: awaitingOther ? 1 : 0 }).changes;
+      return updateStateStmt.run({
+        id,
+        state_json: JSON.stringify(withSanitizedQuestions(state)),
+        awaiting_other: awaitingOther ? 1 : 0,
+      }).changes;
     },
 
     /**
@@ -95,7 +143,15 @@ function createQuestionStore(rawDb, now = () => Date.now()) {
       if (!['answered', 'cancelled', 'timeout', 'expired'].includes(status)) {
         throw new Error(`bad status: ${status}`);
       }
-      return resolveStmt.run({ id, status, answered_ts: now() }).changes;
+      // Terminal transition: the answer has already been handed to the agent
+      // and no path replays a non-pending row, so the retained state can be
+      // masked. The row stays for audit; the credential does not.
+      //
+      // Read and write are one transaction. Read-then-write outside one would
+      // let a tap's updateState land in between and be overwritten by the
+      // state this call had already read — the answer state silently rolling
+      // back at the moment the row is sealed.
+      return resolveTxn(id, status);
     },
 
     sweepTimedOut() { return listTimedOutStmt.all(now()); },

package/lib/rewind/execute.js

@@ -26,7 +26,13 @@ function transcriptPathFor(cwd, sessionId) {
  * @param {object} deps { db, pm, tg, bot, botName, logEvent, logger, buildForkImpl }
  * @returns {(req) => Promise<{ok:boolean,error?:string,droppedCount?:number}>}
  */
-function createRewindExecutor({ db, pm, tg, bot, botName = 'bot', logEvent = () => {}, logger = console, buildForkImpl = buildFork } = {}) {
+function createRewindExecutor({
+  db, pm, tg, bot, botName = 'bot', logEvent = () => {}, logger = console,
+  buildForkImpl = buildFork,
+  // Narrow async hook: retire the question state of the session whose process
+  // is being replaced. A callback, so this module never learns the store.
+  retireQuestionSession = null,
+} = {}) {
   // P3: delete the bot's own outbound messages sent after M (it can always delete its own).
   async function deleteBotMessagesAfter({ chatId, threadId, afterMsgId }) {
     let rows;
@@ -74,8 +80,12 @@ function createRewindExecutor({ db, pm, tg, bot, botName = 'bot', logEvent = ()
     catch (e) {
       warning = 'the previous session may still be running — send a new message to confirm the rewind took';
       logger.error?.(`[${botName}] rewind kill: ${e.message}`);
-      logEvent('rewind-kill-failed', { session_key: req.sessionKey, error: e.message });
+      logEvent('rewind-kill-failed', { session_key: req.sessionKey, error_class: e.name || 'Error' });
     }
+    // The replaced process owned any open question. Retire its state whether or
+    // not the kill was clean: the rewound session cannot complete that ask, and
+    // an exact answer must not outlive the process it belonged to.
+    await retireQuestionSession?.(req.sessionKey);
 
     let droppedCount = 0;
     try { droppedCount = await deleteBotMessagesAfter({ chatId: req.chatId, threadId: req.threadId, afterMsgId: req.target.msg_id }); }

package/lib/rewind/rewind.js

@@ -103,7 +103,7 @@ function createRewindHandler({ pm, tg, bot, botName = 'bot', executeRewind, logE
       logEvent('rewind-done', { session_key: req.sessionKey, target_msg_id: req.target.msg_id });
     } else {
       await ack(req.chatId, req.threadId, `↩️ couldn't rewind — ${(result && result.error) || 'unknown error'}`);
-      logEvent('rewind-failed', { session_key: req.sessionKey, target_msg_id: req.target.msg_id, error: result && result.error });
+      logEvent('rewind-failed', { session_key: req.sessionKey, target_msg_id: req.target.msg_id, error_code: (result && result.error) ? 'rewind-failed' : null });
     }
   }
 

package/lib/sdk/build-options.js

@@ -89,8 +89,8 @@ function createBuildSdkOptions({
       } catch (err) {
         logger.error?.(`[${label}] agent-loader: ${err.message}`);
         logEvent('agent-load-failed', {
-          chat_id: chatId, agent: effectiveAgent, error: err.message,
-          topic: threadId || null,
+          chat_id: chatId, agent: effectiveAgent, error_class: err.name || 'Error',
+          thread_id: threadId || null,
         });
       }
     }