polygram 0.38.1 → 0.38.3

package/polygram.js

@@ -31,13 +31,15 @@ const {
 const { buildPrompt, resolvePromptBackend } = require('./lib/prompt');
 const { countInFlight } = require('./lib/queue-utils');
 const { createIpcHandlers } = require('./lib/ipc/handlers');
-const {
-  requireRestartRequestId,
-} = require('./lib/ipc/restart-request-id');
 const {
   buildQualificationEvent,
-  normalizeDeployQualificationExpectation,
 } = require('./lib/ops/clean-restart-qualification');
+const {
+  createForegroundCanaryAuthorizer,
+} = require('./lib/ops/foreground-canary-target');
+const {
+  createDeployRestartHandler,
+} = require('./lib/ops/deploy-restart-handler');
 const { classifyOrphanSweep } = require('./lib/ops/tmux-preflight');
 const {
   parseSystemdInvocationId,
@@ -119,7 +121,7 @@ const { createRedeliver } = require('./lib/handlers/redeliver');
 const { classifyReplay, executeReplayPlan } = require('./lib/handlers/replay-disposition');
 const { createDropRedeliverer } = require('./lib/handlers/drop-redeliver');
 const { createSessionFeedback } = require('./lib/feedback/session-feedback');
-const { createSlashCommands } = require('./lib/handlers/slash-commands');
+const { createSlashCommands, normalizeCompactCommand } = require('./lib/handlers/slash-commands');
 const {
   buildCodexReconciliationView,
   createHandleCodexReconciliationCallback,
@@ -1075,6 +1077,8 @@ let attemptAutoResume = null;
 let errorReplyText = null;
 let queueWarnThreshold = null;
 let inFlightHandlers = null;
+let getActiveHandlerCount = null;
+let getActiveHandlerTargets = null;
 let awaitHandlerSettlement = null;
 let trackHandlerTask = null;
 let recoverCodexRequest = null;
@@ -1394,7 +1398,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
   // /pair-code /pairings /unpair /pair. Returns true when handled;
   // caller short-circuits.
   if (await dispatchSlashCommand({
-    text, sessionKey, chatId, threadIdStr, chatConfig,
+    text, msgId: msg.message_id, sessionKey, chatId, threadIdStr, chatConfig,
     cmdUser, cmdUserId, label, sendReply,
   })) return;
 
@@ -1507,7 +1511,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
       console.error(`[${label}] failed to notify user of skipped attachments: ${err.message}`);
       logEvent('attachment-skip-notice-failed', {
         chat_id: chatId, msg_id: msg.message_id,
-        error: err.message?.slice(0, 200),
+        error_class: err.name || 'Error',
         rejected_count: rejected.length,
       });
     }
@@ -1789,7 +1793,8 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
           // Network errors can embed the request URL, which carries the
           // bot token — redact before persisting, matching rich-edit.js
           // and api.js's handling of the same error class.
-          api_error: redactBotToken(err.message)?.slice(0, 200),
+          api_error_code: err.code || err.name || 'error',
+          error_len: err.message?.length ?? 0,
           bot: BOT_NAME,
         });
         throw err;
@@ -2449,7 +2454,9 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
       logEvent('wedged-session-detected', {
         chat_id: chatId, session_key: sessionKey,
         kind: wedge.kind,
-        text_preview: result.text.slice(0, 200),
+        // The wrapper's classification is the forensic signal; the wrapped
+        // payload is provider content and stays out of the row.
+        text_len: result.text.length,
       });
       // Promote the wrapped error to result.error so the existing
       // auto-recover + thrown-error machinery handles it uniformly.
@@ -2470,6 +2477,13 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
       // to type /new.
       const cls = classifyError(result.error);
       if (cls.autoRecover === 'reset_session') {
+        // The process that owns any open question is going away with the
+        // session. Retirement closes the row and drops what is held exactly
+        // for it — that part runs synchronously, so starting it here is enough
+        // to have happened before the reset. Only the card edit it leaves
+        // behind is awaited, and the reset must not wait on Telegram.
+        questionHandlers?.retireSession(sessionKey)
+          ?.catch((err) => console.error(`[${label}] question retire failed: ${err.message}`));
         pm.resetSession(sessionKey, { reason: cls.kind })
           .catch((err) => console.error(`[${label}] auto-reset failed: ${err.message}`));
         logEvent('auto-recover', {
@@ -2644,7 +2658,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
         reactor.setState('ERROR');
         logEvent('telegram-empty-response-fallback-failed', {
           chat_id: chatId, msg_id: msg.message_id, bot: BOT_NAME,
-          error: err.message?.slice(0, 200),
+          error_class: err.name || 'Error',
         });
         throw new Error(`empty-response fallback send failed: ${err.message}`);
       }
@@ -2733,7 +2747,8 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
         logEvent('canned-reply-suppressed', {
           chat_id: chatId,
           msg_id: msg.message_id,
-          original: sanitized.original,
+          // The suppressed reply is provider content; its size is the signal.
+          original_len: sanitized.original?.length ?? 0,
           backend: result?.backend || null,
         });
         parsed.text = sanitized.text;
@@ -3531,7 +3546,7 @@ function createBot(token) {
       bot: BOT_NAME,
       update_id: updateId,
       msg_id: msgId,
-      error: err.message?.slice(0, 300),
+      error_class: err.name || 'Error',
     });
   });
 
@@ -3871,7 +3886,7 @@ async function main() {
       }
     } catch (err) {
       console.error(`[secret-sweep] FAILED (${trigger}): ${err.message}`);
-      try { db.logEvent('secret-sweep-failed', { trigger, error: err.message }); } catch {}
+      try { db.logEvent('secret-sweep-failed', { trigger, error_class: err.name || 'Error' }); } catch {}
     }
   };
   if (secretSweepCfg.enabled) {
@@ -4042,6 +4057,20 @@ async function main() {
     answerQuestion: (sk, tc, result) => pm.answerQuestion(sk, tc, result),
     logger: console,
   });
+  // A question whose answer was held in memory cannot be completed by this
+  // process: the exact value went with the one that died. Cancel those rows
+  // here — before replay, redelivery, provider recovery, polling or any other
+  // path can act on them — so none is ever answered from a marker.
+  // A failure here is fatal on purpose. Rows this could not cancel would meet
+  // replay and inbound traffic with an answer no live process can complete, so
+  // startup stops instead of admitting messages behind an open fence.
+  try {
+    await questionHandlers.reconcileMarkedQuestionsAtBoot(questionStore.listOpen(BOT_NAME));
+  } catch (e) {
+    console.error(`[${BOT_NAME}] question boot reconciliation failed; refusing to admit traffic: ${e.message}`);
+    throw e;
+  }
+
   // Resolve expired questions with {timedout} so claude never hangs on an ignored ask.
   setInterval(() => {
     try {
@@ -4055,7 +4084,10 @@ async function main() {
   // the copy-only transcript-fork executor (P2/P3: fork → repoint the session → kill → delete
   // orphaned bot messages). channels/cli only; the fork mechanism was proven in P0.6.
   // See docs/0.13-rewind-design.md.
-  const executeRewind = createRewindExecutor({ db, pm, tg, bot, botName: BOT_NAME, logEvent, logger: console });
+  const executeRewind = createRewindExecutor({
+    db, pm, tg, bot, botName: BOT_NAME, logEvent, logger: console,
+    retireQuestionSession: (sessionKey) => questionHandlers?.retireSession(sessionKey),
+  });
   rewindHandler = createRewindHandler({
     pm, tg, bot, botName: BOT_NAME, logEvent, logger: console, executeRewind,
   });
@@ -4403,6 +4435,7 @@ async function main() {
   handleAbortIfRequested = createHandleAbort({
     pm, bot, tg, logEvent, isAbortRequest,
     markSessionAborted, clearAutosteeredReactions, getSessionKey,
+    retireQuestionSession: (sessionKey) => questionHandlers?.retireSession(sessionKey),
     botName: BOT_NAME, logger: console,
   });
   autosteer = createAutosteerHandlers({
@@ -4423,6 +4456,8 @@ async function main() {
     errorReplyText,
     queueWarnThreshold,
     inFlightHandlers,
+    getActiveHandlerCount,
+    getActiveHandlerTargets,
     awaitSettlement: awaitHandlerSettlement,
     trackTask: trackHandlerTask,
   } = createDispatcher({
@@ -4508,6 +4543,7 @@ async function main() {
     modelVersionsDesc: MODEL_VERSIONS_DESC, saveConfig,
     resolveRuntimeView: resolveSessionRuntimeView,
     botName: BOT_NAME, logEvent, logger: console,
+    retireQuestionSession: (sessionKey) => questionHandlers?.retireSession(sessionKey),
   });
   console.log('[polygram] using SDK ProcessManager');
 
@@ -4569,19 +4605,19 @@ async function main() {
     // provider; ordinary stops keep the existing answer-and-await behavior.
     try {
       const openQuestions = questionStore.listOpen?.(BOT_NAME) || [];
-      if (continuationAuthorized) {
-        for (const row of openQuestions) {
-          questionHandlers.beginShutdownDisposition(row, {
-            message: 'Bot is restarting — this question was cancelled. It may be re-asked in a moment.',
-          });
-        }
-      } else {
-        for (const row of openQuestions) {
-          // eslint-disable-next-line no-await-in-loop
-          await questionHandlers.expireQuestion(row, {
-            status: 'cancelled',
-            message: 'Bot is restarting — this question was cancelled. It may be re-asked in a moment.',
-          }).catch(() => {});
+      const shutdownNotice = 'Bot is restarting — this question was cancelled. It may be re-asked in a moment.';
+      // Each row is disposed on its own: one that throws must not take the
+      // rows after it, nor the drop of everything held in memory, with it.
+      for (const row of openQuestions) {
+        try {
+          if (continuationAuthorized) {
+            questionHandlers.beginShutdownDisposition(row, { message: shutdownNotice });
+          } else {
+            // eslint-disable-next-line no-await-in-loop
+            await questionHandlers.expireQuestion(row, { status: 'cancelled', message: shutdownNotice });
+          }
+        } catch (err) {
+          console.error(`[shutdown] question ${row.id} disposition failed: ${err.message}`);
         }
       }
       if (openQuestions.length) {
@@ -4589,6 +4625,11 @@ async function main() {
       }
     } catch (err) {
       console.error(`[shutdown] question expiry failed: ${err.message}`);
+    } finally {
+      // Nothing exact survives the process on purpose, whatever any single row
+      // did on the way out.
+      try { questionHandlers.discardAll(); }
+      catch (err) { console.error(`[shutdown] question context drop failed: ${err.message}`); }
     }
 
     // 1.6 Album siblings still buffered (arrived <flushMs before shutdown,
@@ -4681,6 +4722,7 @@ async function main() {
           awaitIngressSettlement,
           awaitHandlerSettlement,
           settlementTimeoutMs: SHUTDOWN_DRAIN_MS,
+          continuationAuthorized,
           qualificationExpectation,
         });
         if (qualificationExpectation !== undefined) {
@@ -4793,7 +4835,7 @@ async function main() {
           logEvent('shutdown-persistence-fallback', {
             bot: BOT_NAME,
             replay_marked: fallback.replayMarked,
-            error: err.message?.slice(0, 200),
+            error_class: err.name || 'Error',
           });
         } catch (fallbackErr) {
           console.error(
@@ -4849,6 +4891,27 @@ async function main() {
     // scripts, hook); also exported to spawned Claude processes via env.
     const ipcSecret = ipcServer.writeSecret(BOT_NAME);
     process.env.POLYGRAM_IPC_SECRET = ipcSecret;
+    const foregroundCanaryAuthorizer = createForegroundCanaryAuthorizer({
+      botName: BOT_NAME,
+      daemonIdentity,
+      config,
+      tokenSecret: ipcSecret,
+      getActiveHandlerCount: () => getActiveHandlerCount(),
+      getActiveHandlerTargets: () => getActiveHandlerTargets(),
+      getForegroundCanaryTarget: (input) => (
+        db.getForegroundCanaryTarget(input)
+      ),
+    });
+    const requestDeployRestart = createDeployRestartHandler({
+      getIsShuttingDown: () => isShuttingDown,
+      getPid: () => process.pid,
+      foregroundCanaryAuthorizer,
+      persistForegroundCanaryAuthorization: (detail) => (
+        db.logEvent('foreground-canary-target-authorized', detail)
+      ),
+      shutdown,
+      logger: console,
+    });
     ipcCloser = await ipcServer.start({
       path: ipcServer.socketPathFor(BOT_NAME),
       secret: ipcSecret,
@@ -4857,28 +4920,13 @@ async function main() {
         daemonIdentity,
         getInFlightHandlers: () => inFlightHandlers,
         handleSendOverIpc: (req) => handleSendOverIpc(req),
+        requestForegroundCanaryTarget: (req) => (
+          foregroundCanaryAuthorizer.probe(req)
+        ),
         inspectCleanRestartQualification: () => (
           pm.inspectCleanRestartQualification(undefined)
         ),
-        requestDeployRestart: (req) => {
-          if (isShuttingDown) {
-            const error = new Error('shutdown already in progress');
-            error.code = 'SHUTDOWN_IN_PROGRESS';
-            throw error;
-          }
-          const restartRequestId = requireRestartRequestId(req.id);
-          const qualificationExpectation = normalizeDeployQualificationExpectation(req);
-          const oldPid = process.pid;
-          shutdown({
-            continuationAuthorized: true,
-            trigger: 'deploy-ipc',
-            restartRequestId,
-            qualificationExpectation,
-          }).catch((error) => {
-            console.error(`[shutdown] deploy restart failed: ${error.message}`);
-          });
-          return { accepted: true, old_pid: oldPid };
-        },
+        requestDeployRestart,
       }),
       logger: console,
     });
@@ -5274,18 +5322,17 @@ async function main() {
     console.error(`[replay] boot replay failed: ${err.message}`);
   }
 
-  // rc.61 + rc.65: handle compact-command events that were never
-  // paired with a compact-boundary (deploy / crash interrupted them
-  // before the SDK processed). rc.65 changes behaviour from
-  // "post a 'please retry' message and ask the user" to
-  // "silently retry by re-pushing the same /compact text to a
-  // freshly-spawned (resumed) Query." Same pattern as boot-replay
-  // for inbound messages — recovery should be invisible.
+  // Handle compact-command events that were never paired with a
+  // compact-boundary (a deploy or crash interrupted them before the SDK
+  // processed them). Recovery re-pushes the same /compact line into a
+  // freshly-spawned (resumed) session, invisibly — the same pattern as
+  // boot-replay for inbound messages.
   //
   // Requirements for a silent retry:
-  //   1. The compact-command event was logged with full `text`
-  //      (rc.65+ does this; pre-rc.65 events have only text_len —
-  //      we fall back to the old "please retry" message for those).
+  //   1. The command line is recoverable — from the inbound message row the
+  //      event points at, or from an older event that still stored it — and
+  //      it normalizes to a real /compact command. Otherwise the user gets
+  //      the "please retry" message instead.
   //   2. The chat is still configured (config.chats[chat_id] exists).
   //   3. The session has a saved claude_session_id we can resume.
   //
@@ -5313,9 +5360,13 @@ async function main() {
       const threadId = o.thread_id ? Number(o.thread_id) : null;
       const savedSessionId = getClaudeSessionId(db, o.session_key);
 
-      // Silent retry path: only when we have BOTH the original text
-      // (rc.65+) AND a session_id to resume into.
-      if (o.text && savedSessionId) {
+      // Silent retry path: only when the stored line is provably a compact
+      // command AND there is a session_id to resume into. The line comes back
+      // from storage, so it is normalized and validated before it is fired at
+      // a live session — a mention-suffixed command is accepted in its
+      // normalized form, anything else is refused and surfaced instead.
+      const replayCommand = normalizeCompactCommand(o.text);
+      if (replayCommand && savedSessionId) {
         try {
           const entry = await pm.getOrSpawn(
             o.session_key,
@@ -5327,7 +5378,7 @@ async function main() {
           if (!entry || typeof entry.fireUserMessage !== 'function') {
             throw new Error('Process.fireUserMessage not available');
           }
-          const ok = entry.fireUserMessage(o.text);
+          const ok = entry.fireUserMessage(replayCommand);
           if (!ok) {
             throw new Error('fireUserMessage refused (closed or empty content)');
           }
@@ -5336,8 +5387,7 @@ async function main() {
             thread_id: o.thread_id,
             session_key: o.session_key,
             original_ts: o.ts,
-            text_len: o.text.length,
-            user: o.user,
+            text_len: replayCommand.length,
             user_id: o.user_id,
           });
           replayed += 1;
@@ -5348,9 +5398,9 @@ async function main() {
         }
       }
 
-      // Fallback: surface the legacy "please retry" message. Only
-      // happens for pre-rc.65 events (no `text` field) or when
-      // the silent-retry spawn failed.
+      // Fallback: surface the "please retry" message. Happens when the hint
+      // could not be recovered, when the stored line is not a compact
+      // command, or when the silent retry failed.
       try {
         await tg(bot, 'sendMessage', {
           chat_id: o.chat_id,
@@ -5362,9 +5412,8 @@ async function main() {
           thread_id: o.thread_id,
           session_key: o.session_key,
           original_ts: o.ts,
-          user: o.user,
           user_id: o.user_id,
-          reason: o.text ? 'spawn-failed' : 'pre-rc65-event-no-text',
+          reason: replayCommand ? 'spawn-failed' : (o.text ? 'not-a-compact-command' : 'no-recoverable-text'),
         });
         surfacedFallback += 1;
       } catch (err) {