polygram 0.38.4 → 0.38.5

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.38.4",
+  "version": "0.38.5",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/lib/codex/clean-replay-dispatch.js

@@ -0,0 +1,51 @@
+'use strict';
+
+function changedProcessError() {
+  const error = new Error(
+    'Clean Codex replay no longer owns the process that rearmed its input',
+  );
+  error.code = 'CODEX_CLEAN_REPLAY_PROCESS_CHANGED';
+  return error;
+}
+
+function authorizeCleanReplayDispatch({
+  sessionKey,
+  currentProcess,
+  expectedProcess,
+  reservation,
+  controller,
+} = {}) {
+  const generationId = reservation?.generationId;
+  const reservationId = reservation?.reservationId;
+  if (
+    typeof sessionKey !== 'string'
+    || sessionKey.length === 0
+    || currentProcess !== expectedProcess
+    || !currentProcess
+    || currentProcess.closed === true
+    || (currentProcess.runtime ?? currentProcess.backend) !== 'codex'
+    || !['Active', 'Idle', 'StartingTurn'].includes(currentProcess.state)
+    || typeof generationId !== 'string'
+    || generationId.length === 0
+    || currentProcess.generationId !== generationId
+    || typeof reservationId !== 'string'
+    || reservationId.length === 0
+    || typeof controller?.markDispatchDisposition !== 'function'
+  ) {
+    throw changedProcessError();
+  }
+
+  controller.markDispatchDisposition({
+    sessionKey,
+    generationId,
+    reservationId,
+    disposition: 'queue-authorized',
+  });
+  return Object.freeze({
+    reservationId,
+    generationId,
+    state: 'queue-authorized',
+  });
+}
+
+module.exports = { authorizeCleanReplayDispatch };

package/lib/codex/dispatch-reservation-id.js

@@ -0,0 +1,20 @@
+'use strict';
+
+const { createHash } = require('node:crypto');
+
+function codexDispatchReservationId({
+  botName,
+  telegramChatId,
+  telegramMessageId,
+}) {
+  const digest = createHash('sha256')
+    .update(JSON.stringify({
+      botName,
+      telegramChatId,
+      telegramMessageId,
+    }))
+    .digest('hex');
+  return `codex-dispatch:v1:${digest}`;
+}
+
+module.exports = { codexDispatchReservationId };

package/lib/codex/runtime-controller.js

@@ -18,6 +18,10 @@ const {
   resolveCodexRuntimeRequest,
   resolveRuntimeConfig,
 } = require('../runtime-config');
+const { CODEX_APP_SERVER_NAMESPACE } = require('../db/sessions');
+const {
+  codexDispatchReservationId,
+} = require('./dispatch-reservation-id');
 
 const DEFAULT_CATALOG_MAX_AGE_MS = 15 * 60 * 1_000;
 
@@ -734,7 +738,9 @@ function createCodexRuntimeController({
     return processReplacementReason(sessionKey, proc) !== null;
   }
 
-  function registerProcess(proc) {
+  function registerProcess(proc, {
+    expectedProviderGenerationId = null,
+  } = {}) {
     if (
       proc?.runtime !== 'codex'
       || typeof proc.generationId !== 'string'
@@ -742,6 +748,21 @@ function createCodexRuntimeController({
     ) {
       throw new TypeError('Codex runtime controller requires a Codex process');
     }
+    const strictResume = (
+      proc.spawnOptions?.resumePolicy === 'require-interrupted-turn'
+    );
+    if (
+      (strictResume && (
+        typeof expectedProviderGenerationId !== 'string'
+        || expectedProviderGenerationId.length === 0
+        || Buffer.byteLength(expectedProviderGenerationId) > 4096
+      ))
+      || (!strictResume && expectedProviderGenerationId !== null)
+    ) {
+      throw new TypeError(
+        'Codex provider lineage is valid only for an exact strict resume',
+      );
+    }
     const receipt = resolveReceipt(proc.sessionKey, {
       runtime: 'codex',
       spawnProfileId: proc.spawnProfileId,
@@ -765,6 +786,8 @@ function createCodexRuntimeController({
       retirementRequested: false,
       retirementWaiters: [],
       retired: false,
+      expectedProviderGenerationId,
+      strictResumeAttemptId: null,
       credentialStateFingerprint: receiptsBySession
         .get(proc.sessionKey)
         .credentialStateFingerprint,
@@ -852,18 +875,6 @@ function createCodexRuntimeController({
     };
   }
 
-  function dispatchReservationId({
-    botName,
-    telegramChatId,
-    telegramMessageId,
-  }) {
-    return `codex-dispatch:v1:${digest({
-      botName,
-      telegramChatId,
-      telegramMessageId,
-    })}`;
-  }
-
   function claimDispatchReservation({
     sessionKey,
     generationId,
@@ -881,7 +892,7 @@ function createCodexRuntimeController({
       telegramMessageId,
       'Telegram message ID',
     );
-    const reservationId = dispatchReservationId({
+    const reservationId = codexDispatchReservationId({
       botName: exactBotName,
       telegramChatId: exactChatId,
       telegramMessageId: exactMessageId,
@@ -982,7 +993,7 @@ function createCodexRuntimeController({
       reservationId,
       'dispatch reservation ID',
     );
-    if (exactReservationId !== dispatchReservationId({
+    if (exactReservationId !== codexDispatchReservationId({
       botName: exactBotName,
       telegramChatId: exactChatId,
       telegramMessageId: exactMessageId,
@@ -1172,7 +1183,10 @@ function createCodexRuntimeController({
   }
 
   function activateWithPreparedCheckpoint(record, payload) {
-    if (payload.kind !== 'request-prepared') {
+    if (
+      payload.kind !== 'request-prepared'
+      || !['thread/start', 'thread/resume'].includes(payload.method)
+    ) {
       throw controllerError(
         'Codex generation reached durability out of order.',
         'CODEX_GENERATION_NOT_DURABLE',
@@ -1205,6 +1219,100 @@ function createCodexRuntimeController({
     record.durable = true;
   }
 
+  function persistPreparedTurnIdentity(record, payload, state) {
+    const proc = record.proc;
+    const pending = proc.current;
+    const settings = pending?.admittedSettings;
+    const sourceMsgId = pending?.context?.sourceMsgId ?? null;
+    const starting = (
+      proc.state === 'StartingTurn'
+      && proc.settingsAdmissionClosed === false
+    );
+    const quiescing = (
+      proc.state === 'Quiescing'
+      && proc.settingsAdmissionClosed === true
+    );
+    const reject = () => {
+      throw controllerError(
+        'Codex turn preparation does not match the exact admitted turn.',
+        'CODEX_TURN_PREPARATION_REJECTED',
+        'Fence the generation before retrying the user turn.',
+      );
+    };
+    if (
+      currentProcessBySession.get(proc.sessionKey) !== record
+      || record.closed
+      || record.retired
+      || record.durabilityBlocked
+      || record.retirementVerificationFailed
+      || !record.durable
+      || proc.closed === true
+      || proc.runtime !== 'codex'
+      || proc.backend !== 'codex'
+      || proc.generationId !== payload.generationId
+      || proc.hostIdentity !== state.identity.stableHostId
+      || proc.bootSessionIdentity !== state.identity.bootSessionId
+      || (!starting && !quiescing)
+      || !pending
+      || proc.pendingQueue?.[0] !== pending
+      || pending.settled !== false
+      || pending.startDeliveryState !== 'preparing'
+      || pending.attemptId !== payload.attemptId
+      || typeof pending.clientUserMessageId !== 'string'
+      || pending.clientUserMessageId.length === 0
+      || (pending.clientUserMessageId ?? null)
+        !== (payload.clientUserMessageId ?? null)
+      || sourceMsgId !== (payload.source ?? null)
+      || pending.admittedSettings !== proc.admittingTurnSettings
+      || !Object.isFrozen(settings)
+      || typeof settings?.model !== 'string'
+      || settings.model.length === 0
+      || typeof settings?.effort !== 'string'
+      || settings.effort.length === 0
+      || typeof proc.providerSessionId !== 'string'
+      || proc.providerSessionId.length === 0
+      || proc.providerSessionId !== payload.threadId
+      || proc.spawnProfileId !== record.receipt.spawnProfileId
+      || proc.cwd !== record.receipt.expectedStaticProfile.cwd
+    ) {
+      reject();
+    }
+    const expectedProviderGenerationId = (
+      record.expectedProviderGenerationId !== null
+      && (
+        record.strictResumeAttemptId === null
+        || record.strictResumeAttemptId === payload.attemptId
+      )
+    )
+      ? record.expectedProviderGenerationId
+      : null;
+    const result = db.recordCodexTurnStartPrepared({
+      checkpoint: payload,
+      provider: {
+        session_key: proc.sessionKey,
+        namespace: CODEX_APP_SERVER_NAMESPACE,
+        provider: 'codex',
+        provider_session_id: proc.providerSessionId,
+        app_server_session_id: null,
+        agent: null,
+        cwd: proc.cwd,
+        model: settings.model,
+        effort: settings.effort,
+        pm_backend: 'codex',
+        spawn_profile_id: proc.spawnProfileId,
+        ts: payload.ts ?? Date.now(),
+      },
+      expectedProviderGenerationId,
+    });
+    if (
+      expectedProviderGenerationId !== null
+      && record.strictResumeAttemptId === null
+    ) {
+      record.strictResumeAttemptId = payload.attemptId;
+    }
+    return result;
+  }
+
   function maybeRetire(record) {
     if (
       record.retired
@@ -1488,7 +1596,7 @@ function createCodexRuntimeController({
     }
   }
 
-  async function checkpointSink(payload) {
+  function checkpointSinkImpl(payload) {
     const record = processesByGeneration.get(payload?.generationId);
     const state = requireAvailableInitialization();
     if (
@@ -1553,7 +1661,19 @@ function createCodexRuntimeController({
       return Object.freeze({ ...result });
     }
 
-    if (!record.durable) {
+    if (
+      payload.kind === 'request-prepared'
+      && payload.method === 'turn/start'
+    ) {
+      if (!record.durable) {
+        throw controllerError(
+          'Codex turn reached persistence before generation initialization.',
+          'CODEX_GENERATION_NOT_DURABLE',
+          'Quarantine the generation and inspect its initialization checkpoints.',
+        );
+      }
+      persistPreparedTurnIdentity(record, payload, state);
+    } else if (!record.durable) {
       activateWithPreparedCheckpoint(record, payload);
     } else {
       db.recordCodexCheckpoint(payload);
@@ -1567,6 +1687,20 @@ function createCodexRuntimeController({
     maybeRetire(record);
   }
 
+  async function checkpointSink(payload) {
+    try {
+      return checkpointSinkImpl(payload);
+    } catch (error) {
+      if (
+        payload?.kind === 'request-prepared'
+        && payload?.method === 'turn/start'
+      ) {
+        error.checkpointDisposition = 'not-committed';
+      }
+      throw error;
+    }
+  }
+
   return Object.freeze({
     initialize,
     prepareSession,

package/lib/codex/spawn-context.js

@@ -64,6 +64,7 @@ async function buildCodexSpawnContext({
       existingSessionId,
       resumePolicy: 'require-interrupted-turn',
       expectedInterruptedTurnId: strictResume.expectedInterruptedTurnId,
+      expectedProviderGenerationId: strictResume.expectedGenerationId,
       noWaitForCapacity: true,
     };
   }

package/lib/db/auto-resume.js

@@ -80,15 +80,172 @@ function createAutoResumeTracker({ cooldownMs = DEFAULT_COOLDOWN_MS, now = Date.
  * Classify the durable provider ledger for one Codex Telegram input.
  *
  * A request is safe to submit automatically only when the ledger proves that
- * no provider write occurred. Explicit cancellation is also definitely
- * not-sent, but remains cancelled rather than becoming new work. Every other
- * state fails closed because re-submission could duplicate text or tool
- * effects.
+ * no provider write occurred. A deploy-owned pre-write cancellation is safe
+ * only with exact clean-restart provenance; other cancellations remain
+ * cancelled. Every ambiguous state fails closed because re-submission could
+ * duplicate text or tool effects.
  *
  * Linked steering inputs are never independent work. Their state follows the
  * target turn, which is returned only for diagnostics and reconciliation.
  */
 function classifyCodexRecoveryEvidence(evidence = {}) {
+  const structured = (
+    evidence?.kind != null
+    || evidence?.selection != null
+    || evidence?.reservation != null
+    || evidence?.attempt != null
+    || evidence?.linkedInput != null
+    || evidence?.targetAttempt != null
+    || evidence?.cancellationProof != null
+  );
+  if (structured) {
+    const selection = evidence?.selection;
+    const reservation = evidence?.reservation;
+    const attempt = evidence?.attempt;
+    const linkedInput = evidence?.linkedInput;
+    const targetAttempt = evidence?.targetAttempt;
+    const cancellationProof = evidence?.cancellationProof;
+    const exactSelection = (
+      evidence?.provider === 'codex'
+      && selection?.provider === 'codex'
+      && typeof selection.sessionKey === 'string'
+      && selection.sessionKey.length > 0
+      && Number.isSafeInteger(selection.selectedTs)
+      && selection.selectedTs >= 0
+    );
+    const exactReservation = (
+      typeof reservation?.reservationId === 'string'
+      && reservation.reservationId.length > 0
+      && typeof reservation?.generationId === 'string'
+      && reservation.generationId.length > 0
+      && ['reserved', 'queue-authorized'].includes(reservation.state)
+      && reservation.steerAttemptId == null
+      && reservation.targetAttemptId == null
+      && reservation.settledTs == null
+    );
+    const exactAttempt = (
+      typeof attempt?.attemptId === 'string'
+      && attempt.attemptId.length > 0
+      && typeof attempt?.generationId === 'string'
+      && attempt.generationId.length > 0
+      && attempt.deliveryState === 'prepared'
+      && attempt.turnId == null
+      && attempt.terminalStatus == null
+    );
+    const noLinkedEvidence = linkedInput == null && targetAttempt == null;
+    const matchingGeneration = (
+      reservation == null
+      || attempt == null
+      || reservation.generationId === attempt.generationId
+    );
+    const exactOptionalQueueReservation = (
+      reservation == null
+      || (exactReservation && reservation.state === 'queue-authorized')
+    );
+
+    if (!exactSelection) {
+      return {
+        action: 'defer',
+        reason: 'provider-acceptance-not-disproven',
+      };
+    }
+    if (!noLinkedEvidence) {
+      return {
+        action: 'defer',
+        reason: 'linked-input',
+      };
+    }
+    if (
+      evidence.kind === 'selection-only'
+      && reservation == null
+      && attempt == null
+      && cancellationProof == null
+    ) {
+      return {
+        action: 'recover',
+        reason: 'selection-proven-not-dispatched',
+        cleanRestartSafe: true,
+      };
+    }
+    if (
+      evidence.kind === 'dispatch-reservation'
+      && exactReservation
+      && attempt == null
+      && cancellationProof == null
+    ) {
+      return {
+        action: 'recover',
+        reason: 'reservation-proven-not-dispatched',
+        cleanRestartSafe: true,
+      };
+    }
+
+    const exactPrimary = (
+      exactAttempt
+      && attempt.method === 'turn/start'
+      && matchingGeneration
+      && exactOptionalQueueReservation
+      && (
+        (reservation == null && evidence.kind === 'primary-turn')
+        || (
+          reservation != null
+          && evidence.kind === 'dispatch-reservation'
+        )
+      )
+    );
+    if (
+      exactPrimary
+      && attempt.recoveryState === 'prepared'
+      && cancellationProof == null
+    ) {
+      return {
+        action: 'recover',
+        reason: 'request-proven-not-accepted',
+        cleanRestartSafe: true,
+      };
+    }
+    if (exactPrimary && attempt.recoveryState === 'cancelled') {
+      if (
+        cancellationProof?.kind === 'active-start-cancelled'
+        && cancellationProof?.reason === 'clean-restart'
+        && Object.keys(cancellationProof).length === 2
+      ) {
+        return {
+          action: 'recover',
+          reason: 'clean-restart-request-cancelled-before-acceptance',
+          cleanRestartSafe: true,
+        };
+      }
+      return {
+        action: 'skip',
+        reason: 'request-cancelled-before-acceptance',
+      };
+    }
+
+    const exactQueuedCancellation = (
+      evidence.kind === 'queued-send'
+      && exactAttempt
+      && attempt.method === 'queued/send'
+      && attempt.recoveryState === 'cancelled'
+      && matchingGeneration
+      && exactOptionalQueueReservation
+      && cancellationProof?.kind === 'queued-send-cancelled'
+      && cancellationProof?.reason === 'clean-restart'
+      && Object.keys(cancellationProof).length === 2
+    );
+    if (exactQueuedCancellation) {
+      return {
+        action: 'recover',
+        reason: 'clean-restart-queued-send-cancelled',
+        cleanRestartSafe: true,
+      };
+    }
+    return {
+      action: 'defer',
+      reason: 'provider-acceptance-not-disproven',
+    };
+  }
+
   const deliveryState = evidence?.delivery_state ?? evidence?.deliveryState;
   const recoveryState = evidence?.recovery_state ?? evidence?.recoveryState;
   const linkedState = (

package/lib/db/event-detail-schema.js

@@ -278,6 +278,14 @@ const FIELDS = {
   replies: 'int',
   reply_count: 'int',
   receipt_count: 'int',
+  recovered_count: 'int',
+  skipped_count: 'int',
+  codex_scheduled_count: 'int',
+  admitted_count: 'int',
+  terminal_count: 'int',
+  noticed_count: 'int',
+  notice_failed_count: 'int',
+  deferred_count: 'int',
   interim_count: 'int',
   block_count: 'int',
   media_count: 'int',