polygram 0.38.4 → 0.38.5

package/lib/handlers/dispatcher.js

@@ -42,7 +42,8 @@ function createDispatcher({
   botName,
   logEvent,
   // Closures that polygram.js owns; passed in:
-  handleMessage,                  // async (sessionKey, chatId, msg, bot)
+  handleMessage,                  // async (sessionKey, chatId, msg, bot, dispatchContext)
+  awaitSessionRecovery = () => Promise.resolve(),
   sendToProcess,                  // async (sessionKey, prompt, ctx)
   recoverCodex,                   // async ({ sessionKey, chatId, msg, bot, providerRecovery })
   // Cross-cutting helpers:
@@ -265,7 +266,13 @@ function createDispatcher({
     return resultText;
   }
 
-  function dispatchHandleMessage(sessionKey, chatId, msg, bot) {
+  function dispatchHandleMessage(
+    sessionKey,
+    chatId,
+    msg,
+    bot,
+    dispatchContext = null,
+  ) {
     const activeHandlerTarget = Object.freeze({
       sessionKey: String(sessionKey),
       chatId: String(chatId),
@@ -284,7 +291,19 @@ function createDispatcher({
         in_flight: count, threshold: warnAt,
       });
     }
-    const task = handleMessage(sessionKey, chatId, msg, bot).catch(async (err) => {
+    const task = Promise.resolve()
+      .then(() => awaitSessionRecovery(
+        sessionKey,
+        dispatchContext?.recoveryReceipt ?? null,
+      ))
+      .then(() => handleMessage(
+        sessionKey,
+        chatId,
+        msg,
+        bot,
+        dispatchContext,
+      ))
+      .catch(async (err) => {
       const wasAborted = abortGrace.isRecent(sessionKey);
       const isReplay = msg._isReplay === true;
       let oomShutdown = false;
@@ -292,6 +311,10 @@ function createDispatcher({
         oomShutdown = getOomObservation()?.detected === true;
       } catch {}
       const isShuttingDown = getIsShuttingDown() || oomShutdown;
+      const cleanReplayProcessDrift = (
+        dispatchContext?.cleanReplay != null
+        && err.code === 'CODEX_CLEAN_REPLAY_PROCESS_CHANGED'
+      );
       let processLossResetFailed = false;
       logger.error?.(`[${sessionKey}] Error: ${err.message}`);
       // Mark the row terminal so the right thing happens on next
@@ -306,12 +329,14 @@ function createDispatcher({
         : isShuttingDown
           ? (isReplay ? 'replay-attempted' : 'replay-pending')
           : 'failed';
-      dbWrite(() => (
-        db.setInboundHandlerStatusUnlessCodexTerminal
-        ?? db.setInboundHandlerStatus
-      ).call(db, {
-        chat_id: chatId, msg_id: msg.message_id, status,
-      }), `set handler_status=${status}`);
+      if (!cleanReplayProcessDrift) {
+        dbWrite(() => (
+          db.setInboundHandlerStatusUnlessCodexTerminal
+          ?? db.setInboundHandlerStatus
+        ).call(db, {
+          chat_id: chatId, msg_id: msg.message_id, status,
+        }), `set handler_status=${status}`);
+      }
       logEvent('handler-error', {
         chat_id: chatId, session_key: sessionKey,
         msg_id: msg?.message_id,
@@ -417,7 +442,13 @@ function createDispatcher({
       // through into this hardcoded reply — contradicting the "chat is
       // never told, only the operator is" contract classify.js establishes
       // via userMessage: null (found in code review).
-      if (isReplay && !wasAborted && !isShuttingDown && err.code !== 'AUTH_DISABLED') {
+      if (
+        isReplay
+        && !wasAborted
+        && !isShuttingDown
+        && err.code !== 'AUTH_DISABLED'
+        && !cleanReplayProcessDrift
+      ) {
         tg(bot, 'sendMessage', {
           chat_id: chatId,
           text: '⚠️ This turn was interrupted and didn\'t complete on retry — please rephrase or simplify, or split into smaller steps.',
@@ -573,7 +604,7 @@ function createDispatcher({
           });
         }
       }
-    }).finally(() => {
+      }).finally(() => {
       activeHandlerTargets.delete(activeHandlerTarget);
       const n = (inFlightHandlers.get(sessionKey) || 1) - 1;
       if (n <= 0) inFlightHandlers.delete(sessionKey);

package/lib/handlers/redeliver.js

@@ -63,10 +63,20 @@ function createRedeliver({
    * @param {string|null} [opts.preMark]  — handler_status to pre-mark (one-shot guard), e.g. 'replay-attempted'
    * @param {boolean} [opts.gate=true]    — run the D5 gate at tier 'redelivery'
    * @param {boolean} [opts.ack=true]     — 👀 on the redelivered message
+   * @param {Function|null} [opts.prepareDispatch] — post-gate durable setup
+   *   returning private context for the normal dispatcher
+   * @param {Function|null} [opts.onGateBlocked] — terminalize a blocked replay
    * @returns {Promise<{ok:boolean, reason?:string}>}
    */
   return async function redeliverAsFreshTurn({
-    chatId, msg, source, preMark = null, gate = true, ack = true,
+    chatId,
+    msg,
+    source,
+    preMark = null,
+    gate = true,
+    ack = true,
+    prepareDispatch = null,
+    onGateBlocked = null,
   } = {}) {
     if (!msg || !msg.chat || msg.message_id == null) return { ok: false, reason: 'malformed message' };
     const chatConfig = config.chats[String(chatId)];
@@ -101,21 +111,42 @@ function createRedeliver({
         logEvent('input-dropped-no-redeliver', {
           chat_id: chatId, msg_id: msg.message_id, source, stage: res.stage ?? null,
         });
-        return { ok: false, reason: res.stage || res.action };
+        if (typeof onGateBlocked === 'function') {
+          await onGateBlocked({
+            chatId,
+            msg,
+            source,
+            stage: res.stage ?? null,
+            action: res.action,
+          });
+        }
+        return {
+          ok: false,
+          reason: res.stage || res.action,
+          ...(typeof onGateBlocked === 'function' ? { terminal: true } : {}),
+        };
       }
     }
 
+    const threadId = msg.message_thread_id?.toString();
+    const sessionKey = getSessionKey(String(chatId), threadId, chatConfig);
+    const dispatchContext = typeof prepareDispatch === 'function'
+      ? await prepareDispatch({ chatId, msg, source, sessionKey })
+      : null;
     if (ack) {
       try { react?.(chatId, msg.message_id); } catch { /* best-effort — never blocks */ }
     }
-
-    const threadId = msg.message_thread_id?.toString();
-    const sessionKey = getSessionKey(String(chatId), threadId, chatConfig);
     logEvent('redelivered-as-fresh-turn', {
       chat_id: chatId, msg_id: msg.message_id, source, session_key: sessionKey,
     });
-    dispatchHandleMessage(sessionKey, String(chatId), msg, bot);
-    return { ok: true };
+    const task = dispatchHandleMessage(
+      sessionKey,
+      String(chatId),
+      msg,
+      bot,
+      dispatchContext,
+    );
+    return { ok: true, task };
   };
 }
 

package/lib/handlers/replay-disposition.js

@@ -53,14 +53,10 @@ function providerReplayDisposition(candidate, getProviderRecovery) {
  *   - CRASH (cleanShutdown=false): recover every still-unanswered candidate —
  *     the existing rc.57 behavior. An unexpected exit must never silently drop
  *     interrupted work.
- *   - CLEAN (cleanShutdown=true): a deliberate restart. Prod data (n=3430)
- *     showed skip-vs-recover CANNOT be auto-classified (53% of turns run >=30s
- *     so ordinary interactive turns are replay-pending just like a long task,
- *     and the rc.57 Xero case is itself a user message). So we decide by RESTART
- *     INTENT, not message state: skip ALL pending candidates (don't re-answer
- *     stale messages) and surface ONE visibility notice per chat/topic so a
- *     genuinely-needed reply can be re-sent. rc.57's harm was *silent* loss;
- *     this makes the skip *visible*.
+ *   - CLEAN (cleanShutdown=true): a deliberate restart. Exact Codex evidence
+ *     that proves a request never crossed the provider boundary stays eligible
+ *     for its dedicated recoverer. Other pending candidates are skipped, with
+ *     one visibility notice per chat/topic for announceable legacy work.
  *
  * Dedup: a candidate already answered (hasCompletedTurn -> true) is dropped from
  * the plan entirely — never recovered, never announced. The caller wires this to
@@ -89,6 +85,7 @@ function classifyReplay({
   const pending = (candidates || []).filter((c) => !answered(c));
   const legacy = [];
   const recoverCodex = [];
+  const restartSkippedCodex = [];
   const cancelled = [];
   const defer = [];
 
@@ -100,7 +97,11 @@ function classifyReplay({
     if (disposition.action === 'legacy') {
       legacy.push(candidate);
     } else if (disposition.action === 'recover') {
-      recoverCodex.push(candidate);
+      if (!cleanShutdown || disposition.cleanRestartSafe === true) {
+        recoverCodex.push(candidate);
+      } else {
+        restartSkippedCodex.push(candidate);
+      }
     } else if (disposition.action === 'skip') {
       cancelled.push(candidate);
     } else {
@@ -121,15 +122,16 @@ function classifyReplay({
     return plan;
   }
 
-  // Deliberate restart: skip ALL pending (none re-answered), and group the
-  // ANNOUNCEABLE ones per (chat, thread) for one visibility notice each
+  // Deliberate restart: preserve exact clean-safe Codex recovery, skip the
+  // remaining pending work, and group the ANNOUNCEABLE skipped rows per
+  // (chat, thread) for one visibility notice each
   // (isolateTopics-safe). announceable excludes admin/slash + abort-shaped rows
   // (H5) — those are skipped silently, mirroring the crash path's redelivery
   // gate which never re-executes them. Default: everything announceable.
   const isAnnounceable = typeof announceable === 'function' ? announceable : () => true;
   const SEP = String.fromCharCode(0); // NUL separator (H8, collision-proof)
   const groups = new Map();
-  const restartSkipped = [...legacy, ...recoverCodex];
+  const restartSkipped = [...legacy, ...restartSkippedCodex];
   for (const c of restartSkipped) {
     if (!isAnnounceable(c)) continue;
     const thread = c.thread_id == null ? null : c.thread_id;
@@ -143,6 +145,7 @@ function classifyReplay({
     skip: [...restartSkipped, ...cancelled],
     notices: Array.from(groups.values()),
   };
+  if (recoverCodex.length > 0) plan.recoverCodex = recoverCodex;
   if (defer.length > 0) plan.defer = defer;
   return plan;
 }
@@ -165,7 +168,7 @@ function classifyReplay({
  * @param {object} opts.deps
  * @param {(candidate)=>Promise<{ok:boolean}>} opts.deps.recover  crash-path re-dispatch
  * @param {(candidate)=>Promise<{ok:boolean}>} [opts.deps.recoverCodex]
- *   exact-runtime Codex crash-path re-dispatch
+ *   exact-runtime Codex re-dispatch
  * @param {(group)=>Promise<{ok:boolean, messageId?:any, error?:string}>} opts.deps.sendNotice
  * @param {(candidate)=>void} opts.deps.markSkipped  mark row terminal 'replay-skipped'
  * @param {(kind, detail)=>void} [opts.deps.logEvent]

package/lib/ops/clean-codex-boot-replay.js

@@ -0,0 +1,56 @@
+'use strict';
+
+function scheduleCleanCodexReplaySessions({
+  candidates = [],
+  getSessionKey,
+  getContinuationTasks,
+  coordinator,
+  recover,
+  trackTask,
+  onOutcome = () => {},
+} = {}) {
+  if (
+    !Array.isArray(candidates)
+    || typeof getSessionKey !== 'function'
+    || typeof getContinuationTasks !== 'function'
+    || typeof coordinator?.schedule !== 'function'
+    || typeof recover !== 'function'
+    || typeof trackTask !== 'function'
+    || typeof onOutcome !== 'function'
+  ) {
+    throw new TypeError('clean Codex boot replay dependencies are invalid');
+  }
+
+  const candidatesBySession = new Map();
+  for (const candidate of candidates) {
+    const sessionKey = getSessionKey(candidate);
+    if (typeof sessionKey !== 'string' || sessionKey.length === 0) {
+      throw new TypeError('clean Codex boot replay candidate has no session');
+    }
+    const sessionCandidates = candidatesBySession.get(sessionKey) || [];
+    sessionCandidates.push(candidate);
+    candidatesBySession.set(sessionKey, sessionCandidates);
+  }
+
+  let scheduled = 0;
+  for (const [sessionKey, followers] of candidatesBySession) {
+    const task = coordinator.schedule({
+      sessionKey,
+      continuationTasks: getContinuationTasks(sessionKey),
+      followers,
+      recover,
+    }).then((outcome) => {
+      onOutcome({ sessionKey, outcome });
+      return outcome;
+    });
+    scheduled += followers.length;
+    trackTask(task);
+  }
+
+  return {
+    scheduled,
+    sessions: candidatesBySession.size,
+  };
+}
+
+module.exports = { scheduleCleanCodexReplaySessions };

package/lib/ops/clean-replay-session-coordinator.js

@@ -0,0 +1,106 @@
+'use strict';
+
+function createCleanReplaySessionCoordinator() {
+  const sessions = new Map();
+
+  function wait(sessionKey, receipt = null) {
+    const state = sessions.get(sessionKey);
+    if (!state || (receipt !== null && receipt === state.receipt)) {
+      return Promise.resolve();
+    }
+    return state.barrier;
+  }
+
+  function schedule({
+    sessionKey,
+    continuationTasks = [],
+    followers = [],
+    recover,
+  } = {}) {
+    if (
+      typeof sessionKey !== 'string'
+      || sessionKey.length === 0
+      || !Array.isArray(continuationTasks)
+      || !Array.isArray(followers)
+      || typeof recover !== 'function'
+      || sessions.has(sessionKey)
+    ) {
+      throw new TypeError('clean replay session schedule is invalid');
+    }
+
+    let release;
+    const state = {
+      receipt: null,
+      barrier: new Promise((resolve) => { release = resolve; }),
+    };
+    sessions.set(sessionKey, state);
+
+    const task = Promise.resolve().then(async () => {
+      let admitted = 0;
+      let terminal = 0;
+      try {
+        const continuationResults = await Promise.allSettled(continuationTasks);
+        if (continuationResults.some((result) => (
+          result.status !== 'fulfilled'
+          || result.value?.status !== 'replied'
+        ))) {
+          return {
+            status: 'deferred',
+            admitted,
+            terminal,
+            deferred: followers.length,
+            reason: 'continuation-not-replied',
+          };
+        }
+
+        for (let index = 0; index < followers.length; index += 1) {
+          const receipt = Object.freeze({});
+          state.receipt = receipt;
+          let result;
+          try {
+            // eslint-disable-next-line no-await-in-loop
+            result = await recover(followers[index], { receipt });
+          } catch (error) {
+            result = {
+              status: 'failed',
+              reason: error?.code || 'recovery-failed',
+            };
+          } finally {
+            state.receipt = null;
+          }
+          if (result?.status === 'dispatched') {
+            admitted += 1;
+            continue;
+          }
+          if (result?.status === 'gate-terminal') {
+            terminal += 1;
+            continue;
+          }
+          return {
+            status: 'deferred',
+            admitted,
+            terminal,
+            deferred: followers.length - index,
+            reason: result?.reason || 'recovery-not-dispatched',
+          };
+        }
+        return {
+          status: 'complete',
+          admitted,
+          terminal,
+          deferred: 0,
+          reason: null,
+        };
+      } finally {
+        if (sessions.get(sessionKey) === state) sessions.delete(sessionKey);
+        release();
+      }
+    });
+
+    return task;
+  }
+
+  return Object.freeze({ wait, schedule });
+}
+
+module.exports = { createCleanReplaySessionCoordinator };

package/lib/ops/clean-resume.js

@@ -434,6 +434,10 @@ async function startCleanRestartRecovery({
           ready = true;
           rejectReady(error);
         }
+        return {
+          status: 'failed',
+          reason: error?.code || 'unexpected-recovery-error',
+        };
       })
       .finally(releaseReady);
     trackTask(task);

package/lib/sdk/callbacks.js

@@ -97,19 +97,9 @@ function createSdkCallbacks({
       const chatConfig = config.chats[entry.chatId] || {};
       const topicConfig = getTopicConfig(chatConfig, entry.threadId || null);
       if (isCodexProcess(entry)) {
-        dbWrite(() => db.upsertProviderSession({
-          session_key: sessionKey,
-          namespace: 'codex:app-server',
-          provider: 'codex',
-          provider_session_id: event.providerSessionId ?? event.session_id,
-          app_server_session_id: event.appServerSessionId ?? null,
-          agent: null,
-          cwd: entry.cwd,
-          model: entry.model,
-          effort: entry.effort,
-          pm_backend: 'codex',
-          spawn_profile_id: entry.spawnProfileId,
-        }), `upsert Codex session ${sessionKey}`);
+        // Codex init does not carry the settings admitted for a turn. The
+        // request-prepared checkpoint persists that exact provider identity
+        // atomically with the turn attempt before any app-server write.
         return;
       }
 

package/migrations/021-codex-replay-evidence-indexes.sql

@@ -0,0 +1,19 @@
+-- Boot replay only needs to distinguish zero, one, or conflicting evidence
+-- for a Telegram input. These indexes keep those bounded probes independent
+-- of the accumulated Codex attempt and linked-input history.
+CREATE INDEX idx_codex_attempts_replay_source
+  ON codex_turn_attempts(
+    session_key,
+    telegram_source_message_id,
+    created_ts,
+    attempt_id
+  );
+
+CREATE INDEX idx_codex_linked_inputs_replay_source
+  ON codex_linked_inputs(
+    telegram_chat_id,
+    telegram_message_id,
+    generation_id,
+    created_ts,
+    linked_input_id
+  );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.38.4",
+  "version": "0.38.5",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {
@@ -63,7 +63,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.123",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@shumkov/orchestra": "0.10.17",
+    "@shumkov/orchestra": "0.10.18",
     "better-sqlite3": "^12.9.0",
     "grammy": "^1.42.0",
     "markdown-it": "^14.1.1",