polygram 0.39.0 → 0.39.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.39.0",
+  "version": "0.39.1",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/config.example.json

@@ -9,6 +9,8 @@
       "_comment_adminChatId": "Required when allowConfigCommands is true for pairing commands (/pair-code, /pairings, /unpair) to work. These grant cross-chat trust and are gated to the admin chat only.",
       "adminChatId": "123456789",
       "needsToken": false,
+      "_comment_claudeCliAuthSource": "native (default) checks the host Claude login before CLI turns. Set external only when the configured session launcher supplies proxy credentials. SDK retains native checks; Codex is unaffected. Requires a verified pinned CLI and an absolute session launcher. Restart after changes; restore native when disabling proxy routing.",
+      "claudeCliAuthSource": "native",
       "_comment_stream": "Streaming is always on. `streamMinChars` sets the initial-send debounce (default 30) — short responses below that stay idle until the final result. `streamThrottleMs` sets the edit cadence (default 1000ms, min 250).",
       "streamMinChars": 30,
       "streamThrottleMs": 1000,

package/lib/ops/claude-auth-health.js

@@ -0,0 +1,52 @@
+'use strict';
+
+const path = require('node:path');
+const { resolveRuntimeDescriptor } = require('../runtime-config');
+
+function validateClaudeCliAuthSource(botConfig = {}) {
+  const source = botConfig.claudeCliAuthSource;
+  if (source !== undefined && source !== 'native' && source !== 'external') {
+    throw new TypeError('claudeCliAuthSource must be native or external');
+  }
+}
+
+function needsNativeClaudeAuth(botConfig, backend) {
+  validateClaudeCliAuthSource(botConfig);
+  if (backend === 'codex') return false;
+  if (backend === 'sdk') return true;
+  if (backend !== 'cli') throw new TypeError('Unknown Claude auth backend');
+  return botConfig?.claudeCliAuthSource !== 'external';
+}
+
+function hasNativeClaudeRuntime(config) {
+  validateClaudeCliAuthSource(config.bot);
+  for (const [chatId, chat] of Object.entries(config.chats || {})) {
+    for (const threadId of [null, ...Object.keys(chat.topics || {})]) {
+      const { backend } = resolveRuntimeDescriptor({
+        config, chatId, threadId, defaultPm: 'sdk',
+      });
+      if (needsNativeClaudeAuth(config.bot, backend)) return true;
+    }
+  }
+  return false;
+}
+
+function assertExternalClaudeCliReady(botConfig, { sessionLauncher, pinnedClaudeBin }) {
+  validateClaudeCliAuthSource(botConfig);
+  if (botConfig?.claudeCliAuthSource !== 'external') return;
+  if (typeof sessionLauncher !== 'string' || !path.isAbsolute(sessionLauncher)) {
+    throw new Error('External Claude CLI auth requires an absolute session launcher');
+  }
+  // Without a pinned binary the process factory falls back to SDK, which does
+  // not use the CLI launcher's external credentials.
+  if (!pinnedClaudeBin) {
+    throw new Error('External Claude CLI auth requires a verified pinned Claude binary');
+  }
+}
+
+module.exports = {
+  validateClaudeCliAuthSource,
+  needsNativeClaudeAuth,
+  hasNativeClaudeRuntime,
+  assertExternalClaudeCliReady,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.39.0",
+  "version": "0.39.1",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {

package/polygram.js

@@ -61,6 +61,12 @@ const { filterAttachments, resolveFileCaps, resolveMaxFileOverride, MAX_TOTAL_BY
 const { ProcessManager } = require('@shumkov/orchestra');
 const { createProcessFactory, pickBackend } = require('@shumkov/orchestra');
 const { checkClaudeAuthHealth } = require('@shumkov/orchestra').claudeBin;
+const {
+  validateClaudeCliAuthSource,
+  needsNativeClaudeAuth,
+  hasNativeClaudeRuntime,
+  assertExternalClaudeCliReady,
+} = require('./lib/ops/claude-auth-health');
 const { extractAssistantText } = require('@shumkov/orchestra');
 // 0.11.0: channels backend tool dispatcher — adapts CliProcess's reply
 // tool callback into polygram's existing chunkText + deliverReplies primitives.
@@ -1411,7 +1417,7 @@ async function handleMessage(sessionKey, chatId, msg, bot, dispatchContext = nul
     cmdUser, cmdUserId, label, sendReply,
   })) return;
 
-  // Claude-auth gate: if the CLI login has expired, every claude turn wedges
+  // Claude-auth gate: if the native CLI login has expired, its turns wedge
   // INVISIBLY — the 401 fires inside the subprocess, never reaches the
   // classifier, and the turn degrades to a silent "⏱ went quiet" across every
   // topic. Refuse up-front with a clear message + a loud log instead of
@@ -1424,7 +1430,9 @@ async function handleMessage(sessionKey, chatId, msg, bot, dispatchContext = nul
   // read, and a token can expire between an original dispatch and its later
   // redelivery, so skipping it there would silently re-wedge exactly the
   // messages most likely to hit an expired-auth window (post-restart backlog).
-  if (selectedInboundProvider === 'claude') {
+  // An externally authenticated CLI uses its launcher's credentials instead;
+  // the host login says nothing about that route. SDK retains its native check.
+  if (needsNativeClaudeAuth(config.bot, selectedBackend)) {
     let auth;
     try {
       auth = checkClaudeAuthHealth();
@@ -3634,6 +3642,7 @@ async function main() {
     // `= config.bots[BOT_NAME]` silently dropped top-level shared fields and
     // orphaned apiRoot (both bots ran on cloud, not the 2GB local server).
     config.bot = activeBotConfig(config, BOT_NAME);
+    validateClaudeCliAuthSource(config.bot);
   } catch (err) {
     console.error(`[fatal] ${err.message}`);
     process.exit(2);
@@ -3929,18 +3938,19 @@ async function main() {
 
   // Claude-auth health monitor — a FREE credentials-file check (no API call, no
   // model spawn). An expired refresh token makes the CLI 401 silently and wedges
-  // every channels turn; the handleMessage gate refuses turns + tells the user,
+  // native CLI turns; the handleMessage gate refuses turns + tells the user,
   // and this surfaces the same state loudly in the operator logs at boot + every
   // 30 min, warning a few days ahead so re-login happens before it breaks.
   const runAuthCheck = (trigger) => {
     try {
+      if (!hasNativeClaudeRuntime(config)) return;
       const auth = checkClaudeAuthHealth();
       const expIso = auth.refreshTokenExpiresAt ? new Date(auth.refreshTokenExpiresAt).toISOString() : 'n/a';
       if (auth.state === 'expired') {
-        console.error(`[auth] (${trigger}) Claude login EXPIRED (refresh token ${expIso}) — turns are being refused; re-login on the host.`);
+        console.error(`[auth] (${trigger}) Native Claude login EXPIRED (refresh token ${expIso}) — native-auth turns are being refused; re-login on the host.`);
         logEvent('auth-expired', { source: 'monitor', trigger, refresh_token_expires_at: auth.refreshTokenExpiresAt });
       } else if (auth.state === 'expiring') {
-        console.warn(`[auth] (${trigger}) Claude login expires in ${auth.daysLeft}d (${expIso}) — re-login soon.`);
+        console.warn(`[auth] (${trigger}) Native Claude login expires in ${auth.daysLeft}d (${expIso}) — re-login soon.`);
         logEvent('auth-expiring', { source: 'monitor', trigger, days_left: auth.daysLeft, refresh_token_expires_at: auth.refreshTokenExpiresAt });
       } else if (auth.state === 'unknown') {
         console.warn(`[auth] (${trigger}) Claude credentials check inconclusive: ${auth.reason}`);
@@ -4320,6 +4330,7 @@ async function main() {
     logger: console,
   });
   const channelsClaudeBin = pinnedClaudeBin;
+  assertExternalClaudeCliReady(config.bot, { sessionLauncher, pinnedClaudeBin });
 
   const orchestraProcessFactory = createProcessFactory({
     config,