polygram 0.6.3 → 0.6.5

package/migrations/007-attachments-table.sql

@@ -64,6 +64,19 @@ CREATE INDEX IF NOT EXISTS idx_attachments_unique_id
 -- mime_type, size, file_id, file_unique_id, and optionally transcription.
 -- Pre-0.5.x rows may not have file_unique_id. We pull what's there and
 -- leave the rest NULL.
+--
+-- Robustness: json_each() raises on malformed JSON or on a non-array
+-- root, which would roll back the entire migration transaction (one bad
+-- row blocks the upgrade). The `json_valid(...) AND json_type(...) =
+-- 'array'` guards skip those rows so the rest still backfill. Rows
+-- without a `file_id` are also skipped — the schema declares file_id
+-- NOT NULL and we'd rather drop a corrupt entry than materialise a
+-- permanently un-redownloadable row with file_id=''.
+-- Pre-filter messages in a subquery so json_each() only runs on valid
+-- JSON arrays. SQLite's json_each raises on malformed JSON or on a
+-- non-array root, and that error rolls back the whole migration. The
+-- subquery materialises only rows that pass json_valid + json_type
+-- before the join expands them.
 INSERT INTO attachments (
   message_id, chat_id, msg_id, thread_id, bot_name,
   file_id, file_unique_id, kind, name, mime_type, size_bytes,
@@ -71,7 +84,7 @@ INSERT INTO attachments (
 )
 SELECT
   m.id, m.chat_id, m.msg_id, m.thread_id, m.bot_name,
-  COALESCE(json_extract(att.value, '$.file_id'), ''),
+  json_extract(att.value, '$.file_id'),
   json_extract(att.value, '$.file_unique_id'),
   COALESCE(json_extract(att.value, '$.kind'), 'document'),
   json_extract(att.value, '$.name'),
@@ -81,9 +94,14 @@ SELECT
   'downloaded',
   json_extract(att.value, '$.transcription.text'),
   m.ts
-FROM messages m, json_each(m.attachments_json) att
-WHERE m.attachments_json IS NOT NULL
-  AND m.direction = 'in'
-  AND NOT EXISTS (
-    SELECT 1 FROM attachments a WHERE a.message_id = m.id
-  );
+FROM (
+  SELECT id, chat_id, msg_id, thread_id, bot_name, attachments_json, ts
+    FROM messages
+   WHERE direction = 'in'
+     AND attachments_json IS NOT NULL
+     AND json_valid(attachments_json) = 1
+     AND json_type(attachments_json) = 'array'
+     AND NOT EXISTS (SELECT 1 FROM attachments a WHERE a.message_id = id)
+) m, json_each(m.attachments_json) att
+WHERE json_extract(att.value, '$.file_id') IS NOT NULL
+  AND json_extract(att.value, '$.file_id') != '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc-client.js",
   "bin": {

package/polygram.js

@@ -208,7 +208,13 @@ function recordInbound(msg) {
   const chatConfig = config.chats[chatId];
   const ts = (msg.date || Math.floor(Date.now() / 1000)) * 1000;
 
-  dbWrite(() => {
+  // Atomic message + attachments write: all-or-nothing so a half-applied
+  // record can never leave a message row with zero (or partial) attachment
+  // rows that boot replay would silently treat as "no media." Wrapping in
+  // db.raw.transaction also collapses the message + N-attachment fsyncs
+  // into one commit (perf win for media groups: 7-attachment albums go
+  // from 8 sync writes to 1).
+  const writeInbound = db.raw.transaction(() => {
     db.insertMessage({
       chat_id: chatId,
       thread_id: threadId,
@@ -231,6 +237,13 @@ function recordInbound(msg) {
     // the upsert path; an explicit lookup is cheap and always correct.
     const messageId = db.getInboundMessageId({ chat_id: chatId, msg_id: msg.message_id });
     if (!messageId) return;
+    // Edit-safe insert: Telegram edited_message events re-fire
+    // recordInbound with the same (chat_id, msg_id). Telegram doesn't
+    // permit replacing media in an edit (only text/caption), so if rows
+    // already exist for this message_id they're correct as-is —
+    // re-inserting would (a) duplicate them, (b) reset download_status
+    // back to 'pending' and lose the local_path we already fetched.
+    if (db.getAttachmentsByMessage(messageId).length > 0) return;
     for (const att of attachments) {
       db.insertAttachment({
         message_id: messageId,
@@ -247,7 +260,9 @@ function recordInbound(msg) {
         ts,
       });
     }
-  }, `insert inbound ${chatId}/${msg.message_id}`);
+  });
+
+  dbWrite(() => writeInbound(), `insert inbound ${chatId}/${msg.message_id}`);
 }
 
 
@@ -741,12 +756,6 @@ function dispatchHandleMessage(sessionKey, chatId, msg, bot) {
   });
 }
 
-// drainQueuesForChat is retained as a no-op for backwards compat with
-// call sites in /model, /effort, chat-migration, and abort handlers.
-// Returns 0 always; a drain isn't meaningful in the concurrent model —
-// callers that want to abort should rely on pm.killChat.
-const drainQueuesForChat = (_chatId) => 0;
-
 // Per-session lock ordering stdin writes. Module is I/O-pure.
 const stdinLock = createAsyncLock();
 
@@ -1146,17 +1155,17 @@ async function handleConfigCallback(ctx) {
     user: cmdUser, user_id: cmdUserId, source: 'inline-button',
   }), `log ${setting} change`);
 
-  // Graceful respawn across all sessionKeys for this chat (matches the
-  // text-command flow in handleMessage).
+  // Graceful respawn of the topic's session that the card is in. With
+  // isolateTopics=false sessionKey is the chat (one shared session). With
+  // isolateTopics=true sessionKey carries the topic, so other topics'
+  // in-flight turns are not disturbed and the card update + button toast
+  // only affect the user's own context. Mirrors the text-command flow in
+  // handleMessage's requestRespawnForSession.
+  const callbackThreadId = ctx.callbackQuery.message?.message_thread_id?.toString() || null;
+  const callbackSessionKey = getSessionKey(chatId, callbackThreadId, chatConfig);
   const reason = setting === 'model' ? 'model-change' : 'effort-change';
-  const prefix = chatId;
-  let anyActive = false;
-  for (const key of pm.keys()) {
-    if (key === prefix || key.startsWith(prefix + ':')) {
-      const res = pm.requestRespawn(key, reason);
-      if (!res.killed) anyActive = true;
-    }
-  }
+  const respawn = pm.requestRespawn(callbackSessionKey, reason);
+  const anyActive = !respawn.killed;
 
   // Re-render the card with updated ✓ + the same help text shown initially.
   // Detect original card type (model-only / effort-only / both) by counting
@@ -1292,23 +1301,17 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
     await sendReply(info, { params: { reply_markup } });
     return;
   }
-  // Helper: request respawn across ALL sessionKeys owned by this chat (one
-  // per topic if isolateTopics=true, otherwise just the single chat-level
-  // key). Graceful: in-flight turns drain on old settings, new turns use
-  // the new settings. Returns total pending turns across all keys so the
-  // reply can tell the user.
-  const requestRespawnForChat = (reason) => {
-    const prefix = String(chatId);
-    let totalQueued = 0;
-    let anyActive = false;
-    for (const key of pm.keys()) {
-      if (key === prefix || key.startsWith(prefix + ':')) {
-        const res = pm.requestRespawn(key, reason);
-        totalQueued += res.queued;
-        if (!res.killed) anyActive = true;
-      }
-    }
-    return { queued: totalQueued, anyActive };
+  // Graceful respawn of the user's CURRENT session only. With
+  // isolateTopics=false the sessionKey is just the chat (one shared
+  // session for the whole chat — every topic respawns implicitly).
+  // With isolateTopics=true each topic is a separate session, and a
+  // /model in topic A should NOT disturb topic B's in-flight turn or
+  // post a phantom "✓ Using sonnet now" in a topic that didn't ask.
+  // Pre-0.6.5 this iterated pm.keys() by chat prefix and incorrectly
+  // fanned out across all topics under isolateTopics=true.
+  const requestRespawnForSession = (reason) => {
+    const res = pm.requestRespawn(sessionKey, reason);
+    return { queued: res.queued, anyActive: !res.killed };
   };
 
   if (botAllowsCommands && text.startsWith('/model ')) {
@@ -1322,7 +1325,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
         old_value: oldModel, new_value: newModel,
         user: cmdUser, user_id: cmdUserId, source: 'command',
       }), 'log model change');
-      const { anyActive } = requestRespawnForChat('model-change');
+      const { anyActive } = requestRespawnForSession('model-change');
       const ver = MODEL_VERSIONS[newModel] || newModel;
       const suffix = anyActive ? ` — I'll switch when I finish` : '';
       await sendReply(`Model → ${newModel} (${ver})${suffix}`);
@@ -1342,7 +1345,7 @@ async function handleMessage(sessionKey, chatId, msg, bot) {
         old_value: oldEffort, new_value: newEffort,
         user: cmdUser, user_id: cmdUserId, source: 'command',
       }), 'log effort change');
-      const { anyActive } = requestRespawnForChat('effort-change');
+      const { anyActive } = requestRespawnForSession('effort-change');
       const suffix = anyActive ? ` — I'll switch when I finish` : '';
       await sendReply(`Effort → ${newEffort}${suffix}`);
     } else {
@@ -1855,16 +1858,24 @@ function createBot(token) {
       const threadId = msg.message_thread_id?.toString();
       const sessionKey = getSessionKey(chatId, threadId, chatConfig);
       const hadActive = pm.has(sessionKey) && !!pm.get(sessionKey)?.inFlight;
-      const dropped = drainQueuesForChat(chatId);
       // Mark BEFORE killing: the 'close' event fires almost immediately
       // after SIGTERM, and processQueue's catch needs to see the flag to
       // skip the generic error-reply. If we marked after, there'd be a
       // race where the error-reply slips through.
       if (hadActive) markSessionAborted(sessionKey);
-      await pm.killChat(chatId).catch(() => {});
+      // Kill ONLY the user's own session, not every topic in the chat.
+      // Pre-0.6.5 this was pm.killChat(chatId) which fanned out across
+      // all topics under isolateTopics=true: the user typed "stop" in
+      // topic A and the bot tore down topic B's in-flight turn, surfacing
+      // a 💥 reply to topic B's user (whose key was never marked aborted,
+      // so the abort grace window didn't apply). With isolateTopics=false
+      // the sessionKey is the chat itself, so killing one session is the
+      // same as killing the chat — behavior unchanged for the common case.
+      await pm.kill(sessionKey).catch((err) =>
+        console.error(`[${BOT_NAME}] abort kill failed: ${err.message}`));
       dbWrite(() => db.logEvent('abort-requested', {
         chat_id: chatId, user_id: msg.from?.id || null,
-        had_active: hadActive, queued_dropped: dropped,
+        had_active: hadActive,
         trigger: cleanText.slice(0, 40),
       }), 'log abort-requested');
       // Reply in the same language the user aborted in. Cyrillic-detection
@@ -2073,8 +2084,10 @@ function createBot(token) {
       config.chats[newChatId] = { ...config.chats[oldChatId] };
       delete config.chats[oldChatId];
       saveConfig();
-      const droppedMigrate = drainQueuesForChat(oldChatId);
-      if (droppedMigrate) dbWrite(() => db.logEvent('queue-drained', { chat_id: oldChatId, reason: 'chat-migrated', dropped: droppedMigrate }), 'log queue-drained');
+      // Chat migration is the one legit chat-wide kill: every session
+      // (every topic) under the old chat_id is stale and must restart
+      // under the new chat_id. Other respawn/abort paths target a
+      // single sessionKey, but here ALL sessions are invalid.
       await pm.killChat(oldChatId);
     }
   });