sneakoscope 7.3.0 → 7.6.0

package/dist/core/telegram/runtime.js

@@ -2,23 +2,36 @@ import { REMOTE_COMMAND_SCHEMA, REMOTE_R2_APPROVAL_SCHEMA, REMOTE_WORKER_REQUEST
 import { nowIso, readJson, sha256, writeJsonAtomic } from '../fsx.js';
 import { TelegramActionBroker, TelegramAuditLedger, TelegramTopicRegistry } from './ledgers.js';
 import { TelegramBotApiError } from './bot-api.js';
+import { telegramConfigPairing } from './config.js';
 import { TelegramHubRouter } from './hub.js';
+import { TelegramIngressSpool } from './ingress-spool.js';
 import { TelegramMessageProjector, publicSafeText } from './messages.js';
-import { asRecord, boundedIdentifier, cardFromSnapshot, commandView, emptyProjection, pickerAction, requestId, routeKey, snapshotSummary, successSummary, topicName } from './runtime-projection.js';
+import { asRecord, boundedIdentifier, cardFromSnapshot, commandView, emptyProjection, pickerAction, requestId, routeKey, snapshotSummary, failureSummary, successSummary, topicName } from './runtime-projection.js';
 export class TelegramHubRuntime {
     options;
     clients = new Map();
     now;
+    pairedChatId;
     constructor(options) {
         this.options = options;
         this.now = options.now ?? Date.now;
+        this.pairedChatId = telegramConfigPairing(options.config).chatId;
     }
     async initialize() {
         return this.syncSessions();
     }
     async processUpdate(update) {
-        const routed = await this.options.router.handleUpdate(update);
-        await this.acknowledgeCallback(update, routed);
+        const routed = await this.prepareUpdate(update);
+        await this.executePreparedUpdate(update, routed);
+        return routed;
+    }
+    async prepareUpdate(update, options = {}) {
+        await this.acknowledgeCallback(update);
+        return this.options.router.handleUpdate(update, {
+            skipIdempotency: options.durablyAdmitted === true
+        });
+    }
+    async executePreparedUpdate(update, routed) {
         try {
             if (routed.session_picker)
                 await this.sendSessionPicker(update);
@@ -26,9 +39,12 @@ export class TelegramHubRuntime {
                 await this.executeRoutedAction(update, routed);
         }
         catch (error) {
-            await this.reportEffectFailure(update, routed.action, error);
+            if (this.options.ingress)
+                throw error;
+            const handled = await this.reportEffectFailure(update, routed.action, error);
+            if (!handled)
+                throw error;
         }
-        return routed;
     }
     async tick() {
         const routes = await this.options.topics.list();
@@ -38,6 +54,7 @@ export class TelegramHubRuntime {
         let changed = false;
         for (const route of routes) {
             try {
+                this.assertCurrentRoute(route);
                 const key = routeKey(route);
                 const row = state.sessions[key] ?? emptyProjection();
                 state.sessions[key] = row;
@@ -103,10 +120,12 @@ export class TelegramHubRuntime {
                     });
                     const snapshot = snapshotResponse.ok ? asRecord(snapshotResponse.data) : null;
                     let route = await this.options.topics.findBySession(target.machine_id, target.project_id, sessionId);
+                    if (route && route.chat_id !== this.pairedChatId)
+                        route = null;
                     if (!route) {
                         let messageThreadId = 0;
                         try {
-                            const topic = await this.options.projector.createSessionTopic(this.options.config.paired_chat_ids[0], topicName(target, sessionId, snapshot));
+                            const topic = await this.options.projector.createSessionTopic(this.pairedChatId, topicName(target, sessionId, snapshot));
                             messageThreadId = topic.message_thread_id;
                         }
                         catch (error) {
@@ -118,11 +137,12 @@ export class TelegramHubRuntime {
                             machine_id: target.machine_id,
                             project_id: target.project_id,
                             session_id: sessionId,
-                            chat_id: this.options.config.paired_chat_ids[0],
+                            chat_id: this.pairedChatId,
                             message_thread_id: messageThreadId,
                             pinned_message_id: null
                         });
                     }
+                    this.assertCurrentRoute(route);
                     if (snapshot) {
                         const needsInitialProjection = route.pinned_message_id === null || !state.sessions[routeKey(route)];
                         await this.projectSnapshot(route, snapshot, state, needsInitialProjection);
@@ -146,53 +166,146 @@ export class TelegramHubRuntime {
         const route = await this.options.topics.findBySession(action.machine_id, action.project_id, action.session_id);
         if (!route)
             throw new Error('telegram_action_route_missing');
+        this.assertCurrentRoute(route);
+        if (route.generation !== action.route_generation) {
+            throw new Error('telegram_action_route_generation_stale');
+        }
         if (action.prompt === 'pick') {
-            await this.options.projector.sendFinal({ route, text: 'Session selected. Use this topic for typed SKS controls.' });
+            const text = 'Session selected. Use this topic for typed SKS controls.';
+            await this.checkpointEffectless(update.update_id, text, action.status === 'claimed' ? 'resolved' : 'none');
+            await this.sendTelegramOnce(update.update_id, () => (this.options.projector.sendFinal({ route, text })));
             if (action.status === 'claimed')
                 await this.options.actions.complete(action.action_id, 'resolved');
+            await this.options.ingress?.markAuditCompleted(update.update_id);
             return;
         }
         if (routed.status === 'approval_required' && routed.callback_data) {
-            const messageId = await this.options.projector.sendApproval(route, routed.callback_data);
-            await this.options.projector.setReaction(route, messageId, 'needs_input');
+            await this.checkpointEffectless(update.update_id, 'Cancel approval requested.', 'none');
+            const sent = await this.sendTelegramOnce(update.update_id, async () => {
+                const messageId = await this.options.projector.sendApproval(route, routed.callback_data);
+                return { method: 'sendMessage', message_id: messageId };
+            });
+            if (sent.newlyDelivered) {
+                await this.options.projector.setReaction(route, sent.receipt.message_id, 'needs_input');
+            }
+            await this.options.ingress?.markAuditCompleted(update.update_id);
             return;
         }
         if (action.kind === 'input' && action.prompt === '/input') {
-            await this.options.projector.requestInput({ route, prompt: 'Reply to this message with the exact Codex follow-up input.', placeholder: 'Send input to this session' });
+            const text = 'Reply to this message with the exact Codex follow-up input.';
+            await this.checkpointEffectless(update.update_id, text, 'none');
+            await this.sendTelegramOnce(update.update_id, async () => ({
+                method: 'sendMessage',
+                message_id: await this.options.projector.requestInput({
+                    route,
+                    prompt: text,
+                    placeholder: 'Send input to this session'
+                })
+            }));
+            await this.options.ingress?.markAuditCompleted(update.update_id);
             return;
         }
-        const response = await this.dispatch(route, action);
-        const data = asRecord(response.receipt?.result ?? response.data);
-        if (response.ok) {
-            await this.options.projector.sendFinal({ route, text: successSummary(action, data) });
-            if (commandView(action.prompt) === 'artifacts')
-                await this.options.projector.sendArtifactManifest({ route, artifacts: Array.isArray(data?.artifacts) ? data.artifacts : [] });
-            if (data?.schema === 'sks.remote-session-snapshot.v1') {
-                const state = await this.readProjectionState();
-                await this.projectSnapshot(route, data, state, true);
-                await writeJsonAtomic(this.options.projectionStatePath, state);
+        let execution = await this.options.ingress?.execution(update.update_id) ?? null;
+        let outcome = checkpointedOutcome(execution);
+        let responseData = null;
+        if (!outcome) {
+            await this.reactToUpdate(update, route, 'running');
+            await this.options.ingress?.markEffectDispatching(update.update_id);
+            try {
+                const response = await this.dispatch(route, action);
+                responseData = asRecord(response.receipt?.result ?? response.data);
+                const errorDelivery = response.error?.delivery;
+                outcome = {
+                    effectState: response.ok
+                        ? 'applied'
+                        : errorDelivery === 'not_dispatched'
+                            ? 'rejected'
+                            : 'unknown',
+                    effectReceipt: response.receipt
+                        ? `${response.receipt.command_id}:${response.receipt.status}`
+                        : null,
+                    finalText: response.ok
+                        ? successSummary(action, responseData)
+                        : failureSummary(publicSafeText(response.error?.code ?? 'remote_command_failed'), errorDelivery),
+                    decision: response.ok ? 'accepted' : 'rejected',
+                    policyReason: response.ok
+                        ? 'effect_completed'
+                        : publicSafeText(response.error?.code ?? 'effect_failed').slice(0, 160),
+                    actionCompletion: action.status === 'claimed'
+                        ? response.ok || errorDelivery !== 'not_dispatched'
+                            ? 'resolved'
+                            : 'cancelled'
+                        : 'none'
+                };
             }
-            await this.reactToUpdate(update, route, action.kind === 'cancel' ? 'blocked' : action.kind === 'verify' ? 'verified' : 'observed');
-            if (action.status === 'claimed')
-                await this.options.actions.complete(action.action_id, 'resolved');
+            catch (error) {
+                const delivery = error instanceof RemoteSshClientError ? error.delivery : 'unknown';
+                const code = error instanceof RemoteSshClientError
+                    ? `${error.code}:${delivery}`
+                    : error instanceof Error
+                        ? publicSafeText(error.message || 'telegram_effect_failed').slice(0, 160)
+                        : 'telegram_effect_failed';
+                outcome = {
+                    effectState: delivery === 'not_dispatched' ? 'rejected' : 'unknown',
+                    effectReceipt: null,
+                    finalText: failureSummary(code, delivery),
+                    decision: 'rejected',
+                    policyReason: code,
+                    actionCompletion: action.status === 'claimed'
+                        ? delivery === 'not_dispatched' ? 'cancelled' : 'resolved'
+                        : 'none'
+                };
+            }
+            await this.options.ingress?.markEffectOutcome(update.update_id, outcome);
         }
-        else {
-            const code = publicSafeText(response.error?.code ?? 'remote_command_failed');
-            await this.options.projector.sendFinal({ route, text: `Remote action blocked: ${code}` });
-            await this.reactToUpdate(update, route, 'blocked');
-            if (action.status === 'claimed')
-                await this.options.actions.complete(action.action_id, 'cancelled');
+        const sent = await this.sendTelegramOnce(update.update_id, () => (this.options.projector.sendFinal({ route, text: outcome.finalText })));
+        if (sent.newlyDelivered) {
+            if (outcome.decision === 'accepted' && responseData) {
+                if (commandView(action.prompt) === 'artifacts') {
+                    await this.options.projector.sendArtifactManifest({
+                        route,
+                        artifacts: Array.isArray(responseData.artifacts) ? responseData.artifacts : []
+                    }).catch(() => undefined);
+                }
+                if (responseData.schema === 'sks.remote-session-snapshot.v1') {
+                    try {
+                        const state = await this.readProjectionState();
+                        await this.projectSnapshot(route, responseData, state, true);
+                        await writeJsonAtomic(this.options.projectionStatePath, state);
+                    }
+                    catch {
+                    }
+                }
+            }
+            await this.reactToUpdate(update, route, outcome.decision === 'rejected'
+                ? 'blocked'
+                : action.kind === 'cancel'
+                    ? 'blocked'
+                    : action.kind === 'verify' || action.kind === 'input'
+                        ? 'verified'
+                        : 'observed');
+        }
+        if (action.status === 'claimed' && outcome.actionCompletion !== 'none') {
+            await this.options.actions.complete(action.action_id, outcome.actionCompletion);
+        }
+        execution = await this.options.ingress?.execution(update.update_id) ?? execution;
+        if (execution?.audit_state !== 'completed') {
+            await this.options.audit.record({
+                update_id: update.update_id,
+                chat_id: route.chat_id,
+                topic_id: route.message_thread_id,
+                action_alias: update.callback_query?.data?.startsWith('cb:')
+                    ? update.callback_query.data.slice(3)
+                    : null,
+                command_kind: action.kind,
+                decision: outcome.decision,
+                policy_reason: outcome.policyReason,
+                effect_receipt: outcome.effectReceipt,
+                telegram_delivery: 'delivered',
+                telegram_delivery_receipt: `${sent.receipt.method}:${sent.receipt.message_id}`
+            });
+            await this.options.ingress?.markAuditCompleted(update.update_id);
         }
-        await this.options.audit.record({
-            update_id: update.update_id,
-            chat_id: route.chat_id,
-            topic_id: route.message_thread_id,
-            action_alias: update.callback_query?.data?.startsWith('cb:') ? update.callback_query.data.slice(3) : null,
-            command_kind: action.kind,
-            decision: response.ok ? 'accepted' : 'rejected',
-            policy_reason: response.ok ? 'effect_completed' : response.error?.code ?? 'effect_failed',
-            effect_receipt: response.receipt ? `${response.receipt.command_id}:${response.receipt.status}` : null
-        });
     }
     async dispatch(route, action) {
         if (action.risk === 'R3')
@@ -260,40 +373,126 @@ export class TelegramHubRuntime {
         const chatId = update.message?.chat.id ?? update.callback_query?.message?.chat.id;
         if (chatId === undefined)
             return;
+        if (String(chatId) !== this.pairedChatId)
+            throw new Error('telegram_route_identity_mismatch');
         const routes = (await this.options.topics.list()).filter((route) => route.chat_id === String(chatId)).slice(0, 24);
+        for (const route of routes)
+            this.assertCurrentRoute(route);
         if (!routes.length) {
-            await this.options.projector.sendFlat({ chatId: String(chatId), text: 'No registered SKS session topics are available. Run hub sync after the remote session index is configured.' });
+            const text = 'No registered SKS session topics are available. Run hub sync after the remote session index is configured.';
+            await this.checkpointEffectless(update.update_id, text, 'none');
+            await this.sendTelegramOnce(update.update_id, async () => ({
+                method: 'sendMessage',
+                message_id: await this.options.projector.sendFlat({ chatId: String(chatId), text })
+            }));
+            await this.options.ingress?.markAuditCompleted(update.update_id);
             return;
         }
+        const createdActions = await this.options.actions.createMany(routes.map((route) => ({
+            action: pickerAction(route, this.now(), update.update_id),
+            route: { chat_id: route.chat_id, message_thread_id: 0 }
+        })));
         const buttons = [];
-        for (const route of routes) {
-            const action = pickerAction(route, this.now());
-            const created = await this.options.actions.create(action, { chat_id: route.chat_id, message_thread_id: 0 });
+        for (let index = 0; index < routes.length; index += 1) {
+            const route = routes[index];
+            const created = createdActions[index];
             buttons.push([{ text: `${route.machine_id} · ${route.project_id} · ${route.session_id}`.slice(0, 56), callback_data: created.callback_data }]);
         }
-        await this.options.projector.sendFlat({
-            chatId: String(chatId),
-            text: 'Choose a session. The bot will post into the exact private topic; subsequent controls must stay in that topic.',
-            replyMarkup: { inline_keyboard: buttons }
+        const text = 'Choose a session. The bot will post into the exact private topic; subsequent controls must stay in that topic.';
+        await this.checkpointEffectless(update.update_id, text, 'none');
+        await this.sendTelegramOnce(update.update_id, async () => ({
+            method: 'sendMessage',
+            message_id: await this.options.projector.sendFlat({
+                chatId: String(chatId),
+                text,
+                replyMarkup: { inline_keyboard: buttons }
+            })
+        }));
+        await this.options.ingress?.markAuditCompleted(update.update_id);
+    }
+    async checkpointEffectless(updateId, finalText, actionCompletion) {
+        const execution = await this.options.ingress?.execution(updateId) ?? null;
+        if (checkpointedOutcome(execution))
+            return;
+        await this.options.ingress?.markEffectOutcome(updateId, {
+            effectState: 'applied',
+            effectReceipt: null,
+            finalText,
+            decision: 'accepted',
+            policyReason: 'telegram_projection_prepared',
+            actionCompletion
         });
     }
-    async acknowledgeCallback(update, routed) {
+    async sendTelegramOnce(updateId, send) {
+        const ingress = this.options.ingress;
+        if (!ingress)
+            return { receipt: await send(), newlyDelivered: true };
+        const execution = await ingress.execution(updateId);
+        if (!execution)
+            throw new Error('telegram_ingress_entry_missing');
+        if (execution.telegram_delivery === 'delivered') {
+            if (!execution.telegram_message_receipt) {
+                throw new Error('telegram_ingress_message_receipt_missing');
+            }
+            return {
+                receipt: execution.telegram_message_receipt,
+                newlyDelivered: false
+            };
+        }
+        if (execution.telegram_delivery === 'dispatching'
+            || execution.telegram_delivery === 'unknown') {
+            throw new Error('telegram_ingress_telegram_delivery_ambiguous');
+        }
+        await ingress.markTelegramDispatching(updateId);
+        try {
+            const receipt = await send();
+            await ingress.markTelegramDelivered(updateId, receipt);
+            return { receipt, newlyDelivered: true };
+        }
+        catch (error) {
+            await ingress.markTelegramDeliveryFailure(updateId, telegramDeliveryFromError(error));
+            throw error;
+        }
+    }
+    assertCurrentRoute(route) {
+        if (route.chat_id !== this.pairedChatId) {
+            throw new Error('telegram_route_identity_mismatch');
+        }
+    }
+    async acknowledgeCallback(update) {
         const id = update.callback_query?.id;
         if (!id)
             return;
-        const text = routed.ok
-            ? routed.status === 'claimed' ? 'Approved; applying exact scope.' : 'Request accepted.'
-            : routed.status === 'already_resolved' ? 'Already resolved.' : `Request rejected: ${routed.status}`;
-        await this.options.projector.answerCallbackQuery(id, text, false).catch(() => undefined);
+        await this.options.projector.answerCallbackQuery(id, 'Request received. SKS will validate and apply the exact linked scope.', false).catch(() => undefined);
     }
     async reportEffectFailure(update, action, error) {
         if (!action)
-            return;
+            return false;
         const route = await this.options.topics.findBySession(action.machine_id, action.project_id, action.session_id);
         if (!route)
-            return;
-        const code = error instanceof RemoteSshClientError ? `${error.code}:${error.delivery}` : 'telegram_effect_failed';
-        await this.options.projector.sendFinal({ route, text: `Remote action blocked: ${publicSafeText(code)}` }).catch(() => undefined);
+            return false;
+        const code = error instanceof RemoteSshClientError
+            ? `${error.code}:${error.delivery}`
+            : error instanceof Error
+                ? publicSafeText(error.message || 'telegram_effect_failed').slice(0, 160)
+                : 'telegram_effect_failed';
+        if (action.status === 'claimed') {
+            const appliedOrUnknown = error instanceof RemoteSshClientError && error.delivery !== 'not_dispatched';
+            await this.options.actions.complete(action.action_id, appliedOrUnknown ? 'resolved' : 'cancelled');
+        }
+        let telegramDelivery = 'not_dispatched';
+        let telegramDeliveryReceipt = null;
+        try {
+            const final = await this.options.projector.sendFinal({
+                route,
+                text: `Remote action blocked: ${publicSafeText(code)}`
+            });
+            telegramDelivery = 'delivered';
+            telegramDeliveryReceipt = `${final.method}:${final.message_id}`;
+        }
+        catch (deliveryError) {
+            telegramDelivery = telegramDeliveryFromError(deliveryError);
+        }
         await this.options.audit.record({
             update_id: update.update_id,
             chat_id: route.chat_id,
@@ -302,13 +501,15 @@ export class TelegramHubRuntime {
             command_kind: action.kind,
             decision: 'rejected',
             policy_reason: code,
-            effect_receipt: null
+            effect_receipt: null,
+            telegram_delivery: telegramDelivery,
+            telegram_delivery_receipt: telegramDeliveryReceipt
         });
-        if (action.status === 'claimed')
-            await this.options.actions.complete(action.action_id, 'cancelled').catch(() => undefined);
+        return true;
     }
     async projectSnapshot(routeInput, snapshot, state, force = false) {
         let route = routeInput;
+        this.assertCurrentRoute(route);
         const key = routeKey(route);
         const projection = state.sessions[key] ?? emptyProjection();
         const digest = sha256(JSON.stringify(snapshot));
@@ -334,14 +535,28 @@ export class TelegramHubRuntime {
         projection.snapshot_digest = digest;
         if (draft.message_id)
             projection.draft_message_id = draft.message_id;
-        if (snapshot.completion_verified === true && projection.final_generation !== route.generation) {
-            await this.options.projector.sendFinal({ route, text: `Verified terminal session: ${route.session_id}. Machine gates and trust evidence are complete.` });
-            projection.final_generation = route.generation;
+        if (snapshot.completion_verified === true
+            && projection.final_generation !== route.generation
+            && projection.final_generation_unknown !== route.generation) {
+            try {
+                await this.options.projector.sendFinal({
+                    route,
+                    text: `Verified terminal session: ${route.session_id}. Machine gates and trust evidence are complete.`
+                });
+                projection.final_generation = route.generation;
+                projection.final_generation_unknown = null;
+            }
+            catch (error) {
+                if (telegramDeliveryFromError(error) !== 'unknown')
+                    throw error;
+                projection.final_generation_unknown = route.generation;
+            }
         }
         state.sessions[key] = projection;
         return true;
     }
     clientForRoute(route) {
+        this.assertCurrentRoute(route);
         return this.clientForTarget(findRemoteSessionTarget(this.options.sessionIndex, route.machine_id, route.project_id));
     }
     clientForTarget(target) {
@@ -376,3 +591,23 @@ export class TelegramHubRuntime {
             : { schema: 'sks.telegram-projection-state.v1', sessions: {} };
     }
 }
+function telegramDeliveryFromError(error) {
+    return error instanceof TelegramBotApiError ? error.delivery : 'unknown';
+}
+function checkpointedOutcome(execution) {
+    if (!execution
+        || !['applied', 'rejected', 'unknown'].includes(execution.effect_state)
+        || !execution.final_text
+        || !execution.decision
+        || !execution.policy_reason) {
+        return null;
+    }
+    return {
+        effectState: execution.effect_state,
+        effectReceipt: execution.effect_receipt,
+        finalText: execution.final_text,
+        decision: execution.decision,
+        policyReason: execution.policy_reason,
+        actionCompletion: execution.action_completion
+    };
+}