toolroll 0.9.17 → 0.9.19

package/dist/telegram.js

@@ -27,7 +27,8 @@ import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { chmodSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { validateNote } from "./decision.js";
-import { isLifecycleNotification, isTelegramProgressNotification, TELEGRAM_HOLD_REASONS } from "./store.js";
+import { resultShotsFor } from "./result-shots.js";
+import { isLifecycleNotification, isTelegramProgressNotification, RESULT_SHOTS_KIND, TELEGRAM_HOLD_REASONS } from "./store.js";
 import { telegramProgressCard } from "./telegram-progress.js";
 import { enqueueEveningDigests, finishedView, isTaskFact, joinsBatch, needsPerson, quietCardView } from "./chat-quiet.js";
 import { BATCH_MS, chatText, chatTitle, factLinkLabel, mentions, nameTelegramBot } from "./chat-voice.js";
@@ -36,6 +37,8 @@ import { applyTeamInbound, deliverTeamChats, teamCommand } from "./telegram-team
 import { applyFlowReply, applyFlowTap, FLOW_DECIDE_KEY, flowButtons, flowDecisionAt } from "./telegram-flow.js";
 import { connectChannel, FLOW_WORDS, takeChannelMessage, watchedChannel } from "./chat-inbox.js";
 import { focusContextFor, taskInCeiling } from "./chat-channel.js";
+import { answersPrompt, applyDecideFeedback, applyDecideTap, decideFallbackLink, dropDecideTokens, hasLiveDecideTokens, linksFor, placeDecidePrompt, decideOffer, decideTargetOf, isDecideToken, mergedText, mintDecideButtons, offerFingerprint, openPromptFor, placeDecideTokens, recordChatMerge, retireDecideTokens } from "./chat-decide.js";
+import { mergePullRequest } from "./pull-request-flow.js";
 import { phoneCommand, phoneStatus, phoneTaskView, PHONE_CONSOLE_FOOTER, PHONE_HELP, notificationIdentity, phoneTaskChoices, resolvePhoneTask, phoneFocusText, phoneTaskListText, phoneText, PHONE_NO_MATCH, PHONE_BACK_TO_LEAD } from "./telegram-status.js";
 import { MATE_MESSAGE_MAX_CHARS } from "./mate.js";
 import { envValue } from "./names.js";
@@ -159,7 +162,7 @@ export function scrub(text, token) {
     return token === "" ? text : text.split(token).join(redactToken(token));
 }
 export function createTransport(token, timeoutMs = 30_000) {
-    return async (method, params, signal, upload) => {
+    return async (method, params, signal, upload, more) => {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         const onAbort = () => controller.abort();
@@ -176,7 +179,7 @@ export function createTransport(token, timeoutMs = 30_000) {
             // the verified bytes as one Blob under the file name given.
             const request = upload === undefined
                 ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(params), signal: controller.signal }
-                : { method: "POST", body: multipartOf(params, upload), signal: controller.signal };
+                : { method: "POST", body: multipartOf(params, upload, ...(more ?? [])), signal: controller.signal };
             const response = await fetch(`https://api.telegram.org/bot${token}/${method}`, request);
             const body = (await response.json());
             // A missing or malformed acknowledgement does not prove a send failed.
@@ -248,14 +251,15 @@ export function transportError(error) {
     return why === "" || why === message ? message : `${message} (${why.slice(0, 160)})`;
 }
 /** The multipart body: every param a field (objects as JSON), the file last. Exported for the adapter's own test only. */
-export function multipartOf(params, upload) {
+export function multipartOf(params, upload, ...more) {
     const form = new FormData();
     for (const [key, value] of Object.entries(params)) {
         if (value === undefined || value === null)
             continue;
         form.append(key, typeof value === "object" ? JSON.stringify(value) : String(value));
     }
-    form.append(upload.field, new Blob([new Uint8Array(upload.bytes)], { type: upload.contentType }), upload.fileName);
+    for (const one of [upload, ...more])
+        form.append(one.field, new Blob([new Uint8Array(one.bytes)], { type: one.contentType }), one.fileName);
     return form;
 }
 // ---- pairing ---------------------------------------------------------------
@@ -601,6 +605,29 @@ function viewKeyboard(phoneOrigin, view) {
         return [];
     }
 }
+/** Where a paired person taps: their binding and private chat. */
+function decideSeat(binding) {
+    return { channel: "telegram", binding: binding.id, chat: binding.chatId, approver: binding.approver, generation: binding.approverGeneration };
+}
+/** Decide buttons as Telegram draws them: an act's opaque token, or a link under the trusted origin read now (none without one). */
+function decideKeyboard(phoneOrigin, rows) {
+    let origin = null;
+    try {
+        origin = phoneOrigin?.() ?? null;
+    }
+    catch {
+        origin = null;
+    }
+    return rows.map(row => row.flatMap((one) => "token" in one ? [{ text: one.label, callback_data: one.token }]
+        : phoneLinkButton(origin, one.link) ?? [])).filter(row => row.length > 0);
+}
+/** What this card may act on in the chat now, for this person under their current ceiling; null keeps its link. */
+function decideOfferFor(store, binding, target, projects, now, root) {
+    if (target === null || target === undefined)
+        return null;
+    const principal = verifyApproverStanding(store, binding.approver, binding.approverGeneration, telegramConversationRepos(store, binding.approver, projects));
+    return principal.ok ? decideOffer(store, target, principal.who, now, root) : null;
+}
 /** Team-conversation traffic to the chats that follow one — after the outbox, under the same delivery switch, never a problem to raise when nothing follows anything. */
 async function deliverTeam(store, botId, transport, clock, report, readProjects, canDeliver, phoneOrigin) {
     if (store.listTelegramTeamChats(botId).length === 0)
@@ -631,7 +658,7 @@ async function deliverOutbox(store, botId, transport, owner, clock, report, read
         // Routine progress facts are not a problem to fix: a first pairing
         // starts from now and settles them as history. Anything else pending
         // is named, once per pass, as before.
-        if (store.listNotifications("pending").some(row => !isLifecycleNotification(row)))
+        if (store.listNotifications("pending").some(row => !isLifecycleNotification(row) && row.kind !== RESULT_SHOTS_KIND))
             report.problems.push("outbox rows are pending but no chat is paired — `toolroll bridge telegram pair`");
         return;
     }
@@ -663,7 +690,7 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
     const groups = [];
     for (const row of claimed) {
         const last = groups[groups.length - 1];
-        if (!quiet && digest.everyMs !== null && !isUrgent(row) && last !== undefined && !isUrgent(last[0]))
+        if (!quiet && digest.everyMs !== null && joinsDigest(row) && last !== undefined && joinsDigest(last[0]))
             last.push(row);
         else
             groups.push([row]);
@@ -760,18 +787,26 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                 const sent = await sender(`A screenshot for result #${row.run} could not be sent: ${verified.problem}. Inspect the result before accepting.`);
                 return sent.ok ? { ok: true, receipt: receiptFor(botId, binding.chatId, sent.messageId) } : sent;
             }
+            // Already sent with its result (result-shots.ts): the same screenshot is not sent again.
+            const artifact = Number(match[2]);
+            if (store.resultShotsSent(row.destination, row.run).has(artifact))
+                return { ok: true, receipt: "skipped:screenshot-sent" };
+            // Marked while it goes, so the screenshots sent with the result skip it; any failure unmarks it for the retry.
+            store.markResultShotsSent(row.destination, row.run, [artifact], clock());
             // No await between the access fence, file validation and upload.
             let answer;
             try {
                 answer = await transport("sendDocument", { chat_id: binding.chatId, caption: `${resultTaskLabel(row.taskId)} · result #${row.run} · screenshot for acceptance` }, undefined, {
-                    field: "document", bytes: verified.bytes, contentType: verified.format === "png" ? "image/png" : "image/jpeg", fileName: resultImageFileName(row.taskId, row.run, Number(match[2]), verified.format),
+                    field: "document", bytes: verified.bytes, contentType: verified.format === "png" ? "image/png" : "image/jpeg", fileName: resultImageFileName(row.taskId, row.run, artifact, verified.format),
                 });
             }
             catch {
+                store.unmarkResultShotsSent(row.destination, row.run, [artifact]);
                 return { ok: false, error: "Screenshot delivery is unconfirmed; retry may duplicate it" };
             }
             const messageId = answer.result?.message_id;
             if (!answer.ok || !Number.isSafeInteger(messageId)) {
+                store.unmarkResultShotsSent(row.destination, row.run, [artifact]);
                 if (answer.parameters?.retry_after !== undefined)
                     store.deferTelegram(botId, new Date(clock().getTime() + answer.parameters.retry_after * 1000).toISOString());
                 return { ok: false, error: answer.uncertain || (answer.ok && messageId == null) ? "Screenshot delivery is unconfirmed; retry may duplicate it" : "Telegram did not accept the screenshot" };
@@ -780,7 +815,56 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
             const after = (await readAccess()) ?? fence();
             return after === null ? { ok: true, receipt: receiptFor(botId, binding.chatId, String(messageId)) } : { ok: false, error: after };
         };
-        const batched = !quiet && digest.everyMs !== null && !isUrgent(rows[0]);
+        /** Screenshots with a result (result-shots.ts): photos, several as one album, re-proved before every call. Each is
+         * marked sent before it goes, so an unconfirmed send is never repeated; only Telegram's outright refusal unmarks it. */
+        const shotsSender = async (row) => {
+            let receipt = null;
+            for (let call = 0; call <= 4; call++) {
+                const problem = (await readAccess()) ?? fence();
+                if (problem !== null)
+                    return { ok: false, error: problem };
+                const plan = resultShotsFor(store, evidenceRoot, telegramConversationRepos(store, binding.approver, projects), row, store.resultShotsSent(row.destination, row.run ?? 0));
+                if (plan.kind === "none")
+                    return call > 0 ? { ok: true, receipt } : { ok: true, receipt: `skipped:screenshots-${plan.why}` };
+                if (plan.kind === "line") {
+                    const sent = await sender(plan.text, undefined, [row]);
+                    return sent.ok ? { ok: true, receipt: receiptFor(botId, binding.chatId, sent.messageId) } : sent;
+                }
+                // No await between the access fence, the files' verification and the upload.
+                const photos = plan.shots.filter(one => one.photo);
+                const batch = photos.length >= 2 ? photos : [plan.shots[0]];
+                const upload = (one, field) => ({ field, fileName: one.fileName, contentType: one.format === "png" ? "image/png" : "image/jpeg", bytes: one.bytes });
+                const ids = batch.map(one => one.artifact);
+                store.markResultShotsSent(row.destination, plan.run, ids, clock());
+                let answer;
+                try {
+                    answer = batch.length > 1
+                        ? await transport("sendMediaGroup", { chat_id: binding.chatId, media: batch.map((one, index) => ({ type: "photo", media: `attach://shot${index}`, ...(index === 0 ? { caption: one.caption } : {}) })) }, undefined, upload(batch[0], "shot0"), batch.slice(1).map((one, index) => upload(one, `shot${index + 1}`)))
+                        : batch[0].photo
+                            ? await transport("sendPhoto", { chat_id: binding.chatId, caption: batch[0].caption }, undefined, upload(batch[0], "photo"))
+                            : await transport("sendDocument", { chat_id: binding.chatId, caption: batch[0].caption }, undefined, upload(batch[0], "document"));
+                }
+                catch {
+                    answer = { ok: false, uncertain: true };
+                }
+                if (!answer.ok && answer.uncertain !== true) {
+                    store.unmarkResultShotsSent(row.destination, plan.run, ids);
+                    if (answer.parameters?.retry_after !== undefined)
+                        store.deferTelegram(botId, new Date(clock().getTime() + answer.parameters.retry_after * 1000).toISOString());
+                    return { ok: false, error: "Telegram did not accept the screenshots" };
+                }
+                const messages = (Array.isArray(answer.result) ? answer.result : [answer.result])
+                    .map(one => one?.message_id).filter((one) => Number.isSafeInteger(one));
+                // An unconfirmed send stays marked: it may have arrived, so it is never sent again.
+                if (!answer.ok || messages.length === 0)
+                    report.problems.push(`notification ${row.id}: Telegram did not confirm the screenshots; they are not sent again`);
+                for (const one of messages)
+                    store.recordTelegramMessage(row, binding, String(one), clock());
+                receipt = receiptFor(botId, binding.chatId, messages.length === 0 ? null : String(messages[0]));
+            }
+            return { ok: true, receipt };
+        };
+        const batched = !quiet && digest.everyMs !== null && joinsDigest(rows[0]);
         const row = rows[0];
         const progressRun = batched ? null : store.telegramProgressRun(row);
         const progress = progressRun !== null && isTelegramProgressNotification(row);
@@ -885,35 +969,65 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                         return { ok: true, receipt: receiptFor(botId, binding.chatId, card.messageId) };
                     return deliverOne(store, botId, binding, sender, fact, clock, phoneOrigin, evidenceRoot, projects);
                 }
+                // A message about one result, plan, failure or pull request acts in place (chat-decide.ts); its buttons are
+                // minted only when what it offers changed, or its own were spent (Not now), so an unchanged repaint keeps the
+                // ones already in the chat.
+                const offer = decideOfferFor(store, binding, view.target, projects, clock(), evidenceRoot);
+                const text = offer?.text ?? view.text;
                 // While a lone update is still the only item, its edit keeps that update's own action button.
-                const own = lone && fact.link !== null ? factButton(phoneOrigin, fact.link) : null;
-                const keyboard = own !== null ? [own] : viewKeyboard(phoneOrigin, view);
-                const shown = createHash("sha256").update(JSON.stringify([view.text, keyboard])).digest("hex");
+                const own = offer === null && lone && fact.link !== null ? factButton(phoneOrigin, fact.link) : null;
+                let keyboard = own !== null ? [own] : viewKeyboard(phoneOrigin, view);
+                const shown = createHash("sha256").update(JSON.stringify(offer === null ? [view.text, keyboard] : [text, offerFingerprint(offer)])).digest("hex");
+                let tokens = [];
+                // Minted unplaced: they ride a message only once it shows them, and until then the old card's buttons work.
+                const mintFor = () => {
+                    if (offer === null)
+                        return;
+                    const minted = mintDecideButtons(store, decideSeat(binding), view.target, offer, clock());
+                    keyboard = decideKeyboard(phoneOrigin, minted.rows);
+                    tokens = minted.tokens;
+                };
                 if (batch.message !== null) {
-                    if (batch.digest === shown) {
+                    if (batch.digest === shown && (offer === null || hasLiveDecideTokens(store, "telegram", binding.chatId, batch.message, clock()))) {
                         store.recordTelegramMessage(fact, binding, batch.message, clock());
                         return { ok: true, receipt: receiptFor(botId, binding.chatId, batch.message) };
                     }
                     const problem = (await readAccess()) ?? fence();
                     if (problem !== null)
                         return { ok: false, error: problem };
-                    const edited = await editProgress(transport, binding.chatId, batch.message, view.text, keyboard);
+                    mintFor();
+                    const edited = await editProgress(transport, binding.chatId, batch.message, text, keyboard);
                     if (edited.ok) {
+                        // The repaint landed: the old words' buttons retire and the new ones ride the message.
+                        retireDecideTokens(store, "telegram", binding.chatId, batch.message, clock());
+                        placeDecideTokens(store, tokens, batch.message);
                         store.setChatBatchMessage(batch.id, batch.message, shown);
                         store.recordTelegramMessage(fact, binding, batch.message, clock());
                         const after = (await readAccess()) ?? fence();
                         return after === null ? { ok: true, receipt: receiptFor(botId, binding.chatId, batch.message) } : { ok: false, error: after };
                     }
+                    // A failed edit: the buttons it carried never act, and the card's old ones keep working.
+                    dropDecideTokens(store, tokens, clock());
                     if (edited.retryAfter !== undefined)
                         store.deferTelegram(botId, new Date(clock().getTime() + edited.retryAfter * 1000).toISOString());
                     // Only Telegram's definitive missing/uneditable answer permits a new message.
                     if (!edited.replace)
                         return edited;
                 }
-                const sent = await sender(view.text, keyboard.length === 0 ? undefined : keyboard, [fact]);
+                // A new message: its buttons are minted for it, never the ones a failed edit was given.
+                mintFor();
+                const sent = await sender(text, keyboard.length === 0 ? undefined : keyboard, [fact]);
                 const placed = sent.ok ? sent.messageId : store.telegramMessageOf(fact.id, fact.destination);
                 if (placed !== null)
                     store.setChatBatchMessage(batch.id, placed, shown);
+                if (sent.ok && sent.messageId !== null) {
+                    // The new card replaces the old one: only its buttons act.
+                    if (batch.message !== null)
+                        retireDecideTokens(store, "telegram", binding.chatId, batch.message, clock());
+                    placeDecideTokens(store, tokens, sent.messageId);
+                }
+                else
+                    dropDecideTokens(store, tokens, clock());
                 return sent.ok ? { ok: true, receipt: receiptFor(botId, binding.chatId, sent.messageId) } : sent;
             }
             return fact.kind === "acceptance-evidence" ? imageSender(fact) : deliverOne(store, botId, binding, sender, fact, clock, phoneOrigin, evidenceRoot, projects);
@@ -944,7 +1058,9 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
             return sent.ok ? { ok: true, receipt: receiptFor(botId, binding.chatId, sent.messageId) } : sent;
         };
         let outcome;
-        if (rows.length === 1 && row.kind === LEAD_SAY_KIND)
+        if (rows.length === 1 && row.kind === RESULT_SHOTS_KIND)
+            outcome = await shotsSender(row);
+        else if (rows.length === 1 && row.kind === LEAD_SAY_KIND)
             outcome = await leadSayOutcome(row);
         else if (quiet && rows.length === 1 && isTaskFact(row))
             outcome = await quietOutcome(row);
@@ -988,6 +1104,11 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
 function isUrgent(notification) {
     return /^decision:\d+$/.test(notification.dedupeKey) || notification.pushClass === "attention" || notification.kind === "acceptance-evidence" || notification.kind === "acceptance-ready";
 }
+/** A routine fact the digest may carry. Screenshots are never urgent (they follow their result message, which the
+ * task's order fence holds them behind) and never a digest line: they go as their own photos once it has gone. */
+function joinsDigest(notification) {
+    return !isUrgent(notification) && notification.kind !== RESULT_SHOTS_KIND;
+}
 /** The digest text: a header with the count and the window, then one
  * fact per entry — its subject, then its body's first line, indented.
  * Plain text, no buttons: nothing in a digest is tappable. */
@@ -1066,8 +1187,19 @@ async function deliverOne(store, botId, binding, sender, notification, clock, ph
         const task = notification.taskId === null ? [] : [{ id: notification.taskId, ...(title === undefined ? {} : { title }) }];
         const words = chatText(`${alreadyAccepted ? "Acceptance recorded" : leadSubjectOf(store, notification, binding.approver)}${body === "" ? "" : `\n\n${body}`}`, task);
         // The task's title once: in front, unless the words already name it.
-        const parts = split(`${notificationIdentity(notification, title !== undefined && mentions(words, title) ? undefined : title)}${words}`);
-        const button = notification.link !== null && !alreadyAccepted && current ? factButton(phoneOrigin, notification.link) : null;
+        // A result, plan, failure or ready pull request acts in place (chat-decide.ts); otherwise its one link.
+        const target = alreadyAccepted || !current ? null : decideTargetOf(notification);
+        const offer = decideOfferFor(store, binding, target, projects, clock(), evidenceRoot);
+        const decided = offer === null ? null : mintDecideButtons(store, decideSeat(binding), target, offer, clock());
+        const parts = split(offer?.text ?? `${notificationIdentity(notification, title !== undefined && mentions(words, title) ? undefined : title)}${words}`);
+        const fallback = offer === null ? decideFallbackLink(target) : null;
+        const button = fallback !== null ? (() => { try {
+            return phoneLinkButton(phoneOrigin?.() ?? null, fallback);
+        }
+        catch {
+            return null;
+        } })()
+            : offer === null && notification.link !== null && !alreadyAccepted && current ? factButton(phoneOrigin, notification.link) : null;
         // A flow card waiting on a decision (v86): Approve, Edit, Send back on the last part, for this visit only.
         const visit = FLOW_DECIDE_KEY.exec(notification.dedupeKey);
         const waiting = visit === null ? null : flowDecisionAt(store, Number(visit[1]), Number(visit[2]));
@@ -1079,16 +1211,22 @@ async function deliverOne(store, botId, binding, sender, notification, clock, ph
         let last = null;
         for (const [index, part] of parts.entries()) {
             const final = index === parts.length - 1;
-            const keyboard = !final ? undefined : keys !== null ? [...keys.keyboard, ...(button === null ? [] : [button])] : button !== null ? [button] : undefined;
+            const decideKeys = decided === null ? [] : decideKeyboard(phoneOrigin, decided.rows);
+            const keyboard = !final ? undefined : keys !== null ? [...keys.keyboard, ...(button === null ? [] : [button])] : decideKeys.length > 0 ? decideKeys : button !== null ? [button] : undefined;
             const sent = await sender(part, keyboard);
-            if (!sent.ok)
+            if (!sent.ok) {
+                if (decided !== null)
+                    dropDecideTokens(store, decided.tokens, clock());
                 return { ok: false, error: sent.error };
+            }
             last = sent.messageId;
         }
         if (flowKeys !== null && last !== null)
             store.placeTelegramFlowActions(flowKeys.tokens, last);
         if (questionKeys !== null && last !== null)
             store.placeTelegramQuestionActions(questionKeys.tokens, last);
+        if (decided !== null && last !== null)
+            placeDecideTokens(store, decided.tokens, last);
         return { ok: true, receipt: receiptFor(botId, binding.chatId, last) };
     }
     // A decision. Every safety-bearing word goes out before anything tappable
@@ -1335,13 +1473,15 @@ async function projectsForTap(context, update) {
     const callback = update.callback_query;
     // Flow decision buttons (v86) work with or without the lead's conversation on this phone.
     const flowTap = callback !== undefined && context.store.getTelegramFlowAction(callback.data ?? "") !== null;
-    if (callback === undefined || context.readProjects === undefined || (context.conversation === undefined && !flowTap))
+    // So do a result's, plan's or pull request's own buttons (chat-decide.ts).
+    const decideTap = callback !== undefined && isDecideToken(context.store, callback.data ?? "");
+    if (callback === undefined || context.readProjects === undefined || (context.conversation === undefined && !flowTap && !decideTap))
         return null;
     const binding = callback.from === undefined ? null : context.store.liveTelegramBindingFor(context.botId, String(callback.from.id));
     if (binding === null || callback.from === undefined ||
         callback.message?.chat === undefined ||
         // Proposal cards and task picks read the chat's project ceiling.
-        (context.store.getTelegramProposalAction(callback.data ?? "") === null && context.store.getTelegramFlowAction(callback.data ?? "") === null && !(callback.data ?? "").startsWith("pick:")))
+        (context.store.getTelegramProposalAction(callback.data ?? "") === null && context.store.getTelegramFlowAction(callback.data ?? "") === null && !decideTap && !(callback.data ?? "").startsWith("pick:")))
         return null;
     const chat = callback.message.chat;
     const chatId = String(chat.id);
@@ -1482,6 +1622,26 @@ function applyMessage(context, update, effects) {
             }
             return;
         }
+        // After Request changes asked "What should change?": the person's next message in their own chat is the feedback.
+        // A reply to some other message (a decision, a result) keeps its own meaning.
+        const decidePrompt = binding !== null && chat.type === "private" && String(chat.id) === binding.chatId && typeof message.text === "string" && message.text.trim() !== "" && !message.text.startsWith("/")
+            ? openPromptFor(store, { channel: "telegram", binding: binding.id, chat: binding.chatId }, clock()) : null;
+        if (binding !== null && decidePrompt !== null && answersPrompt(decidePrompt, message.reply_to_message === undefined ? null : String(message.reply_to_message.message_id))) {
+            const repos = context.projects === null ? [] : telegramConversationRepos(store, binding.approver, context.projects);
+            const answer = applyDecideFeedback(store, decideSeat(binding), decidePrompt, message.text ?? "", repos, context.conversation?.evidenceRoot, clock());
+            effects.push(async () => {
+                let button = null;
+                try {
+                    button = phoneLinkButton(context.conversation?.phoneOrigin?.() ?? null, answer.link);
+                }
+                catch {
+                    button = null;
+                }
+                await transport("sendMessage", { chat_id: binding.chatId, text: answer.said, link_preview_options: { is_disabled: true }, reply_parameters: { message_id: message.message_id },
+                    ...(button === null ? {} : { reply_markup: { inline_keyboard: [button] } }) });
+            });
+            return;
+        }
         // A message to a teammate by name (v96), in the person's own chat: a card on its desk, and the answer comes back here.
         if (binding !== null && message.reply_to_message === undefined && message.chat?.type === "private" && String(chat.id) === binding.chatId && store.accountOf(binding.approver)?.role === "approver") {
             const repos = context.projects === null ? store.knownRepos().filter(repo => store.accountCanAccess(binding.approver, repo)) : telegramConversationRepos(store, binding.approver, context.projects);
@@ -1881,6 +2041,14 @@ function applyCallback(context, update, effects) {
     const binding = from === undefined ? null : store.liveTelegramBindingFor(botId, String(from.id));
     const tapChat = message?.chat === undefined ? null : String(message.chat.id);
     const followedGroup = tapChat !== null && binding !== null && tapChat !== binding.chatId && store.telegramTeamChat(botId, tapChat)?.kind === "group";
+    // A result's, plan's, failure's or pull request's own buttons act only in the paired person's own chat; a tap
+    // anywhere else is still answered, so the button never just spins.
+    if (isDecideToken(store, token) && (binding === null || tapChat === null || tapChat !== binding.chatId)) {
+        report.ignored++;
+        ack(binding === null ? "These buttons work only for the person they were sent to. Nothing was done."
+            : "These buttons work only in your own chat with the bot. Nothing was done.");
+        return;
+    }
     if (binding === null ||
         from === undefined ||
         message === undefined ||
@@ -2010,6 +2178,56 @@ function applyCallback(context, update, effects) {
         editText(`${message.text ?? ask.question}\n\nYou chose: ${option}`.slice(0, 4000));
         return;
     }
+    // A result's, plan's, failure's or pull request's own buttons (chat-decide.ts): in the person's own chat only.
+    if (isDecideToken(store, token)) {
+        const repos = context.projects === null ? null : telegramConversationRepos(store, binding.approver, context.projects);
+        if (repos === null) {
+            ack("Your projects couldn't be read just now. Try again.");
+            return;
+        }
+        const messageId = String(message.message_id);
+        const tapped = applyDecideTap(store, decideSeat(binding), { token, message: messageId, shown: message.text ?? "", repos, ...(context.conversation === undefined ? {} : { root: context.conversation.evidenceRoot }), now: clock() });
+        if (tapped === null) {
+            report.ignored++;
+            ack("That button doesn't do anything now.");
+            return;
+        }
+        if (tapped.ignored === true)
+            report.ignored++;
+        ack(tapped.ack.slice(0, 190));
+        if (tapped.edit !== undefined)
+            editText(tapped.edit.text.slice(0, 4000), decideKeyboard(context.conversation?.phoneOrigin, tapped.edit.rows));
+        if (tapped.prompt !== undefined) {
+            const prompt = tapped.prompt;
+            effects.push(async () => {
+                const answer = await transport("sendMessage", { chat_id: binding.chatId, text: prompt.text, link_preview_options: { is_disabled: true },
+                    reply_parameters: { message_id: message.message_id }, reply_markup: { force_reply: true, input_field_placeholder: "What should change?" } });
+                const id = answer.result?.message_id;
+                if (answer.ok && Number.isSafeInteger(id))
+                    placeDecidePrompt(store, prompt.id, String(id));
+            });
+        }
+        if (tapped.merge !== undefined) {
+            const merge = tapped.merge, shown = tapped.edit?.text ?? message.text ?? "";
+            // GitHub is a network call: after the tap's transaction, then the card says how it went.
+            effects.push(async () => {
+                let merged;
+                try {
+                    merged = context.conversation?.merge !== undefined ? await context.conversation.merge({ runId: merge.runId, by: merge.by })
+                        : await mergePullRequest(store, { runId: merge.runId, by: merge.by, clock });
+                }
+                catch {
+                    merged = { ok: false, message: "GitHub couldn't be reached just now. Try again from the task." };
+                }
+                // The ledger says what happened, failure included, once GitHub has answered.
+                recordChatMerge(store, merge, merged.ok ? { ok: true } : { ok: false, message: merged.message }, clock());
+                // A merge that didn't land keeps a way to the task.
+                await transport("editMessageText", { chat_id: binding.chatId, message_id: message.message_id, text: mergedText(shown, merged.ok ? { ok: true } : { ok: false, message: merged.message }).slice(0, 4000),
+                    link_preview_options: { is_disabled: true }, reply_markup: { inline_keyboard: merged.ok ? [] : decideKeyboard(context.conversation?.phoneOrigin, linksFor({ kind: "merge", taskId: merge.taskId, run: merge.runId })) } });
+            });
+        }
+        return;
+    }
     const action = store.getTelegramAction(token);
     if (action === null && context.conversation !== undefined && store.getTelegramProposalAction(token) !== null) {
         // A proposal card's button: the shared confirm door, inside this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.17",
+  "version": "0.9.19",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"