Fix 5 compatibility issues in Telegram Phase 4

Issues found and fixed during compatibility review:

CRITICAL:
1. Handler.Approver data race — goroutines racing on shared pointer
   → Replaced single *TelegramApprover with sync.Map keyed by chatID
   → Added SetApprover/GetApprover/DeleteApprover methods on Handler
   → handleCallback now looks up approver by callback's chat ID

2. /new command NPE — nil Approver dereference when no message processed yet
   → Now uses handler.GetApprover(chatID) which returns nil gracefully

MEDIUM:
3. Same-chat message racing — two rapid messages corrupt session history
   → Added per-chat sync.Mutex serialization via chatMu sync.Map
   → handleChatMessage locks per-chat before processing

MINOR:
4. Dead os import + dead code in approver.go — removed

CONFIRMED OK:
5. Project-level config — LoadConfig always loads ./odek.json, confirmed

Author: jkyberneees

cmd/odek/telegram.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/signal"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -17,6 +18,17 @@ import (
 	"github.com/BackendStack21/kode/internal/telegram"
 )
 
+// chatMu serializes agent processing per chat to prevent same-chat message
+// racing. Each chat gets its own mutex; messages from the same chat are
+// processed sequentially, preserving session history integrity.
+var chatMu sync.Map // map[int64]*sync.Mutex
+
+// getChatMutex returns the per-chat mutex for the given chat ID.
+func getChatMutex(chatID int64) *sync.Mutex {
+	v, _ := chatMu.LoadOrStore(chatID, &sync.Mutex{})
+	return v.(*sync.Mutex)
+}
+
 // telegramCmd is the entry point for "odek telegram".
 func telegramCmd(args []string) error {
 	// 1. Load config from all sources (file → env).
@@ -85,8 +97,8 @@ func telegramCmd(args []string) error {
 		// Handle /new — clear session and reset trust in the approver.
 		if cmdName == "new" {
 			sessionManager.Delete(chatID)
-			if handler.Approver != nil {
-				handler.Approver.ResetTrust()
+			if a := handler.GetApprover(chatID); a != nil {
+				a.ResetTrust()
 			}
 		}
 
@@ -164,9 +176,16 @@ func handleChatMessage(
 	resolved	config.ResolvedConfig,
 	systemMessage string,
 ) {
+	// Serialize per chat: only one agent loop runs per chat at a time.
+	// Prevents same-chat message racing that would corrupt session history.
+	mu := getChatMutex(chatID)
+	mu.Lock()
+	defer mu.Unlock()
+
 	// Create a per-chat TelegramApprover for inline keyboard approval.
 	approver := telegram.NewTelegramApprover(bot, chatID)
-	handler.Approver = approver
+	handler.SetApprover(chatID, approver)
+	defer handler.DeleteApprover(chatID)
 
 	// Get or create the session for this chat.
 	cs, err := sessionManager.GetOrCreate(chatID)

internal/telegram/approver.go

@@ -4,7 +4,6 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"fmt"
-	"os"
 	"strings"
 	"sync"
 	"time"
@@ -218,12 +217,3 @@ func (a *TelegramApprover) ResetTrust() {
 	a.trusted = make(map[danger.RiskClass]bool)
 	a.mu.Unlock()
 }
-
-// ── File descriptor check ──────────────────────────────────────────────────
-
-// ensureApproverHasFD is a no-op on Telegram (no TTY needed).
-// Kept for interface compatibility — never called directly.
-var _ = func() string {
-	// Satisfy the os import
-	return os.DevNull
-}

internal/telegram/handler.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"sync"
 )
 
 // ─── Config ────────────────────────────────────────────────────────────────
@@ -24,11 +25,10 @@ type Handler struct {
 	Bot    *Bot
 	Config HandlerConfig
 
-	// Approver handles inline keyboard approval requests for dangerous
-	// operations. When non-nil, callback queries with approval prefixes
-	// (apr:/den:/trs:) are routed to Approver.HandleCallback before
-	// reaching OnCallbackQuery.
-	Approver *TelegramApprover
+	// approvers maps chatID → *TelegramApprover for inline keyboard approval
+	// requests. Protected by sync.Map for concurrent read/write from the
+	// update loop (reads) and agent goroutines (writes).
+	approvers sync.Map
 
 	// OnTextMessage is called when a plain text message is received.
 	// Returns the response text (may be empty).
@@ -61,6 +61,29 @@ type Handler struct {
 	OnError func(chatID int64, err error)
 }
 
+// SetApprover stores a TelegramApprover for the given chat ID.
+// Thread-safe: safe to call from any goroutine.
+func (h *Handler) SetApprover(chatID int64, a *TelegramApprover) {
+	h.approvers.Store(chatID, a)
+}
+
+// GetApprover retrieves the TelegramApprover for the given chat ID.
+// Returns nil if no approver is registered. Thread-safe.
+func (h *Handler) GetApprover(chatID int64) *TelegramApprover {
+	v, ok := h.approvers.Load(chatID)
+	if !ok {
+		return nil
+	}
+	a, _ := v.(*TelegramApprover)
+	return a
+}
+
+// DeleteApprover removes the TelegramApprover for the given chat ID.
+// Thread-safe. Used when a session is reset or ends.
+func (h *Handler) DeleteApprover(chatID int64) {
+	h.approvers.Delete(chatID)
+}
+
 // NewHandler creates a Handler with the given bot and default settings.
 func NewHandler(bot *Bot) *Handler {
 	return &Handler{
@@ -233,8 +256,12 @@ func (h *Handler) handleCommand(msg *Message) {
 
 // handleCallback processes a callback query from an inline keyboard.
 func (h *Handler) handleCallback(cq *CallbackQuery) {
-	// Route approval callbacks to the TelegramApprover first.
-	if h.Approver != nil && h.Approver.HandleCallback(cq.Data) {
+	if cq.Message == nil || cq.Message.Chat == nil {
+		return
+	}
+
+	// Route approval callbacks to the per-chat TelegramApprover.
+	if a := h.GetApprover(cq.Message.Chat.ID); a != nil && a.HandleCallback(cq.Data) {
 		// Answer the callback (remove loading state on button).
 		if err := h.Bot.AnswerCallbackQuery(cq.ID, "", false); err != nil {
 			if h.OnError != nil {