@claw-link/gateway-host 0.3.15 → 0.3.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.3.15",
+  "version": "0.3.18",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/scripts/install.js

@@ -724,11 +724,25 @@ async function drainToIdle({ timeoutMs = 15 * 60 * 1000, force = false, onWait }
   // where an interrupt could leave the worker drained. Don't install a handler here.
   const startedAt = Date.now();
   let waited = false;
+  let claimOnlySince = 0; // busy with ZERO active jobs = just a poll round-trip, not real work
   while (Date.now() - startedAt < timeoutMs) {
     const s = control.liveStatus();
     if (!s) return { hadWorker: true, drained: true, workerGone: true };  // worker exited → safe
     // Safe to restart only once the worker has ACKED the drain (won't claim more) AND is idle.
     if (s.drain && !s.busy) return { hadWorker: true, drained: true, waited };
+    // Wedge escape: "busy" caused ONLY by an in-flight claim (no running job) that never clears —
+    // e.g. an older worker whose HTTP call to a dead backend hangs without a timeout. A claim
+    // round-trip is seconds; 90s of claim-only busy means it's stuck, and a restart can't lose
+    // work because no job is actually running.
+    if (s.drain && s.busy && Number(s.activeJobs) === 0) {
+      if (!claimOnlySince) claimOnlySince = Date.now();
+      if (Date.now() - claimOnlySince > 90_000) {
+        console.log('\n  ⚠ Worker reports busy with no running job for 90s (stuck network call) — proceeding with the restart.');
+        return { hadWorker: true, drained: true, waited, wedged: true };
+      }
+    } else {
+      claimOnlySince = 0;
+    }
     if (s.busy && typeof onWait === 'function') { onWait(s); waited = true; }
     await sleep(1500);
   }

package/src/bridge.js

@@ -15,15 +15,29 @@ class Bridge {
   }
 
   async _post(action, extra) {
-    const res = await fetch(this.url, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Authorization: `Bearer ${this.token}`,
-      },
-      // agent_id is only a hint (the token resolves the agent); machine_id binds the host.
-      body: JSON.stringify({ action, agent_id: this.agentId || undefined, machine_id: this.machineId, ...extra }),
-    });
+    // Hard request timeout: a dead/paused backend must FAIL a call, never hang it — a hung claim
+    // pins claimsInFlight, which reports the worker "busy" forever and wedges graceful update's
+    // drain-wait. 45s covers slow uplinks posting large complete() payloads.
+    const ac = new AbortController();
+    const kill = setTimeout(() => ac.abort(), Number(process.env.CLAWHOST_HTTP_TIMEOUT_MS) || 45_000);
+    let res;
+    try {
+      res = await fetch(this.url, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${this.token}`,
+        },
+        // agent_id is only a hint (the token resolves the agent); machine_id binds the host.
+        body: JSON.stringify({ action, agent_id: this.agentId || undefined, machine_id: this.machineId, ...extra }),
+        signal: ac.signal,
+      });
+    } catch (e) {
+      if (ac.signal.aborted) { const err = new Error(`host-bridge ${action} timed out`); err.status = 0; throw err; }
+      throw e;
+    } finally {
+      clearTimeout(kill);
+    }
     let data = null;
     try { data = await res.json(); } catch { /* non-json */ }
     if (!res.ok) {
@@ -40,7 +54,9 @@ class Bridge {
   claim() { return this._post('claim', { instance_id: this.instanceId }); }
   // Multiplexed poll: ONE invocation authenticates all the host's agent tokens, refreshes their
   // liveness (replacing per-agent heartbeats), and claims up to capacities[i] jobs per agent.
-  claimAll(tokens, capacities) { return this._post('claim_all', { tokens, capacities, instance_id: this.instanceId }); }
+  // `active` = in-flight job ids; the server bumps their keepalive so the reaper knows the
+  // difference between a long-running job and a host that died mid-job.
+  claimAll(tokens, capacities, active) { return this._post('claim_all', { tokens, capacities, active, instance_id: this.instanceId }); }
   stream(jobId, seq, type, content) { return this._post('stream', { job_id: jobId, seq, type, content }); }
   complete(jobId, finalContent, metadata) { return this._post('complete', { job_id: jobId, final_content: finalContent, metadata: metadata || {} }); }
   fail(jobId, error) { return this._post('fail', { job_id: jobId, error: String(error).slice(0, 1000) }); }

package/src/worker.js

@@ -199,7 +199,9 @@ async function multiplexLoop(slots, cfg, p2p) {
     let errored = false;
     claimsInFlight++; // busy for the whole round-trip — preserves the graceful-drain guarantee
     try {
-      const r = await primary.claimAll(tokens, capacities);
+      // `active` = in-flight job ids: the server bumps their keepalive (touched_at) so the
+      // reaper never expires a job this host is still running (long builds are legitimate).
+      const r = await primary.claimAll(tokens, capacities, [...activeJobIds]);
       claimFails = 0;
       for (const job of r.jobs || []) {
         const slot = slots.find((s) => s.agent.agent_id === job.agent_id);
@@ -336,12 +338,27 @@ async function startWorker() {
 
   // Register every agent up-front, then poll with ONE multiplexed claim_all per tick for the
   // whole host (falls back to legacy per-agent loops against an older server).
-  const slots = [];
+  let slots = [];
   for (const a of agents) {
     const s = await prepareAgent(a, raw);
     if (s) slots.push(s);
   }
-  if (!slots.length) { logger.error('No agent could register — check Host Tokens (clhost doctor).'); return; }
+  // No agent registered (rotated/dead tokens, or the backend was migrated): DON'T exit — launchd
+  // would just crash-loop us and the status file would flap, confusing `clhost update`. Stay
+  // alive (status keeps publishing "live + idle") and retry registration every 60s; `clhost link`
+  // restarts the service anyway the moment new tokens arrive.
+  while (!slots.length && !stopping) {
+    logger.error('No agent could register — tokens rotated or invalid. Retrying in 60s (fix with: clhost link <code> · clhost retoken <id> · clhost doctor).');
+    const until = Date.now() + 60_000;
+    while (Date.now() < until && !stopping) await sleep(1000);
+    if (stopping) return;
+    slots = [];
+    for (const a of agents) {
+      const s = await prepareAgent(a, raw);
+      if (s) slots.push(s);
+    }
+  }
+  if (stopping) return;
   const mode = await multiplexLoop(slots, raw, p2p);
   if (mode === 'legacy') {
     logger.warn('server has no claim_all yet — using per-agent polling (update the ClawLink backend to cut invocations)');