@gonzih/cc-tg 0.9.14 → 0.9.15

package/dist/bot.js

@@ -952,8 +952,9 @@ export class CcTgBot {
         await this.bot.sendMessage(chatId, "Clearing npx cache and reloading MCP...");
         try {
             const home = process.env.HOME ?? "~";
-            execSync(`rm -rf "${home}/.npm/_npx/"`, { encoding: "utf8", shell: "/bin/sh" });
-            console.log("[mcp] cleared ~/.npm/_npx/");
+            const npmBase = process.env.npm_config_cache ? join(process.env.npm_config_cache, "..") : `${home}/.npm`;
+            execSync(`rm -rf "${npmBase}/_npx/"`, { encoding: "utf8", shell: "/bin/sh" });
+            console.log(`[mcp] cleared ${npmBase}/_npx/`);
         }
         catch (err) {
             await this.bot.sendMessage(chatId, `Warning: failed to clear npx cache: ${err.message}`);
@@ -995,10 +996,14 @@ export class CcTgBot {
     }
     async handleClearNpxCache(chatId) {
         const home = process.env.HOME ?? "/tmp";
+        // Use the isolated npm cache dir set in the plist (npm_config_cache), not hardcoded ~/.npm
+        const npmBase = process.env.npm_config_cache
+            ? join(process.env.npm_config_cache, "..")
+            : `${home}/.npm`;
         const cleared = [];
         const failed = [];
         // Clear both npx execution cache and full npm package cache
-        for (const dir of [`${home}/.npm/_npx`, `${home}/.npm/cache`]) {
+        for (const dir of [`${npmBase}/_npx`, `${npmBase}/cache`]) {
             try {
                 execSync(`rm -rf "${dir}"`, { encoding: "utf8", shell: "/bin/sh" });
                 cleared.push(dir.replace(home, "~"));
@@ -1022,8 +1027,12 @@ export class CcTgBot {
         await this.bot.sendMessage(chatId, "Clearing cache and restarting... brb.");
         await new Promise(resolve => setTimeout(resolve, 300));
         // Clear npm caches before restart so launchd brings up fresh version
+        // Use isolated npm_config_cache path from plist, not hardcoded ~/.npm
         const home = process.env.HOME ?? "/tmp";
-        for (const dir of [`${home}/.npm/_npx`, `${home}/.npm/cache`]) {
+        const npmBase = process.env.npm_config_cache
+            ? join(process.env.npm_config_cache, "..")
+            : `${home}/.npm`;
+        for (const dir of [`${npmBase}/_npx`, `${npmBase}/cache`]) {
             try {
                 execSync(`rm -rf "${dir}"`, { shell: "/bin/sh" });
             }
@@ -1073,18 +1082,24 @@ export class CcTgBot {
     callCcAgentTool(toolName, args = {}) {
         return new Promise((resolve) => {
             let settled = false;
+            let procRef = null;
             const done = (val) => {
                 if (!settled) {
                     settled = true;
+                    try {
+                        procRef?.kill();
+                    }
+                    catch { }
                     resolve(val);
                 }
             };
             let proc;
             try {
-                proc = spawn("npx", ["-y", "@gonzih/cc-agent@latest"], {
+                proc = spawn("npx", ["--prefer-online", "-y", "@gonzih/cc-agent@latest"], {
                     env: { ...process.env },
                     stdio: ["pipe", "pipe", "pipe"],
                 });
+                procRef = proc;
             }
             catch (err) {
                 console.error("[mcp] failed to spawn cc-agent:", err.message);

package/dist/index.js

@@ -18,12 +18,18 @@ import { createServer, createConnection } from "net";
 import { unlinkSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
+import { createHash } from "crypto";
 import { CcTgBot } from "./bot.js";
-const LOCK_SOCKET = join(tmpdir(), "cc-tg.sock");
-function acquireLock() {
+// Derive socket path from token hash so multiple instances (feral/law/simorgh)
+// never collide, and the path is stable across restarts on the same machine.
+function lockSocketPath(token) {
+    const hash = createHash("sha256").update(token).digest("hex").slice(0, 12);
+    return join(tmpdir(), `cc-tg-${hash}.sock`);
+}
+function acquireLock(socketPath) {
     return new Promise((resolve) => {
         const server = createServer();
-        server.listen(LOCK_SOCKET, () => {
+        server.listen(socketPath, () => {
             // Bound successfully — we own the lock. Socket auto-released on any exit incl. SIGKILL.
             resolve(true);
         });
@@ -33,7 +39,7 @@ function acquireLock() {
                 return;
             }
             // Socket path exists — probe if anything is actually listening
-            const probe = createConnection(LOCK_SOCKET);
+            const probe = createConnection(socketPath);
             probe.on("connect", () => {
                 probe.destroy();
                 console.error("[cc-tg] Another instance is already running. Exiting.");
@@ -42,20 +48,16 @@ function acquireLock() {
             probe.on("error", () => {
                 // Nothing listening — stale socket, remove and retry
                 try {
-                    unlinkSync(LOCK_SOCKET);
+                    unlinkSync(socketPath);
                 }
                 catch { }
                 const retry = createServer();
-                retry.listen(LOCK_SOCKET, () => resolve(true));
+                retry.listen(socketPath, () => resolve(true));
                 retry.on("error", () => resolve(true)); // give up on lock, just start
             });
         });
     });
 }
-const lockAcquired = await acquireLock();
-if (!lockAcquired) {
-    process.exit(1);
-}
 function required(name) {
     const val = process.env[name];
     if (!val) {
@@ -76,6 +78,13 @@ Or add to your shell profile / .env file.
     return val;
 }
 const telegramToken = required("TELEGRAM_BOT_TOKEN");
+// Acquire lock before doing anything else. Socket derived from token hash so
+// multiple instances (different bots / users) never share the same socket.
+const LOCK_SOCKET = lockSocketPath(telegramToken);
+const lockAcquired = await acquireLock(LOCK_SOCKET);
+if (!lockAcquired) {
+    process.exit(1);
+}
 // Accept CLAUDE_CODE_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, or ANTHROPIC_API_KEY
 const claudeToken = process.env.CLAUDE_CODE_TOKEN ??
     process.env.CLAUDE_CODE_OAUTH_TOKEN ??

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gonzih/cc-tg",
-  "version": "0.9.14",
+  "version": "0.9.15",
   "description": "Claude Code Telegram bot — chat with Claude Code via Telegram",
   "type": "module",
   "bin": {