@inetafrica/open-claudia 1.14.6 → 1.14.8

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## v1.14.8
+- Fix: `/stop` and the 6h hard-timeout now walk the full descendant
+  process tree, not just the Claude CLI's process group. Background
+  bashes started with `run_in_background: true` (and other detached
+  children) used to survive the kill and keep running indefinitely —
+  e.g. a polling `until` loop with a broken grep would burn CPU and
+  network for hours after the agent was already dead.
+- Fix: on bot startup, sweep stale `claude login` / `claude setup-token`
+  processes older than 30 minutes. These were left over from previous
+  bot crashes (blocked on stdin forever) and could hold Keychain locks.
+
 ## v1.14.0
 - Claude Code auth management from Telegram: `/auth_status`, `/login`, `/setup_token`, `/use_oauth_token`, and `/clear_oauth_token`
 - Claude subprocesses now receive `CLAUDE_CODE_OAUTH_TOKEN` from config/env/vault when available, avoiding launchd/macOS Keychain auth failures

package/bot-agent.js

@@ -1011,12 +1011,17 @@ async function runClaudeAuthCommand(args, label, opts = {}) {
     pendingClaudeAuthLabel = null;
     const token = opts.captureToken ? extractClaudeToken(output) : null;
     if (token && !tokenStored) tokenStored = saveClaudeOAuthToken(token);
-    const final = redactSensitive(output.trim());
+    const cleaned = redactSensitive(stripTerminalControls(output))
+      .replace(/https?:\/\/github\.com\/vadimdemedes\/ink\S*/gi, "")
+      .trim();
+    const isTtyError = /raw mode is not supported|process\.stdin/i.test(output);
     if (tokenStored) {
       await send(`${label} finished. OAuth token stored for launchd/non-interactive Claude runs.`);
       await sendClaudeAuthStatusSummary("Post-auth check:");
-    } else if (final) {
-      await send(`${label} finished (exit ${code}).\n\n${final.slice(-2500)}`);
+    } else if (isTtyError && opts.captureToken) {
+      await send(`${label} cannot complete from this bot — the Claude CLI needs an interactive terminal for setup-token.\n\nRun this in your Mac terminal:\n  claude setup-token\n\nThen paste the token here with:\n  /use_oauth_token <token>`);
+    } else if (cleaned) {
+      await send(`${label} finished (exit ${code}).\n\n${cleaned.slice(-2500)}`);
       await sendClaudeAuthStatusSummary("Post-auth check:");
     } else {
       await send(`${label} finished (exit ${code}).`);

package/bot.js

@@ -7,16 +7,51 @@ const cron = require("node-cron");
 const Vault = require("./vault");
 const CONFIG_DIR = require("./config-dir");
 
+// ── Process tree helpers ───────────────────────────────────────────
+// Background tools (e.g. Bash run_in_background, /stop on a dev server)
+// often spawn into their own session/group, so a single PGID kill on the
+// Claude CLI doesn't reach them. We walk the descendant tree explicitly
+// and signal each PID. Without this, runaway poll-loops survive
+// indefinitely after the parent CLI is SIGTERMed.
+function descendantPids(rootPid) {
+  const seen = new Set();
+  const queue = [Number(rootPid)];
+  while (queue.length) {
+    const pid = queue.shift();
+    if (!pid || seen.has(pid)) continue;
+    seen.add(pid);
+    try {
+      const out = execSync(`pgrep -P ${pid}`, { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+      for (const line of out.split("\n")) {
+        const child = Number(line.trim());
+        if (child) queue.push(child);
+      }
+    } catch (e) {
+      // pgrep exits 1 when no children — ignore.
+    }
+  }
+  seen.delete(Number(rootPid));
+  return [...seen];
+}
+
+function killProcessTree(rootPid, signal = "SIGTERM") {
+  if (!rootPid) return;
+  const descendants = descendantPids(rootPid);
+  // Kill the process group first (covers the common case quickly).
+  try { process.kill(-rootPid, signal); } catch (e) {}
+  try { process.kill(rootPid, signal); } catch (e) {}
+  // Then mop up any descendants that escaped the group (detached
+  // children with their own session — e.g. bash run_in_background).
+  for (const pid of descendants) {
+    try { process.kill(pid, signal); } catch (e) {}
+  }
+}
+
 // ── Graceful shutdown & error handling ─────────────────────────────
 async function gracefulShutdown(signal) {
   console.log(`Received ${signal}, shutting down gracefully...`);
-  // Stop any running Claude process
   if (typeof runningProcess !== "undefined" && runningProcess) {
-    try {
-      process.kill(-runningProcess.pid, "SIGTERM");
-    } catch (e) {
-      try { runningProcess.kill("SIGTERM"); } catch (e2) {}
-    }
+    killProcessTree(runningProcess.pid, "SIGTERM");
   }
   // Clean up temp media files older than 1 hour
   try {
@@ -1073,12 +1108,17 @@ async function runClaudeAuthCommand(args, label, opts = {}) {
     pendingClaudeAuthLabel = null;
     const token = opts.captureToken ? extractClaudeToken(output) : null;
     if (token && !tokenStored) tokenStored = saveClaudeOAuthToken(token);
-    const final = redactSensitive(output.trim());
+    const cleaned = redactSensitive(stripTerminalControls(output))
+      .replace(/https?:\/\/github\.com\/vadimdemedes\/ink\S*/gi, "")
+      .trim();
+    const isTtyError = /raw mode is not supported|process\.stdin/i.test(output);
     if (tokenStored) {
       await send(`${label} finished. OAuth token stored for launchd/non-interactive Claude runs.`);
       await sendClaudeAuthStatusSummary("Post-auth check:");
-    } else if (final) {
-      await send(`${label} finished (exit ${code}).\n\n${final.slice(-2500)}`);
+    } else if (isTtyError && opts.captureToken) {
+      await send(`${label} cannot complete from this bot — the Claude CLI needs an interactive terminal for setup-token.\n\nRun this in your Mac terminal:\n  claude setup-token\n\nThen paste the token here with:\n  /use_oauth_token <token>`);
+    } else if (cleaned) {
+      await send(`${label} finished (exit ${code}).\n\n${cleaned.slice(-2500)}`);
       await sendClaudeAuthStatusSummary("Post-auth check:");
     } else {
       await send(`${label} finished (exit ${code}).`);
@@ -1173,17 +1213,13 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   const startTime = Date.now();
   let longRunningNotified = false;
 
-  // Hard timeout to prevent runaway processes
+  // Hard timeout to prevent runaway processes. We walk the descendant
+  // tree (not just the PGID) so that detached background bashes — like
+  // `run_in_background: true` poll loops — get cleaned up too.
   const processTimeout = setTimeout(async () => {
     if (runningProcess === proc) {
-      try {
-        process.kill(-proc.pid, "SIGTERM");
-        setTimeout(() => {
-          try { process.kill(-proc.pid, "SIGKILL"); } catch (e) {}
-        }, 5000);
-      } catch (e) {
-        try { proc.kill("SIGKILL"); } catch (e2) {}
-      }
+      killProcessTree(proc.pid, "SIGTERM");
+      setTimeout(() => killProcessTree(proc.pid, "SIGKILL"), 5000);
       await send(`Task timed out after ${MAX_PROCESS_TIMEOUT / 60000} minutes. Stopped.`);
     }
   }, MAX_PROCESS_TIMEOUT);
@@ -1692,16 +1728,10 @@ bot.onText(/\/stop/, async (msg) => {
   if (!isAuthorized(msg)) return;
   if (runningProcess) {
     const pid = runningProcess.pid;
-    try {
-      // Kill entire process group to catch child processes (dev servers, etc.)
-      process.kill(-pid, "SIGTERM");
-    } catch (e) {
-      try { runningProcess.kill("SIGTERM"); } catch (e2) {}
-    }
-    // Force kill after 3 seconds if still alive
-    setTimeout(() => {
-      try { process.kill(-pid, "SIGKILL"); } catch (e) {}
-    }, 3000);
+    // Walk the descendant tree so detached children (background bashes,
+    // dev servers) get cleaned up, not just the PGID.
+    killProcessTree(pid, "SIGTERM");
+    setTimeout(() => killProcessTree(pid, "SIGKILL"), 3000);
     runningProcess = null;
     if (streamInterval) clearTimeout(streamInterval);
     messageQueue = [];
@@ -2201,6 +2231,36 @@ try {
   console.warn("Setup check skipped:", e.message);
 }
 
+// Sweep stale `claude login` / `claude setup-token` processes that
+// survived a previous bot crash. They're blocked on stdin forever and
+// can hold keychain locks / resources. Anything older than 30 minutes
+// is assumed to be abandoned.
+try {
+  const out = execSync(
+    `ps -axo pid,etime,command | awk '/claude (login|setup-token)/ && !/awk/'`,
+    { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] },
+  );
+  for (const line of out.split("\n")) {
+    const m = line.trim().match(/^(\d+)\s+(\S+)\s/);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    const elapsed = m[2]; // [DD-]HH:MM:SS or MM:SS
+    const minutes = elapsed.includes("-")
+      ? Number(elapsed.split("-")[0]) * 24 * 60 + 60 // any "DD-" form is ≥1 day
+      : elapsed.split(":").length === 3
+        ? Number(elapsed.split(":")[0]) * 60 + Number(elapsed.split(":")[1])
+        : Number(elapsed.split(":")[0]);
+    if (minutes >= 30) {
+      try {
+        process.kill(pid, "SIGTERM");
+        console.log(`Swept stale auth process pid=${pid} elapsed=${elapsed}`);
+      } catch (e) {}
+    }
+  }
+} catch (e) {
+  // ps/awk not available or no matches — fine.
+}
+
 initCrons();
 console.log("Claude Code Telegram bot running");
 console.log(`Workspace: ${WORKSPACE}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "1.14.6",
+  "version": "1.14.8",
   "description": "Your always-on AI coding assistant — Claude Code via Telegram",
   "main": "bot.js",
   "bin": {