@inetafrica/open-claudia 2.6.55 → 2.6.56

package/.env.example

@@ -21,6 +21,9 @@ CLAUDE_MODEL=claude-fable-5
 CURSOR_PATH=
 CODEX_PATH=
 AUTO_COMPACT_TOKENS=280000
+# Inactivity watchdog: kill a heavy turn's child if it emits no output for
+# this many ms, so a hung tool call can't wedge the bot. Default 600000 (10min).
+OC_TURN_IDLE_MS=600000
 USAGE_ALERT_CONTEXT_TOKENS=120000
 USAGE_ALERT_RATE_MULTIPLIER=1.75
 USAGE_ALERT_BASELINE_TURNS=20

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## v2.6.56
+- **Stop a single hung child from wedging the whole bot.** Agent mode is single-flight: a heavy turn spawns one child and sets a global `runningProcess` flag; while it's set, every new message is demoted to a lightweight side-chat instead of a full turn. That flag is *only* ever cleared by the child's `close`/`error` events — so a child that hangs (a wedged tool call that never returns) pins it forever. That's exactly what happened: one turn went silent, its child never exited, and from then on the bot stayed alive (health checks passed) but answered nothing of substance — every later message fell through to a side-chat that also couldn't make progress. The fix is an **inactivity watchdog** in `runClaude` (`bot-agent.js`): track `lastActivity`, bumped on every `stdout`/`stderr` chunk from the child, and inside the existing progress-update loop (which already ticks every 2–5s while a task runs) kill the child if it produces no output for longer than the idle limit — SIGTERM to the process group, SIGKILL 3s later, plus a 10s failsafe that force-clears the flag if `close` somehow never fires. The watchdog short-circuits the close handler so the user gets one clear "task stalled — stopped it, I'm responsive again, send /continue" message instead of a confusing "(no output)". Default idle limit is 10 minutes, tunable via `OC_TURN_IDLE_MS`. Deliberately scoped to the wedge only — the v2.6.55 polling fix is healthy and untouched.
+
 ## v2.6.55
 - **Make fixing a tool as cheap as creating one.** The tool subsystem was structurally tilted toward sprawl: creating a tool was a trusting one-liner with no validation, while *fixing* one had no verb at all — so the path of least resistance was always another near-duplicate. This release closes that gap from both ends. **A first-class fix verb:** `open-claudia tool set <name> [--desc|--pack|--requires|--usage]` rewrites a tool's header metadata in place (new `updateToolHeader()` in `core/tools.js`) — it refreshes only the recognised field lines, preserving the marker, any hand-written comments, and the immutable `createdAt`, and never touches the body. `open-claudia tool edit <name>` prints the source path (stdout) so the agent's Edit/Write or the user's `$EDITOR` can open it directly, with the metadata-only hint on stderr. **An add-time safety net** (all advisory, never blocking — a tool the agent just wrote is usually right): `tool add`/`tool set` now lint the source and surface (1) hardcoded secrets — `sk-ant-`/`sk-proj-`/`sk-`/`AKIA`/`gh*_`/`xox*`/PEM/inline-Bearer literals that should be `$KEYRING` refs, mirroring the redactor; (2) requires/keyring mismatches — keyring keys the script reads but `--requires` omits (with a ready-to-paste `tool set` fix), and declared keys it never reads; (3) syntax errors via the script's own interpreter (`bash -n` / `node --check` / `py_compile`, silent when the interpreter or type is unknown — never cries wolf); and (4) a dangling `--pack` link to a pack that doesn't exist. **Immutable creation telemetry:** the `.usage.json` sidecar now stamps `createdAt` once at add-time (surfaced on every tool record); the nightly dream's "cold since creation" check ages by this stamp instead of file mtime, so a body edit can no longer reset a never-run tool's staleness clock (falls back to mtime for tools created before the stamp existed). Extends `test-tools.js` (createdAt immutability, `envRefsIn`, `lintToolSource`, `checkSyntax`, `updateToolHeader`).
 - **Stop the phantom-outage restart storm — just keep polling.** The Telegram adapter was killing the bot over network blips that weren't real. A side-by-side network monitor (probing 1.1.1.1 *and* api.telegram.org every 60s) showed the connection healthy throughout, yet `bot.log` had logged 20k+ `EFATAL: read ETIMEDOUT` → "Network lost" events: the long-poll's pooled keep-alive socket goes stale on a macOS sleep/wake or an idle-NAT eviction, and every reused poll then times out instantly. The old handler treated *any* such timeout as a lost network — loudly stopping/restarting polling and, after 6 quick attempts (a sleep/wake error burst exhausts those in seconds), calling `process.exit(1)` for launchd to relaunch. That voluntary suicide *was* the "why does it keep restarting" the bot kept doing. Three changes in `channels/telegram/adapter.js`: (1) **fresh socket per poll** (`keepAlive:false`) so there's no pooled socket to go stale — the root of the ETIMEDOUT storm; (2) **gentle, throttled recovery** — a transient timeout no longer screams or tears down on the first hit (with keep-alive off the next poll self-heals on a new connection); it logs at most once a minute and only actively restarts polling if errors persist; (3) **never exit over a network blip** — only a `409 Conflict` (a second poller on the same token) exits immediately; a genuinely wedged loop now has to fail unbroken for a full 10 minutes before a clean relaunch, versus the old ~90s hair-trigger. The diagnostic `netmon.sh` that proved the network was fine stays running.

package/bot-agent.js

@@ -1259,6 +1259,16 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   const startTime = Date.now();
   let longRunningNotified = false;
 
+  // Inactivity watchdog. The single-flight `runningProcess` flag is only
+  // cleared by this child's close/error events, so a child that hangs
+  // (e.g. a wedged tool call) pins the flag forever and demotes every later
+  // message to a side-chat. Track the last time the child produced output;
+  // if it goes silent past the idle limit, kill it so the flag clears and
+  // the bot responds again. Tune with OC_TURN_IDLE_MS (default 10min).
+  const idleLimitMs = Math.max(60000, parseInt(process.env.OC_TURN_IDLE_MS, 10) || 10 * 60 * 1000);
+  let lastActivity = Date.now();
+  let watchdogTripped = false;
+
   let lastUpdate = "";
   // Adaptive update interval: 2s for first 2min, then 5s to avoid rate limits
   const scheduleUpdate = () => {
@@ -1268,6 +1278,29 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   };
   const updateProgress = async () => {
     const elapsed = Math.floor((Date.now() - startTime) / 1000);
+    // Inactivity watchdog: kill a child that has gone silent past the idle limit.
+    if (!watchdogTripped && runningProcess === proc && Date.now() - lastActivity > idleLimitMs) {
+      watchdogTripped = true;
+      const idleMin = Math.floor((Date.now() - lastActivity) / 60000);
+      const pid = proc.pid;
+      console.error(`[watchdog] child pid ${pid} idle ${idleMin}min (limit ${Math.floor(idleLimitMs / 60000)}min) — killing`);
+      try { process.kill(-pid, "SIGTERM"); } catch (e) {
+        try { proc.kill("SIGTERM"); } catch (e2) {}
+      }
+      setTimeout(() => { try { process.kill(-pid, "SIGKILL"); } catch (e) {} }, 3000);
+      // Failsafe: if close never fires, force-clear so the bot recovers anyway.
+      setTimeout(() => {
+        if (runningProcess === proc) {
+          runningProcess = null; runningProcessPrompt = null;
+          clearTimeout(streamInterval); streamInterval = null;
+        }
+      }, 10000);
+      try {
+        await send(`Task stalled — no activity for ${idleMin}min, so I stopped it and I'm responsive again. Send /continue to resume, or just re-ask.`);
+      } catch (e) {}
+      statusMessageId = null;
+      return; // stop the progress loop; close (or failsafe) clears state
+    }
     try {
       bot.sendChatAction(CHAT_ID, "typing").catch(() => {});
       const display = formatProgress(assistantText, toolUses, currentTool, elapsed, currentToolDetail);
@@ -1292,6 +1325,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   scheduleUpdate();
 
   proc.stdout.on("data", (data) => {
+    lastActivity = Date.now();
     streamBuffer += data.toString();
     const events = parseStreamEvents(streamBuffer);
     const lastNewline = streamBuffer.lastIndexOf("\n");
@@ -1367,6 +1401,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
 
   let stderrBuffer = "";
   proc.stderr.on("data", (d) => {
+    lastActivity = Date.now();
     const chunk = d.toString();
     stderrBuffer += chunk;
     console.error("STDERR:", redactSensitive(chunk));
@@ -1375,6 +1410,13 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   proc.on("close", async (code) => {
     runningProcess = null; runningProcessPrompt = null;
     clearTimeout(streamInterval); streamInterval = null;
+    if (watchdogTripped) {
+      // The inactivity watchdog already notified the user and killed the
+      // child; don't also deliver partial / "(no output)" text.
+      statusMessageId = null;
+      if (settings.budget) settings.budget = null;
+      return;
+    }
     if (settings.backend !== "cursor" && isClaudeAuthErrorText(stderrBuffer)) {
       await send(claudeAuthRecoveryMessage(stderrBuffer.trim().slice(-800)), { replyTo: replyToMsgId });
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.6.55",
+  "version": "2.6.56",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {