@inetafrica/open-claudia 3.0.13 → 3.0.15

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v3.0.15 — the owner keeps their memory on Kazee
+
+- **Episodic recall no longer goes dark on Kazee / group chats.** Cross-conversation episodic memory (relevant snippets from the owner's past transcripts) is deliberately owner-only. The gate that decides "is this speaker the owner?" resolved the person by `findByHandle(adapter, channelId)` — but on Kazee the `channelId` is the *chat/room id*, while the owner's stored handle is their Kazee *user id*, so the lookup missed and fail-closed suppressed episodes. The owner's canonical brain, settings, and session were shared via identity unification, but this one recall layer silently went quiet — which read as "less context on Kazee." The gate now resolves the speaker by the envelope's **canonical user id** first (derived from the authenticated sender and unified across a person's linked channels), falling back to the channelId handle lookup when no canonical is in context. Fail-closed semantics for non-owners are preserved: a non-owner's canonical never matches an owner record. Regression pinned in `test-recall-relationship-gate.js` (owner recognised via canonical on a room-id channel; external still blocked).
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically (FROM the pre-baked `:base`). Existing pods pick this up on their next approved upgrade.
+
+## v3.0.14 — the Telegram poll stops wedging, and every reboot says why
+
+- **Root-cause fix for the restart flap.** In the cluster, DNS hands back a dead IPv6 address for `api.telegram.org` first and IPv6 egress is unreachable; under Node's default `verbatim` resolution the long-poll dials the dead address first (a latency penalty always, and a hard wedge on any AAAA-only window). `bot.js` now sets `dns.setDefaultResultOrder("ipv4first")` before any socket opens, eliminating that path for every request the process makes.
+- **Half-open long-polls now fail fast instead of wedging for 10 minutes.** The Telegram `request` block gained `timeout: 40000` — with keep-alive off, `request` arms a socket-idle timeout, so a poll whose socket silently dies is killed (`ESOCKETTIMEDOUT` → `EFATAL` → hiccup → heal on a fresh socket) in ~40s rather than sitting dead until the 10-minute backstop calls `process.exit(1)` and the pod restarts. 40s sits safely above the 30s long-poll hold so healthy idle polls are never chopped; `ESOCKETTIMEDOUT` was also added explicitly to the transient-error classifier.
+- **Every code-initiated reboot now reports its reason.** New `core/restart-reason.js` records *why* right before any deliberate exit (polling-wedge, uncaught exception, boot failure, graceful SIGTERM/SIGINT, `/restart`, `/upgrade`, runtime-mode switch); the "Back online" greeting reads and clears it and appends `↳ Reboot reason: …`. No record on boot ⇒ an external hard restart (SIGKILL, OOM, host or k8s force-restart) that nothing could log — the greeting says so explicitly. This turns a silent "Back online" into an actionable one.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically (FROM the pre-baked `:base`). Existing pods pick this up on their next approved upgrade.
+
 ## v3.0.13 — chat with the bot from its own dashboard
 
 - **The web dashboard gains a Chat tab — a real channel, not a side door.** A new in-process `WebAdapter` (`channels/web/`) registers as a first-class channel whenever the web UI is up: messages typed in the dashboard flow through the same router, identity, packs, transcripts, and approval pipeline as Telegram/Kazee/voice, and the bot's replies (including inline approval buttons, files, voice notes, live typing) stream back over `/api/chat/stream` (SSE with history replay on connect). New session-gated routes: `GET /api/chat/stream`, `POST /api/chat/send`, `POST /api/chat/action`, `GET /api/chat/media/<id>`. The channel is fixed single-owner (`web-owner`): the dashboard session already gates every call, so `access.js`/`identity.js` authorize it as the owner and — under unified identity — it resolves to the owner's canonical brain like every other owner channel.

package/bot.js

@@ -6,6 +6,13 @@
 //   - Handle process signals + crash notifications.
 // Heavy lifting lives in core/* and channels/*; this file is just the wire.
 
+// Prefer IPv4 for every DNS lookup in this process. In the cluster, DNS returns
+// a dead IPv6 address for api.telegram.org first and IPv6 egress is unreachable;
+// with Node's default 'verbatim' order the Telegram long-poll dials the dead
+// address first (250-600ms penalty, and a hard wedge on any AAAA-only window).
+// ipv4first removes that path. Must run before any module opens a socket.
+require("dns").setDefaultResultOrder("ipv4first");
+
 const path = require("path");
 const fs = require("fs");
 const { execSync } = require("child_process");
@@ -134,6 +141,7 @@ async function gracefulShutdown(signal) {
     }
   } catch (e) {}
   persist();
+  try { require("./core/restart-reason").recordExitReason(`Graceful shutdown on ${signal} (external stop/rollout/scale)`, { code: 0 }); } catch (e) {}
   process.exit(0);
 }
 
@@ -183,6 +191,7 @@ function notifyError(label, err) {
 
 process.on("uncaughtException", (err) => {
   notifyError("Uncaught exception", err);
+  try { require("./core/restart-reason").recordExitReason(`Uncaught exception: ${err?.message || err}`, { code: 1 }); } catch (e) {}
   try { persist(); } catch (e) {}
   setTimeout(() => process.exit(1), 2000);
 });
@@ -303,10 +312,16 @@ setInterval(checkForUpdates, 5 * 60 * 1000);
   // chat_id — boot onboarding below opens the DM when outreach is needed.
   // Skipped entirely pre-onboarding: a fresh pod's first words should be
   // the onboarding greeting, not "Back online".
+  // Consume (and clear) the exit reason once, up front: a code-initiated exit
+  // recorded why; no record ⇒ an external hard restart nothing could log.
+  const exitInfo = require("./core/restart-reason").consumeExitReason();
+  const reasonLine = exitInfo
+    ? `\n↳ Reboot reason: ${exitInfo.reason}`
+    : "\n↳ Reboot reason: external / hard restart — no code-side reason recorded (e.g. SIGKILL, OOM, host or k8s force-restart).";
   for (const a of adapters) {
     try {
       if (a.type === "telegram" && CHAT_ID && isOnboarded()) {
-        await a.send(CHAT_ID, `Back online and ready! Running v${CURRENT_VERSION}.`);
+        await a.send(CHAT_ID, `Back online and ready! Running v${CURRENT_VERSION}.${reasonLine}`);
       }
     } catch (e) {}
   }
@@ -347,5 +362,6 @@ setInterval(checkForUpdates, 5 * 60 * 1000);
   }
 })().catch((e) => {
   console.error("Boot failure:", e);
+  try { require("./core/restart-reason").recordExitReason(`Boot failure: ${e?.message || e}`, { code: 1 }); } catch (e2) {}
   process.exit(1);
 });

package/channels/telegram/adapter.js

@@ -28,7 +28,14 @@ class TelegramAdapter {
     this._agent = new https.Agent({ keepAlive: false });
     this.bot = new TelegramBot(token, {
       polling: { autoStart: false, params: { timeout: 30 } },
-      request: { agent: this._agent },
+      // Socket-idle timeout on every request (getUpdates included). With
+      // keepAlive off, `request` arms req.setTimeout, so a half-open long-poll
+      // that stops sending bytes is killed here (ESOCKETTIMEDOUT → EFATAL →
+      // _onPollingHiccup → heal on a fresh socket) in ~40s instead of silently
+      // wedging until the 10-min backstop exits the process. MUST exceed the
+      // 30s long-poll hold (params.timeout:30) or it would abort healthy idle
+      // polls; 40s leaves a 10s margin.
+      request: { agent: this._agent, timeout: 40000 },
     });
     this._listeners = { message: new Set(), action: new Set() };
     this._healTimer = null;      // one active recovery in flight at a time
@@ -143,6 +150,7 @@ class TelegramAdapter {
       // wedge, and exiting busts the prompt cache (full uncached re-bill of the
       // conversation window on the next turn).
       console.error("Polling wedged >10min — exiting for a clean restart.");
+      try { require("../../core/restart-reason").recordExitReason("Telegram polling wedged >10min (long-poll unrecoverable) — self-exit for a clean restart", { code: 1 }); } catch (e) {}
       process.exit(1);
     }
     try {
@@ -216,7 +224,7 @@ class TelegramAdapter {
         this._on409Conflict();
         return;
       }
-      if (/ETIMEDOUT|ECONNRESET|ENOTFOUND|ENETUNREACH|EAI_AGAIN|EFATAL|socket hang up/i.test(msg)) {
+      if (/ESOCKETTIMEDOUT|ETIMEDOUT|ECONNRESET|ENOTFOUND|ENETUNREACH|EAI_AGAIN|EFATAL|socket hang up/i.test(msg)) {
         this._onPollingHiccup(msg); // transient — heal quietly, never exit
         return;
       }

package/core/actions.js

@@ -557,6 +557,7 @@ async function handleAction(envelope) {
     fs.writeFileSync(modeFile, newMode);
     await send(`Switching to ${newMode} mode... restarting.`);
     await sideChatCoordinator.cancelAll();
+    try { require("./restart-reason").recordExitReason(`Runtime mode switch → ${newMode}`, { code: 0 }); } catch (e) {}
     setTimeout(() => process.exit(0), 500);
     return;
   }

package/core/handlers.js

@@ -565,6 +565,7 @@ register({
   handler: async (env) => {
     if (!ownerEnv(env)) return;
     await send("Going offline for a quick restart — back in a moment.");
+    try { require("./restart-reason").recordExitReason("User /restart command", { code: 0 }); } catch (e) {}
     setTimeout(() => process.exit(0), 1000);
   },
 });
@@ -734,6 +735,7 @@ register({
       const tailNote = "Source refreshed in /app. If this release also changed the Dockerfile (apt packages, env, base image), the host still needs a docker pull + recreate for those.";
       const msg = `Installed v${newVersion}.${whatsNew ? `\n\nWhat's new:\n${whatsNew}` : ""}\n\n${tailNote}\n\nRestarting...`;
       await send(msg.length > 3900 ? msg.slice(0, 3900) : msg);
+      try { require("./restart-reason").recordExitReason(`User /upgrade → v${newVersion} (source refresh)`, { code: 0 }); } catch (e) {}
       setTimeout(() => process.exit(0), 2000);
       return;
     }
@@ -781,6 +783,7 @@ register({
       const doctorReport = formatDoctorReport(runDoctorChecks());
       const msg = `Installed v${newPkg.version}.${whatsNew ? `\n\nWhat's new:\n${whatsNew}` : ""}\n\nPost-upgrade requirements check:\n${doctorReport}\n\nGoing offline to restart...`;
       await send(msg.length > 3900 ? msg.slice(0, 3900) : msg);
+      try { require("./restart-reason").recordExitReason(`User /upgrade → v${newPkg.version}`, { code: 0 }); } catch (e) {}
     } catch (e) {
       const errOutput = (e.stdout || e.stderr || e.message || "").slice(-500);
       await send(`Upgrade failed:\n${errOutput}`);

package/core/recall/discoverer.js

@@ -109,12 +109,21 @@ const EXCERPT_CHARS = 600;
 // e.g. CLI/tests) may pull them. Same-conversation packs/entities are unaffected.
 function episodesAllowedForSpeaker() {
   try {
-    const { currentAdapter, currentChannelId } = require("../context");
+    const { currentAdapter, currentChannelId, currentCanonicalUserId } = require("../context");
     const adapter = currentAdapter();
     const channelId = currentChannelId();
     if (!adapter || !channelId) return true; // no speaker context (CLI/tests) → ungated
     const people = require("../people");
-    const speaker = people.findByHandle(adapter.type, channelId);
+    // Resolve the speaker by canonical user id first. On transports where the
+    // channelId is a room/chat id rather than the sender's user id (Kazee, group
+    // chats), a handle lookup keyed on channelId misses the owner and fails
+    // closed — silently starving them of episodic recall. The canonical id is
+    // derived from the authenticated sender and is unified across a person's
+    // linked channels, so it recognises the owner on every transport. Falls back
+    // to the channelId handle lookup when no canonical is in context.
+    const canonical = currentCanonicalUserId();
+    const speaker = (canonical && people.findByCanonicalUserId(canonical))
+      || people.findByHandle(adapter.type, channelId);
     return !!(speaker && speaker.isOwner); // unknown/non-owner → gated
   } catch (e) {
     return false; // resolution error → fail closed

package/core/restart-reason.js

@@ -0,0 +1,42 @@
+// Records WHY the process is about to exit so the next boot can report the
+// cause in its "Back online" greeting. Only code-initiated exits get a chance
+// to write the file — an external hard-kill (SIGKILL, OOM, host reboot, k8s
+// force-restart) leaves no record, which is itself the signal that the restart
+// was NOT code-initiated.
+
+const fs = require("fs");
+const path = require("path");
+const { CONFIG_DIR } = require("./config");
+
+const FILE = path.join(CONFIG_DIR, "last-exit.json");
+// A reason older than this is treated as stale (the file was left behind by a
+// much earlier exit and the real cause of *this* boot is unknown/external).
+const FRESH_MS = 10 * 60 * 1000;
+
+// Call synchronously right before a code-initiated process.exit(). Best-effort:
+// never throws, never blocks the exit.
+function recordExitReason(reason, extra = {}) {
+  try {
+    fs.writeFileSync(FILE, JSON.stringify({
+      reason: String(reason || "unspecified").slice(0, 300),
+      code: extra.code,
+      at: Date.now(),
+    }));
+  } catch (e) { /* the recorder must never itself throw */ }
+}
+
+// Read + clear the recorded reason on boot. Returns null when there is no fresh
+// record ⇒ the restart was external/uncontrolled (nothing got to write a file).
+function consumeExitReason() {
+  try {
+    const raw = fs.readFileSync(FILE, "utf8");
+    try { fs.unlinkSync(FILE); } catch (e) {}
+    const rec = JSON.parse(raw);
+    if (!rec || typeof rec.at !== "number" || Date.now() - rec.at > FRESH_MS) return null;
+    return rec;
+  } catch (e) {
+    return null; // absent/unreadable ⇒ external restart
+  }
+}
+
+module.exports = { recordExitReason, consumeExitReason };

package/docker-entrypoint.sh

@@ -60,5 +60,28 @@ SOUL
   echo "Configuration written to $ENV_FILE"
 fi
 
+# Identity sync: pod-provisioned env is authoritative for identity keys.
+# The config loader prefers .env file values over process env, so a retained
+# disk attached to a NEW bot would otherwise keep the old bot's identity
+# (tokens, owner). Re-seed identity keys from env on every boot — only keys
+# actually set in the environment; everything else in .env is untouched.
+if [ -f "$ENV_FILE" ]; then
+  sync_env_key() {
+    key="$1"; value="$2"
+    [ -n "$value" ] || return 0
+    tmp="$ENV_FILE.identity-sync"
+    grep -v "^${key}=" "$ENV_FILE" > "$tmp" || true
+    printf '%s=%s\n' "$key" "$value" >> "$tmp"
+    mv "$tmp" "$ENV_FILE"
+  }
+  sync_env_key CHANNELS "$CHANNELS"
+  sync_env_key TELEGRAM_BOT_TOKEN "$TELEGRAM_BOT_TOKEN"
+  sync_env_key TELEGRAM_CHAT_ID "$TELEGRAM_CHAT_ID"
+  sync_env_key KAZEE_URL "$KAZEE_URL"
+  sync_env_key KAZEE_BOT_TOKEN "$KAZEE_BOT_TOKEN"
+  sync_env_key KAZEE_BOT_USER_ID "$KAZEE_BOT_USER_ID"
+  sync_env_key KAZEE_OWNER_USER_ID "$KAZEE_OWNER_USER_ID"
+fi
+
 # Execute the main command
 exec "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.13",
+  "version": "3.0.15",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-provider-language.js

@@ -32,12 +32,11 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.13 approved by Sumeet 2026-07-13 ("ok please proceed... once done
-// please push it out" on the agent-space P0–P3 plan): web chat channel —
-// in-process WebAdapter, /api/chat SSE + send/action/media routes, Chat tab
-// in the dashboard, and a control-token-only /api/otp/mint for AgentSpace
-// magic-link SSO.
-assert.strictEqual(pkg.version, "3.0.13", "release version must remain unchanged without explicit approval");
+// 3.0.15 approved by Sumeet 2026-07-14 ("Yes fix and push"): episodic-recall
+// owner gate now resolves the speaker by canonical user id (not raw channelId),
+// so the owner keeps cross-conversation episodic memory on Kazee / group chats
+// where channelId is a room id that never matches the stored user-id handle.
+assert.strictEqual(pkg.version, "3.0.15", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-recall-relationship-gate.js

@@ -39,4 +39,25 @@ assert.strictEqual(inChat("222", () => episodesAllowedForSpeaker()), false, "ext
 // Unknown channel (no person record) → fail closed.
 assert.strictEqual(inChat("999", () => episodesAllowedForSpeaker()), false, "unknown speaker → episodes blocked");
 
+// Kazee / group case: the channelId is a room/chat id that does NOT match the
+// owner's stored handle, but the envelope carries the owner's unified canonical
+// id. Resolving by canonical must recognise the owner even though a handle
+// lookup on the room id misses — otherwise the owner silently loses episodic
+// recall on those transports (the Kazee "less context" regression).
+const withCanon = (channelId, canonicalUserId, fn) =>
+  runInChat({ adapter, channelId, canonicalUserId, transport: "telegram" }, fn);
+const ownerCanon = people.findById(owner.id).handles[0].canonicalUserId;
+assert.strictEqual(
+  withCanon("room-xyz", ownerCanon, () => episodesAllowedForSpeaker()),
+  true,
+  "owner via canonical on a room-id channel → episodes allowed (Kazee/group regression)",
+);
+// A non-owner on a room-id channel with their own canonical stays blocked.
+const extCanon = people.findById(ext.id).handles[0].canonicalUserId;
+assert.strictEqual(
+  withCanon("room-abc", extCanon, () => episodesAllowedForSpeaker()),
+  false,
+  "external via canonical → episodes still blocked",
+);
+
 console.log("recall relationship gate OK");