@inetafrica/open-claudia 3.0.2 → 3.0.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## v3.0.3 — the lock-holder stands its ground
+
+- **A persistent 409 no longer restarts the bot.** v3.0.1 taught the poller to ride out short 409 conflicts but still `exit(1)` once a conflict outlived 2 minutes, on the theory that the survivor had to be a real second instance. In practice the rogue poller is lock-blind — a debugger-run dev checkout, a copy on another config dir, or another host on the same token — so the exit killed the *legitimate*, lock-holding service and launchd respawned it straight back into the same fight (five boot→409→exit cycles on 2026-07-12). The poller now never exits over a 409: it pauses 15s per retry, slows to 60s once the streak passes 2 minutes, sends the owner a throttled Telegram alert (max one per hour) naming the likely culprits, and posts an all-clear once the rogue goes away.
+- **The single-instance lock is atomic.** Acquisition was read-check-then-write, so two processes booting together (a launchd respawn racing a manual start) could both judge the lock stale and both claim it — each believing it was the only copy. The lock is now claimed with an exclusive-create (`O_EXCL`) in a bounded retry loop: stale, corrupt, or own-pid locks are unlinked and re-claimed atomically, a live holder still turns the newcomer away, and a process that loses every claim attempt refuses to boot rather than assuming ownership.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. `test-telegram-409-grace.js` now proves the never-exit + owner-alert + all-clear path; `test-single-instance.js` passes unchanged against the atomic rewrite.
+
 ## v3.0.2 — honest context numbers, dream summaries that arrive
 
 - **The context warning counts the window again, not the bill.** The v3.0.0 provider rewrite computed the live context number from the provider's *cumulative* turn usage — every tool round-trip re-counted the cached prompt prefix, so a normal turn read as 347k+ "context" (crossing 1M on busy turns), spooked the usage alert, and could prematurely force-compact sessions whose real window was fine. The number now tracks the **peak single API call** in the turn (`peakContextTokens` over per-call usage events) — true window occupancy, the same semantics v2 reported (~160k on a heavy turn). Billing is untouched: ledger records keep the cumulative figure in `billedContextTokens`, and API-reported spend was never affected (v3 bills the same or less than v2 — the display was wrong, not the meter). The usage alert says "Context this turn" whenever the peak is available.

package/bot.js

@@ -22,10 +22,10 @@ ensureRuntimeDirectories();
 const { acquireSingleInstanceLock } = require("./core/single-instance");
 const instanceLock = acquireSingleInstanceLock({ configDir: CONFIG_DIR });
 if (!instanceLock.acquired) {
-  const h = instanceLock.holder;
+  const h = instanceLock.holder || {};
   console.error(
     `Another Open Claudia instance already owns ${CONFIG_DIR} ` +
-    `(pid ${h.pid}, started ${h.startedAt || "?"}, ${h.entrypoint || "unknown entrypoint"}). Exiting. ` +
+    `(pid ${h.pid || "?"}, started ${h.startedAt || "?"}, ${h.entrypoint || "unknown entrypoint"}). Exiting. ` +
     "Stop it first (launchctl stop com.claude-telegram-bot), or give a dev run its own OPEN_CLAUDIA_CONFIG_DIR."
   );
   process.exit(1);

package/channels/telegram/adapter.js

@@ -41,6 +41,8 @@ class TelegramAdapter {
     this._conflictSince = 0;         // start of the current 409 streak
     this._conflictTimer = null;      // pending paused retry after a 409
     this._conflictClearTimer = null; // quiet after a retry ⇒ streak over
+    this._conflictAlertAt = 0;       // last owner alert about a rogue poller (throttle: 1/h)
+    this._conflictAlerted = false;   // current streak already alerted ⇒ send the all-clear
     this._wireInbound();
   }
 
@@ -142,23 +144,31 @@ class TelegramAdapter {
     }, 30000);
   }
 
-  // Telegram 409s a getUpdates call while ANOTHER one holds the token. Two
-  // causes: a ghost long-poll left by an uncleanly-killed predecessor (clears
-  // within its ≤30s poll timeout), or a genuinely running second instance.
-  // Exiting on the first 409 turned the ghost case into a KeepAlive respawn
-  // storm (7 boot→409→die cycles on 2026-07-12). So: pause, retry inside a
-  // grace window, and exit only if the conflict outlives it — that really is
-  // a second instance, and the supervisor's throttled respawns pace the rest.
+  // Telegram 409s a getUpdates call while ANOTHER one holds the token: a
+  // ghost long-poll left by an uncleanly-killed predecessor (clears within
+  // its ≤30s poll timeout), or a genuinely running second poller. We hold
+  // the single-instance lock, so WE are the legitimate copy — the rogue is
+  // lock-blind (a pre-lock process, a checkout on another CONFIG_DIR, or
+  // another host on the same token). Exiting here just handed launchd a
+  // respawn into the same fight (the 5-boot storm of 2026-07-12), so we
+  // never exit: pause, retry, and once the streak outlives the ghost window
+  // slow to 60s retries and alert the owner (max 1/hour) until it clears.
   _on409Conflict() {
     const now = Date.now();
     if (!this._conflictSince) this._conflictSince = now;
     if (this._conflictClearTimer) { clearTimeout(this._conflictClearTimer); this._conflictClearTimer = null; }
-    if (now - this._conflictSince > 120000) {
-      console.error("Another instance is polling (409 persisted >2min). Exiting.");
-      process.exit(1);
+    const persisted = now - this._conflictSince > 120000;
+    if (persisted && this.ownerChatId && now - this._conflictAlertAt > 3600000) {
+      this._conflictAlertAt = now;
+      this._conflictAlerted = true;
+      Promise.resolve(this.bot.sendMessage(
+        this.ownerChatId,
+        "⚠️ Another poller has held my Telegram token for over 2 minutes — likely a dev checkout, a debugger run, or another host using this token. I hold the instance lock, so I'm staying up and retrying every 60s; messages may lag until it stops.",
+      )).catch(() => {});
     }
     if (this._conflictTimer) return; // a paused retry is already queued
-    console.error("409 Conflict: another poller holds this token — pausing 15s (ghost polls clear in <1min; exiting only if this persists >2min).");
+    const pauseMs = persisted ? 60000 : 15000;
+    console.error(`409 Conflict: another poller holds this token — pausing ${Math.round(pauseMs / 1000)}s, then retrying (we hold the instance lock; never exiting).`);
     // Stop hammering now; the timer below dials back in.
     Promise.resolve(this.bot.stopPolling({ cancel: true, reason: "409 conflict backoff" })).catch(() => {});
     this._conflictTimer = setTimeout(async () => {
@@ -168,8 +178,14 @@ class TelegramAdapter {
       this._conflictClearTimer = setTimeout(() => {
         this._conflictClearTimer = null;
         this._conflictSince = 0;
+        if (this._conflictAlerted) {
+          this._conflictAlerted = false;
+          if (this.ownerChatId) {
+            Promise.resolve(this.bot.sendMessage(this.ownerChatId, "✅ The competing Telegram poller is gone — normal polling resumed.")).catch(() => {});
+          }
+        }
       }, 45000);
-    }, 15000);
+    }, pauseMs);
   }
 
   _wireInbound() {

package/core/single-instance.js

@@ -17,30 +17,46 @@ function pidAlive(pid) {
 
 function acquireSingleInstanceLock({ configDir, name = "bot" }) {
   const lockPath = path.join(configDir, `${name}.lock`);
-  try {
-    const prev = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-    if (prev && prev.pid && prev.pid !== process.pid && pidAlive(prev.pid)) {
-      return { acquired: false, holder: prev, lockPath };
-    }
-    // Missing, corrupt, own-pid, or dead-pid (stale after SIGKILL): claim it.
-  } catch (e) {}
-  fs.writeFileSync(lockPath, JSON.stringify({
+  const payload = JSON.stringify({
     pid: process.pid,
     startedAt: new Date().toISOString(),
     entrypoint: process.argv[1] || "",
-  }));
-  let released = false;
-  const release = () => {
-    if (released) return;
-    released = true;
+  });
+  // O_EXCL creation is the only atomic claim the filesystem offers. The old
+  // read-check-then-write had a TOCTOU hole: two processes booting together
+  // (launchd respawn racing a manual start) could both read "stale" and both
+  // write, each believing it held the lock. Now a stale/corrupt lock is
+  // unlinked and the claim retried; only a wx-create that succeeds counts.
+  for (let attempt = 0; attempt < 5; attempt++) {
     try {
-      const cur = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-      // Never delete a lock a successor already owns.
-      if (cur && cur.pid === process.pid) fs.unlinkSync(lockPath);
-    } catch (e) {}
-  };
-  process.on("exit", release);
-  return { acquired: true, lockPath, release };
+      fs.writeFileSync(lockPath, payload, { flag: "wx" });
+      let released = false;
+      const release = () => {
+        if (released) return;
+        released = true;
+        try {
+          const cur = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+          // Never delete a lock a successor already owns.
+          if (cur && cur.pid === process.pid) fs.unlinkSync(lockPath);
+        } catch (e) {}
+      };
+      process.on("exit", release);
+      return { acquired: true, lockPath, release };
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+    }
+    let prev = null;
+    try { prev = JSON.parse(fs.readFileSync(lockPath, "utf8")); } catch (e) {}
+    if (prev && prev.pid && prev.pid !== process.pid && pidAlive(prev.pid)) {
+      return { acquired: false, holder: prev, lockPath };
+    }
+    // Corrupt, own-pid, or dead-pid (stale after SIGKILL): clear and retry.
+    try { fs.unlinkSync(lockPath); } catch (e) {}
+  }
+  // Five claim attempts lost to contenders — treat it as someone else's lock.
+  let holder = null;
+  try { holder = JSON.parse(fs.readFileSync(lockPath, "utf8")); } catch (e) {}
+  return { acquired: false, holder, lockPath };
 }
 
 module.exports = { acquireSingleInstanceLock, pidAlive };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-provider-language.js

@@ -32,10 +32,10 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.2 approved by Sumeet 2026-07-12 ("Yeh do it and push it out" — peak
-// context metric restored, Telegram long-message chunking so dream summaries
-// deliver; CHANGELOG documents it as v3.0.2).
-assert.strictEqual(pkg.version, "3.0.2", "release version must remain unchanged without explicit approval");
+// 3.0.3 approved by Sumeet 2026-07-12 ("Yes please" to patching the double-
+// poller bug as v3.0.3 — atomic single-instance lock, 409 handler never exits
+// while holding the lock, throttled owner alert; CHANGELOG documents it).
+assert.strictEqual(pkg.version, "3.0.3", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }