@inetafrica/open-claudia 3.0.41 → 3.0.42

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v3.0.42 — Telegram stops rebooting itself: the long-poll wedge now heals in place
+
+- **The bot no longer restarts the whole process to recover from a stuck Telegram long-poll.** When the network stalls a poll mid-flight (a half-open socket after a laptop sleep/wake, or a NAT/IPv6 connection eviction), `node-telegram-bot-api` was left holding one reused internal poller whose abort flag got stuck "on". Restarting polling *in place* revived that same poisoned object, which fired a single `getUpdates` and then silently refused to schedule the next one — a dead loop that threw no error, so the heal looked like it "worked" while nothing was actually polling. The only thing that ever truly recovered was the 10-minute backstop calling `process.exit(1)` and letting the supervisor relaunch — i.e. the reboot storm you'd see. The heal now **discards the poisoned poller so a fresh one is built** (the update offset is preserved, so no messages are refetched or skipped), and it only declares polling "healthy again" once a `getUpdates` has genuinely **completed since the restart** — otherwise it re-arms another heal instead of blindly declaring victory. Net effect: transient poll wedges recover in seconds without a process restart; the 10-min self-exit becomes the rare true-last-resort it was meant to be.
+- **Agent-space / OpenClaw:** no new deps, env, or schema change; Docker image builds FROM the existing `:base`. Change is confined to `channels/telegram/adapter.js` (the `_heal` path); covered by three new cases in `test-telegram-poll-recovery.js` (proven to fail before the fix and pass after — the poisoned-object revival and the false "healthy" signal). Existing pods pick it up on their next approved upgrade.
+
 ## v3.0.41 — Verbose off now means a clean chat: the "Let me…" narration no longer lingers
 
 - **With `/verbose` off, the interim progress message is now removed once a turn settles, so the chat is left with only the final answer.** During a multi-step turn the bot posts a throttled "working…" preview that shows the short "Let me check…/Let me look at…" narration emitted before each tool call. That preview used to *stay* — settling into a permanent message — regardless of `/verbose`, which only ever gated the extended-thinking (🧠) stream. So even with verbose off you'd be left with the narration trail as a leftover message that reads like thinking-out-loud. `finalizeStreamPreview` now deletes that preview when verbose is off; `/verbose on` still keeps the narration trail. Live progress during long turns is unchanged either way — the cleanup only affects what remains after the turn ends.

package/channels/telegram/adapter.js

@@ -178,21 +178,44 @@ class TelegramAdapter {
     try {
       await this._stopPollingClean("stale Telegram long-poll recovery");
       await new Promise((r) => setTimeout(r, 500));
-      // restart:false — the lib's restart path is another cancel-stop (zombie
-      // factory); we already stopped cleanly, so only start if truly idle.
+      // THE wedge fix: the lib reuses this.bot._polling across start/stop and
+      // only reschedules the poll loop when `_abort === false`. A wedge (half-
+      // open socket after sleep/wake or a NAT/IPv6 eviction) can leave the old
+      // getUpdates unsettled past our 5s stop cap, so `_abort` stays stuck true
+      // — the restarted loop then fires ONE getUpdates and dies in its .finally,
+      // a silent dead loop that only process.exit ever cleared (the restart
+      // storm). Nulling forces startPolling to build a FRESH object with
+      // `_abort=false`; the offset survives via the shared bot.options.polling
+      // params, so no updates are refetched or skipped.
+      this.bot._polling = null;
+      // The fresh object's _lastUpdate starts at 0; startPolling below blocks up
+      // to ~30s on the first long-poll, so stamp the watchdog grace baseline NOW
+      // — else _checkPollingHealth would fall back to a stale _pollStartedAt and
+      // false-fire mid-first-poll.
+      this._pollStartedAt = Date.now();
       await this.bot.startPolling({ restart: false });
     } catch (e) {
       return; // restart didn't take — the next hiccup reschedules a heal
     }
-    // Quiet for 30s after a restart ⇒ genuinely recovered.
+    // Recovery is real only if a getUpdates has actually COMPLETED since the
+    // restart — not merely "no throw for 35s". A dead one-shot loop throws
+    // nothing, so the old blind timer declared it healthy and reset _wedgedSince,
+    // hiding the wedge until the 10-min backstop rebooted. Gate the reset on a
+    // completed poll; otherwise re-arm a heal.
+    const restartedAt = this._pollStartedAt;
     if (this._healthyTimer) clearTimeout(this._healthyTimer);
     this._healthyTimer = setTimeout(() => {
       this._healthyTimer = null;
-      if (this._wedgedSince) console.log("Polling healthy again.");
-      this._wedgedSince = 0;
-      this._healBackoff = 0;
-      this._deferredExitLogAt = 0;
-    }, 30000);
+      const lastCompletedPoll = this.bot?._polling?._lastUpdate || 0;
+      if (lastCompletedPoll >= restartedAt) {
+        if (this._wedgedSince) console.log("Polling healthy again.");
+        this._wedgedSince = 0;
+        this._healBackoff = 0;
+        this._deferredExitLogAt = 0;
+      } else {
+        this._onPollingHiccup("restart completed but no getUpdates within 35s");
+      }
+    }, 35000);
   }
 
   // Telegram 409s a getUpdates call while ANOTHER one holds the token: a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.41",
+  "version": "3.0.42",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-provider-language.js

@@ -65,7 +65,16 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // permanent message regardless of /verbose — only extended-thinking was gated.
 // finalizeStreamPreview now deletes the settled preview when /verbose is off, so
 // chat carries only the final answer; verbose ON still keeps the narration trail.
-assert.strictEqual(pkg.version, "3.0.41", "release version must remain unchanged without explicit approval");
+// 3.0.42 approved by Sumeet 2026-07-18 ("Yes please because it's restarting way
+// too much"): Telegram poll-recovery fix that stops the restart storm. A wedge
+// (half-open getUpdates after sleep/wake or NAT/IPv6 eviction) left the lib's
+// REUSED _polling object with _abort stuck true, so the in-place restart revived
+// a dead one-shot loop — the heal "succeeded" yet nothing polled, and only the
+// 10-min process.exit backstop recovered. The heal now nulls _polling so the lib
+// builds a fresh object (offset survives via the shared params), and the
+// "healthy" reset requires a getUpdates that actually COMPLETED since the restart
+// (else it re-arms a heal) instead of blindly declaring victory after 35s.
+assert.strictEqual(pkg.version, "3.0.42", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-telegram-poll-recovery.js

@@ -244,6 +244,156 @@ async function testWedgeExitFiresWhenIdle() {
   assert.strictEqual(exitCode, 1, "the idle wedge backstop must exit(1) for a clean restart");
 }
 
+// THE RESTART STORM regression. A wedge (half-open getUpdates after sleep/wake
+// or a NAT/IPv6 eviction) leaves the lib's REUSED _polling object with `_abort`
+// stuck true: the hung request never settled within our stop cap, so stop()'s
+// `.finally(() => _abort = false)` never ran. node-telegram-bot-api's
+// startPolling reuses this.bot._polling when it's present, so restarting in
+// place revives the SAME poisoned object — its loop fires one getUpdates and
+// dies in .finally (sees _abort===true ⇒ no reschedule). A silent dead loop:
+// the heal "succeeds" (no throw) yet nothing polls, so only the 10-min backstop's
+// process.exit ever recovered (the reboot storm the user saw). The heal must
+// null _polling so the lib constructs a FRESH object with _abort=false; the
+// offset survives via the shared bot.options.polling params. Fails before the
+// fix because the poisoned object is revived in place.
+async function testHealNullsPoisonedPollingSoLibRebuildsFresh() {
+  const ancient = Date.now() - 5 * 60 * 1000;
+  const poisoned = { _abort: true, _lastUpdate: ancient };
+  const adapter = Object.create(TelegramAdapter.prototype);
+  adapter._healTimer = null;
+  adapter._healthyTimer = null;
+  adapter._wedgedSince = Date.now() - 60000;
+  adapter._healBackoff = 0;
+  adapter._pollStartedAt = ancient;
+  adapter._onPollingHiccup = () => {};
+  adapter._agent = { destroy() {} };
+  adapter.bot = {
+    _polling: poisoned,
+    async stopPolling() { /* wedge: the hung request never settles, _abort stays true */ },
+    async startPolling() {
+      // Faithful to the lib: reuse _polling if present, else construct fresh.
+      if (!this._polling) this._polling = { _abort: false, _lastUpdate: Date.now() };
+    },
+  };
+
+  const realSetTimeout = global.setTimeout;
+  const realClearTimeout = global.clearTimeout;
+  global.setTimeout = (fn, ms) => { if (ms === 500 || ms === 5000) fn(); return { ms }; };
+  global.clearTimeout = () => {};
+  try {
+    await adapter._heal();
+  } finally {
+    global.setTimeout = realSetTimeout;
+    global.clearTimeout = realClearTimeout;
+  }
+
+  assert.notStrictEqual(adapter.bot._polling, poisoned,
+    "heal must discard the poisoned _polling object, not revive it in place");
+  assert.strictEqual(adapter.bot._polling._abort, false,
+    "the rebuilt poller must start with _abort=false so its loop reschedules");
+  assert.ok(adapter.bot._polling._lastUpdate >= adapter._pollStartedAt,
+    "the fresh poller must be able to complete a getUpdates (a live loop, not a dead one-shot)");
+}
+
+// HONEST HEALTH SIGNAL regression. "No throw for 35s" is NOT recovery — a dead
+// one-shot loop throws nothing. The old blind healthy-timer reset _wedgedSince
+// unconditionally, so a restart that never completed a single getUpdates was
+// declared healthy, hiding the wedge until the 10-min backstop rebooted. The
+// check must require a getUpdates COMPLETED since the restart; if none did, it
+// must re-arm a heal instead of declaring victory. Fails before the fix because
+// the blind timer clears the wedge with no completed poll.
+async function testHealthySignalReArmsWhenNoPollCompleted() {
+  const adapter = Object.create(TelegramAdapter.prototype);
+  adapter._healTimer = null;
+  adapter._healthyTimer = null;
+  adapter._wedgedSince = Date.now() - 60000;
+  adapter._healBackoff = 2;
+  adapter._deferredExitLogAt = 0;
+  adapter._pollStartedAt = 0;
+  adapter._agent = { destroy() {} };
+  adapter.bot = {
+    _polling: { _abort: true, _lastUpdate: 0 },
+    async stopPolling() {},
+    async startPolling() {
+      // Models a restart whose loop never completes a getUpdates: _lastUpdate
+      // stays 0 (pre-fix this is the revived poisoned object; post-fix a fresh
+      // object that simply hasn't succeeded yet).
+      if (!this._polling) this._polling = { _abort: false, _lastUpdate: 0 };
+    },
+  };
+  let healthyFn;
+  const hiccups = [];
+  adapter._onPollingHiccup = (m) => hiccups.push(m);
+
+  const realSetTimeout = global.setTimeout;
+  const realClearTimeout = global.clearTimeout;
+  global.setTimeout = (fn, ms) => {
+    if (ms === 500 || ms === 5000) fn();
+    else if (ms >= 30000) healthyFn = fn; // capture the healthy check (30s pre-fix, 35s post)
+    return { ms };
+  };
+  global.clearTimeout = () => {};
+  try {
+    await adapter._heal();
+    assert.strictEqual(typeof healthyFn, "function", "heal must arm a healthy check");
+    healthyFn();
+  } finally {
+    global.setTimeout = realSetTimeout;
+    global.clearTimeout = realClearTimeout;
+  }
+
+  assert.ok(adapter._wedgedSince > 0,
+    "a restart with no completed getUpdates must NOT clear the wedge");
+  assert.match(hiccups[0] || "", /no getUpdates/i,
+    "an unrecovered restart must re-arm a heal, not declare victory");
+}
+
+// Companion happy-path guard: once a getUpdates DOES complete after the restart,
+// the same healthy check clears the wedge and resets backoff (and must NOT
+// re-arm a heal). Passes before and after the fix — it guards the fix from
+// over-correcting into a bot that never declares itself recovered.
+async function testHealthySignalClearsWedgeOnceAPollCompletes() {
+  const adapter = Object.create(TelegramAdapter.prototype);
+  adapter._healTimer = null;
+  adapter._healthyTimer = null;
+  adapter._wedgedSince = Date.now() - 60000;
+  adapter._healBackoff = 3;
+  adapter._deferredExitLogAt = 12345;
+  adapter._pollStartedAt = 0;
+  adapter._agent = { destroy() {} };
+  adapter.bot = {
+    _polling: { _abort: true, _lastUpdate: 0 },
+    async stopPolling() {},
+    async startPolling() {
+      // A fresh, healthy poller that completes a getUpdates just after restart.
+      if (!this._polling) this._polling = { _abort: false, _lastUpdate: Date.now() + 1 };
+    },
+  };
+  let healthyFn;
+  const hiccups = [];
+  adapter._onPollingHiccup = (m) => hiccups.push(m);
+
+  const realSetTimeout = global.setTimeout;
+  const realClearTimeout = global.clearTimeout;
+  global.setTimeout = (fn, ms) => {
+    if (ms === 500 || ms === 5000) fn();
+    else if (ms >= 30000) healthyFn = fn;
+    return { ms };
+  };
+  global.clearTimeout = () => {};
+  try {
+    await adapter._heal();
+    healthyFn();
+  } finally {
+    global.setTimeout = realSetTimeout;
+    global.clearTimeout = realClearTimeout;
+  }
+
+  assert.strictEqual(adapter._wedgedSince, 0, "a completed getUpdates since restart must clear the wedge");
+  assert.strictEqual(adapter._healBackoff, 0, "recovery resets heal backoff");
+  assert.deepStrictEqual(hiccups, [], "a genuinely recovered restart must NOT re-arm a heal");
+}
+
 (async () => {
   await testStartDoesNotWaitForFirstLongPollAndArmsStallWatchdog();
   await testHealStopsPlainlyDestroysAgentAndRestartsIdle();
@@ -251,6 +401,9 @@ async function testWedgeExitFiresWhenIdle() {
   await test409ConflictSeversGhostSocketAndRestartsIdle();
   await testWedgeExitDefersWhileTurnInFlight();
   await testWedgeExitFiresWhenIdle();
+  await testHealNullsPoisonedPollingSoLibRebuildsFresh();
+  await testHealthySignalReArmsWhenNoPollCompleted();
+  await testHealthySignalClearsWedgeOnceAPollCompletes();
   console.log("telegram poll recovery OK");
 })().catch((err) => {
   console.error(err.stack || err);