@nopeek/agent-bridge 0.7.4 → 0.7.5

package/dist/bot.d.ts

@@ -21,6 +21,9 @@ export declare class BotRunner {
     private np;
     private stopped;
     private refreshTimer;
+    private lastConnectedAt;
+    private lastForcedRestart;
+    private running;
     private seen;
     private channelCache;
     private allowed;
@@ -38,6 +41,19 @@ export declare class BotRunner {
     private log;
     private logErr;
     constructor(info: BotInfo, cfg: BridgeConfig, pairing: Pairing);
+    /** Watchdog liveness: 0 while currently connected, else ms since the bot was
+     *  last connected (seeded at construction so a never-connected bot ages too). */
+    msSinceHealthy(): number;
+    /** When the watchdog last force-restarted this runner (null = never). */
+    get lastForcedRestartAt(): number | null;
+    /**
+     * Watchdog hard restart: tear the SDK client down completely and rebuild it
+     * from scratch (fresh session mint + NoPeek.connect) — the proven-working
+     * path when the SDK's own reconnect wedges. Unlike stop(), this does NOT
+     * permanently stop the runner; it clears `stopped` so the connect loop
+     * actually re-enters. Idempotent enough to call every watchdog tick.
+     */
+    forceRestart(): void;
     /** Re-read the effective brain (e.g. after a live server backend change) so
      *  status reflects it immediately. The next message re-resolves regardless. */
     refreshBrainKind(): void;

package/dist/bot.js

@@ -24,6 +24,15 @@ export class BotRunner {
     np = null;
     stopped = false;
     refreshTimer = null;
+    // Watchdog liveness. Seeded at construction so a bot that NEVER connects still
+    // ages from birth. Set to now() whenever the socket becomes connected; while
+    // disconnected it holds the last-healthy instant, so msSinceHealthy() reports
+    // how long the bot has been down.
+    lastConnectedAt = Date.now();
+    lastForcedRestart = null;
+    // Guards against two concurrent connect loops if forceRestart() lands while a
+    // backoff retry loop is still running.
+    running = false;
     seen = new Set();
     channelCache = new Map();
     // Access control: bots are PRIVATE by default. `allowed` is the set of user
@@ -76,6 +85,39 @@ export class BotRunner {
         this.log = (m) => console.log(`${tag} ${m}`);
         this.logErr = (m) => console.error(`${tag} ${m}`);
     }
+    /** Watchdog liveness: 0 while currently connected, else ms since the bot was
+     *  last connected (seeded at construction so a never-connected bot ages too). */
+    msSinceHealthy() {
+        return this.connected ? 0 : Date.now() - this.lastConnectedAt;
+    }
+    /** When the watchdog last force-restarted this runner (null = never). */
+    get lastForcedRestartAt() {
+        return this.lastForcedRestart;
+    }
+    /**
+     * Watchdog hard restart: tear the SDK client down completely and rebuild it
+     * from scratch (fresh session mint + NoPeek.connect) — the proven-working
+     * path when the SDK's own reconnect wedges. Unlike stop(), this does NOT
+     * permanently stop the runner; it clears `stopped` so the connect loop
+     * actually re-enters. Idempotent enough to call every watchdog tick.
+     */
+    forceRestart() {
+        if (this.stopped)
+            return; // truly stopped (unpair) — never resurrect
+        this.lastForcedRestart = Date.now();
+        if (this.refreshTimer)
+            clearTimeout(this.refreshTimer);
+        this.refreshTimer = null;
+        try {
+            this.np?.close();
+        }
+        catch {
+            /* best-effort */
+        }
+        this.np = null;
+        this.connected = false;
+        this.start(); // run()'s `running` guard prevents a duplicate loop
+    }
     /** Re-read the effective brain (e.g. after a live server backend change) so
      *  status reflects it immediately. The next message re-resolves regardless. */
     refreshBrainKind() {
@@ -251,19 +293,27 @@ export class BotRunner {
         }
     }
     async run() {
-        this.log(`starting (${this.info.userId}) brain=${this.brainKind}`);
-        let delay = 2_000;
-        while (!this.stopped) {
-            try {
-                await this.connectOnce();
-                return; // connected; SDK auto-reconnects, session refresh re-enters via reconnect()
-            }
-            catch (err) {
-                this.logErr(`connect failed: ${err.message} — retrying in ${delay / 1000}s`);
-                await sleep(delay);
-                delay = Math.min(delay * 2, MAX_BACKOFF_MS);
+        if (this.running)
+            return; // a connect loop is already active — never double it
+        this.running = true;
+        try {
+            this.log(`starting (${this.info.userId}) brain=${this.brainKind}`);
+            let delay = 2_000;
+            while (!this.stopped) {
+                try {
+                    await this.connectOnce();
+                    return; // connected; SDK auto-reconnects, session refresh re-enters via reconnect()
+                }
+                catch (err) {
+                    this.logErr(`connect failed: ${err.message} — retrying in ${delay / 1000}s`);
+                    await sleep(delay);
+                    delay = Math.min(delay * 2, MAX_BACKOFF_MS);
+                }
             }
         }
+        finally {
+            this.running = false;
+        }
     }
     async connectOnce() {
         const session = await this.mintSession();
@@ -286,11 +336,13 @@ export class BotRunner {
         }
         this.np = np;
         this.connected = true;
+        this.lastConnectedAt = Date.now();
         this.channelCache.clear();
         this.ownerPresence.clear();
         this.log(`connected, device ${np.deviceId} (platform=server), store ${store.file}`);
         np.on("connected", (() => {
             this.connected = true;
+            this.lastConnectedAt = Date.now();
             this.log(`ws connected`);
         }));
         np.on("disconnected", (() => {

package/dist/bridge.d.ts

@@ -1,5 +1,5 @@
 import type { BridgeConfig, Pairing, BrainSpec, BrainBackend } from "./config.js";
-export declare const VERSION = "0.7.4";
+export declare const VERSION = "0.7.5";
 export interface PairRequest {
     pairingSecret: string;
     appId: string;
@@ -39,6 +39,9 @@ export declare class BridgeApp {
     readonly startedAt: number;
     private runtimes;
     private capabilitiesTimer;
+    private watchdogTimer;
+    private hardStaleStreak;
+    private lastWatchdogAt;
     private stopped;
     constructor(cfg: BridgeConfig);
     get paired(): boolean;
@@ -48,6 +51,12 @@ export declare class BridgeApp {
     start(): void;
     stop(): void;
     private startRuntime;
+    /** Reconnect watchdog. Sweeps every pairing's runners + control sockets on a
+     *  fixed interval and force-recovers anything stuck; as a last resort, exits
+     *  so the always-restart service relaunches a clean process. unref'd so it
+     *  never keeps the process alive on its own. */
+    private ensureWatchdogTimer;
+    private watchdogTick;
     /** Re-probe + report brain availability every ~5 min (once per pairing) so a
      *  login/logout on this computer surfaces in each account's picker without a
      *  reconnect. onAuthed covers initial + reconnect reports; this covers drift.

package/dist/bridge.js

@@ -17,9 +17,22 @@ import { resolveBrain } from "./brain.js";
 import { provisionSoul, provisionHermesProfile } from "./backends.js";
 import { reportCapabilities } from "./capabilities.js";
 import { isBrainBackend } from "./config.js";
-export const VERSION = "0.7.4";
+export const VERSION = "0.7.5";
 /** How often to re-probe + report brain availability to the server. */
 const CAPABILITIES_INTERVAL_MS = 5 * 60_000;
+// ---- Reconnect watchdog -----------------------------------------------------
+// A layered safety net for the exact wedge seen in the field: after a network
+// routing change all bot sockets closed with 1006 and the process's networking
+// got stuck — the SDK's own reconnect never recovered, though a fresh process
+// connected fine. So we don't trust internal reconnect: we (a) force a hard
+// rebuild of any runner/control socket that's been down too long, and (b) as a
+// last resort exit so the always-restart service relaunches a clean process.
+/** How often the watchdog sweeps every pairing's runners + control sockets. */
+const WATCHDOG_INTERVAL_MS = 30_000;
+/** Down longer than this → force a hard restart (rebuild from scratch). */
+const SOFT_STALE_MS = 90_000;
+/** Every bot down longer than this (sustained) → exit for a clean relaunch. */
+const HARD_STALE_MS = 5 * 60_000;
 export class PairError extends Error {
     code;
     constructor(code, message) {
@@ -140,9 +153,48 @@ class PairingRuntime {
             userId: b.info.userId,
             connected: b.connected,
             handled: b.handled,
+            msSinceHealthy: b.msSinceHealthy(),
+            lastForcedRestart: b.lastForcedRestartAt,
             brain: resolveBrain(this.cfg, b.info.handle).kind,
         }));
     }
+    /**
+     * Watchdog soft pass for THIS pairing. Force-restart (full rebuild) any bot
+     * that's been disconnected longer than softMs, debounced so a single bot is
+     * restarted at most once per softMs window. Also force-recreate the control
+     * socket if it's been un-authed longer than softMs (its internal backoff can
+     * wedge too). Returns each bot's msSinceHealthy so the app can evaluate the
+     * hard, process-level catch-all across all pairings.
+     */
+    watchdogSoftPass(softMs) {
+        if (this.stopped)
+            return [];
+        const now = Date.now();
+        const liveness = [];
+        for (const b of this.bots.values()) {
+            const ms = b.msSinceHealthy();
+            liveness.push(ms);
+            if (ms <= softMs)
+                continue;
+            const last = b.lastForcedRestartAt;
+            if (last !== null && now - last < softMs)
+                continue; // debounce: one restart per window
+            console.log(`${this.tag} [watchdog] @${b.info.handle} disconnected ${Math.round(ms / 1000)}s — forcing hard restart`);
+            b.forceRestart();
+        }
+        const control = this.control;
+        if (control) {
+            const ms = control.msSinceHealthy();
+            if (ms > softMs) {
+                const last = control.lastForcedRestartAt;
+                if (last === null || now - last >= softMs) {
+                    console.log(`${this.tag} [watchdog] control socket down ${Math.round(ms / 1000)}s — forcing a fresh socket`);
+                    control.forceReconnect();
+                }
+            }
+        }
+        return liveness;
+    }
     // ---------------------------------------------------------------- core ----
     startBot(info) {
         if (this.bots.has(info.userId))
@@ -229,6 +281,11 @@ export class BridgeApp {
     startedAt = Date.now();
     runtimes = [];
     capabilitiesTimer = null;
+    watchdogTimer = null;
+    // Hard exit needs the all-bots-stale condition sustained across TWO
+    // consecutive checks — a single transient blip must never restart the process.
+    hardStaleStreak = 0;
+    lastWatchdogAt = 0;
     stopped = false;
     constructor(cfg) {
         this.cfg = cfg;
@@ -261,6 +318,10 @@ export class BridgeApp {
             clearInterval(this.capabilitiesTimer);
             this.capabilitiesTimer = null;
         }
+        if (this.watchdogTimer) {
+            clearInterval(this.watchdogTimer);
+            this.watchdogTimer = null;
+        }
         for (const r of this.runtimes)
             r.stop();
         this.runtimes = [];
@@ -274,6 +335,46 @@ export class BridgeApp {
         this.runtimes.push(rt);
         rt.start();
         this.ensureCapabilitiesTimer();
+        this.ensureWatchdogTimer();
+    }
+    /** Reconnect watchdog. Sweeps every pairing's runners + control sockets on a
+     *  fixed interval and force-recovers anything stuck; as a last resort, exits
+     *  so the always-restart service relaunches a clean process. unref'd so it
+     *  never keeps the process alive on its own. */
+    ensureWatchdogTimer() {
+        if (this.watchdogTimer)
+            return;
+        this.watchdogTimer = setInterval(() => this.watchdogTick(), WATCHDOG_INTERVAL_MS);
+        this.watchdogTimer.unref?.();
+    }
+    watchdogTick() {
+        if (this.stopped || !this.paired) {
+            this.hardStaleStreak = 0;
+            return;
+        }
+        this.lastWatchdogAt = Date.now();
+        // Layers 2+3: soft force-recovery per pairing (bots + control socket).
+        let allLiveness = [];
+        for (const r of this.runtimes)
+            allLiveness = allLiveness.concat(r.watchdogSoftPass(SOFT_STALE_MS));
+        // Layer 4 (the guarantee): if EVERY bot across ALL pairings has been down
+        // longer than HARD_STALE_MS and there is at least one bot, soft recovery
+        // has failed — the process networking is wedged. Require the condition
+        // sustained over two consecutive checks, then exit for a clean relaunch.
+        const hasBots = allLiveness.length > 0;
+        const allHardStale = hasBots && allLiveness.every((ms) => ms > HARD_STALE_MS);
+        if (this.paired && hasBots && allHardStale) {
+            this.hardStaleStreak++;
+            const mins = Math.round(HARD_STALE_MS / 60_000);
+            if (this.hardStaleStreak >= 2) {
+                console.error(`[watchdog] no bot connected for ${mins}min across ${allLiveness.length} bot(s) — exiting for a clean relaunch`);
+                process.exit(1);
+            }
+            console.error(`[watchdog] all ${allLiveness.length} bot(s) down > ${mins}min — will exit for a clean relaunch if still down next check`);
+        }
+        else {
+            this.hardStaleStreak = 0;
+        }
     }
     /** Re-probe + report brain availability every ~5 min (once per pairing) so a
      *  login/logout on this computer surfaces in each account's picker without a
@@ -342,6 +443,7 @@ export class BridgeApp {
      * Returns false when a runtimeId was given but matches no pairing.
      */
     unpair(runtimeId) {
+        this.hardStaleStreak = 0; // never carry a stale streak across a topology change
         if (!runtimeId) {
             console.log(`[bridge] unpairing ALL ${this.cfg.pairings.length} account(s) — stopping bots and forgetting the pairing secrets`);
             for (const r of this.runtimes)
@@ -499,6 +601,15 @@ export class BridgeApp {
             },
             // Legacy flat list = every pairing's bots (pre-0.6 clients read this).
             bots: this.runtimes.flatMap((r) => r.botStatuses()),
+            // Reconnect watchdog state (per-bot msSinceHealthy/lastForcedRestart ride
+            // each bot entry above; this summarizes the process-level guard).
+            watchdog: {
+                intervalMs: WATCHDOG_INTERVAL_MS,
+                softStaleMs: SOFT_STALE_MS,
+                hardStaleMs: HARD_STALE_MS,
+                hardStaleStreak: this.hardStaleStreak,
+                lastCheckAt: this.lastWatchdogAt || null,
+            },
         };
     }
 }

package/dist/control.d.ts

@@ -42,12 +42,25 @@ export declare class ControlSocket {
     private ws;
     private stopped;
     private heartbeat;
+    private reconnectTimer;
     private delay;
+    private lastConnectedAt;
+    private lastForcedRestart;
     /** Log tag — with several sockets running, lines must say whose they are. */
     private tag;
     constructor(pairing: Pairing, handlers: ControlHandlers);
     start(): void;
     stop(): void;
+    /** Watchdog liveness: 0 while authenticated, else ms since the last auth.ok. */
+    msSinceHealthy(): number;
+    /** When the watchdog last force-recreated this socket (null = never). */
+    get lastForcedRestartAt(): number | null;
+    /**
+     * Watchdog force-recovery: cancel any pending backoff timer, tear down the
+     * current socket and open a brand-new one immediately — bypassing the
+     * internal backoff, which can itself wedge after a network event.
+     */
+    forceReconnect(): void;
     private connect;
     private handleFrame;
     private scheduleReconnect;

package/dist/control.js

@@ -10,7 +10,13 @@ export class ControlSocket {
     ws = null;
     stopped = false;
     heartbeat = null;
+    reconnectTimer = null;
     delay = 2_000;
+    // Watchdog liveness. Seeded at construction; set to now() on every auth.ok
+    // (the only "healthy" moment for a control socket). While un-authed it holds
+    // the last-authed instant so msSinceHealthy() reports how long we've been out.
+    lastConnectedAt = Date.now();
+    lastForcedRestart = null;
     /** Log tag — with several sockets running, lines must say whose they are. */
     tag;
     constructor(pairing, handlers) {
@@ -23,6 +29,14 @@ export class ControlSocket {
     }
     stop() {
         this.stopped = true;
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = null;
+        }
+        if (this.heartbeat) {
+            clearInterval(this.heartbeat);
+            this.heartbeat = null;
+        }
         try {
             this.ws?.close();
         }
@@ -32,6 +46,42 @@ export class ControlSocket {
         this.ws = null;
         this.connected = false;
     }
+    /** Watchdog liveness: 0 while authenticated, else ms since the last auth.ok. */
+    msSinceHealthy() {
+        return this.connected ? 0 : Date.now() - this.lastConnectedAt;
+    }
+    /** When the watchdog last force-recreated this socket (null = never). */
+    get lastForcedRestartAt() {
+        return this.lastForcedRestart;
+    }
+    /**
+     * Watchdog force-recovery: cancel any pending backoff timer, tear down the
+     * current socket and open a brand-new one immediately — bypassing the
+     * internal backoff, which can itself wedge after a network event.
+     */
+    forceReconnect() {
+        if (this.stopped)
+            return;
+        this.lastForcedRestart = Date.now();
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = null;
+        }
+        if (this.heartbeat) {
+            clearInterval(this.heartbeat);
+            this.heartbeat = null;
+        }
+        try {
+            this.ws?.close();
+        }
+        catch {
+            /* best-effort */
+        }
+        this.ws = null;
+        this.connected = false;
+        this.delay = 2_000; // fresh start — reset backoff
+        this.connect();
+    }
     connect() {
         if (this.stopped)
             return;
@@ -47,6 +97,13 @@ export class ControlSocket {
         }
         this.ws = ws;
         ws.onopen = () => {
+            if (this.ws !== ws) {
+                try {
+                    ws.close();
+                }
+                catch { /* stale */ }
+                return;
+            } // superseded
             console.log(`${this.tag} socket open, awaiting auth.ok`);
             // Heartbeat: the server closes sockets idle >60s; the SDK pings every
             // 25s and so do we — otherwise the control socket flaps once a minute
@@ -76,6 +133,10 @@ export class ControlSocket {
             // onclose always follows; log there.
         };
         ws.onclose = (ev) => {
+            // A newer socket (e.g. from a watchdog forceReconnect) already superseded
+            // this one — ignore this stale close so we never stack reconnects.
+            if (this.ws !== ws)
+                return;
             if (this.heartbeat) {
                 clearInterval(this.heartbeat);
                 this.heartbeat = null;
@@ -92,6 +153,7 @@ export class ControlSocket {
         switch (frame.type) {
             case "auth.ok": {
                 this.connected = true;
+                this.lastConnectedAt = Date.now();
                 this.delay = 2_000; // reset backoff on a good auth
                 this.runtimeId = String(frame.runtimeId ?? "");
                 console.log(`${this.tag} authenticated as runtime ${this.runtimeId} (control=${String(frame.control)})`);
@@ -147,9 +209,16 @@ export class ControlSocket {
     scheduleReconnect() {
         if (this.stopped)
             return;
+        // A watchdog forceReconnect() may have already opened a fresh socket; only
+        // one pending reconnect timer at a time (never stack sockets).
+        if (this.reconnectTimer)
+            return;
         console.log(`${this.tag} reconnecting in ${this.delay / 1000}s`);
-        const t = setTimeout(() => this.connect(), this.delay);
-        t.unref?.();
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = null;
+            this.connect();
+        }, this.delay);
+        this.reconnectTimer.unref?.();
         this.delay = Math.min(this.delay * 2, 30_000);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nopeek/agent-bridge",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Run your own agents as E2EE NoPeek bots. Pairs with one-time codes (multiple accounts per computer), runs every bot each account owns, and pipes messages to any command or webhook.",
   "type": "module",
   "license": "MIT",