@ouro.bot/cli 0.1.0-alpha.830 → 0.1.0-alpha.832

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.832",
+      "changes": [
+        "Sanctuary authority gateway: a getUpdates 409 conflict (and transient 5xx) after a gateway restart is retried internally until the previous Telegram long-poll session expires, so the tokenless resident never sees the reclaim window."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.831",
+      "changes": [
+        "Sanctuary: the Telegram long-poll survives transient transport failures — a dropped authority socket or a Telegram API error is retried with exponential backoff instead of exiting the sense process, so a gateway restart no longer crash-loops the resident. Non-transport (dispatch/durable-audit) failures still surface."
+      ]
+    },
     {
       "version": "0.1.0-alpha.830",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.830",
+  "runtimeVersion": "0.1.0-alpha.832",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.830</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.832</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-telegram-authority-service.js

@@ -38,6 +38,7 @@ exports.createSanctuaryTelegramAuthorityServer = createSanctuaryTelegramAuthorit
 const fs = __importStar(require("node:fs"));
 const net = __importStar(require("node:net"));
 const path = __importStar(require("node:path"));
+const telegram_client_1 = require("../../senses/telegram-client");
 const telegram_effect_adapter_1 = require("../../senses/telegram-effect-adapter");
 const frontend_socket_client_1 = require("../frontend-socket-client");
 const sanctuary_authority_codec_1 = require("./sanctuary-authority-codec");
@@ -68,8 +69,17 @@ function exactBody(value, required, optional = []) {
 function boundedText(value, maxLength) {
     return typeof value === "string" && value.length > 0 && value.length <= maxLength;
 }
+// After a gateway restart, Telegram keeps the previous getUpdates long-poll
+// alive server-side and answers 409 Conflict to the new poller until that
+// session expires (about the previous poll's timeout). Retry through that
+// window so the tokenless resident never sees the reclaim error; a transient
+// 5xx from Telegram is retried the same way.
+const AUTHORITY_POLL_RECLAIM_ATTEMPTS = 20;
+const AUTHORITY_POLL_RECLAIM_DELAY_MS = 4_000;
 class SanctuaryTelegramAuthorityService {
     #api;
+    #pollReclaimAttempts;
+    #pollReclaimDelayMs;
     #gateway;
     #downloadFile;
     #hostAuthority;
@@ -86,10 +96,37 @@ class SanctuaryTelegramAuthorityService {
         this.#hostAuthority = options.hostAuthority;
         this.#hostExecutor = options.hostExecutor;
         this.#downloadFile = options.downloadFile;
+        this.#pollReclaimAttempts = options.pollReclaimAttempts ?? AUTHORITY_POLL_RECLAIM_ATTEMPTS;
+        this.#pollReclaimDelayMs = options.pollReclaimDelayMs ?? AUTHORITY_POLL_RECLAIM_DELAY_MS;
     }
     async drainHostExecutions() {
         await Promise.allSettled(this.#hostExecutions.values());
     }
+    async #pollUpdates() {
+        for (let attempt = 1;; attempt += 1) {
+            try {
+                return await this.#api.request("getUpdates", {
+                    offset: this.#gateway.cursor(),
+                    timeout: 50,
+                    allowed_updates: ["message", "callback_query"],
+                });
+            }
+            catch (error) {
+                const status = error instanceof telegram_client_1.TelegramApiError ? error.status : null;
+                const reclaimable = status === 409 || (status !== null && status >= 500);
+                if (!reclaimable || attempt >= this.#pollReclaimAttempts)
+                    throw error;
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.sanctuary_authority_poll_reclaim",
+                    message: "getUpdates conflicted while reclaiming the Telegram session; retrying",
+                    meta: { status, attempt },
+                });
+                await new Promise((resolve) => setTimeout(resolve, this.#pollReclaimDelayMs));
+            }
+        }
+    }
     #hostReady() {
         return this.#hostExecutor !== undefined && (this.#hostExecutor.isHealthy?.() ?? true);
     }
@@ -103,11 +140,7 @@ class SanctuaryTelegramAuthorityService {
         if (method === "telegram.poll") {
             if (!emptyParams(params))
                 throw new Error("Sanctuary Telegram poll params are invalid");
-            const updates = await this.#api.request("getUpdates", {
-                offset: this.#gateway.cursor(),
-                timeout: 50,
-                allowed_updates: ["message", "callback_query"],
-            });
+            const updates = await this.#pollUpdates();
             if (!Array.isArray(updates))
                 throw new Error("Sanctuary Telegram poll result must be an array");
             this.#gateway.capture(updates);

package/dist/heart/frontend-socket-client.js

@@ -36,6 +36,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SocketFrontendClient = void 0;
 const net = __importStar(require("node:net"));
 const runtime_1 = require("../nerves/runtime");
+// A dropped or refused frontend socket is a transient transport condition, not a
+// logic failure: the caller (e.g. the Telegram long-poll loop) should reconnect
+// and retry rather than exit. Flag such errors so that layer can classify them.
+function markTransientTransport(error) {
+    return Object.assign(error, { isTransientTransportError: true });
+}
+function transientTransportError(message) {
+    return markTransientTransport(new Error(message));
+}
 class SocketFrontendClient {
     socketPath;
     pending = new Map();
@@ -65,7 +74,7 @@ class SocketFrontendClient {
         return () => this.closeListeners.delete(listener);
     }
     close() {
-        this.failPending(new Error("frontend socket closed"));
+        this.failPending(transientTransportError("frontend socket closed"));
         this.socket?.destroy();
         this.socket = null;
     }
@@ -78,19 +87,20 @@ class SocketFrontendClient {
             const socket = net.createConnection(this.socketPath);
             const fail = (error) => {
                 this.connecting = null;
-                reject(error);
+                reject(markTransientTransport(error));
             };
             socket.once("error", fail);
             socket.once("connect", () => {
                 socket.removeListener("error", fail);
                 socket.on("error", (error) => {
-                    this.failPending(error);
+                    const transient = markTransientTransport(error);
+                    this.failPending(transient);
                     for (const listener of this.closeListeners)
-                        listener(error);
+                        listener(transient);
                 });
                 socket.on("data", (chunk) => this.handleData(chunk.toString("utf8")));
                 socket.on("close", () => {
-                    const error = new Error("frontend socket closed");
+                    const error = transientTransportError("frontend socket closed");
                     this.failPending(error);
                     for (const listener of this.closeListeners)
                         listener(error);

package/dist/senses/telegram-client.js

@@ -80,6 +80,12 @@ class FileTelegramOffsetStore {
 exports.FileTelegramOffsetStore = FileTelegramOffsetStore;
 const DEFAULT_TELEGRAM_INDETERMINATE_RETENTION_MS = 24 * 60 * 60 * 1_000;
 const DEFAULT_TELEGRAM_MAX_INDETERMINATE_RECEIPTS = 1_000;
+// Long-poll retry backoff. A transient failure (a Telegram 5xx, a dropped
+// authority socket in the resident, or a relayed gateway 409 during a
+// getUpdates-session reclaim) must not exit the sense process; the loop waits
+// and retries, doubling from the base up to the cap and resetting on success.
+const TELEGRAM_POLL_RETRY_BASE_MS = 1_000;
+const TELEGRAM_POLL_RETRY_MAX_MS = 30_000;
 const TELEGRAM_UPDATE_DIGEST_DOMAIN = "ouroboros.telegram.update.v1";
 const TELEGRAM_UPDATE_SEQUENCE_DOMAIN = "ouroboros.telegram.update-sequence.v1";
 const TELEGRAM_UPDATE_DIGEST = /^tgu_[A-Za-z0-9_-]{43}$/u;
@@ -469,14 +475,26 @@ class FileTelegramUpdateInboxStore {
     }
 }
 exports.FileTelegramUpdateInboxStore = FileTelegramUpdateInboxStore;
+// A poll failure is retryable when it is a transient transport condition: a
+// Telegram Bot API error (network/HTTP), or an authority-socket error flagged
+// transient by the resident's socket client (a dropped or refused connection).
+// Dispatch and durable-audit invariant failures are not transport conditions;
+// they must surface rather than be spun on indefinitely.
+function isRetryablePollError(error) {
+    if (error instanceof TelegramApiError)
+        return true;
+    return error instanceof Error
+        && error.isTransientTransportError === true;
+}
 function createTelegramLongPoll(options) {
     let nextUpdateId = options.offsetStore.load();
     const shutdown = new AbortController();
-    const retryAfterPollError = (signal) => new Promise((resolve, reject) => {
-        const timer = setTimeout(resolve, 1_000);
+    const retryAfterPollError = (signal, attempt) => new Promise((resolve) => {
+        const delay = Math.min(TELEGRAM_POLL_RETRY_BASE_MS * 2 ** Math.max(0, attempt - 1), TELEGRAM_POLL_RETRY_MAX_MS);
+        const timer = setTimeout(resolve, delay);
         signal.addEventListener("abort", () => {
             clearTimeout(timer);
-            reject(signal.reason);
+            resolve();
         }, { once: true });
     });
     const inboundAttachments = (message) => {
@@ -690,23 +708,37 @@ function createTelegramLongPoll(options) {
         pollOnce,
         async run(signal) {
             const runSignal = signal ? AbortSignal.any([shutdown.signal, signal]) : shutdown.signal;
+            let consecutiveFailures = 0;
             while (!runSignal.aborted) {
                 try {
                     await pollOnce(runSignal);
+                    consecutiveFailures = 0;
                 }
                 catch (error) {
                     if (shutdown.signal.aborted || signal?.aborted)
                         return;
-                    if (!(error instanceof TelegramApiError))
+                    // Only transient transport failures are retried here: a Telegram API
+                    // error, or a dropped/again-failing authority socket in the resident.
+                    // Exiting the process on those (as an unhandled throw would) only
+                    // trades an in-process retry for a heavier container/daemon restart
+                    // cycle, which is what produced the observed ~10s crash-loops. A
+                    // non-transport failure (a dispatch or durable-audit invariant) still
+                    // surfaces so it is not silently spun on.
+                    if (!isRetryablePollError(error))
                         throw error;
+                    consecutiveFailures += 1;
                     (0, runtime_1.emitNervesEvent)({
                         level: "warn",
                         component: "senses",
                         event: "telegram.poll_retry",
                         message: "Telegram long poll request failed; retrying",
-                        meta: { status: error.status, errorCode: error.errorCode },
+                        meta: {
+                            attempt: consecutiveFailures,
+                            ...(error instanceof TelegramApiError ? { status: error.status, errorCode: error.errorCode } : {}),
+                            reason: error.message,
+                        },
                     });
-                    await retryAfterPollError(runSignal);
+                    await retryAfterPollError(runSignal, consecutiveFailures);
                 }
             }
         },

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.830",
+  "version": "0.1.0-alpha.832",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.830",
+      "version": "0.1.0-alpha.832",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.830",
+  "version": "0.1.0-alpha.832",
   "engines": {
     "node": ">=22"
   },