@reefclaw/openclaw-plugin 0.1.19 → 0.1.20

package/bridge/gateway/gateway-ws-client.d.ts

@@ -1,7 +1,10 @@
 import { type ReconnectConfig as BaseReconnectConfig } from '../utils/reconnect.js';
 import type { GatewayConfig } from './gateway-config.js';
 interface ReconnectConfig extends BaseReconnectConfig {
-    maxAttempts: number;
+    /** Fast-backoff attempts before falling back to the slow retry loop */
+    maxFastAttempts: number;
+    /** Slow retry interval once the fast attempts are exhausted (ms) */
+    slowRetryMs: number;
 }
 /** hello-ok response payload from gateway */
 export interface HelloOkPayload {
@@ -56,6 +59,9 @@ export declare class GatewayWsClient {
     private ws;
     private state;
     private attempt;
+    /** True once the fast burst is spent and we are in the slow retry loop
+     *  (kept so the "switching to slow retry" warning logs once, not per attempt). */
+    private slowRetryActive;
     private reconnectTimer;
     private staleWarnTimer;
     private staleReconnectTimer;

package/bridge/gateway/gateway-ws-client.js

@@ -30,11 +30,23 @@ const MIN_PROTOCOL_VERSION = 3;
 const MAX_PROTOCOL_VERSION = 4;
 const CLIENT_ID = 'openclaw-tui';
 const CLIENT_VERSION = '0.1.0';
+// Mirrors the relay connector's proven shape (see connector.ts DEFAULT_RECONNECT):
+// a bounded fast-backoff burst, then a slow retry that NEVER gives up.
+//
+// This client used to have `maxAttempts: 20` and go terminal ('failed') when it
+// ran out — roughly 9 minutes of budget (2+4+8+16s, then 16 x 30s). On
+// 2026-07-31 an OpenClaw upgrade left the gateway crash-looping for 56 minutes;
+// the bridge burned its 20 attempts in the first 9, gave up permanently, and
+// stayed dark even AFTER the gateway recovered. The dashboard — the operator's
+// window and one of the emergency-control paths — required a manual bridge
+// restart to come back. Any gateway downtime over ~9 min (upgrade, reboot,
+// crash-loop) reproduced it, on every deployment.
 const DEFAULT_RECONNECT = {
     baseDelayMs: 2_000,
     maxDelayMs: 30_000,
-    maxAttempts: 20,
+    maxFastAttempts: 20,
     jitterFactor: 0.3,
+    slowRetryMs: 60_000,
 };
 // ---- Fatal close codes ----
 /** Auth errors — do not reconnect */
@@ -45,6 +57,9 @@ export class GatewayWsClient {
     ws = null;
     state = 'disconnected';
     attempt = 0;
+    /** True once the fast burst is spent and we are in the slow retry loop
+     *  (kept so the "switching to slow retry" warning logs once, not per attempt). */
+    slowRetryActive = false;
     reconnectTimer = null;
     staleWarnTimer = null;
     staleReconnectTimer = null;
@@ -351,6 +366,7 @@ export class GatewayWsClient {
         logger.info(TAG, `Connected to gateway (protocol=${payload.protocol})`);
         this.lastHelloOk = payload;
         this.attempt = 0; // Reset reconnect counter
+        this.slowRetryActive = false; // Back on the fast budget for the next drop
         // Parse policy
         if (payload.policy?.tickIntervalMs) {
             this.tickIntervalMs = payload.policy.tickIntervalMs;
@@ -403,14 +419,21 @@ export class GatewayWsClient {
     // ---- Reconnection ----
     scheduleReconnect() {
         this.attempt++;
-        if (this.attempt > this.reconnectConfig.maxAttempts) {
-            logger.error(TAG, `Max reconnection attempts (${this.reconnectConfig.maxAttempts}) exceeded`);
-            this.setState('failed');
-            this.emit('failed', { reason: 'Max reconnection attempts exceeded' });
-            return;
+        const { maxFastAttempts, slowRetryMs } = this.reconnectConfig;
+        // Exhausting the fast burst is NOT terminal — a gateway that is down for an
+        // hour (upgrade, reboot, crash-loop) must still be picked up when it
+        // returns. Only a fatal close code (4001 auth) ends the client, because a
+        // rejected token will never start working and must not be retried forever.
+        const exhausted = this.attempt > maxFastAttempts;
+        if (exhausted && !this.slowRetryActive) {
+            this.slowRetryActive = true;
+            logger.warn(TAG, `Fast reconnect budget (${maxFastAttempts} attempts) exhausted — switching to slow retry every ` +
+                `${Math.round(slowRetryMs / 1000)}s. Still trying; will reconnect on its own when the gateway returns.`);
         }
-        const delay = computeDelay(this.attempt - 1, this.reconnectConfig);
-        logger.info(TAG, `Reconnecting in ${Math.round(delay)}ms (attempt ${this.attempt}/${this.reconnectConfig.maxAttempts})`);
+        const delay = exhausted ? slowRetryMs : computeDelay(this.attempt - 1, this.reconnectConfig);
+        logger.info(TAG, exhausted
+            ? `Reconnecting in ${Math.round(delay)}ms (slow retry, attempt ${this.attempt})`
+            : `Reconnecting in ${Math.round(delay)}ms (attempt ${this.attempt}/${maxFastAttempts})`);
         this.setState('reconnecting');
         this.emit('reconnecting', { attempt: this.attempt, delayMs: Math.round(delay) });
         this.reconnectTimer = setTimeout(() => {

package/ingest/position-auto-capture.js

@@ -124,6 +124,25 @@ export async function onCreateOrderFilled(ctx, inputs, order) {
     //             scale-ins with WS-exact data; capturing here would double-post).
     const existing = ctx.stateStore.get(inputs.symbol);
     if (existing) {
+        // ★ SAME-ORDER GUARD — the twin of the dedup in onWsFillObserved (which
+        // returns when `stateEntry.openedFromExchangeTradeId === fill.exchangeOrderId`).
+        // That one covers create_order-then-WS; this covers WS-then-create_order,
+        // which is the ORDINARY ordering for a market order: the WS fill routinely
+        // beats the REST response (measured ~270-415ms on prod).
+        //
+        // Without it the stale probe below decides this case, and it CANNOT: its
+        // test is "does the exchange position equal this fill?", which is equally
+        // true of a genuinely stale mapping AND of the mapping the WS path just
+        // wrote for THIS VERY FILL. It chose 'stale', dropped the fresh mapping and
+        // journaled a second position — 38 duplicate pairs in 9 days (~11/day), each
+        // orphaning the WS row at 0 reviews while the exchange held ONE position.
+        // The twins were undedupable downstream because they key on different ids
+        // (WS = trade id, here = order id).
+        const orderId = typeof order.id === 'string' ? order.id : undefined;
+        if (orderId && existing.openedFromExchangeTradeId === orderId) {
+            logger.info(TAG, `onCreateOrderFilled ${inputs.symbol}: WS fill path already captured this order (${orderId}) — skipping duplicate capture`);
+            return;
+        }
         const probe = await probeStaleStateEntry(ctx, inputs.symbol, filledQty);
         if (probe === 'stale') {
             logger.warn(TAG, `onCreateOrderFilled ${inputs.symbol}: state-store entry (openedAt=${existing.openedAt}) is STALE — ` +

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "reefclaw-paper-trading",
   "name": "ReefClaw Trading",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "Supervised trading plugin for the ReefClaw dashboard. It runs on YOUR machine and starts in PAPER mode with no API keys. It cannot trade real funds until you supply exchange credentials and step PAPER→MICRO_LIVE→LIVE yourself from the dashboard — the agent cannot make that change (the tool is refused without operator provenance). Exchange keys stay local, are used only to sign requests to the exchange, and are never transmitted to ReefClaw (asserted by a test in this package). Trading telemetry — positions, fills, decision journal — is sent to ReefClaw to render the dashboard. Every live position carries exchange-native protective stops. Remote updates to the agent's trading instructions are applied only after an Ed25519 signature is verified against a public key pinned in this build.",
   "author": "ReefClaw",
   "activation": {

package/package.json

@@ -1,38 +1,38 @@
-{
-  "name": "@reefclaw/openclaw-plugin",
-  "version": "0.1.19",
-  "description": "ReefClaw supervised trading plugin for OpenClaw. Runs entirely on YOUR machine and starts in PAPER mode — it cannot trade real funds until you supply exchange credentials and walk the PAPER→MICRO_LIVE→LIVE ladder yourself from the ReefClaw dashboard (the agent cannot make that change; it is refused without operator provenance). Your exchange API keys stay on your machine to sign requests to the exchange and are NEVER sent to ReefClaw — a test in the package asserts this. What does reach ReefClaw is trading telemetry for the dashboard (positions, fills, decision journal). Live trading always carries exchange-native protective stops. Trading instructions can be updated remotely, and every update must carry a valid Ed25519 signature verified against a key pinned in this build before it is applied. Install: /plugins install clawhub:@reefclaw/openclaw-plugin",
-  "type": "module",
-  "main": "index.js",
-  "openclaw": {
-    "extensions": [
-      "./index.js"
-    ],
-    "compat": {
-      "pluginApi": ">=2026.6.0"
-    },
-    "build": {
-      "openclawVersion": "2026.6.11"
-    }
-  },
-  "files": [
-    "**/*",
-    "!scripts/**"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "@reefclaw/shared": "0.1.4",
-    "ccxt": "4.5.37",
-    "json5": "2.2.3",
-    "ws": "8.21.1"
-  },
-  "scripts": {
-    "build": "node scripts/assemble.mjs",
-    "verify": "node scripts/verify-shared-contract.mjs",
-    "prepublishOnly": "node scripts/verify-shared-contract.mjs"
-  },
-  "license": "MIT",
-  "homepage": "https://reefclaw.com"
-}
+{
+  "name": "@reefclaw/openclaw-plugin",
+  "version": "0.1.20",
+  "description": "ReefClaw supervised trading plugin for OpenClaw. Runs entirely on YOUR machine and starts in PAPER mode \u00e2\u20ac\u201d it cannot trade real funds until you supply exchange credentials and walk the PAPER\u00e2\u2020\u2019MICRO_LIVE\u00e2\u2020\u2019LIVE ladder yourself from the ReefClaw dashboard (the agent cannot make that change; it is refused without operator provenance). Your exchange API keys stay on your machine to sign requests to the exchange and are NEVER sent to ReefClaw \u00e2\u20ac\u201d a test in the package asserts this. What does reach ReefClaw is trading telemetry for the dashboard (positions, fills, decision journal). Live trading always carries exchange-native protective stops. Trading instructions can be updated remotely, and every update must carry a valid Ed25519 signature verified against a key pinned in this build before it is applied. Install: /plugins install clawhub:@reefclaw/openclaw-plugin",
+  "type": "module",
+  "main": "index.js",
+  "openclaw": {
+    "extensions": [
+      "./index.js"
+    ],
+    "compat": {
+      "pluginApi": ">=2026.6.0"
+    },
+    "build": {
+      "openclawVersion": "2026.6.11"
+    }
+  },
+  "files": [
+    "**/*",
+    "!scripts/**"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@reefclaw/shared": "0.1.4",
+    "ccxt": "4.5.37",
+    "json5": "2.2.3",
+    "ws": "8.21.1"
+  },
+  "scripts": {
+    "build": "node scripts/assemble.mjs",
+    "verify": "node scripts/verify-shared-contract.mjs",
+    "prepublishOnly": "node scripts/verify-shared-contract.mjs"
+  },
+  "license": "MIT",
+  "homepage": "https://reefclaw.com"
+}