ai-control-center 1.15.2

package/lib/telegram/bot.js

@@ -0,0 +1,416 @@
+/**
+ * AI Control Center Telegram Bot — remote pipeline control + notifications.
+ *
+ * v1.6.67 — Resilient polling architecture inspired by OpenClaw's monitorTelegramProvider.
+ *
+ * Key improvements over v1.6.66:
+ *   1. Fresh Bot instance per restart cycle — no stale HTTP/polling state
+ *   2. Exponential backoff with jitter (2s → 30s cap) — prevents API hammering
+ *   3. Error classification — recoverable network errors vs fatal bugs
+ *   4. Standalone API for notifications — survives bot restarts
+ *
+ * Setup:
+ *   1. Talk to @BotFather on Telegram → /newbot → get token
+ *   2. Set env vars (prefix with your project prefix from aicc.config.js):
+ *      export {PREFIX}_TELEGRAM_TOKEN=your_bot_token
+ *      export {PREFIX}_TELEGRAM_CHAT_ID=your_chat_id  (for push notifications)
+ *      export {PREFIX}_TELEGRAM_ALLOWED_IDS=id1,id2   (whitelist — comma-separated user/chat IDs)
+ *   3. Run: aicc telegram
+ *
+ * Security:
+ *   - TELEGRAM_ALLOWED_IDS restricts who can use the bot.
+ *   - If not set, only TELEGRAM_CHAT_ID is allowed.
+ *   - If neither is set, the bot runs in "discovery mode" — it only responds
+ *     to /start (to show the chat ID) and ignores everything else.
+ *   - Unauthorized users get a single rejection message.
+ *
+ * To find your chat ID: send /start to the bot, check the logs.
+ */
+import { Api, Bot } from 'grammy';
+import { env, getConfig, loadConfig } from '../config.js';
+import { autoResumePipeline } from '../shared/action-runner.js';
+import { bus } from '../shared/event-bus.js';
+import { registerCommands } from './commands.js';
+import { setupNotifications } from './notifications.js';
+
+// ─── Resilience utilities (ported from OpenClaw's monitorTelegramProvider) ─────
+
+/** Backoff policy — starts at 2s, caps at 30s, with 25% random jitter */
+const RESTART_POLICY = { initialMs: 2000, maxMs: 30000, factor: 1.8, jitter: 0.25 };
+
+/** Exponential backoff with jitter — prevents thundering herd on API recovery */
+function computeBackoff(attempt, policy = RESTART_POLICY) {
+  const base = Math.min(policy.initialMs * Math.pow(policy.factor, attempt), policy.maxMs);
+  const jitter = base * policy.jitter * (Math.random() * 2 - 1); // ±25%
+  return Math.max(500, Math.round(base + jitter));
+}
+
+/** Classify errors as recoverable (network/transient) vs fatal (code bugs, auth) */
+function isRecoverableError(err) {
+  if (!err) return false;
+  const msg = String(err?.message || err).toLowerCase();
+  const code = err?.code || '';
+
+  // Recoverable system error codes (network layer)
+  const RECOVERABLE_CODES = [
+    'ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'ENOTFOUND', 'EAI_AGAIN',
+    'EPIPE', 'EHOSTUNREACH', 'ENETUNREACH', 'ERR_SOCKET_CONNECTION_TIMEOUT',
+  ];
+  if (RECOVERABLE_CODES.includes(code)) return true;
+
+  // Telegram API 409 conflict is always recoverable
+  if (err?.error_code === 409) return true;
+
+  // Recoverable message patterns (network issues, rate limits, server errors)
+  const RECOVERABLE_PATTERNS = [
+    'network', 'timeout', 'econnreset', 'econnrefused', 'etimedout',
+    'socket', 'dns', 'fetch failed', 'abort', 'terminated', 'getaddrinfo',
+    'connection', '502 ', '503 ', '429 ', 'too many requests',
+    'internal server error', 'bad gateway', 'service unavailable',
+  ];
+  return RECOVERABLE_PATTERNS.some(p => msg.includes(p));
+}
+
+const sleep = (ms) => new Promise(r => setTimeout(r, ms));
+
+// ─── Exported for testing ──────────────────────────────────────────────────────
+export { computeBackoff, isRecoverableError, RESTART_POLICY };
+
+// ─── Main bot startup ──────────────────────────────────────────────────────────
+
+export async function startBot() {
+  // Guard against double execution (ESM can re-evaluate modules)
+  const GUARD_KEY = '__aicc_telegram_bot_started__';
+  if (globalThis[GUARD_KEY]) return;
+  globalThis[GUARD_KEY] = true;
+
+  // Ensure config + .env are loaded before reading env vars
+  await loadConfig().catch(() => {});
+
+  const BOT_TOKEN   = env('TELEGRAM_TOKEN');
+  const CHAT_ID     = env('TELEGRAM_CHAT_ID');
+  const ALLOWED_RAW = env('TELEGRAM_ALLOWED_IDS');
+
+  if (!BOT_TOKEN) {
+    const prefix = (() => { try { return getConfig().envPrefix; } catch { return 'AICC'; } })();
+    console.error(`\n  Missing ${prefix}_TELEGRAM_TOKEN environment variable.`);
+    console.error('  Get one from @BotFather on Telegram.\n');
+    process.exit(1);
+  }
+
+  // Deprecation notice: recommend OpenClaw bridge for Telegram
+  try {
+    const { existsSync: _exists } = await import('fs');
+    const { resolve: _resolve } = await import('path');
+    const homeDir = process.env.HOME || process.env.USERPROFILE;
+    if (_exists(_resolve(homeDir, '.openclaw', 'openclaw.json'))) {
+      console.log('  ⚠️  OpenClaw detected. Consider using the OpenClaw bridge instead of the built-in Telegram bot.');
+      console.log('     Set roleplay.openclawBridge: true in aicc.config.js and run "aicc start".');
+      console.log('     The bridge provides multi-channel support (Telegram + WhatsApp + Slack + Discord).\n');
+    }
+  } catch { /* ok */ }
+
+  // ─── Build whitelist ──────────────────────────────────────────────────────────
+  // Accepts user IDs and/or chat IDs (both are numbers in Telegram).
+  // Sources: TELEGRAM_ALLOWED_IDS (comma-separated) + TELEGRAM_CHAT_ID
+  const allowedIds = new Set();
+
+  if (ALLOWED_RAW) {
+    ALLOWED_RAW.split(',').map(s => s.trim()).filter(Boolean).forEach(id => allowedIds.add(id));
+  }
+  if (CHAT_ID) {
+    allowedIds.add(CHAT_ID);
+  }
+
+  const isWhitelistConfigured = allowedIds.size > 0;
+
+  // ─── Standalone API for notifications — survives bot restarts ─────────────────
+  // This never gets stale because it's not tied to any polling lifecycle.
+  const notifyApi = new Api(BOT_TOKEN);
+
+  /** Send a notification to the chat — fire-and-forget, never throws */
+  function notifyChat(text, opts = {}) {
+    if (!CHAT_ID) return;
+    notifyApi.sendMessage(CHAT_ID, text, { parse_mode: 'HTML', ...opts }).catch(() => {});
+  }
+
+  // ─── Auth middleware (reusable across fresh bot instances) ─────────────────────
+  const authMiddleware = async (ctx, next) => {
+    const chatId   = String(ctx.chat?.id ?? '');
+    const userId   = String(ctx.from?.id ?? '');
+    const username = ctx.from?.username || 'unknown';
+
+    // Always allow /start so new users can discover their chat ID
+    const isStart = ctx.message?.text?.startsWith('/start') || false;
+
+    if (!isWhitelistConfigured) {
+      // Discovery mode — only /start works
+      if (isStart) {
+        console.log(`  [AUTH] Discovery mode — /start from ${username} (user: ${userId}, chat: ${chatId})`);
+        console.log(`  [AUTH] To whitelist, set: ${getConfig().envPrefix}_TELEGRAM_ALLOWED_IDS=${userId}`);
+        await ctx.reply(
+          `Your user ID: \`${userId}\`\nYour chat ID: \`${chatId}\`\n\n` +
+          `Add one of these to your env to enable the bot:\n` +
+          `\`${getConfig().envPrefix}_TELEGRAM_ALLOWED_IDS=${userId}\``,
+          { parse_mode: 'Markdown' }
+        );
+      }
+      return; // Block all commands in discovery mode
+    }
+
+    // Whitelist check — match against user ID or chat ID
+    if (allowedIds.has(userId) || allowedIds.has(chatId)) {
+      return next(); // Authorized — proceed to command handlers
+    }
+
+    // Unauthorized
+    console.log(`  [AUTH] Blocked: ${username} (user: ${userId}, chat: ${chatId})`);
+
+    if (isStart) {
+      await ctx.reply(
+        `Access denied.\n\nYour user ID: \`${userId}\`\nContact the bot owner to request access.`,
+        { parse_mode: 'Markdown' }
+      );
+    }
+    // Silently ignore all other messages from unauthorized users
+  };
+
+  // ─── Notifications — set up ONCE using standalone API ─────────────────────────
+  // Pass { api: notifyApi } as a proxy — setupNotifications only uses bot.api.*
+  // This way notifications survive bot restarts without re-registering bus listeners.
+  setupNotifications({ api: notifyApi }, bus, CHAT_ID);
+
+  // Start watching status.json
+  bus.startWatching();
+
+  // Initialize roleplay room + PM agent (non-fatal)
+  try {
+    const { isRoleplayEnabled } = await import('../roleplay/roleplay-config.js');
+    if (isRoleplayEnabled()) {
+      const { initRoom } = await import('../roleplay/room.js');
+      const { startPMAgent } = await import('../roleplay/pm-agent.js');
+      const room = initRoom(bus);
+      startPMAgent(bus, room);
+    }
+  } catch { /* roleplay optional — non-fatal */ }
+
+  // ─── Resilient polling loop ──────────────────────────────────────────────────
+  let _crashCount = 0;
+  let _attempt = 0;
+  let _currentBot = null;
+  let _triggerRestart = null; // crash signal resolver — accessible by global handlers
+  let _running = true;
+  let _lastRecoveryNotifyTime = 0; // suppress repeated "back online" messages
+  const RECOVERY_NOTIFY_COOLDOWN = 5 * 60 * 1000; // 5 minutes between recovery notifications
+
+  /** Create a FRESH Bot instance with auth middleware + commands registered.
+   *  This is the #1 fix — a fresh instance has no stale HTTP state, no broken
+   *  keep-alive connections, no corrupted polling offset. OpenClaw does this
+   *  every cycle via createPollingBot(). */
+  /** Telegram command menu — shown when user types "/" in the chat */
+  const BOT_COMMANDS = [
+    { command: 'feature', description: '✨ Submit a new feature' },
+    { command: 'bug', description: '🐛 Report and fix a bug' },
+    { command: 'review', description: '🔍 Trigger code review' },
+    { command: 'approve', description: '✅ Approve current feature' },
+    { command: 'reject', description: '❌ Reject with reason' },
+    { command: 'implement', description: '⚡ Trigger Coder implementation' },
+    { command: 'deploy', description: '🚀 Deploy to environment' },
+    { command: 'status', description: '📊 Pipeline status' },
+    { command: 'health', description: '🏥 System health check' },
+    { command: 'logs', description: '📋 View session logs' },
+    { command: 'docs', description: '📂 Browse pipeline documents' },
+    { command: 'costs', description: '💰 AI usage & cost summary' },
+    { command: 'leaderboard', description: '🏆 AI model performance' },
+    { command: 'audit', description: '📋 Recent audit log' },
+    { command: 'autopilot', description: '⚡ Toggle auto-pilot mode' },
+    { command: 'reset', description: '🔄 Reset / Abandon feature' },
+    { command: 'cleanup', description: '🧹 Clean up workspace' },
+    { command: 'retry', description: '🔁 Retry from checkpoint' },
+    { command: 'ask', description: '🤖 Ask AI a question' },
+    { command: 'aimode', description: '🧠 View/toggle AI mode' },
+    { command: 'dryrun', description: '🧪 Pipeline dry run' },
+    { command: 'assign', description: '🎯 Assign project URL + goal to AI IT dept' },
+    { command: 'qa', description: '🔬 Run browser QA tests on target website' },
+    { command: 'suggest', description: '💡 AI suggests features based on QA data' },
+    { command: 'threads', description: '💬 View open discussion threads' },
+    { command: 'menu', description: '📱 Show main menu buttons' },
+  ];
+
+  function createFreshBot() {
+    const bot = new Bot(BOT_TOKEN);
+    bot.use(authMiddleware);
+    registerCommands(bot);
+    // Register command menu with Telegram — shows suggestions when user types "/"
+    bot.api.setMyCommands(BOT_COMMANDS).catch(err =>
+      console.error(`  [Bot] Failed to set command menu: ${err.message}`)
+    );
+    return bot;
+  }
+
+  async function resilientLoop() {
+    while (_running) {
+      // ── Create FRESH bot each cycle — no stale HTTP/polling state ──────────
+      const bot = createFreshBot();
+      _currentBot = bot;
+
+      // Crash signal — resolved when bot.catch() or global error handlers fire.
+      // The Promise.race below picks up either clean-stop or crash.
+      const crashSignal = new Promise(resolve => { _triggerRestart = resolve; });
+
+      bot.catch((err) => {
+        const e = err.error || err;
+        _crashCount++;
+        console.error(`  [Bot] Polling/middleware error: ${e.message || e}`);
+        try { bot.stop(); } catch {}
+        if (_triggerRestart) _triggerRestart(e);
+      });
+
+      // Clear any stale webhook before starting — prevents 409 conflicts
+      try { await bot.api.deleteWebhook({ drop_pending_updates: false }); } catch {}
+
+      try {
+        const result = await Promise.race([
+          bot.start({
+            onStart: (info) => {
+              const wasRestarted = _crashCount > 0;
+              if (wasRestarted) _attempt = 0; // reset backoff on successful reconnect
+              _crashCount = 0;
+
+              console.log(`\n  ${getConfig().name} Telegram Bot`);
+              console.log(`  @${info.username}`);
+              if (isWhitelistConfigured) {
+                console.log(`  Whitelist: ${[...allowedIds].join(', ')}`);
+              } else {
+                console.log(`  WARNING: No whitelist configured — discovery mode only`);
+                console.log(`  Set ${getConfig().envPrefix}_TELEGRAM_ALLOWED_IDS to enable commands`);
+              }
+              if (CHAT_ID) console.log(`  Push notifications → chat ${CHAT_ID}`);
+              console.log('');
+
+              // Notify user when bot recovers from a crash (with cooldown to prevent spam)
+              if (wasRestarted && Date.now() - _lastRecoveryNotifyTime > RECOVERY_NOTIFY_COOLDOWN) {
+                _lastRecoveryNotifyTime = Date.now();
+                const s = bus.getStatus();
+                const pipelineInfo = s?.current_feature
+                  ? `\nPipeline: <code>${s.current_feature}</code> at stage <b>${s.stage}</b>`
+                  : '';
+                notifyChat(`🟢 Bot is back online after crash recovery.${pipelineInfo}`);
+              }
+
+              // Resume any auto pipeline that was interrupted by a restart
+              setTimeout(() => autoResumePipeline().catch(err =>
+                console.error('[Pipeline] Resume error:', err.message)), 3000);
+            },
+          }).then(() => ({ type: 'clean-stop' })),
+          crashSignal.then(e => ({ type: 'crash', error: e })),
+        ]);
+
+        if (result.type === 'clean-stop') {
+          // Graceful stop (SIGINT) — exit loop
+          console.log('  [Bot] Graceful stop.');
+          break;
+        }
+
+        // ── Handle crash — compute backoff and retry ────────────────────────
+        const err = result.error;
+        _attempt++;
+
+        // 409 = another instance polling — must wait for Telegram's 30s timeout
+        if (err?.error_code === 409) {
+          const delay = 35000;
+          _crashCount = 0; // 409 is not a real crash — reset so recovery notification doesn't fire
+          console.log(`  [Bot] Conflict (409) — waiting 35s for Telegram to release... (attempt ${_attempt})`);
+          await sleep(delay);
+          continue;
+        }
+
+        // Classify error and compute appropriate delay
+        const recoverable = isRecoverableError(err);
+        const delay = recoverable ? computeBackoff(_attempt) : 30000;
+        const label = recoverable ? 'Recoverable' : 'Fatal';
+        console.log(`  [Bot] ${label} error — restarting with fresh instance in ${(delay / 1000).toFixed(1)}s (attempt ${_attempt})...`);
+        // Only notify on first error or after cooldown — prevent spam during crash loops
+        if (_attempt <= 1 || Date.now() - _lastRecoveryNotifyTime > RECOVERY_NOTIFY_COOLDOWN) {
+          notifyChat(`${recoverable ? '⚠️' : '🚨'} Bot ${label.toLowerCase()} error: ${err?.message || 'unknown'}\nRestarting in ${(delay / 1000).toFixed(1)}s (attempt ${_attempt})...`);
+        }
+        await sleep(delay);
+
+      } catch (err) {
+        // Startup-phase error (before polling begins)
+        _crashCount++;
+        _attempt++;
+
+        if (err.error_code === 409) {
+          _crashCount = 0; // 409 is not a real crash — reset so recovery notification doesn't fire
+          console.log(`  [Bot] Conflict (409) at startup — waiting 35s...`);
+          await sleep(35000);
+          continue;
+        }
+
+        const recoverable = isRecoverableError(err);
+        const delay = recoverable ? computeBackoff(_attempt) : 30000;
+        console.error(`  [Bot] Startup error: ${err.message}`);
+        console.log(`  [Bot] Restarting in ${(delay / 1000).toFixed(1)}s (attempt ${_attempt})...`);
+        notifyChat(`🚨 Bot startup error: ${err.message}\nRestarting in ${(delay / 1000).toFixed(1)}s...`);
+        await sleep(delay);
+      }
+    }
+  }
+
+  // ─── Global error handlers — force restart via crash signal ──────────────────
+  // These catch errors that escape grammy's error boundary (unhandled promises,
+  // uncaught exceptions from callbacks, etc.) and feed them into the resilient
+  // loop instead of letting the process die silently.
+
+  process.on('uncaughtException', (err) => {
+    console.error('  [Bot] Uncaught exception:', err.message);
+    _crashCount++;
+    notifyChat(`🚨 Uncaught exception: ${err.message}\nForcing restart with fresh bot instance...`);
+    if (_currentBot) try { _currentBot.stop(); } catch {}
+    if (_triggerRestart) _triggerRestart(err);
+  });
+
+  process.on('unhandledRejection', (err) => {
+    const msg = err?.message || String(err);
+    if (isRecoverableError(err)) {
+      // Network/transient error — restart with backoff
+      console.error('  [Bot] Unhandled rejection (recoverable):', msg);
+      _crashCount++;
+      if (_currentBot) try { _currentBot.stop(); } catch {}
+      if (_triggerRestart) _triggerRestart(err);
+    } else {
+      // Non-network rejection — log but don't restart (might be a code bug
+      // that would cause infinite restart loops)
+      console.error('  [Bot] Unhandled rejection (non-recoverable, not restarting):', msg);
+    }
+  });
+
+  // ─── Signal handling ──────────────────────────────────────────────────────────
+
+  // Ignore SIGHUP — prevents instant death when terminal disconnects
+  // (SSH timeout, terminal tab close, macOS sleep, etc.)
+  process.on('SIGHUP', () => {
+    console.log('  [Bot] SIGHUP received — ignoring (terminal disconnect).');
+  });
+
+  // Cleanup on explicit interrupt
+  process.on('SIGINT', () => {
+    _running = false;
+    bus.stopWatching();
+    if (_currentBot) _currentBot.stop();
+    process.exit(0);
+  });
+
+  // ─── Start the resilient loop ─────────────────────────────────────────────────
+  resilientLoop().catch(err => {
+    console.error('  [Bot] Resilience loop fatal crash:', err.message);
+    notifyChat(`💀 Bot resilience loop crashed: ${err.message}`);
+    process.exit(1);
+  });
+}
+
+// Auto-start when run directly (node bot.js), not when imported via aicc CLI
+if (process.argv[1]?.endsWith('bot.js')) {
+  startBot();
+}