lazyclaw 6.0.1 → 6.1.0

package/channels/matrix.mjs

@@ -158,7 +158,7 @@ export class MatrixChannel extends Channel {
     if (typeof opts.since === 'string') this._since = opts.since;
     this._timeoutMs = typeof opts.timeoutMs === 'number' ? opts.timeoutMs : LONG_POLL_MS;
     const poll = opts.poll !== false; // default true
-    if (poll) this._startPollLoop({ logger: this._logger });
+    if (poll) this._startPollLoop({ logger: this._logger, onDead: opts.onDead });
     return this;
   }
 
@@ -191,8 +191,9 @@ export class MatrixChannel extends Channel {
           // base.mjs's bucket gate reads req.token || req.key, so the sender
           // id rides under `key`: an authToken gate compares against it and a
           // rate-limit gate keys per-sender. We keep senderId for downstream
-          // handler context too.
-          gateInput: { key: evt.senderId, senderId: evt.senderId },
+          // handler context, and the globally-unique event_id for daemon-
+          // side dedup.
+          gateInput: { key: evt.senderId, senderId: evt.senderId, messageId: evt.eventId },
         });
       } catch (err) {
         if (err instanceof ChannelGated || err?.code === 'CHANNEL_GATED') {
@@ -253,6 +254,7 @@ export class MatrixChannel extends Channel {
       threadId,
       text,
       senderId: gateInput && gateInput.senderId != null ? gateInput.senderId : null,
+      messageId: gateInput && gateInput.messageId != null ? gateInput.messageId : null,
     });
   }
 
@@ -320,8 +322,16 @@ export class MatrixChannel extends Channel {
   // backs off rather than crashing the daemon. The in-flight AbortController
   // is held so stop() can abort the ~30s held-open request for prompt
   // shutdown.
-  _startPollLoop({ logger }) {
+  _startPollLoop({ logger, onDead }) {
     let stopped = false;
+    // Abnormal loop death must be VISIBLE to a live process: a gateway whose
+    // matrix poll silently exits looks healthy while being deaf on that
+    // channel. Default: throw from a fresh tick so the process crash
+    // handlers fire (and a service manager restarts it).
+    const dead = (err) => {
+      if (typeof onDead === 'function') return onDead(err);
+      setImmediate(() => { throw err; });
+    };
     const loop = async () => {
       while (!stopped) {
         try {
@@ -335,12 +345,20 @@ export class MatrixChannel extends Channel {
           }
         } catch (err) {
           if (stopped) break;
-          if (err?.name === 'AbortError' || err?.code === 'MATRIX_ABORTED') break;
+          if (err?.name === 'AbortError' || err?.code === 'MATRIX_ABORTED') {
+            // Aborted while NOT stopping = some other actor killed the
+            // in-flight sync — that's a dead listener, not a clean exit.
+            logger(`[matrix] sync aborted outside shutdown — stopping listener\n`);
+            this._fatal = err;
+            dead(err);
+            break;
+          }
           // A dead/forbidden token will never recover — stop the listener
           // and surface it rather than spinning forever on a 500ms back-off.
           if (err?.code === 'MATRIX_AUTH_FATAL') {
             logger(`[matrix] FATAL: ${err.message} — stopping listener\n`);
             this._fatal = err;
+            dead(err);
             break;
           }
           logger(`[matrix] poll error: ${err?.message || err}\n`);

package/channels/slack.mjs

@@ -19,17 +19,10 @@
 // Phase 8 spec can point the adapter at a local mock HTTP server.
 
 import { Channel, ChannelGated } from './base.mjs';
+import { SlackError, readSlackEnv, validateEnv } from './slack_env.mjs';
 
-const DEFAULT_API_BASE = 'https://slack.com/api';
-
-export class SlackError extends Error {
-  constructor(message, code, missing) {
-    super(message);
-    this.name = 'SlackError';
-    this.code = code || 'SLACK_ERR';
-    if (Array.isArray(missing)) this.missing = missing;
-  }
-}
+// Re-exported for compatibility (split out under the file-size ratchet).
+export { SlackError, readSlackEnv } from './slack_env.mjs';
 
 // Decide whether a Socket Mode event should drive a handler call.
 // Pulled out of dispatchEvent so we can unit-test the filter without
@@ -57,34 +50,6 @@ export function shouldDispatchEvent(event, { selfUserId = null, selfBotId = null
   return true;
 }
 
-export function readSlackEnv(env = process.env) {
-  const out = {
-    botToken: env.SLACK_BOT_TOKEN || null,
-    appToken: env.SLACK_APP_TOKEN || null,
-    signingSecret: env.SLACK_SIGNING_SECRET || null,
-    apiBase: env.SLACK_API_BASE || DEFAULT_API_BASE,
-  };
-  return out;
-}
-
-function validateEnv(env, { requireInbound = false } = {}) {
-  const missing = [];
-  if (!env.botToken) missing.push('SLACK_BOT_TOKEN');
-  else if (!env.botToken.startsWith('xoxb-')) {
-    throw new SlackError('SLACK_BOT_TOKEN must start with "xoxb-"', 'SLACK_BAD_TOKEN', ['SLACK_BOT_TOKEN']);
-  }
-  if (requireInbound) {
-    if (!env.appToken) missing.push('SLACK_APP_TOKEN');
-    else if (!env.appToken.startsWith('xapp-')) {
-      throw new SlackError('SLACK_APP_TOKEN must start with "xapp-"', 'SLACK_BAD_TOKEN', ['SLACK_APP_TOKEN']);
-    }
-    if (!env.signingSecret) missing.push('SLACK_SIGNING_SECRET');
-  }
-  if (missing.length) {
-    throw new SlackError(`missing Slack env vars: ${missing.join(', ')}`, 'SLACK_MISSING_ENV', missing);
-  }
-}
-
 export class SlackChannel extends Channel {
   constructor(opts = {}) {
     super('slack');
@@ -112,10 +77,10 @@ export class SlackChannel extends Channel {
   // handler that decided to stay silent — e.g. the listener dropping
   // an empty-after-mention-strip inbound — doesn't leak a "(empty
   // reply)" placeholder into the channel.
-  async _simulateInbound(text, threadId) {
+  async _simulateInbound(text, threadId, senderId = null, messageId = null) {
     let reply;
     try {
-      reply = await this._processInbound({ threadId, text, gateInput: {} });
+      reply = await this._processInbound({ threadId, text, gateInput: { key: senderId, senderId, messageId } });
     } catch (err) {
       if (err instanceof ChannelGated || err?.code === 'CHANNEL_GATED') {
         await this.send(threadId, `(gated: ${err.message})`);
@@ -128,6 +93,30 @@ export class SlackChannel extends Channel {
     await this.send(threadId, reply);
   }
 
+  // The base _processInbound forwards { channel, threadId, text }; we enrich
+  // the event with senderId (the Slack user id) so the listener bridge can
+  // pass it to the daemon's /inbound pairing gate — without it, Slack is the
+  // one channel that can never be pairing-gated. Mirrors telegram/matrix;
+  // adds a field, never drops one.
+  async _processInbound({ threadId, text, gateInput }) {
+    if (this._gate) {
+      const verdict = this._gate.check(gateInput || {});
+      if (!verdict.ok) {
+        const err = new Error(verdict.reason || 'denied');
+        err.code = 'CHANNEL_GATED';
+        throw err;
+      }
+    }
+    if (!this._handler) throw new Error(`channel "${this.name}" has no handler`);
+    return await this._handler({
+      channel: this.name,
+      threadId,
+      text,
+      senderId: gateInput && gateInput.senderId != null ? gateInput.senderId : null,
+      messageId: gateInput && gateInput.messageId != null ? gateInput.messageId : null,
+    });
+  }
+
   // Translate a target spec like `slack:#deploys` or `slack:U012345` into
   // a Slack `channel` string. Threads are addressed by a `threadId` of
   // shape `<channel>:<thread_ts>` or plain channel/user id.
@@ -184,7 +173,11 @@ export class SlackChannel extends Channel {
   // opts.logger?: (line: string) => void — diagnostic sink (stderr in
   //   the CLI, no-op in tests).
   // opts.maxReconnects?: number — cap reconnect attempts (default ∞).
-  async _connectSocketMode({ logger = () => {}, maxReconnects = Infinity } = {}) {
+  // opts.onDead?: (err) => void — called when the reconnect chain gives up
+  //   for good. Default THROWS on the next tick so an always-on process
+  //   crashes loudly (and a service manager restarts it) instead of sitting
+  //   alive with a permanently dead socket.
+  async _connectSocketMode({ logger = () => {}, maxReconnects = Infinity, onDead } = {}) {
     validateEnv(this._env, { requireInbound: true });
     if (typeof globalThis.WebSocket !== 'function') {
       throw new SlackError(
@@ -284,6 +277,7 @@ export class SlackChannel extends Channel {
       // get app_mention events. Either way we have channel + ts.
       const text = typeof event.text === 'string' ? event.text : '';
       const channel = event.channel;
+      const senderId = event.user != null ? String(event.user) : null;  // the human who sent it
       const sourceTs = event.ts;                       // the message we react to
       const replyTs = event.thread_ts || event.ts;     // the thread root for replies
       if (!channel || !sourceTs) return;
@@ -292,6 +286,10 @@ export class SlackChannel extends Channel {
         return;
       }
       const threadId = `${channel}:${replyTs}`;
+      // Native message id for daemon-side dedup: ts is unique per channel,
+      // so channel:ts is unique bot-wide (and identical for the app_mention
+      // and message events of the same message — exactly what dedup wants).
+      const messageId = `${channel}:${sourceTs}`;
       logger(`[slack] inbound ${event.type} from ${channel} (${text.length} chars)\n`);
 
       // Immediate acknowledgement. _ackInbound is silent when
@@ -300,7 +298,7 @@ export class SlackChannel extends Channel {
       const eyesOk = await this._ackInbound(channel, sourceTs, logger);
 
       try {
-        await this._simulateInbound(text, threadId);
+        await this._simulateInbound(text, threadId, senderId, messageId);
         if (eyesOk) {
           // Swap the "working" reaction for a "done" one so the user can
           // tell at a glance which messages have been answered.
@@ -316,17 +314,51 @@ export class SlackChannel extends Channel {
       }
     };
 
+    const dead = (err) => {
+      if (typeof onDead === 'function') return onDead(err);
+      // Surface the permanent failure instead of staying alive-but-deaf:
+      // throwing from a fresh tick reaches the process crash handlers.
+      setImmediate(() => { throw err; });
+    };
+
+    // Reschedule after ANY reconnect failure — including apps.connections.open
+    // rejecting — so one bad negotiation can't permanently kill the chain.
+    const scheduleReconnect = () => {
+      if (closed) return;
+      attempts++;
+      if (attempts > maxReconnects) {
+        logger(`[slack] giving up after ${attempts - 1} reconnect attempts\n`);
+        dead(new SlackError(`socket-mode reconnect gave up after ${attempts - 1} attempts`, 'SLACK_SOCKET_DEAD'));
+        return;
+      }
+      const backoff = Math.min(30000, 1000 * Math.pow(2, Math.min(attempts, 5)));
+      logger(`[slack] reconnecting in ${backoff}ms (attempt ${attempts})\n`);
+      setTimeout(() => {
+        if (closed) return;
+        connectOnce().catch((e) => {
+          logger(`[slack] reconnect failed: ${e?.message || e}\n`);
+          scheduleReconnect();
+        });
+      }, backoff);
+    };
+
     const connectOnce = () => new Promise((resolve, reject) => {
+      // Settle exactly once: a socket that closes (or errors) before 'open'
+      // REJECTS instead of leaving the promise pending forever — the initial
+      // caller surfaces it as a start failure; the reconnect path's .catch
+      // schedules the next attempt.
+      let settled = false;
       let wsUrl;
       openConnection()
         .then((u) => { wsUrl = u; })
-        .catch(reject)
+        .catch((e) => { settled = true; reject(e); })
         .then(() => {
           if (!wsUrl) return;
           logger(`[slack] socket-mode dialing wss gateway\n`);
           ws = new WebSocket(wsUrl);
           ws.addEventListener('open', () => {
             attempts = 0;
+            settled = true;
             logger(`[slack] socket-mode connected\n`);
             resolve();
           });
@@ -362,15 +394,16 @@ export class SlackChannel extends Channel {
           });
           ws.addEventListener('close', () => {
             logger(`[slack] socket closed\n`);
-            if (closed) return;
-            attempts++;
-            if (attempts > maxReconnects) {
-              logger(`[slack] giving up after ${attempts} reconnect attempts\n`);
+            if (!settled) {
+              // Closed before 'open': settle the pending connect attempt.
+              // The caller's .catch (initial start OR scheduleReconnect)
+              // decides what happens next — never double-schedule here.
+              settled = true;
+              reject(new SlackError('socket closed before open', 'SLACK_SOCKET_CLOSED_EARLY'));
               return;
             }
-            const backoff = Math.min(30000, 1000 * Math.pow(2, Math.min(attempts, 5)));
-            logger(`[slack] reconnecting in ${backoff}ms (attempt ${attempts})\n`);
-            setTimeout(() => { if (!closed) connectOnce().catch((e) => logger(`[slack] reconnect failed: ${e?.message || e}\n`)); }, backoff);
+            if (closed) return;
+            scheduleReconnect();
           });
           ws.addEventListener('error', (ev) => {
             // The 'error' event fires before 'close'; we let 'close' drive

package/channels/slack_env.mjs

@@ -0,0 +1,45 @@
+// channels/slack_env.mjs — Slack env reading + validation, split out of
+// slack.mjs (file-size ratchet) so the adapter file has room for the
+// socket-mode transport. Re-exported from slack.mjs for compatibility.
+
+const DEFAULT_API_BASE = 'https://slack.com/api';
+
+export class SlackError extends Error {
+  constructor(message, code, missing) {
+    super(message);
+    this.name = 'SlackError';
+    this.code = code || 'SLACK_ERR';
+    if (Array.isArray(missing)) this.missing = missing;
+  }
+}
+
+export function readSlackEnv(env = process.env) {
+  const out = {
+    botToken: env.SLACK_BOT_TOKEN || null,
+    appToken: env.SLACK_APP_TOKEN || null,
+    signingSecret: env.SLACK_SIGNING_SECRET || null,
+    apiBase: env.SLACK_API_BASE || DEFAULT_API_BASE,
+  };
+  return out;
+}
+
+export function validateEnv(env, { requireInbound = false } = {}) {
+  const missing = [];
+  if (!env.botToken) missing.push('SLACK_BOT_TOKEN');
+  else if (!env.botToken.startsWith('xoxb-')) {
+    throw new SlackError('SLACK_BOT_TOKEN must start with "xoxb-"', 'SLACK_BAD_TOKEN', ['SLACK_BOT_TOKEN']);
+  }
+  if (requireInbound) {
+    // Socket Mode (the inbound path) authenticates the WebSocket with the
+    // app-level token; SLACK_SIGNING_SECRET is only needed for the HTTP Events
+    // API (request-signature verification), which this adapter does not use, so
+    // it is NOT required here — requiring it blocked socket-mode setups.
+    if (!env.appToken) missing.push('SLACK_APP_TOKEN');
+    else if (!env.appToken.startsWith('xapp-')) {
+      throw new SlackError('SLACK_APP_TOKEN must start with "xapp-"', 'SLACK_BAD_TOKEN', ['SLACK_APP_TOKEN']);
+    }
+  }
+  if (missing.length) {
+    throw new SlackError(`missing Slack env vars: ${missing.join(', ')}`, 'SLACK_MISSING_ENV', missing);
+  }
+}

package/channels/telegram.mjs

@@ -130,6 +130,7 @@ export class TelegramChannel extends Channel {
         // backoff between iterations (default 0 — no extra sleep).
         pollIntervalMs: typeof opts.pollIntervalMs === 'number' ? opts.pollIntervalMs : 0,
         logger: this._logger,
+        onDead: opts.onDead,
       });
     }
     return this;
@@ -157,8 +158,20 @@ export class TelegramChannel extends Channel {
         // base.mjs's bucket gate reads req.token || req.key, so the sender
         // id rides under `key`: an authToken gate compares against it and a
         // rate-limit gate keys per-sender. We also keep senderId for
-        // downstream handler context.
-        gateInput: { key: evt.senderId, senderId: evt.senderId },
+        // downstream handler context, plus a dedup id for the daemon.
+        // PREFER update_id: it is stable when getUpdates redelivers the same
+        // update (offset is memory-only, so a restart replays the batch) but
+        // DISTINCT for an edit — an edited_message carries the ORIGINAL
+        // message_id, so keying on message_id would replay the stale answer
+        // instead of processing the edit. chatId-scoped message_id is only
+        // the fallback for direct _simulateInbound callers without update_id.
+        gateInput: {
+          key: evt.senderId,
+          senderId: evt.senderId,
+          messageId: evt.updateId != null
+            ? `${evt.chatId}:u${evt.updateId}`
+            : (evt.messageId ? `${evt.chatId}:${evt.messageId}` : null),
+        },
       });
     } catch (err) {
       if (err instanceof ChannelGated || err?.code === 'CHANNEL_GATED') {
@@ -201,6 +214,7 @@ export class TelegramChannel extends Channel {
       threadId,
       text,
       senderId: gateInput && gateInput.senderId != null ? gateInput.senderId : null,
+      messageId: gateInput && gateInput.messageId != null ? gateInput.messageId : null,
     });
   }
 
@@ -248,6 +262,12 @@ export class TelegramChannel extends Channel {
     const timeoutMs = typeof opts.timeoutMs === 'number' ? opts.timeoutMs : 15000;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
+    // opts.track exposes this call's AbortController so stop() can cut a
+    // held-open long-poll short instead of waiting out the ~60s window
+    // (which can overrun a service manager's SIGTERM grace and get us
+    // SIGKILLed mid-drain). Only getUpdates opts in — aborting an in-flight
+    // send would drop a reply.
+    if (opts.track) this._inflightAbort = controller;
     let res;
     try {
       res = await fetch(url, {
@@ -263,6 +283,11 @@ export class TelegramChannel extends Channel {
       throw new TelegramError(`telegram ${method} transport error: ${err?.message || err}`, 'TELEGRAM_TRANSPORT');
     } finally {
       clearTimeout(timer);
+      if (opts.track) this._inflightAbort = null;
+    }
+    if (res.status === 401 || res.status === 403) {
+      // A dead/revoked token never recovers — fatal, not retryable.
+      throw new TelegramError(`telegram ${method} auth failed: HTTP ${res.status} (check TELEGRAM_BOT_TOKEN)`, 'TELEGRAM_AUTH_FATAL');
     }
     if (!res.ok) {
       throw new TelegramError(`telegram ${method} failed: HTTP ${res.status}`, 'TELEGRAM_HTTP_FAIL');
@@ -280,15 +305,30 @@ export class TelegramChannel extends Channel {
   // hands the batch to _processBatch which advances the ack offset only
   // for updates it processes successfully. Errors are logged and the loop
   // backs off rather than crashing the daemon.
-  _startPollLoop({ pollIntervalMs, logger }) {
+  _startPollLoop({ pollIntervalMs, logger, onDead }) {
     let stopped = false;
+    // Mirror matrix: abnormal loop death is surfaced (default: throw on a
+    // fresh tick -> crash handlers -> service-manager restart), never silent.
+    const dead = (err) => {
+      if (typeof onDead === 'function') return onDead(err);
+      setImmediate(() => { throw err; });
+    };
     const loop = async () => {
       while (!stopped) {
         try {
           const updates = await this._fetchUpdates();
           await this._processBatch(updates, () => stopped);
         } catch (err) {
-          logger(`[telegram] poll error: ${err?.message || err}\n`);
+          // A dead/revoked token never recovers — stop and surface instead
+          // of hammering the API on a 500ms back-off forever.
+          if (!stopped && err?.code === 'TELEGRAM_AUTH_FATAL') {
+            logger(`[telegram] FATAL: ${err.message} — stopping listener\n`);
+            this._fatal = err;
+            dead(err);
+            break;
+          }
+          // A shutdown abort is a clean exit, not an error worth logging.
+          if (!stopped) logger(`[telegram] poll error: ${err?.message || err}\n`);
           // On a transport/API error, back off a beat so we don't spin
           // hot against a failing endpoint even when pollIntervalMs is 0.
           if (!stopped) await new Promise((r) => setTimeout(r, Math.max(pollIntervalMs, 500)));
@@ -299,11 +339,14 @@ export class TelegramChannel extends Channel {
         if (pollIntervalMs > 0) await new Promise((r) => setTimeout(r, pollIntervalMs));
       }
     };
-    // Fire and forget — stop() flips `stopped` and the loop exits.
+    // Fire and forget — stop() flips `stopped`, aborts the held-open
+    // getUpdates (prompt shutdown instead of waiting out the ~60s
+    // long-poll), and the loop exits.
     const promise = loop();
     this._pollHandle = {
       stop: async () => {
         stopped = true;
+        try { this._inflightAbort?.abort(); } catch { /* already settled */ }
         try { await promise; } catch { /* best-effort */ }
       },
     };
@@ -347,7 +390,7 @@ export class TelegramChannel extends Channel {
     const json = await this._apiCall(
       'getUpdates',
       { offset: this._offset, timeout: LONG_POLL_SECONDS },
-      { timeoutMs: (LONG_POLL_SECONDS + 10) * 1000 }
+      { timeoutMs: (LONG_POLL_SECONDS + 10) * 1000, track: true }
     );
     return Array.isArray(json.result) ? json.result : [];
   }

package/cli.mjs

@@ -311,27 +311,16 @@ async function main() {
     }
     case 'channels': {
       const sub = (rest.positional[0] || 'list').toLowerCase();
-      const { createLoader, listInstalled } = await import('./channels/loader.mjs');
-      const cfgDir = path.dirname(configPath());
-      const loader = createLoader({ configDir: cfgDir });
-      if (sub === 'install') {
-        const name = rest.positional[1];
-        if (!name) { process.stderr.write('usage: lazyclaw channels install <@lazyclaw/channel-name>\n'); process.exit(2); }
-        const info = await loader.install(name);
-        process.stdout.write(`installed ${info.name}@${info.version}\n`);
-        break;
-      }
-      if (sub === 'remove' || sub === 'uninstall') {
-        const name = rest.positional[1];
-        if (!name) { process.stderr.write('usage: lazyclaw channels remove <@lazyclaw/channel-name>\n'); process.exit(2); }
-        await loader.remove(name);
-        process.stdout.write(`removed ${name}\n`);
-        break;
-      }
-      // list
-      const rows = listInstalled(cfgDir);
-      if (!rows.length) { process.stdout.write('no channel plugins installed\n'); break; }
-      for (const r of rows) process.stdout.write(`${r.name}\t${r.version}\n`);
+      await (await import('./commands/channels.mjs')).cmdChannels(sub, rest.positional.slice(1), rest.flags);
+      break;
+    }
+    case 'service': {
+      const sub = rest.positional[0];
+      await (await import('./commands/service.mjs')).cmdService(sub, rest.positional.slice(1), rest.flags);
+      break;
+    }
+    case 'gateway': {
+      await (await import('./commands/gateway.mjs')).cmdGateway(rest.flags);
       break;
     }
     case 'daemon': {