polygram 0.10.0-rc.39 → 0.10.0-rc.40

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.10.0-rc.39",
+  "version": "0.10.0-rc.40",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/lib/process/tmux-process.js

@@ -186,6 +186,22 @@ const DEFAULT_READY_TIMEOUT_MS = 120_000;
 const DEFAULT_TURN_TIMEOUT_MS  = 5 * 60_000;
 const DEFAULT_POLL_MS          = 250;
 const DEFAULT_QUIESCE_MS       = 500; // require READY for this long before declaring done
+// 0.10.0 H3 — hook-fed idle ceiling + hard backstop.
+//   `turnTimeoutMs`         — IDLE ceiling (default 5 min). A turn is
+//                              wedged only if there's no activity
+//                              (JSONL events, capture-pane signals,
+//                              OR hook events) for this long. A
+//                              healthy long subagent firing hooks
+//                              every few seconds never trips this.
+//   `hardBackstopMs`        — absolute backstop against pathological
+//                              infinite tool loops. Default 4h.
+//   `IDLE_POLL_INTERVAL_MS` — how often the idle poller in
+//                              _awaitSettle wakes to check the
+//                              accumulated idle. Coarse enough to be
+//                              cheap, fine enough that the perceived
+//                              wedge-detection delay is bounded.
+const DEFAULT_HARD_BACKSTOP_MS = 4 * 60 * 60_000;     // 4 hours
+const IDLE_POLL_INTERVAL_MS    = 30_000;              // 30 s
 
 // B8 (slow-MCP readiness): how long the claude `--debug-file` log must
 // have had NO new bytes appended before the startup is considered
@@ -234,6 +250,7 @@ class TmuxProcess extends Process {
     sleepFn, nowFn,
     readyTimeoutMs = DEFAULT_READY_TIMEOUT_MS,
     turnTimeoutMs = DEFAULT_TURN_TIMEOUT_MS,
+    hardBackstopMs = DEFAULT_HARD_BACKSTOP_MS,
     pollMs = DEFAULT_POLL_MS,
     quiesceMs = DEFAULT_QUIESCE_MS,
     lateGraceMs = 1500,
@@ -277,6 +294,7 @@ class TmuxProcess extends Process {
     // Tunables
     this.readyTimeoutMs = readyTimeoutMs;
     this.turnTimeoutMs = turnTimeoutMs;
+    this.hardBackstopMs = hardBackstopMs;
     this.pollMs = pollMs;
     this.quiesceMs = quiesceMs;
     this.readyDebugQuietMs = readyDebugQuietMs;
@@ -1044,11 +1062,13 @@ class TmuxProcess extends Process {
     const abortP = new Promise((resolve) => { signalAbort = resolve; });
     return new Promise((resolve) => {
       let done = false;
-      let deadlineTimer = null;
+      let idlePoller = null;
+      let hardBackstopTimer = null;
       const finish = (outcome) => {
         if (done) return;
         done = true;
-        if (deadlineTimer) clearTimeout(deadlineTimer);
+        if (idlePoller) clearInterval(idlePoller);
+        if (hardBackstopTimer) clearTimeout(hardBackstopTimer);
         // Release the capture-pane poll loop (and, with a shared
         // PollScheduler, its refcount) even when a non-capture outcome
         // won — mirrors the old `finally { signalAbort() }`.
@@ -1076,7 +1096,7 @@ class TmuxProcess extends Process {
         try {
           buf = await this._awaitTurnComplete({ timeoutMs: turnTimeoutMs, abortP });
         } catch {
-          return;   // capture's own timeout — the W1 deadline (#5) settles
+          return;   // capture's own timeout — the idle poller (#5a) settles
         }
         if (buf === ABORT_SENTINEL) return;   // released by another outcome
         // B7 gate: a paste that never submitted leaves the pane idle
@@ -1088,20 +1108,57 @@ class TmuxProcess extends Process {
         if (turn.token && !turn.submitConfirmed) return;
         // B10 gate: a tool or subagent is in flight — the main pane is
         // quiescent because the agent is WORKING, not done. Ignore
-        // capture; settle via JSONL `result` (or W1) when the work
-        // returns.
+        // capture; settle via JSONL `result` (or the idle/backstop
+        // racers below) when the work returns.
         if (turn.outstandingTools.size > 0
           || turn.outstandingSubagents.size > 0) return;
         finish({ kind: 'quiesced' });
       })();
 
-      // 5. W1 absolute deadline — one timer, not a racer. `unref` so
-      //    it never keeps the process alive on its own.
-      deadlineTimer = setTimeout(
-        () => finish({ kind: 'timeout' }),
-        turnTimeoutMs,
+      // 5a. Idle-ceiling poller (H3, rc.40). The old W1 was an
+      //     ABSOLUTE setTimeout — it killed any turn that ran longer
+      //     than turnTimeoutMs, regardless of whether the turn was
+      //     making progress (msg 884: 49-min SoundCloud subagent
+      //     killed at 30 min while demonstrably alive). H3 inverts:
+      //     `turnTimeoutMs` is now the IDLE ceiling. A turn is
+      //     wedged only if NO activity (JSONL events, capture-pane
+      //     stream signals, OR hook events — see _handleHookEvent)
+      //     for `turnTimeoutMs`. Every active signal heartbeats
+      //     `turn.lastActivityAt`, resetting the clock implicitly.
+      //
+      //     Poll cadence (30 s) is the worst-case detection delay
+      //     past the configured ceiling. Cheap.
+      //
+      //     Poll cadence is ADAPTIVE: 30 s in production (where
+      //     `turnTimeoutMs` is minutes), but capped at
+      //     ~`turnTimeoutMs / 4` with a 50 ms floor so test configs
+      //     with small `turnTimeoutMs` (e.g. R7's 60 ms wedge test)
+      //     still detect idle inside the test's own assertion budget.
+      const pollIntervalMs = Math.max(
+        50,
+        Math.min(IDLE_POLL_INTERVAL_MS, Math.floor(turnTimeoutMs / 4)),
+      );
+      idlePoller = setInterval(() => {
+        const idleMs = this._now() - turn.lastActivityAt;
+        if (idleMs >= turnTimeoutMs) {
+          finish({ kind: 'timeout', reason: 'idle-ceiling', idleMs });
+        }
+      }, pollIntervalMs);
+      idlePoller.unref?.();
+
+      // 5b. Hard backstop (H3, rc.40). Absolute deadline against a
+      //     pathological infinite tool loop that DOES fire hooks
+      //     continuously and so never trips the idle ceiling. Default
+      //     4h is far beyond any legitimate single-turn runtime,
+      //     even a multi-hour rate-limited SoundCloud crawl. Counted
+      //     from turn start.
+      const backstopRemaining = Math.max(
+        0, (turn.startedAt + this.hardBackstopMs) - this._now());
+      hardBackstopTimer = setTimeout(
+        () => finish({ kind: 'timeout', reason: 'hard-backstop' }),
+        backstopRemaining,
       );
-      deadlineTimer.unref?.();
+      hardBackstopTimer.unref?.();
     });
   }
 
@@ -1544,20 +1601,38 @@ class TmuxProcess extends Process {
   }
 
   /**
-   * Observer-only hook-event handler. Persists each event for the
-   * H1 soak (so the trajectory can be inspected against real Music
-   * traffic) and emits a `hook-event` event so process-manager's
-   * `onHookEvent` callback writes it to the events DB.
+   * Hook-event handler. Three roles, layered over time:
    *
-   * No `turn.*` field consumes hook signals in H1. The next phases
-   * (see hook-observability doc):
-   *   H2 — reactor wiring (kills the fear).
-   *   H3 — predicate progress + W1 retirement.
-   *   H4 — `Stop` as authoritative completion.
+   *   H1 (rc.36) — emit `hook-event` so polygram persists each event
+   *     to the events DB; observer-only.
+   *   H2 (rc.38) — sdk/callbacks.js extends onHookEvent to route to
+   *     the reactor (PreToolUse → setState, PostToolUse / SubagentStop
+   *     / Notification → heartbeat). Kills the fear escalation.
+   *   H3 (rc.40) — hook events count as PREDICATE-side liveness too:
+   *     every hook event heartbeats the active group's turns so the
+   *     idle-ceiling poller in `_awaitSettle` doesn't fire on a long
+   *     healthy subagent that is communicating via hooks. THIS is
+   *     the structural fix for the msg-884 incident (49-min
+   *     SoundCloud subagent killed at the 30-min wall-clock while
+   *     demonstrably alive).
+   *
+   *   H4 — `Stop` as authoritative completion (still pending).
+   *
+   * Parse errors and unknown event shapes are intentionally still
+   * forwarded — observer-only metrics for stream-reliability soak.
    */
   _handleHookEvent(ev) {
-    // Parse errors and unknown event shapes are intentionally
-    // forwarded — H1 measures how often they fire on real traffic.
+    // H3: every hook event (except the diagnostic types) is liveness
+    // evidence. Heartbeat every turn in the active group so the
+    // idle-ceiling poller resets. We don't differentiate by event
+    // type — even Notification or UserPromptSubmit prove claude is
+    // active in this session.
+    if (ev?.type && ev.type !== 'parse-error' && ev.type !== 'unknown') {
+      const turns = this._activeGroup?.turns || [];
+      for (const t of turns) {
+        this._heartbeat(t, `hook:${ev.type}`);
+      }
+    }
     this.emit('hook-event', ev);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.10.0-rc.39",
+  "version": "0.10.0-rc.40",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {