switchroom 0.18.9 → 0.18.11

package/telegram-plugin/bridge/bridge.ts

@@ -31,6 +31,7 @@ import { buildEffectiveToolSchemas, LINEAR_ENV } from './tool-filter.js'
 import type { InboundMessage, PermissionEvent, StatusEvent } from '../gateway/ipc-protocol.js'
 import { matchesAllowRule } from '../permission-rule.js'
 import { createOutstandingPermissionLedger } from './permission-ledger.js'
+import { appendCrashBreadcrumb } from './crash-breadcrumb.js'
 
 installPluginLogger()
 
@@ -107,7 +108,7 @@ const TOOL_SCHEMAS = [
         quote: { type: 'boolean', description: 'Opt out of the default quote-reply behavior. Default: true. Pass false to send a bare message with no quote reference. Ignored when reply_to is explicitly set.' },
         message_thread_id: { type: 'string', description: 'Forum topic thread ID. Auto-applied from the last inbound message in the same chat if not specified.' },
         origin_turn_id: { type: 'string', description: 'In a forum supergroup, pass back the origin_turn_id attribute from the <channel> message you are answering. It pins the reply to that message\'s topic even if another topic\'s turn started meanwhile. Omit in DMs / single-topic chats.' },
-        files: { type: 'array', items: { type: 'string' }, description: 'Absolute file paths to attach. Images send as photos; other types as documents. Max 50MB each.' },
+        files: { type: 'array', items: { type: 'string' }, description: 'Absolute file paths to attach. Images send as photos; other types as documents. Max 50MB each. Telegram rejects photos with extreme dimensions (aspect ratio over ~10:1, width+height over 10000px, or over 10MB) — very tall images like full-page screenshots are auto-rerouted as documents; crop or split them first if the user should see them inline as photos.' },
         format: { type: 'string', enum: ['html', 'markdownv2', 'text'], description: "Rendering mode. 'html' (default) converts markdown to Telegram HTML." },
         disable_web_page_preview: { type: 'boolean', description: 'Disable link preview thumbnails. Default: true.' },
         protect_content: { type: 'boolean', description: 'When true, Telegram prevents the message from being forwarded or saved.' },
@@ -895,8 +896,29 @@ process.on('SIGINT', () => {
   setTimeout(() => process.exit(0), 500)
 })
 
+// #3033 — the bridge process must survive stray errors, and when it can't,
+// it must leave a diagnosable trace. Claude Code NEVER respawns a dead MCP
+// server: if this process exits, the reply tool vanishes from the session
+// (`No such tool available`) and only a full container restart recovers the
+// chat surface (2026-07-11 clerk incident — the gateway crashed, its
+// supervisor brought it back in 1s, but the bridge had died in the same
+// window and the agent was mute for 7 minutes until the operator bounced
+// the container). Claude Code also drops MCP-server stderr after startup,
+// so both handlers persist a breadcrumb to STATE_DIR/bridge-crash.log.
+const CRASH_LOG_PATH = join(STATE_DIR, 'bridge-crash.log')
+
 process.on('unhandledRejection', (err) => {
   process.stderr.write(`telegram bridge: unhandled rejection: ${err}\n`)
+  appendCrashBreadcrumb(CRASH_LOG_PATH, 'unhandledRejection', err)
+})
+
+process.on('uncaughtException', (err) => {
+  // Log-and-continue, mirroring the unhandledRejection posture. Risky in
+  // general, but the alternative is strictly worse here: process death is
+  // unrecoverable by design (see above), while the IPC client's reconnect
+  // loop can heal any gateway-connection damage on its own.
+  process.stderr.write(`telegram bridge: uncaught exception (continuing): ${(err as Error)?.stack ?? err}\n`)
+  appendCrashBreadcrumb(CRASH_LOG_PATH, 'uncaughtException', err)
 })
 
 async function main(): Promise<void> {

package/telegram-plugin/bridge/crash-breadcrumb.ts

@@ -0,0 +1,42 @@
+/**
+ * crash-breadcrumb.ts — persistent last-gasp diagnostics for the MCP
+ * bridge process (#3033).
+ *
+ * Why this exists: Claude Code captures an MCP server's stderr only
+ * around connection startup — anything the bridge writes later is
+ * dropped. In the 2026-07-11 clerk incident the bridge process died
+ * within seconds of a gateway crash and the cause was unrecoverable:
+ * no stderr, no log, nothing. And a dead bridge is terminal — Claude
+ * Code never respawns a failed MCP server, so the chat surface stays
+ * down (`No such tool available: mcp__switchroom-telegram__reply`)
+ * until a full container restart.
+ *
+ * This module appends a bounded breadcrumb line to
+ * `STATE_DIR/bridge-crash.log` from the bridge's uncaughtException /
+ * unhandledRejection handlers so the NEXT incident is diagnosable.
+ * Append-only, best-effort, never throws.
+ */
+
+import { appendFileSync, statSync, renameSync } from 'node:fs'
+
+/** Rotate once past ~1MB — a crash-looping bridge must not fill the disk. */
+const MAX_LOG_BYTES = 1024 * 1024
+
+export function appendCrashBreadcrumb(
+  logPath: string,
+  kind: 'uncaughtException' | 'unhandledRejection',
+  err: unknown,
+  now: Date = new Date(),
+): void {
+  try {
+    try {
+      if (statSync(logPath).size > MAX_LOG_BYTES) renameSync(logPath, `${logPath}.1`)
+    } catch { /* first write, or rotation raced — append anyway */ }
+    const detail = err instanceof Error ? (err.stack ?? err.message) : String(err)
+    // Single line per event (stack newlines folded) — greppable, bounded.
+    const folded = detail.replace(/\s*\n\s*/g, ' | ').slice(0, 4000)
+    appendFileSync(logPath, `${now.toISOString()} ${kind} pid=${process.pid} ${folded}\n`)
+  } catch {
+    /* best-effort: a failing breadcrumb must never make the crash worse */
+  }
+}

package/telegram-plugin/chat-lock.ts

@@ -70,6 +70,19 @@ export function createChatLock(): ChatLock {
     const tracked = next.finally(() => {
       if (chains.get(key) === tracked) chains.delete(key)
     })
+    // `tracked` is a SECOND promise derived from `next`, retained only in
+    // the `chains` map for ordering. The caller awaits `next` (and handles
+    // its rejection); `tracked` is picked up by the NEXT queued call via
+    // `prior.then(fn, fn)`. But when this is the TAIL call on the key —
+    // the common single-reply case — nothing ever attaches a handler to
+    // `tracked`, so a rejected `next` surfaces as an UNHANDLED REJECTION
+    // and (per the gateway's unhandledRejection policy) crashes + reboots
+    // the whole gateway. This bit any failing send that was last in its
+    // (chat,thread) lane: sendPhoto PHOTO_INVALID_DIMENSIONS, sendMediaGroup,
+    // editMessageText MESSAGE_TOO_LONG, deleteMessage "can't be deleted",
+    // etc. Swallow the rejection on the internal tracking promise ONLY —
+    // the caller's `next` still carries the real error for normal handling.
+    tracked.catch(() => {})
     chains.set(key, tracked)
     return next
   }

package/telegram-plugin/dist/bridge/bridge.js

@@ -24681,6 +24681,22 @@ function createOutstandingPermissionLedger() {
   };
 }
 
+// bridge/crash-breadcrumb.ts
+import { appendFileSync as appendFileSync2, statSync as statSync5, renameSync as renameSync2 } from "node:fs";
+var MAX_LOG_BYTES = 1024 * 1024;
+function appendCrashBreadcrumb(logPath, kind, err, now = new Date) {
+  try {
+    try {
+      if (statSync5(logPath).size > MAX_LOG_BYTES)
+        renameSync2(logPath, `${logPath}.1`);
+    } catch {}
+    const detail = err instanceof Error ? err.stack ?? err.message : String(err);
+    const folded = detail.replace(/\s*\n\s*/g, " | ").slice(0, 4000);
+    appendFileSync2(logPath, `${now.toISOString()} ${kind} pid=${process.pid} ${folded}
+`);
+  } catch {}
+}
+
 // bridge/bridge.ts
 installPluginLogger();
 var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join4(homedir3(), ".claude", "channels", "telegram");
@@ -24730,7 +24746,7 @@ var TOOL_SCHEMAS = [
         quote: { type: "boolean", description: "Opt out of the default quote-reply behavior. Default: true. Pass false to send a bare message with no quote reference. Ignored when reply_to is explicitly set." },
         message_thread_id: { type: "string", description: "Forum topic thread ID. Auto-applied from the last inbound message in the same chat if not specified." },
         origin_turn_id: { type: "string", description: "In a forum supergroup, pass back the origin_turn_id attribute from the <channel> message you are answering. It pins the reply to that message's topic even if another topic's turn started meanwhile. Omit in DMs / single-topic chats." },
-        files: { type: "array", items: { type: "string" }, description: "Absolute file paths to attach. Images send as photos; other types as documents. Max 50MB each." },
+        files: { type: "array", items: { type: "string" }, description: "Absolute file paths to attach. Images send as photos; other types as documents. Max 50MB each. Telegram rejects photos with extreme dimensions (aspect ratio over ~10:1, width+height over 10000px, or over 10MB) \u2014 very tall images like full-page screenshots are auto-rerouted as documents; crop or split them first if the user should see them inline as photos." },
         format: { type: "string", enum: ["html", "markdownv2", "text"], description: "Rendering mode. 'html' (default) converts markdown to Telegram HTML." },
         disable_web_page_preview: { type: "boolean", description: "Disable link preview thumbnails. Default: true." },
         protect_content: { type: "boolean", description: "When true, Telegram prevents the message from being forwarded or saved." },
@@ -25380,9 +25396,16 @@ process.on("SIGINT", () => {
   cleanup();
   setTimeout(() => process.exit(0), 500);
 });
+var CRASH_LOG_PATH = join4(STATE_DIR, "bridge-crash.log");
 process.on("unhandledRejection", (err) => {
   process.stderr.write(`telegram bridge: unhandled rejection: ${err}
 `);
+  appendCrashBreadcrumb(CRASH_LOG_PATH, "unhandledRejection", err);
+});
+process.on("uncaughtException", (err) => {
+  process.stderr.write(`telegram bridge: uncaught exception (continuing): ${err?.stack ?? err}
+`);
+  appendCrashBreadcrumb(CRASH_LOG_PATH, "uncaughtException", err);
 });
 async function main() {
   ipc = await createIpcClient({