talon-agent 3.24.0 → 3.24.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.24.0",
+  "version": "3.24.1",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/frontend/telegram/commands/admin.ts

@@ -8,6 +8,7 @@
 
 import type { Bot } from "grammy";
 import { respawnSelf } from "../../../util/respawn.js";
+import { isStaleCommand } from "../stale-command.js";
 import {
   getRepoRoot,
   runSelfUpdate,
@@ -154,6 +155,10 @@ export function registerAdminCommands(
       await ctx.reply("Not authorized.");
       return;
     }
+    // A restart that predates this process is a redelivery (or an order
+    // aimed at a daemon that is already gone) — obeying it would restart
+    // us again, and again, on every boot.
+    if (isStaleCommand(ctx.message?.date, "/restart")) return;
     await ctx.reply("♻️ Restarting...");
     respawnSelf("telegram /restart");
   });
@@ -169,6 +174,8 @@ export function registerAdminCommands(
         await ctx.reply("Not authorized.");
         return;
       }
+      // Same redelivery hazard as /restart — it also ends the process.
+      if (isStaleCommand(ctx.message?.date, "/update")) return;
       const remote = config.update?.remote ?? "origin";
       const branch = config.update?.branch ?? "main";
       const sent = await ctx.reply(

package/src/frontend/telegram/index.ts

@@ -23,6 +23,7 @@ import {
 } from "./commands/index.js";
 import { setAccessControl } from "./handlers/index.js";
 import { registerMiddleware } from "./middleware.js";
+import { confirmUpdates } from "./update-offset.js";
 import { registerCallbacks } from "./callbacks/index.js";
 import { log, logError } from "../../util/log.js";
 
@@ -142,6 +143,10 @@ export function createTelegramFrontend(
     async stop() {
       try {
         await bot.stop();
+        // grammY advances the update offset on its NEXT poll, which never
+        // comes once we are shutting down — so confirm it explicitly or
+        // Telegram redelivers the command that triggered this shutdown.
+        await confirmUpdates(bot);
         log("shutdown", "Bot disconnected");
       } catch (err) {
         logError("shutdown", "Bot stop error", err);

package/src/frontend/telegram/middleware.ts

@@ -10,6 +10,7 @@ import { allowChat, revokeChat } from "./userbot.js";
 import { registerChat } from "../../core/background/pulse.js";
 import { log } from "../../util/log.js";
 import { getSenderName } from "./handlers/index.js";
+import { noteUpdateId } from "./update-offset.js";
 import { noteInboundThread } from "./topics.js";
 import { recordJoinRequest } from "./join-requests.js";
 import { newlyAddedEmojis, recordReactionToBot } from "../../core/soul/taps.js";
@@ -26,6 +27,15 @@ import {
 } from "./handlers/index.js";
 
 export function registerMiddleware(bot: Bot, config: TalonConfig): void {
+  // ── Update-offset tracking (every update, before anything else) ──────────
+  // Telegram redelivers any update whose id was never confirmed; the
+  // shutdown path confirms this one so a process-ending command can't be
+  // served twice. See update-offset.ts.
+  bot.use((ctx, next) => {
+    noteUpdateId(ctx.update.update_id);
+    return next();
+  });
+
   // ── History capture (runs for ALL messages, before handlers) ─────────────
   bot.on("message", (ctx, next) => {
     const chatId = String(ctx.chat.id);

package/src/frontend/telegram/stale-command.ts

@@ -0,0 +1,46 @@
+/**
+ * Staleness guard for process-ending commands.
+ *
+ * Second layer under `update-offset.ts`. Confirming the offset stops the
+ * redelivery that caused the restart loop, but it can't be guaranteed —
+ * the confirmation is a network call on the way out, and a SIGKILL, a
+ * crash, or a 409 from two pollers skips it entirely. Any command that
+ * ends the process is therefore also checked for age: it must be newer
+ * than this process, because a `/restart` issued before we booted has
+ * either already been served (redelivery) or refers to a daemon that is
+ * no longer running.
+ *
+ * Only self-terminating commands are gated. Ordinary messages sent while
+ * the daemon was down are real work and must still be processed.
+ */
+
+import { logWarn } from "../../util/log.js";
+
+/**
+ * Grace window for clock skew between Telegram's timestamps and ours,
+ * and for a command issued in the seconds around a boot.
+ */
+const CLOCK_SKEW_GRACE_MS = 30_000;
+
+/** When this process started — the cutoff a fresh command must beat. */
+const PROCESS_START_MS = Date.now();
+
+/**
+ * True when a command predates this process and must not be re-executed.
+ * `messageDate` is Telegram's `message.date` (seconds since epoch).
+ */
+export function isStaleCommand(
+  messageDate: number | undefined,
+  command: string,
+): boolean {
+  if (!messageDate) return false; // no timestamp — treat as live
+  const sentAtMs = messageDate * 1000;
+  if (sentAtMs >= PROCESS_START_MS - CLOCK_SKEW_GRACE_MS) return false;
+  const ageSec = Math.round((Date.now() - sentAtMs) / 1000);
+  logWarn(
+    "bot",
+    `Ignoring stale ${command} from ${ageSec}s ago — it predates this process ` +
+      `(a redelivered restart would loop the daemon).`,
+  );
+  return true;
+}

package/src/frontend/telegram/update-offset.ts

@@ -0,0 +1,58 @@
+/**
+ * Update-offset confirmation — the reason a `/restart` used to run twice.
+ *
+ * Telegram's getUpdates is at-least-once: an update stays queued until a
+ * LATER call passes `offset = update_id + 1`. grammY advances that offset
+ * on its next poll, so a command that ends the process — `/restart`,
+ * `/update` — exits before the confirmation is ever sent. Telegram then
+ * redelivers it to the successor, which restarts, which never confirms
+ * either: a boot loop that survives every restart, observed live on
+ * 2026-08-22 taking the daemon down four times in a row.
+ *
+ * The fix is to confirm explicitly before exiting. This module tracks the
+ * highest update_id seen and `confirmUpdates` acknowledges it with a
+ * zero-timeout getUpdates, which is exactly what grammY's next poll would
+ * have done.
+ */
+
+import type { Bot } from "grammy";
+import { log, logWarn } from "../../util/log.js";
+
+let highestUpdateId = 0;
+
+/** Record an update as seen. Called for every update grammY dispatches. */
+export function noteUpdateId(updateId: number): void {
+  if (updateId > highestUpdateId) highestUpdateId = updateId;
+}
+
+/** Highest update id seen this process (0 when none). Test seam. */
+export function lastUpdateId(): number {
+  return highestUpdateId;
+}
+
+/** Test seam: forget the tracked offset. */
+export function resetUpdateOffset(): void {
+  highestUpdateId = 0;
+}
+
+/**
+ * Tell Telegram every update seen so far is handled, so none of them is
+ * redelivered to the next process. Best-effort: this runs on the
+ * shutdown path, where a failure must never block exit.
+ */
+export async function confirmUpdates(bot: Bot): Promise<void> {
+  if (highestUpdateId === 0) return;
+  try {
+    await bot.api.getUpdates({
+      offset: highestUpdateId + 1,
+      limit: 1,
+      timeout: 0,
+    });
+    log("shutdown", `Confirmed Telegram updates through ${highestUpdateId}`);
+  } catch (err) {
+    logWarn(
+      "shutdown",
+      `Could not confirm Telegram update offset: ${err instanceof Error ? err.message : err}`,
+    );
+  }
+}