talon-agent 3.25.3 → 3.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.25.3",
+  "version": "3.26.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/frontend/whatsapp/actions/messaging.ts

@@ -17,7 +17,13 @@ import {
   resolveKey,
 } from "../message-store.js";
 import { recordPin, listPins, forgetPin } from "../pins.js";
-import { resolveQuoted, sendContent, sendText, tryAction } from "./shared.js";
+import {
+  resolveQuoted,
+  sendContent,
+  sendText,
+  tryAction,
+  boundedSend,
+} from "./shared.js";
 import type { WhatsAppActionHandlers } from "./types.js";
 
 /** WhatsApp keeps a pin for 24h, 7d, or 30d — no indefinite option. */
@@ -89,9 +95,11 @@ export const messagingHandlers: WhatsAppActionHandlers = {
       if ("error" in resolved) return { ok: false, error: resolved.error };
       // An empty emoji clears the reaction — WhatsApp's own semantics,
       // and the only way to take one back.
-      await ctx.sock.sendMessage(ctx.chat!.jid, {
-        react: { text: String(body.emoji ?? ""), key: resolved.key },
-      });
+      await boundedSend("react", () =>
+        ctx.sock.sendMessage(ctx.chat!.jid, {
+          react: { text: String(body.emoji ?? ""), key: resolved.key },
+        }),
+      );
       return { ok: true };
     }),
 
@@ -103,10 +111,12 @@ export const messagingHandlers: WhatsAppActionHandlers = {
       if (!text.trim()) {
         return { ok: false, error: "edit_message: text is required" };
       }
-      await ctx.sock.sendMessage(ctx.chat!.jid, {
-        text: toWhatsAppText(text),
-        edit: resolved.key,
-      });
+      await boundedSend("edit", () =>
+        ctx.sock.sendMessage(ctx.chat!.jid, {
+          text: toWhatsAppText(text),
+          edit: resolved.key,
+        }),
+      );
       return { ok: true, message_id: resolved.stored.msgId };
     }),
 
@@ -114,7 +124,9 @@ export const messagingHandlers: WhatsAppActionHandlers = {
     tryAction("delete_message", async () => {
       const resolved = resolveKey(body.message_id, ctx.chat!.chatId);
       if ("error" in resolved) return { ok: false, error: resolved.error };
-      await ctx.sock.sendMessage(ctx.chat!.jid, { delete: resolved.key });
+      await boundedSend("delete", () =>
+        ctx.sock.sendMessage(ctx.chat!.jid, { delete: resolved.key }),
+      );
       forgetPin(ctx.chat!.chatId, resolved.stored.msgId);
       return { ok: true };
     }),
@@ -166,11 +178,13 @@ export const messagingHandlers: WhatsAppActionHandlers = {
       const time =
         PIN_DURATIONS.find((d) => d >= requested) ??
         PIN_DURATIONS[PIN_DURATIONS.length - 1];
-      await ctx.sock.sendMessage(ctx.chat!.jid, {
-        pin: resolved.key,
-        type: proto.PinInChat.Type.PIN_FOR_ALL,
-        time,
-      });
+      await boundedSend("pin", () =>
+        ctx.sock.sendMessage(ctx.chat!.jid, {
+          pin: resolved.key,
+          type: proto.PinInChat.Type.PIN_FOR_ALL,
+          time,
+        }),
+      );
       recordPin(ctx.chat!.chatId, resolved.stored);
       return { ok: true };
     }),
@@ -179,10 +193,12 @@ export const messagingHandlers: WhatsAppActionHandlers = {
     tryAction("unpin_message", async () => {
       const resolved = resolveKey(body.message_id, ctx.chat!.chatId);
       if ("error" in resolved) return { ok: false, error: resolved.error };
-      await ctx.sock.sendMessage(ctx.chat!.jid, {
-        pin: resolved.key,
-        type: proto.PinInChat.Type.UNPIN_FOR_ALL,
-      });
+      await boundedSend("unpin", () =>
+        ctx.sock.sendMessage(ctx.chat!.jid, {
+          pin: resolved.key,
+          type: proto.PinInChat.Type.UNPIN_FOR_ALL,
+        }),
+      );
       forgetPin(ctx.chat!.chatId, resolved.stored.msgId);
       return { ok: true };
     }),

package/src/frontend/whatsapp/actions/shared.ts

@@ -163,6 +163,57 @@ function outboundTextMarker(content: AnyMessageContent): string {
   return "";
 }
 
+// ── Serialized, time-bounded sends ─────────────────────────────────────────
+//
+// Ported from OpenClaw's socket-timing adapter. Two failure modes this
+// removes, both observed live:
+//   - a send on a dying socket hanging a turn indefinitely ("timed out
+//     waiting for message" with nothing delivered and no error surfaced),
+//   - interleaved sends racing each other's Baileys internals.
+// Every outbound WhatsApp operation goes through one FIFO per process
+// with a hard timeout; on timeout the queue advances so later sends
+// aren't wedged behind the dead one.
+
+const SEND_TIMEOUT_MS = 60_000;
+let sendTail: Promise<unknown> = Promise.resolve();
+
+export class WhatsAppSendTimeoutError extends Error {
+  constructor(operation: string) {
+    super(
+      `WhatsApp ${operation} timed out after ${SEND_TIMEOUT_MS / 1000}s — ` +
+        `delivery state unknown (the socket may be dead or reconnecting)`,
+    );
+    this.name = "WhatsAppSendTimeoutError";
+  }
+}
+
+/**
+ * Run one socket operation serialized behind every earlier one, bounded
+ * by SEND_TIMEOUT_MS. The timeout rejects THIS caller but releases the
+ * queue, so a wedged operation can't dam everything after it.
+ */
+export function boundedSend<T>(
+  operation: string,
+  run: () => Promise<T>,
+): Promise<T> {
+  const prev = sendTail.catch(() => {});
+  const result = prev.then(() => {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    return Promise.race([
+      run(),
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(new WhatsAppSendTimeoutError(operation)),
+          SEND_TIMEOUT_MS,
+        );
+        timer.unref?.();
+      }),
+    ]).finally(() => clearTimeout(timer));
+  });
+  sendTail = result.catch(() => {});
+  return result;
+}
+
 /**
  * Send one content payload, remember the resulting message so later
  * tool calls can address it, and report its Talon numeric id.
@@ -173,7 +224,9 @@ export async function sendContent(
   content: AnyMessageContent,
   options: { quoted?: WAMessage } = {},
 ): Promise<ActionResult> {
-  const sent = await ctx.sock.sendMessage(chat.jid, content, options);
+  const sent = await boundedSend("sendMessage", () =>
+    ctx.sock.sendMessage(chat.jid, content, options),
+  );
   ctx.gateway.incrementMessages(chat.numericChatId);
   if (!sent?.key) return { ok: true };
   const text =

package/src/frontend/whatsapp/auth-state.ts

@@ -0,0 +1,133 @@
+/**
+ * Atomic multi-file auth state for Baileys — a drop-in replacement for
+ * `useMultiFileAuthState` with two hardening changes ported from how
+ * OpenClaw persists WhatsApp credentials:
+ *
+ *   1. Every write is ATOMIC (tmp + rename via write-file-atomic). The
+ *      upstream helper uses a bare `writeFile`, so a daemon restart or
+ *      crash mid-write tears creds.json or a signal-key file. A torn
+ *      signal key is invisible until the server starts rejecting stanzas
+ *      ("smax-invalid: stanza rejected — likely stale device"), which is
+ *      the documented prelude to WhatsApp unlinking the device — the
+ *      exact sequence the live deployment logged before its
+ *      `device_removed` conflict.
+ *   2. Writes to the same file are serialized through a promise chain,
+ *      and `flushAuthWrites()` lets shutdown drain the queue before the
+ *      process exits, so `talon stop` can't strand a half-persisted key.
+ *
+ * The on-disk format is byte-compatible with upstream: same folder, same
+ * file names, same BufferJSON encoding — existing auth dirs just work.
+ */
+
+import { mkdir, readFile, stat, unlink } from "node:fs/promises";
+import { join } from "node:path";
+import writeFileAtomic from "write-file-atomic";
+import { BufferJSON, initAuthCreds, proto } from "baileys";
+import type { AuthenticationState, SignalDataTypeMap } from "baileys";
+
+/** file path → tail of its write chain. Module-level: one dir per process. */
+const writeTails = new Map<string, Promise<void>>();
+
+function enqueueWrite(
+  filePath: string,
+  task: () => Promise<void>,
+): Promise<void> {
+  const tail = (writeTails.get(filePath) ?? Promise.resolve())
+    .catch(() => {})
+    .then(task);
+  writeTails.set(
+    filePath,
+    tail.catch(() => {}),
+  );
+  return tail;
+}
+
+/** Resolve when every queued auth write has settled. Call before exit. */
+export async function flushAuthWrites(): Promise<void> {
+  await Promise.allSettled(writeTails.values());
+}
+
+/** Baileys' name mangling, kept identical for on-disk compatibility. */
+function fixFileName(file: string): string {
+  return file.replace(/\//g, "__").replace(/:/g, "-");
+}
+
+export async function useAtomicAuthState(folder: string): Promise<{
+  state: AuthenticationState;
+  saveCreds: () => Promise<void>;
+}> {
+  const info = await stat(folder).catch(() => undefined);
+  if (info && !info.isDirectory()) {
+    throw new Error(`not a directory: ${folder}`);
+  }
+  if (!info) await mkdir(folder, { recursive: true });
+
+  const writeData = (data: unknown, file: string): Promise<void> => {
+    const filePath = join(folder, fixFileName(file));
+    return enqueueWrite(filePath, () =>
+      writeFileAtomic(filePath, JSON.stringify(data, BufferJSON.replacer)),
+    );
+  };
+
+  const readData = async (file: string): Promise<unknown> => {
+    const filePath = join(folder, fixFileName(file));
+    // Reads wait for any pending write to that file, so a get() racing a
+    // set() sees the new value rather than the old file.
+    await (writeTails.get(filePath) ?? Promise.resolve()).catch(() => {});
+    try {
+      const raw = await readFile(filePath, "utf-8");
+      return JSON.parse(raw, BufferJSON.reviver);
+    } catch {
+      return null;
+    }
+  };
+
+  const removeData = (file: string): Promise<void> => {
+    const filePath = join(folder, fixFileName(file));
+    return enqueueWrite(filePath, async () => {
+      await unlink(filePath).catch(() => {});
+    });
+  };
+
+  const creds =
+    ((await readData("creds.json")) as ReturnType<
+      typeof initAuthCreds
+    > | null) ?? initAuthCreds();
+
+  return {
+    state: {
+      creds,
+      keys: {
+        get: async <T extends keyof SignalDataTypeMap>(
+          type: T,
+          ids: string[],
+        ) => {
+          const data: { [id: string]: SignalDataTypeMap[T] } = {};
+          await Promise.all(
+            ids.map(async (id) => {
+              let value = await readData(`${type}-${id}.json`);
+              if (type === "app-state-sync-key" && value) {
+                value = proto.Message.AppStateSyncKeyData.fromObject(value);
+              }
+              data[id] = value as SignalDataTypeMap[T];
+            }),
+          );
+          return data;
+        },
+        set: async (data) => {
+          const tasks: Promise<void>[] = [];
+          for (const category in data) {
+            const entries = data[category as keyof SignalDataTypeMap];
+            for (const id in entries) {
+              const value = entries[id];
+              const file = `${category}-${id}.json`;
+              tasks.push(value ? writeData(value, file) : removeData(file));
+            }
+          }
+          await Promise.all(tasks);
+        },
+      },
+    },
+    saveCreds: () => writeData(creds, "creds.json"),
+  };
+}

package/src/frontend/whatsapp/index.ts

@@ -16,9 +16,7 @@
 
 import { rmSync } from "node:fs";
 import makeWASocket, {
-  DisconnectReason,
   isJidGroup,
-  useMultiFileAuthState,
   type WAMessage,
   type WASocket,
 } from "baileys";
@@ -53,7 +51,13 @@ import {
   seedMessageStore,
 } from "./message-store.js";
 import { runTurnWithRecovery, shouldReplyToCatchUp } from "./turn-recovery.js";
-import { nextPairingDelayMs, shouldNotifyPairingCode } from "./pairing.js";
+import {
+  classifyClose,
+  nextPairingDelayMs,
+  REPLACED_BACKOFF_MS,
+  shouldNotifyPairingCode,
+} from "./pairing.js";
+import { flushAuthWrites, useAtomicAuthState } from "./auth-state.js";
 import { notifyAdmin } from "../../core/notify.js";
 import {
   lookupWhatsAppChat,
@@ -433,7 +437,9 @@ export function createWhatsAppFrontend(
 
   /** One socket lifetime. Resolves with what the caller should do next. */
   async function connectOnce(): Promise<"reconnect" | "logged-out" | "stop"> {
-    const { state, saveCreds } = await useMultiFileAuthState(dirs.whatsappAuth);
+    // Atomic replacement for Baileys' useMultiFileAuthState — same disk
+    // format, torn-write-proof (see auth-state.ts for why that matters).
+    const { state, saveCreds } = await useAtomicAuthState(dirs.whatsappAuth);
     const socket = makeWASocket({
       auth: state,
       logger: makeWaLogger(),
@@ -445,6 +451,11 @@ export function createWhatsAppFrontend(
       // a ~2½-minute socket lifetime in pairing mode, shorter than it
       // takes a human to pick up their phone and type the code.
       qrTimeout: 120_000,
+      // OpenClaw's production timings: the Baileys 20s connect timeout
+      // is tight on a loaded box, and a slightly faster keepalive spots
+      // a dead transport sooner.
+      connectTimeoutMs: 60_000,
+      keepAliveIntervalMs: 25_000,
     });
     sock = socket;
     socket.ev.on("creds.update", saveCreds);
@@ -545,12 +556,37 @@ export function createWhatsAppFrontend(
               { output?: { statusCode?: number } } | undefined
           )?.output?.statusCode;
           if (stopping) return resolve("stop");
-          if (code === DisconnectReason.loggedOut) return resolve("logged-out");
-          log(
-            "whatsapp",
-            `Connection closed (code ${code ?? "?"}) — reconnecting`,
-          );
-          return resolve("reconnect");
+          const disposition = classifyClose(code, state.creds.registered);
+          switch (disposition.kind) {
+            case "pairing-accepted":
+              // 515 right after a pairing code/QR is SUCCESS, not an
+              // error: WhatsApp requires one reconnect with the same
+              // credentials to complete the login.
+              log(
+                "whatsapp",
+                "Pairing accepted (515) — reconnecting to complete login",
+              );
+              reconnectDelay = RECONNECT_BASE_MS;
+              return resolve("reconnect");
+            case "replaced":
+              // Another socket owns this session (440). Fighting it with
+              // an instant reconnect just steals the session back and
+              // forth; sit out a full minute instead.
+              logWarn(
+                "whatsapp",
+                "Connection replaced by another client (440) — backing off",
+              );
+              reconnectDelay = REPLACED_BACKOFF_MS;
+              return resolve("reconnect");
+            case "logged-out":
+              return resolve("logged-out");
+            default:
+              log(
+                "whatsapp",
+                `Connection closed (code ${code ?? "?"}) — reconnecting`,
+              );
+              return resolve("reconnect");
+          }
         }
       });
     });
@@ -658,6 +694,10 @@ export function createWhatsAppFrontend(
         /* already closed */
       }
       sock = null;
+      // Drain queued credential writes before the process exits — a key
+      // half-written at shutdown is invisible until the server starts
+      // rejecting stanzas with it.
+      await flushAuthWrites();
       await gateway.stop();
       log("whatsapp", "WhatsApp frontend stopped");
     },

package/src/frontend/whatsapp/pairing.ts

@@ -38,3 +38,38 @@ export function shouldNotifyPairingCode(
   if (lastNotifiedAt === undefined) return true;
   return now - lastNotifiedAt >= PAIRING_NOTIFY_MIN_GAP_MS;
 }
+
+// ── Close-code taxonomy ─────────────────────────────────────────────────────
+
+/**
+ * What one Baileys `connection: "close"` means for the reconnect loop.
+ * Ported from how OpenClaw's connection controller reads DisconnectReason
+ * — the old handler knew only "loggedOut or not", which turned pairing
+ * success (515) into an anonymous reconnect and let another client's
+ * takeover (440) start a reconnect fight.
+ */
+export type CloseDisposition =
+  | { kind: "pairing-accepted" } // 515: code entered — reconnect NOW, same creds
+  | { kind: "replaced" } // 440: another socket owns the session — back off hard
+  | { kind: "logged-out"; midPairing: boolean } // 401: dead creds
+  | { kind: "reconnect" }; // everything else: transient
+
+export function classifyClose(
+  statusCode: number | undefined,
+  credsRegistered: boolean,
+): CloseDisposition {
+  switch (statusCode) {
+    case 515: // DisconnectReason.restartRequired — expected right after pairing
+      return { kind: "pairing-accepted" };
+    case 440: // DisconnectReason.connectionReplaced
+      return { kind: "replaced" };
+    case 401: // DisconnectReason.loggedOut
+    case 403: // DisconnectReason.forbidden — account-level, same recovery
+      return { kind: "logged-out", midPairing: !credsRegistered };
+    default:
+      return { kind: "reconnect" };
+  }
+}
+
+/** How long to sit out after a 440 — another client owns the session. */
+export const REPLACED_BACKOFF_MS = 60_000;