Repository navigation
fix(launch): a transient Telegram reset at boot is retried instead of killing the process, and bot tokens never reach logs or alerts (Refs #972) - #973
Open
alex-mextner wants to merge 3 commits into
Conversation
… killing the process, and bot tokens never reach logs or alerts (Refs #972) launchBot awaits bot.start() and retries network failures, 429/5xx answers and non-JSON gateway pages with bounded backoff (a shutdown and a Telegram flood wait are respected); a rejected token still fails at once with one fatal line, and a failed launch ends in the graceful shutdown and exit 1. The onStart command-menu hook no longer rejects unhandled. Every pino line, library console output and alert text passes secret redaction (Telegram bot tokens, sk-ant keys, Bearer values and the secrets loadConfig registers).
…rets carries the justified CodeQL suppression (Refs #972)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #972
What changed
launchBotnow awaitsbot.start(). A transient failure of the first Telegram call (ECONNRESET, ETIMEDOUT, ECONNREFUSED, 429/5xx, a non-JSON gateway page) is retried up to 8 attempts with 1, 2, 4, 8, 15, 15, 15 s pauses; a 429 waits at least itsretry_after(capped at 120 s). Each retry logs one level-40 line. A rejected token (401/404) or an unknown error fails at once with one honest level-60 line. A failed launch alerts, runs the graceful shutdown and exits 1.onStartcommand-menu hook no longer rejects unhandled (gramio does not await it).consoleoutput and alert text is redacted (src/utils/redact-secrets.ts): Telegram bot tokens,sk-ant-keys,Bearervalues and the valuesloadConfig()registers (bot, inline bot, admin alert, provider keys, Redis password in both encodings).Evidence
test/bootstrap/launch-start-retry.test.ts,launch-real-gramio.test.ts(real gramioBotagainst a local socket that resets, answers an HTML 502, a 429 and a 401),test/utils/redact-secrets.test.ts,logger-redaction.test.ts, plus additions to the crash-handler, alert-repository, env, bot-commands tests. Mutation check: removing thestreamWritehook fails the real-gramio test.server-run):tsc --noEmitclean,bun run lintclean, knip shows nothing new, fullbun test9608 pass; the 6 failures are the Python installer suites and Chromium-dependent tests that also fail onmainon that host (missing browser/installer prerequisites), and none touches this change. Hosted CI is the authority.review diff --staged --pool 1 --task 972 -m omp:anthropic/claude-opus-5-5, five rounds; the last round returned no actionable findings. Full-roster review is owed in Full-roster review of the integration diff of the incident fixes (PRs 941, 942, async pictures) is owed #961.Not covered
Redaction does nothing for the token already in the 2026-11-05 container log; only reissuing
BOT_TOKENin BotFather makes it safe (owner's decision, documented in the runbook).