mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-11 13:37:32 +01:00
Today the bot was up, healthy and answering nothing for three hours. A host
firewall change (fixed in testsAndMisc 334c0cd9) cut every Docker container
off the internet; signal-cli lost Signal and reconnected in a loop from
15:32:50 onward. Nothing noticed:
- the container's own healthcheck answered 204
- /v1/groups answered 200 out of local state, so discovery saw no change
- the bot's WebSocket to the container stayed OPEN, so the transport's
reconnect logic never fired
- /healthz answered {"status": "ok"} the entire time
The only symptom was silence, which is also what a quiet evening looks like.
signal_bot/liveness.py asks the one question that cannot be answered from a
cache -- GET /v1/devices, which needs a live round trip -- but only after
SILENCE_SECONDS (120) with no frame of any kind, so a busy group costs
nothing and an idle one costs one request per window. Three consecutive
failures and /healthz answers 503 with the reason. Verified end to end in
scripts/e2e.sh against the real process: 503 after 84s with the fake's
connection cut, back to 200 on its own 30s after restoring it.
scripts/signal_api_watchdog.sh + a two-minute user timer do the recovery the
bot cannot do for itself, since a wedged bot cannot restart the container it
depends on. Two tiers, so the steady state costs no Signal round trip at
all: the bot's own /healthz first, the authenticated probe only when that is
not 200. It stops after 3 restarts in 6 hours and escalates instead -- a
deregistered account or a blocked network is not fixable by restarting, and
a restart loop would hide it. Its own bash suite stubs curl and docker and
drives every branch including the give-up cap.
signal_bot/trust.py answers the other half: TRUSTED_INVITERS decides who may
put this bot in a group. The gate sits in GroupDirectory._permitted, which
both _join_pending and _adopt already route through -- gating only invites
would gate the door nobody uses, since prime_profile.sh exists precisely so
that an add becomes a direct join. Evidence is either the group-update
envelope, which is the only frame naming an inviter, or a trusted identity
being a full member in the listing. A refusal is logged once, with that
group's members, so the operator can see which string to add.
verify_allowlist moved to membership.py to keep discovery.py under the
250-line gate; it was already the module that owns MembershipError.
Verified live, by stopping the container by hand and touching nothing else:
18:54:35 docker stop signal-api
18:56:36 liveness: failure 1 of 3 after 123s of silence
18:57:36 failure 3 of 3 -> /healthz answers 503 from 18:57:45
18:58:18 watchdog: probe failed (1/2)
19:00:28 watchdog: probe failed (2/2) -> docker restart signal-api
19:00:36 liveness: receive path recovered after 8 failed probe(s)
19:01:13 watchdog: signal-api is back
Six minutes, unattended, against three hours of silence this afternoon. All
four real groups are still adopted with TRUSTED_INVITERS=+48123456789 set,
and no group was refused.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbjfWdAyHbCubac7wJKJZW
94 lines
3.4 KiB
Python
94 lines
3.4 KiB
Python
# Copyright (c) 2026 Krzysztof Rudnicki. MIT licence.
|
|
"""Routes one inbound frame: scope it, count it, maybe run a command."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import datetime as dt
|
|
import logging
|
|
from collections.abc import Callable
|
|
from dataclasses import dataclass
|
|
from typing import TYPE_CHECKING
|
|
|
|
from signal_bot.counting import should_count, watched_group
|
|
from signal_bot.models import parse_envelope
|
|
from signal_bot.registry import CommandContext, CommandRegistry
|
|
|
|
if TYPE_CHECKING:
|
|
from signal_bot.config import Config
|
|
from signal_bot.discovery import GroupDirectory
|
|
from signal_bot.store import Store
|
|
from signal_bot.transport_base import Transport
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
Clock = Callable[[], dt.datetime]
|
|
|
|
|
|
@dataclass(frozen=True, slots=True)
|
|
class Dispatcher:
|
|
"""Applies the scoping rules and dispatches commands."""
|
|
|
|
config: Config
|
|
directory: GroupDirectory
|
|
registry: CommandRegistry
|
|
store: Store
|
|
transport: Transport
|
|
clock: Clock
|
|
|
|
async def handle(self, frame: str) -> None:
|
|
"""Process one raw websocket frame end to end."""
|
|
message = parse_envelope(frame)
|
|
if message is None:
|
|
return
|
|
|
|
# Before the scoping gate: a group-update frame arrives while its
|
|
# group is still unknown, and it is what vouches for that group.
|
|
self.directory.note_group_update(message)
|
|
|
|
# The scoping gate. Direct messages and every other group the account
|
|
# belongs to stop here, before counting and before any handler runs.
|
|
# The canonical id it yields is the reply address and the key for
|
|
# every piece of per-group state, so a message can only ever be
|
|
# counted, rate-limited and answered in the group it came from.
|
|
group = watched_group(message, self.directory)
|
|
if group is None and message.group_id is not None:
|
|
# The bot was probably just added: Signal is already delivering
|
|
# this group's messages while our listing still predates it.
|
|
# Refreshing here is what makes the *first* command after an add
|
|
# work, instead of the one after the next 30-second sweep.
|
|
group = await self.directory.refresh_for(message.group_id)
|
|
if group is None:
|
|
logger.debug(
|
|
"ignoring message from group %r; watching %r",
|
|
message.group_id,
|
|
list(self.directory.groups),
|
|
)
|
|
return
|
|
|
|
if should_count(message):
|
|
self.store.increment(group, message.source_uuid, message.source_name)
|
|
|
|
command = self.registry.resolve(message.text)
|
|
if command is None:
|
|
return
|
|
|
|
logger.info("running command %s for %s", command.name, message.source_name)
|
|
now = self.clock()
|
|
ctx = CommandContext(
|
|
message=message,
|
|
group_id=group,
|
|
transport=self.transport,
|
|
store=self.store,
|
|
config=self.config,
|
|
command_name=command.name,
|
|
now=now.timestamp(),
|
|
day=now.date().isoformat(),
|
|
)
|
|
try:
|
|
await command.handler(ctx)
|
|
except Exception:
|
|
logger.exception("command %s failed", command.name)
|
|
return
|
|
# Recorded once, here, so stacked gates cannot double-count a use.
|
|
self.store.record_use(group, message.source_uuid, command.name, ctx.now, ctx.day)
|