fix(telegram): add UND_ERR_CONNECT_TIMEOUT to PRE_CONNECT_ERROR_CODES by lzw112 · Pull Request #101258 · openclaw/openclaw

lzw112 · 2026-07-07T01:44:03Z

What Problem This Solves

isSafeToRetrySendError guards non-idempotent sendMessage retries by checking only PRE_CONNECT_ERROR_CODES — errors that are guaranteed to have occurred before the request reached Telegram's servers. UND_ERR_CONNECT_TIMEOUT (undici's TCP/TLS connect timeout) was not in this set, so sendMessage would not retry when the connection timed out during the handshake.

This is inconsistent: ECONNREFUSED, ENOTFOUND, ENETUNREACH, and EHOSTUNREACH are all in PRE_CONNECT_ERROR_CODES because they fire before the connection is established. UND_ERR_CONNECT_TIMEOUT has the same property — it fires during TCP/TLS connect, before any HTTP request bytes are written to the socket — yet it was only in RECOVERABLE_ERROR_CODES (permissive, for idempotent operations).

Why This Change Was Made

undici's connect timeout covers the TCP three-way handshake and TLS negotiation phases. The HTTP request data is only written after the connection is established. If the connect timer fires, no bytes were sent — meaning Telegram never received the message, and retrying is safe.

Adding "UND_ERR_CONNECT_TIMEOUT" to PRE_CONNECT_ERROR_CODES makes isSafeToRetrySendError consistent with its contract: retry only when the message was definitely not delivered.

undici error code	Phase	Request sent?	Safe to retry sendMessage?
`UND_ERR_CONNECT_TIMEOUT`	TCP/TLS connect	❌	Yes (FIX)
`UND_ERR_HEADERS_TIMEOUT`	Response headers	✅	❌
`UND_ERR_BODY_TIMEOUT`	Response body	✅	❌

User Impact

sendMessage becomes more resilient on flaky networks — connection timeouts during the TCP/TLS handshake will be retried instead of failing the send. No risk of duplicate messages because the connect timeout guarantees no request data was transmitted.

Evidence

Verified against commit 02892535 on branch fix/telegram-pre-connect-undici-timeout.

Before (broken)

err=UND_ERR_CONNECT_TIMEOUT (never sent — should retry)
    isSafeToRetrySendError  => false FAIL

After (fixed)

err=UND_ERR_CONNECT_TIMEOUT (never sent — should retry)
    isSafeToRetrySendError  => true  PASS

Regression guard

err=UND_ERR_HEADERS_TIMEOUT (response headers — request already sent)
    isSafeToRetrySendError  => false PASS (unchanged)

err=UND_ERR_BODY_TIMEOUT (response body — request already sent)
    isSafeToRetrySendError  => false PASS (unchanged)

err=ECONNRESET (connection reset — ambiguous)
    isSafeToRetrySendError  => false PASS (unchanged)

err=ETIMEDOUT (ambiguous)
    isSafeToRetrySendError  => false PASS (unchanged)

Tests and Validation

$ pnpm test extensions/telegram/src/network-errors.test.ts
Test Files  1 passed (1)
Tests       58 passed (58)

One assertion updated: UND_ERR_CONNECT_TIMEOUT now expects true for isSafeToRetrySendError, matching all other pre-connect error codes.

Risk Checklist

User-visible behavior: No — sendMessage retries on one additional error code that is guaranteed to fire before any data reaches Telegram.
Config/env/migration behavior: No.
Security/auth/secrets/network/tool execution: No.
Plugins/providers/channels/SDK: No — internal to Telegram plugin.
Highest-risk area: None. Adding a pre-connect error code to the pre-connect set is mechanically consistent. The undici error code is well-defined in Node.js internals.
Mitigation: Existing tests (58) + updated regression assertion; all other undici error codes remain excluded from the pre-connect set.

Closes: N/A

Maintainer Evidence

Verified exact head d5a71be15d369fa3dfa3ce8dd59c81268d230c6e.

Inspected Undici 8.5.0 directly: its connector clears the timeout only after connect or secureConnect; UND_ERR_CONNECT_TIMEOUT destroys the socket before the connector callback exposes it to the HTTP dispatcher.
Confirmed the shared predicate owns strict retries for durable sends, bot-delivery sends, and first-preview streaming. Headers/body/socket/reset failures remain excluded.
Added caller-path regressions for nested grammY HttpError envelopes in both sendMessageTelegram and bot delivery.
Exact-head secretless CI passed: https://github.com/openclaw/openclaw/actions/runs/28841353902
Fresh Codex autoreview passed with no accepted/actionable findings.

A sanitized AWS Crabbox run reached the no-role bootstrap but the broker's t3.small fallback was OOM-killed during dependency installation, before tests; no test result is claimed from that run.

clawsweeper · 2026-07-07T01:57:50Z

Codex review: needs real behavior proof before merge. Reviewed July 6, 2026, 11:25 PM ET / 03:25 UTC.

Summary
Adds UND_ERR_CONNECT_TIMEOUT to Telegram's pre-connect safe-send retry classifier and updates the classifier test expectation.

PR surface: Source +1, Tests 0. Total +1 across 2 files.

Reproducibility: yes. by source inspection: current main excludes UND_ERR_CONNECT_TIMEOUT from PRE_CONNECT_ERROR_CODES, so isSafeToRetrySendError returns false for that code. I did not run a live Telegram or fault-injected undici connect-timeout repro.

Review metrics: 1 noteworthy metric.

Non-idempotent retry classifier: 1 error code added; 1 expectation flipped. This directly changes when Telegram sendMessage-style operations are retried after a failed network attempt.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted live or fault-injected send-path proof showing UND_ERR_CONNECT_TIMEOUT is retried without retrying header/body/reset failures.
Refresh or re-run exact-head CI after the unrelated base lint/protocol failures are resolved.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body includes synthetic predicate output and a unit-test run, but no real or fault-injected Telegram/undici send-path proof; contributor should add redacted logs, terminal output, or a linked artifact before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] This changes retry behavior for non-idempotent Telegram sends; without real or fault-injected send-path proof, a wrapper or integration mismatch could duplicate a visible message.
[P1] Exact-head CI still has unrelated lint/protocol failures, so normal branch/base readiness must be restored before merge.

Maintainer options:

Require send-path proof (recommended)
Ask for redacted live output, fault-injection logs, or a linked artifact showing a connect timeout is retried while header/body/reset failures remain non-retryable.
Accept dependency proof
A maintainer could choose to merge on the undici source contract plus classifier coverage, explicitly accepting the lack of real send-path proof for this tiny retry fix.

Next step before merge

[P1] No repair job: there is no narrow code defect to fix, but the external contributor still needs to provide real send-path proof and normal CI readiness before merge.

Security
Cleared: The diff only changes a Telegram retry classifier and its test; it does not touch dependencies, lockfiles, workflows, credentials, permissions, or code-execution surfaces.

Review details

Best possible solution:

Land the narrow classifier fix after redacted real or fault-injected Telegram/undici send-path proof shows UND_ERR_CONNECT_TIMEOUT retries and ambiguous post-connect failures still do not.

Do we have a high-confidence way to reproduce the issue?

Yes by source inspection: current main excludes UND_ERR_CONNECT_TIMEOUT from PRE_CONNECT_ERROR_CODES, so isSafeToRetrySendError returns false for that code. I did not run a live Telegram or fault-injected undici connect-timeout repro.

Is this the best way to solve the issue?

Yes, this is the narrowest maintainable fix if the undici connect-timeout contract holds; broadening generic retry matching would be riskier for duplicate message delivery.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 62e5d4406d85.

Label changes

Label justifications:

P2: This is a focused Telegram reliability bug fix with limited blast radius and no evidence of a widespread outage.
merge-risk: 🚨 message-delivery: The diff changes retry behavior for non-idempotent Telegram sends, where an incorrect safe-retry classification could duplicate delivered messages.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body includes synthetic predicate output and a unit-test run, but no real or fault-injected Telegram/undici send-path proof; contributor should add redacted logs, terminal output, or a linked artifact before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +1, Tests 0. Total +1 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	1	0	+1
Tests	1	1	1	0
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	2	1	+1

What I checked:

Current main behavior: On current main, PRE_CONNECT_ERROR_CODES contains the strict non-idempotent send retry allowlist and does not include UND_ERR_CONNECT_TIMEOUT, while isSafeToRetrySendError returns true only for Telegram 421 or codes in that set. (extensions/telegram/src/network-errors.ts:43, 62e5d4406d85)
PR implementation: The PR adds UND_ERR_CONNECT_TIMEOUT to PRE_CONNECT_ERROR_CODES, making the strict safe-send predicate return true for that code. (extensions/telegram/src/network-errors.ts:50, b8e2dbaeb0d5)
Regression test change: The table-driven test for isSafeToRetrySendError flips only the UND_ERR_CONNECT_TIMEOUT expectation from false to true, leaving reset, timeout, and pipe errors non-retryable. (extensions/telegram/src/network-errors.test.ts:239, b8e2dbaeb0d5)
Non-idempotent send callers: The durable send funnel, bot delivery funnel, and first-preview streaming path all use isSafeToRetrySendError for non-idempotent Telegram sends, so the classifier directly controls visible duplicate-message risk. (extensions/telegram/src/send.ts:700, 62e5d4406d85)
Retry runtime contract: strictShouldRetry disables the broad channel retry regex and uses only the Telegram predicate, which is the intended boundary for non-idempotent message sends. (src/infra/retry-policy.ts:21, 62e5d4406d85)
Undici dependency contract: Undici v8.5.0 defines ConnectTimeoutError with code UND_ERR_CONNECT_TIMEOUT; its connector clears the connect timer only after connect or secureConnect, and the client writes queued requests only after an HTTP context exists. (nodejs/undici/lib/core/errors.js:20, v8.5.0)

Likely related people:

obviyus: Authored the fix(telegram): keep send retries strict commit inside merged PR fix(telegram): retry network errors wrapped in grammY HttpError #51895, which established the non-idempotent safe-send retry behavior this PR extends. (role: introduced strict send retry boundary and adjacent owner; confidence: high; commits: 3f67581e50a3; files: extensions/telegram/src/network-errors.ts, extensions/telegram/src/send.ts)
lzw112: Authored recently merged Telegram retry-context PRs for edit and action paths and also authored this proposed narrow retry-code change. (role: recent adjacent contributor; confidence: medium; commits: 7b68306949d9, 22dfb150488d; files: extensions/telegram/src/network-errors.ts, extensions/telegram/src/network-errors.test.ts, extensions/telegram/src/send.ts)
vincentkoc: Merged and supplied maintainer proof for the adjacent Telegram retry-context PRs that touched the same classifier/test surface. (role: recent reviewer and merger; confidence: medium; commits: 7b68306949d9, 22dfb150488d; files: extensions/telegram/src/network-errors.ts, extensions/telegram/src/network-errors.test.ts, extensions/telegram/src/send.ts)
chinar-amrutkar: Authored the merged PR that fixed wrapped grammY network errors and helped define the Telegram safe-send retry contract later narrowed by strict send retries. (role: original reporter/contributor for wrapped retry behavior; confidence: medium; commits: 3f67581e50a3; files: extensions/telegram/src/network-errors.ts, extensions/telegram/src/send.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (2 earlier review cycles)

reviewed 2026-07-07T02:02:18.672Z sha cc38903 :: needs real behavior proof before merge. :: none
reviewed 2026-07-07T02:43:24.435Z sha aed3d03 :: needs real behavior proof before merge. :: none

UND_ERR_CONNECT_TIMEOUT occurs during TCP/TLS connect handshake, before any HTTP request data is sent. Adding it to the pre-connect set allows isSafeToRetrySendError to safely retry sendMessage when undici's connect timeout fires — the message was never transmitted.

steipete · 2026-07-07T04:32:54Z

Land-ready maintainer proof for exact head d5a71be15d369fa3dfa3ce8dd59c81268d230c6e:

Best-fix verdict: shared classifier is the correct owner boundary. Per-funnel recovery would duplicate policy; generic timeout matching would risk duplicate messages after ambiguous post-connect failures.
Dependency contract: inspected Undici 8.5.0 lib/core/connect.js, lib/core/util.js, and lib/core/errors.js; connect timeout destroys the socket before the connector callback exposes it to HTTP dispatch.
Caller coverage: durable sendMessageTelegram, bot delivery, and first-preview streaming all consume isSafeToRetrySendError; new nested grammY-envelope regressions exercise durable and bot-delivery sends.
Formatting: oxfmt --check extensions/telegram/src/bot/delivery.test.ts extensions/telegram/src/send.test.ts — pass.
Exact-head CI: https://github.com/openclaw/openclaw/actions/runs/28841353902 — pass (47 successful jobs, no failures).
Fresh Codex autoreview: clean; no accepted/actionable findings.
Repo-native prepare: OPENCLAW_TESTBOX=1 scripts/pr prepare-run 101258 — hosted exact-head gates passed.

Sanitized AWS Crabbox lease cbx_de1c184b94d9, run run_00991a80fefe, verified public networking/no Tailscale and reached the trusted no-role bootstrap, but the broker fell back to t3.small and dependency installation was OOM-killed (exit 137) before tests. No test result is claimed from that attempt.

steipete · 2026-07-07T04:33:06Z

Merged via squash.

Prepared head SHA: d5a71be15d369fa3dfa3ce8dd59c81268d230c6e
Landed commit: da20b6523111d14ebebcf472e782cbaaa125ee08

…openclaw#101258) * fix(telegram): add UND_ERR_CONNECT_TIMEOUT to PRE_CONNECT_ERROR_CODES UND_ERR_CONNECT_TIMEOUT occurs during TCP/TLS connect handshake, before any HTTP request data is sent. Adding it to the pre-connect set allows isSafeToRetrySendError to safely retry sendMessage when undici's connect timeout fires — the message was never transmitted. * test(telegram): cover connect-timeout retry funnels --------- Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added channel: telegram Channel integration: telegram size: XS labels Jul 7, 2026

lzw112 force-pushed the fix/telegram-pre-connect-undici-timeout branch from ab2e950 to aed3d03 Compare July 7, 2026 02:32

github-actions Bot mentioned this pull request Jul 7, 2026

🦞 OpenClaw 生态日报 2026-07-07 zx0828/big_model_radar#226

Open

lzw112 force-pushed the fix/telegram-pre-connect-undici-timeout branch from aed3d03 to b8e2dba Compare July 7, 2026 02:50

lzw112 force-pushed the fix/telegram-pre-connect-undici-timeout branch from b8e2dba to f255925 Compare July 7, 2026 03:59

steipete self-assigned this Jul 7, 2026

test(telegram): cover connect-timeout retry funnels

d5a71be

github-actions Bot mentioned this pull request Jul 7, 2026

🦞 OpenClaw 生态日报 2026-07-07 litang9/big_model_radar#175

Open

steipete merged commit da20b65 into openclaw:main Jul 7, 2026
99 checks passed

miorbnli mentioned this pull request Jul 8, 2026

fix(telegram): guard ingress worker JSON.parse against malformed Bot API bodies #98372

Closed

Kailigithub mentioned this pull request Jul 9, 2026

fix(telegram): make pre-connect network failures recoverable in send context #80529

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(telegram): add UND_ERR_CONNECT_TIMEOUT to PRE_CONNECT_ERROR_CODES#101258

fix(telegram): add UND_ERR_CONNECT_TIMEOUT to PRE_CONNECT_ERROR_CODES#101258
steipete merged 2 commits into
openclaw:mainfrom
lzw112:fix/telegram-pre-connect-undici-timeout

lzw112 commented Jul 7, 2026 •

edited by steipete

Loading

Uh oh!

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 7, 2026

Uh oh!

Uh oh!

steipete commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

lzw112 commented Jul 7, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Before (broken)

After (fixed)

Regression guard

Tests and Validation

Risk Checklist

Maintainer Evidence

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 7, 2026

Uh oh!

Uh oh!

steipete commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lzw112 commented Jul 7, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading