[Rikul]

restart.sh used to kill the running bot and start a new one. In Docker
(the bot is PID 1) or under a supervisor that kills the process group,
killing the bot also killed the script, so nothing came back up.

Now /restart (any channel) and SIGHUP (sent by restart.sh) request a
restart: the server waits for running turns and queued replies, shuts
the channels down cleanly, then re-executes the same command line in
the same process (after uv sync for new dependencies), so updated
code is loaded from disk and the PID never changes. restart.sh finds
the bot via the PID file or /proc (no ps in the Docker image) and only
starts a new one when none is running. The agent's system prompt now
says how to restart itself after pulling new code.

Co-Authored-By: Claude Opus 5.5 [email protected]
Claude-Session: https://claude.ai/code/session_01BbTezqpYhpjuHnDYNvRX33

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T08:51:00.551591Z	5b050fd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b050fd978

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Rikul]

Restart-in-place works, and I verified that end-to-end rather than reading it. But the upgrade path — the one this PR exists for — fails on first use.

What I ran

• Full suite at 5b050fd: 473 passed; CI green.
• A live instance (web channel only, spare port, throwaway ANOTHERBOT_HOME): both SIGHUP and a WebSocket /restart re-execute in place — same PID 71999 before and after, uvicorn shut down cleanly, the port rebound with no EADDRINUSE, downtime ~1 s, and /restart's reply arrived before the socket closed with 1012 (so the CLAUDE.md wording there is accurate).
• Probes for the three findings below; numbers are quoted in the comments.

Findings

1. restart.sh — the "an old build exits on SIGHUP ... a new one is started" fallback is documented but not implemented: the old build is killed and nothing replaces it. This is literally the first upgrade from any pre-PR build, and sys_instructions.md now tells the agent to do exactly this after a git pull.
2. bg_server.py — scheduled-task runs are not counted as turns, so a restart during one kills it, records it as success with empty output, consumes its slot, and never delivers the result.
3. bg_server.py — SIGHUP is restored to SIG_DFL for the whole shutdown + uv sync window, so a second HUP terminates the bot. Reproduced at a 1.3 s offset.

Lower-severity: no drain gate behind the 300 s cap, a fixed 1 s sleep standing in for "reply delivered", uv sync flags that differ from the image build, and the /proc scan picking an arbitrary match / risking a second instance.

Checked and correct (so you know what wasn't skimmed):

• children = all_tasks() - existing - {server} really does capture every channel coro — probe: len(coros)=5 len(children)=5.
• The /restart reply is already on the outgoing queue when wait_requested() wakes (qsize()==1), so the first q.empty() poll cannot drop that message; _restart_cmd has no suspension point between request_restart() and outgoing_msg().
• START_CWD + restoring it before execv is what keeps a relative PYTHONPATH=. from run.sh working; the reasoning in the comment holds.
• config.PROJECT_HOME and restart.sh's ${ANOTHERBOT_HOME:-$HOME/.anotherbot} resolve to the same path, so the PID file round-trips; is_bot also rejects a stale PID that got reused.
• Windows: signal.SIGHUP raises AttributeError there, and both add_signal_handler and remove_signal_handler sit inside handlers for it.
• restart.turn() decrements correctly on cancellation.
• The frontend reconnects on 1012 with backoff and resets agentBusy, so a restart doesn't wedge the UI.

Not verified: Docker itself — the image-specific notes are reasoned from the Dockerfile, not executed. (The token here is the PR author's, so GitHub won't accept APPROVE/REQUEST_CHANGES; this is a COMMENT review.)