@agfpd/voicetalk-runtime 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/voicetalk-runtime",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Voice runtime-router for IAP peers.",
   "license": "Apache-2.0",
   "type": "module",

package/src/cli.ts

@@ -73,6 +73,20 @@ function isIntelligence(value: unknown): value is Intelligence {
   return value === 'natural' || value === 'artificial' || value === 'absent'
 }
 
+// Read-compat map for legacy intelligence values coming off the wire (mirrors the core
+// codec's normalizeIntelligenceValue): human → natural · scripted → absent. A genuinely
+// unknown value is dropped, not invented.
+const LEGACY_INTELLIGENCE: Readonly<Record<string, Intelligence>> = {
+  human: 'natural',
+  scripted: 'absent',
+}
+
+function normalizeIntelligenceValue(value: unknown): Intelligence | undefined {
+  if (typeof value !== 'string') return undefined
+  if (isIntelligence(value)) return value
+  return LEGACY_INTELLIGENCE[value]
+}
+
 const HUMAN_RUNTIMES = new Set(['telegram', 'voicetalk', 'discord', 'matrix', 'email', 'web'])
 const SCRIPTED_RUNTIMES = new Set(['webhook', 'api', 'cron'])
 
@@ -105,6 +119,9 @@ type IapEnvelope = {
   fromPersonality: string
   fromRuntime: string
   fromIntelligence?: Intelligence
+  /** Sender's dispatch instant (`ts` attribute, envelope-compaction F, core 0.4.86) —
+   *  full local ISO on the wire; absent on legacy envelopes. */
+  sentAt?: string
   topic?: string
   attachments: string[]
   message: string
@@ -367,80 +384,111 @@ function setVoicetalkInterface(cwd: string, patch: VoicetalkInterface): Record<s
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// IAP envelope parsing (CDATA-aware) — mirrors the foundation codec / telegram-runtime
+// IAP envelope parsing — port of the foundation codec (iapeer src/codec/index.ts,
+// envelope-compaction F, 0.4.86): CDATA-aware on BOTH tag sides (В37), В38
+// false-start resync, READ-BOTH attr/tag names (legacy wire + compact
+// presentation) and the additive `ts` attribute.
 // ─────────────────────────────────────────────────────────────────────────────
 
 function unescapeAttr(value: string): string {
+  // Reverse of the encoder's escapeAttr. Order matters: &amp; LAST so an escaped
+  // "&amp;lt;" in the source does not get double-decoded.
   return value.replace(/&quot;/g, '"').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&')
 }
 
+/** NAME-ANCHORED attribute lookup. The anchor `(?:^|\s)` is load-bearing: an unanchored
+ *  regex lets `runtime="` match the TAIL of `from-runtime="…"` (and `intelligence="` the
+ *  tail of `from-intelligence="…"`) — coincidentally right under today's attr order, a
+ *  mine under read-both (the short-name lookup must NOT be satisfied by a legacy long
+ *  name, or the fromRuntime modality cue reads the wrong value). */
 function attrValue(attrs: string, name: string): string | undefined {
-  const m = new RegExp(`${name}="([^"]*)"`).exec(attrs)
+  const m = new RegExp(`(?:^|\\s)${name}="([^"]*)"`).exec(attrs)
   return m ? unescapeAttr(m[1]) : undefined
 }
 
-function decodeCdata(inner: string): string {
-  if (!inner.startsWith('<![CDATA[') || !inner.endsWith(']]>')) return inner
-  return inner.slice('<![CDATA['.length, -']]>'.length).replaceAll(']]]]><![CDATA[>', ']]>')
-}
-
-/** Find `needle` at/after `from`, ignoring any occurrence INSIDE a <![CDATA[ … ]]>
- *  section, so a message body that literally contains "</message>"/"</iap>" never
- *  truncates the envelope. With no CDATA present this behaves exactly like indexOf. */
-function indexOfOutsideCdata(s: string, needle: string, from = 0): number {
-  let i = from
-  let inCdata = false
-  while (i < s.length) {
-    if (inCdata) {
-      if (s.startsWith(']]>', i)) {
-        inCdata = false
-        i += 3
-        continue
-      }
-      i++
-      continue
-    }
-    if (s.startsWith('<![CDATA[', i)) {
-      inCdata = true
-      i += '<![CDATA['.length
+const CDATA_OPEN = '<![CDATA['
+const CDATA_CLOSE = ']]>'
+
+/** Find `needle` at/after `start`, skipping CDATA sections WHOLESALE — `]]>` inside a
+ *  section is its terminator, never a match — so a message body literally containing
+ *  "</message>"/"</iap>" never truncates the envelope. Returns -1 when not found OR when
+ *  an unterminated CDATA section is hit (incomplete buffer → the caller waits). */
+function indexOfOutsideCdata(buffer: string, needle: string, start = 0): number {
+  let i = start
+  while (i < buffer.length) {
+    if (buffer.startsWith(CDATA_OPEN, i)) {
+      const term = buffer.indexOf(CDATA_CLOSE, i + CDATA_OPEN.length)
+      if (term < 0) return -1 // unterminated CDATA → incomplete buffer
+      i = term + CDATA_CLOSE.length
       continue
     }
-    if (s.startsWith(needle, i)) return i
+    if (buffer.startsWith(needle, i)) return i
     i++
   }
   return -1
 }
 
+/** Extract and decode the content of `<tag>…</tag>`, treating the body as a sequence of
+ *  CDATA sections (and any stray raw text) and CONCATENATING them — which both ignores
+ *  quoted `</tag>`/`</iap>` inside CDATA and reverses the encoder's
+ *  `]]>` → `]]]]><![CDATA[>` split. В37: the OPEN tag is located CDATA-aware too (the
+ *  close side already was) — a message whose CDATA body QUOTES `<attachments>…</attachments>`
+ *  otherwise mints phantom attachments, and a quoted `<message>` hijacks the real body;
+ *  for this runtime the corrupted text would go straight to TTS. */
 function tagContent(xml: string, tag: string): string | undefined {
   const open = `<${tag}>`
-  const start = xml.indexOf(open)
-  if (start < 0) return undefined
-  const innerStart = start + open.length
-  const end = indexOfOutsideCdata(xml, `</${tag}>`, innerStart)
-  if (end < 0) return undefined
-  return decodeCdata(xml.slice(innerStart, end))
+  const close = `</${tag}>`
+  const openIdx = indexOfOutsideCdata(xml, open, 0)
+  if (openIdx < 0) return undefined
+  let i = openIdx + open.length
+  let out = ''
+  while (i < xml.length) {
+    if (xml.startsWith(CDATA_OPEN, i)) {
+      const term = xml.indexOf(CDATA_CLOSE, i + CDATA_OPEN.length)
+      if (term < 0) {
+        // Unterminated CDATA — malformed; treat the remainder as raw content.
+        return out + xml.slice(i + CDATA_OPEN.length)
+      }
+      out += xml.slice(i + CDATA_OPEN.length, term)
+      i = term + CDATA_CLOSE.length
+      continue
+    }
+    if (xml.startsWith(close, i)) return out
+    out += xml[i]
+    i++
+  }
+  return undefined // close tag never reached outside CDATA
 }
 
 export function parseIapEnvelope(xml: string): IapEnvelope {
   // Fold \r\n and lone \r → \n once (defensive: a raw-mode pty stdin can surface bare
-  // CRs), so multi-line messages and attachment splits are LF-terminated.
+  // CRs). DELIBERATE deviation from the core codec, which leaves the fold to the
+  // transport: here the parse boundary IS the transport boundary — this function is
+  // only ever fed envelopes sliced off this process's stdin.
   xml = xml.replace(/\r\n?/g, '\n')
   const open = /^<iap\s+([^>]*)>/.exec(xml.trim())
   if (!open) throw new VoicetalkRuntimeError('invalid IAP envelope: missing <iap ...>')
-  const fromPersonality = attrValue(open[1], 'from-personality')
-  const fromRuntime = attrValue(open[1], 'from-runtime')
+  // READ-BOTH (envelope-compaction F): the legacy wire names AND the compact
+  // presentation names (`from`/`runtime`/`intelligence`, `<msg>`, `ts`) both decode,
+  // short names winning when both are present — so a future wire flip to the compact
+  // form cannot blank fromRuntime (the spoken-modality cue) on this side.
+  const fromPersonality = attrValue(open[1], 'from') ?? attrValue(open[1], 'from-personality')
+  const fromRuntime = attrValue(open[1], 'runtime') ?? attrValue(open[1], 'from-runtime')
   if (!fromPersonality || !fromRuntime) {
     throw new VoicetalkRuntimeError('invalid IAP envelope: missing from-personality/from-runtime')
   }
-  const fromIntelligenceRaw = attrValue(open[1], 'from-intelligence')
-  const fromIntelligence = isIntelligence(fromIntelligenceRaw) ? fromIntelligenceRaw : undefined
-  const message = tagContent(xml, 'message')
+  const fromIntelligence = normalizeIntelligenceValue(
+    attrValue(open[1], 'intelligence') ?? attrValue(open[1], 'from-intelligence'),
+  )
+  const message = tagContent(xml, 'message') ?? tagContent(xml, 'msg')
   if (message === undefined) throw new VoicetalkRuntimeError('invalid IAP envelope: missing message')
   const attachmentsRaw = tagContent(xml, 'attachments')
+  const sentAt = attrValue(open[1], 'ts')
   return {
     fromPersonality,
     fromRuntime,
     ...(fromIntelligence ? { fromIntelligence } : {}),
+    ...(sentAt ? { sentAt } : {}),
     topic: attrValue(open[1], 'topic'),
     attachments: attachmentsRaw
       ? attachmentsRaw.split(/\r?\n/).map(item => item.trim()).filter(Boolean)
@@ -449,21 +497,64 @@ export function parseIapEnvelope(xml: string): IapEnvelope {
   }
 }
 
+// В38 — a real envelope's open tag is bounded: personality/runtime ≤32 chars each,
+// topic ≤200, intelligence one word, plus attr names and escaping. 1 KiB is far above
+// any legitimate open tag; a longer '>'-less run after `<iap ` is prose, not a tag.
+const MAX_OPEN_TAG_LEN = 1024
+
+/** Classify the text at a `<iap ` occurrence: a complete VALID open tag (required attrs
+ *  present under either naming — legacy wire or compact presentation), a
+ *  complete-but-INVALID one / overlong tagless run (prose that merely contains the
+ *  marker), or INCOMPLETE (no '>' yet within bounds — wait for the next chunk). */
+function openTagVerdict(candidate: string): 'valid' | 'invalid' | 'incomplete' {
+  const m = /^<iap\s+([^>]*)>/.exec(candidate)
+  if (!m) {
+    const unclosed = candidate.indexOf('>') < 0
+    return unclosed && candidate.length <= MAX_OPEN_TAG_LEN ? 'incomplete' : 'invalid'
+  }
+  if (m[0].length > MAX_OPEN_TAG_LEN) return 'invalid'
+  const hasPersonality = m[1].includes('from-personality="') || /(?:^|\s)from="/.test(m[1])
+  const hasRuntime = m[1].includes('from-runtime="') || /(?:^|\s)runtime="/.test(m[1])
+  return hasPersonality && hasRuntime ? 'valid' : 'invalid'
+}
+
 /** Slice complete <iap>…</iap> envelopes out of a streaming buffer, returning the leftover
- *  tail (a partial envelope still being written). CDATA-aware close matching. */
+ *  tail (a partial envelope still being written). CDATA-aware close matching.
+ *
+ *  В38 — a FALSE start (prose that merely contains `<iap `, e.g. a quoted tool
+ *  description) is never committed to: the open tag is validated first, and a candidate
+ *  whose decode fails RESYNCS one char forward instead of being kept (which used to
+ *  either swallow the NEXT real envelope into a mis-attributed blob, or park the buffer
+ *  forever waiting for a close that never comes). */
 export function extractIapEnvelopes(buffer: string): { envelopes: string[]; rest: string } {
   const envelopes: string[] = []
   let rest = buffer
   while (true) {
     const start = rest.indexOf('<iap ')
     if (start < 0) {
-      return { envelopes, rest: rest.slice(Math.max(0, rest.length - 8)) }
+      // Keep a small tail in case `<iap ` is split across chunk boundaries.
+      return { envelopes, rest: rest.slice(Math.max(0, rest.length - '<iap '.length)) }
     }
     if (start > 0) rest = rest.slice(start)
-    const end = indexOfOutsideCdata(rest, '</iap>')
-    if (end < 0) return { envelopes, rest }
+    const verdict = openTagVerdict(rest)
+    if (verdict === 'incomplete') return { envelopes, rest } // open tag split across chunks → wait
+    if (verdict === 'invalid') {
+      rest = rest.slice(1) // false start: skip past this '<' and rescan for the next '<iap '
+      continue
+    }
+    const end = indexOfOutsideCdata(rest, '</iap>', '<iap '.length)
+    if (end < 0) return { envelopes, rest } // incomplete (or mid-CDATA) → wait
     const envelopeEnd = end + '</iap>'.length
-    envelopes.push(rest.slice(0, envelopeEnd))
+    const candidate = rest.slice(0, envelopeEnd)
+    try {
+      parseIapEnvelope(candidate)
+    } catch {
+      // Structurally envelope-shaped but undecodable → a false start after all;
+      // resync so a REAL envelope inside/behind the candidate is still found.
+      rest = rest.slice(1)
+      continue
+    }
+    envelopes.push(candidate)
     rest = rest.slice(envelopeEnd)
   }
 }