@nanhara/hara 0.121.1 → 0.122.0

package/dist/gateway/sessions.js

@@ -4,10 +4,10 @@
 // resumes the right one. /sessions then lists the current dir's threads (codex-style), while the chat itself
 // stays a single conversation front-end (hermes-style). The same model backs a future desktop app.
 // Sessions are stored by id in ~/.hara/sessions, so these are real sessions resumable via `hara -p … --resume`.
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
-import { createHash } from "node:crypto";
 /** Idle window before a chat auto-rotates to a FRESH session (hours). A WeChat/Feishu chat is one
  *  endless surface — without this, days-old context piles onto every new ask and the agent answers
  *  from stale state (the "gateway answers with old context" report). Default 8h: overnight gaps start
@@ -18,92 +18,489 @@ export function idleRotationMs() {
         return 0; // 0/garbage → disabled
     return raw * 3_600_000;
 }
-const dir = () => join(homedir(), ".hara", "gateway");
+const haraDir = () => join(homedir(), ".hara");
+const dir = () => join(haraDir(), "gateway");
 const file = () => join(dir(), "chats.json");
-const mapKey = (platform, chatId) => `${platform}:${chatId}`;
+const lockFile = () => `${file()}.lock`;
+const reclaimFile = () => `${lockFile()}.reclaim`;
+const waitCell = new Int32Array(new SharedArrayBuffer(4));
+const LOCK_WAIT_MS = 5_000;
+function errorCode(error) {
+    return typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : undefined;
+}
+function ensurePrivateDir() {
+    mkdirSync(dir(), { recursive: true, mode: 0o700 });
+    // Tighten legacy directories as well. A private leaf is insufficient when ~/.hara itself is traversable.
+    try {
+        chmodSync(haraDir(), 0o700);
+        chmodSync(dir(), 0o700);
+    }
+    catch {
+        /* best effort on filesystems without POSIX modes */
+    }
+}
+function removeIfPresent(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch (error) {
+        if (errorCode(error) !== "ENOENT")
+            throw error;
+    }
+}
+function readLock(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return Number.isInteger(parsed?.pid) && parsed.pid > 0 && typeof parsed?.token === "string" && parsed.token
+            ? { pid: parsed.pid, token: parsed.token }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return errorCode(error) === "EPERM";
+    }
+}
+function writeLock(path, record) {
+    let fd;
+    try {
+        fd = openSync(path, "wx", 0o600);
+        writeFileSync(fd, JSON.stringify(record), "utf8");
+        fsyncSync(fd);
+    }
+    catch (error) {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* preserve the original error */ }
+            fd = undefined;
+            try {
+                removeIfPresent(path);
+            }
+            catch { /* preserve the original error */ }
+        }
+        throw error;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/** Serialize read-modify-write cycles across gateway processes. A tokenized owner may only be reclaimed
+ * after its PID is proven dead; malformed locks fail closed instead of being unlinked by age. */
+function acquireLock() {
+    ensurePrivateDir();
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    const claim = { pid: process.pid, token: randomBytes(16).toString("hex") };
+    for (;;) {
+        if (existsSync(reclaimFile())) {
+            const stale = readLock(reclaimFile());
+            if (stale && !pidAlive(stale.pid)) {
+                const current = readLock(reclaimFile());
+                if (current?.pid === stale.pid && current.token === stale.token && !pidAlive(current.pid)) {
+                    removeIfPresent(reclaimFile());
+                    continue;
+                }
+            }
+            if (Date.now() >= deadline)
+                throw new Error(`Timed out waiting for gateway session store lock: ${lockFile()}`);
+            Atomics.wait(waitCell, 0, 0, 10);
+            continue;
+        }
+        try {
+            writeLock(lockFile(), claim);
+            let released = false;
+            return () => {
+                if (released)
+                    return;
+                released = true;
+                const current = readLock(lockFile());
+                if (current?.pid === claim.pid && current.token === claim.token) {
+                    removeIfPresent(lockFile());
+                }
+            };
+        }
+        catch (error) {
+            if (errorCode(error) !== "EEXIST")
+                throw error;
+            const held = readLock(lockFile());
+            if (held && !pidAlive(held.pid)) {
+                const guard = { pid: process.pid, token: randomBytes(16).toString("hex") };
+                try {
+                    writeLock(reclaimFile(), guard);
+                    const current = readLock(lockFile());
+                    if (current?.pid === held.pid && current.token === held.token && !pidAlive(current.pid)) {
+                        removeIfPresent(lockFile());
+                    }
+                }
+                catch (reclaimError) {
+                    if (errorCode(reclaimError) !== "EEXIST")
+                        throw reclaimError;
+                }
+                finally {
+                    const currentGuard = readLock(reclaimFile());
+                    if (currentGuard?.pid === guard.pid && currentGuard.token === guard.token) {
+                        removeIfPresent(reclaimFile());
+                    }
+                }
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(`Timed out waiting for gateway session store lock: ${lockFile()}`);
+            }
+            Atomics.wait(waitCell, 0, 0, 10);
+        }
+    }
+}
+function emptyThreads() {
+    return Object.create(null);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeFork(value, label) {
+    if (value === undefined)
+        return 0;
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`Invalid fork counter in gateway session store (${label})`);
+    }
+    return value;
+}
+function normalizeThread(value, label) {
+    if (!isRecord(value) || typeof value.sessionId !== "string") {
+        throw new Error(`Invalid thread in gateway session store (${label})`);
+    }
+    return { sessionId: value.sessionId, fork: normalizeFork(value.fork, label) };
+}
+function normalizeEntry(value, key) {
+    if (!isRecord(value) || typeof value.sessionId !== "string") {
+        throw new Error(`Invalid entry in gateway session store (${key})`);
+    }
+    if (value.cwd !== undefined && typeof value.cwd !== "string") {
+        throw new Error(`Invalid cwd in gateway session store (${key})`);
+    }
+    const threads = emptyThreads();
+    if (value.threads !== undefined) {
+        if (!isRecord(value.threads))
+            throw new Error(`Invalid thread map in gateway session store (${key})`);
+        for (const [cwd, thread] of Object.entries(value.threads)) {
+            threads[cwd] = normalizeThread(thread, `${key}:${cwd}`);
+        }
+    }
+    const entry = {
+        cwd: typeof value.cwd === "string" ? value.cwd : "", // pre-cwd stores are migrated by chatContext
+        sessionId: value.sessionId,
+        fork: normalizeFork(value.fork, key),
+        threads,
+    };
+    if (typeof value.voice === "boolean")
+        entry.voice = value.voice;
+    if (typeof value.lastUsed === "number" && Number.isFinite(value.lastUsed))
+        entry.lastUsed = value.lastUsed;
+    if (typeof value.agent === "string" && value.agent)
+        entry.agent = value.agent;
+    if (typeof value.agentReturnCwd === "string" && value.agentReturnCwd)
+        entry.agentReturnCwd = value.agentReturnCwd;
+    return entry;
+}
 function load() {
+    let raw;
     try {
-        return existsSync(file()) ? JSON.parse(readFileSync(file(), "utf8")) : {};
+        raw = readFileSync(file(), "utf8");
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return Object.create(null);
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`Invalid JSON in gateway session store: ${file()}`, { cause: error });
+    }
+    if (!isRecord(parsed))
+        throw new Error(`Invalid gateway session store: ${file()}`);
+    const result = Object.create(null);
+    for (const [key, value] of Object.entries(parsed))
+        result[key] = normalizeEntry(value, key);
+    return result;
+}
+function fsyncDirectory() {
+    let fd;
+    try {
+        fd = openSync(dir(), "r");
+        fsyncSync(fd);
     }
     catch {
-        return {};
+        /* best-effort durability on platforms that cannot fsync directory handles */
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
     }
 }
-function save(m) {
-    mkdirSync(dir(), { recursive: true });
-    writeFileSync(file(), JSON.stringify(m, null, 2));
+/** Write a complete replacement privately and atomically; a crash leaves the previous JSON intact. */
+function save(map) {
+    ensurePrivateDir();
+    const tmp = join(dir(), `.chats.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+    let fd;
+    try {
+        fd = openSync(tmp, "wx", 0o600);
+        writeFileSync(fd, JSON.stringify(map, null, 2), "utf8");
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        renameSync(tmp, file());
+        try {
+            chmodSync(file(), 0o600);
+        }
+        catch { /* best effort */ }
+        fsyncDirectory();
+    }
+    catch (error) {
+        if (fd !== undefined)
+            closeSync(fd);
+        removeIfPresent(tmp);
+        throw error;
+    }
+}
+function mutate(fn) {
+    const release = acquireLock();
+    try {
+        const map = load();
+        const result = fn(map);
+        save(map);
+        return result;
+    }
+    finally {
+        release();
+    }
+}
+/** Thread identity is (platform, chat) for DMs — chatId IS the user — but (platform, chat, USER) in group
+ *  chats. A missing group user fails closed instead of silently sharing another member's context. */
+function scopedUser(who) {
+    if (who?.chatType !== "group")
+        return undefined;
+    if (who.userId === undefined || who.userId === null || who.userId === "") {
+        throw new Error("A group gateway session requires a userId");
+    }
+    return who.userId;
+}
+function mapKey(platform, chatId, userId) {
+    if (userId === undefined)
+        return `${platform}:${chatId}`;
+    const userTag = createHash("sha256").update(String(userId)).digest("hex").slice(0, 24);
+    return `${platform}:${chatId}:u${userTag}`;
 }
 /** A stable, short, dir-specific suffix so each (chat, cwd) pair gets its own session thread. */
 export function cwdTag(cwd) {
     return createHash("sha256").update(cwd).digest("hex").slice(0, 6);
 }
-/** Derived session id for a (chat, cwd, fork): `<platform>-<chatId>-<cwdTag>[-fork]`. */
-function deriveId(platform, chatId, cwd, fork) {
-    return `${platform}-${chatId}-${cwdTag(cwd)}${fork ? `-${fork}` : ""}`;
-}
-/** Get (or initialize) the chat's context: current working dir + the session id it drives. `defaultCwd` (the
- *  gateway's launch dir) is used only on first contact; a pre-cwd entry is migrated in place (keeps its id). */
-export function chatContext(platform, chatId, defaultCwd) {
-    const m = load();
-    const k = mapKey(platform, chatId);
-    const e = m[k];
-    const now = Date.now();
-    if (!e) {
-        const fresh = { cwd: defaultCwd, sessionId: deriveId(platform, chatId, defaultCwd, 0), fork: 0, lastUsed: now };
-        m[k] = fresh;
-        save(m);
-        return { cwd: fresh.cwd, sessionId: fresh.sessionId, voice: false };
-    }
-    if (!e.cwd)
-        e.cwd = defaultCwd; // migrate an old (pre-cwd) entry, preserving its existing sessionId
-    // Session hygiene: a chat idle past the window rotates to a fresh thread (same mechanics as /new).
-    // The OLD id is returned so the gateway can offer "/resume <id>" — nothing is lost, sessions persist.
-    const idleMs = idleRotationMs();
-    let rotatedFrom;
-    if (idleMs > 0 && typeof e.lastUsed === "number" && now - e.lastUsed > idleMs && e.sessionId) {
-        rotatedFrom = e.sessionId;
-        e.fork = (e.fork ?? 0) + 1;
-        e.sessionId = deriveId(platform, chatId, e.cwd, e.fork);
-    }
-    e.lastUsed = now;
-    save(m);
-    return { cwd: e.cwd, sessionId: e.sessionId, voice: !!e.voice, ...(rotatedFrom ? { rotatedFrom } : {}) };
-}
-/** `/voice` — toggle whether this chat's replies are spoken (TTS audio); returns the new state. */
-export function toggleVoice(platform, chatId) {
-    const m = load();
-    const k = mapKey(platform, chatId);
-    const e = m[k];
-    if (!e)
-        return false; // chatContext always runs first, so an entry exists; defensive no-op otherwise
-    e.voice = !e.voice;
-    save(m);
-    return !!e.voice;
-}
-/** `/cd <dir>` — switch the chat to a working dir; the session follows (its own per-project thread). */
-export function chatCd(platform, chatId, cwd) {
-    const m = load();
-    const sessionId = deriveId(platform, chatId, cwd, 0);
-    m[mapKey(platform, chatId)] = { cwd, sessionId, fork: 0 };
-    save(m);
-    return sessionId;
-}
-/** `/new` — fork a fresh thread for the chat's CURRENT dir (the old one is preserved). */
-export function newChatSession(platform, chatId, defaultCwd) {
-    const m = load();
-    const k = mapKey(platform, chatId);
-    const cur = m[k] ?? { cwd: defaultCwd, sessionId: "", fork: 0 };
-    const cwd = cur.cwd || defaultCwd;
-    const fork = (cur.fork ?? 0) + 1;
-    const sessionId = deriveId(platform, chatId, cwd, fork);
-    m[k] = { cwd, sessionId, fork };
-    save(m);
-    return sessionId;
-}
-/** `/resume <id>` — point the chat at a specific existing session, following its cwd so it runs in the right place. */
-export function setChatSession(platform, chatId, sessionId, cwd) {
-    const m = load();
-    const k = mapKey(platform, chatId);
-    m[k] = { cwd, sessionId, fork: m[k]?.fork ?? 0 };
-    save(m);
+/** Derived session id for a (chat[, user], cwd, fork): `<platform>-<chatId>[-u<userTag>]-<cwdTag>[-fork]`. */
+function deriveId(platform, chatId, cwd, fork, userId) {
+    const u = userId === undefined
+        ? ""
+        : `-u${createHash("sha256").update(String(userId)).digest("hex").slice(0, 24)}`;
+    return `${platform}-${chatId}${u}-${cwdTag(cwd)}${fork ? `-${fork}` : ""}`;
+}
+/** A gateway thread may resume/list only ids derived for its own chat identity. This blocks an allowlisted
+ * operator from using `/sessions` or `/resume` to cross into another chat/user's persisted transcript. */
+export function ownsChatSession(platform, chatId, sessionId, who) {
+    try {
+        const userId = scopedUser(who);
+        const user = userId === undefined
+            ? ""
+            : `-u${createHash("sha256").update(String(userId)).digest("hex").slice(0, 24)}`;
+        const namespace = `${platform}-${chatId}${user}`.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        // Anchor the complete derived-id grammar. A raw startsWith check lets chat "room" accidentally own
+        // chat "room-extra"; the cwd hash + optional numeric fork make the namespace boundary unambiguous.
+        return new RegExp(`^${namespace}-[a-f0-9]{6}(?:-[1-9]\\d*)?$`).test(sessionId);
+    }
+    catch {
+        return false;
+    }
+}
+/** Resolve the compact ids shown by the chat UI without ever searching another user's sessions. Exact ids
+ * win; otherwise a displayed prefix OR suffix is accepted only when it identifies one owned session. */
+export function resolveOwnedSessionId(platform, chatId, idOrFragment, candidates, who) {
+    const fragment = idOrFragment.trim();
+    if (!fragment)
+        return null;
+    const owned = [...new Set(candidates)].filter((id) => ownsChatSession(platform, chatId, id, who));
+    if (owned.includes(fragment))
+        return { id: fragment };
+    const matches = owned.filter((id) => id.startsWith(fragment) || id.endsWith(fragment));
+    if (matches.length === 1)
+        return { id: matches[0] };
+    return matches.length > 1 ? { ambiguous: matches.sort() } : null;
+}
+function rememberCurrent(entry) {
+    if (!entry.cwd || !entry.sessionId)
+        return;
+    entry.threads[entry.cwd] = { sessionId: entry.sessionId, fork: entry.fork };
+}
+function freshEntry(platform, chatId, cwd, userId) {
+    const sessionId = deriveId(platform, chatId, cwd, 0, userId);
+    const entry = { cwd, sessionId, fork: 0, threads: emptyThreads() };
+    rememberCurrent(entry);
+    return entry;
+}
+function migrateEntry(entry, platform, chatId, defaultCwd, userId) {
+    if (!entry.cwd)
+        entry.cwd = defaultCwd;
+    if (!entry.sessionId)
+        entry.sessionId = deriveId(platform, chatId, entry.cwd, entry.fork, userId);
+    rememberCurrent(entry);
+}
+function switchCwd(entry, platform, chatId, cwd, userId) {
+    rememberCurrent(entry);
+    const prior = entry.threads[cwd];
+    entry.cwd = cwd;
+    entry.sessionId = prior?.sessionId ?? deriveId(platform, chatId, cwd, 0, userId);
+    entry.fork = prior?.fork ?? 0;
+    rememberCurrent(entry);
+}
+/** Get (or initialize) the chat's context. `who` adds the user dimension for group chats. */
+export function chatContext(platform, chatId, defaultCwd, who) {
+    const uid = scopedUser(who);
+    const key = mapKey(platform, chatId, uid);
+    return mutate((map) => {
+        const now = Date.now();
+        let entry = map[key];
+        if (!entry) {
+            entry = freshEntry(platform, chatId, defaultCwd, uid);
+            entry.lastUsed = now;
+            map[key] = entry;
+            return { cwd: entry.cwd, sessionId: entry.sessionId, voice: false };
+        }
+        migrateEntry(entry, platform, chatId, defaultCwd, uid);
+        // Session hygiene: a chat idle past the window rotates to a fresh thread (same mechanics as /new).
+        // The old id is returned so the gateway can offer `/resume <id>`; persisted sessions are not deleted.
+        const idleMs = idleRotationMs();
+        let rotatedFrom;
+        if (idleMs > 0 && typeof entry.lastUsed === "number" && now - entry.lastUsed > idleMs && entry.sessionId) {
+            rotatedFrom = entry.sessionId;
+            entry.fork += 1;
+            entry.sessionId = deriveId(platform, chatId, entry.cwd, entry.fork, uid);
+            rememberCurrent(entry);
+        }
+        entry.lastUsed = now;
+        return {
+            cwd: entry.cwd,
+            sessionId: entry.sessionId,
+            voice: !!entry.voice,
+            ...(entry.agent ? { agent: entry.agent } : {}),
+            ...(rotatedFrom ? { rotatedFrom } : {}),
+        };
+    });
+}
+/** `/agent <ref|main>` — pin a role and optionally enter its home, or restore the pre-role cwd on clear.
+ *  Callers must pass `home` here instead of calling chatCd first, otherwise the previous cwd is unknowable. */
+export function setChatAgent(platform, chatId, agent, who, home) {
+    const uid = scopedUser(who);
+    const key = mapKey(platform, chatId, uid);
+    return mutate((map) => {
+        const entry = map[key];
+        if (!entry)
+            return undefined; // chatContext normally initializes the entry
+        if (agent) {
+            if (home && home !== entry.cwd) {
+                if (!entry.agentReturnCwd)
+                    entry.agentReturnCwd = entry.cwd;
+                switchCwd(entry, platform, chatId, home, uid);
+            }
+            else if (agent.startsWith("global:")) {
+                // Moving from a project-pinned role to a portable global role makes the current directory the
+                // user's real working directory again. Drop the old return point so a later `/agent main` does
+                // not unexpectedly jump back past subsequent `/cd` changes.
+                delete entry.agentReturnCwd;
+            }
+            entry.agent = agent;
+        }
+        else {
+            delete entry.agent;
+            const restore = entry.agentReturnCwd;
+            delete entry.agentReturnCwd;
+            if (restore && restore !== entry.cwd)
+                switchCwd(entry, platform, chatId, restore, uid);
+        }
+        return entry.agent;
+    });
+}
+/** `/voice` — toggle whether this chat member's replies are spoken (TTS audio). */
+export function toggleVoice(platform, chatId, who) {
+    const uid = scopedUser(who);
+    const key = mapKey(platform, chatId, uid);
+    return mutate((map) => {
+        const entry = map[key];
+        if (!entry)
+            return false; // chatContext normally initializes the entry
+        entry.voice = !entry.voice;
+        return !!entry.voice;
+    });
+}
+/** `/cd <dir>` — switch cwd and restore that cwd's last selected/forked session. */
+export function chatCd(platform, chatId, cwd, who) {
+    const uid = scopedUser(who);
+    const key = mapKey(platform, chatId, uid);
+    return mutate((map) => {
+        let entry = map[key];
+        if (!entry) {
+            entry = freshEntry(platform, chatId, cwd, uid);
+            map[key] = entry;
+        }
+        else {
+            migrateEntry(entry, platform, chatId, cwd, uid);
+            switchCwd(entry, platform, chatId, cwd, uid);
+        }
+        return entry.sessionId;
+    });
+}
+/** `/new` — fork a fresh thread for the chat member's current dir (the old session remains on disk). */
+export function newChatSession(platform, chatId, defaultCwd, who) {
+    const uid = scopedUser(who);
+    const key = mapKey(platform, chatId, uid);
+    return mutate((map) => {
+        let entry = map[key];
+        if (!entry) {
+            entry = freshEntry(platform, chatId, defaultCwd, uid);
+            map[key] = entry;
+        }
+        else {
+            migrateEntry(entry, platform, chatId, defaultCwd, uid);
+        }
+        entry.fork += 1;
+        entry.sessionId = deriveId(platform, chatId, entry.cwd, entry.fork, uid);
+        rememberCurrent(entry);
+        return entry.sessionId;
+    });
+}
+/** `/resume <id>` — select a persisted session and bind it to its cwd for future /cd round trips. */
+export function setChatSession(platform, chatId, sessionId, cwd, who) {
+    const uid = scopedUser(who);
+    const key = mapKey(platform, chatId, uid);
+    mutate((map) => {
+        let entry = map[key];
+        if (!entry) {
+            entry = freshEntry(platform, chatId, cwd, uid);
+            map[key] = entry;
+        }
+        else {
+            migrateEntry(entry, platform, chatId, cwd, uid);
+            switchCwd(entry, platform, chatId, cwd, uid);
+        }
+        entry.sessionId = sessionId;
+        rememberCurrent(entry);
+    });
 }