@nicknisi/pi-relay 0.3.5 → 0.4.0

package/dist/mailbox.js

@@ -9,13 +9,13 @@
  *   failed delivery leaves the letter recoverable (recoverInboxClaims) or
  *   requeueable.
  * - A corrupt letter is discarded on read, so it cannot poison every drain.
- * - Consumption is the receipt: the sender learns "delivered" only when the
- *   letter actually disappeared from the target's inbox and durable claims.
+ * - Durable acknowledgement is the receipt: disappearance without exact
+ *   proof is uncertain, never evidence of delivery.
  * - Every deposit and every delivery appends one append-only audit line —
  *   drain-as-receipt must not destroy evidence. The log never holds a full
  *   body, only a short preview.
  */
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import * as path from 'node:path';
 import { assertPathSegment, openRelayRoot, rethrowFilesystemError, RelayDirectoryHandle, RelayFilesystemError, } from './filesystem.js';
 export const MAX_BODY_CHARS = 32 * 1024;
@@ -372,6 +372,36 @@ export function readClaimedLetter(root, addr, claimToken, fileToken) {
         relay.close();
     }
 }
+function letterDigest(letter) {
+    return createHash('sha256')
+        .update(JSON.stringify([
+        letter.id,
+        letter.ts,
+        letter.kind,
+        letter.body,
+        letter.replyTo ?? null,
+        letter.from.addr,
+        letter.from.name,
+        letter.from.cwd,
+    ]))
+        .digest('hex');
+}
+function readAcknowledgement(raw, fileName) {
+    try {
+        const proof = raw === null ? null : JSON.parse(raw);
+        return proof &&
+            proof.fileName === fileName &&
+            typeof proof.digest === 'string' &&
+            /^[a-f0-9]{64}$/.test(proof.digest) &&
+            Number.isSafeInteger(proof.acknowledgedAt) &&
+            proof.acknowledgedAt >= 0
+            ? proof
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
 function finishClaimedLetter(root, addr, claimToken, fileToken, requeue) {
     assertPathSegment(addr, 'relay address');
     assertInboxClaimToken(claimToken);
@@ -400,6 +430,42 @@ function finishClaimedLetter(root, addr, claimToken, fileToken, requeue) {
                     }
                 }
                 else {
+                    // Persist proof before deleting the exact letter. Corrupt payloads are discarded without proof.
+                    const raw = claim.readFile(fileToken);
+                    if (raw !== null) {
+                        let parsed;
+                        try {
+                            parsed = JSON.parse(raw);
+                        }
+                        catch {
+                            /* corrupt letter */
+                        }
+                        if (parsed &&
+                            typeof parsed.id === 'string' &&
+                            MESSAGE_ID_PATTERN.test(parsed.id) &&
+                            typeof parsed.body === 'string' &&
+                            ['message', 'ask', 'reply', 'cancel'].includes(parsed.kind) &&
+                            parsed.from &&
+                            typeof parsed.from.addr === 'string' &&
+                            typeof parsed.from.name === 'string' &&
+                            typeof parsed.from.cwd === 'string' &&
+                            Number.isSafeInteger(parsed.ts) &&
+                            parsed.ts >= 0 &&
+                            letterFileName(parsed) === fileToken) {
+                            const acks = relay.openDirectory(`${addr}.acks`, true);
+                            try {
+                                const proof = {
+                                    fileName: fileToken,
+                                    digest: letterDigest(parsed),
+                                    acknowledgedAt: Date.now(),
+                                };
+                                acks.writeFileAtomic(fileToken, JSON.stringify(proof));
+                            }
+                            finally {
+                                acks.close();
+                            }
+                        }
+                    }
                     finished = claim.unlinkFile(fileToken);
                     if (finished)
                         claim.sync();
@@ -428,6 +494,45 @@ export function ackClaimedLetter(root, addr, claimToken, fileToken) {
 export function requeueClaimedLetter(root, addr, claimToken, fileToken) {
     return finishClaimedLetter(root, addr, claimToken, fileToken, true);
 }
+/** Retain exact acknowledgement proof for the mail retention window, including live sessions. */
+export function sweepAcknowledgements(root, addr, now, retentionMs) {
+    assertPathSegment(addr, 'relay address');
+    const relay = openRelayRoot(root);
+    if (relay === null)
+        return 0;
+    try {
+        const acks = relay.openDirectory(`${addr}.acks`);
+        if (acks === null)
+            return 0;
+        let retained = 0;
+        try {
+            for (const entry of acks.readDirectory()) {
+                if (entry.isSymbolicLink())
+                    throw new RelayFilesystemError(`Refusing symlinked relay acknowledgement: ${entry.name}`);
+                if (!entry.isFile()) {
+                    retained++;
+                    continue;
+                }
+                const parts = inboxFileTokenParts(entry.name);
+                const proof = readAcknowledgement(acks.readFile(entry.name), entry.name);
+                if (parts === null || proof === null || now - proof.acknowledgedAt < retentionMs) {
+                    retained++;
+                    continue;
+                }
+                acks.unlinkFile(entry.name);
+            }
+            acks.sync();
+        }
+        finally {
+            acks.close();
+        }
+        relay.removeEmptyDirectory(`${addr}.acks`);
+        return retained;
+    }
+    finally {
+        relay.close();
+    }
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function fileExistsInClaims(relay, addr, fileName) {
     const claims = relay.openDirectory(claimsDirectoryName(addr));
@@ -476,25 +581,34 @@ function receiptFileExists(relay, addr, fileName) {
     }
     return fileExistsInClaims(relay, addr, fileName);
 }
-/**
- * Consumption receipt: after depositing to a LIVE target, wait briefly for
- * the exact letter to vanish from both the live inbox and durable claims.
- * 'delivered' means the receiver acknowledged it, not merely claimed it.
- */
 export async function awaitReceipt(root, toAddr, letter, timeoutMs = 1500) {
     assertPathSegment(toAddr, 'relay address');
     const relay = openRelayRoot(root);
     if (relay === null)
-        return 'delivered';
+        return 'uncertain';
     try {
         const fileName = letterFileName(letter);
+        const observe = () => {
+            const acks = relay.openDirectory(`${toAddr}.acks`);
+            if (acks !== null) {
+                try {
+                    const proof = readAcknowledgement(acks.readFile(fileName), fileName);
+                    if (proof?.digest === letterDigest(letter))
+                        return 'delivered';
+                }
+                finally {
+                    acks.close();
+                }
+            }
+            return receiptFileExists(relay, toAddr, fileName) ? 'queued' : 'uncertain';
+        };
         const deadline = Date.now() + timeoutMs;
         while (Date.now() < deadline) {
-            if (!receiptFileExists(relay, toAddr, fileName))
+            if (observe() === 'delivered')
                 return 'delivered';
             await sleep(100);
         }
-        return receiptFileExists(relay, toAddr, fileName) ? 'queued' : 'delivered';
+        return observe();
     }
     finally {
         relay.close();

package/dist/receipts.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/receipts.test.js

@@ -0,0 +1,183 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, expect, it, vi } from 'vitest';
+import { ackClaimedLetter, awaitReceipt, claimInbox, deposit, sweepAcknowledgements } from './mailbox.js';
+import { deriveAddr, sweep, SWEEP_MAIL_KEEP_MS, writeRecord } from './registry.js';
+import { openRelayRoot, RelayDirectoryHandle } from './filesystem.js';
+const roots = [];
+afterEach(() => {
+    for (const root of roots.splice(0))
+        fs.rmSync(root, { recursive: true, force: true });
+});
+function fixture() {
+    const root = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'relay-receipt-')));
+    roots.push(root);
+    return root;
+}
+const addr = deriveAddr('/receiver', 'receiver');
+function letter(id = 'proof', ts = Date.now()) {
+    return {
+        id,
+        ts,
+        kind: 'message',
+        body: 'fixture',
+        from: { addr: deriveAddr('/sender', 'sender'), name: 'sender', cwd: '/sender' },
+    };
+}
+it('does not infer delivery from absent roots, removed letters, or legacy roots without ACKs', async () => {
+    const root = fixture();
+    const l = letter();
+    expect(await awaitReceipt(path.join(root, 'absent'), addr, l, 0)).toBe('uncertain');
+    deposit(root, addr, l);
+    expect(await awaitReceipt(root, addr, l, 0)).toBe('queued');
+    fs.unlinkSync(path.join(root, `${addr}.inbox`, `${l.ts}-${l.id}.json`));
+    expect(await awaitReceipt(root, addr, l, 0)).toBe('uncertain');
+});
+it('persists exact proof before deletion and cleans empty claims on Linux and macOS', async () => {
+    const root = fixture();
+    const l = letter();
+    deposit(root, addr, l);
+    const claim = claimInbox(root, addr);
+    expect(await awaitReceipt(root, addr, l, 0)).toBe('queued');
+    expect(ackClaimedLetter(root, addr, claim.claimToken, claim.fileTokens[0])).toBe(true);
+    expect(fs.existsSync(path.join(root, `${addr}.claims`, claim.claimToken))).toBe(false);
+    expect(await awaitReceipt(root, addr, l, 0)).toBe('delivered');
+    expect(await awaitReceipt(root, addr, { ...l, id: 'different' }, 0)).toBe('uncertain');
+    expect(await awaitReceipt(root, addr, { ...l, body: 'changed payload' }, 0)).toBe('uncertain');
+    expect(await awaitReceipt(root, addr, { ...l, from: { ...l.from, addr: deriveAddr('/other', 'other') } }, 0)).toBe('uncertain');
+    expect(ackClaimedLetter(root, addr, claim.claimToken, claim.fileTokens[0])).toBe(false);
+});
+it('keeps mail claimed if the ACK path is unsafe, without writing through symlinks', async () => {
+    const root = fixture();
+    const outside = fixture();
+    const l = letter();
+    deposit(root, addr, l);
+    const claim = claimInbox(root, addr);
+    fs.symlinkSync(outside, path.join(root, `${addr}.acks`));
+    expect(() => ackClaimedLetter(root, addr, claim.claimToken, claim.fileTokens[0])).toThrow(/symlink/i);
+    expect(fs.existsSync(path.join(root, `${addr}.claims`, claim.claimToken, claim.fileTokens[0]))).toBe(true);
+    expect(fs.readdirSync(outside)).toEqual([]);
+    await expect(awaitReceipt(root, addr, l, 0)).rejects.toThrow(/symlink/i);
+});
+it('does not grant delivery proof to corrupt or mismatched payloads', async () => {
+    const root = fixture();
+    const l = letter();
+    deposit(root, addr, l);
+    const claim = claimInbox(root, addr);
+    fs.writeFileSync(path.join(root, `${addr}.claims`, claim.claimToken, claim.fileTokens[0]), '{bad');
+    ackClaimedLetter(root, addr, claim.claimToken, claim.fileTokens[0]);
+    expect(await awaitReceipt(root, addr, l, 0)).toBe('uncertain');
+});
+it('preserves claimed mail when persisting proof fails and supports a successful retry', async () => {
+    const root = fixture();
+    const l = letter();
+    deposit(root, addr, l);
+    const claim = claimInbox(root, addr);
+    const write = vi.spyOn(RelayDirectoryHandle.prototype, 'writeFileAtomic').mockImplementationOnce(() => {
+        throw new Error('fixture proof write failed');
+    });
+    try {
+        expect(() => ackClaimedLetter(root, addr, claim.claimToken, claim.fileTokens[0])).toThrow(/proof write failed/);
+        expect(fs.existsSync(path.join(root, `${addr}.claims`, claim.claimToken, claim.fileTokens[0]))).toBe(true);
+        expect(await awaitReceipt(root, addr, l, 0)).toBe('queued');
+    }
+    finally {
+        write.mockRestore();
+    }
+    expect(ackClaimedLetter(root, addr, claim.claimToken, claim.fileTokens[0])).toBe(true);
+    expect(await awaitReceipt(root, addr, l, 0)).toBe('delivered');
+});
+it('rejects symlinked proof files without reading their targets', async () => {
+    const root = fixture();
+    const outside = fixture();
+    const l = letter();
+    deposit(root, addr, l);
+    const claim = claimInbox(root, addr);
+    const token = claim.fileTokens[0];
+    ackClaimedLetter(root, addr, claim.claimToken, token);
+    const proofPath = path.join(root, `${addr}.acks`, token);
+    const outsideFile = path.join(outside, 'fixture-proof');
+    fs.writeFileSync(outsideFile, fs.readFileSync(proofPath));
+    fs.unlinkSync(proofPath);
+    fs.symlinkSync(outsideFile, proofPath);
+    await expect(awaitReceipt(root, addr, l, 0)).rejects.toThrow(/symlink/i);
+});
+it('expires proof for live sessions, retains malformed markers, and protects recent proof during sweep', () => {
+    const root = fixture();
+    const now = Date.now();
+    const old = letter('old', now - SWEEP_MAIL_KEEP_MS - 1);
+    const recent = letter('recent', now);
+    for (const l of [old, recent])
+        deposit(root, addr, l);
+    const claim = claimInbox(root, addr);
+    for (const token of claim.fileTokens)
+        ackClaimedLetter(root, addr, claim.claimToken, token);
+    const oldProofPath = path.join(root, `${addr}.acks`, `${old.ts}-${old.id}.json`);
+    const recentProofPath = path.join(root, `${addr}.acks`, `${recent.ts}-${recent.id}.json`);
+    // Retention starts at acknowledgement, not at the timestamp of long-queued mail.
+    const oldProof = JSON.parse(fs.readFileSync(oldProofPath, 'utf8'));
+    expect(oldProof.acknowledgedAt).toBeGreaterThanOrEqual(now);
+    fs.writeFileSync(oldProofPath, JSON.stringify({ ...oldProof, acknowledgedAt: now - SWEEP_MAIL_KEEP_MS - 1 }));
+    const recentProof = JSON.parse(fs.readFileSync(recentProofPath, 'utf8'));
+    fs.writeFileSync(recentProofPath, JSON.stringify({ ...recentProof, acknowledgedAt: now }));
+    writeRecord(root, {
+        addr,
+        sessionId: 'receiver',
+        name: 'receiver',
+        cwd: '/receiver',
+        pid: process.pid,
+        startedAt: now,
+        lastSeenAt: now,
+        status: 'idle',
+    });
+    sweep(root, now);
+    expect(fs.readdirSync(path.join(root, `${addr}.acks`))).toEqual([`${recent.ts}-${recent.id}.json`]);
+    writeRecord(root, {
+        addr,
+        sessionId: 'receiver',
+        name: 'receiver',
+        cwd: '/receiver',
+        pid: process.pid,
+        startedAt: now,
+        lastSeenAt: now - 60_000,
+        status: 'idle',
+        offline: true,
+    });
+    sweep(root, now, () => false);
+    expect(fs.existsSync(path.join(root, `${addr}.json`))).toBe(true);
+    fs.writeFileSync(path.join(root, `${addr}.acks`, 'malformed.json'), 'not proof');
+    expect(sweepAcknowledgements(root, addr, now + SWEEP_MAIL_KEEP_MS + 1, SWEEP_MAIL_KEEP_MS)).toBe(1);
+});
+it('never lets retained proof pin an expired offline record', () => {
+    const root = fixture();
+    const now = Date.now();
+    writeRecord(root, {
+        addr,
+        sessionId: 'receiver',
+        name: 'receiver',
+        cwd: '/receiver',
+        pid: process.pid,
+        startedAt: 0,
+        lastSeenAt: now - SWEEP_MAIL_KEEP_MS - 1,
+        status: 'idle',
+        offline: true,
+    });
+    fs.mkdirSync(path.join(root, `${addr}.acks`));
+    fs.writeFileSync(path.join(root, `${addr}.acks`, 'malformed.json'), 'not proof');
+    sweep(root, now, () => true);
+    expect(fs.existsSync(path.join(root, `${addr}.json`))).toBe(false);
+    expect(fs.existsSync(path.join(root, `${addr}.acks`))).toBe(false);
+});
+it('uses the platform directory-removal flag for descriptor-relative cleanup', () => {
+    const root = fixture();
+    const handle = openRelayRoot(root);
+    try {
+        handle.openDirectory('empty', true).close();
+        expect(handle.removeEmptyDirectory('empty')).toBe(true);
+        expect(fs.existsSync(path.join(root, 'empty'))).toBe(false);
+    }
+    finally {
+        handle.close();
+    }
+});

package/dist/registry.js

@@ -17,6 +17,7 @@
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { sweepAcknowledgements } from './mailbox.js';
 import { assertPathSegment, openRelayRoot, rethrowFilesystemError, RelayDirectoryHandle, RelayFilesystemError, } from './filesystem.js';
 export const HEARTBEAT_STALE_MS = 45_000;
 /** A mailbox holding undelivered mail is kept this long after last contact. */
@@ -405,12 +406,17 @@ function removeClaims(directory, addr) {
  */
 export function sweep(root, now = Date.now(), sessionExists) {
     for (const record of listRecords(root)) {
+        const retainedAcknowledgements = sweepAcknowledgements(root, record.addr, now, SWEEP_MAIL_KEEP_MS);
         if (presenceOf(record, now) !== 'offline')
             continue;
         const hasMail = dirHasJson(root, `${record.addr}.inbox`) ||
             dirHasJson(root, `${record.addr}.asks`) ||
             claimsHaveJson(root, record.addr);
         const expired = now - record.lastSeenAt >= SWEEP_MAIL_KEEP_MS;
+        // Recent proof keeps a resumable record around, but never past expiry —
+        // otherwise one unreadable ack would pin a dead session (and its alias) forever.
+        if (retainedAcknowledgements > 0 && !expired)
+            continue;
         if (hasMail && !expired)
             continue;
         if (!expired && (sessionExists?.(record.sessionId) ?? true))
@@ -420,6 +426,7 @@ export function sweep(root, now = Date.now(), sessionExists) {
             try {
                 relay.removeDirectory(`${record.addr}.inbox`);
                 relay.removeDirectory(`${record.addr}.asks`);
+                relay.removeDirectory(`${record.addr}.acks`);
                 removeClaims(relay, record.addr);
                 try {
                     relay.unlinkFile(`${record.addr}.json`);

package/dist/relay.test.js

@@ -7,7 +7,7 @@ import { createRequire, syncBuiltinESMExports } from 'node:module';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
-import { BOUNDARY_PREAMBLE, formatAudit, formatDelivery, formatListing, refusalAmbiguous, refusalUnknown, } from './format.js';
+import { BOUNDARY_PREAMBLE, formatAudit, formatDelivery, formatListing } from './format.js';
 import { ackClaimedLetter, appendAudit, auditLogPath, awaitReceipt, claimInbox, clearAsk, deposit, drain, pendingAsks, previewBody, readAudit, readClaimedLetter, readIncomingAsk, readOutgoingAsk, recoverInboxClaims, requeueClaimedLetter, resolveAskByRef, trackIncomingAsk, trackOutgoingAsk, unreadCount, watchInbox, } from './mailbox.js';
 import { BACKLOG_CAP, OutboundPolicy, inboundAccepts } from './policy.js';
 import { claimAlias, clearAlias, deriveAddr, ensureRoot, resolveRelayRoot, isValidAliasName, listAliases, listRecords, presenceOf, readAlias, readRecord, sweep, writeAlias, writeRecord, } from './registry.js';
@@ -179,14 +179,14 @@ describe('mailbox', () => {
         deposit(root, addr, letter({ id: 'id-9', ts: 2000, body: 'good' }));
         expect(drain(root, addr).map((l) => l.body)).toEqual(['good']);
     });
-    it('receipt: delivered when the letter vanishes, queued when it stays', async () => {
+    it('receipt: destructive drain leaves delivery uncertain, remaining letters stay queued', async () => {
         const root = tmpRoot();
         const addr = 'inbox0000003';
         const l1 = letter({ id: 'rcpt-1', ts: Date.now() });
         deposit(root, addr, l1);
         const drained = drain(root, addr); // receiver takes it
         expect(drained).toHaveLength(1);
-        expect(await awaitReceipt(root, addr, l1, 400)).toBe('delivered');
+        expect(await awaitReceipt(root, addr, l1, 400)).toBe('uncertain');
         const l2 = letter({ id: 'rcpt-2', ts: Date.now() + 1 });
         deposit(root, addr, l2);
         expect(await awaitReceipt(root, addr, l2, 400)).toBe('queued');
@@ -610,10 +610,6 @@ describe('format', () => {
         expect(text).not.toContain('self00000000');
         expect(text).toContain('beta (peer00) — /tmp/alpha [idle]');
     });
-    it('pins refusal strings', () => {
-        expect(refusalUnknown('nobody', ['"alpha" (aaaa11)'])).toContain('No session matches');
-        expect(refusalAmbiguous('al', ['"alpha" (aaaa11)', '"alpine" (bbbb22)'])).toContain('ambiguous');
-    });
 });
 describe('relay root resolution', () => {
     // pi's home is commonly a dotfiles symlink (`~/.pi -> ~/Developer/dotfiles/home/.pi`).

package/dist/routing.d.ts

@@ -0,0 +1,18 @@
+import type { Letter } from './mailbox.js';
+import type { SessionRecord } from './registry.js';
+/** Exact session IDs share the target namespace with names and addresses. Never guess collisions. */
+export declare function resolveSessionTarget(to: string, records: SessionRecord[], selfAddr: string): {
+    record?: SessionRecord;
+    error?: string;
+};
+interface ReplyTarget {
+    id: string;
+    addr: string;
+    ask: boolean;
+}
+/** Reconstruct ordinary reply targets from the active branch, not abandoned histories or process-local delivery state. */
+export declare function resolveReplyTarget(reference: string, pending: Letter[], branch: readonly unknown[]): {
+    target?: ReplyTarget;
+    error?: string;
+};
+export {};

package/dist/routing.js

@@ -0,0 +1,58 @@
+/** Exact session IDs share the target namespace with names and addresses. Never guess collisions. */
+export function resolveSessionTarget(to, records, selfAddr) {
+    const peers = records.filter((r) => r.addr !== selfAddr);
+    const exact = peers.filter((r) => r.sessionId === to || r.addr === to || r.name.toLowerCase() === to.toLowerCase());
+    const matches = exact.length ? exact : peers.filter((r) => r.addr.startsWith(to));
+    const label = (r) => `${JSON.stringify(r.name)} (address ${r.addr}, sessionId ${JSON.stringify(r.sessionId)})`;
+    if (!matches.length)
+        return { error: `No session matches ${JSON.stringify(to)}. Use list or list-cwd to discover peers.` };
+    if (matches.length > 1)
+        return {
+            error: `${JSON.stringify(to)} is ambiguous: ${matches.map(label).join(', ')}. Use the intended full address.`,
+        };
+    return { record: matches[0] };
+}
+const ID = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/;
+const ADDRESS = /^[a-f0-9]{12}$/;
+/** Reconstruct ordinary reply targets from the active branch, not abandoned histories or process-local delivery state. */
+export function resolveReplyTarget(reference, pending, branch) {
+    if (!ID.test(reference))
+        return { error: 'replyTo must be a message ID or a nonempty unique prefix.' };
+    const candidates = pending.map((ask) => ({ id: ask.id, addr: ask.from.addr, ask: true }));
+    for (const entry of branch) {
+        if (typeof entry !== 'object' || entry === null)
+            continue;
+        const e = entry;
+        if (e.type !== 'custom_message' || e.customType !== 'relay:delivery')
+            continue;
+        const d = e.details;
+        if (typeof d !== 'object' || d === null)
+            continue;
+        const data = d;
+        if (data.kind !== 'message' && data.kind !== 'reply')
+            continue;
+        if (typeof data.id !== 'string' || !ID.test(data.id) || typeof data.from !== 'object' || data.from === null)
+            continue;
+        const addr = data.from.addr;
+        if (typeof addr !== 'string' || !ADDRESS.test(addr))
+            continue;
+        candidates.push({ id: data.id, addr, ask: false });
+    }
+    const matches = new Map();
+    const exact = candidates.filter((candidate) => candidate.id === reference);
+    for (const candidate of exact.length ? exact : candidates) {
+        if (!candidate.id.startsWith(reference))
+            continue;
+        const key = `${candidate.id}\0${candidate.addr}`;
+        matches.set(key, { ...candidate, ask: candidate.ask || matches.get(key)?.ask === true });
+    }
+    if (!matches.size)
+        return {
+            error: `No received message or pending ask matches ${JSON.stringify(reference)} in the active conversation. Use its full ID or list pending asks.`,
+        };
+    if (matches.size !== 1)
+        return {
+            error: `Reply ID ${JSON.stringify(reference)} is ambiguous. Use a longer prefix or full ID. Sender addresses: ${[...new Set([...matches.values()].map((m) => m.addr))].join(', ')}.`,
+        };
+    return { target: matches.values().next().value };
+}

package/filesystem.ts

@@ -25,7 +25,7 @@ const NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
 const DIRECTORY = fs.constants.O_DIRECTORY ?? 0;
 const CLOEXEC = process.platform === 'darwin' ? 0x01000000 : 0x00080000;
 const READ_DIRECTORY_FLAGS = fs.constants.O_RDONLY | NOFOLLOW | DIRECTORY | CLOEXEC;
-const AT_REMOVEDIR = 0x80;
+const AT_REMOVEDIR = process.platform === 'darwin' ? 0x80 : 0x200;
 
 function loadLibc(): ReturnType<typeof koffi.load> {
   const candidates =

package/format.ts

@@ -51,14 +51,6 @@ export function formatPendingAsk(letter: Letter, now: number = Date.now()): stri
   return `• ${letter.id.slice(0, 8)} from "${letter.from.name}" (${age(letter.ts, now)}): ${letter.body.replace(/\s+/g, ' ').slice(0, 80)}`;
 }
 
-export function refusalUnknown(to: string, reachable: string[]): string {
-  return `No session matches '${to}'. Reachable: ${reachable.length > 0 ? reachable.join(', ') : '(none)'}.`;
-}
-
-export function refusalAmbiguous(to: string, candidates: string[]): string {
-  return `'${to}' is ambiguous; matches: ${candidates.join(', ')}. Use a full name or address prefix.`;
-}
-
 /** Render recent audit entries for `/relay log`. */
 export function formatAudit(records: AuditRecord[], now: number = Date.now()): string {
   if (records.length === 0) return 'No audit entries yet.';