@patimweb/pi-teams 1.8.0 → 1.9.1

package/src/watch/loop.ts

@@ -97,6 +97,18 @@ export interface WatchRuntimeStatus {
 // One tick
 // ---------------------------------------------------------------------------
 
+/** A tick was asked to run without knowing who pi is signed in as. */
+export class WatchIdentityError extends Error {
+	constructor(cause?: unknown) {
+		super(
+			"Listen mode is waiting: the signed-in user could not be determined, so pi's own replies " +
+				"could not be told apart from new messages. Retrying on the next poll." +
+				(cause ? ` ${formatGraphError(cause)}` : ""),
+		);
+		this.name = "WatchIdentityError";
+	}
+}
+
 /**
  * Bound on how many chats one tick examines.
  *
@@ -165,8 +177,14 @@ export async function runWatchTick(
 	deps: WatchTickDeps,
 	state: WatchState,
 	watch: ResolvedWatchConfig,
-	me: SignedInUser | undefined,
+	me: SignedInUser,
 ): Promise<WatchTickResult> {
+	// Who pi acts as is what tells its own replies apart from everybody else's
+	// (`isFromMe`). Without it, the answer pi just sent looks like a new message
+	// from a colleague and wakes pi again — a loop that answers itself. So a tick
+	// without an identity examines nothing, and in particular writes no cursor.
+	if (!me) throw new WatchIdentityError();
+
 	const now = deps.now();
 	pruneState(state, now);
 
@@ -328,8 +346,24 @@ export function startWatchLoop(options: WatchLoopOptions): WatchLoop {
 
 	let stopped = false;
 	let timer: ReturnType<typeof setTimeout> | undefined;
+	/**
+	 * The tick currently running, if any.
+	 *
+	 * Every tick schedules the next one when it finishes, so two ticks running at
+	 * once would leave two chains behind and quietly double the polling rate for
+	 * the rest of the session. `poll()` therefore joins the tick in flight
+	 * instead of starting a second one.
+	 */
+	let inFlight: Promise<void> | undefined;
+	/**
+	 * Who pi acts as, looked up on the first tick that can reach Graph.
+	 *
+	 * A failed lookup is not an answer: it is retried on every tick until it
+	 * succeeds, and no tick runs before it has. A watcher started before sign-in
+	 * (autoStart in a fresh container, say) would otherwise settle for "nobody"
+	 * for the whole session and wake on its own replies.
+	 */
 	let me: SignedInUser | undefined;
-	let meResolved = false;
 	let failureCount = 0;
 
 	const status: WatchRuntimeStatus = {
@@ -343,7 +377,7 @@ export function startWatchLoop(options: WatchLoopOptions): WatchLoop {
 
 	const schedule = (delayMs: number) => {
 		if (stopped) return;
-		timer = setTimeout(() => void tick(), delayMs);
+		timer = setTimeout(() => void runTick(), delayMs);
 		// Do not hold the process open for a poll that can wait.
 		timer.unref?.();
 	};
@@ -352,9 +386,12 @@ export function startWatchLoop(options: WatchLoopOptions): WatchLoop {
 		if (stopped) return;
 
 		try {
-			if (!meResolved) {
-				me = await getMe(connection).catch(() => undefined);
-				meResolved = true;
+			if (!me) {
+				try {
+					me = await getMe(connection);
+				} catch (err) {
+					throw new WatchIdentityError(err);
+				}
 			}
 
 			const result = await runWatchTick(
@@ -406,14 +443,31 @@ export function startWatchLoop(options: WatchLoopOptions): WatchLoop {
 			options.onError?.(status.lastError);
 		}
 
-		options.onTick?.(status);
+		// Outside the try above on purpose, and guarded on its own: a throwing
+		// status callback must not become an unhandled rejection that takes the
+		// watcher down without a word.
+		try {
+			options.onTick?.(status);
+		} catch {
+			/* a footer that cannot render is not worth stopping the loop for */
+		}
+
 		schedule(watch.intervalSeconds * 1000 * Math.min(2 ** failureCount, 10));
 	}
 
+	/** Run a tick unless one is already running; either way, resolve with it. */
+	function runTick(): Promise<void> {
+		if (inFlight) return inFlight;
+		inFlight = tick().finally(() => {
+			inFlight = undefined;
+		});
+		return inFlight;
+	}
+
 	// The first tick is immediate: it answers what is still open since the last
 	// run, and a user who switched listen mode on should not wait a full interval
 	// to see it alive.
-	void tick();
+	void runTick();
 
 	return {
 		stop() {
@@ -424,9 +478,15 @@ export function startWatchLoop(options: WatchLoopOptions): WatchLoop {
 		},
 		status: () => ({ ...status, wakesThisHour: wakesThisHour(state, Date.now()) }),
 		async poll() {
+			// Join a tick already in flight rather than racing it; only start one
+			// when nothing is running.
+			if (inFlight) {
+				await inFlight;
+				return;
+			}
 			if (timer) clearTimeout(timer);
 			timer = undefined;
-			await tick();
+			await runTick();
 		},
 	};
 }

package/src/watch/pin.ts

@@ -0,0 +1,109 @@
+/**
+ * Listen mode — pinning the answer to the chat that asked for it.
+ *
+ * A wake puts somebody else's words into pi's prompt, and pi holds tools that
+ * write in the user's name. The prompt asks it to answer only the chat it was
+ * woken for, but an instruction inside a message is exactly the thing that can
+ * talk a model out of following an instruction in a prompt. So the rule is
+ * enforced here instead: while an answer is pending, sending anywhere other
+ * than the chat that woke pi is refused by the safety interceptor.
+ *
+ * This is deliberately narrow. It gates outgoing messages only — the tools that
+ * speak to other people — and not reading, presence or the calendar, because a
+ * pin that blocks unrelated work would be a bug the user meets far more often
+ * than an attack.
+ *
+ * Module state rather than a parameter: the interceptor sees a tool call, not a
+ * turn, and one session runs one watcher.
+ */
+
+/**
+ * How long a pin can survive without the turn ending.
+ *
+ * The pin is normally cleared when the agent settles. The timeout is the
+ * backstop for the case where that never arrives — a crash, a cancelled run —
+ * so a stuck pin cannot lock the user out of their own tools.
+ */
+export const PIN_TTL_MS = 15 * 60 * 1000;
+
+interface Pin {
+	chatId: string;
+	/** Chat label, for the refusal message */
+	label: string;
+	at: number;
+}
+
+let pin: Pin | undefined;
+
+/** Pin the answer of the turn that is about to start to one chat. */
+export function pinWakeTarget(chatId: string, label: string, now = Date.now()): void {
+	pin = { chatId, label, at: now };
+}
+
+/** Release the pin. Safe to call when there is none. */
+export function clearWakeTarget(): void {
+	pin = undefined;
+}
+
+/** The chat an answer is currently owed to, if any. */
+export function getWakeTarget(now = Date.now()): { chatId: string; label: string } | undefined {
+	if (!pin) return undefined;
+	if (now - pin.at > PIN_TTL_MS) {
+		pin = undefined;
+		return undefined;
+	}
+	return { chatId: pin.chatId, label: pin.label };
+}
+
+/**
+ * Tools that speak to people, and must therefore stay inside the pinned chat.
+ *
+ * Reading, presence and calendar tools are absent on purpose: they do not put
+ * words in anyone's inbox, and gating them would break ordinary work for no
+ * security gain.
+ */
+const OUTGOING_TOOLS = new Set<string>([
+	"teams_send_chat_message",
+	"teams_send_channel_message",
+	"teams_reply_channel_message",
+	"teams_create_chat",
+	"teams_chat_members",
+	"teams_update_message",
+	"teams_react",
+]);
+
+/**
+ * Why this call must not go through while an answer is pinned, or undefined.
+ *
+ * The chat is matched on its ID, because that is what the wake prompt hands the
+ * model and the only identifier that cannot be talked into meaning a different
+ * conversation.
+ */
+export function pinViolation(
+	toolName: string,
+	params: Record<string, unknown>,
+	now = Date.now(),
+): string | undefined {
+	const target = getWakeTarget(now);
+	if (!target) return undefined;
+	if (!OUTGOING_TOOLS.has(toolName)) return undefined;
+
+	const explain = (what: string) =>
+		`Listen mode is answering "${target.label}". ${what} Only that chat may be written to until the ` +
+		`answer is done — a message can ask for anything, and this is the part that does not take its word for it.`;
+
+	if (toolName === "teams_send_channel_message" || toolName === "teams_reply_channel_message") {
+		return explain("This would post in a channel.");
+	}
+	if (toolName === "teams_create_chat") {
+		return explain("This would start a different conversation.");
+	}
+
+	const chat = typeof params.chat === "string" ? params.chat : undefined;
+	if (!chat) return explain("This does not name the chat it would write to.");
+	if (chat !== target.chatId) {
+		return explain(`This would write to "${chat}" instead.`);
+	}
+
+	return undefined;
+}