@quecue/dev-notify 0.1.0-alpha.1 → 0.1.0-alpha.3

package/dist/reply-engine.js

@@ -0,0 +1,199 @@
+import { randomBytes } from 'node:crypto';
+import { ConfigError } from './config.js';
+import { digest, targetEpoch, stateTransaction, TTL } from './reply-state.js';
+import { handleInteractionCallback, handleInteractionText, showInteraction } from './reply-interactions.js';
+import { injectReply, sanitizeReply, validateTarget } from './reply-platform.js';
+import { replyHint } from './reply-telegram.js';
+export const sessionEpoch = targetEpoch;
+export const textHash = (text) => digest(text.replace(/\s+/g, ' ').trim());
+function privateUser(message, sender) {
+    const chat = message?.chat;
+    if (chat?.type !== 'private' || !Number.isSafeInteger(chat.id) || chat.id <= 0
+        || !Number.isSafeInteger(sender?.id) || sender.id !== chat.id || sender.is_bot === true)
+        return null;
+    return String(chat.id);
+}
+export async function resolveEntry(access, key, context) {
+    const resolved = await stateTransaction(access, state => {
+        const entry = state.entries[key], target = entry && state.sessions[entry.session];
+        return entry && target && (target.tracked === true || !!entry.request) && entry.epoch === sessionEpoch(target) && Date.now() - entry.updated < TTL ? { entry, target } : null;
+    });
+    if (!resolved || !await (context.validate ?? (target => validateTarget(target)))(resolved.target))
+        return null;
+    return resolved;
+}
+async function prompt(access, chat, messageId, key, context) {
+    const resolved = await resolveEntry(access, key, context);
+    if (!resolved) {
+        await replyHint(context.api, chat, '⚠️ 无法回复', '该会话已关闭、切换或通知过期，请从最新通知进入。', messageId);
+        return;
+    }
+    if (resolved.entry.request) {
+        await showInteraction(access, resolved.entry.request, chat, context.api);
+        return;
+    }
+    const sent = await replyHint(context.api, chat, '💬 回复 Claude', '请回复此消息输入内容。该输入将提交到对应本机会话。\n会话：' + (resolved.target.title || resolved.target.session), messageId, { force_reply: true, selective: true });
+    if (Number.isSafeInteger(sent?.message_id))
+        await stateTransaction(access, state => { state.entries[`tg:${chat}:${sent.message_id}`] = resolved.entry; });
+}
+export async function processUpdate(access, update, context) {
+    try {
+        await processAuthorizedUpdate(access, update, context);
+    }
+    catch (error) {
+        const message = update?.callback_query?.message ?? update?.message;
+        const sender = update?.callback_query?.from ?? update?.message?.from;
+        const chat = privateUser(message, sender);
+        const current = await context.fresh().catch(() => null);
+        if (chat && current?.identity === access.identity && current.policy.users.includes(chat)) {
+            if (typeof update?.callback_query?.id === 'string')
+                await context.api('answerCallbackQuery', {
+                    callback_query_id: update.callback_query.id, text: '处理失败或结果未知，请检查终端；不会自动重复提交',
+                }).catch(() => { });
+            await replyHint(context.api, chat, '⚠️ 本次提交结果无法确认', '处理发生异常，无法确认是否已登记或采用。请检查终端及后续结果反馈；不会自动重复提交。').catch(() => { });
+        }
+        throw error;
+    }
+}
+async function processAuthorizedUpdate(access, update, context) {
+    if (!Number.isSafeInteger(update?.update_id) || update.update_id < 0)
+        return;
+    const current = await context.fresh();
+    if (!current || current.identity !== access.identity)
+        return;
+    // 先提交 offset；强杀可能丢失本条，但不能重放已授权的终端输入。
+    const claimed = await stateTransaction(access, state => {
+        if (update.update_id < state.offset)
+            return false;
+        state.offset = update.update_id + 1;
+        return true;
+    });
+    if (!claimed)
+        return;
+    if (update.callback_query) {
+        const callback = update.callback_query, chat = privateUser(callback.message, callback.from);
+        if (!chat || !current.policy.users.includes(chat))
+            return;
+        const value = callback.data;
+        if (typeof value === 'string' && value.startsWith('dn:q:')) {
+            const id = value.split(':')[2];
+            if (!/^[a-f0-9]{32}$/.test(id) || !await resolveEntry(access, 'token:' + id, context)) {
+                await context.api('answerCallbackQuery', { callback_query_id: callback.id, text: '会话已关闭或交互已失效' }).catch(() => { });
+                await replyHint(context.api, chat, '⚠️ 本次提交未生效', '会话已关闭、切换或交互已失效；未回传答案。').catch(() => { });
+                return;
+            }
+            if (await handleInteractionCallback(access, callback, chat, context.api))
+                return;
+        }
+        if (typeof value !== 'string' || !/^dn:r:[a-f0-9]{32}$/.test(value) || typeof callback.id !== 'string')
+            return;
+        await context.api('answerCallbackQuery', { callback_query_id: callback.id, text: '请在回复框输入内容' });
+        await prompt(access, chat, callback.message.message_id, 'token:' + value.slice(5), context);
+        return;
+    }
+    const message = update.message, chat = privateUser(message, message?.from);
+    if (!chat || typeof message.text !== 'string' || !Number.isSafeInteger(message.message_id))
+        return;
+    const text = message.text.trim();
+    if (text === '/chatid') {
+        await replyHint(context.api, chat, 'Telegram chat_id', chat, message.message_id);
+        return;
+    }
+    if (!current.policy.users.includes(chat))
+        return;
+    if (typeof message.date === 'number' && Date.now() / 1000 - message.date > 300) {
+        await replyHint(context.api, chat, '⚠️ 本次提交未生效', '这条输入消息已超过有效时间，未回传；请查看最新问题或终端状态。');
+        return;
+    }
+    if (/^\/start\s+[a-f0-9]{32}$/.test(text)) {
+        await prompt(access, chat, message.message_id, 'token:' + text.split(/\s+/)[1], context);
+        return;
+    }
+    const replyTo = message.reply_to_message?.message_id;
+    if (!Number.isSafeInteger(replyTo)) {
+        await replyHint(context.api, chat, '💬 回复方式', '请直接回复任务完成通知，或点击通知里的「回复 Claude」按钮。', message.message_id);
+        return;
+    }
+    const resolved = await resolveEntry(access, `tg:${chat}:${replyTo}`, context);
+    if (!resolved) {
+        await replyHint(context.api, chat, '⚠️ 无法回复', '通知已过期或对应会话已关闭、切换，请从最新通知回复。', message.message_id);
+        return;
+    }
+    if (resolved.entry.request) {
+        await handleInteractionText(access, resolved.entry.request, chat, message, context.api);
+        return;
+    }
+    let safe;
+    try {
+        safe = sanitizeReply(message.text);
+    }
+    catch (error) {
+        await replyHint(context.api, chat, '❌ 未提交回复', error instanceof ConfigError ? error.message : '输入无效', message.message_id);
+        return;
+    }
+    const id = randomBytes(16).toString('hex');
+    const queued = await stateTransaction(access, state => {
+        const target = state.sessions[resolved.target.session];
+        if (!target || sessionEpoch(target) !== resolved.entry.epoch)
+            throw new ConfigError('会话已变化，未提交');
+        if (state.pending[target.session] && Date.now() - state.pending[target.session].updated < 5 * 60 * 1000)
+            return null;
+        state.pending[target.session] = { hash: textHash(safe), text: safe, epoch: resolved.entry.epoch, id, updated: Date.now(), queued: target.working,
+            phase: 'queued', chat, message: message.message_id };
+        return target.working;
+    });
+    if (queued === null) {
+        await replyHint(context.api, chat, '⏳ 未提交新回复', '该会话已有未确认回复，请等待收到确认或检查本机终端后再试。', message.message_id);
+        return;
+    }
+    if (queued)
+        await replyHint(context.api, chat, '⏳ 回复已排队', 'Claude 正在处理当前任务；本地队列将在本轮结束后尝试提交，不会把文本输入到正在等待权限的弹窗。', message.message_id);
+    else
+        await drainReplies(access, context);
+}
+export async function drainReplies(access, context) {
+    const queued = await stateTransaction(access, state => Object.entries(state.pending)
+        .filter(([session, value]) => value.phase === 'queued' && (!state.sessions[session]?.working || Date.now() - value.updated > 5 * 60 * 1000))
+        .map(([session, pending]) => ({ target: state.sessions[session], pending })));
+    for (const item of queued) {
+        const { target, pending } = item;
+        if (!target || !pending.text)
+            continue;
+        try {
+            const current = await context.fresh();
+            if (!current || current.identity !== access.identity || !current.policy.users.includes(pending.chat))
+                return;
+            if (Date.now() - pending.updated > 5 * 60 * 1000)
+                throw new ConfigError('排队回复已超过 5 分钟，未提交；请检查本机后重新回复');
+            if (!target.tracked || pending.epoch !== sessionEpoch(target) || !await (context.validate ?? (value => validateTarget(value)))(target))
+                throw new ConfigError('会话已关闭或切换，未提交');
+            const text = pending.text;
+            const claimed = await stateTransaction(access, state => {
+                const actual = state.pending[target.session], active = state.sessions[target.session];
+                if (!actual || actual.id !== pending.id || actual.phase !== 'queued' || active?.working || sessionEpoch(active) !== sessionEpoch(target))
+                    return false;
+                actual.phase = 'submitted';
+                delete actual.text;
+                return true;
+            });
+            if (!claimed)
+                continue;
+            // 输入前再次核验授权，撤销后不发送。原生调用一旦开始，不能撤回或保证无竞态。
+            const final = await context.fresh();
+            if (!final || final.identity !== access.identity)
+                return;
+            await (context.inject ?? ((value, content) => injectReply(value, content)))(target, text);
+            await replyHint(context.api, pending.chat, '✅ 已转发给 Claude', '终端输入已提交，等待 UserPromptSubmit 确认；这不等于 Claude 已开始处理。', pending.message);
+        }
+        catch (error) {
+            await stateTransaction(access, state => {
+                const value = state.pending[target.session];
+                if (value?.id === pending.id) {
+                    value.phase = 'unknown';
+                    delete value.text;
+                }
+            });
+            await replyHint(context.api, pending.chat, '⚠️ 转发未确认', error instanceof ConfigError ? error.message : '提交失败或结果未知，请检查本机终端；不会自动重复提交。', pending.message).catch(() => { });
+        }
+    }
+}

package/dist/reply-hooks.js

@@ -0,0 +1,230 @@
+import { randomBytes } from 'node:crypto';
+import { ConfigError } from './config.js';
+import { accessReplies, botKey, digest, stateTransaction, targetEpoch } from './reply-state.js';
+import { findSession } from './reply-platform.js';
+import { textHash } from './reply-engine.js';
+import { telegramApi, replyHint } from './reply-telegram.js';
+import { bridgeStatus, startBridge } from './reply-bridge.js';
+import { createInteraction, showInteraction, waitInteraction } from './reply-interactions.js';
+import { makePlan, deliver } from './channels.js';
+import { completeToolCall, endSessionInteractions, finishInteraction, matchingCall, registerToolCall } from './reply-outcomes.js';
+const apiFor = (access, options) => (options.api ?? (value => telegramApi(value.config.telegram.token)))(access);
+async function getTarget(data, options) {
+    return (options.session ?? (id => findSession(id, { env: options.env })))(data.session_id);
+}
+export async function lifecycleHook(data, file, options = {}) {
+    const event = data.hook_event_name;
+    if (!['SessionStart', 'UserPromptSubmit', 'SessionEnd', 'Stop', 'Notification'].includes(event) || typeof data.session_id !== 'string')
+        return;
+    const access = await accessReplies(file, options.env);
+    if (!access)
+        return;
+    if (event === 'Stop' && data.stop_hook_active === true)
+        return;
+    const target = event === 'SessionEnd' ? null : await getTarget(data, options);
+    const receipt = await stateTransaction(access, state => {
+        const previous = state.sessions[data.session_id];
+        if (event === 'SessionEnd' || !target) {
+            delete state.sessions[data.session_id];
+            delete state.pending[data.session_id];
+            endSessionInteractions(state, data.session_id, '会话已结束或无法核验');
+            return null;
+        }
+        // 同进程 / 同 TTY 已切换会话时，旧映射不再允许输入。
+        for (const [id, other] of Object.entries(state.sessions)) {
+            if (id !== target.session && (other.pid === target.pid || (target.tty && other.tty === target.tty))) {
+                endSessionInteractions(state, id, '会话已切换');
+                delete state.sessions[id];
+                delete state.pending[id];
+            }
+        }
+        const pending = state.pending[target.session];
+        const match = event === 'UserPromptSubmit' && typeof data.prompt === 'string' && pending?.phase === 'submitted'
+            && pending.epoch === targetEpoch(target) && pending.hash === textHash(data.prompt) && Date.now() - pending.updated < 5 * 60 * 1000;
+        if (match || (pending && pending.epoch !== targetEpoch(target)))
+            delete state.pending[target.session];
+        const working = event !== 'Stop';
+        const tracked = event === 'UserPromptSubmit' || (event !== 'SessionStart' && previous?.tracked === true && targetEpoch(previous) === targetEpoch(target));
+        const latestCall = event !== 'SessionStart' && event !== 'UserPromptSubmit' && previous && targetEpoch(previous) === targetEpoch(target)
+            ? previous.latestCall : undefined;
+        state.sessions[target.session] = { ...target, working, tracked, latestCall, updated: Date.now() };
+        // 本地用户提交新任务时，尚未注入的排队回复不能抢在该任务前输入。
+        if (event === 'UserPromptSubmit' && !match && pending?.phase === 'queued')
+            delete state.pending[target.session];
+        if (event === 'UserPromptSubmit' || event === 'SessionStart' || event === 'Stop') {
+            endSessionInteractions(state, target.session, event === 'Stop' ? '本轮已结束' : '本机已开始新任务或新会话');
+        }
+        return match ? pending : null;
+    });
+    if (receipt) {
+        await replyHint(apiFor(access, options), receipt.chat, '✅ Claude 已收到回复', 'UserPromptSubmit 已匹配本次远程输入；这仅确认收到，不代表任务已经完成。', receipt.message).catch(() => options.err?.('Telegram: 收到确认发送失败；不会重放输入。'));
+        if (access.config.feishu.enabled && access.config.feishu.webhook) {
+            try {
+                const result = await (options.send ?? deliver)(makePlan('feishu', { title: 'Claude 已收到回复', level: 'info',
+                    content: 'UserPromptSubmit 已匹配远程输入；仅确认收到，不代表任务完成。为减少扩散，不转发回复原文。',
+                    footer: '会话：' + data.session_id }, access.config), access.config);
+                if (!result.ok)
+                    options.err?.('feishu: 收到确认未完整发送；不会重放输入。');
+            }
+            catch {
+                options.err?.('feishu: 收到确认发送失败；不会重放输入。');
+            }
+        }
+    }
+}
+const feishuTarget = (config) => digest(JSON.stringify([config.feishu.webhook, config.feishu.secret]));
+export async function notificationCoverage(data, file, config, options = {}) {
+    const none = { telegram: [], feishu: false };
+    if (data.hook_event_name !== 'Notification' || data.notification_type !== 'permission_prompt' || typeof data.session_id !== 'string')
+        return none;
+    const access = await accessReplies(file, options.env);
+    if (!access || botKey(config) !== access.policy.bot)
+        return none;
+    return stateTransaction(access, state => {
+        const target = state.sessions[data.session_id];
+        const call = target?.latestCall && state.calls[target.latestCall];
+        if (!target || !call || call.session !== target.session || call.epoch !== targetEpoch(target) || call.tool !== 'AskUserQuestion'
+            || typeof data.tool_use_id === 'string' && data.tool_use_id !== call.id
+            || typeof data.tool_name === 'string' && data.tool_name !== call.tool
+            || typeof data.prompt_id === 'string' && data.prompt_id !== call.prompt)
+            return none;
+        const request = call.request && state.requests[call.request];
+        if (!request || request.kind !== 'question' || request.session !== target.session || request.epoch !== call.epoch || request.expires <= Date.now())
+            return none;
+        // Notification 通常没有调用 ID；仅覆盖当前最后一项调用，存在其他并行调用时保守保留提醒。
+        if (Object.entries(state.calls).some(([key, other]) => key !== target.latestCall && other.session === target.session && other.epoch === call.epoch && !other.ended))
+            return none;
+        return { telegram: (request.notified?.telegram ?? []).filter(user => access.policy.users.includes(user)),
+            feishu: request.notified?.feishu === feishuTarget(config) };
+    });
+}
+export async function attachReply(message, data, file, options = {}) {
+    const access = await accessReplies(file, options.env);
+    if (!access || data.hook_event_name !== 'Stop')
+        return null;
+    const target = await getTarget(data, options);
+    if (!target)
+        return null;
+    const saved = await stateTransaction(access, state => state.sessions[target.session]);
+    if (!saved || saved.working || !saved.tracked || targetEpoch(saved) !== targetEpoch(target))
+        return null;
+    const ready = options.bridge ? await options.bridge(file, options.env ?? process.env)
+        : (await bridgeStatus(file)).ready || await startBridge(file, options.env);
+    if (!ready) {
+        options.err?.('远程回复桥接未就绪，本次通知不展示回复按钮；可运行 reply status 检查。');
+        return null;
+    }
+    const api = apiFor(access, options), bot = await api('getMe', {});
+    if (typeof bot?.username !== 'string' || !/^[A-Za-z0-9_]{5,64}$/.test(bot.username))
+        throw new ConfigError('Telegram Bot 用户名无效，未启用回复按钮');
+    const token = randomBytes(16).toString('hex');
+    await stateTransaction(access, state => { state.entries['token:' + token] = { session: target.session, epoch: targetEpoch(target), updated: Date.now() }; });
+    message.reply = { token, url: `https://t.me/${bot.username}?start=${token}`, users: access.policy.users };
+    return { access, token };
+}
+export function mapReplies(plan, binding) {
+    if (plan.channel !== 'telegram')
+        return;
+    plan.onSent = async (item, response) => {
+        if (!binding.access.policy.users.includes(item.recipient))
+            return;
+        if (!Number.isSafeInteger(response.result?.message_id))
+            throw new ConfigError('通知未返回可映射的 Telegram 消息 ID');
+        await stateTransaction(binding.access, state => {
+            const entry = state.entries['token:' + binding.token];
+            if (entry)
+                state.entries[`tg:${item.recipient}:${response.result.message_id}`] = entry;
+        });
+    };
+}
+export async function interactionHook(data, file, options = {}) {
+    if (!['PreToolUse', 'PermissionRequest', 'PostToolUse', 'PostToolUseFailure', 'PermissionDenied'].includes(data.hook_event_name))
+        return;
+    const access = await accessReplies(file, options.env);
+    if (!access)
+        return;
+    if (['PostToolUse', 'PostToolUseFailure', 'PermissionDenied'].includes(data.hook_event_name)) {
+        await completeToolCall(access, data);
+        return;
+    }
+    if (!['PreToolUse', 'PermissionRequest'].includes(data.hook_event_name))
+        return;
+    const kind = data.tool_name === 'AskUserQuestion' ? 'question' : access.policy.permissions === true ? 'permission' : null;
+    if (typeof data.session_id !== 'string' || data.hook_event_name === 'PermissionRequest' && !kind)
+        return;
+    const cached = data.hook_event_name === 'PreToolUse'
+        ? await stateTransaction(access, state => state.sessions[data.session_id]) : null;
+    // 登记阶段复用生命周期元数据；真正开启远程交互时仍重新核验进程身份。
+    const target = cached ?? await getTarget(data, options);
+    if (!target) {
+        options.err?.('无法核验会话，结构化交互保留本机处理。');
+        return;
+    }
+    if (data.hook_event_name === 'PreToolUse') {
+        // 只登记调用身份，不发网络请求、不等待远端，原生窗口可以正常出现。
+        await registerToolCall(access, target, data);
+        return;
+    }
+    if (!kind)
+        return;
+    const call = await stateTransaction(access, state => matchingCall(state, target, data));
+    if (!call) {
+        options.err?.('无法唯一关联工具调用，远程交互未启用；本机窗口保持正常。');
+        return;
+    }
+    const ready = options.bridge ? await options.bridge(file, options.env ?? process.env)
+        : (await bridgeStatus(file)).ready || await startBridge(file, options.env);
+    if (!ready) {
+        options.err?.('回复桥接未就绪，问题保留本机处理。');
+        return;
+    }
+    const api = apiFor(access, options);
+    const request = await createInteraction(access, target, kind, kind === 'question' ? data.tool_input : { tool_name: data.tool_name, tool_input: data.tool_input }, call);
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    process.on('SIGTERM', cancel);
+    process.on('SIGINT', cancel);
+    try {
+        for (const chat of access.policy.users)
+            await showInteraction(access, request.id, chat, api);
+        if (access.config.feishu.enabled && access.config.feishu.webhook) {
+            const bot = await api('getMe', {});
+            if (typeof bot?.username === 'string' && /^[A-Za-z0-9_]{5,64}$/.test(bot.username)) {
+                const result = await (options.send ?? deliver)(makePlan('feishu', { title: 'Claude Code 需要你处理', level: 'warn', footer: '',
+                    content: kind === 'question' ? request.questions.map(q => q.question + '\n' + q.options.map(o => o.label + '：' + o.description).join('\n')).join('\n\n') : '工具权限请求：' + data.tool_name,
+                    reply: { token: request.id, url: `https://t.me/${bot.username}?start=${request.id}`, users: access.policy.users } }, access.config), access.config);
+                if (result.ok)
+                    await stateTransaction(access, state => {
+                        const current = state.requests[request.id];
+                        if (current) {
+                            current.notified ??= {};
+                            current.notified.feishu = feishuTarget(access.config);
+                        }
+                    });
+            }
+        }
+        const response = await (options.wait ?? waitInteraction)(access, request, () => accessReplies(file, options.env), { signal: controller.signal });
+        if (response && !controller.signal.aborted)
+            options.response?.(response);
+        else
+            options.err?.('远程交互已结束或未提交；不会默认作答，本机操作不受影响。');
+    }
+    catch (error) {
+        await stateTransaction(access, state => {
+            const current = state.requests[request.id];
+            if (current)
+                finishInteraction(current, { kind: current.claimed ? 'unknown' : 'not-applied', text: '远程交互处理失败；请检查本机，不会自动重复提交。' });
+        }).catch(() => { });
+        throw error;
+    }
+    finally {
+        process.off('SIGTERM', cancel);
+        process.off('SIGINT', cancel);
+        if (controller.signal.aborted)
+            await stateTransaction(access, state => {
+                const current = state.requests[request.id];
+                if (current)
+                    finishInteraction(current, { kind: current.claimed ? 'unknown' : 'not-applied', text: '交互等待已取消，远程答案未确认生效。' });
+            }).catch(() => { });
+    }
+}