@rubytech/create-maxy-code 0.1.350 → 0.1.351

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -9,7 +9,6 @@
 //   DELETE /:id                 -> 204 (rmSync JSONL + subdir)
 //                                 409 if PTY still alive
 //                                 404 if no transcript on disk
-//   POST   /:id/input           { text }
 //   GET    /:id/log             -> { jsonlPath, sizeBytes, exists }
 //   GET    /:id/log?follow=1    -> streamed file content (current + new)
 //   GET    /:id/meta            -> SessionMeta payload
@@ -21,17 +20,18 @@
 // manager does not know.
 import { Hono } from 'hono';
 import { stream } from 'hono/streaming';
-import { existsSync, statSync, createReadStream, watchFile, unwatchFile, rmSync, mkdirSync, renameSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, statSync, createReadStream, watchFile, unwatchFile, rmSync, mkdirSync, renameSync, readFileSync, writeFileSync, openSync, readSync, closeSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { buildWaChannelMcpServers, buildWaChannelArgv, waChannelMcpConfigPath, isDevChannelPrompt } from './wa-channel-mcp.js';
 import { buildWebchatChannelMcpServers, buildWebchatChannelArgv, webchatChannelMcpConfigPath } from './webchat-channel-mcp.js';
+import { buildTelegramChannelMcpServers, buildTelegramChannelArgv, telegramChannelMcpConfigPath } from './telegram-channel-mcp.js';
 import { buildChannelMcpServers, buildChannelArgv, channelMcpConfigPath } from './channel-mcp.js';
 import { mergeTarget, isMultiTarget, targetKinds } from './channel-targets.js';
 import { randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { buildRcChildEnv, reapplyAdminLevers } from './rc-daemon.js';
 import { isEffortLevel, isNewSessionEffortLevel, isPermissionMode, SONNET_MODEL } from '../../../lib/models/dist/index.js';
-import { spawnClaudeSession, stopSession, writeInputToPty, writeInterruptToPty, isLive, onPtyExit, livePtyCount, liveSessionIds, getPtyTrackerForTests, livePidForSession, classifyLiveness, priorExitedCountForSession, PERMISSION_MODES, openFdCount, registerRcSpawnPty, } from './pty-spawner.js';
+import { spawnClaudeSession, stopSession, writeInterruptToPty, isLive, onPtyExit, livePtyCount, liveSessionIds, getPtyTrackerForTests, livePidForSession, classifyLiveness, priorExitedCountForSession, PERMISSION_MODES, openFdCount, registerRcSpawnPty, } from './pty-spawner.js';
 import { writeScopeRecord, removeScopeRecord } from './scope-record.js';
 import { writeReseatMarker, resolveReseatChain, clearReseatMarker } from './reseat-ledger.js';
 import { getScopeMainPid, defaultProcessSignals, defaultSystemctlRunner } from './systemd-scope.js';
@@ -40,7 +40,6 @@ import { resolveSettingsPermissionMode, resolveSettingsModel, resolveSettingsEff
 import { emitRcLife } from './rc-life.js';
 import { createRcChildLog } from './rc-child-log.js';
 import { readJsonlSession } from './jsonl-enumerator.js';
-import { watchInputSubmission, countUserEntries } from './input-postcondition.js';
 import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, detectRemoteControlSlug, classifyBindBlocker, } from './jsonl-path.js';
 import { basename, dirname, join } from 'node:path';
 import { validateUserTitle } from './user-title-store.js';
@@ -156,6 +155,62 @@ function finitePositive(raw, fallback) {
     const n = Number(raw);
     return Number.isFinite(n) && n > 0 ? n : fallback;
 }
+/** Task 1090 Phase 2 — the post-interrupt transcript-integrity check. Reads a
+ *  bounded tail of the session JSONL and reports whether a `tool_use` block in
+ *  that window has no matching `tool_result` after it — the signature of an
+ *  interrupt that landed mid-tool-call, which would corrupt a later `--resume`.
+ *  Bounded (last 64KB) so a large transcript never blocks the post-check; the
+ *  window only needs the last turn's tool pairing. Returns false on any read
+ *  error (no file yet, gone) — absence of evidence is not a dangling use. */
+function tailHasDanglingToolUse(jsonlPath) {
+    try {
+        if (!existsSync(jsonlPath))
+            return false;
+        const size = statSync(jsonlPath).size;
+        const window = 64 * 1024;
+        const fd = openSync(jsonlPath, 'r');
+        try {
+            const start = size > window ? size - window : 0;
+            const len = size - start;
+            const buf = Buffer.alloc(len);
+            readSync(fd, buf, 0, len, start);
+            const lines = buf.toString('utf8').split('\n');
+            const used = new Set();
+            const resulted = new Set();
+            for (const line of lines) {
+                if (!line)
+                    continue;
+                let o;
+                try {
+                    o = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                const rec = o;
+                const content = rec.message?.content;
+                if (!Array.isArray(content))
+                    continue;
+                for (const c of content) {
+                    if (c.type === 'tool_use' && typeof c.id === 'string')
+                        used.add(c.id);
+                    if (c.type === 'tool_result' && typeof c.tool_use_id === 'string')
+                        resulted.add(c.tool_use_id);
+                }
+            }
+            for (const id of used)
+                if (!resulted.has(id))
+                    return true;
+            return false;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return false;
+    }
+}
 /** Resolve any of the 4 keys to the canonical (sessionId, row) pair.
  *  Tries: intrinsic sessionId, bridgeSessionId, bridgeSuffix, numeric pid.
  *  Returns undefined when nothing matches. */
@@ -1489,84 +1544,13 @@ export function buildHttpApp(deps) {
         // binding. Best-effort; the store logs its own failure.
         deps.waChannelStore.remove(sessionId);
         deps.webchatChannelStore?.remove(sessionId);
+        deps.telegramChannelStore?.remove(sessionId);
         // Task 702 — the transcript is gone; its reattach hint must go too.
         removeScopeRecord(sessionsDir, sessionId, deps.logger);
         deps.logger(`purge sessionId=${sessionId.slice(0, 8)} bytes=${bytes}`);
         timed(deps.logger, 'DELETE', `/${id}`, 204, Date.now() - start);
         return c.body(null, 204);
     });
-    app.post('/:sessionId/input', async (c) => {
-        const start = Date.now();
-        const id = c.req.param('sessionId');
-        const row = resolveRow(deps.watcher, id);
-        const sessionId = row?.sessionId ?? id;
-        let body;
-        try {
-            body = await c.req.json();
-        }
-        catch {
-            timed(deps.logger, 'POST', `/${id}/input`, 400, Date.now() - start);
-            return c.json({ error: 'body-not-json' }, 400);
-        }
-        if (typeof body.text !== 'string') {
-            timed(deps.logger, 'POST', `/${id}/input`, 400, Date.now() - start);
-            return c.json({ error: 'text-required' }, 400);
-        }
-        const channel = row?.channel ?? null;
-        const result = writeInputToPty(sessionId, body.text, deps.logger, channel);
-        if (!result.ok) {
-            if (result.error === 'not-found') {
-                timed(deps.logger, 'POST', `/${id}/input`, 404, Date.now() - start);
-                return c.json({ error: 'session-not-found' }, 404);
-            }
-            if (result.error === 'exited') {
-                timed(deps.logger, 'POST', `/${id}/input`, 410, Date.now() - start);
-                return c.json({ error: 'session-exited' }, 410);
-            }
-            timed(deps.logger, 'POST', `/${id}/input`, 500, Date.now() - start);
-            return c.json({ error: 'pty-write-failed', detail: result.detail }, 500);
-        }
-        // Task 666 — the 200 means the write was accepted, not that a turn
-        // submitted. Fire a bounded post-condition poll (non-awaited) that confirms
-        // the PTY went `busy` or a new user JSONL entry landed, or emits
-        // `op=input-no-turn` so an accepted-but-unsubmitted input is visible without
-        // waiting for the 300s turn-timeout. The 200 is no longer the success signal.
-        // Finite-guard the tunables: a non-numeric env override would otherwise make
-        // windowMs/intervalMs NaN, so the elapse check never fires and the poll spins
-        // forever (a timer leak per /input). Fall back to the defaults instead.
-        const windowMs = finitePositive(process.env.INPUT_SUBMIT_POLL_MS, 8000);
-        const intervalMs = finitePositive(process.env.INPUT_SUBMIT_POLL_INTERVAL_MS, 250);
-        const postcondJsonlPath = jsonlPathForSessionId(deps.spawnCwd, sessionId);
-        const baselineUserCount = countUserEntries(postcondJsonlPath);
-        const pid = resolveRow(deps.watcher, id)?.pid ?? null;
-        void watchInputSubmission({
-            pid,
-            sessionId,
-            bytes: result.bytes ?? 0,
-            baselineUserCount,
-            deps: {
-                getPtyStatus: () => deps.watcher.getBySessionId(sessionId)?.status ?? null,
-                getUserEntryCount: () => countUserEntries(postcondJsonlPath),
-                getLastEntryAgeMs: () => {
-                    try {
-                        return Date.now() - statSync(postcondJsonlPath).mtimeMs;
-                    }
-                    catch {
-                        return null;
-                    }
-                },
-                now: () => Date.now(),
-                sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
-                log: deps.logger,
-                windowMs,
-                intervalMs,
-            },
-        }).catch((err) => {
-            deps.logger(`op=input-postcondition-error sessionId=${sessionId.slice(0, 8)} message=${err instanceof Error ? err.message : String(err)}`);
-        });
-        timed(deps.logger, 'POST', `/${id}/input`, 200, Date.now() - start);
-        return c.json({ ok: true, bytes: result.bytes }, 200);
-    });
     // Task 1090 Phase 1 — POST /:sessionId/interrupt writes one raw control byte
     // (ESC or Ctrl-C) to the PTY master via writeInterruptToPty: the soft
     // interrupt, session-preserving, distinct from /stop's SIGTERM recycle. The
@@ -1592,8 +1576,9 @@ export function buildHttpApp(deps) {
             return c.json({ error: 'byte-invalid' }, 400);
         }
         const byte = body.byte;
+        const trigger = typeof body.trigger === 'string' ? body.trigger : 'manual';
         const intId = `${sessionId.slice(0, 8)}-${start}`;
-        deps.logger(`[webchat-interrupt] op=interrupt-requested intId=${intId} sessionId=${sessionId.slice(0, 8)} trigger=manual-spike`);
+        deps.logger(`[webchat-interrupt] op=interrupt-requested intId=${intId} sessionId=${sessionId.slice(0, 8)} trigger=${trigger}`);
         const result = writeInterruptToPty(sessionId, byte, deps.logger);
         if (!result.ok) {
             if (result.error === 'not-found') {
@@ -1608,8 +1593,49 @@ export function buildHttpApp(deps) {
             return c.json({ error: 'pty-write-failed', detail: result.detail }, 500);
         }
         deps.logger(`[webchat-interrupt] op=interrupt-sent intId=${intId} byte=${byte} bytes=${result.bytes}`);
+        // Task 1090 Phase 2 — confirm generation actually stopped, rather than
+        // assuming the byte worked. The fs-watcher row status is `busy` while a turn
+        // streams; poll it until it leaves `busy` (idle/gone) within the bounded
+        // window. This is the gate the webchat send path waits on before delivering
+        // a mid-turn message, so it is awaited (not fire-and-forget).
+        const stopMs = finitePositive(process.env.MAXY_INTERRUPT_STOP_MS, 2500);
+        const sentAt = Date.now();
+        let stopped = false;
+        while (Date.now() - sentAt < stopMs) {
+            const st = deps.watcher.getBySessionId(sessionId)?.status;
+            if (st !== 'busy') {
+                stopped = true;
+                break;
+            }
+            await new Promise((r) => setTimeout(r, 120));
+        }
+        const stoppedMs = stopped ? Date.now() - sentAt : null;
+        if (stopped)
+            deps.logger(`[webchat-interrupt] op=generation-stopped intId=${intId} stoppedMs=${stoppedMs}`);
+        else
+            deps.logger(`[webchat-interrupt] op=interrupt-ineffective intId=${intId} ranMs=${Date.now() - sentAt}`);
+        // Non-awaited post-check (mirrors the /input postcondition watcher): a
+        // delayed liveness probe catches a deferred death the synchronous return
+        // cannot, and the tail reconcile surfaces a mid-tool-call interrupt that
+        // would corrupt a later --resume. Both are no-event standing signals.
+        const surviveMs = finitePositive(process.env.MAXY_INTERRUPT_SURVIVE_MS, 1500);
+        const postPath = jsonlPathForSessionId(deps.spawnCwd, sessionId);
+        void (async () => {
+            await new Promise((r) => setTimeout(r, surviveMs));
+            const liveRow = deps.watcher.getBySessionId(sessionId);
+            const alive = !!liveRow && liveRow.status !== 'gone';
+            deps.logger(`[webchat-interrupt] op=survives-interrupt intId=${intId} alive=${alive}`);
+            if (!alive)
+                deps.logger(`[webchat-interrupt] op=interrupt-killed-session intId=${intId} alive=false`);
+            const dangling = tailHasDanglingToolUse(postPath);
+            deps.logger(`[webchat-interrupt] op=tail-reconcile intId=${intId} danglingToolUse=${dangling}`);
+            if (dangling)
+                deps.logger(`[webchat-interrupt] op=interrupt-dangling-tooluse intId=${intId}`);
+        })().catch((err) => {
+            deps.logger(`[webchat-interrupt] op=postcheck-error intId=${intId} message=${err instanceof Error ? err.message : String(err)}`);
+        });
         timed(deps.logger, 'POST', `/${id}/interrupt`, 200, Date.now() - start);
-        return c.json({ ok: true, intId, byte, bytes: result.bytes }, 200);
+        return c.json({ ok: true, intId, byte, bytes: result.bytes, stopped, stoppedMs }, 200);
     });
     app.get('/:sessionId/log', (c) => {
         const start = Date.now();
@@ -1915,6 +1941,18 @@ export function buildHttpApp(deps) {
             typeof webchatChannelRaw.serverPath === 'string'
             ? webchatChannelRaw
             : undefined;
+        // Optional telegram native-channel attach, the telegram twin of
+        // webchatChannel. The binding field is senderId (not key). All three fields
+        // must be present strings or the attach is skipped. A session is whatsapp
+        // XOR webchat XOR telegram, so at most one channel block below fires.
+        const telegramChannelRaw = body.telegramChannel;
+        const telegramChannel = telegramChannelRaw !== null &&
+            typeof telegramChannelRaw === 'object' &&
+            typeof telegramChannelRaw.senderId === 'string' &&
+            typeof telegramChannelRaw.gatewayUrl === 'string' &&
+            typeof telegramChannelRaw.serverPath === 'string'
+            ? telegramChannelRaw
+            : undefined;
         // Task-962 — recover an already-live but unresponsive webchat session. When
         // set, the already-live branch classifies the child busy vs wedged and
         // respawns ONLY a wedged one (busy → idempotent-busy reply; not-live → a
@@ -2013,12 +2051,11 @@ export function buildHttpApp(deps) {
             }
         }
         // Task 702 — never run two processes on one sessionId. If we already own a
-        // live PTY for this id, the spawn is a no-op (a bridge that lost its
-        // in-memory index after a restart re-asks; the live PTY takes the next
-        // /input). If a reattached survivor scope holds the id (status=detached, a
-        // process this manager cannot own after its own restart and cannot feed
-        // via /input), stop that scope first so the fresh --resume below is the
-        // only process.
+        // live PTY for this id, the spawn is a no-op (a caller that lost its
+        // in-memory state after a restart re-asks; the live PTY takes the next
+        // turn). If a reattached survivor scope holds the id (status=detached, a
+        // process this manager cannot own after its own restart and cannot drive),
+        // stop that scope first so the fresh --resume below is the only process.
         // Task-962 — set on a wedged-child respawn so the spawn-success response
         // below reports the recovery verdict to the gateway.
         let recoverOutcome = null;
@@ -2188,6 +2225,7 @@ export function buildHttpApp(deps) {
         // web), and the two are fanned by one unified channel server below.
         let effectiveWaChannel;
         let effectiveWebchatChannel;
+        let effectiveTelegramChannel;
         if (sessionId) {
             if (waChannel) {
                 effectiveWaChannel = waChannel;
@@ -2211,6 +2249,17 @@ export function buildHttpApp(deps) {
                     deps.logger(`[rc-spawn] op=webchat-channel-rebind sessionId=${sessionId.slice(0, 8)} key=${stored.key} source=store`);
                 }
             }
+            if (telegramChannel) {
+                effectiveTelegramChannel = telegramChannel;
+                deps.telegramChannelStore?.set(sessionId, telegramChannel);
+            }
+            else {
+                const stored = deps.telegramChannelStore?.get(sessionId);
+                if (stored) {
+                    effectiveTelegramChannel = { senderId: stored.senderId, gatewayUrl: stored.gatewayUrl, serverPath: stored.serverPath };
+                    deps.logger(`[rc-spawn] op=telegram-channel-rebind sessionId=${sessionId.slice(0, 8)} senderId=${stored.senderId} source=store`);
+                }
+            }
         }
         // Task 933 — read the persisted sidecar once so the identity gate below can
         // resolve role + name + adminUserId from disk when the caller omitted them
@@ -2237,6 +2286,7 @@ export function buildHttpApp(deps) {
             targetSet = mergeTarget(targetSet, { kind: 'webchat', ...effectiveWebchatChannel });
         let waPath = null;
         let webchatPath = null;
+        let telegramPath = null;
         if (sessionId && isMultiTarget(targetSet)) {
             const unifiedServers = buildChannelMcpServers({ sessionId, targets: targetSet });
             const unifiedPath = channelMcpConfigPath(sessionId, tmpdir());
@@ -2288,6 +2338,29 @@ export function buildHttpApp(deps) {
                     deps.logger(`[rc-spawn] op=webchat-channel-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
                 }
             }
+            // Telegram is a standalone per-kind channel (not in the unified target
+            // set). A session is whatsapp XOR webchat XOR telegram, so the telegram
+            // block fires only when neither wa nor webchat is bound, so exactly one
+            // channel argv block ever runs.
+            if (effectiveTelegramChannel && sessionId && !effectiveWaChannel && !effectiveWebchatChannel) {
+                const telegramServers = buildTelegramChannelMcpServers({
+                    sessionId,
+                    senderId: effectiveTelegramChannel.senderId,
+                    gatewayUrl: effectiveTelegramChannel.gatewayUrl,
+                    serverPath: effectiveTelegramChannel.serverPath,
+                    role: rcRole,
+                });
+                telegramPath = telegramChannelMcpConfigPath(sessionId, tmpdir());
+                try {
+                    writeFileSync(telegramPath, JSON.stringify({ mcpServers: telegramServers }, null, 2), 'utf8');
+                    argv.push(...buildTelegramChannelArgv(telegramPath));
+                    deps.logger(`[rc-spawn] op=telegram-channel senderId=${effectiveTelegramChannel.senderId} gateway=${effectiveTelegramChannel.gatewayUrl} path=${telegramPath}`);
+                }
+                catch (err) {
+                    telegramPath = null;
+                    deps.logger(`[rc-spawn] op=telegram-channel-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
+                }
+            }
         }
         // Task 889 — a webchat-bound admin rc session is the /chat admin surface.
         // Inject the authenticated-identity line (resolved name, or the explicit
@@ -2444,6 +2517,10 @@ export function buildHttpApp(deps) {
         if (sessionId && deps.webchatChannelStore?.get(sessionId) && webchatPath === null) {
             deps.logger(`[rc-spawn] op=webchat-channel-binding-lost sessionId=${sessionId} pid=${pty.pid} reason=resume-without-mcp-config`);
         }
+        // The same post-condition for the telegram binding.
+        if (sessionId && deps.telegramChannelStore?.get(sessionId) && telegramPath === null) {
+            deps.logger(`[rc-spawn] op=telegram-channel-binding-lost sessionId=${sessionId} pid=${pty.pid} reason=resume-without-mcp-config`);
+        }
         // Tracker registration — closes the leak gap the Task 552 path opened.
         // For fresh spawns without a caller-supplied sessionId we register the
         // tracker under the unitToken so the entry has a stable key; the
@@ -2479,7 +2556,7 @@ export function buildHttpApp(deps) {
         // a failed classification sidecar must not tear it down, so it logs and the
         // session keeps running (the pre-fix reader-blind behaviour, no worse).
         const classifyChannel = rcRole !== undefined ? adminChannel : undefined;
-        const classifySenderId = adminSenderId ?? effectiveWaChannel?.senderId ?? effectiveWebchatChannel?.key;
+        const classifySenderId = adminSenderId ?? effectiveWaChannel?.senderId ?? effectiveWebchatChannel?.key ?? effectiveTelegramChannel?.senderId;
         if (sessionId && classifyChannel && classifySenderId) {
             const classifySidecarPath = sidecarPathForSessionId(deps.spawnCwd, sessionId);
             if (!existsSync(classifySidecarPath)) {
@@ -2594,8 +2671,8 @@ export function buildHttpApp(deps) {
         // no literal spaces, so match on the ANSI/space-stripped letter stream.
         // Bounded startup keystroke only — inbound message submission stays a
         // channel event (the whole point of the migration). Armed only when a
-        // native channel (waChannel or webchatChannel, Task 772) is attached,
-        // fired at most once — the prompt text is channel-agnostic.
+        // native channel (waChannel, webchatChannel, or telegramChannel) is
+        // attached, fired at most once. The prompt text is channel-agnostic.
         let devChannelConfirmed = false;
         let devChannelScan = '';
         let resolveStdoutSlug = () => { };
@@ -2604,7 +2681,7 @@ export function buildHttpApp(deps) {
         pty.onData((data) => {
             stdoutBytes += data.length;
             childLog.write(data);
-            if ((effectiveWaChannel || effectiveWebchatChannel) && !devChannelConfirmed) {
+            if ((effectiveWaChannel || effectiveWebchatChannel || effectiveTelegramChannel) && !devChannelConfirmed) {
                 devChannelScan += data;
                 if (devChannelScan.length > 4096)
                     devChannelScan = devChannelScan.slice(devChannelScan.length - 4096);