@selesai/code 0.13.39 → 0.13.40

package/dist/extensions/pi-intercom/broker/broker.ts

@@ -1,9 +1,9 @@
 import net from "net";
-import { chmodSync, mkdirSync, readdirSync, readFileSync, writeFileSync, unlinkSync } from "fs";
+import { chmodSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync, unlinkSync } from "fs";
 import { join } from "path";
-import { createHash, randomUUID } from "crypto";
+import { createHash, randomBytes, randomUUID } from "crypto";
 import { writeMessage, createMessageReader } from "./framing.ts";
-import { isMessage, isMessageReceipt, isSessionId, isSessionRegistration } from "./protocol.ts";
+import { isMessage, isMessageReceipt, isSessionId, isSessionInfo, isSessionRegistration } from "./protocol.ts";
 import {
   ensureIntercomRuntimeDir,
   getBrokerListenTarget,
@@ -28,6 +28,10 @@ const LISTEN_TARGET = getBrokerListenTarget();
 const PID_PATH = join(INTERCOM_DIR, "broker.pid");
 const PORT_PATH = getBrokerPortFilePath(INTERCOM_DIR);
 const PENDING_ASKS_DIR = join(INTERCOM_DIR, "pending-asks");
+const MAILBOX_DIR = join(INTERCOM_DIR, "mailbox");
+const DISCONNECTED_SESSIONS_DIR = join(INTERCOM_DIR, "disconnected-sessions");
+const PERSISTED_RECORD_VERSION = 1;
+const MAX_PERSISTED_ID_FILENAME_CHARS = 100;
 const BROKER_STATE_ID = randomUUID();
 const MAX_SESSIONS = 128;
 const MAX_UNREGISTERED_CONNECTIONS = 32;
@@ -199,12 +203,113 @@ function ensurePendingAskRecordDir(): void {
   }
 }
 
+function sha256Hex(value: string): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+// One file per queued message. The sender key is part of the name because
+// message ids are only unique per sender (delivery records key on both).
+function mailboxFilePath(scopeId: string | undefined, fromKey: string, messageId: string): string {
+  const scopePart = scopeId ? sha256Hex(scopeId).slice(0, 16) : "global";
+  const encodedId = encodeURIComponent(messageId);
+  const idPart = encodedId.length <= MAX_PERSISTED_ID_FILENAME_CHARS ? encodedId : sha256Hex(messageId);
+  return join(MAILBOX_DIR, `${scopePart}-${sha256Hex(fromKey).slice(0, 16)}-${idPart}.json`);
+}
+
+function disconnectedSessionFilePath(sessionKey: string): string {
+  return join(DISCONNECTED_SESSIONS_DIR, `${sha256Hex(sessionKey)}.json`);
+}
+
+function ensureRuntimeDir(dirPath: string): void {
+  mkdirSync(dirPath, { recursive: true, mode: INTERCOM_DIR_MODE });
+  if (process.platform !== "win32") {
+    chmodSync(dirPath, INTERCOM_DIR_MODE);
+  }
+}
+
+// Temp file + rename so a crash mid-write never leaves a half-written record.
+// Temp names end in .tmp (never .json) so loaders ignore and sweep them.
+function writeFileAtomic(filePath: string, content: string): void {
+  const tempPath = `${filePath}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, content, { mode: INTERCOM_RUNTIME_FILE_MODE });
+    restrictIntercomRuntimeFile(tempPath);
+    renameSync(tempPath, filePath);
+  } catch (error) {
+    try {
+      unlinkSync(tempPath);
+    } catch {
+      // The temp file may never have been created.
+    }
+    throw error;
+  }
+}
+
+function isOptionalString(value: unknown): value is string | undefined {
+  return value === undefined || typeof value === "string";
+}
+
+function parseMailboxRecord(value: unknown): MailboxMessage | null {
+  if (!isRecord(value) || value.version !== PERSISTED_RECORD_VERSION) {
+    return null;
+  }
+  if (
+    !isSessionInfo(value.from)
+    || typeof value.fromKey !== "string"
+    || !isOptionalString(value.fromScopeId)
+    || !isSessionInfo(value.target)
+    || typeof value.targetKey !== "string"
+    || !isOptionalString(value.targetScopeId)
+    || !isMessage(value.message)
+    || !Number.isSafeInteger(value.queuedAt)
+  ) {
+    return null;
+  }
+  // Blocking asks are never queued; a record claiming otherwise is not ours.
+  if (value.message.expectsReply) {
+    return null;
+  }
+  return {
+    from: value.from,
+    fromKey: value.fromKey,
+    ...(value.fromScopeId ? { fromScopeId: value.fromScopeId } : {}),
+    target: value.target,
+    targetKey: value.targetKey,
+    ...(value.targetScopeId ? { targetScopeId: value.targetScopeId } : {}),
+    message: value.message,
+    queuedAt: value.queuedAt as number,
+  };
+}
+
+function parseDisconnectedSessionRecord(value: unknown): DisconnectedSession | null {
+  if (!isRecord(value) || value.version !== PERSISTED_RECORD_VERSION) {
+    return null;
+  }
+  if (
+    typeof value.key !== "string"
+    || !isSessionInfo(value.info)
+    || !isOptionalString(value.scopeId)
+    || !Number.isSafeInteger(value.disconnectedAt)
+  ) {
+    return null;
+  }
+  return {
+    info: value.info,
+    key: value.key,
+    ...(value.scopeId ? { scopeId: value.scopeId } : {}),
+    disconnectedAt: value.disconnectedAt as number,
+  };
+}
+
 class IntercomBroker {
   private sessions = new Map<string, ConnectedSession>();
   private askEdges = new Map<string, AskEdge>();
   private messageReceiptRoutes = new Map<string, MessageReceiptRoute>();
   private disconnectedSessions = new Map<string, DisconnectedSession>();
   private mailboxMessages: MailboxMessage[] = [];
+  // Where each queued message is persisted, so removal deletes the exact file
+  // it was loaded from or written to.
+  private mailboxFilePaths = new WeakMap<MailboxMessage, string>();
   private deliveryRecords = new Map<string, DeliveryRecord>();
   private connections = new Set<net.Socket>();
   private unregisteredConnections = new Set<net.Socket>();
@@ -220,6 +325,8 @@ class IntercomBroker {
     assertNoLiveBroker(PID_PATH);
     ensurePendingAskRecordDir();
     this.prunePendingAskRecords();
+    this.loadDisconnectedSessions();
+    this.loadMailboxMessages();
     this.extensionStateManager = new ExtensionStateManager(INTERCOM_DIR);
     if (typeof LISTEN_TARGET === "string" && process.platform !== "win32") {
       try {
@@ -486,7 +593,7 @@ class IntercomBroker {
           extensions,
         };
         this.sessions.set(key, connectedSession);
-        this.disconnectedSessions.delete(key);
+        this.forgetDisconnectedSession(key);
         
         if (this.shutdownTimer) {
           clearTimeout(this.shutdownTimer);
@@ -819,7 +926,8 @@ class IntercomBroker {
         const sender = this.sessions.get(currentKey);
         const queuedIndex = this.mailboxMessages.findIndex(entry => entry.message.id === clientMessage.messageId && entry.fromKey === currentKey);
         if (queuedIndex >= 0 && sender?.socket === socket) {
-          this.mailboxMessages.splice(queuedIndex, 1);
+          const [cancelled] = this.mailboxMessages.splice(queuedIndex, 1);
+          this.removeMailboxFile(cancelled!);
           this.updateDeliveryRecord(currentKey, clientMessage.messageId, "failed", "Sender cancelled the queued delivery", "E_DELIVERY_CANCELLED");
           const edge = this.askEdges.get(clientMessage.messageId);
           if (edge?.from === currentKey) {
@@ -976,23 +1084,156 @@ class IntercomBroker {
   }
 
   private rememberDisconnectedSession(session: ConnectedSession, now = Date.now()): void {
-    this.disconnectedSessions.set(session.key, {
+    const remembered: DisconnectedSession = {
       info: { ...session.info },
       key: session.key,
       ...(session.scopeId ? { scopeId: session.scopeId } : {}),
       disconnectedAt: now,
-    });
+    };
+    this.disconnectedSessions.set(session.key, remembered);
+    this.persistDisconnectedSession(remembered);
     this.pruneDisconnectedSessions(now);
   }
 
+  private forgetDisconnectedSession(sessionKey: string): void {
+    if (this.disconnectedSessions.delete(sessionKey)) {
+      this.removePersistedFile(disconnectedSessionFilePath(sessionKey), "disconnected session");
+    }
+  }
+
   private pruneDisconnectedSessions(now = Date.now()): void {
     for (const [sessionId, session] of this.disconnectedSessions) {
       if (now - session.disconnectedAt > DISCONNECTED_SESSION_RETENTION_MS) {
-        this.disconnectedSessions.delete(sessionId);
+        this.forgetDisconnectedSession(sessionId);
+      }
+    }
+  }
+
+  // Persistence is best effort: a full disk or bad permissions must never break
+  // live delivery, so failures are logged and the broker keeps going in memory.
+  private persistDisconnectedSession(session: DisconnectedSession): void {
+    try {
+      mkdirSync(DISCONNECTED_SESSIONS_DIR, { recursive: true, mode: INTERCOM_DIR_MODE });
+      const record = { version: PERSISTED_RECORD_VERSION, ...session };
+      writeFileAtomic(disconnectedSessionFilePath(session.key), `${JSON.stringify(record, null, 2)}\n`);
+    } catch (error) {
+      console.error("Failed to persist disconnected intercom session:", error);
+    }
+  }
+
+  private persistMailboxMessage(entry: MailboxMessage): void {
+    try {
+      mkdirSync(MAILBOX_DIR, { recursive: true, mode: INTERCOM_DIR_MODE });
+      const filePath = mailboxFilePath(entry.fromScopeId, entry.fromKey, entry.message.id);
+      const record = { version: PERSISTED_RECORD_VERSION, ...entry };
+      writeFileAtomic(filePath, `${JSON.stringify(record, null, 2)}\n`);
+      this.mailboxFilePaths.set(entry, filePath);
+    } catch (error) {
+      console.error("Failed to persist intercom mailbox message:", error);
+    }
+  }
+
+  /** Call at every place an entry leaves `mailboxMessages` (never on shutdown). */
+  private removeMailboxFile(entry: MailboxMessage): void {
+    const filePath = this.mailboxFilePaths.get(entry) ?? mailboxFilePath(entry.fromScopeId, entry.fromKey, entry.message.id);
+    this.mailboxFilePaths.delete(entry);
+    this.removePersistedFile(filePath, "mailbox message");
+  }
+
+  private removePersistedFile(filePath: string, label: string): void {
+    try {
+      unlinkSync(filePath);
+    } catch (error) {
+      if (!isRecord(error) || error.code !== "ENOENT") {
+        console.error(`Failed to remove persisted intercom ${label}:`, error);
       }
     }
   }
 
+  /**
+   * Reads every `*.json` record in `dirPath`, deleting corrupt, invalid and
+   * (via `isExpired`) stale files. Leftover `*.tmp` files from an interrupted
+   * atomic write are swept. Never throws: an unreadable directory just means
+   * nothing is restored.
+   */
+  private loadPersistedRecords<T>(
+    dirPath: string,
+    label: string,
+    parse: (value: unknown) => T | null,
+    isExpired: (record: T) => boolean,
+  ): Array<{ record: T; filePath: string }> {
+    const loaded: Array<{ record: T; filePath: string }> = [];
+    try {
+      ensureRuntimeDir(dirPath);
+      for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+        if (!entry.isFile()) {
+          continue;
+        }
+        const filePath = join(dirPath, entry.name);
+        if (entry.name.endsWith(".tmp")) {
+          this.removePersistedFile(filePath, label);
+          continue;
+        }
+        if (!entry.name.endsWith(".json")) {
+          continue;
+        }
+        let parsed: unknown;
+        try {
+          parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+        } catch {
+          this.removePersistedFile(filePath, label);
+          continue;
+        }
+        const record = parse(parsed);
+        if (!record || isExpired(record)) {
+          this.removePersistedFile(filePath, label);
+          continue;
+        }
+        loaded.push({ record, filePath });
+      }
+    } catch (error) {
+      console.error(`Failed to load persisted intercom ${label}s:`, error);
+    }
+    return loaded;
+  }
+
+  private loadDisconnectedSessions(now = Date.now()): void {
+    const loaded = this.loadPersistedRecords(
+      DISCONNECTED_SESSIONS_DIR,
+      "disconnected session",
+      parseDisconnectedSessionRecord,
+      (session) => now - session.disconnectedAt > DISCONNECTED_SESSION_RETENTION_MS,
+    );
+    for (const { record, filePath } of loaded) {
+      const existing = this.disconnectedSessions.get(record.key);
+      if (existing && existing.disconnectedAt >= record.disconnectedAt) {
+        this.removePersistedFile(filePath, "disconnected session");
+        continue;
+      }
+      this.disconnectedSessions.set(record.key, record);
+    }
+  }
+
+  private loadMailboxMessages(now = Date.now()): void {
+    const loaded = this.loadPersistedRecords(
+      MAILBOX_DIR,
+      "mailbox message",
+      parseMailboxRecord,
+      (entry) => now - entry.queuedAt > MAILBOX_MESSAGE_RETENTION_MS,
+    );
+    // Array.prototype.sort is stable, so equal timestamps keep directory order.
+    loaded.sort((a, b) => a.record.queuedAt - b.record.queuedAt);
+    // Same bound as live queueing: keep the newest, drop the oldest.
+    const overflow = Math.max(0, loaded.length - MAX_MAILBOX_MESSAGES);
+    for (const { filePath } of loaded.slice(0, overflow)) {
+      this.removePersistedFile(filePath, "mailbox message");
+    }
+    for (const { record, filePath } of loaded.slice(overflow)) {
+      this.mailboxFilePaths.set(record, filePath);
+      this.mailboxMessages.push(record);
+    }
+  }
+
   private pruneMailboxMessages(now = Date.now()): void {
     for (let index = this.mailboxMessages.length - 1; index >= 0; index -= 1) {
       const entry = this.mailboxMessages[index]!;
@@ -1004,6 +1245,7 @@ class IntercomBroker {
         this.messageReceiptRoutes.delete(entry.message.id);
         this.updateDeliveryRecord(entry.fromKey, entry.message.id, "failed", "Mailbox delivery expired", "E_DELIVERY_EXPIRED");
         this.mailboxMessages.splice(index, 1);
+        this.removeMailboxFile(entry);
       }
     }
   }
@@ -1013,6 +1255,7 @@ class IntercomBroker {
     while (this.mailboxMessages.length >= MAX_MAILBOX_MESSAGES) {
       const evicted = this.mailboxMessages.shift();
       if (!evicted) break;
+      this.removeMailboxFile(evicted);
       if (evicted.message.expectsReply) {
         this.askEdges.delete(evicted.message.id);
         this.removePendingAskRecord(evicted.message.id, evicted.fromScopeId);
@@ -1020,7 +1263,7 @@ class IntercomBroker {
       this.messageReceiptRoutes.delete(evicted.message.id);
       this.updateDeliveryRecord(evicted.fromKey, evicted.message.id, "failed", "Mailbox capacity evicted the delivery", "E_DELIVERY_EVICTED");
     }
-    this.mailboxMessages.push({
+    const queued: MailboxMessage = {
       from: { ...from.info },
       fromKey: from.key,
       ...(from.scopeId ? { fromScopeId: from.scopeId } : {}),
@@ -1029,7 +1272,9 @@ class IntercomBroker {
       ...(target.scopeId ? { targetScopeId: target.scopeId } : {}),
       message: { ...message, brokerReceivedAt },
       queuedAt: brokerReceivedAt,
-    });
+    };
+    this.mailboxMessages.push(queued);
+    this.persistMailboxMessage(queued);
   }
 
   private writeDeliverySuccess(socket: net.Socket, messageId: string, delivery: "socket_delivered" | "queued"): void {
@@ -1141,6 +1386,9 @@ class IntercomBroker {
       }
 
       this.mailboxMessages.splice(index, 1);
+      // Drop the file before the socket write: a failed write already loses the
+      // in-memory entry, so keeping the file would only risk a duplicate later.
+      this.removeMailboxFile(entry);
       const edge = this.askEdges.get(entry.message.id);
       if (edge?.to === entry.targetKey) {
         edge.to = session.key;
@@ -1173,11 +1421,25 @@ class IntercomBroker {
     }
   }
 
-  private clearAskEdgesForSession(sessionKey: string): void {
+  /**
+   * Intentionally NOT called on disconnect/unregister: edges age out via
+   * `pruneAskEdges`, and a late reply to a disconnected asker is mailboxed on
+   * purpose so a resumed asker (or target) still receives it.
+   * `asker`: drop asks this session was waiting on. `target`: drop asks
+   * addressed to this session.
+   */
+  private clearAskEdgesForSession(sessionKey: string, role: "asker" | "target" | "either"): void {
     for (const [messageId, edge] of this.askEdges) {
-      if (edge.from === sessionKey || edge.to === sessionKey) {
-        this.askEdges.delete(messageId);
+      const matches = (role !== "target" && edge.from === sessionKey) || (role !== "asker" && edge.to === sessionKey);
+      if (!matches) {
+        continue;
+      }
+      this.askEdges.delete(messageId);
+      try {
         this.removePendingAskRecord(messageId, edge.scopeId);
+      } catch (error) {
+        // Disconnect cleanup must not throw out of a socket event handler.
+        console.error("Failed to remove pending ask record:", error);
       }
     }
   }
@@ -1694,6 +1956,8 @@ class IntercomBroker {
     this.sessions.clear();
     this.askEdges.clear();
     this.messageReceiptRoutes.clear();
+    // Only the in-memory copies are cleared. The persisted mailbox and
+    // disconnected-session files are kept on purpose: the next broker reloads them.
     this.disconnectedSessions.clear();
     this.mailboxMessages.length = 0;
     if (typeof LISTEN_TARGET === "string" && process.platform !== "win32") {

package/dist/extensions/pi-intercom/broker/client.ts

@@ -383,7 +383,9 @@ export class IntercomClient extends EventEmitter {
         }
 
         this.pendingSends.delete(messageId);
-        pending.resolve({ id: messageId, delivered: true, delivery: delivery as "socket_delivered" | "queued" | undefined ?? "socket_delivered", retryable: retryable as boolean | undefined ?? false, outcomeKnown: outcomeKnown as boolean | undefined ?? true, ...(typeof brokerMessage.code === "string" ? { code: brokerMessage.code } : {}) });
+        const result: SendResult = { id: messageId, delivered: true, delivery: delivery as "socket_delivered" | "queued" | undefined ?? "socket_delivered", retryable: retryable as boolean | undefined ?? false, outcomeKnown: outcomeKnown as boolean | undefined ?? true, ...(typeof brokerMessage.code === "string" ? { code: brokerMessage.code } : {}) };
+        pending.resolve(result);
+        this.emit("broker_message", { type: "delivered", messageId, delivery: result.delivery, retryable: result.retryable, outcomeKnown: result.outcomeKnown, ...(result.code ? { code: result.code } : {}) });
         break;
       }
 
@@ -400,7 +402,9 @@ export class IntercomClient extends EventEmitter {
         }
 
         this.pendingSends.delete(messageId);
-        pending.resolve({ id: messageId, delivered: false, reason, delivery: delivery as "failed" | "unknown" | undefined ?? "failed", retryable: retryable as boolean | undefined ?? false, outcomeKnown: outcomeKnown as boolean | undefined ?? true, ...(typeof brokerMessage.code === "string" ? { code: brokerMessage.code } : {}) });
+        const result: SendResult = { id: messageId, delivered: false, reason, delivery: delivery as "failed" | "unknown" | undefined ?? "failed", retryable: retryable as boolean | undefined ?? false, outcomeKnown: outcomeKnown as boolean | undefined ?? true, ...(typeof brokerMessage.code === "string" ? { code: brokerMessage.code } : {}) };
+        pending.resolve(result);
+        this.emit("broker_message", { type: "delivery_failed", messageId, reason, delivery: result.delivery, retryable: result.retryable, outcomeKnown: result.outcomeKnown, ...(result.code ? { code: result.code } : {}) });
         break;
       }