@songsid/agend 2.2.0-alpha.5 → 2.2.0-alpha.6

package/dist/web-chat-store.js

@@ -0,0 +1,192 @@
+/**
+ * #1565: the web chat's history on the local disk, so it survives a fleet restart — the latest messages per instance
+ * (the same bounds as in memory: 500 messages, about 1 MB of text), one file per instance:
+ * `<AGEND_HOME>/workspaces/<instance>/web-chat.json`, mode 0600, next to the instance's other files.
+ *
+ * Writes never block the fleet loop: they are debounced per instance, one in flight at a time, and go through
+ * fs.promises — a temporary file, fsync, then rename, so a crash leaves either the old file or the new one, never half
+ * of one. Reading happens once, at fleet start, for the instances that are configured; a file that is too large, not
+ * JSON, or not ours in shape is skipped with one log line and never stops the fleet.
+ */
+import { closeSync, existsSync, openSync, readFileSync, fstatSync } from "node:fs";
+import { mkdir, open, rename, unlink } from "node:fs/promises";
+import { join } from "node:path";
+import { constants } from "node:fs";
+export const WEB_CHAT_FILE = "web-chat.json";
+/** A file larger than this is not read (the bounds keep a real one far smaller). */
+export const WEB_CHAT_FILE_MAX_BYTES = 8 * 1024 * 1024;
+const FORMAT = 1;
+/** The rule instance paths are held to: no separator, no control character, no traversal. */
+export function isSafeInstanceDirName(name) {
+    return typeof name === "string" && name.length > 0 && name.length <= 128 && !/[/\\\u0000-\u001f\u007f]/.test(name) && name !== "." && !name.includes("..");
+}
+export class WebChatDiskStore {
+    home;
+    logger;
+    debounceMs;
+    /**
+     * Who the instance is now: a fleet agent's working directory, a ClassicBot room's channel. Written with the file
+     * and required to match when it is read, so a later instance that only shares the name (deleted while the fleet was
+     * down, then created again elsewhere) never gets another one's history. Null: not configured — not written.
+     */
+    ownerOf;
+    /** instance → its pending write (a timer) and whether one is in flight. */
+    pending = new Map();
+    /** Instances forgotten: a write already under way must not bring the file back. */
+    gone = new Set();
+    constructor(opts) {
+        this.home = opts.home;
+        this.ownerOf = opts.ownerOf;
+        this.logger = opts.logger;
+        this.debounceMs = opts.debounceMs ?? 300;
+    }
+    pathOf(instance) {
+        return isSafeInstanceDirName(instance) ? join(this.home, "workspaces", instance, WEB_CHAT_FILE) : null;
+    }
+    /**
+     * The stored messages of one instance, as written (validated later by the history), or null: no file, or one that
+     * is skipped (too large, unreadable, not JSON, not ours, another instance's) — said once in the log.
+     */
+    load(instance) {
+        const path = this.pathOf(instance);
+        if (!path || !existsSync(path))
+            return null;
+        let text;
+        try {
+            const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            try {
+                const st = fstatSync(fd);
+                if (!st.isFile() || st.size > WEB_CHAT_FILE_MAX_BYTES) {
+                    this.logger.warn({ instance, path, size: st.size }, "web chat history: file skipped (not a file, or too large)");
+                    return null;
+                }
+                text = readFileSync(fd, "utf-8");
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch (err) {
+            this.logger.warn({ instance, path, err: err.message }, "web chat history: file skipped (unreadable)");
+            return null;
+        }
+        let data;
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            this.logger.warn({ instance, path }, "web chat history: file skipped (not JSON)");
+            return null;
+        }
+        const d = data;
+        if (!d || typeof d !== "object" || d.format !== FORMAT || d.instance !== instance || !Array.isArray(d.messages)) {
+            this.logger.warn({ instance, path }, "web chat history: file skipped (not this instance's web chat history)");
+            return null;
+        }
+        const owner = this.ownerOf(instance);
+        if (owner === null || d.owner !== owner) {
+            this.logger.warn({ instance, path }, "web chat history: file skipped (written for another instance of this name)");
+            return null;
+        }
+        return d.messages;
+    }
+    /** The instance's history changed: write it soon (debounced; one write in flight; the latest snapshot wins). */
+    schedule(instance, snapshot) {
+        if (!this.pathOf(instance))
+            return;
+        this.gone.delete(instance);
+        let p = this.pending.get(instance);
+        if (!p) {
+            p = { timer: null, writing: null, again: false, snapshot };
+            this.pending.set(instance, p);
+        }
+        p.snapshot = snapshot;
+        if (p.writing) {
+            p.again = true;
+            return;
+        }
+        if (p.timer)
+            return;
+        p.timer = setTimeout(() => { p.timer = null; this.write(instance); }, this.debounceMs);
+        p.timer.unref?.();
+    }
+    write(instance) {
+        const p = this.pending.get(instance);
+        if (!p || this.gone.has(instance))
+            return;
+        const messages = p.snapshot();
+        p.writing = this.writeFile(instance, messages).catch((err) => {
+            this.logger.warn({ instance, err: err.message }, "web chat history: could not be written");
+        }).finally(() => {
+            p.writing = null;
+            if (p.again && !this.gone.has(instance)) {
+                p.again = false;
+                this.write(instance);
+            }
+            else if (!p.timer)
+                this.pending.delete(instance);
+        });
+    }
+    async writeFile(instance, messages) {
+        const path = this.pathOf(instance);
+        const owner = this.ownerOf(instance);
+        if (owner === null)
+            return; // not a configured instance: nothing to keep it for
+        const dir = join(this.home, "workspaces", instance);
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        const tmp = `${path}.tmp-${process.pid}`;
+        const body = JSON.stringify({ format: FORMAT, instance, owner, messages });
+        const fh = await open(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | (constants.O_NOFOLLOW ?? 0), 0o600);
+        try {
+            await fh.writeFile(body, "utf-8");
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+        if (this.gone.has(instance)) {
+            await unlink(tmp).catch(() => { });
+            return;
+        }
+        await rename(tmp, path);
+    }
+    /** Every pending write done (tests; a clean shutdown). */
+    async flush() {
+        for (;;) {
+            const busy = [...this.pending.entries()];
+            if (!busy.length)
+                return;
+            for (const [instance, p] of busy) {
+                if (p.timer) {
+                    clearTimeout(p.timer);
+                    p.timer = null;
+                    this.write(instance);
+                }
+            }
+            await Promise.all([...this.pending.values()].map((p) => p.writing ?? Promise.resolve()));
+            if ([...this.pending.values()].every((p) => !p.writing && !p.timer && !p.again)) {
+                this.pending.clear();
+                return;
+            }
+        }
+    }
+    /** The instance is gone: no further write, and the file (and any temporary one of ours) is deleted. */
+    async remove(instance) {
+        const path = this.pathOf(instance);
+        if (!path)
+            return;
+        this.gone.add(instance);
+        const p = this.pending.get(instance);
+        if (p?.timer) {
+            clearTimeout(p.timer);
+            p.timer = null;
+        }
+        if (p?.writing)
+            await p.writing;
+        this.pending.delete(instance);
+        await unlink(path).catch((err) => { if (err.code !== "ENOENT")
+            this.logger.warn({ instance, err: err.message }, "web chat history: could not be deleted"); });
+        await unlink(`${path}.tmp-${process.pid}`).catch(() => { });
+    }
+}
+//# sourceMappingURL=web-chat-store.js.map

package/dist/web-chat-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-chat-store.js","sourceRoot":"","sources":["../src/web-chat-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAC7C,oFAAoF;AACpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACvD,MAAM,MAAM,GAAG,CAAC,CAAC;AAIjB,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7J,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAS;IACb,MAAM,CAAqB;IAC3B,UAAU,CAAS;IACpC;;;;OAIG;IACc,OAAO,CAAsC;IAC9D,2EAA2E;IAC1D,OAAO,GAAG,IAAI,GAAG,EAAkJ,CAAC;IACrL,mFAAmF;IAClE,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,YAAY,IAAqH;QAC/H,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,QAAgB;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;gBACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;oBACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,2DAA2D,CAAC,CAAC;oBACjH,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACnC,CAAC;oBAAS,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,6CAA6C,CAAC,CAAC;YACjH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAG,IAAqF,CAAC;QAChG,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,uEAAuE,CAAC,CAAC;YAC9G,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,4EAA4E,CAAC,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IAED,gHAAgH;IAChH,QAAQ,CAAC,QAAgB,EAAE,QAAsC;QAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QACtG,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACtB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK;YAAE,OAAO;QACpB,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAE,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACxF,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAgB;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wCAAwC,CAAC,CAAC;QACxG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;iBAC9E,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,QAAgC;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAuB,oDAAoD;QACtG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5H,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,KAAK;QACT,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACzB,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;oBAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAAC,CAAC;YAC/E,CAAC;YACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;QACpH,CAAC;IACH,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;YAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;QAAC,CAAC;QACxD,IAAI,CAAC,EAAE,OAAO;YAAE,MAAM,CAAC,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAA0B,EAAE,EAAE,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,wCAAwC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrL,MAAM,MAAM,CAAC,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/web-login.d.ts

@@ -59,6 +59,8 @@ export declare class WebLoginCodes {
         audience?: string;
         owner?: LoginCodeOwner;
     }): IssuedLoginCode;
+    /** #1570: how long redemption stays paused by the breaker (0 when it is closed). A code request is refused meanwhile. */
+    pausedForMs(): number;
     /** Whether a redemption right now would be compared against anything. */
     get hasOutstandingCode(): boolean;
     /** Withdraw the outstanding code without spending it (`/dashboard revoke`). */

package/dist/web-login.js

@@ -61,6 +61,10 @@ export class WebLoginCodes {
         this.onEvent("issued");
         return { display: formatOneTimeCode(code), expiresAt, tier, issuanceId };
     }
+    /** #1570: how long redemption stays paused by the breaker (0 when it is closed). A code request is refused meanwhile. */
+    pausedForMs() {
+        return Math.max(0, this.pausedUntil - this.now());
+    }
     /** Whether a redemption right now would be compared against anything. */
     get hasOutstandingCode() {
         return this.activeCode() !== null;

package/dist/web-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-login.js","sourceRoot":"","sources":["../src/web-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,gGAAgG;AAChG,MAAM,mBAAmB,GAAG,UAAU,CAAC;AA4CvC,MAAM,OAAO,aAAa;IAChB,WAAW,GAAuB,IAAI,CAAC;IACvC,QAAQ,GAAa,EAAE,CAAC;IACxB,WAAW,GAAG,CAAC,CAAC;IACP,GAAG,CAAe;IAClB,QAAQ,CAAe;IACvB,OAAO,CAAkE;IAE1F,YAAY,OAA6B,EAAE;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAsF;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;QACjD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAChJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC3E,CAAC;IAED,yEAAyE;IACzE,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,+EAA+E;IAC/E,MAAM;QACJ,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,8FAA8F;IAC9F,eAAe,CAAC,UAAkB;QAChC,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,KAAK,UAAU;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC3E,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,YAAoB,EAAE,QAAQ,GAAG,OAAO;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;QAE5F,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAE1C,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5C,8EAA8E;YAC9E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7F,CAAC;QAED,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACvF,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,GAAG,uBAAuB,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,sBAAsB,CAAC;YAChD,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"web-login.js","sourceRoot":"","sources":["../src/web-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,gGAAgG;AAChG,MAAM,mBAAmB,GAAG,UAAU,CAAC;AA4CvC,MAAM,OAAO,aAAa;IAChB,WAAW,GAAuB,IAAI,CAAC;IACvC,QAAQ,GAAa,EAAE,CAAC;IACxB,WAAW,GAAG,CAAC,CAAC;IACP,GAAG,CAAe;IAClB,QAAQ,CAAe;IACvB,OAAO,CAAkE;IAE1F,YAAY,OAA6B,EAAE;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAsF;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;QACjD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAChJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC3E,CAAC;IAED,yHAAyH;IACzH,WAAW;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,+EAA+E;IAC/E,MAAM;QACJ,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,8FAA8F;IAC9F,eAAe,CAAC,UAAkB;QAChC,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,KAAK,UAAU;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC3E,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,YAAoB,EAAE,QAAQ,GAAG,OAAO;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;QAE5F,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAE1C,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5C,8EAA8E;YAC9E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7F,CAAC;QAED,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACvF,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,GAAG,uBAAuB,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,sBAAsB,CAAC;YAChD,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}

package/dist/web-returning-device.d.ts

@@ -0,0 +1,84 @@
+import type { LoginCodeOwner } from "./web-login.js";
+import type { SessionSurface } from "./web-session.js";
+export declare const DEVICE_COOKIE = "agend_device";
+/** On https (and always on the public link): a `__Host-` cookie cannot be planted by a sibling site. */
+export declare const DEVICE_COOKIE_SECURE = "__Host-agend_device";
+export declare const DEVICE_MAX_AGE_MS: number;
+export declare const MAX_RETURNING_DEVICES = 16;
+/** What the registry knows about one returning device. No cookie value; the owner minus the live binding. */
+export interface ReturningDevice {
+    readonly idHash: string;
+    readonly owner: {
+        readonly adapterId: string;
+        readonly userId: string;
+        readonly chatId: string;
+        readonly threadId?: string;
+    };
+    readonly surface: SessionSurface;
+    readonly label: string;
+    readonly tokenEpoch: string;
+    readonly created: number;
+    readonly expires: number;
+}
+export declare class ReturningDevices {
+    private readonly byHash;
+    private readonly path;
+    private readonly now;
+    private readonly warn;
+    constructor(opts?: {
+        dataDir?: string;
+        now?: () => number;
+        onWarn?: (message: string) => void;
+    });
+    get size(): number;
+    /** Record this browser as a returning device of `owner`; the returned value is the cookie, given out once. */
+    remember(owner: LoginCodeOwner, input: {
+        surface: SessionSurface;
+        label: string;
+        tokenEpoch: string;
+        webToken: string;
+    }): string;
+    /** The device a cookie value proves, or null: bad shape, bad signature (another token), unknown, expired, old epoch. */
+    verify(value: string | undefined, webToken: string, tokenEpoch: string): ReturningDevice | null;
+    /** `/dashboard revoke`: no browser may ask for a code any more. Whether that holds after a restart. */
+    revokeAll(): {
+        count: number;
+        durable: boolean;
+    };
+    private load;
+    /**
+     * Write the registry; whether a restart now sees what memory sees. A failed write after a revoke must not leave the
+     * old file to bring revoked devices back: then the file is removed (every browser loses its button — the safe side).
+     */
+    private persist;
+}
+/** The device cookie a request presents: the `__Host-` one first; the plain one only off the public link. */
+export declare function readDeviceCookie(cookieHeader: string | undefined, publicLink: boolean): string | undefined;
+export declare function buildDeviceCookie(value: string, secure: boolean): string;
+/** Per device: one request a minute and five an hour. For the whole fleet: one every 20 s and twenty an hour. */
+export declare const CODE_REQUEST_LIMITS: {
+    readonly deviceGapMs: 60000;
+    readonly devicePerHour: 5;
+    readonly globalGapMs: 20000;
+    readonly globalPerHour: 20;
+};
+/** Rate limits for code requests, on a monotonic clock (a wall-clock jump neither opens nor closes them). */
+export declare class CodeRequestLimiter {
+    private readonly now;
+    private readonly limits;
+    private readonly byDevice;
+    private global;
+    constructor(now?: () => number, limits?: {
+        readonly deviceGapMs: 60000;
+        readonly devicePerHour: 5;
+        readonly globalGapMs: 20000;
+        readonly globalPerHour: 20;
+    });
+    /** Admit one request for `deviceKey` now, or say how long until one would be admitted. */
+    admit(deviceKey: string): {
+        ok: true;
+    } | {
+        ok: false;
+        retryAfterMs: number;
+    };
+}

package/dist/web-returning-device.js

@@ -0,0 +1,204 @@
+/**
+ * #1570: a browser that signed in before may ask the sign-in page for a fresh code, which goes privately to the person
+ * whose `/dashboard` code it last redeemed. This deliberately bends `web-login.ts`'s "no outstanding code, nothing to
+ * guess" rule, so the door is narrow (design baseline: #1570 issuecomment-6098782305):
+ *
+ * - **Only a returning device.** The cookie is set only after a sign-in whose code carried a `LoginCodeOwner` (a code
+ *   `/dashboard` delivered privately). It is `<deviceId>.<HMAC>`: a 128-bit random id and a signature keyed from
+ *   `web.token`. It names no chat or user; the owner lives in this registry, which keeps `sha256(deviceId)` only, so the
+ *   file on disk cannot be replayed as a cookie.
+ * - **Rotation and revoke.** The HMAC key and the recorded token epoch both come from `web.token`, so `agend web-token
+ *   rotate` (from any process) makes every device cookie stop verifying. `/dashboard revoke` empties the registry.
+ * - **Rate limits** live here too (`CodeRequestLimiter`), on a monotonic clock.
+ *
+ * Who receives the code, and whether they still may, is decided by the fleet (FleetManager.requestReturningCode).
+ * Deliberately has no idea what an HTTP request is, beyond reading and building the cookie.
+ */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { performance } from "node:perf_hooks";
+export const DEVICE_COOKIE = "agend_device";
+/** On https (and always on the public link): a `__Host-` cookie cannot be planted by a sibling site. */
+export const DEVICE_COOKIE_SECURE = "__Host-agend_device";
+export const DEVICE_MAX_AGE_MS = 90 * 24 * 60 * 60 * 1000;
+export const MAX_RETURNING_DEVICES = 16;
+const ID_PATTERN = /^[0-9a-f]{32}$/;
+const SIG_PATTERN = /^[0-9a-f]{64}$/;
+const HASH_PATTERN = /^[0-9a-f]{64}$/;
+function signingKey(webToken) {
+    return createHmac("sha256", webToken).update("agend returning device v1").digest();
+}
+function sign(deviceId, webToken) {
+    return createHmac("sha256", signingKey(webToken)).update(deviceId).digest("hex");
+}
+const sha256 = (s) => createHash("sha256").update(s).digest("hex");
+function isDevice(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const d = v, o = d.owner;
+    return typeof d.idHash === "string" && HASH_PATTERN.test(d.idHash)
+        && !!o && typeof o.adapterId === "string" && typeof o.userId === "string" && typeof o.chatId === "string"
+        && (o.threadId === undefined || typeof o.threadId === "string")
+        && (d.surface === "local" || d.surface === "gateway")
+        && typeof d.label === "string" && d.label.length <= 80
+        && typeof d.tokenEpoch === "string" && HASH_PATTERN.test(d.tokenEpoch)
+        && typeof d.created === "number" && Number.isFinite(d.created) && typeof d.expires === "number" && Number.isFinite(d.expires);
+}
+export class ReturningDevices {
+    byHash = new Map();
+    path;
+    now;
+    warn;
+    constructor(opts = {}) {
+        this.path = opts.dataDir ? join(opts.dataDir, "web-devices.json") : null;
+        this.now = opts.now ?? Date.now;
+        this.warn = opts.onWarn ?? (() => { });
+        this.load();
+    }
+    get size() { return this.byHash.size; }
+    /** Record this browser as a returning device of `owner`; the returned value is the cookie, given out once. */
+    remember(owner, input) {
+        const deviceId = randomBytes(16).toString("hex");
+        const now = this.now();
+        const device = {
+            idHash: sha256(deviceId),
+            owner: { adapterId: owner.adapterId, userId: owner.userId, chatId: owner.chatId, ...(owner.threadId !== undefined ? { threadId: owner.threadId } : {}) },
+            surface: input.surface, label: input.label.slice(0, 80), tokenEpoch: input.tokenEpoch, created: now, expires: now + DEVICE_MAX_AGE_MS,
+        };
+        this.byHash.set(device.idHash, device);
+        while (this.byHash.size > MAX_RETURNING_DEVICES) {
+            const oldest = [...this.byHash.values()].reduce((a, b) => (a.created <= b.created ? a : b));
+            this.byHash.delete(oldest.idHash);
+        }
+        this.persist();
+        return `${deviceId}.${sign(deviceId, input.webToken)}`;
+    }
+    /** The device a cookie value proves, or null: bad shape, bad signature (another token), unknown, expired, old epoch. */
+    verify(value, webToken, tokenEpoch) {
+        if (!value)
+            return null;
+        const dot = value.indexOf(".");
+        const id = value.slice(0, dot), sig = value.slice(dot + 1);
+        if (dot < 0 || !ID_PATTERN.test(id) || !SIG_PATTERN.test(sig))
+            return null;
+        const expected = Buffer.from(sign(id, webToken), "hex");
+        if (!timingSafeEqual(expected, Buffer.from(sig, "hex")))
+            return null;
+        const device = this.byHash.get(sha256(id));
+        if (!device || device.tokenEpoch !== tokenEpoch || this.now() >= device.expires)
+            return null;
+        return device;
+    }
+    /** `/dashboard revoke`: no browser may ask for a code any more. Whether that holds after a restart. */
+    revokeAll() {
+        const count = this.byHash.size;
+        this.byHash.clear();
+        return { count, durable: this.persist() };
+    }
+    load() {
+        if (!this.path)
+            return;
+        let raw;
+        try {
+            raw = JSON.parse(readFileSync(this.path, "utf8"));
+        }
+        catch {
+            return;
+        }
+        const devices = raw && typeof raw === "object" && Array.isArray(raw.devices) ? raw.devices : [];
+        const now = this.now();
+        for (const d of devices)
+            if (isDevice(d) && d.expires > now)
+                this.byHash.set(d.idHash, d);
+    }
+    /**
+     * Write the registry; whether a restart now sees what memory sees. A failed write after a revoke must not leave the
+     * old file to bring revoked devices back: then the file is removed (every browser loses its button — the safe side).
+     */
+    persist() {
+        if (!this.path)
+            return true;
+        const temp = `${this.path}.tmp-${process.pid}-${randomBytes(6).toString("hex")}`;
+        try {
+            mkdirSync(join(this.path, ".."), { recursive: true });
+            writeFileSync(temp, JSON.stringify({ version: 1, devices: [...this.byHash.values()] }), { encoding: "utf8", mode: 0o600, flag: "wx" });
+            renameSync(temp, this.path);
+            try {
+                chmodSync(this.path, 0o600);
+            }
+            catch { /* best effort */ }
+            return true;
+        }
+        catch (err) {
+            try {
+                unlinkSync(temp);
+            }
+            catch { /* never created */ }
+            try {
+                unlinkSync(this.path);
+                return true;
+            }
+            catch (e) {
+                if (e.code === "ENOENT")
+                    return true;
+                this.warn(`Returning-device registry could not be saved or removed (${err.message}); a restart may bring revoked devices back until the web token is rotated`);
+                return false;
+            }
+        }
+    }
+}
+/** The device cookie a request presents: the `__Host-` one first; the plain one only off the public link. */
+export function readDeviceCookie(cookieHeader, publicLink) {
+    const jar = new Map();
+    for (const part of (cookieHeader ?? "").split(";")) {
+        const eq = part.indexOf("=");
+        if (eq < 1)
+            continue;
+        jar.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+    }
+    return jar.get(DEVICE_COOKIE_SECURE) ?? (publicLink ? undefined : jar.get(DEVICE_COOKIE));
+}
+export function buildDeviceCookie(value, secure) {
+    return [`${secure ? DEVICE_COOKIE_SECURE : DEVICE_COOKIE}=${value}`, "Path=/", "HttpOnly", "SameSite=Strict",
+        `Max-Age=${Math.floor(DEVICE_MAX_AGE_MS / 1000)}`, ...(secure ? ["Secure"] : [])].join("; ");
+}
+/** Per device: one request a minute and five an hour. For the whole fleet: one every 20 s and twenty an hour. */
+export const CODE_REQUEST_LIMITS = { deviceGapMs: 60_000, devicePerHour: 5, globalGapMs: 20_000, globalPerHour: 20 };
+const HOUR_MS = 60 * 60 * 1000;
+/** Rate limits for code requests, on a monotonic clock (a wall-clock jump neither opens nor closes them). */
+export class CodeRequestLimiter {
+    now;
+    limits;
+    byDevice = new Map();
+    global = [];
+    constructor(now = () => performance.now(), limits = CODE_REQUEST_LIMITS) {
+        this.now = now;
+        this.limits = limits;
+    }
+    /** Admit one request for `deviceKey` now, or say how long until one would be admitted. */
+    admit(deviceKey) {
+        const now = this.now();
+        const recent = (this.byDevice.get(deviceKey) ?? []).filter(t => now - t < HOUR_MS);
+        this.global = this.global.filter(t => now - t < HOUR_MS);
+        const waits = [];
+        const last = recent.at(-1), lastGlobal = this.global.at(-1);
+        if (last !== undefined && now - last < this.limits.deviceGapMs)
+            waits.push(this.limits.deviceGapMs - (now - last));
+        if (recent.length >= this.limits.devicePerHour)
+            waits.push(HOUR_MS - (now - recent[0]));
+        if (lastGlobal !== undefined && now - lastGlobal < this.limits.globalGapMs)
+            waits.push(this.limits.globalGapMs - (now - lastGlobal));
+        if (this.global.length >= this.limits.globalPerHour)
+            waits.push(HOUR_MS - (now - this.global[0]));
+        if (waits.length) {
+            this.byDevice.set(deviceKey, recent);
+            return { ok: false, retryAfterMs: Math.max(...waits) };
+        }
+        recent.push(now);
+        this.global.push(now);
+        this.byDevice.set(deviceKey, recent);
+        return { ok: true };
+    }
+}
+//# sourceMappingURL=web-returning-device.js.map

package/dist/web-returning-device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-returning-device.js","sourceRoot":"","sources":["../src/web-returning-device.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9C,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAC5C,wGAAwG;AACxG,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAatC,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AACD,SAAS,IAAI,CAAC,QAAgB,EAAE,QAAgB;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnF,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,EAAE,CAAC,GAAG,CAAC,CAAC,KAA4C,CAAC;IAC3F,OAAO,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;WAC7D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;WACtG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;WAC5D,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;WAClD,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE;WACnD,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;WACnE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAClI,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5C,IAAI,CAAgB;IACpB,GAAG,CAAe;IAClB,IAAI,CAA4B;IAEjD,YAAY,OAAqF,EAAE;QACjG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/C,8GAA8G;IAC9G,QAAQ,CAAC,KAAqB,EAAE,KAAuF;QACrH,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAoB;YAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC;YACxB,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACxJ,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,iBAAiB;SACtI,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,wHAAwH;IACxH,MAAM,CAAC,KAAyB,EAAE,QAAgB,EAAE,UAAkB;QACpE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC7F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uGAAuG;IACvG,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5C,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAE,GAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,GAA8B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED;;;OAGG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACvD,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACrD,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAChE,IAAI,CAAC,IAAI,CAAC,4DAA6D,GAAa,CAAC,OAAO,4EAA4E,CAAC,CAAC;gBAC1K,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,6GAA6G;AAC7G,MAAM,UAAU,gBAAgB,CAAC,YAAgC,EAAE,UAAmB;IACpF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAe;IAC9D,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,IAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB;QAC1G,WAAW,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAW,CAAC;AAC9H,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,6GAA6G;AAC7G,MAAM,OAAO,kBAAkB;IAGA;IAA8D;IAF1E,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,MAAM,GAAa,EAAE,CAAC;IAC9B,YAA6B,MAAoB,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAmB,SAAS,mBAAmB;QAA1F,QAAG,GAAH,GAAG,CAAwC;QAAmB,WAAM,GAAN,MAAM,CAAsB;IAAG,CAAC;IAE3H,0FAA0F;IAC1F,KAAK,CAAC,SAAiB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QACnH,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACzF,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC;QACrI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACnG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QAAC,CAAC;QACnH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/web-upload.d.ts

@@ -133,6 +133,27 @@ export declare class WebFileLedger {
         file: ServedFile;
         bytes: Buffer;
     } | null;
+    /**
+     * #1565: the path to keep with a message's file id, so the file can be served again after a restart — null when
+     * nothing is served under the id, or it is an upload no message has taken (web-pending-…): that is never kept.
+     */
+    storablePath(id: string): string | null;
+    /** #1565: these ids are no longer shown (their message left the history's window): nothing is served under them. */
+    dropServed(ids: Iterable<string>): void;
+    /**
+     * #1565: serve again, under the id it had, a file a message showed before the fleet restarted — only if it still
+     * passes every check: an id of ours in shape; never an upload no message took (web-pending-…); the path itself not a
+     * symlink, and a regular file within MAX_SERVED_BYTES; its real path inside this instance's inbox
+     * (`workspaces/<instance>/inbox`, itself not a link elsewhere). Null when any check fails (the message then shows the
+     * name as unavailable). Fetched by id only, as ever: the stored path is the fleet's own file, never a request's.
+     */
+    restoreServed(entry: {
+        id: unknown;
+        path: unknown;
+        name?: unknown;
+        mime?: unknown;
+        kind?: unknown;
+    }, instance: string, inboxDir: string): ServedFile | null;
     /** Forget an instance's files (it was deleted). The files themselves are its workspace's to remove. */
     forget(instance: string): void;
     /**

package/dist/web-upload.js

@@ -13,7 +13,7 @@
  */
 import { randomBytes } from "node:crypto";
 import { constants as fsConstants, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { basename, dirname, extname, join } from "node:path";
+import { basename, dirname, extname, join, sep } from "node:path";
 export const UPLOAD_LIMITS = {
     /** One file. */
     maxFileBytes: 10 * 1024 * 1024,
@@ -311,6 +311,55 @@ export class WebFileLedger {
                 closeSync(fd);
         }
     }
+    /**
+     * #1565: the path to keep with a message's file id, so the file can be served again after a restart — null when
+     * nothing is served under the id, or it is an upload no message has taken (web-pending-…): that is never kept.
+     */
+    storablePath(id) {
+        const file = isFileId(id) ? this.served.get(id) : undefined;
+        return file && !basename(file.realPath).startsWith(PENDING_PREFIX) ? file.realPath : null;
+    }
+    /** #1565: these ids are no longer shown (their message left the history's window): nothing is served under them. */
+    dropServed(ids) { for (const id of ids)
+        this.served.delete(id); }
+    /**
+     * #1565: serve again, under the id it had, a file a message showed before the fleet restarted — only if it still
+     * passes every check: an id of ours in shape; never an upload no message took (web-pending-…); the path itself not a
+     * symlink, and a regular file within MAX_SERVED_BYTES; its real path inside this instance's inbox
+     * (`workspaces/<instance>/inbox`, itself not a link elsewhere). Null when any check fails (the message then shows the
+     * name as unavailable). Fetched by id only, as ever: the stored path is the fleet's own file, never a request's.
+     */
+    restoreServed(entry, instance, inboxDir) {
+        if (typeof entry.id !== "string" || !isFileId(entry.id) || typeof entry.path !== "string" || !entry.path)
+            return null;
+        if (basename(entry.path).startsWith(PENDING_PREFIX))
+            return null;
+        let real;
+        let own;
+        try {
+            own = lstatSync(entry.path);
+            if (own.isSymbolicLink() || !own.isFile() || own.size > MAX_SERVED_BYTES)
+                return null;
+            const inbox = realpathSync(inboxDir);
+            if (inbox !== join(realpathSync(dirname(inboxDir)), basename(inboxDir)))
+                return null;
+            real = realpathSync(entry.path);
+            if (!real.startsWith(inbox + sep))
+                return null;
+        }
+        catch {
+            return null;
+        }
+        const kind = entry.kind === "photo" || entry.kind === "document" ? entry.kind : undefined;
+        const file = this.registerServed({ id: entry.id, path: real, instance,
+            ...(typeof entry.name === "string" ? { name: entry.name } : {}), ...(typeof entry.mime === "string" ? { mime: entry.mime } : {}), ...(kind ? { kind } : {}) });
+        // The file checked is the file registered (nothing swapped in between).
+        if (file && (file.realPath !== real || file.dev !== own.dev || file.ino !== own.ino)) {
+            this.served.delete(file.id);
+            return null;
+        }
+        return file;
+    }
     /** Forget an instance's files (it was deleted). The files themselves are its workspace's to remove. */
     forget(instance) {
         for (const [id, e] of this.uploads)