@songsid/agend 2.3.0-beta.25 → 2.3.0-beta.27

package/dist/web-api.js

@@ -53,6 +53,7 @@ import { resolveTz } from "./tz-utils.js";
 import { filesPlayInChat } from "./web-effect.js";
 import { QUERY_MAX_CHARS, RESULT_MAX, SEARCH_SOURCES } from "./search/search-store.js";
 import { xmsgShown } from "./search/search-docs.js";
+import { WebSendDedupe } from "./web-send-dedupe.js";
 // ── Strict public-facing schemas ────────────────────────────────────────────
 // web-api endpoints must reject unknown fields so the dashboard cannot inject
 // internal-only flags that would reach handleCreate/scheduler/config writers.
@@ -169,6 +170,9 @@ const SendMessageSchema = z.object({
     attachments: z.array(z.string().regex(/^[0-9a-f]{32}$/)).max(UPLOAD_LIMITS.maxFiles).optional(),
     /** #2272: the message of this chat this one replies to — its row only; the server reads what it quotes. */
     replyTo: z.object({ boot: z.string().regex(/^[0-9a-f]{1,32}$/), id: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER) }).strict().optional(),
+    /** The sending page's own id for its pending bubble: echoed on the live event only (never recorded), so that page
+     *  swaps its "sending" bubble for the real one even when the stream beats this answer. */
+    clientId: z.string().regex(/^[A-Za-z0-9_-]{8,64}$/).optional(),
 }).strict().refine(v => v.message.trim().length > 0 || (v.attachments?.length ?? 0) > 0, { message: "a message or at least one file", path: ["message"] });
 /** An instance name that is safe as one path segment (no separator, no NUL, not a dot name). */
 const safeInstanceSegment = (name) => /^[^\\/\x00]+$/.test(name) && name !== "." && name !== "..";
@@ -1304,7 +1308,14 @@ function webAuthorityOf(req, url, ctx, instance) {
         return { authority: noAuthority(0), refusal: "not_session" };
     const v = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
     return ctx.webAuthority({ session: v.kind === "allow" && v.via === "session" ? v.session : null, gateway: !!gatewayRequestContext(req),
-        peer: classifyWebPeer(req), ...(instance !== undefined ? { instance } : {}) });
+        peer: webPeerOf(req), ...(instance !== undefined ? { instance } : {}) });
+}
+/**
+ * #1939 §3.4 / #2453 §0.2: where this request came from — the admin's named link by the gateway's own provenance (its
+ * exact hostname), else what the TCP peer and Host say (a quick tunnel's request is `lan`, and refused as public_link).
+ */
+export function webPeerOf(req) {
+    return gatewayRequestContext(req)?.named === true ? "named_link" : classifyWebPeer(req);
 }
 /**
  * #2122: what let this request in, asked now — its session (by handle, under the token it was signed in with) or the
@@ -1626,15 +1637,12 @@ export function handleWebRequest(req, res, url, ctx) {
         const after = url.searchParams.get("after");
         const fresh = after === null || after === ""; // a cursor that is not ours in shape still gets nothing
         if (guest) {
-            // #2085 review: and what became the channel's after its cursor (an older row, its copy sent since), once each.
+            // #2085 review: with what became the channel's after its cursor (an older row, its copy sent since), once each —
+            // replayFor counts a row where it was seen (seenSeq), as for every reader (#1774).
             json(res, 200, guestPollBody(ctx.getUiStatus(), guest.scope(), Date.now(), guest, after, () => {
                 if (!history)
                     return [];
-                if (fresh)
-                    return history.after(0);
-                const cursor = parseLastEventId(after);
-                const rows = [...history.replayFor(cursor), ...history.seenAfter(cursor)];
-                return rows.filter((m, i) => rows.findIndex((x) => x.boot === m.boot && x.id === m.id) === i);
+                return fresh ? history.after(0) : history.replayFor(parseLastEventId(after));
             }));
             return true;
         }
@@ -1972,6 +1980,100 @@ export function handleWebRequest(req, res, url, ctx) {
         });
         return true;
     }
+    // ── Fleet → Org chart → Office: the offices people made (web-offices.json, web-office-store.ts) ──
+    // GET /ui/offices: { rev, offices, readable } for whoever may open the org chart (the public link too: it reads the
+    // chart; a guest's routes do not include it). PUT /ui/offices { offices, rev? }: a person's change, as a theme's reset
+    // or lock is — an admin session only, never the CLI token, never the public link (absent from its manifest, and
+    // refused here too); asked again once the body is in. Every page hears `offices` on the stream and reads again.
+    if (method === "GET" && path === "/ui/offices") {
+        const store = ctx.officeStore;
+        if (!store) {
+            json(res, 404, { error: "Offices are not kept on this fleet" });
+            return true;
+        }
+        json(res, 200, store.list());
+        return true;
+    }
+    if (method === "PUT" && path === "/ui/offices") {
+        const store = ctx.officeStore;
+        if (!store) {
+            json(res, 404, { error: "Offices are not kept on this fleet" });
+            return true;
+        }
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "offices_not_over_public_link" });
+            return true;
+        }
+        // The person (an admin session's account), or the status that refuses the request.
+        const who = () => {
+            const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+            if (verdict.kind !== "allow")
+                return { status: 401 };
+            return verdict.via === "session" && verdict.session?.tier === "admin" ? { person: verdict.session.owner ? webPersonKey(verdict.session.owner) : "admin-session" } : { status: 403 };
+        };
+        const refuse = (status) => json(res, status, { error: status === 401 ? WEB_TOKEN_INVALID_MESSAGE : "offices_need_an_admin_session" });
+        const first = who();
+        if ("status" in first) {
+            refuse(first.status);
+            return true;
+        }
+        (async () => {
+            let body;
+            try {
+                body = await parseBody(req);
+            }
+            catch {
+                json(res, 400, { error: "Invalid JSON" });
+                return;
+            }
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            const now = who();
+            if ("status" in now) {
+                refuse(now.status);
+                return;
+            }
+            if (!body || typeof body !== "object" || Array.isArray(body)) {
+                json(res, 400, { error: "offices required" });
+                return;
+            }
+            const extra = Object.keys(body).find(k => k !== "offices" && k !== "rev");
+            if (extra !== undefined) {
+                json(res, 400, { error: "offices_invalid", detail: `unknown key "${extra}"` });
+                return;
+            }
+            // Office review: the rev the page read is required — a save without one would overwrite another person's unseen.
+            if (body.rev === undefined) {
+                json(res, 428, { error: "offices_rev_required", detail: "send the rev you read (GET /ui/offices)" });
+                return;
+            }
+            if (!Number.isSafeInteger(body.rev)) {
+                json(res, 400, { error: "offices_invalid", detail: "rev: an integer" });
+                return;
+            }
+            const limiter = ctx.officeWrites, allowed = limiter ? limiter.check(now.person) : { ok: true };
+            if (!allowed.ok) {
+                res.setHeader("Retry-After", String(allowed.retry_after_s));
+                json(res, 429, { error: "offices_rate_limited", retry_after_s: allowed.retry_after_s });
+                return;
+            }
+            const r = store.replace(body.offices, body.rev);
+            if (!r.ok) {
+                json(res, r.status, { error: r.error, ...(r.detail ? { detail: r.detail } : {}) });
+                return;
+            }
+            limiter?.record(now.person);
+            ctx.emitSseEvent("offices", { rev: r.rev });
+            json(res, 200, { rev: r.rev, offices: r.offices });
+        })().catch(err => {
+            ctx.logger.error({ err: err.message }, "Saving offices failed");
+            try {
+                json(res, 500, { error: "Saving offices failed" });
+            }
+            catch { /* already answered */ }
+        });
+        return true;
+    }
     // ── #1630: avatars and Discord server emoji, same-origin (the page never loads a platform's CDN; img-src stays 'self') ──
     const imageMatch = path.match(/^\/ui\/img\/(bot|avatar|emoji)\/([^/]+)$/);
     if (method === "GET" && imageMatch) {
@@ -2373,7 +2475,7 @@ export function handleWebRequest(req, res, url, ctx) {
     if (path === "/ui/authorization" && (method === "GET" || method === "POST")) {
         const judge = () => {
             const v = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
-            return { session: v.kind === "allow" && v.via === "session" ? v.session : null, gateway: !!gatewayRequestContext(req), peer: classifyWebPeer(req) };
+            return { session: v.kind === "allow" && v.via === "session" ? v.session : null, gateway: !!gatewayRequestContext(req), peer: webPeerOf(req) };
         };
         res.setHeader("Cache-Control", "no-store");
         if (method === "GET") {
@@ -3069,11 +3171,12 @@ export function handleWebRequest(req, res, url, ctx) {
         }
         return true;
     }
-    // #2293: global search — an admin's only: the header token or an admin session. Never over the public link (the gateway
-    // does not list it either), never a guest (not in GUEST_ROUTES). Asked on arrival and again before the answer is sent.
+    // #2293: global search — an admin's only: the header token or an admin session. Never a guest (not in GUEST_ROUTES).
+    // #2478 (the user's request): over the public link too, unless web.search.public_link is false. Asked on arrival and
+    // again before the answer is sent.
     if (method === "GET" && (path === "/ui/search" || path === "/ui/search/context")) {
         const refusal = () => {
-            if (gatewayRequestContext(req))
+            if (gatewayRequestContext(req) && ctx.fleetConfig?.web?.search?.public_link === false)
                 return [404, "search_not_over_public_link"];
             if (guestRequestOf(req))
                 return [403, "guest_forbidden"];
@@ -3435,6 +3538,14 @@ function webDeliveryFailure(err) {
     return { reason: "delivery_unavailable", error: "The instance could not receive this message. Check its status on the host, then retry." };
 }
 /** Handle POST /ui/send — extracted for readability. */
+/** Each web server's own memory of the sends it accepted by clientId (web-send-dedupe.ts). */
+const webSendDedupes = new WeakMap();
+function webSendDedupeOf(ctx) {
+    let d = webSendDedupes.get(ctx);
+    if (!d)
+        webSendDedupes.set(ctx, d = new WebSendDedupe());
+    return d;
+}
 function handleSendMessage(req, res, ctx) {
     const arrival = webAuthorityOf(req, new URL(req.url ?? "/", "http://localhost"), ctx); // #1939 §3: again after the body
     let body = "";
@@ -3451,6 +3562,9 @@ function handleSendMessage(req, res, ctx) {
     req.on("end", async () => {
         if (!permitWebContinuation(req, res, ctx))
             return;
+        // A claimed clientId is settled however this ends: with the messageId once accepted, else forgotten.
+        let claim;
+        let acceptedId = null;
         try {
             const raw = JSON.parse(body);
             const parsed = SendMessageSchema.safeParse(raw);
@@ -3459,7 +3573,7 @@ function handleSendMessage(req, res, ctx) {
                 json(res, 400, { error: `${issue.path.join(".") || "body"}: ${issue.message}` });
                 return;
             }
-            const { instance, message: typed, attachments = [], replyTo } = parsed.data;
+            const { instance, message: typed, attachments = [], replyTo, clientId } = parsed.data;
             // #1920 step 2b: a guest writes only to an in-scope instance, while guests may chat, and never a command.
             const guest = guestRequestOf(req);
             const refused = guestChatRefusal(guest, instance);
@@ -3486,6 +3600,33 @@ function handleSendMessage(req, res, ctx) {
                 json(res, 404, { error: `Instance not found: ${instance}` });
                 return;
             }
+            // #1827: who is writing — the name agents and chats see, and the id they tell people apart by. Asked now that the
+            // body is in: a session revoked meanwhile sends nothing (not as the operator).
+            const person = webPersonOf(req, new URL(req.url ?? "/", "http://localhost"), ctx);
+            if (!person) {
+                json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                return;
+            }
+            // #2438 follow-up: the page's Retry of a send that already went (its answer and the live copy lost) is that send:
+            // answered with its messageId, delivered once. One still going is waited for; one that failed is sent anew.
+            if (clientId) {
+                const key = WebSendDedupe.key(person.key, instance, clientId);
+                for (;;) {
+                    const seen = webSendDedupeOf(ctx).claim(key);
+                    if (seen.kind === "going") {
+                        await seen.settled;
+                        if (res.destroyed)
+                            return;
+                        continue;
+                    }
+                    if (seen.kind === "accepted") {
+                        json(res, 200, { sent: true, messageId: seen.messageId, repeated: true });
+                        return;
+                    }
+                    claim = seen;
+                    break;
+                }
+            }
             let files = [];
             if (attachments.length > 0) {
                 const taken = ctx.webFiles?.takeForMessage(instance, attachments);
@@ -3512,14 +3653,6 @@ function handleSendMessage(req, res, ctx) {
                 && (!guest || (guest.current() && !guestChatRefusal(guest, instance)))
                 && (registered ? registeredChatInstance(ctx, instance) : ctx.instanceIpcClients.has(instance));
             const message = typed;
-            // #1827: who is writing — the name agents and chats see, and the id they tell people apart by. Asked now that the
-            // body is in: a session revoked meanwhile sends nothing (not as the operator).
-            const person = webPersonOf(req, new URL(req.url ?? "/", "http://localhost"), ctx);
-            if (!person) {
-                ctx.webFiles?.release(files);
-                json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
-                return;
-            }
             // #1939 S1: what the receipt records about who authorized it (observe only: agents still read web as recognition).
             const { authority } = confirmAfterBody(arrival, webAuthorityOf(req, new URL(req.url ?? "/", "http://localhost"), ctx, instance));
             const ts = new Date().toISOString();
@@ -3537,13 +3670,18 @@ function handleSendMessage(req, res, ctx) {
             // Add no runtime credentials or local attachment paths to the display copy. A reply opens with the line it
             // answers (#2272) — quoted only if that message reached the channel; a web-only one is named, never copied out.
             const quoteLine = quoted ? webReplyEchoLine(quoted) : "";
-            const preview = (quoteLine ? `${quoteLine}\n` : "") + webEchoPreview(message, files.map(f => f.name));
+            const plainPreview = webEchoPreview(message, files.map(f => f.name));
+            const preview = (quoteLine ? `${quoteLine}\n` : "") + plainPreview;
+            // #2281: where the quoted message is on a platform. An echo to the same place is a native reply to it there, and
+            // then needs no quoted line; anywhere else (or a message with no known post) keeps the line, as before.
+            const quotedPosts = quoted ? ctx.webChatHistory?.postsOf(quoted) ?? [] : [];
+            const echoText = (p) => formatWebChannelEcho(person.name, p, t("web.echo_full_text"), { guest: !!guest });
             // ClassicBot echo (#1320 part B): same ordering lane, each room's setting (#2054: on unless it says false, or
             // the fleet-wide switch is off for a room that is unset) resolved at send time inside sendClassicWebEcho.
             const canClassicEcho = ctx.isClassicInstance?.(instance) === true && !!ctx.sendClassicWebEcho;
             const settleClassicEcho = canClassicEcho ? ctx.reserveWebChannelEcho?.(instance, async () => {
                 const copies = [];
-                const posted = await ctx.sendClassicWebEcho(instance, formatWebChannelEcho(person.name, preview, t("web.echo_full_text"), { guest: !!guest }), person.name, copies);
+                const posted = await ctx.sendClassicWebEcho(instance, echoText(preview), person.name, copies, quotedPosts.length ? { posts: quotedPosts, text: echoText(plainPreview) } : undefined);
                 if (posted > 0)
                     ctx.webMessageInChannel?.(instance, messageId, copies); // #1920 §5.2: the room saw it (#2305: its copies)
             }) : undefined;
@@ -3553,12 +3691,13 @@ function handleSendMessage(req, res, ctx) {
                     || (ctx.getGroupIdForInstance?.(instance) ?? String(ctx.fleetConfig?.channel?.group_id ?? "")) !== groupId
                     || ctx.fleetConfig?.instances[instance]?.topic_id !== topicId)
                     return;
-                const sent = await syncAdapter.sendText(String(groupId), formatWebChannelEcho(person.name, preview, t("web.echo_full_text"), { guest: !!guest }), { threadId: String(topicId), format: "text", allowedMentions: { parse: [] } });
+                const native = quotedPosts.find(p => p.adapterId === syncAdapter.id && p.chatId === String(groupId) && (p.threadId ?? "") === String(topicId));
+                const sent = await syncAdapter.sendText(String(groupId), echoText(native ? plainPreview : preview), { threadId: String(topicId), format: "text", allowedMentions: { parse: [] }, ...(native ? { replyTo: native.messageId } : {}) });
                 const copyId = sent && typeof sent === "object" && typeof sent.messageId === "string" ? sent.messageId : "";
-                // #1920 §5.2: the topic saw it. #2305: and where it is, for a reaction to the web message.
+                // #1920 §5.2: the topic saw it. #2305: and where it is, for a reaction to the web message (#2281: and a reply).
                 const reacting = syncAdapter;
-                ctx.webMessageInChannel?.(instance, messageId, copyId && typeof reacting.react === "function"
-                    ? [{ adapter: reacting, chatId: String(groupId), threadId: String(topicId), messageId: copyId }] : []);
+                ctx.webMessageInChannel?.(instance, messageId, copyId
+                    ? [{ adapter: reacting, adapterId: syncAdapter.id, chatId: String(groupId), threadId: String(topicId), messageId: copyId }] : []);
                 return sent;
             }) : undefined;
             let delivered;
@@ -3604,6 +3743,9 @@ function handleSendMessage(req, res, ctx) {
                 json(res, 503, { reason: "delivery_changed", error: "The session or instance changed before this message was sent. Sign in again if needed, then retry." });
                 return;
             }
+            // The agent has it: from here on a repeat of this clientId is this send, whatever fails after (the echo, the
+            // stream's copy) — a Retry then gets this messageId, never a second delivery.
+            acceptedId = messageId;
             settleEcho?.(true);
             settleClassicEcho?.(true);
             // #1666: the same cancel/progress bubble a platform inbound starts, in the topic the echo went to — a second turn
@@ -3618,11 +3760,19 @@ function handleSendMessage(req, res, ctx) {
             ctx.eventLog?.logActivity("message", person.name, (message || `[${files.length} file(s)]`).slice(0, 200), instance);
             // #1920: the account that wrote it (a guest sees its own); channel-visible once its copy was sent (above).
             ctx.emitSseEvent("message", { instance, sender: person.name, role: "user", text: message, ts, attachments: files.map(publicAttachment), messageId, ...(person.bound ? { from: person.voterKey } : {}),
-                ...(quoted ? { replyTo: webChatReplyRef(quoted) } : {}) });
+                ...(quoted ? { replyTo: webChatReplyRef(quoted) } : {}), ...(clientId ? { clientId } : {}) });
             json(res, 200, { sent: true, messageId });
         }
         catch {
-            json(res, 400, { error: "Invalid JSON" });
+            // A failure after the agent has it is no failed send: the page is told it went (a Retry would only find it).
+            if (res.headersSent) { /* answered already: the failure was in or after the answer */ }
+            else if (acceptedId)
+                json(res, 200, { sent: true, messageId: acceptedId });
+            else
+                json(res, 400, { error: "Invalid JSON" });
+        }
+        finally {
+            claim?.settle(acceptedId);
         }
     });
 }
@@ -3916,6 +4066,8 @@ function shellBodyTag(req, ctx, mode, viewer) {
         + ` data-owner-css-state="${ownerCssState}"${ownerCss ? ` data-owner-css="${attr(ownerCss)}"` : ""}`
         // #1589: the public link shows attachments as downloads only (no inline text or media): its scope is unchanged.
         + `${gatewayRequestContext(req) ? ' data-public-link="1"' : ""}`
+        // #2478: search is offered over the public link unless web.search.public_link is false (the page then shows no entry).
+        + `${gatewayRequestContext(req) && ctx.fleetConfig?.web?.search?.public_link === false ? ' data-search-link="0"' : ""}`
         // #1920 phase 3: a guest's page — the shell shows only what a guest may use, and who it is signed in as.
         + `${mode === "full" && viewer?.guest && viewer.owner ? guestBodyAttrs(ctx, viewer.owner, attr) : ""}>`;
 }