@threadbase-sh/streamer 1.58.0 → 1.58.1

package/dist/index.cjs

@@ -1305,11 +1305,19 @@ var CodexPtyRunner = class {
   onStatusChange;
   onPhaseChange;
   onReady;
-  // Broadcasts Codex's blocking startup gates (directory trust, hooks review)
-  // as question cards; null dismisses the card once the gate leaves the screen.
+  // Every Codex prompt the client can answer — startup gates (directory trust,
+  // hooks review), command approvals, and the rate-limit model picker — is
+  // broadcast through this one channel; null dismisses the card once the prompt
+  // leaves the screen.
+  //
+  // Deliberately NOT onLiveQuestion/onLiveQuestionGone, which is Claude's
+  // AskUserQuestion transport. Both channels land on the same mobile
+  // QuestionCard, and the permission one is the correct fit for Codex: its menus
+  // are answered by the option's real on-screen number (parseCodexNumberedOptions
+  // emits `answerKeys: "2\r"`), which is exactly what `permissionIndices` carries
+  // and what AskUserQuestion's down-arrow-count model cannot express. Wiring the
+  // question channel as well would be a second path to the same card.
   onPermissionChange;
-  onLiveQuestion;
-  onLiveQuestionGone;
   onUserMessage;
   log;
   // Tracks sessions whose PTY has spawned but Codex hasn't yet reached its
@@ -1359,8 +1367,6 @@ var CodexPtyRunner = class {
     this.onPhaseChange = options.onPhaseChange;
     this.onReady = options.onReady;
     this.onPermissionChange = options.onPermissionChange;
-    this.onLiveQuestion = options.onLiveQuestion;
-    this.onLiveQuestionGone = options.onLiveQuestionGone;
     this.onUserMessage = options.onUserMessage;
     this.log = options.logger ?? getLogger("codex-pty");
   }
@@ -11391,7 +11397,37 @@ var PairTokenStore = class {
       expiresInSeconds: Math.floor(this.ttlMs / 1e3)
     };
   }
+  /**
+   * Whether `consume` would succeed right now, WITHOUT spending the token.
+   *
+   * Exists so a caller can reject a bad token before doing any work, and still
+   * spend the token only once the work has succeeded. A pair token is
+   * single-use and lives 180 seconds, so spending it on a request that then
+   * fails costs the user a whole new QR — and, worse, makes their retry
+   * indistinguishable from an attacker replaying a photographed code, which is
+   * the one signal `design.md` §2.6 designates as replay detection.
+   *
+   * Advisory, not a reservation: it takes no lock and holds nothing. The
+   * authoritative answer is still `consume`'s.
+   */
+  verify(token) {
+    const result = this.check(token);
+    return result.ok ? { ok: true } : result;
+  }
   consume(token) {
+    const result = this.check(token);
+    if (!result.ok) return result;
+    result.record.used = true;
+    return { ok: true };
+  }
+  /**
+   * The shared predicate behind `verify` and `consume`.
+   *
+   * One implementation on purpose: two copies of "is this token usable" is two
+   * places for the expiry or single-use rule to drift, and a drift in this
+   * direction fails open.
+   */
+  check(token) {
     const record2 = this.current;
     if (!record2 || record2.token !== token) return { ok: false, reason: "unknown" };
     if (Date.now() > record2.expiresAt) {
@@ -11399,8 +11435,7 @@ var PairTokenStore = class {
       return { ok: false, reason: "expired" };
     }
     if (record2.used) return { ok: false, reason: "used" };
-    record2.used = true;
-    return { ok: true };
+    return { ok: true, record: record2 };
   }
   peek() {
     return this.current;
@@ -16190,9 +16225,9 @@ var StreamerServer = class {
       json(res, 400, { error: "Missing token or clientPublicKey" });
       return;
     }
-    const result = this.pairTokens.consume(token);
-    if (!result.ok) {
-      json(res, 401, { error: `Pair token ${result.reason}` });
+    const precheck = this.pairTokens.verify(token);
+    if (!precheck.ok) {
+      json(res, 401, { error: `Pair token ${precheck.reason}` });
       return;
     }
     let sealed;
@@ -16203,6 +16238,11 @@ var StreamerServer = class {
       json(res, 400, { error: message });
       return;
     }
+    const result = this.pairTokens.consume(token);
+    if (!result.ok) {
+      json(res, 401, { error: `Pair token ${result.reason}` });
+      return;
+    }
     const ts = (/* @__PURE__ */ new Date()).toISOString();
     this.log.info(`[pair] token exchanged from ${ip} at ${ts}`, {
       event: "pair.token_exchanged",