@threadbase-sh/streamer 1.58.0 → 1.58.2

package/dist/index.cjs

@@ -907,6 +907,21 @@ var import_child_process = require("child_process");
 var import_fs3 = require("fs");
 var import_os2 = require("os");
 var import_path3 = require("path");
+
+// src/providers.ts
+var CLAUDE_CODE_PROVIDER = "claude-code";
+var CODEX_CLI_PROVIDER = "codex-cli";
+function isProviderName(value) {
+  return value === CLAUDE_CODE_PROVIDER || value === CODEX_CLI_PROVIDER;
+}
+function coerceProviderForRunner(value) {
+  return isProviderName(value) ? value : CLAUDE_CODE_PROVIDER;
+}
+function isProviderResumable(_provider, availabilityResumable) {
+  return availabilityResumable;
+}
+
+// src/platform.ts
 var isWindows = (0, import_os2.platform)() === "win32";
 var WINDOWS_EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([".exe", ".cmd", ".bat"]);
 function isWindowsExecutablePath(path) {
@@ -1036,18 +1051,38 @@ function resolveCodexExe() {
   _codexExe = "codex";
   return _codexExe;
 }
-
-// src/providers.ts
-var CLAUDE_CODE_PROVIDER = "claude-code";
-var CODEX_CLI_PROVIDER = "codex-cli";
-function isProviderName(value) {
-  return value === CLAUDE_CODE_PROVIDER || value === CODEX_CLI_PROVIDER;
+function isExecutableFile(path) {
+  try {
+    if (!(0, import_fs3.statSync)(path).isFile()) return false;
+    (0, import_fs3.accessSync)(path, import_fs3.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
 }
-function coerceProviderForRunner(value) {
-  return isProviderName(value) ? value : CLAUDE_CODE_PROVIDER;
+function locateExecutable(exe) {
+  if (/[\\/]/.test(exe)) return isExecutableFile(exe) ? exe : null;
+  const names = isWindows ? [
+    ...isWindowsExecutablePath(exe) ? [exe] : [],
+    ...[...WINDOWS_EXECUTABLE_EXTENSIONS].map((ext) => `${exe}${ext}`)
+  ] : [exe];
+  for (const dir of (process.env.PATH ?? "").split(import_path3.delimiter)) {
+    if (!dir) continue;
+    for (const name of names) {
+      const candidate = (0, import_path3.join)(dir, name);
+      if (isExecutableFile(candidate)) return candidate;
+    }
+  }
+  return null;
 }
-function isProviderResumable(_provider, availabilityResumable) {
-  return availabilityResumable;
+function locateProviderExe(provider) {
+  const isCodex = provider === CODEX_CLI_PROVIDER;
+  const found = locateExecutable(isCodex ? resolveCodexExe() : resolveClaudeExe());
+  if (found === null) {
+    if (isCodex) clearCodexExeCache();
+    else clearClaudeExeCache();
+  }
+  return found;
 }
 
 // src/pty-shared.ts
@@ -1305,11 +1340,19 @@ var CodexPtyRunner = class {
   onStatusChange;
   onPhaseChange;
   onReady;
-  // Broadcasts Codex's blocking startup gates (directory trust, hooks review)
-  // as question cards; null dismisses the card once the gate leaves the screen.
+  // Every Codex prompt the client can answer — startup gates (directory trust,
+  // hooks review), command approvals, and the rate-limit model picker — is
+  // broadcast through this one channel; null dismisses the card once the prompt
+  // leaves the screen.
+  //
+  // Deliberately NOT onLiveQuestion/onLiveQuestionGone, which is Claude's
+  // AskUserQuestion transport. Both channels land on the same mobile
+  // QuestionCard, and the permission one is the correct fit for Codex: its menus
+  // are answered by the option's real on-screen number (parseCodexNumberedOptions
+  // emits `answerKeys: "2\r"`), which is exactly what `permissionIndices` carries
+  // and what AskUserQuestion's down-arrow-count model cannot express. Wiring the
+  // question channel as well would be a second path to the same card.
   onPermissionChange;
-  onLiveQuestion;
-  onLiveQuestionGone;
   onUserMessage;
   log;
   // Tracks sessions whose PTY has spawned but Codex hasn't yet reached its
@@ -1359,8 +1402,6 @@ var CodexPtyRunner = class {
     this.onPhaseChange = options.onPhaseChange;
     this.onReady = options.onReady;
     this.onPermissionChange = options.onPermissionChange;
-    this.onLiveQuestion = options.onLiveQuestion;
-    this.onLiveQuestionGone = options.onLiveQuestionGone;
     this.onUserMessage = options.onUserMessage;
     this.log = options.logger ?? getLogger("codex-pty");
   }
@@ -3668,11 +3709,13 @@ var LiveSessionManager = class {
   async start(sessionId, options) {
     const provider = options.provider ?? CLAUDE_CODE_PROVIDER;
     const runner = this.assertSupportedProvider(provider, options.projectPath);
+    this.assertProviderInstalled(provider);
     return runner.start(sessionId, options);
   }
   async startFresh(options) {
     const provider = options.provider ?? CLAUDE_CODE_PROVIDER;
     const runner = this.assertSupportedProvider(provider, options.projectPath);
+    this.assertProviderInstalled(provider);
     return runner.startFresh(options);
   }
   /**
@@ -3691,6 +3734,7 @@ var LiveSessionManager = class {
       err.statusCode = 501;
       throw err;
     }
+    this.assertProviderInstalled(provider);
     return runner.startFork(options);
   }
   sendInput(sessionId, input) {
@@ -3772,6 +3816,30 @@ var LiveSessionManager = class {
     }
     throw new Error(`Session not found: ${sessionId}`);
   }
+  /**
+   * Refuse before spawning when the provider's CLI is not on this machine.
+   *
+   * Without this the spawn "succeeds": on POSIX execvp fails inside the forked
+   * child, so a session appears, exits ~12ms later with code 1 and no output,
+   * and the caller is told only that it "exited before becoming ready" — or,
+   * on the Claude resume path, is told nothing at all, since that path answers
+   * 200 before the process has had a chance to die. Every start route funnels
+   * through here, so one check covers start, resume, adopt and fork.
+   *
+   * 503, not 500: the request was well-formed and the fault is this machine's
+   * environment. `code` is what mobile branches on (it reads `errBody.code`),
+   * and `PROVIDER_NOT_INSTALLED` is a remediation string it already knows.
+   */
+  assertProviderInstalled(provider) {
+    if (locateProviderExe(provider) !== null) return;
+    const command = provider === CODEX_CLI_PROVIDER ? "codex" : "claude";
+    const err = new Error(
+      `The ${command} command was not found on this server. Install the ${provider} CLI, or make sure it is on the PATH the streamer runs with.`
+    );
+    err.statusCode = 503;
+    err.code = "PROVIDER_NOT_INSTALLED";
+    throw err;
+  }
   assertSupportedProvider(provider, projectPath) {
     if (this.remoteRunner) return this.remoteRunner;
     const runner = this.runners.get(provider);
@@ -4454,7 +4522,9 @@ var corsMiddleware = (configValue) => {
 // src/api/middleware/error.middleware.ts
 var errorMiddleware = (err, c) => {
   const message = err instanceof Error ? err.message : "Internal server error";
-  return c.json({ error: message }, 500);
+  const { statusCode, code } = err;
+  const status = typeof statusCode === "number" && statusCode >= 400 && statusCode <= 599 ? statusCode : 500;
+  return c.json(typeof code === "string" ? { error: message, code } : { error: message }, status);
 };
 
 // src/api/routes/backup.routes.ts
@@ -5009,24 +5079,26 @@ function computeBootToken() {
 }
 
 // src/api/routes/diagnostics.routes.ts
-function providerCheck(name, resolve2) {
+function providerCheck(name) {
   try {
-    const exe = resolve2();
-    return {
-      id: `provider:${name}`,
-      status: "ok",
-      summary: `${name} CLI is installed.`,
-      remediation: "NONE",
-      detail: { location: redactPath(exe) }
-    };
+    const exe = locateProviderExe(name);
+    if (exe !== null) {
+      return {
+        id: `provider:${name}`,
+        status: "ok",
+        summary: `${name} CLI is installed.`,
+        remediation: "NONE",
+        detail: { location: redactPath(exe) }
+      };
+    }
   } catch {
-    return {
-      id: `provider:${name}`,
-      status: "failed",
-      summary: `${name} CLI could not be located. Sessions for this provider cannot start.`,
-      remediation: "PROVIDER_NOT_INSTALLED"
-    };
   }
+  return {
+    id: `provider:${name}`,
+    status: "failed",
+    summary: `${name} CLI could not be located. Sessions for this provider cannot start.`,
+    remediation: "PROVIDER_NOT_INSTALLED"
+  };
 }
 var createDiagnosticsRoutes = (deps) => {
   const app = new import_hono8.Hono();
@@ -5039,8 +5111,8 @@ var createDiagnosticsRoutes = (deps) => {
       remediation: "NONE",
       detail: { version: getVersion(), uptimeSeconds: Math.floor(process.uptime()) }
     });
-    checks.push(providerCheck("claude-code", resolveClaudeExe));
-    checks.push(providerCheck("codex-cli", resolveCodexExe));
+    checks.push(providerCheck(CLAUDE_CODE_PROVIDER));
+    checks.push(providerCheck(CODEX_CLI_PROVIDER));
     const cacheAlert = deps.cacheMonitor()?.healthzField();
     checks.push(
       cacheAlert ? {
@@ -6112,7 +6184,10 @@ function parseVersionOutput(output) {
   const match = output.match(/\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?/);
   return match ? match[0] : null;
 }
+var versionByExe = /* @__PURE__ */ new Map();
 function runVersion(exe) {
+  const cached3 = versionByExe.get(exe);
+  if (cached3 !== void 0) return Promise.resolve(cached3);
   const viaShell = isWindows && /\.(?:cmd|bat)$/i.test(exe);
   const file = viaShell ? `"${exe}"` : exe;
   return new Promise((resolve2) => {
@@ -6122,7 +6197,9 @@ function runVersion(exe) {
       { timeout: VERSION_TIMEOUT_MS, shell: viaShell, windowsHide: true },
       (err, stdout, stderr) => {
         if (err && !stdout && !stderr) return resolve2(null);
-        resolve2(parseVersionOutput(`${stdout}${stderr}`));
+        const version = parseVersionOutput(`${stdout}${stderr}`);
+        if (version !== null) versionByExe.set(exe, version);
+        resolve2(version);
       }
     );
   });
@@ -6166,13 +6243,16 @@ function compareSemver(a, b) {
   if (pb.pre === null) return -1;
   return pa.pre < pb.pre ? -1 : 1;
 }
-async function providerHealth(name, resolveExe, detect = runVersion) {
+async function providerHealth(name, locateExe = () => locateProviderExe(name), detect = runVersion) {
   const verifiedAgainst = VERIFIED_AGAINST[name];
   const capabilities = capabilitiesFor(name);
-  let exe;
+  let exe = null;
   try {
-    exe = resolveExe();
+    exe = locateExe();
   } catch {
+    exe = null;
+  }
+  if (exe === null) {
     return {
       name,
       available: false,
@@ -6209,8 +6289,8 @@ var createProviderRoutes = () => {
   const app = new import_hono14.Hono();
   app.get("/", async (c) => {
     const providers = await Promise.all([
-      providerHealth(CLAUDE_CODE_PROVIDER, resolveClaudeExe),
-      providerHealth(CODEX_CLI_PROVIDER, resolveCodexExe)
+      providerHealth(CLAUDE_CODE_PROVIDER),
+      providerHealth(CODEX_CLI_PROVIDER)
     ]);
     return c.json({ providers });
   });
@@ -10681,7 +10761,10 @@ var SessionHandlers = class {
       });
       this.sessionStore.addManaged(session);
       this.registryBoot.recordSessionSpawn(session);
-      const { outcome } = await this.deps.waitForStartupOutcome(session.id, START_READY_TIMEOUT_MS);
+      const { outcome, session: settled } = await this.deps.waitForStartupOutcome(
+        session.id,
+        START_READY_TIMEOUT_MS
+      );
       const current = this.sessionStore.get(session.id, this.deps.ptyAttachedIds());
       if (outcome === "ready" && current) {
         json(res, 200, { session: current });
@@ -10689,7 +10772,7 @@ var SessionHandlers = class {
         json(res, 502, {
           id: session.id,
           status: "idle",
-          error: current.failureReason ?? "Session exited before becoming ready"
+          error: settled?.failureReason ?? "Session exited before becoming ready"
         });
       } else {
         json(res, 202, { id: session.id, status: "pending" });
@@ -10703,11 +10786,16 @@ var SessionHandlers = class {
     } catch (err) {
       const message = err instanceof Error ? err.message : "Failed to start session";
       const statusCode = typeof err.statusCode === "number" ? err.statusCode : 500;
+      const code = err.code;
       this.log.error(`[start] failed to start session: ${message}`, {
         event: "session.start_failed",
         error: message
       });
-      json(res, statusCode, { error: message });
+      json(
+        res,
+        statusCode,
+        typeof code === "string" ? { error: message, code } : { error: message }
+      );
     }
   }
   async handleSetSessionName(sessionId, req, res) {
@@ -11391,7 +11479,37 @@ var PairTokenStore = class {
       expiresInSeconds: Math.floor(this.ttlMs / 1e3)
     };
   }
+  /**
+   * Whether `consume` would succeed right now, WITHOUT spending the token.
+   *
+   * Exists so a caller can reject a bad token before doing any work, and still
+   * spend the token only once the work has succeeded. A pair token is
+   * single-use and lives 180 seconds, so spending it on a request that then
+   * fails costs the user a whole new QR — and, worse, makes their retry
+   * indistinguishable from an attacker replaying a photographed code, which is
+   * the one signal `design.md` §2.6 designates as replay detection.
+   *
+   * Advisory, not a reservation: it takes no lock and holds nothing. The
+   * authoritative answer is still `consume`'s.
+   */
+  verify(token) {
+    const result = this.check(token);
+    return result.ok ? { ok: true } : result;
+  }
   consume(token) {
+    const result = this.check(token);
+    if (!result.ok) return result;
+    result.record.used = true;
+    return { ok: true };
+  }
+  /**
+   * The shared predicate behind `verify` and `consume`.
+   *
+   * One implementation on purpose: two copies of "is this token usable" is two
+   * places for the expiry or single-use rule to drift, and a drift in this
+   * direction fails open.
+   */
+  check(token) {
     const record2 = this.current;
     if (!record2 || record2.token !== token) return { ok: false, reason: "unknown" };
     if (Date.now() > record2.expiresAt) {
@@ -11399,8 +11517,7 @@ var PairTokenStore = class {
       return { ok: false, reason: "expired" };
     }
     if (record2.used) return { ok: false, reason: "used" };
-    record2.used = true;
-    return { ok: true };
+    return { ok: true, record: record2 };
   }
   peek() {
     return this.current;
@@ -12299,7 +12416,15 @@ function createLiveSessionOptions(deps) {
         // grace-timer/idle-reaper hold (statusSource "shutdown") apart from a
         // genuine process exit ("process-exit"), and reports both as
         // `lifecycle: "completed"`. See managedToResponse in session-store.ts.
-        ...session.statusSource != null && { statusSource: session.statusSource }
+        ...session.statusSource != null && { statusSource: session.statusSource },
+        // Why a session died, not just that it did. Without this the store's
+        // copy has no failureReason, so managedToResponse falls through to
+        // `lifecycle: "completed"` (see session-store.ts) and a session that
+        // never started — missing CLI, missing project dir — is reported to
+        // every client as one that finished normally. Guarded like its
+        // neighbours: a later transition must not blank a recorded failure.
+        ...session.failureReason != null && { failureReason: session.failureReason },
+        ...session.failureCode != null && { failureCode: session.failureCode }
       });
       deps.managedSessionsRepo()?.recordStatus(
         session.id,
@@ -15754,6 +15879,41 @@ var StreamerServer = class {
     json(res, 503, body);
     return true;
   }
+  /**
+   * Say which provider CLIs this machine can actually launch.
+   *
+   * The operator cannot discover this case unaided: under launchd/Task
+   * Scheduler the service inherits a stripped PATH, so a CLI that works
+   * perfectly in their terminal is invisible to the service, and every session
+   * start dies milliseconds in. `/api/diagnostics` answers it too, but only for
+   * someone who already suspects it.
+   *
+   * Availability only, never a version — `--version` costs a process spawn per
+   * provider (85ms for claude here) and belongs on the first request that wants
+   * it, not on boot.
+   *
+   * Called AFTER the port is bound, which is not cosmetic. This is the first
+   * caller of the exe resolvers in the process, so the memo is cold by
+   * definition and each provider pays one synchronous `which` / `where.exe`
+   * (platform.ts) with a 3s timeout. On POSIX that is 3ms found, 7ms missing.
+   * Windows is the risk — `where.exe` is slower, `execFileSync` blocks the
+   * event loop, and Task Scheduler's stripped PATH is exactly where a miss
+   * pays the full timeout — so the worst case is ~6s of two blocking lookups.
+   * After `listen()` that delays the first requests on a box that cannot start
+   * a session anyway; before it, it would have delayed binding the port.
+   */
+  logProviderAvailability() {
+    for (const provider of [CLAUDE_CODE_PROVIDER, CODEX_CLI_PROVIDER]) {
+      if (locateProviderExe(provider)) {
+        this.log.info(`Provider ${provider}: found`, { event: "config.provider", provider });
+      } else {
+        this.log.warn(`Provider ${provider}: not found on PATH \u2014 sessions cannot start`, {
+          event: "config.provider_missing",
+          provider
+        });
+      }
+    }
+  }
   async listen(port, opts) {
     if (this.featureFlags.ptyHost) {
       try {
@@ -15814,6 +15974,7 @@ var StreamerServer = class {
           event: "server.listening",
           ...this.host !== void 0 && { host: this.host }
         });
+        this.logProviderAvailability();
         try {
           this.runtimeStore = RuntimeStore.open(this.runtimeDbPath);
           this.managedSessionsRepo = new ManagedSessionsRepository(this.runtimeStore.getDatabase());
@@ -16190,9 +16351,9 @@ var StreamerServer = class {
       json(res, 400, { error: "Missing token or clientPublicKey" });
       return;
     }
-    const result = this.pairTokens.consume(token);
-    if (!result.ok) {
-      json(res, 401, { error: `Pair token ${result.reason}` });
+    const precheck = this.pairTokens.verify(token);
+    if (!precheck.ok) {
+      json(res, 401, { error: `Pair token ${precheck.reason}` });
       return;
     }
     let sealed;
@@ -16203,6 +16364,11 @@ var StreamerServer = class {
       json(res, 400, { error: message });
       return;
     }
+    const result = this.pairTokens.consume(token);
+    if (!result.ok) {
+      json(res, 401, { error: `Pair token ${result.reason}` });
+      return;
+    }
     const ts = (/* @__PURE__ */ new Date()).toISOString();
     this.log.info(`[pair] token exchanged from ${ip} at ${ts}`, {
       event: "pair.token_exchanged",