@threadbase-sh/streamer 1.67.3 → 1.68.0

package/dist/index.js

@@ -2569,6 +2569,9 @@ import { basename as basename2 } from "path";
 function permissionContentKey(gate) {
   return `${gate.prompt ?? ""}::${gate.detail ?? ""}::${gate.options.map((o) => `${o.index}.${o.label}`).join(",")}::${gate.cursor ?? ""}`;
 }
+function permissionGateKey(gate) {
+  return permissionContentKey({ ...gate, cursor: void 0 });
+}
 var OSC_777_PERMISSION_RE = /\x1b\]777;notify;Claude Code;[^\x07\x1b]*needs your permission/;
 var OSC_777_WAITING_RE = /\x1b\]777;notify;Claude Code;[^\x07\x1b]*waiting for your input/;
 function hasPermissionOsc(rawData) {
@@ -2787,6 +2790,18 @@ function detectShellPrompt(lines) {
   return null;
 }
 
+// src/services/questions/permissionAnswerKeys.ts
+var ENTER2 = "\r";
+function permissionAnswerKeys(index) {
+  if (!Number.isInteger(index) || index < 0) {
+    throw new Error(`Invalid permission option index: ${index}`);
+  }
+  return `${index}${ENTER2}`;
+}
+function isPermissionAnswer(gate, keys) {
+  return gate.options.some((o) => keys === (o.answerKeys ?? permissionAnswerKeys(o.index)));
+}
+
 // src/utils/deriveSessionName.ts
 function deriveSessionName(firstMessageText) {
   const firstLine = firstMessageText.split("\n", 1)[0]?.trim() ?? "";
@@ -2829,10 +2844,12 @@ var PTYManager = class {
   onLiveQuestion;
   onLiveQuestionGone;
   onUserMessage;
-  // Per-session permission-gate state. True between an OSC 777 (gate open) and
-  // the next prompt-ready without a fresh 777 (gate closed). Prevents
-  // re-broadcasting open/close on every chunk.
-  permissionOpen = /* @__PURE__ */ new Set();
+  // Per-session permission-gate state: the gate currently open on a session's
+  // screen. Set between an OSC 777 / paint-time claim (gate open) and the next
+  // prompt-ready without a fresh 777 (gate closed). Prevents re-broadcasting
+  // open/close on every chunk. Holds the gate itself rather than just the id so
+  // sendKeys can tell whether the bytes it is writing are that gate's answer.
+  permissionOpen = /* @__PURE__ */ new Map();
   // Last chunk's raw tail per session — prepended to the next chunk before
   // the OSC regex test so a split escape still matches. Consumed on match.
   oscTail = /* @__PURE__ */ new Map();
@@ -3067,6 +3084,11 @@ var PTYManager = class {
     );
     session.process.write(keys);
     session.lastActivityAt = /* @__PURE__ */ new Date();
+    const openGate = this.permissionOpen.get(sessionId);
+    if (openGate && isPermissionAnswer(openGate, keys)) {
+      this.permissionOpen.delete(sessionId);
+      this.onPermissionChange?.(sessionId, null);
+    }
   }
   sendInput(sessionId, input) {
     const session = this.sessions.get(sessionId);
@@ -3413,7 +3435,7 @@ var PTYManager = class {
     }
     if (oscPermission && !askFooterOnScreen) {
       const gate = scrapePermissionGate(lines);
-      this.permissionOpen.add(sessionId);
+      this.permissionOpen.set(sessionId, gate ?? { options: [] });
       this.onPermissionChange?.(sessionId, gate ?? { options: [] });
     } else if (this.permissionOpen.has(sessionId) && !askFooterOnScreen) {
       const gate = detectGateScreen(lines);
@@ -3427,6 +3449,7 @@ var PTYManager = class {
           this.closedGateKey.delete(sessionId);
         }
       } else if (gate) {
+        this.permissionOpen.set(sessionId, gate);
         this.onPermissionChange?.(sessionId, gate);
       }
     } else if (!askFooterOnScreen && !oscWaitingForInput) {
@@ -3434,7 +3457,7 @@ var PTYManager = class {
       if (gate) {
         const key = permissionContentKey({ ...gate, cursor: void 0 });
         if (this.closedGateKey.get(sessionId) !== key) {
-          this.permissionOpen.add(sessionId);
+          this.permissionOpen.set(sessionId, gate);
           this.onPermissionChange?.(sessionId, gate);
         }
       } else {
@@ -6320,6 +6343,10 @@ var createSessionRoutes = (deps) => {
     await deps.handleSendAnswer(c.req.param("id"), c.env.incoming, c.env.outgoing);
     return alreadyHandled6();
   });
+  app.post("/:id/permission/answer", async (c) => {
+    await deps.handlePermissionAnswer(c.req.param("id"), c.env.incoming, c.env.outgoing);
+    return alreadyHandled6();
+  });
   app.post("/:id/files", async (c) => {
     await deps.handleUploadFile(c.req.param("id"), c.env.incoming, c.env.outgoing);
     return alreadyHandled6();
@@ -9553,7 +9580,7 @@ function parseStatusLine(lines) {
 
 // src/services/questions/answersToKeystrokes.ts
 var DOWN = "\x1B[B";
-var ENTER2 = "\r";
+var ENTER3 = "\r";
 var UnknownOptionError = class extends Error {
   constructor(question, value) {
     super(`No option labelled "${value}" for question "${question}"`);
@@ -9574,7 +9601,7 @@ function answersToKeystrokes(questions, answers) {
     const label = Array.isArray(raw) ? raw[0] : raw;
     const target = q.options.findIndex((o) => o.label === label);
     if (target < 0) throw new UnknownOptionError(q.question, label);
-    out += DOWN.repeat(target) + ENTER2;
+    out += DOWN.repeat(target) + ENTER3;
   }
   return out;
 }
@@ -10486,9 +10513,98 @@ var SessionHandlers = class {
       ...gate.prompt ? { prompt: gate.prompt } : {},
       ...gate.detail ? { detail: gate.detail } : {},
       options: gate.options,
-      ...gate.cursor !== void 0 ? { cursor: gate.cursor } : {}
+      ...gate.cursor !== void 0 ? { cursor: gate.cursor } : {},
+      contentKey: permissionGateKey(gate)
     });
   }
+  /**
+   * Answer a permission gate — the validated counterpart of POST /:id/input.
+   *
+   * `/input` is a raw-bytes conduit (arrow-key nav uses it too) and stays that
+   * way; this route is the semantic one, mirroring the /answer split. Two
+   * things make it more than validation theatre:
+   *
+   *   - The client sends `{ contentKey, optionIndex }` and NO keystrokes. The
+   *     keys are derived here from our own copy of the gate, so the client's
+   *     key-derivation can never drift from the server's.
+   *   - `contentKey` binds the answer to a specific gate. `isPermissionAnswer`
+   *     matches structurally, and approval gates repeat constantly ("2. Yes /
+   *     3. No" for every tool call), so without this a delayed answer to gate A
+   *     could be written as gate B's answer — a user approving a bash command
+   *     they never saw, with a 200 and a normal permission_cancelled. Treat the
+   *     check as a security boundary.
+   *
+   * Every refusal happens BEFORE sendKeys. On success we deliberately broadcast
+   * nothing: the PTY-side close (isPermissionAnswer in pty-manager) recognises
+   * the bytes we just wrote and fires permission_cancelled itself.
+   */
+  async handlePermissionAnswer(sessionId, req, res) {
+    const body = await readBody2(req);
+    const contentKey = body?.contentKey;
+    const optionIndex = body?.optionIndex;
+    if (typeof contentKey !== "string" || !Number.isInteger(optionIndex) || optionIndex < 0) {
+      json(res, 400, { ok: false, reason: "Expected { contentKey: string, optionIndex: number }" });
+      return;
+    }
+    const gateClosed = () => {
+      this.pendingPermission.delete(sessionId);
+      this.pendingPermissionKey.delete(sessionId);
+      this.wsHub.broadcast({ type: "permission_cancelled", sessionId });
+      json(res, 409, { ok: false, reason: "gate_closed" });
+    };
+    const gate = this.pendingPermission.get(sessionId);
+    if (!gate) {
+      gateClosed();
+      return;
+    }
+    if (permissionGateKey(gate) !== contentKey) {
+      json(res, 409, { ok: false, reason: "gate_mismatch" });
+      return;
+    }
+    const option = gate.options[optionIndex];
+    if (!option) {
+      json(res, 409, { ok: false, reason: "unknown_option" });
+      return;
+    }
+    if (!await this.permissionGateStillOpen(sessionId, contentKey)) {
+      gateClosed();
+      return;
+    }
+    try {
+      this.ptyManager.sendKeys(sessionId, option.answerKeys ?? permissionAnswerKeys(option.index));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to send answer";
+      json(res, 400, { ok: false, reason: message });
+      return;
+    }
+    json(res, 200, { ok: true });
+  }
+  /**
+   * Is THIS gate still the one on screen?
+   *
+   * Deliberately stricter than questionMenuStillOpen's "is a menu up": the
+   * staleness window this exists to cover (the ~300ms scrape throttle plus the
+   * wait for the next PTY chunk) is exactly where pendingPermission still says
+   * gate A while the screen has moved to gate B — and since approval gates
+   * repeat their shape, "some gate is open" would wave that through.
+   *
+   * Reads 60 lines because that is the window the detector that produced the
+   * pending gate uses (pty-manager's scrape); `detail` walks up to 6 lines
+   * above the prompt, so a shorter window can truncate it and manufacture a
+   * mismatch on a healthy gate.
+   *
+   * Best-effort, like questionMenuStillOpen: a session we hold no PTY for, or
+   * one that raced away mid-read, is not ours to veto.
+   */
+  async permissionGateStillOpen(sessionId, contentKey) {
+    if (!this.ptyManager.hasSession(sessionId)) return true;
+    try {
+      const onScreen = scrapePermissionGate(await this.ptyManager.getOutputLines(sessionId, 60));
+      return onScreen !== null && permissionGateKey(onScreen) === contentKey;
+    } catch {
+      return true;
+    }
+  }
   async handleSendAnswer(sessionId, req, res) {
     const body = await readBody2(req);
     const pending = this.pendingQuestions.get(sessionId);
@@ -12935,6 +13051,7 @@ function createApiDeps(deps) {
     handleGetOutput: (id, res) => deps.sessionHandlers.handleGetOutput(id, res),
     handleSendInput: (id, req, res) => deps.sessionHandlers.handleSendInput(id, req, res),
     handleSendAnswer: (id, req, res) => deps.sessionHandlers.handleSendAnswer(id, req, res),
+    handlePermissionAnswer: (id, req, res) => deps.sessionHandlers.handlePermissionAnswer(id, req, res),
     handleCancel: (id, res) => deps.sessionHandlers.handleCancel(id, res),
     handleStopSession: (id, res) => deps.sessionHandlers.handleStopSession(id, res),
     handleSetSessionName: (id, req, res) => deps.sessionHandlers.handleSetSessionName(id, req, res),
@@ -13018,7 +13135,8 @@ function createApiDeps(deps) {
                 ...pendingGate.prompt ? { prompt: pendingGate.prompt } : {},
                 ...pendingGate.detail ? { detail: pendingGate.detail } : {},
                 options: pendingGate.options,
-                ...pendingGate.cursor !== void 0 ? { cursor: pendingGate.cursor } : {}
+                ...pendingGate.cursor !== void 0 ? { cursor: pendingGate.cursor } : {},
+                contentKey: permissionGateKey(pendingGate)
               })
             );
           }