@threadbase-sh/streamer 1.67.4 → 1.68.1

package/dist/index.js

@@ -2569,6 +2569,9 @@ import { basename as basename2 } from "path";
 function permissionContentKey(gate) {
   return `${gate.prompt ?? ""}::${gate.detail ?? ""}::${gate.options.map((o) => `${o.index}.${o.label}`).join(",")}::${gate.cursor ?? ""}`;
 }
+function permissionGateKey(gate) {
+  return permissionContentKey({ ...gate, cursor: void 0 });
+}
 var OSC_777_PERMISSION_RE = /\x1b\]777;notify;Claude Code;[^\x07\x1b]*needs your permission/;
 var OSC_777_WAITING_RE = /\x1b\]777;notify;Claude Code;[^\x07\x1b]*waiting for your input/;
 function hasPermissionOsc(rawData) {
@@ -6340,6 +6343,10 @@ var createSessionRoutes = (deps) => {
     await deps.handleSendAnswer(c.req.param("id"), c.env.incoming, c.env.outgoing);
     return alreadyHandled6();
   });
+  app.post("/:id/permission/answer", async (c) => {
+    await deps.handlePermissionAnswer(c.req.param("id"), c.env.incoming, c.env.outgoing);
+    return alreadyHandled6();
+  });
   app.post("/:id/files", async (c) => {
     await deps.handleUploadFile(c.req.param("id"), c.env.incoming, c.env.outgoing);
     return alreadyHandled6();
@@ -10506,9 +10513,98 @@ var SessionHandlers = class {
       ...gate.prompt ? { prompt: gate.prompt } : {},
       ...gate.detail ? { detail: gate.detail } : {},
       options: gate.options,
-      ...gate.cursor !== void 0 ? { cursor: gate.cursor } : {}
+      ...gate.cursor !== void 0 ? { cursor: gate.cursor } : {},
+      contentKey: permissionGateKey(gate)
     });
   }
+  /**
+   * Answer a permission gate — the validated counterpart of POST /:id/input.
+   *
+   * `/input` is a raw-bytes conduit (arrow-key nav uses it too) and stays that
+   * way; this route is the semantic one, mirroring the /answer split. Two
+   * things make it more than validation theatre:
+   *
+   *   - The client sends `{ contentKey, optionIndex }` and NO keystrokes. The
+   *     keys are derived here from our own copy of the gate, so the client's
+   *     key-derivation can never drift from the server's.
+   *   - `contentKey` binds the answer to a specific gate. `isPermissionAnswer`
+   *     matches structurally, and approval gates repeat constantly ("2. Yes /
+   *     3. No" for every tool call), so without this a delayed answer to gate A
+   *     could be written as gate B's answer — a user approving a bash command
+   *     they never saw, with a 200 and a normal permission_cancelled. Treat the
+   *     check as a security boundary.
+   *
+   * Every refusal happens BEFORE sendKeys. On success we deliberately broadcast
+   * nothing: the PTY-side close (isPermissionAnswer in pty-manager) recognises
+   * the bytes we just wrote and fires permission_cancelled itself.
+   */
+  async handlePermissionAnswer(sessionId, req, res) {
+    const body = await readBody2(req);
+    const contentKey = body?.contentKey;
+    const optionIndex = body?.optionIndex;
+    if (typeof contentKey !== "string" || !Number.isInteger(optionIndex) || optionIndex < 0) {
+      json(res, 400, { ok: false, reason: "Expected { contentKey: string, optionIndex: number }" });
+      return;
+    }
+    const gateClosed = () => {
+      this.pendingPermission.delete(sessionId);
+      this.pendingPermissionKey.delete(sessionId);
+      this.wsHub.broadcast({ type: "permission_cancelled", sessionId });
+      json(res, 409, { ok: false, reason: "gate_closed" });
+    };
+    const gate = this.pendingPermission.get(sessionId);
+    if (!gate) {
+      gateClosed();
+      return;
+    }
+    if (permissionGateKey(gate) !== contentKey) {
+      json(res, 409, { ok: false, reason: "gate_mismatch" });
+      return;
+    }
+    const option = gate.options[optionIndex];
+    if (!option) {
+      json(res, 409, { ok: false, reason: "unknown_option" });
+      return;
+    }
+    if (!await this.permissionGateStillOpen(sessionId, contentKey)) {
+      gateClosed();
+      return;
+    }
+    try {
+      this.ptyManager.sendKeys(sessionId, option.answerKeys ?? permissionAnswerKeys(option.index));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to send answer";
+      json(res, 400, { ok: false, reason: message });
+      return;
+    }
+    json(res, 200, { ok: true });
+  }
+  /**
+   * Is THIS gate still the one on screen?
+   *
+   * Deliberately stricter than questionMenuStillOpen's "is a menu up": the
+   * staleness window this exists to cover (the ~300ms scrape throttle plus the
+   * wait for the next PTY chunk) is exactly where pendingPermission still says
+   * gate A while the screen has moved to gate B — and since approval gates
+   * repeat their shape, "some gate is open" would wave that through.
+   *
+   * Reads 60 lines because that is the window the detector that produced the
+   * pending gate uses (pty-manager's scrape); `detail` walks up to 6 lines
+   * above the prompt, so a shorter window can truncate it and manufacture a
+   * mismatch on a healthy gate.
+   *
+   * Best-effort, like questionMenuStillOpen: a session we hold no PTY for, or
+   * one that raced away mid-read, is not ours to veto.
+   */
+  async permissionGateStillOpen(sessionId, contentKey) {
+    if (!this.ptyManager.hasSession(sessionId)) return true;
+    try {
+      const onScreen = scrapePermissionGate(await this.ptyManager.getOutputLines(sessionId, 60));
+      return onScreen !== null && permissionGateKey(onScreen) === contentKey;
+    } catch {
+      return true;
+    }
+  }
   async handleSendAnswer(sessionId, req, res) {
     const body = await readBody2(req);
     const pending = this.pendingQuestions.get(sessionId);
@@ -12955,6 +13051,7 @@ function createApiDeps(deps) {
     handleGetOutput: (id, res) => deps.sessionHandlers.handleGetOutput(id, res),
     handleSendInput: (id, req, res) => deps.sessionHandlers.handleSendInput(id, req, res),
     handleSendAnswer: (id, req, res) => deps.sessionHandlers.handleSendAnswer(id, req, res),
+    handlePermissionAnswer: (id, req, res) => deps.sessionHandlers.handlePermissionAnswer(id, req, res),
     handleCancel: (id, res) => deps.sessionHandlers.handleCancel(id, res),
     handleStopSession: (id, res) => deps.sessionHandlers.handleStopSession(id, res),
     handleSetSessionName: (id, req, res) => deps.sessionHandlers.handleSetSessionName(id, req, res),
@@ -13038,7 +13135,8 @@ function createApiDeps(deps) {
                 ...pendingGate.prompt ? { prompt: pendingGate.prompt } : {},
                 ...pendingGate.detail ? { detail: pendingGate.detail } : {},
                 options: pendingGate.options,
-                ...pendingGate.cursor !== void 0 ? { cursor: pendingGate.cursor } : {}
+                ...pendingGate.cursor !== void 0 ? { cursor: pendingGate.cursor } : {},
+                contentKey: permissionGateKey(pendingGate)
               })
             );
           }