@threadbase-sh/streamer 1.69.3 → 1.69.4

package/dist/index.cjs

@@ -4142,7 +4142,7 @@ async function readGitBranch(dir) {
 // src/server.ts
 var import_node_ws = require("@hono/node-ws");
 var import_client = require("@temporalio/client");
-var import_crypto13 = require("crypto");
+var import_crypto14 = require("crypto");
 var import_events = require("events");
 var import_fs28 = require("fs");
 var import_promises7 = require("fs/promises");
@@ -9251,6 +9251,7 @@ var ConversationHandlers = class {
 };
 
 // src/api/handlers/sessions.handlers.ts
+var import_crypto9 = require("crypto");
 var import_fs15 = require("fs");
 var import_path16 = require("path");
 
@@ -10546,7 +10547,9 @@ var SessionHandlers = class {
     }
     const key = permissionContentKey(gate);
     if (this.pendingPermissionKey.get(sessionId) === key) return;
-    this.pendingPermission.set(sessionId, gate);
+    const prior = this.pendingPermission.get(sessionId);
+    const gateId = prior && permissionGateKey(prior) === permissionGateKey(gate) ? prior.gateId : (0, import_crypto9.randomUUID)();
+    this.pendingPermission.set(sessionId, { ...gate, gateId });
     this.pendingPermissionKey.set(sessionId, key);
     const subscriberCount = this.sessionSubscribers.get(sessionId)?.size ?? 0;
     this.log.info(
@@ -10560,7 +10563,8 @@ var SessionHandlers = class {
       ...gate.detail ? { detail: gate.detail } : {},
       options: gate.options,
       ...gate.cursor !== void 0 ? { cursor: gate.cursor } : {},
-      contentKey: permissionGateKey(gate)
+      contentKey: permissionGateKey(gate),
+      gateId
     });
   }
   /**
@@ -10588,10 +10592,15 @@ var SessionHandlers = class {
     const body = await readBody2(req);
     const contentKey = body?.contentKey;
     const optionIndex = body?.optionIndex;
+    const gateId = body?.gateId;
     if (typeof contentKey !== "string" || !Number.isInteger(optionIndex) || optionIndex < 0) {
       json(res, 400, { ok: false, reason: "Expected { contentKey: string, optionIndex: number }" });
       return;
     }
+    if (gateId !== void 0 && typeof gateId !== "string") {
+      json(res, 400, { ok: false, reason: "Expected gateId to be a string" });
+      return;
+    }
     const gateClosed = () => {
       this.pendingPermission.delete(sessionId);
       this.pendingPermissionKey.delete(sessionId);
@@ -10603,6 +10612,16 @@ var SessionHandlers = class {
       gateClosed();
       return;
     }
+    if (gateId !== void 0 && gateId !== gate.gateId) {
+      json(res, 409, { ok: false, reason: "gate_mismatch" });
+      return;
+    }
+    if (gateId === void 0) {
+      this.log.info(`[permission.answer_legacy_identity] ${sessionId.slice(0, 8)}`, {
+        event: "permission.answer_legacy_identity",
+        sessionId
+      });
+    }
     if (permissionGateKey(gate) !== contentKey) {
       json(res, 409, { ok: false, reason: "gate_mismatch" });
       return;
@@ -10612,7 +10631,8 @@ var SessionHandlers = class {
       json(res, 409, { ok: false, reason: "unknown_option" });
       return;
     }
-    if (!await this.permissionGateStillOpen(sessionId, contentKey)) {
+    const provider = this.sessionStore.getManaged(sessionId)?.provider;
+    if (provider !== CODEX_CLI_PROVIDER && !await this.permissionGateStillOpen(sessionId, contentKey)) {
       gateClosed();
       return;
     }
@@ -11320,7 +11340,7 @@ var ManagedSessionsRepository = class {
 };
 
 // src/db/repositories/projects.repository.ts
-var import_crypto9 = require("crypto");
+var import_crypto10 = require("crypto");
 function rowToProject(row) {
   return {
     id: row.id,
@@ -11405,7 +11425,7 @@ var ProjectsRepository = class {
       });
       return rowToProject(this.getById.get(existing.id));
     }
-    const id = (0, import_crypto9.randomUUID)();
+    const id = (0, import_crypto10.randomUUID)();
     this.insert.run({
       id,
       path,
@@ -11535,7 +11555,7 @@ var RuntimeStore = class _RuntimeStore {
 };
 
 // src/e2ee/noise.ts
-var import_crypto10 = require("crypto");
+var import_crypto11 = require("crypto");
 var NOISE_PROTOCOL_NAME = "Noise_IKpsk1_25519_ChaChaPoly_SHA256";
 var PAIR_PROLOGUE = Buffer.from("threadbase-e2ee/1 pair", "utf-8");
 var DHLEN = 32;
@@ -11551,15 +11571,15 @@ var NoiseError = class extends Error {
   }
 };
 function generateKeyPair() {
-  const { publicKey, privateKey } = (0, import_crypto10.generateKeyPairSync)("x25519");
+  const { publicKey, privateKey } = (0, import_crypto11.generateKeyPairSync)("x25519");
   return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
 }
 function keyPairFrom(privateKey) {
-  const publicKey = (0, import_crypto10.createPublicKey)(privateKey);
+  const publicKey = (0, import_crypto11.createPublicKey)(privateKey);
   return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
 }
 function rawPublicKey(key) {
-  const pub = key.type === "public" ? key : (0, import_crypto10.createPublicKey)(key);
+  const pub = key.type === "public" ? key : (0, import_crypto11.createPublicKey)(key);
   const jwk = pub.export({ format: "jwk" });
   if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
     throw new NoiseError("Not an X25519 public key");
@@ -11571,7 +11591,7 @@ function publicKeyFromRaw(raw) {
     throw new NoiseError(`X25519 public key must be ${DHLEN} bytes, got ${raw.length}`);
   }
   try {
-    return (0, import_crypto10.createPublicKey)({
+    return (0, import_crypto11.createPublicKey)({
       key: { kty: "OKP", crv: "X25519", x: raw.toString("base64url") },
       format: "jwk"
     });
@@ -11580,7 +11600,7 @@ function publicKeyFromRaw(raw) {
   }
 }
 function pskFromPairToken(token) {
-  return (0, import_crypto10.createHash)("sha256").update("threadbase-e2ee/1 psk", "utf-8").update(token, "utf-8").digest();
+  return (0, import_crypto11.createHash)("sha256").update("threadbase-e2ee/1 psk", "utf-8").update(token, "utf-8").digest();
 }
 function chachaNonce(n) {
   const nonce = Buffer.alloc(12);
@@ -11599,7 +11619,7 @@ var CipherState = class {
   }
   encryptWithAd(ad, plaintext) {
     if (!this.k) return plaintext;
-    const cipher = (0, import_crypto10.createCipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
+    const cipher = (0, import_crypto11.createCipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
       authTagLength: TAGLEN
     });
     cipher.setAAD(ad, { plaintextLength: plaintext.length });
@@ -11612,7 +11632,7 @@ var CipherState = class {
     if (ciphertext.length < TAGLEN) throw new NoiseError("Ciphertext shorter than its tag");
     const body = ciphertext.subarray(0, ciphertext.length - TAGLEN);
     const tag = ciphertext.subarray(ciphertext.length - TAGLEN);
-    const decipher = (0, import_crypto10.createDecipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
+    const decipher = (0, import_crypto11.createDecipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
       authTagLength: TAGLEN
     });
     decipher.setAAD(ad, { plaintextLength: body.length });
@@ -11633,7 +11653,7 @@ var SymmetricState = class {
   cipher = new CipherState();
   constructor(protocolName) {
     const name = Buffer.from(protocolName, "utf-8");
-    this.h = name.length <= HASHLEN ? Buffer.concat([name, Buffer.alloc(HASHLEN - name.length)]) : (0, import_crypto10.createHash)("sha256").update(name).digest();
+    this.h = name.length <= HASHLEN ? Buffer.concat([name, Buffer.alloc(HASHLEN - name.length)]) : (0, import_crypto11.createHash)("sha256").update(name).digest();
     this.ck = Buffer.from(this.h);
     this.cipher.initializeKey(null);
   }
@@ -11645,7 +11665,7 @@ var SymmetricState = class {
    * subtly wrong.
    */
   hkdf(ikm, outputs) {
-    const raw = Buffer.from((0, import_crypto10.hkdfSync)("sha256", ikm, this.ck, Buffer.alloc(0), HASHLEN * outputs));
+    const raw = Buffer.from((0, import_crypto11.hkdfSync)("sha256", ikm, this.ck, Buffer.alloc(0), HASHLEN * outputs));
     const out = [];
     for (let i = 0; i < outputs; i++) out.push(raw.subarray(i * HASHLEN, (i + 1) * HASHLEN));
     return out;
@@ -11656,7 +11676,7 @@ var SymmetricState = class {
     this.cipher.initializeKey(tempK);
   }
   mixHash(data) {
-    this.h = (0, import_crypto10.createHash)("sha256").update(this.h).update(data).digest();
+    this.h = (0, import_crypto11.createHash)("sha256").update(this.h).update(data).digest();
   }
   /** Spec §5.2. Used only by the `psk` token. */
   mixKeyAndHash(ikm) {
@@ -11686,7 +11706,7 @@ var SymmetricState = class {
   }
 };
 function dh(privateKey, publicKey) {
-  return (0, import_crypto10.diffieHellman)({ privateKey, publicKey });
+  return (0, import_crypto11.diffieHellman)({ privateKey, publicKey });
 }
 function readMessage1(args) {
   assertMessageSize(args.message1, NOISE_MESSAGE_1_OVERHEAD);
@@ -11998,7 +12018,7 @@ var ExternalTailManager = class {
 };
 
 // src/pair-store.ts
-var import_crypto11 = require("crypto");
+var import_crypto12 = require("crypto");
 var DEFAULT_TTL_SECONDS = 180;
 var SWEEP_INTERVAL_MS = 6e4;
 var PairTokenStore = class {
@@ -12013,7 +12033,7 @@ var PairTokenStore = class {
     }
   }
   mint() {
-    const token = `pt_${(0, import_crypto11.randomBytes)(16).toString("hex")}`;
+    const token = `pt_${(0, import_crypto12.randomBytes)(16).toString("hex")}`;
     const expiresAt = Date.now() + this.ttlMs;
     this.current = { token, expiresAt, used: false };
     return {
@@ -13171,7 +13191,8 @@ function createApiDeps(deps) {
                 ...pendingGate.detail ? { detail: pendingGate.detail } : {},
                 options: pendingGate.options,
                 ...pendingGate.cursor !== void 0 ? { cursor: pendingGate.cursor } : {},
-                contentKey: permissionGateKey(pendingGate)
+                contentKey: permissionGateKey(pendingGate),
+                gateId: pendingGate.gateId
               })
             );
           }
@@ -13238,7 +13259,7 @@ function createApiDeps(deps) {
 }
 
 // src/services/cache-integrity/cacheIntegrityMonitor.ts
-var import_crypto12 = require("crypto");
+var import_crypto13 = require("crypto");
 var import_fs23 = require("fs");
 
 // src/services/cache-integrity/alertStore.ts
@@ -13303,7 +13324,7 @@ function envInt(name, fallback) {
 }
 function fingerprintOf(ids) {
   const sorted = [...ids].sort();
-  return `sha256:${(0, import_crypto12.createHash)("sha256").update(sorted.join("\n")).digest("hex")}`;
+  return `sha256:${(0, import_crypto13.createHash)("sha256").update(sorted.join("\n")).digest("hex")}`;
 }
 var CacheIntegrityMonitor = class {
   constructor(cache, wsHub, log10, cacheDir, rescan, runDuringReset) {
@@ -16029,7 +16050,7 @@ var StreamerServer = class {
   runtimeStore = null;
   // Identifies this streamer run. A registry row carrying a different id is a
   // session that outlived the process that started it.
-  streamerInstanceId = (0, import_crypto13.randomUUID)();
+  streamerInstanceId = (0, import_crypto14.randomUUID)();
   cacheMetadataRepo = null;
   // Push registration + delivery state (C7). Null when the cache DB failed to
   // open — registration then degrades to a no-op rather than 500ing.