@threadbase-sh/streamer 1.69.3 → 1.69.5

package/dist/index.cjs

@@ -4142,7 +4142,7 @@ async function readGitBranch(dir) {
 // src/server.ts
 var import_node_ws = require("@hono/node-ws");
 var import_client = require("@temporalio/client");
-var import_crypto13 = require("crypto");
+var import_crypto14 = require("crypto");
 var import_events = require("events");
 var import_fs28 = require("fs");
 var import_promises7 = require("fs/promises");
@@ -9251,6 +9251,7 @@ var ConversationHandlers = class {
 };
 
 // src/api/handlers/sessions.handlers.ts
+var import_crypto9 = require("crypto");
 var import_fs15 = require("fs");
 var import_path16 = require("path");
 
@@ -9622,19 +9623,39 @@ var UnknownOptionError = class extends Error {
   question;
   value;
 };
+var UnsupportedPromptShapeError = class extends Error {
+  constructor(detail) {
+    super(`Unsupported prompt shape: ${detail}`);
+    this.detail = detail;
+    this.name = "UnsupportedPromptShapeError";
+  }
+  detail;
+};
+var IncompleteAnswerError = class extends Error {
+  constructor(question) {
+    super(`Missing answer for question "${question}"`);
+    this.question = question;
+    this.name = "IncompleteAnswerError";
+  }
+  question;
+};
 function answersToKeystrokes(questions, answers) {
-  let out = "";
-  for (const q of questions) {
-    const raw = answers[q.question];
-    if (raw === void 0) {
-      throw new Error(`Missing answer for question "${q.question}"`);
-    }
-    const label = Array.isArray(raw) ? raw[0] : raw;
-    const target = q.options.findIndex((o) => o.label === label);
-    if (target < 0) throw new UnknownOptionError(q.question, label);
-    out += DOWN.repeat(target) + ENTER3;
+  if (questions.length !== 1) {
+    throw new UnsupportedPromptShapeError(`${questions.length} questions`);
   }
-  return out;
+  const q = questions[0];
+  if (q.multiSelect) throw new UnsupportedPromptShapeError("multiSelect");
+  const raw = answers[q.question];
+  if (raw === void 0 || Array.isArray(raw) && raw.length === 0) {
+    throw new IncompleteAnswerError(q.question);
+  }
+  if (Array.isArray(raw) && raw.length > 1) {
+    throw new UnsupportedPromptShapeError(`${raw.length} labels for a single-select question`);
+  }
+  const label = Array.isArray(raw) ? raw[0] : raw;
+  const target = q.options.findIndex((o) => o.label === label);
+  if (target < 0) throw new UnknownOptionError(q.question, label);
+  return DOWN.repeat(target) + ENTER3;
 }
 
 // src/services/questions/resolveAnswer.ts
@@ -9648,6 +9669,10 @@ function resolveAnswer(pending, body) {
     return { ok: true, keys: answersToKeystrokes(pending.questions, answers) };
   } catch (e) {
     if (e instanceof UnknownOptionError) return { ok: false, reason: "unknown_option" };
+    if (e instanceof UnsupportedPromptShapeError) {
+      return { ok: false, reason: "unsupported_prompt_shape" };
+    }
+    if (e instanceof IncompleteAnswerError) return { ok: false, reason: "incomplete_answer" };
     throw e;
   }
 }
@@ -10546,7 +10571,9 @@ var SessionHandlers = class {
     }
     const key = permissionContentKey(gate);
     if (this.pendingPermissionKey.get(sessionId) === key) return;
-    this.pendingPermission.set(sessionId, gate);
+    const prior = this.pendingPermission.get(sessionId);
+    const gateId = prior && permissionGateKey(prior) === permissionGateKey(gate) ? prior.gateId : (0, import_crypto9.randomUUID)();
+    this.pendingPermission.set(sessionId, { ...gate, gateId });
     this.pendingPermissionKey.set(sessionId, key);
     const subscriberCount = this.sessionSubscribers.get(sessionId)?.size ?? 0;
     this.log.info(
@@ -10560,7 +10587,8 @@ var SessionHandlers = class {
       ...gate.detail ? { detail: gate.detail } : {},
       options: gate.options,
       ...gate.cursor !== void 0 ? { cursor: gate.cursor } : {},
-      contentKey: permissionGateKey(gate)
+      contentKey: permissionGateKey(gate),
+      gateId
     });
   }
   /**
@@ -10588,10 +10616,15 @@ var SessionHandlers = class {
     const body = await readBody2(req);
     const contentKey = body?.contentKey;
     const optionIndex = body?.optionIndex;
+    const gateId = body?.gateId;
     if (typeof contentKey !== "string" || !Number.isInteger(optionIndex) || optionIndex < 0) {
       json(res, 400, { ok: false, reason: "Expected { contentKey: string, optionIndex: number }" });
       return;
     }
+    if (gateId !== void 0 && typeof gateId !== "string") {
+      json(res, 400, { ok: false, reason: "Expected gateId to be a string" });
+      return;
+    }
     const gateClosed = () => {
       this.pendingPermission.delete(sessionId);
       this.pendingPermissionKey.delete(sessionId);
@@ -10603,6 +10636,16 @@ var SessionHandlers = class {
       gateClosed();
       return;
     }
+    if (gateId !== void 0 && gateId !== gate.gateId) {
+      json(res, 409, { ok: false, reason: "gate_mismatch" });
+      return;
+    }
+    if (gateId === void 0) {
+      this.log.info(`[permission.answer_legacy_identity] ${sessionId.slice(0, 8)}`, {
+        event: "permission.answer_legacy_identity",
+        sessionId
+      });
+    }
     if (permissionGateKey(gate) !== contentKey) {
       json(res, 409, { ok: false, reason: "gate_mismatch" });
       return;
@@ -10612,7 +10655,8 @@ var SessionHandlers = class {
       json(res, 409, { ok: false, reason: "unknown_option" });
       return;
     }
-    if (!await this.permissionGateStillOpen(sessionId, contentKey)) {
+    const provider = this.sessionStore.getManaged(sessionId)?.provider;
+    if (provider !== CODEX_CLI_PROVIDER && !await this.permissionGateStillOpen(sessionId, contentKey)) {
       gateClosed();
       return;
     }
@@ -10656,7 +10700,14 @@ var SessionHandlers = class {
     const pending = this.pendingQuestions.get(sessionId);
     const resolution = resolveAnswer(pending, body);
     if (!resolution.ok) {
-      json(res, 400, { ok: false, reason: resolution.reason });
+      const unanswerable = resolution.reason === "unsupported_prompt_shape" || resolution.reason === "incomplete_answer";
+      json(res, 400, {
+        ok: false,
+        reason: resolution.reason,
+        ...unanswerable ? {
+          error: "This prompt needs an answer the app cannot give yet; answer it in the terminal"
+        } : {}
+      });
       return;
     }
     const toolUseId = pending?.toolUseId ?? "";
@@ -11320,7 +11371,7 @@ var ManagedSessionsRepository = class {
 };
 
 // src/db/repositories/projects.repository.ts
-var import_crypto9 = require("crypto");
+var import_crypto10 = require("crypto");
 function rowToProject(row) {
   return {
     id: row.id,
@@ -11405,7 +11456,7 @@ var ProjectsRepository = class {
       });
       return rowToProject(this.getById.get(existing.id));
     }
-    const id = (0, import_crypto9.randomUUID)();
+    const id = (0, import_crypto10.randomUUID)();
     this.insert.run({
       id,
       path,
@@ -11535,7 +11586,7 @@ var RuntimeStore = class _RuntimeStore {
 };
 
 // src/e2ee/noise.ts
-var import_crypto10 = require("crypto");
+var import_crypto11 = require("crypto");
 var NOISE_PROTOCOL_NAME = "Noise_IKpsk1_25519_ChaChaPoly_SHA256";
 var PAIR_PROLOGUE = Buffer.from("threadbase-e2ee/1 pair", "utf-8");
 var DHLEN = 32;
@@ -11551,15 +11602,15 @@ var NoiseError = class extends Error {
   }
 };
 function generateKeyPair() {
-  const { publicKey, privateKey } = (0, import_crypto10.generateKeyPairSync)("x25519");
+  const { publicKey, privateKey } = (0, import_crypto11.generateKeyPairSync)("x25519");
   return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
 }
 function keyPairFrom(privateKey) {
-  const publicKey = (0, import_crypto10.createPublicKey)(privateKey);
+  const publicKey = (0, import_crypto11.createPublicKey)(privateKey);
   return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
 }
 function rawPublicKey(key) {
-  const pub = key.type === "public" ? key : (0, import_crypto10.createPublicKey)(key);
+  const pub = key.type === "public" ? key : (0, import_crypto11.createPublicKey)(key);
   const jwk = pub.export({ format: "jwk" });
   if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
     throw new NoiseError("Not an X25519 public key");
@@ -11571,7 +11622,7 @@ function publicKeyFromRaw(raw) {
     throw new NoiseError(`X25519 public key must be ${DHLEN} bytes, got ${raw.length}`);
   }
   try {
-    return (0, import_crypto10.createPublicKey)({
+    return (0, import_crypto11.createPublicKey)({
       key: { kty: "OKP", crv: "X25519", x: raw.toString("base64url") },
       format: "jwk"
     });
@@ -11580,7 +11631,7 @@ function publicKeyFromRaw(raw) {
   }
 }
 function pskFromPairToken(token) {
-  return (0, import_crypto10.createHash)("sha256").update("threadbase-e2ee/1 psk", "utf-8").update(token, "utf-8").digest();
+  return (0, import_crypto11.createHash)("sha256").update("threadbase-e2ee/1 psk", "utf-8").update(token, "utf-8").digest();
 }
 function chachaNonce(n) {
   const nonce = Buffer.alloc(12);
@@ -11599,7 +11650,7 @@ var CipherState = class {
   }
   encryptWithAd(ad, plaintext) {
     if (!this.k) return plaintext;
-    const cipher = (0, import_crypto10.createCipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
+    const cipher = (0, import_crypto11.createCipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
       authTagLength: TAGLEN
     });
     cipher.setAAD(ad, { plaintextLength: plaintext.length });
@@ -11612,7 +11663,7 @@ var CipherState = class {
     if (ciphertext.length < TAGLEN) throw new NoiseError("Ciphertext shorter than its tag");
     const body = ciphertext.subarray(0, ciphertext.length - TAGLEN);
     const tag = ciphertext.subarray(ciphertext.length - TAGLEN);
-    const decipher = (0, import_crypto10.createDecipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
+    const decipher = (0, import_crypto11.createDecipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
       authTagLength: TAGLEN
     });
     decipher.setAAD(ad, { plaintextLength: body.length });
@@ -11633,7 +11684,7 @@ var SymmetricState = class {
   cipher = new CipherState();
   constructor(protocolName) {
     const name = Buffer.from(protocolName, "utf-8");
-    this.h = name.length <= HASHLEN ? Buffer.concat([name, Buffer.alloc(HASHLEN - name.length)]) : (0, import_crypto10.createHash)("sha256").update(name).digest();
+    this.h = name.length <= HASHLEN ? Buffer.concat([name, Buffer.alloc(HASHLEN - name.length)]) : (0, import_crypto11.createHash)("sha256").update(name).digest();
     this.ck = Buffer.from(this.h);
     this.cipher.initializeKey(null);
   }
@@ -11645,7 +11696,7 @@ var SymmetricState = class {
    * subtly wrong.
    */
   hkdf(ikm, outputs) {
-    const raw = Buffer.from((0, import_crypto10.hkdfSync)("sha256", ikm, this.ck, Buffer.alloc(0), HASHLEN * outputs));
+    const raw = Buffer.from((0, import_crypto11.hkdfSync)("sha256", ikm, this.ck, Buffer.alloc(0), HASHLEN * outputs));
     const out = [];
     for (let i = 0; i < outputs; i++) out.push(raw.subarray(i * HASHLEN, (i + 1) * HASHLEN));
     return out;
@@ -11656,7 +11707,7 @@ var SymmetricState = class {
     this.cipher.initializeKey(tempK);
   }
   mixHash(data) {
-    this.h = (0, import_crypto10.createHash)("sha256").update(this.h).update(data).digest();
+    this.h = (0, import_crypto11.createHash)("sha256").update(this.h).update(data).digest();
   }
   /** Spec §5.2. Used only by the `psk` token. */
   mixKeyAndHash(ikm) {
@@ -11686,7 +11737,7 @@ var SymmetricState = class {
   }
 };
 function dh(privateKey, publicKey) {
-  return (0, import_crypto10.diffieHellman)({ privateKey, publicKey });
+  return (0, import_crypto11.diffieHellman)({ privateKey, publicKey });
 }
 function readMessage1(args) {
   assertMessageSize(args.message1, NOISE_MESSAGE_1_OVERHEAD);
@@ -11998,7 +12049,7 @@ var ExternalTailManager = class {
 };
 
 // src/pair-store.ts
-var import_crypto11 = require("crypto");
+var import_crypto12 = require("crypto");
 var DEFAULT_TTL_SECONDS = 180;
 var SWEEP_INTERVAL_MS = 6e4;
 var PairTokenStore = class {
@@ -12013,7 +12064,7 @@ var PairTokenStore = class {
     }
   }
   mint() {
-    const token = `pt_${(0, import_crypto11.randomBytes)(16).toString("hex")}`;
+    const token = `pt_${(0, import_crypto12.randomBytes)(16).toString("hex")}`;
     const expiresAt = Date.now() + this.ttlMs;
     this.current = { token, expiresAt, used: false };
     return {
@@ -13171,7 +13222,8 @@ function createApiDeps(deps) {
                 ...pendingGate.detail ? { detail: pendingGate.detail } : {},
                 options: pendingGate.options,
                 ...pendingGate.cursor !== void 0 ? { cursor: pendingGate.cursor } : {},
-                contentKey: permissionGateKey(pendingGate)
+                contentKey: permissionGateKey(pendingGate),
+                gateId: pendingGate.gateId
               })
             );
           }
@@ -13238,7 +13290,7 @@ function createApiDeps(deps) {
 }
 
 // src/services/cache-integrity/cacheIntegrityMonitor.ts
-var import_crypto12 = require("crypto");
+var import_crypto13 = require("crypto");
 var import_fs23 = require("fs");
 
 // src/services/cache-integrity/alertStore.ts
@@ -13303,7 +13355,7 @@ function envInt(name, fallback) {
 }
 function fingerprintOf(ids) {
   const sorted = [...ids].sort();
-  return `sha256:${(0, import_crypto12.createHash)("sha256").update(sorted.join("\n")).digest("hex")}`;
+  return `sha256:${(0, import_crypto13.createHash)("sha256").update(sorted.join("\n")).digest("hex")}`;
 }
 var CacheIntegrityMonitor = class {
   constructor(cache, wsHub, log10, cacheDir, rescan, runDuringReset) {
@@ -16029,7 +16081,7 @@ var StreamerServer = class {
   runtimeStore = null;
   // Identifies this streamer run. A registry row carrying a different id is a
   // session that outlived the process that started it.
-  streamerInstanceId = (0, import_crypto13.randomUUID)();
+  streamerInstanceId = (0, import_crypto14.randomUUID)();
   cacheMetadataRepo = null;
   // Push registration + delivery state (C7). Null when the cache DB failed to
   // open — registration then degrades to a no-op rather than 500ing.