@tomflow/chatloop-extension 0.3.33 → 0.3.35

package/README.md

@@ -24,6 +24,14 @@ Run: chatloop-extension extension <command> --help
 
 **Chrome 独立运行安装路径：**先用 `npm install --prefix "$HOME/.chat-loop/extension/npm" --save-exact --ignore-scripts @tomflow/chatloop-extension@latest` 下载，再在 `chrome://extensions` 加载该目录下的 `node_modules/@tomflow/chatloop-extension/extension`。改目录会改变扩展 ID，必须通过同一个 npm 包的 `host install <id>` 更新 Native Host。详情见 [Extension 主文档](../../docs/extension.md)。
 
+`extension start` 正常只在 `status=IDLE`、用户确认后启动。上一 Session 若是 `BLOCKED`，可在用户**再次明确批准一个不同 projectId 的全新任务**时附上 `replaceBlockedSessionId`（精确 UUID）作为受控替换条件：扩展 Worker 与本机持久指针必须同时指向该 BLOCKED Session，才能允许新 Session；旧执行 Chat 保留审计，旧用户 Turn 永不自动重发。示例只用于说明 JSON 签名，不会自动调用：
+
+```json
+{"projectId":"new-distinct-test","prompt":"新的独立任务","confirmed":true,"replaceBlockedSessionId":"11111111-1111-4111-a111-111111111111"}
+```
+
+`PAGE_ERROR` 且无原生 Retry 时，Worker 仅观察最多四次；只有原用户消息 ID 未变且连续两次证明错误消失才继续观察；若回查时已经识别到同一 Turn 的可靠完成事件或已发出完成事件，则让已排队的完成回执自然结项，避免 4 秒回查窗口错误覆盖 DONE。其余情况依旧 BLOCKED。**不能把当前网页错误消失当成原消息未发送的证据**。
+
 Clean 只清空输入框，不发送，不更改 Owner；必须指定精确标签页 ID 且验证目标。Chrome 已安装扩展不随 npm 包自动安装。本地源码与已发布 npm 版本可能不同，真实结果请看 [CURRENT](../../context/CURRENT.md)。
 
 详细接口和安全边界统一见 [Extension 产品文档](../../docs/extension.md)。

package/bin/native-host.mjs

@@ -28,7 +28,7 @@ process.stdin.on('data',chunk=>{
     }else if(m.op==='session-read'){
       write({status:'OK',session:readSession()});
     }else if(m.op==='session-sync'){
-      write({status:'OK',session:writeSession(m.session)});
+      write({status:'OK',session:writeSession(m.session,m.replaceBlockedSessionId)});
     }else if(m.op==='stale-failure'){
       const confirmed=staleFailureConfirmed(m.id,m.action);
       write({status:confirmed?'STALE_FAILURE_CONFIRMED':'NOT_ELIGIBLE',

package/extension/background.js

@@ -101,7 +101,8 @@ async function saveRun(run) {
   if(next.sessionId){
     const record = sessionProjection(next);
     const saved = await chrome.runtime.sendNativeMessage(SESSION_HOST,
-      {op:"session-sync",session:record}).catch(()=>null);
+      {op:"session-sync",session:record,
+        ...(next.replacedBlockedSessionId?{replaceBlockedSessionId:next.replacedBlockedSessionId}:{})}).catch(()=>null);
     if(saved?.status!=="OK"||saved.session?.sessionId!==next.sessionId)
       throw Error(saved?.code||"SESSION_PERSISTENCE_UNVERIFIED");
   }
@@ -135,24 +136,39 @@ async function sessionStartPrepare(message,sender){
   if(!sessionPage(sender,'start',message.requestId))
     return {status:'DENIED',code:'INVALID_START_SOURCE'};
   const prior=await readRun();
-  if(prior&&prior.phase!=='DONE')
-    return {status:'DENIED',code:'LOOP_ALREADY_ACTIVE'};
-  const disk=await chrome.runtime.sendNativeMessage(SESSION_HOST,{op:'session-read'}).catch(()=>null);
-  if(disk?.status!=='OK')return {status:'DENIED',code:'SESSION_STATE_UNVERIFIED'};
-  if(disk.session&&disk.session.phase!=='DONE')
-    return {status:'DENIED',code:'SESSION_ALREADY_ACTIVE'};
+  // Read the single authenticated intent BEFORE deciding whether a previously
+  // BLOCKED session can be explicitly superseded. Never infer consent from
+  // a failed page or an old session pointer alone.
   const proof=await chrome.runtime.sendNativeMessage(SESSION_HOST,
     {op:'acquire',id:message.requestId,action:'start'}).catch(()=>null);
   const intent=proof?.intent;
   if(proof?.status!=='OK'||intent?.confirmed!==true
     ||typeof intent.projectId!=='string'
     ||!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(intent.projectId)
-    ||typeof intent.prompt!=='string'||!intent.prompt.trim()||intent.prompt.length>4000)
+    ||typeof intent.prompt!=='string'||!intent.prompt.trim()||intent.prompt.length>4000
+    ||(intent.replaceBlockedSessionId!==undefined
+      && !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(intent.replaceBlockedSessionId)))
     return {status:'DENIED',code:'START_INTENT_UNVERIFIED'};
+  const replace=intent.replaceBlockedSessionId||null;
+  const matchingBlocked=prior?.phase==='BLOCKED' && prior.sessionId===replace
+    && prior.projectId!==intent.projectId;
+  if(replace&&!matchingBlocked)return {status:'DENIED',code:'BLOCKED_REPLACEMENT_MISMATCH'};
+  if(prior&&prior.phase!=='DONE'&&!matchingBlocked)
+    return {status:'DENIED',code:'LOOP_ALREADY_ACTIVE'};
+  const disk=await chrome.runtime.sendNativeMessage(SESSION_HOST,{op:'session-read'}).catch(()=>null);
+  if(disk?.status!=='OK')return {status:'DENIED',code:'SESSION_STATE_UNVERIFIED'};
+  if(matchingBlocked&&(!disk.session||disk.session.phase!=='BLOCKED'
+    ||disk.session.sessionId!==replace||disk.session.projectId!==prior.projectId))
+    return {status:'DENIED',code:'SESSION_REPLACEMENT_MISMATCH'};
+  if(disk.session&&disk.session.phase!=='DONE'&&!matchingBlocked)
+    return {status:'DENIED',code:'SESSION_ALREADY_ACTIVE'};
+  // The same blocked task may never be replayed implicitly: a replacement
+  // requires a new project ID and leaves the old Chat intact for audit.
   const next={sessionId:crypto.randomUUID(),projectId:intent.projectId,
     generation:0,phase:'STARTING',action:'START',token:crypto.randomUUID(),
     page:'/',tabId:null,startedAt:Date.now(),
     machineRequestId:message.requestId,machineActionTabId:sender.tab.id,
+    ...(matchingBlocked?{replacedBlockedSessionId:replace}:{}),
     startPrompt:intent.prompt};
   await saveRun(next); // Reserve BEFORE any new Chrome tab or send.
   return {status:'PREPARED',token:next.token,sessionId:next.sessionId};
@@ -303,6 +319,34 @@ async function onTurnBlocked(message, sender) {
   const second = await verify();
   if (!second || first.retryAvailable !== second.retryAvailable)
     return {status: "IGNORED", code: "ERROR_NOT_STABLE"};
+  // A network interruption may show a transient page error without a native
+  // Retry button. Only *observe* for a bounded grace period: never resend an
+  // uncertain user Turn. Resume normal observation only if the EXACT submitted
+  // user identity stays present and two consecutive polls show no page fault.
+  // If the optimistic user message disappears, this is NOT proof of no send.
+  if (reason === "PAGE_ERROR" && second.retryAvailable !== true) {
+    let recovered = 0;
+    for (let attempt = 0; attempt < 4; attempt++) {
+      await new Promise(resolve => setTimeout(resolve, 1000));
+      const proof = await chrome.tabs.sendMessage(previous.tabId,
+        {type: "CHAT_LOOP_TURN_OBSERVE_V1", poll: true}).catch(() => null);
+      const sameTurn = proof?.contract === "chat-loop.turn-observer.v1"
+        && proof.page === previous.page
+        && proof.userKey === previous.newUserKey;
+      // The Observer may emit its verified completion while this error handler
+      // owns the serialized Worker queue. That completion message is waiting
+      // behind us: fail-closing here would discard a real, finished Turn.
+      // TURN_FINISHED or the exact already-emitted state is sufficient proof
+      // that the SAME user Turn recovered; do not invent/send another message.
+      if (sameTurn && (proof.status === "TURN_FINISHED"
+        || proof.status === "IDLE" && proof.reason === "TURN_ALREADY_EMITTED"))
+        return {status: "IGNORED", code: "PAGE_ERROR_COMPLETION_QUEUED"};
+      if (sameTurn && ["RUNNING", "UNKNOWN"].includes(proof.status)) {
+        recovered++;
+        if (recovered === 2) return {status: "IGNORED", code: "PAGE_ERROR_CLEARED_SAME_TURN"};
+      } else recovered = 0;
+    }
+  }
   // A security challenge is an explicit stop condition, not a prompt to retry
   // or evade site access controls. Keep the original Chat and user Turn intact.
   if (reason === "SECURITY_CHALLENGE") {

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Chat Loop Extension",
-  "version": "0.3.33",
+  "version": "0.3.35",
   "description": "Chat Loop browser companion: Eye actions, Turn observer, Continue and Handoff Actions",
   "permissions": [
     "activeTab",

package/lib/bridge.mjs

@@ -26,13 +26,17 @@ export function requestDir(id) {
 export function validateIntent(action, intent) {
   if(action==='start'){
     if(!intent||typeof intent!=='object'||Array.isArray(intent)
-      ||Object.keys(intent).some(k=>!['projectId','prompt','confirmed'].includes(k))
+      ||Object.keys(intent).some(k=>!['projectId','prompt','confirmed','replaceBlockedSessionId'].includes(k))
       ||!(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/).test(intent.projectId||'')
-      ||intent.confirmed!==true||typeof intent.prompt!=='string'
+      ||intent.confirmed!==true
+      || (intent.replaceBlockedSessionId!==undefined
+        && !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(intent.replaceBlockedSessionId))
+      ||typeof intent.prompt!=='string'
       ||!intent.prompt.trim()||intent.prompt.length>4000
       ||/[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(intent.prompt))
       throw Object.assign(Error('Explicit confirmed task and project required'),{code:'INVALID_START_INTENT'});
-    return {projectId:intent.projectId,prompt:intent.prompt,confirmed:true};
+    return {projectId:intent.projectId,prompt:intent.prompt,confirmed:true,
+      ...(intent.replaceBlockedSessionId?{replaceBlockedSessionId:intent.replaceBlockedSessionId}:{})};
   }
   if(action==='clean'){
     if(!intent || typeof intent!=='object' || Array.isArray(intent)

package/lib/session-file.mjs

@@ -47,14 +47,19 @@ export function readSession(){
   try{return validate(JSON.parse(readFileSync(file,'utf8')));}
   catch(e){if(e.code)throw e;throw fail('SESSION_FILE_CORRUPT');}
 }
-export function writeSession(input){
+export function writeSession(input,replaceBlockedSessionId=null){
   const next=validate(input),file=sessionPath(),dir=dirname(file),lock=file+'.lock';
   ensurePrivate(dir);
   let fd;
   try{fd=openSync(lock,'wx',0o600);}catch{throw fail('SESSION_CONCURRENT_UPDATE');}
   try{
     const old=readSession();
-    if(old&&old.sessionId!==next.sessionId&&old.phase!=='DONE')
+    if(replaceBlockedSessionId && (!old||old.sessionId!==next.sessionId
+      && (old.phase!=='BLOCKED'||old.sessionId!==replaceBlockedSessionId)))
+      throw fail('SESSION_REPLACEMENT_MISMATCH');
+    if(old&&old.sessionId!==next.sessionId&&old.phase!=='DONE'
+      && !(old.phase==='BLOCKED' && next.phase==='STARTING'
+        && replaceBlockedSessionId===old.sessionId && next.projectId!==old.projectId))
       throw fail('SESSION_ALREADY_ACTIVE');
     if(old&&old.sessionId===next.sessionId){
       if(next.generation<old.generation)throw fail('SESSION_STALE_GENERATION');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/chatloop-extension",
-  "version": "0.3.33",
+  "version": "0.3.35",
   "type": "module",
   "description": "Chat Loop Extension package: nine formal Action pages and its own native CLI bridge",
   "bin": {