aicodeman 1.44.0 → 1.45.0

package/dist/web/agent-inbox-persistence.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @fileoverview Opt-in snapshot of the agent inbox, so pending mail between agents
+ * survives a server restart (the agents themselves keep running in tmux across it).
+ *
+ * Off by default: an install that never turns on `agentInboxPersistEnabled` writes
+ * nothing new to disk. The rules (discussion #558):
+ * - Off means no file. Switching it off deletes the snapshot; the in-memory inboxes
+ *   stay as they are.
+ * - Its own file under `dataPath()`, written 0600 through tmp + rename like
+ *   `intents.json`, since messages carry the same kind of text prompts do. It is never
+ *   read by `/api/search` and `sensitive-path.ts` keeps the file viewer off it.
+ * - Writes are debounced (a burst of posts is one write) and flushed on shutdown.
+ * - Boot pruning is NOT done here: the server calls `agentInbox.pruneExcept()` only
+ *   after the session restore succeeded, so a failed restore leaves the mail alone.
+ *
+ * @module web/agent-inbox-persistence
+ */
+import { type AgentInbox } from './agent-inbox.js';
+export declare class AgentInboxPersistence {
+    private readonly inbox;
+    /** Resolved per call: test HOMEs change between files. */
+    private readonly filePath;
+    private readonly debounceMs;
+    private enabled;
+    private timer;
+    constructor(inbox?: AgentInbox, 
+    /** Resolved per call: test HOMEs change between files. */
+    filePath?: () => string, debounceMs?: number);
+    get isEnabled(): boolean;
+    /**
+     * Boot: apply the setting and, when it is on, load the snapshot into the store.
+     * Returns how many messages were restored. A missing or unreadable file is an
+     * empty inbox, never a failed boot.
+     */
+    load(enabled: boolean): number;
+    /**
+     * The setting changed. On: write the current inboxes now. Off: drop any pending
+     * write and delete the snapshot; memory is untouched.
+     */
+    setEnabled(enabled: boolean): void;
+    /** Shutdown: write a pending change now instead of losing it with the timer. */
+    flush(): void;
+    /** Test hook: drop a pending write and detach from the store. */
+    dispose(): void;
+    private schedule;
+    private cancel;
+    private writeNow;
+    private removeFile;
+}
+/** Process-wide instance wired to `agentInbox`; the server and the settings route use it. */
+export declare const agentInboxPersistence: AgentInboxPersistence;
+//# sourceMappingURL=agent-inbox-persistence.d.ts.map

package/dist/web/agent-inbox-persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-inbox-persistence.d.ts","sourceRoot":"","sources":["../../src/web/agent-inbox-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK/D,qBAAa,qBAAqB;IAK9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAP7B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAA+B;gBAGzB,KAAK,GAAE,UAAuB;IAC/C,0DAA0D;IACzC,QAAQ,GAAE,MAAM,MAA2C,EAC3D,UAAU,GAAE,MAA0B;IAKzD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM;IAiB9B;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAWlC,gFAAgF;IAChF,KAAK,IAAI,IAAI;IAMb,iEAAiE;IACjE,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,UAAU;CASnB;AAED,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}

package/dist/web/agent-inbox-persistence.js

@@ -0,0 +1,139 @@
+/**
+ * @fileoverview Opt-in snapshot of the agent inbox, so pending mail between agents
+ * survives a server restart (the agents themselves keep running in tmux across it).
+ *
+ * Off by default: an install that never turns on `agentInboxPersistEnabled` writes
+ * nothing new to disk. The rules (discussion #558):
+ * - Off means no file. Switching it off deletes the snapshot; the in-memory inboxes
+ *   stay as they are.
+ * - Its own file under `dataPath()`, written 0600 through tmp + rename like
+ *   `intents.json`, since messages carry the same kind of text prompts do. It is never
+ *   read by `/api/search` and `sensitive-path.ts` keeps the file viewer off it.
+ * - Writes are debounced (a burst of posts is one write) and flushed on shutdown.
+ * - Boot pruning is NOT done here: the server calls `agentInbox.pruneExcept()` only
+ *   after the session restore succeeded, so a failed restore leaves the mail alone.
+ *
+ * @module web/agent-inbox-persistence
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { dataPath } from '../config/instance.js';
+import { agentInbox } from './agent-inbox.js';
+/** A burst of posts (a coordinator fanning out to five workers) becomes one write. */
+const WRITE_DEBOUNCE_MS = 250;
+export class AgentInboxPersistence {
+    inbox;
+    filePath;
+    debounceMs;
+    enabled = false;
+    timer = null;
+    constructor(inbox = agentInbox, 
+    /** Resolved per call: test HOMEs change between files. */
+    filePath = () => dataPath('agent-inbox.json'), debounceMs = WRITE_DEBOUNCE_MS) {
+        this.inbox = inbox;
+        this.filePath = filePath;
+        this.debounceMs = debounceMs;
+        this.inbox.onChange = () => this.schedule();
+    }
+    get isEnabled() {
+        return this.enabled;
+    }
+    /**
+     * Boot: apply the setting and, when it is on, load the snapshot into the store.
+     * Returns how many messages were restored. A missing or unreadable file is an
+     * empty inbox, never a failed boot.
+     */
+    load(enabled) {
+        this.enabled = enabled;
+        if (!enabled) {
+            // A file left from an earlier "on" is removed, so off really means no file.
+            this.removeFile();
+            return 0;
+        }
+        const path = this.filePath();
+        if (!existsSync(path))
+            return 0;
+        try {
+            return this.inbox.restore(JSON.parse(readFileSync(path, 'utf-8')));
+        }
+        catch (err) {
+            console.warn(`[AgentInbox] Failed to load ${path}, starting empty:`, err);
+            return 0;
+        }
+    }
+    /**
+     * The setting changed. On: write the current inboxes now. Off: drop any pending
+     * write and delete the snapshot; memory is untouched.
+     */
+    setEnabled(enabled) {
+        if (enabled === this.enabled)
+            return;
+        this.enabled = enabled;
+        if (enabled) {
+            this.writeNow();
+        }
+        else {
+            this.cancel();
+            this.removeFile();
+        }
+    }
+    /** Shutdown: write a pending change now instead of losing it with the timer. */
+    flush() {
+        if (!this.timer)
+            return;
+        this.cancel();
+        this.writeNow();
+    }
+    /** Test hook: drop a pending write and detach from the store. */
+    dispose() {
+        this.cancel();
+        if (this.inbox.onChange)
+            this.inbox.onChange = undefined;
+    }
+    schedule() {
+        if (!this.enabled || this.timer)
+            return;
+        this.timer = setTimeout(() => {
+            this.timer = null;
+            this.writeNow();
+        }, this.debounceMs);
+        // A pending write must not hold the process open; shutdown flushes it explicitly.
+        this.timer.unref();
+    }
+    cancel() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+    }
+    writeNow() {
+        if (!this.enabled)
+            return;
+        const path = this.filePath();
+        const tmpPath = `${path}.tmp`;
+        try {
+            mkdirSync(dirname(path), { recursive: true });
+            // 0600: agent messages can carry anything a prompt can, secrets included.
+            // `mode` applies only when the file is created, and the rename makes every
+            // write a fresh file, so the final file is always 0600.
+            rmSync(tmpPath, { force: true });
+            writeFileSync(tmpPath, JSON.stringify(this.inbox.snapshot()), { mode: 0o600 });
+            renameSync(tmpPath, path);
+        }
+        catch (err) {
+            console.warn(`[AgentInbox] Failed to persist ${path}:`, err);
+        }
+    }
+    removeFile() {
+        const path = this.filePath();
+        try {
+            rmSync(path, { force: true });
+            rmSync(`${path}.tmp`, { force: true });
+        }
+        catch (err) {
+            console.warn(`[AgentInbox] Failed to remove ${path}:`, err);
+        }
+    }
+}
+/** Process-wide instance wired to `agentInbox`; the server and the settings route use it. */
+export const agentInboxPersistence = new AgentInboxPersistence();
+//# sourceMappingURL=agent-inbox-persistence.js.map

package/dist/web/agent-inbox-persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-inbox-persistence.js","sourceRoot":"","sources":["../../src/web/agent-inbox-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AAE/D,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,MAAM,OAAO,qBAAqB;IAKb;IAEA;IACA;IAPX,OAAO,GAAG,KAAK,CAAC;IAChB,KAAK,GAA0B,IAAI,CAAC;IAE5C,YACmB,QAAoB,UAAU;IAC/C,0DAA0D;IACzC,WAAyB,GAAG,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAC3D,aAAqB,iBAAiB;QAHtC,UAAK,GAAL,KAAK,CAAyB;QAE9B,aAAQ,GAAR,QAAQ,CAAmD;QAC3D,eAAU,GAAV,UAAU,CAA4B;QAEvD,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,OAAgB;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,4EAA4E;YAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,IAAI,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,OAAgB;QACzB,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED,iEAAiE;IACjE,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC3D,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,kFAAkF;QAClF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,MAAM;QACZ,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;QAC9B,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,0EAA0E;YAC1E,2EAA2E;YAC3E,wDAAwD;YACxD,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,kCAAkC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,IAAI,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,iCAAiC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAC"}

package/dist/web/agent-inbox.d.ts

@@ -0,0 +1,140 @@
+/**
+ * @fileoverview Agent inbox: a per-session mailbox other agents (or the user) post to,
+ * and the receiving agent reads when it chooses to.
+ *
+ * The other agent-to-agent channel, `POST /api/sessions/:id/input`, types into the
+ * receiver's composer. That is right for a prompt and wrong for a message: every
+ * delivery starts or interrupts a turn, the receiver cannot defer it, and it is one
+ * line only. The inbox stores instead of typing. Nothing here ever reaches a pane.
+ *
+ * Invariants (each pinned in `test/agent-inbox.test.ts`):
+ * - **Read until ack.** A read hands out every pending message and removes nothing.
+ *   A message goes only when the receiver acknowledges its id. "Read and dropped"
+ *   and "done" must not look the same to the sender (discussion #558, the 09-23 case).
+ * - **Seen is the receiver's alone.** `read(…, { receiver: true })` marks what it
+ *   handed out as seen; any other read is a peek and changes nothing. The route
+ *   decides who the receiver is; this module only takes the flag.
+ * - **Bounded, and full refuses.** `MAX_MESSAGES_PER_INBOX`, `MAX_MESSAGE_BYTES` and
+ *   `MAX_INBOX_BYTES`. A post that would cross any of them is refused so the sender
+ *   learns. The oldest message is never dropped to make room.
+ * - **TTL from the message's own timestamp** (`MESSAGE_TTL_MS`). A restore keeps
+ *   `createdAt`, so a restart does not restart the clock. Expiry is lazy: every
+ *   accessor sweeps the inbox it touches, `summary()` and `snapshot()` sweep all.
+ * - **No IO, no `Session` import.** Persistence (`agent-inbox-persistence.ts`) hooks
+ *   `onChange`; long-poll waiters live in `session-wait-registry.ts`.
+ *
+ * @consumedby web/routes/inbox-routes, web/agent-inbox-persistence, web/server
+ * @module web/agent-inbox
+ */
+/** Messages one inbox holds before posts are refused. */
+export declare const MAX_MESSAGES_PER_INBOX = 200;
+/** UTF-8 bytes per message. A bigger payload belongs in the workspace; post its path. */
+export declare const MAX_MESSAGE_BYTES = 16384;
+/** UTF-8 bytes of message text one inbox holds before posts are refused. */
+export declare const MAX_INBOX_BYTES: number;
+/** A message older than this is gone, read or not (same span as the approvals inbox). */
+export declare const MESSAGE_TTL_MS: number;
+/** A message as it is stored (and persisted). */
+interface StoredMessage {
+    id: string;
+    /** The posting session's full id, or null when no session could be resolved (the user). */
+    from: string | null;
+    text: string;
+    /** Epoch ms. The TTL counts from here. */
+    createdAt: number;
+    /** Epoch ms of the first receiver read that handed this message out; null while unseen. */
+    seenAt: number | null;
+}
+/** A message as a read hands it out. */
+export interface InboxMessage {
+    id: string;
+    from: string | null;
+    text: string;
+    createdAt: number;
+    /** True when a receiver read had handed this message out BEFORE this read. */
+    seen: boolean;
+}
+export interface InboxReadResult {
+    /** Every pending message, oldest first: unseen and seen-but-unacked alike. */
+    messages: InboxMessage[];
+    pending: number;
+    /** Unseen after this read (0 after a receiver read; unchanged by a peek). */
+    unseen: number;
+}
+export type PostResult = {
+    ok: true;
+    message: InboxMessage;
+    pending: number;
+    unseen: number;
+} | {
+    ok: false;
+    reason: 'empty' | 'message-too-large' | 'inbox-full-count' | 'inbox-full-bytes';
+};
+/** What `summary()` reports for one session. Counts and times only, never text. */
+export interface InboxCounts {
+    pending: number;
+    unseen: number;
+    /** `createdAt` of the oldest unseen message, null when nothing is unseen. */
+    oldestUnseenAt: number | null;
+}
+/** On-disk shape. `version` lets a later format refuse an older file instead of misreading it. */
+export interface InboxSnapshot {
+    version: 1;
+    inboxes: Record<string, StoredMessage[]>;
+}
+export declare class AgentInbox {
+    private readonly now;
+    private readonly inboxes;
+    /** Any mutation (post, seen, ack, expiry, drop, prune, restore excluded). Persistence hooks this. */
+    onChange: (() => void) | undefined;
+    constructor(now?: () => number);
+    /**
+     * Store a message for `sessionId`. `from` is the RESOLVED sender (the route's job),
+     * never a client-supplied label.
+     */
+    post(sessionId: string, from: string | null, text: string): PostResult;
+    /**
+     * Every pending message, oldest first. Removes nothing. With `receiver`, the
+     * messages handed out are marked seen (each keeps its first `seenAt`); without it
+     * this is a peek and changes nothing at all.
+     */
+    read(sessionId: string, options: {
+        receiver: boolean;
+    }): InboxReadResult;
+    /** Messages no receiver read has handed out yet. A `?wait=` read parks while this is 0. */
+    unseenCount(sessionId: string): number;
+    pendingCount(sessionId: string): number;
+    /**
+     * Remove the given messages. Idempotent: an id that is unknown or already gone is
+     * not an error, so a retry after a lost response succeeds. Returns how many went.
+     */
+    ack(sessionId: string, ids: readonly string[]): number;
+    /** Per-session counts for every inbox that holds anything. Never blocks. */
+    summary(): Map<string, InboxCounts>;
+    /** The session was DELETED: its mail goes with it. Not called on detach or shutdown. */
+    drop(sessionId: string): void;
+    /**
+     * Boot-time sweep, run only after the session restore succeeded: discard inboxes
+     * whose session did not come back. Every route needs a live session, so an orphan
+     * could otherwise never be removed. Returns how many inboxes were dropped.
+     */
+    pruneExcept(keep: Iterable<string>): number;
+    /** Whole-store snapshot for persistence, expired messages already swept. */
+    snapshot(): InboxSnapshot;
+    /**
+     * Replace the store from a snapshot (server boot). Malformed input is skipped entry
+     * by entry rather than thrown: a corrupt file must not stop the server. Expired
+     * messages are not restored, and the caps hold for what is. Does not fire
+     * `onChange`: writing back what was just read would be a no-op at best.
+     */
+    restore(snapshot: unknown): number;
+    /** Test hook: back to an empty store with no listener. */
+    resetForTests(): void;
+    /** The inbox with expired messages swept out (fires `onChange` when it swept any). */
+    private live;
+    private store;
+}
+/** Process-wide store used by the routes and the server wiring. Tests construct their own. */
+export declare const agentInbox: AgentInbox;
+export {};
+//# sourceMappingURL=agent-inbox.d.ts.map

package/dist/web/agent-inbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-inbox.d.ts","sourceRoot":"","sources":["../../src/web/agent-inbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,QAAS,CAAC;AACxC,4EAA4E;AAC5E,eAAO,MAAM,eAAe,QAAa,CAAC;AAC1C,yFAAyF;AACzF,eAAO,MAAM,cAAc,QAAsB,CAAC;AAIlD,iDAAiD;AACjD,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,2FAA2F;IAC3F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,kBAAkB,CAAA;CAAE,CAAC;AAEnG,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;CAC1C;AAID,qBAAa,UAAU;IAMT,OAAO,CAAC,QAAQ,CAAC,GAAG;IALhC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAE9D,qGAAqG;IACrG,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;gBAEN,GAAG,GAAE,MAAM,MAAiB;IAEzD;;;OAGG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU;IActE;;;;OAIG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,eAAe;IAgBxE,2FAA2F;IAC3F,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAItC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIvC;;;OAGG;IACH,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM;IAYtD,4EAA4E;IAC5E,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAenC,wFAAwF;IACxF,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI7B;;;;OAIG;IACH,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM;IAY3C,4EAA4E;IAC5E,QAAQ,IAAI,aAAa;IASzB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM;IA4BlC,0DAA0D;IAC1D,aAAa,IAAI,IAAI;IAKrB,sFAAsF;IACtF,OAAO,CAAC,IAAI;IAaZ,OAAO,CAAC,KAAK;CAId;AAiCD,8FAA8F;AAC9F,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/web/agent-inbox.js

@@ -0,0 +1,258 @@
+/**
+ * @fileoverview Agent inbox: a per-session mailbox other agents (or the user) post to,
+ * and the receiving agent reads when it chooses to.
+ *
+ * The other agent-to-agent channel, `POST /api/sessions/:id/input`, types into the
+ * receiver's composer. That is right for a prompt and wrong for a message: every
+ * delivery starts or interrupts a turn, the receiver cannot defer it, and it is one
+ * line only. The inbox stores instead of typing. Nothing here ever reaches a pane.
+ *
+ * Invariants (each pinned in `test/agent-inbox.test.ts`):
+ * - **Read until ack.** A read hands out every pending message and removes nothing.
+ *   A message goes only when the receiver acknowledges its id. "Read and dropped"
+ *   and "done" must not look the same to the sender (discussion #558, the 09-23 case).
+ * - **Seen is the receiver's alone.** `read(…, { receiver: true })` marks what it
+ *   handed out as seen; any other read is a peek and changes nothing. The route
+ *   decides who the receiver is; this module only takes the flag.
+ * - **Bounded, and full refuses.** `MAX_MESSAGES_PER_INBOX`, `MAX_MESSAGE_BYTES` and
+ *   `MAX_INBOX_BYTES`. A post that would cross any of them is refused so the sender
+ *   learns. The oldest message is never dropped to make room.
+ * - **TTL from the message's own timestamp** (`MESSAGE_TTL_MS`). A restore keeps
+ *   `createdAt`, so a restart does not restart the clock. Expiry is lazy: every
+ *   accessor sweeps the inbox it touches, `summary()` and `snapshot()` sweep all.
+ * - **No IO, no `Session` import.** Persistence (`agent-inbox-persistence.ts`) hooks
+ *   `onChange`; long-poll waiters live in `session-wait-registry.ts`.
+ *
+ * @consumedby web/routes/inbox-routes, web/agent-inbox-persistence, web/server
+ * @module web/agent-inbox
+ */
+import { randomUUID } from 'node:crypto';
+// ─── Bounds ──────────────────────────────────────────────────────────────────
+/** Messages one inbox holds before posts are refused. */
+export const MAX_MESSAGES_PER_INBOX = 200;
+/** UTF-8 bytes per message. A bigger payload belongs in the workspace; post its path. */
+export const MAX_MESSAGE_BYTES = 16_384;
+/** UTF-8 bytes of message text one inbox holds before posts are refused. */
+export const MAX_INBOX_BYTES = 512 * 1024;
+/** A message older than this is gone, read or not (same span as the approvals inbox). */
+export const MESSAGE_TTL_MS = 12 * 60 * 60 * 1000;
+// ─── Store ───────────────────────────────────────────────────────────────────
+export class AgentInbox {
+    now;
+    inboxes = new Map();
+    /** Any mutation (post, seen, ack, expiry, drop, prune, restore excluded). Persistence hooks this. */
+    onChange;
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    /**
+     * Store a message for `sessionId`. `from` is the RESOLVED sender (the route's job),
+     * never a client-supplied label.
+     */
+    post(sessionId, from, text) {
+        if (text.length === 0)
+            return { ok: false, reason: 'empty' };
+        const bytes = Buffer.byteLength(text, 'utf8');
+        if (bytes > MAX_MESSAGE_BYTES)
+            return { ok: false, reason: 'message-too-large' };
+        const queue = this.live(sessionId);
+        if (queue.length >= MAX_MESSAGES_PER_INBOX)
+            return { ok: false, reason: 'inbox-full-count' };
+        if (inboxBytes(queue) + bytes > MAX_INBOX_BYTES)
+            return { ok: false, reason: 'inbox-full-bytes' };
+        const stored = { id: randomUUID(), from, text, createdAt: this.now(), seenAt: null };
+        queue.push(stored);
+        this.inboxes.set(sessionId, queue);
+        this.onChange?.();
+        return { ok: true, message: view(stored), pending: queue.length, unseen: countUnseen(queue) };
+    }
+    /**
+     * Every pending message, oldest first. Removes nothing. With `receiver`, the
+     * messages handed out are marked seen (each keeps its first `seenAt`); without it
+     * this is a peek and changes nothing at all.
+     */
+    read(sessionId, options) {
+        const queue = this.live(sessionId);
+        const messages = queue.map(view);
+        if (options.receiver) {
+            let marked = false;
+            const at = this.now();
+            for (const m of queue) {
+                if (m.seenAt !== null)
+                    continue;
+                m.seenAt = at;
+                marked = true;
+            }
+            if (marked)
+                this.onChange?.();
+        }
+        return { messages, pending: queue.length, unseen: countUnseen(queue) };
+    }
+    /** Messages no receiver read has handed out yet. A `?wait=` read parks while this is 0. */
+    unseenCount(sessionId) {
+        return countUnseen(this.live(sessionId));
+    }
+    pendingCount(sessionId) {
+        return this.live(sessionId).length;
+    }
+    /**
+     * Remove the given messages. Idempotent: an id that is unknown or already gone is
+     * not an error, so a retry after a lost response succeeds. Returns how many went.
+     */
+    ack(sessionId, ids) {
+        const queue = this.live(sessionId);
+        if (queue.length === 0 || ids.length === 0)
+            return 0;
+        const drop = new Set(ids);
+        const kept = queue.filter((m) => !drop.has(m.id));
+        const removed = queue.length - kept.length;
+        if (removed === 0)
+            return 0;
+        this.store(sessionId, kept);
+        this.onChange?.();
+        return removed;
+    }
+    /** Per-session counts for every inbox that holds anything. Never blocks. */
+    summary() {
+        const out = new Map();
+        for (const sessionId of [...this.inboxes.keys()]) {
+            const queue = this.live(sessionId);
+            if (queue.length === 0)
+                continue;
+            const unseen = queue.filter((m) => m.seenAt === null);
+            out.set(sessionId, {
+                pending: queue.length,
+                unseen: unseen.length,
+                oldestUnseenAt: unseen.length > 0 ? unseen[0].createdAt : null,
+            });
+        }
+        return out;
+    }
+    /** The session was DELETED: its mail goes with it. Not called on detach or shutdown. */
+    drop(sessionId) {
+        if (this.inboxes.delete(sessionId))
+            this.onChange?.();
+    }
+    /**
+     * Boot-time sweep, run only after the session restore succeeded: discard inboxes
+     * whose session did not come back. Every route needs a live session, so an orphan
+     * could otherwise never be removed. Returns how many inboxes were dropped.
+     */
+    pruneExcept(keep) {
+        const alive = new Set(keep);
+        let dropped = 0;
+        for (const sessionId of [...this.inboxes.keys()]) {
+            if (alive.has(sessionId))
+                continue;
+            this.inboxes.delete(sessionId);
+            dropped++;
+        }
+        if (dropped > 0)
+            this.onChange?.();
+        return dropped;
+    }
+    /** Whole-store snapshot for persistence, expired messages already swept. */
+    snapshot() {
+        const inboxes = {};
+        for (const sessionId of [...this.inboxes.keys()]) {
+            const queue = this.live(sessionId);
+            if (queue.length > 0)
+                inboxes[sessionId] = queue.map((m) => ({ ...m }));
+        }
+        return { version: 1, inboxes };
+    }
+    /**
+     * Replace the store from a snapshot (server boot). Malformed input is skipped entry
+     * by entry rather than thrown: a corrupt file must not stop the server. Expired
+     * messages are not restored, and the caps hold for what is. Does not fire
+     * `onChange`: writing back what was just read would be a no-op at best.
+     */
+    restore(snapshot) {
+        const data = snapshot;
+        this.inboxes.clear();
+        if (!data || data.version !== 1 || typeof data.inboxes !== 'object' || data.inboxes === null)
+            return 0;
+        const cutoff = this.now() - MESSAGE_TTL_MS;
+        let restored = 0;
+        for (const [sessionId, raw] of Object.entries(data.inboxes)) {
+            if (!Array.isArray(raw))
+                continue;
+            const queue = [];
+            let bytes = 0;
+            // Oldest first whatever order the file has, so the caps keep the oldest mail,
+            // which is the rule for posts too.
+            const entries = raw
+                .filter((entry) => isStoredMessage(entry) && entry.createdAt > cutoff)
+                .sort((a, b) => a.createdAt - b.createdAt);
+            for (const entry of entries) {
+                const size = Buffer.byteLength(entry.text, 'utf8');
+                if (queue.length >= MAX_MESSAGES_PER_INBOX || bytes + size > MAX_INBOX_BYTES)
+                    break;
+                queue.push({ ...entry });
+                bytes += size;
+            }
+            if (queue.length === 0)
+                continue;
+            this.inboxes.set(sessionId, queue);
+            restored += queue.length;
+        }
+        return restored;
+    }
+    /** Test hook: back to an empty store with no listener. */
+    resetForTests() {
+        this.inboxes.clear();
+        this.onChange = undefined;
+    }
+    /** The inbox with expired messages swept out (fires `onChange` when it swept any). */
+    live(sessionId) {
+        const queue = this.inboxes.get(sessionId);
+        if (!queue)
+            return [];
+        const cutoff = this.now() - MESSAGE_TTL_MS;
+        // Every message, not only queue[0]: a clock stepping back can put an older
+        // createdAt behind a newer one. At most 200 entries, so the scan is cheap.
+        if (!queue.some((m) => m.createdAt <= cutoff))
+            return queue;
+        const kept = queue.filter((m) => m.createdAt > cutoff);
+        this.store(sessionId, kept);
+        this.onChange?.();
+        return kept;
+    }
+    store(sessionId, queue) {
+        if (queue.length === 0)
+            this.inboxes.delete(sessionId);
+        else
+            this.inboxes.set(sessionId, queue);
+    }
+}
+function view(m) {
+    return { id: m.id, from: m.from, text: m.text, createdAt: m.createdAt, seen: m.seenAt !== null };
+}
+function countUnseen(queue) {
+    let n = 0;
+    for (const m of queue)
+        if (m.seenAt === null)
+            n++;
+    return n;
+}
+function inboxBytes(queue) {
+    let total = 0;
+    for (const m of queue)
+        total += Buffer.byteLength(m.text, 'utf8');
+    return total;
+}
+function isStoredMessage(value) {
+    const m = value;
+    return (!!m &&
+        typeof m.id === 'string' &&
+        (m.from === null || typeof m.from === 'string') &&
+        typeof m.text === 'string' &&
+        m.text.length > 0 &&
+        Buffer.byteLength(m.text, 'utf8') <= MAX_MESSAGE_BYTES &&
+        typeof m.createdAt === 'number' &&
+        Number.isFinite(m.createdAt) &&
+        (m.seenAt === null || typeof m.seenAt === 'number'));
+}
+/** Process-wide store used by the routes and the server wiring. Tests construct their own. */
+export const agentInbox = new AgentInbox();
+//# sourceMappingURL=agent-inbox.js.map

package/dist/web/agent-inbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-inbox.js","sourceRoot":"","sources":["../../src/web/agent-inbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,gFAAgF;AAEhF,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAC1C,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC;AAC1C,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAoDlD,gFAAgF;AAEhF,MAAM,OAAO,UAAU;IAMQ;IALZ,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE9D,qGAAqG;IACrG,QAAQ,CAA2B;IAEnC,YAA6B,MAAoB,IAAI,CAAC,GAAG;QAA5B,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAE7D;;;OAGG;IACH,IAAI,CAAC,SAAiB,EAAE,IAAmB,EAAE,IAAY;QACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,iBAAiB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,IAAI,sBAAsB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC7F,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAClG,MAAM,MAAM,GAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;IAChG,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,SAAiB,EAAE,OAA8B;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;oBAAE,SAAS;gBAChC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;gBACd,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,MAAM;gBAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,2FAA2F;IAC3F,WAAW,CAAC,SAAiB;QAC3B,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,SAAiB,EAAE,GAAsB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAC5E,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC3C,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;aAC/D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wFAAwF;IACxF,IAAI,CAAC,SAAiB;QACpB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,IAAsB;QAChC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC;YAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAC5E,QAAQ;QACN,MAAM,OAAO,GAAoC,EAAE,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAAiB;QACvB,MAAM,IAAI,GAAG,QAAyC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;QAC3C,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,MAAM,KAAK,GAAoB,EAAE,CAAC;YAClC,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,8EAA8E;YAC9E,mCAAmC;YACnC,MAAM,OAAO,GAAG,GAAG;iBAChB,MAAM,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;iBAC7F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnD,IAAI,KAAK,CAAC,MAAM,IAAI,sBAAsB,IAAI,KAAK,GAAG,IAAI,GAAG,eAAe;oBAAE,MAAM;gBACpF,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBACzB,KAAK,IAAI,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACnC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,0DAA0D;IAC1D,aAAa;QACX,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,CAAC;IAED,sFAAsF;IAC9E,IAAI,CAAC,SAAiB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;QAC3C,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,SAAiB,EAAE,KAAsB;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;;YAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,SAAS,IAAI,CAAC,CAAgB;IAC5B,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,WAAW,CAAC,KAA+B;IAClD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,CAAC,EAAE,CAAC;IAClD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,KAA+B;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,CAAC,GAAG,KAAsC,CAAC;IACjD,OAAO,CACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC/C,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,iBAAiB;QACtD,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC"}

package/dist/web/middleware/auth.d.ts

@@ -26,6 +26,8 @@ interface AuthState {
     hookSecretFailures: StaleExpirationMap<string, number> | null;
     /** Per-username Basic-auth failure bucket (multi-user only). */
     userFailures: StaleExpirationMap<string, number> | null;
+    /** Per-(username, client IP) Basic-auth failure bucket (multi-user only). */
+    userIpFailures: StaleExpirationMap<string, number> | null;
 }
 /**
  * The landing-page case of serveLostWebviewFrame, for the index route. Without

package/dist/web/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/web/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAoB1G,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAIlF,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;KACrB;CACF;AAGD,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD,8EAA8E;AAC9E,UAAU,SAAS;IACjB,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI,CAAC;IACnE,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC9D,gEAAgE;IAChE,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CACzD;AAwLD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAInE;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAI1E;AAgCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAK,GAAG,SAAS,CAoKrG;AA8KD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,EAAE,QAAQ,SAAK,GAAG,IAAI,CAuBxG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAK,GAAG,IAAI,CAwEjG"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/web/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAqB1G,OAAO,EAAqC,KAAK,QAAQ,EAAmB,MAAM,gBAAgB,CAAC;AAInG,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;KACrB;CACF;AAGD,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD,8EAA8E;AAC9E,UAAU,SAAS;IACjB,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI,CAAC;IACnE,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC9D,gEAAgE;IAChE,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD,6EAA6E;IAC7E,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC3D;AAwMD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAInE;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAI1E;AAgCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAK,GAAG,SAAS,CAyLrG;AAgQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,EAAE,QAAQ,SAAK,GAAG,IAAI,CAuBxG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAK,GAAG,IAAI,CAwEjG"}