baychat 0.8.1 → 0.9.0

package/dist/relay/queue.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionQueue = void 0;
+/**
+ * Per-session serialisation.
+ *
+ * The hard invariant: for any one session there is at most ONE delivery in
+ * flight at a time. Two concurrent wakes for the same session means two turns
+ * answering the same room from the same identity — an interactive turn and a
+ * headless resume racing, each unaware of the other, both replying. That is the
+ * failure this class exists to prevent, and it is why every wake path goes
+ * through `push` rather than calling the adapter directly.
+ *
+ * Messages that arrive while a turn is running are not dropped and do not
+ * spawn a second turn: they accumulate and are handed to the next delivery as
+ * one batch. Coalescing matters because a headless resume is expensive — three
+ * messages arriving during one run should produce one follow-up turn, not
+ * three.
+ */
+class SessionQueue {
+    deliver;
+    onError;
+    /** Buffered messages per session, awaiting the next free slot. */
+    buffers = new Map();
+    /** Sessions with a delivery currently in flight. */
+    running = new Set();
+    /** Resolvers for `idle()`, so tests and shutdown can await quiescence. */
+    idleWaiters = [];
+    constructor(
+    /**
+     * Delivers one batch. Must not throw for ordinary failures — a failed
+     * delivery is reported through DeliveryOutcome, not by rejecting. A
+     * rejection is treated as a crashed turn: it is logged by the caller's
+     * handler and the slot is freed so the session isn't wedged forever.
+     */
+    deliver, onError = () => { }) {
+        this.deliver = deliver;
+        this.onError = onError;
+    }
+    /** Queue a message for a session, starting a delivery if none is running. */
+    push(session, message) {
+        const buf = this.buffers.get(session) ?? [];
+        // De-dupe inside the buffer too: the same event can legitimately arrive
+        // twice across a cursor re-baseline (409 recovery re-reads from a
+        // watermark), and a batch must not show the room the same line twice.
+        if (!buf.some((m) => m.id === message.id)) {
+            buf.push(message);
+            this.buffers.set(session, buf);
+        }
+        void this.drain(session);
+    }
+    async drain(session) {
+        if (this.running.has(session))
+            return; // a turn owns this session — it will pick the buffer up
+        const buf = this.buffers.get(session);
+        if (!buf || buf.length === 0)
+            return;
+        this.running.add(session);
+        try {
+            // Loop rather than recurse: messages that land *during* the delivery are
+            // picked up here without releasing the slot in between, so there is no
+            // window where a second drain could start a concurrent turn.
+            while (true) {
+                const batch = this.buffers.get(session) ?? [];
+                if (batch.length === 0)
+                    break;
+                this.buffers.delete(session);
+                try {
+                    await this.deliver(session, batch);
+                }
+                catch (err) {
+                    // A thrown delivery must not strand the session. Report and move on:
+                    // the batch is already consumed, and retrying it blindly risks
+                    // double-answering if the turn actually ran.
+                    this.onError(session, err);
+                }
+            }
+        }
+        finally {
+            this.running.delete(session);
+            this.buffers.delete(session);
+            this.notifyIfIdle();
+        }
+    }
+    /** True while any session has a delivery in flight. */
+    get busy() {
+        return this.running.size > 0;
+    }
+    /** Sessions with a delivery in flight — surfaced by `relay status`. */
+    activeSessions() {
+        return [...this.running];
+    }
+    /** Resolves once every in-flight delivery has finished. */
+    idle() {
+        if (!this.busy)
+            return Promise.resolve();
+        return new Promise((resolve) => this.idleWaiters.push(resolve));
+    }
+    notifyIfIdle() {
+        if (this.busy)
+            return;
+        const waiters = this.idleWaiters;
+        this.idleWaiters = [];
+        for (const w of waiters)
+            w();
+    }
+}
+exports.SessionQueue = SessionQueue;

package/dist/relay/registry.js

@@ -0,0 +1,151 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionRegistry = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const FILE = "relay-sessions.json";
+function registryPath() {
+    return path.join((0, config_1.configDir)(), FILE);
+}
+/**
+ * The set of local sessions the relay can wake, keyed by BayChat session name.
+ *
+ * Persisted because `resumeId` is the difference between a headless wake that
+ * continues the right conversation and one that is refused as `pending`. A
+ * daemon restart (or a reboot) must not silently downgrade every session to
+ * "cannot resume safely" — so what `attach` learned is written to disk.
+ *
+ * `attached` is deliberately NOT persisted: it describes a live socket, and a
+ * process that just started holds none. Loading it as `true` would make the
+ * daemon believe someone is listening and route wakes into nothing.
+ */
+class SessionRegistry {
+    filePath;
+    sessions = new Map();
+    constructor(filePath = registryPath()) {
+        this.filePath = filePath;
+    }
+    load() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.filePath, "utf8"));
+            if (!raw || typeof raw !== "object")
+                return;
+            for (const [name, value] of Object.entries(raw)) {
+                if (!value || typeof value !== "object")
+                    continue;
+                this.sessions.set(name, { ...value, name, attached: false });
+            }
+        }
+        catch {
+            // Missing or corrupt — an empty registry is the correct reading. Every
+            // wake then reports `pending` with a reason, which is visible in
+            // `relay status`, rather than failing silently.
+        }
+    }
+    save() {
+        const out = {};
+        for (const [name, target] of this.sessions) {
+            const { attached: _attached, ...persisted } = target;
+            out[name] = persisted;
+        }
+        try {
+            fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+            fs.writeFileSync(this.filePath, JSON.stringify(out, null, 2), { mode: 0o600 });
+        }
+        catch {
+            // A registry we cannot persist still works for this process's lifetime;
+            // losing it costs resume ids after a restart, not correctness now.
+        }
+    }
+    /**
+     * Record (or update) a target. Merges rather than replaces: an `attach` that
+     * omits `resumeId` must not erase one an earlier attach established, or the
+     * next detached wake would report `pending` for a session we can in fact
+     * resume.
+     */
+    upsert(target) {
+        const existing = this.sessions.get(target.name);
+        const merged = {
+            registeredAt: existing?.registeredAt ?? new Date().toISOString(),
+            ...existing,
+            ...stripUndefined(target),
+            name: target.name,
+            runtime: target.runtime,
+        };
+        this.sessions.set(target.name, merged);
+        this.save();
+        return merged;
+    }
+    get(name) {
+        return this.sessions.get(name);
+    }
+    all() {
+        return [...this.sessions.values()];
+    }
+    setAttached(name, attached) {
+        const t = this.sessions.get(name);
+        if (t)
+            t.attached = attached;
+    }
+    /**
+     * Drop targets whose session is no longer live server-side.
+     *
+     * A session ended from the app (Settings → Devices → Sessions → End) stops
+     * appearing in the device poll. Keeping a local target for it would leave a
+     * headless resume firing into a terminal the owner deliberately parked.
+     *
+     * Attached sessions are never pruned: a live socket outranks a poll, which
+     * may simply have raced a join that hasn't been stamped live yet.
+     */
+    pruneToLive(liveNames) {
+        const live = new Set(liveNames);
+        const dropped = [];
+        for (const [name, target] of this.sessions) {
+            if (!live.has(name) && !target.attached) {
+                this.sessions.delete(name);
+                dropped.push(name);
+            }
+        }
+        if (dropped.length > 0)
+            this.save();
+        return dropped;
+    }
+}
+exports.SessionRegistry = SessionRegistry;
+function stripUndefined(obj) {
+    return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
+}

package/dist/relay/socket.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.socketPath = socketPath;
+exports.pidFilePath = pidFilePath;
+exports.createFrameReader = createFrameReader;
+exports.writeFrame = writeFrame;
+exports.probeSocket = probeSocket;
+exports.unlinkStaleSocket = unlinkStaleSocket;
+const fs = __importStar(require("fs"));
+const net = __importStar(require("net"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+/**
+ * Where the attach socket lives.
+ *
+ * `XDG_RUNTIME_DIR` is the right home: it is user-private (0700), on tmpfs, and
+ * cleared on logout, so a stale socket never outlives the session that made it.
+ * The config-dir fallback covers boxes without it (some containers, macOS).
+ */
+function socketPath() {
+    const override = process.env.BAYCHAT_RELAY_SOCKET;
+    if (override)
+        return override;
+    const runtimeDir = process.env.XDG_RUNTIME_DIR;
+    if (runtimeDir)
+        return path.join(runtimeDir, "baychat-relay.sock");
+    return path.join((0, config_1.configDir)(), "relay.sock");
+}
+function pidFilePath() {
+    return path.join((0, config_1.configDir)(), "relay.pid");
+}
+/** Frames are newline-delimited JSON; this splits a stream into whole ones. */
+function createFrameReader(onFrame, onBad) {
+    let buffer = "";
+    return (chunk) => {
+        buffer += chunk.toString();
+        // A peer that never sends a newline must not grow this unboundedly.
+        if (buffer.length > 1_000_000) {
+            buffer = "";
+            onBad?.("frame too large");
+            return;
+        }
+        let idx;
+        while ((idx = buffer.indexOf("\n")) >= 0) {
+            const line = buffer.slice(0, idx).trim();
+            buffer = buffer.slice(idx + 1);
+            if (!line)
+                continue;
+            try {
+                onFrame(JSON.parse(line));
+            }
+            catch {
+                onBad?.(line);
+            }
+        }
+    };
+}
+function writeFrame(sock, frame) {
+    sock.write(JSON.stringify(frame) + "\n");
+}
+/**
+ * Is a daemon already listening?
+ *
+ * A socket file on disk proves nothing — a killed daemon leaves one behind. The
+ * only honest test is to connect: ECONNREFUSED means the file is stale and safe
+ * to unlink, which is what lets `relay start` recover from a hard kill without
+ * a human deleting files.
+ */
+function probeSocket(sockPath, timeoutMs = 1_000) {
+    return new Promise((resolve) => {
+        if (!fs.existsSync(sockPath))
+            return resolve(false);
+        const sock = net.createConnection(sockPath);
+        const done = (alive) => {
+            sock.destroy();
+            resolve(alive);
+        };
+        sock.setTimeout(timeoutMs, () => done(false));
+        sock.on("connect", () => done(true));
+        sock.on("error", () => done(false));
+    });
+}
+/** Remove a socket file we have already proven dead. */
+function unlinkStaleSocket(sockPath) {
+    try {
+        fs.unlinkSync(sockPath);
+    }
+    catch {
+        // Already gone, or not ours to remove — the listen() that follows will
+        // surface anything that actually matters.
+    }
+}

package/dist/relay/types.js

@@ -0,0 +1,11 @@
+"use strict";
+/**
+ * Shared types for the relay daemon.
+ *
+ * The relay's job is narrow: hold `/updates`, decide which local session an
+ * event belongs to, and wake that session — once, never twice concurrently.
+ * It deliberately does NOT decide whether the session should reply. That
+ * judgement is the server's (`shouldRespond`) and the woken session's; the
+ * relay only carries the message across the process boundary.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/relay/updates.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runUpdatesLoop = runUpdatesLoop;
+const api_1 = require("../api");
+/** Server clamps `wait` into [1s, 30s]; 25s stays under the usual 60s proxy idle timeout. */
+const WAIT_SECONDS = 25;
+/** Backoff bounds for transient failures (5xx, 429, network). */
+const BACKOFF_MIN_MS = 1_000;
+const BACKOFF_MAX_MS = 30_000;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Transient failures are ridden out, not surfaced. A 502 while the api
+ * container restarts, a network throw, a 429 — all mean "later", not "stop".
+ * Real 4xx (401 expired device credential, 403) are terminal: they need a
+ * human, and retrying them forever would hide that.
+ *
+ * 409 is deliberately NOT here — it has its own recovery path and must never
+ * be treated as a generic hiccup, because backing off on it would leave the
+ * cursor permanently unusable and the relay silently deaf.
+ */
+function isTransient(err) {
+    if (err instanceof api_1.ApiError)
+        return err.status >= 500 || err.status === 429;
+    return err instanceof TypeError; // fetch rejects with TypeError on network failure
+}
+/**
+ * Holds `GET /api/device-api/updates` and calls `onEvents` for every batch,
+ * until `signal` aborts.
+ *
+ * The credential is the machine's DEVICE credential, not an agent token. A
+ * laptop has one device login and its sessions mint their own agents when they
+ * join, so no single agent token can see them all — the server fans out across
+ * the device's live sessions and tags each event with the session it belongs to.
+ *
+ * Cursor discipline: the cursor is an opaque blob (really one cursor per session
+ * agent, encoded server-side) and advances only after a batch has been handed to
+ * `onEvents`. The caller queues synchronously, so a crash between poll and queue
+ * costs a re-read — harmless, ids de-dupe — rather than a lost message.
+ *
+ * On 409 `cursor_expired` recovery is ours: the server holds no record of what
+ * this client consumed. We re-read each watched conversation from our own
+ * watermark, then poll again with no cursor.
+ */
+async function runUpdatesLoop(opts) {
+    const { auth, watermarks, onEvents, onSessions, onPoll, onError, signal, request = api_1.apiRequest } = opts;
+    let cursor;
+    let backoff = BACKOFF_MIN_MS;
+    while (!signal.aborted) {
+        try {
+            const q = new URLSearchParams({ wait: String(WAIT_SECONDS) });
+            if (cursor)
+                q.set("cursor", cursor);
+            const res = await request(auth, "GET", `/api/device-api/updates?${q.toString()}`);
+            onSessions?.(res.sessions ?? []);
+            if (res.events.length > 0) {
+                onEvents(res.events.map((e) => ({
+                    conversationId: e.conversationId,
+                    sessionName: e.sessionName,
+                    message: { ...e.message, conversationId: e.conversationId },
+                })));
+            }
+            cursor = res.cursor;
+            onPoll?.(res.cursor);
+            backoff = BACKOFF_MIN_MS; // a clean poll resets the ladder
+        }
+        catch (err) {
+            if (signal.aborted)
+                return;
+            if (err instanceof api_1.ApiError && err.status === 409) {
+                onError?.(err, true);
+                try {
+                    const recovered = await catchUp(auth, watermarks, request);
+                    if (recovered.length > 0)
+                        onEvents(recovered);
+                }
+                catch (catchUpErr) {
+                    // Catch-up itself failed. Do NOT clear the cursor and carry on as if
+                    // recovered — that is the silent-gap case. Back off and let the next
+                    // 409 retry the whole recovery.
+                    onError?.(catchUpErr, true);
+                    await sleep(backoff);
+                    backoff = Math.min(backoff * 2, BACKOFF_MAX_MS);
+                    continue;
+                }
+                cursor = undefined;
+                continue;
+            }
+            if (!isTransient(err)) {
+                onError?.(err, false);
+                throw err; // terminal — an expired device credential needs `npx baychat login`
+            }
+            onError?.(err, true);
+            await sleep(backoff);
+            backoff = Math.min(backoff * 2, BACKOFF_MAX_MS);
+        }
+    }
+}
+/**
+ * Re-read each watched conversation from its watermark. Used only on 409
+ * recovery. Messages we already delivered come back here; the caller's
+ * per-session queue de-dupes them by id, so a replay is cheap rather than
+ * duplicated into the room.
+ *
+ * A 404 for one conversation is skipped rather than fatal: a session may have
+ * ended or left the room between the poll and the recovery, and one dead room
+ * must not strand the catch-up for every other.
+ */
+async function catchUp(auth, watermarks, request) {
+    const events = [];
+    for (const [conversationId, since] of watermarks) {
+        let res;
+        try {
+            res = await request(auth, "GET", `/api/device-api/conversations/${conversationId}/messages?since=${encodeURIComponent(since)}`);
+        }
+        catch (err) {
+            if (err instanceof api_1.ApiError && err.status === 404)
+                continue;
+            throw err;
+        }
+        for (const m of res.messages) {
+            if (m.deletedAt)
+                continue;
+            events.push({
+                conversationId,
+                sessionName: res.sessionName,
+                message: { ...m, conversationId },
+            });
+        }
+    }
+    return events;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "BayChat connector CLI — pair an agent session (Claude Code, Codex) with BayChat and chat in groups",
   "bin": {
     "baychat": "dist/index.js"