chorus-codes 0.7.0 → 0.7.1

package/dist/daemon/routes/chats-events.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * SSE stream — `/chats/events`. Pushes chat-list mutations
+ * (created/updated/deleted) so the cockpit sidebar shows freshly-fired
+ * chats — including those created via MCP or external curl — without
+ * waiting for a poll cycle.
+ *
+ * The payload is intentionally minimal: `{ chatId, kind, ts }`. The
+ * client refetches the list on any event; we don't try to patch state
+ * incrementally because the list is short (12 most recent) and the
+ * round-trip is cheap.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerChatEventsRoute = registerChatEventsRoute;
+const chat_events_bus_js_1 = require("../../lib/chat-events-bus.js");
+const HEARTBEAT_INTERVAL_MS = 25_000;
+function registerChatEventsRoute(fastify) {
+    fastify.get('/chats/events', async (_request, reply) => {
+        reply.hijack();
+        reply.raw.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache',
+            Connection: 'keep-alive',
+        });
+        // Initial hello so the client knows the channel is open. Some
+        // browsers (and proxies) buffer the first chunk until enough bytes
+        // arrive — sending a comment line forces the headers through.
+        reply.raw.write(': connected\n\n');
+        const onChange = (ev) => {
+            try {
+                reply.raw.write(`data: ${JSON.stringify(ev)}\n\n`);
+            }
+            catch {
+                /* connection closed mid-write */
+            }
+        };
+        chat_events_bus_js_1.chatEventsBus.on('change', onChange);
+        // Heartbeat keeps idle connections alive across NAT timeouts and
+        // makes EventSource's 'error' fire promptly when the daemon dies.
+        const heartbeat = setInterval(() => {
+            try {
+                reply.raw.write(': hb\n\n');
+            }
+            catch {
+                /* ignore */
+            }
+        }, HEARTBEAT_INTERVAL_MS);
+        const cleanup = () => {
+            clearInterval(heartbeat);
+            chat_events_bus_js_1.chatEventsBus.off('change', onChange);
+            try {
+                reply.raw.end();
+            }
+            catch {
+                /* already closed */
+            }
+        };
+        reply.raw.on('close', cleanup);
+        reply.raw.on('error', cleanup);
+    });
+}
+//# sourceMappingURL=chats-events.js.map

package/dist/daemon/routes/chats-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chats-events.js","sourceRoot":"","sources":["../../../src/daemon/routes/chats-events.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAOH,0DAgDC;AApDD,qEAAmF;AAEnF,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,SAAgB,uBAAuB,CAAC,OAAwB;IAC9D,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACrD,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACvB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QAEH,8DAA8D;QAC9D,mEAAmE;QACnE,8DAA8D;QAC9D,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAEnC,MAAM,QAAQ,GAAG,CAAC,EAAmB,EAAQ,EAAE;YAC7C,IAAI,CAAC;gBACH,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;YACnC,CAAC;QACH,CAAC,CAAC;QAEF,kCAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAErC,iEAAiE;QACjE,kEAAkE;QAClE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,CAAC;gBACH,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1B,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,kCAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/daemon/routes/chats-stream.js

@@ -0,0 +1,241 @@
+"use strict";
+/**
+ * SSE stream handler — `/api/v1/chats/:id/stream`. Multiplexes onto an
+ * active runChat via runner-multiplex; replays past phase_events from
+ * DB so a late-attach run page sees history immediately.
+ *
+ * ─────────────────────────────────────────────────────────────────────
+ *  SSE event vocabulary — frozen v0.7. Adding a new event TYPE is
+ *  non-breaking (consumers ignore unknown types). Adding a new payload
+ *  KEY to an existing type is non-breaking. RENAMING a type or REMOVING
+ *  a required key is a wire break — bump /api/v2 first.
+ *
+ *  | type             | required payload                                 |
+ *  |------------------|--------------------------------------------------|
+ *  | phase_start      | chatId, phaseIdx, ts                             |
+ *  | phase_progress   | chatId, phaseIdx, round, role, agent, elapsedMs  |
+ *  | phase_done       | chatId, phaseIdx, ts                             |
+ *  | participant_done | chatId, phaseIdx, round, role, agent             |
+ *  | text_delta       | chatId, text, ts                                 |
+ *  | tool_call        | chatId, tool, args, ts                           |
+ *  | cli_error        | chatId, error: { code, message, lineage? }       |
+ *  | error            | chatId, error: { code, message, details? }       |
+ *  | chat_done        | chatId, status, verdict, replay?, ts             |
+ *
+ *  All `error.code` values come from the canonical enum in
+ *  src/daemon/api-response.ts. `ts` is unix ms (grandfathered — we
+ *  intentionally did NOT convert to ISO 8601 in the v0.7 freeze; new
+ *  fields shipped from v0.8 onward should use ISO 8601).
+ * ─────────────────────────────────────────────────────────────────────
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerChatStreamRoute = registerChatStreamRoute;
+const index_js_1 = require("../../lib/db/index.js");
+const logger_js_1 = require("../../lib/logger.js");
+const api_response_js_1 = require("../api-response.js");
+const runner_multiplex_js_1 = require("../runner-multiplex.js");
+const template_cache_js_1 = require("../template-cache.js");
+const chats_validation_js_1 = require("./chats-validation.js");
+const TERMINAL_STATUSES = [
+    'approved',
+    'merged',
+    'blocked',
+    'cancelled',
+    'failed',
+    'no_review',
+];
+function registerChatStreamRoute(fastify, { tmuxMgr, errorDetector }) {
+    fastify.get('/chats/:id/stream', async (request, reply) => {
+        const param = request.params.id;
+        if (!(0, chats_validation_js_1.isValidChatId)(param)) {
+            reply.code(400);
+            return (0, api_response_js_1.errorResponse)('validation', 'invalid chat id');
+        }
+        try {
+            const chat = await index_js_1.chats.getBySlugOrId(param);
+            if (!chat) {
+                reply.code(404);
+                return (0, api_response_js_1.errorResponse)('not_found', 'chat not found');
+            }
+            // From here on, `chatId` is the row's authoritative ULID — every
+            // downstream key (activeRuns, subscribers, runWithMultiplex) uses
+            // the ULID, never the slug.
+            const chatId = chat.id;
+            const tmplRow = await index_js_1.templates.getById(chat.template_id);
+            if (!tmplRow) {
+                reply.code(404);
+                return (0, api_response_js_1.errorResponse)('not_found', 'template not found');
+            }
+            // Cached by templateId + updated_at so SSE re-attaches don't
+            // re-parse on every browser refresh.
+            let template;
+            try {
+                template = (0, template_cache_js_1.getParsedTemplate)(tmplRow.id, tmplRow.yaml, tmplRow.updated_at);
+            }
+            catch (parseError) {
+                reply.code(400);
+                return (0, api_response_js_1.errorResponse)('validation', `Invalid template: ${parseError instanceof Error ? parseError.message : String(parseError)}`);
+            }
+            // Take ownership of the underlying socket. Without `reply.hijack()`
+            // Fastify would auto-end the response when this async handler
+            // returns — the SSE would close immediately after the initial
+            // replay even though we still want to keep streaming live events.
+            reply.hijack();
+            // Set SSE headers.
+            //
+            // Do NOT add Content-Encoding: gzip here, and do not stick a
+            // buffering proxy in front of this route. SSE is line-delimited
+            // (`data: ...\n\n`); gzip's compression window batches bytes
+            // until flush, which collapses many small events into one frame
+            // and breaks the client's per-event parser.
+            reply.raw.writeHead(200, {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                Connection: 'keep-alive',
+            });
+            const subscriber = {
+                paused: false,
+                queue: [],
+                write: (line) => {
+                    try {
+                        return reply.raw.write(line);
+                    }
+                    catch {
+                        /* connection closed mid-write */
+                        return false;
+                    }
+                },
+                close: () => {
+                    reply.raw.end();
+                },
+            };
+            // Replay past phase_events from DB so a late-attach run page sees
+            // history immediately instead of a blank screen. Best-effort —
+            // DB doesn't capture phase_progress or cli_error, so live tail is
+            // still richer.
+            //
+            // Backpressure: when subscriber.write() returns false (kernel
+            // buffer full), every subsequent reconstructed event must go to
+            // subscriber.queue — NOT keep calling write() into a paused
+            // socket. The drain handler below flushes the queue once the
+            // kernel buffer recovers.
+            const pastEvents = await index_js_1.phaseEvents.list(chatId);
+            for (const ev of pastEvents) {
+                const reconstructed = (0, runner_multiplex_js_1.phaseEventToRunnerEvent)(chatId, ev);
+                if (!reconstructed)
+                    continue;
+                const line = `data: ${JSON.stringify(reconstructed)}\n\n`;
+                if (subscriber.paused) {
+                    subscriber.queue.push(line);
+                    continue;
+                }
+                if (!subscriber.write(line)) {
+                    subscriber.paused = true;
+                }
+            }
+            // If chat is already terminal, replay is enough — close after
+            // sending a synthetic chat_done so the client knows it's caught up.
+            if (TERMINAL_STATUSES.includes(chat.status)) {
+                const line = `data: ${JSON.stringify({
+                    chatId,
+                    type: 'chat_done',
+                    payload: {
+                        status: chat.status === 'approved' ? 'completed' : chat.status,
+                        verdict: chat.status === 'approved' ? 'approved' : chat.status,
+                        ...(chat.pr_url ? { prUrl: chat.pr_url } : {}),
+                        ...(chat.ship_error ? { shipError: chat.ship_error } : {}),
+                        replay: true,
+                    },
+                    ts: chat.finished_at ?? Date.now(),
+                })}\n\n`;
+                subscriber.write(line);
+                reply.raw.end();
+                return;
+            }
+            // CRITICAL: clear `paused` unconditionally on drain even if the
+            // queue is empty. A write that returns false with no queued
+            // follow-up at drain time would otherwise leave the subscriber
+            // permanently paused — every later event would funnel into the
+            // queue (because dispatch in onEvent only queues when paused),
+            // and no further drain ever fires (the kernel buffer is already
+            // empty). Order: unpause first, then flush whatever queued up.
+            const onDrain = () => {
+                if (!subscriber.paused)
+                    return;
+                subscriber.paused = false;
+                while (subscriber.queue.length > 0) {
+                    const queuedLine = subscriber.queue.shift();
+                    const canContinue = subscriber.write(queuedLine);
+                    if (!canContinue) {
+                        subscriber.paused = true;
+                        break;
+                    }
+                }
+            };
+            reply.raw.on('drain', onDrain);
+            // Either attach to an in-flight runner or fire a fresh one. The
+            // singleton invariant — exactly one runChat per chatId at any
+            // time — is what fixes the load-spike bug.
+            const existing = (0, runner_multiplex_js_1.getActiveRun)(chatId);
+            if (existing) {
+                existing.subscribers.add(subscriber);
+                request.raw.on('close', () => {
+                    existing.subscribers.delete(subscriber);
+                    reply.raw.removeListener('drain', onDrain);
+                });
+                return;
+            }
+            // No active run — fire one and register. Persistence + status
+            // updates are part of the multiplexed onEvent so they happen
+            // exactly once even when multiple SSEs subscribe.
+            const run = (0, runner_multiplex_js_1.runWithMultiplex)({ chatId, template, chat, tmuxMgr, errorDetector });
+            // Chain `.catch` on the ActiveRun.promise so an async rejection
+            // from runChat doesn't escape as an unhandled rejection. Node
+            // >= 15 hard-exits the daemon on those — exactly the failure the
+            // launch-eve gemini review flagged on this stream-attached path.
+            run.promise.catch((err) => {
+                (0, logger_js_1.chatLogger)(chatId).error({ err: err instanceof Error ? err.message : String(err) }, 'stream-attached runner failed');
+            });
+            run.subscribers.add(subscriber);
+            request.raw.on('close', () => {
+                run.subscribers.delete(subscriber);
+                reply.raw.removeListener('drain', onDrain);
+            });
+            return;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            request.log.error(error);
+            // Tell Fastify "I own this socket now" before writing on
+            // reply.raw, even on the error path — without this, when the
+            // throw happens BEFORE the success-path reply.hijack() (e.g. a
+            // DB error in chats.getBySlugOrId, or the YAML parse path
+            // failing), Fastify will try to auto-serialize the handler's
+            // return value AFTER we've already written headers + an error
+            // frame. That double-write throws ERR_HTTP_HEADERS_SENT. hijack()
+            // here is idempotent if already called.
+            try {
+                reply.hijack();
+            }
+            catch {
+                /* already hijacked */
+            }
+            if (!reply.raw.headersSent) {
+                reply.raw.writeHead(200, {
+                    'Content-Type': 'text/event-stream',
+                    'Cache-Control': 'no-cache',
+                    Connection: 'keep-alive',
+                });
+                // SSE error event uses the canonical envelope shape so clients
+                // can rely on `error.code` + `error.message` regardless of
+                // whether the failure surfaced over REST or SSE.
+                reply.raw.write(`data: ${JSON.stringify({
+                    type: 'error',
+                    error: { code: 'internal', message },
+                })}\n\n`);
+            }
+            reply.raw.end();
+        }
+    });
+}
+//# sourceMappingURL=chats-stream.js.map

package/dist/daemon/routes/chats-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chats-stream.js","sourceRoot":"","sources":["../../../src/daemon/routes/chats-stream.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;AAgCH,0DAiNC;AA9OD,oDAAsE;AACtE,mDAAiD;AAEjD,wDAAmD;AAEnD,gEAKgC;AAChC,4DAAyD;AAEzD,+DAAsD;AAEtD,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,QAAQ;IACR,SAAS;IACT,WAAW;IACX,QAAQ;IACR,WAAW;CACH,CAAC;AAOX,SAAgB,uBAAuB,CACrC,OAAwB,EACxB,EAAE,OAAO,EAAE,aAAa,EAA2B;IAEnD,OAAO,CAAC,GAAG,CAA6B,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAA,mCAAa,EAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,IAAA,+BAAa,EAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,gBAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAA,+BAAa,EAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YACtD,CAAC;YACD,iEAAiE;YACjE,kEAAkE;YAClE,4BAA4B;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEvB,MAAM,OAAO,GAAG,MAAM,oBAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAA,+BAAa,EAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;YAC1D,CAAC;YAED,6DAA6D;YAC7D,qCAAqC;YACrC,IAAI,QAAiD,CAAC;YACtD,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAA,qCAAiB,EAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAA,+BAAa,EAClB,YAAY,EACZ,qBAAqB,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,8DAA8D;YAC9D,8DAA8D;YAC9D,kEAAkE;YAClE,KAAK,CAAC,MAAM,EAAE,CAAC;YAEf,mBAAmB;YACnB,EAAE;YACF,6DAA6D;YAC7D,gEAAgE;YAChE,6DAA6D;YAC7D,gEAAgE;YAChE,4CAA4C;YAC5C,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACvB,cAAc,EAAE,mBAAmB;gBACnC,eAAe,EAAE,UAAU;gBAC3B,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAe;gBAC7B,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,EAAE;gBACT,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE;oBACtB,IAAI,CAAC;wBACH,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC/B,CAAC;oBAAC,MAAM,CAAC;wBACP,iCAAiC;wBACjC,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,GAAG,EAAE;oBACV,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBAClB,CAAC;aACF,CAAC;YAEF,kEAAkE;YAClE,+DAA+D;YAC/D,kEAAkE;YAClE,gBAAgB;YAChB,EAAE;YACF,8DAA8D;YAC9D,gEAAgE;YAChE,4DAA4D;YAC5D,6DAA6D;YAC7D,0BAA0B;YAC1B,MAAM,UAAU,GAAG,MAAM,sBAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,MAAM,aAAa,GAAG,IAAA,6CAAuB,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAC7B,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC1D,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;oBACtB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC;YAED,8DAA8D;YAC9D,oEAAoE;YACpE,IAAK,iBAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC;oBACnC,MAAM;oBACN,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;wBAC9D,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;wBAC9D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC9C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1D,MAAM,EAAE,IAAI;qBACb;oBACD,EAAE,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;iBACnC,CAAC,MAAM,CAAC;gBACT,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,gEAAgE;YAChE,4DAA4D;YAC5D,+DAA+D;YAC/D,+DAA+D;YAC/D,+DAA+D;YAC/D,gEAAgE;YAChE,+DAA+D;YAC/D,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,CAAC,UAAU,CAAC,MAAM;oBAAE,OAAO;gBAC/B,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC;gBAC1B,OAAO,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAY,CAAC;oBACtD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBACjD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC;wBACzB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/B,gEAAgE;YAChE,8DAA8D;YAC9D,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,IAAA,kCAAY,EAAC,MAAM,CAAC,CAAC;YACtC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC3B,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBACxC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,8DAA8D;YAC9D,6DAA6D;YAC7D,kDAAkD;YAClD,MAAM,GAAG,GAAG,IAAA,sCAAgB,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YACjF,gEAAgE;YAChE,8DAA8D;YAC9D,iEAAiE;YACjE,iEAAiE;YACjE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACjC,IAAA,sBAAU,EAAC,MAAM,CAAC,CAAC,KAAK,CACtB,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,+BAA+B,CAChC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC3B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,yDAAyD;YACzD,6DAA6D;YAC7D,+DAA+D;YAC/D,0DAA0D;YAC1D,6DAA6D;YAC7D,8DAA8D;YAC9D,kEAAkE;YAClE,wCAAwC;YACxC,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACvB,cAAc,EAAE,mBAAmB;oBACnC,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,YAAY;iBACzB,CAAC,CAAC;gBACH,+DAA+D;gBAC/D,2DAA2D;gBAC3D,iDAAiD;gBACjD,KAAK,CAAC,GAAG,CAAC,KAAK,CACb,SAAS,IAAI,CAAC,SAAS,CAAC;oBACtB,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE;iBACrC,CAAC,MAAM,CACT,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/daemon/routes/chats-validation.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidChatId = isValidChatId;
+// Permissive chatId validator — the runner uses ULIDs (26-char Base32)
+// but we keep older fixtures + the MCP create_chat surface in mind, so
+// allow any short alphanumeric/dash string. Belt-and-braces against
+// unbounded user input becoming a filesystem path or log file name (DoS
+// via 100 MB id).
+const CHAT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+function isValidChatId(value) {
+    return typeof value === 'string' && CHAT_ID_RE.test(value);
+}
+//# sourceMappingURL=chats-validation.js.map

package/dist/daemon/routes/chats-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chats-validation.js","sourceRoot":"","sources":["../../../src/daemon/routes/chats-validation.ts"],"names":[],"mappings":";;AAOA,sCAEC;AATD,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,wEAAwE;AACxE,kBAAkB;AAClB,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C,SAAgB,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC"}