gossipcat 0.6.4 → 0.6.5

package/dist-mcp/mcp-server.js

@@ -44350,6 +44350,83 @@ var init_api_mirror_events = __esm({
 });
 
 // packages/relay/src/dashboard/api-bridge.ts
+function validateAskQuestions(raw) {
+  if (!Array.isArray(raw) || raw.length === 0) {
+    return { error: "questions must be a non-empty array" };
+  }
+  if (raw.length > ASK_MAX_QUESTIONS) {
+    return { error: `too many questions (max ${ASK_MAX_QUESTIONS})` };
+  }
+  const out = [];
+  for (let i = 0; i < raw.length; i++) {
+    const q = raw[i];
+    if (!q || typeof q !== "object") {
+      return { error: `question ${i} must be an object` };
+    }
+    if (typeof q.header !== "string" || q.header.trim().length === 0) {
+      return { error: `question ${i} header must be a non-empty string` };
+    }
+    if (q.header.length > ASK_MAX_HEADER) {
+      return { error: `question ${i} header too long (max ${ASK_MAX_HEADER})` };
+    }
+    if (typeof q.question !== "string" || q.question.trim().length === 0) {
+      return { error: `question ${i} question must be a non-empty string` };
+    }
+    if (q.question.length > ASK_MAX_QUESTION) {
+      return { error: `question ${i} question too long (max ${ASK_MAX_QUESTION})` };
+    }
+    if (q.multiSelect !== void 0 && typeof q.multiSelect !== "boolean") {
+      return { error: `question ${i} multiSelect must be a boolean` };
+    }
+    if (q.allowOther !== void 0 && typeof q.allowOther !== "boolean") {
+      return { error: `question ${i} allowOther must be a boolean` };
+    }
+    if (!Array.isArray(q.options) || q.options.length === 0) {
+      return { error: `question ${i} options must be a non-empty array` };
+    }
+    if (q.options.length > ASK_MAX_OPTIONS) {
+      return { error: `question ${i} has too many options (max ${ASK_MAX_OPTIONS})` };
+    }
+    const options = [];
+    const labels = /* @__PURE__ */ new Set();
+    for (let j = 0; j < q.options.length; j++) {
+      const o = q.options[j];
+      if (!o || typeof o !== "object") {
+        return { error: `question ${i} option ${j} must be an object` };
+      }
+      if (typeof o.label !== "string" || o.label.trim().length === 0) {
+        return { error: `question ${i} option ${j} label must be a non-empty string` };
+      }
+      if (o.label.length > ASK_MAX_LABEL) {
+        return { error: `question ${i} option ${j} label too long (max ${ASK_MAX_LABEL})` };
+      }
+      if (labels.has(o.label)) {
+        return { error: `question ${i} has a duplicate option label` };
+      }
+      labels.add(o.label);
+      const opt = { label: o.label };
+      if (o.description !== void 0 && o.description !== null) {
+        if (typeof o.description !== "string") {
+          return { error: `question ${i} option ${j} description must be a string` };
+        }
+        if (o.description.length > ASK_MAX_DESCRIPTION) {
+          return { error: `question ${i} option ${j} description too long (max ${ASK_MAX_DESCRIPTION})` };
+        }
+        opt.description = o.description;
+      }
+      options.push(opt);
+    }
+    out.push({
+      questionId: `q${i}`,
+      header: q.header,
+      question: q.question,
+      ...q.multiSelect === true ? { multiSelect: true } : {},
+      options,
+      ...q.allowOther === true ? { allowOther: true } : {}
+    });
+  }
+  return { questions: out };
+}
 function isMirrorRole(v) {
   return typeof v === "string" && MIRROR_ROLES.includes(v);
 }
@@ -44359,12 +44436,19 @@ function validateChatId(raw) {
   if (!CHAT_ID_RE.test(v)) return null;
   return v;
 }
-var import_crypto26, MIRROR_ROLES, MIRROR_MAX_TEXT, MIRROR_MAX_FRAMES, CHAT_ID_RE, MAX_MESSAGE_LENGTH, MAX_BRIDGE_CLIENTS, KEEPALIVE_MS2, BACKPRESSURE_EVICT_THRESHOLD2, BridgeHub;
+var import_crypto26, ASK_MAX_QUESTIONS, ASK_MAX_OPTIONS, ASK_MAX_HEADER, ASK_MAX_QUESTION, ASK_MAX_LABEL, ASK_MAX_DESCRIPTION, ASK_MAX_OTHER, MIRROR_ROLES, MIRROR_MAX_TEXT, MIRROR_MAX_FRAMES, CHAT_ID_RE, MAX_MESSAGE_LENGTH, MAX_BRIDGE_CLIENTS, KEEPALIVE_MS2, BACKPRESSURE_EVICT_THRESHOLD2, BridgeHub;
 var init_api_bridge = __esm({
   "packages/relay/src/dashboard/api-bridge.ts"() {
     "use strict";
     import_crypto26 = require("crypto");
     init_api_mirror_events();
+    ASK_MAX_QUESTIONS = 4;
+    ASK_MAX_OPTIONS = 8;
+    ASK_MAX_HEADER = 120;
+    ASK_MAX_QUESTION = 600;
+    ASK_MAX_LABEL = 120;
+    ASK_MAX_DESCRIPTION = 240;
+    ASK_MAX_OTHER = 400;
     MIRROR_ROLES = ["user", "assistant", "activity"];
     MIRROR_MAX_TEXT = 2 * 1024;
     MIRROR_MAX_FRAMES = 64;
@@ -44381,6 +44465,13 @@ var init_api_bridge = __esm({
       // eviction can clearInterval too — the req 'close' handler may never fire on
       // an abrupt res.destroy(), which would otherwise leak the timer.
       keepalives = /* @__PURE__ */ new Map();
+      // Per-client subscribed chat_id (null = no ?chat_id supplied = live-only legacy
+      // consumer). Set when the client is added to this.clients in handleStream.
+      // Server-side filtering in broadcast() uses this: each frame is only delivered
+      // to the client(s) whose subscribed chat_id matches frame.chat_id. A null-
+      // subscribed client receives nothing — the old "shared broadcast to all"
+      // behaviour is intentionally replaced with per-client routing.
+      clientChatId = /* @__PURE__ */ new Map();
       // chat_ids we have seen on an INBOUND POST. Outbound replies bind against this
       // set (consensus f5): the live session can only address a stream the dashboard
       // actually opened, never an arbitrary/forged id. Bounded + TTL'd so a long
@@ -44389,6 +44480,16 @@ var init_api_bridge = __esm({
       static MAX_KNOWN_CHAT_IDS = 64;
       static CHAT_ID_TTL_MS = 2 * 60 * 60 * 1e3;
       // 2h, mirror chat-session-store
+      // ── Outstanding-question registry (gossip_ask round-trip) ───────────────────
+      // qid → {chatId, questions, at}. An inbound answer is validated against the
+      // EXACT set that was asked: the questionId must exist, each selected label must
+      // be one of that question's option labels, `other` only when allowOther. The
+      // registry is bounded + TTL'd (fail-closed eviction) so a long-running session
+      // can't grow it unbounded and a stale qid can never be answered.
+      outstandingQuestions = /* @__PURE__ */ new Map();
+      static MAX_OUTSTANDING_QUESTIONS = 64;
+      static QUESTION_TTL_MS = 2 * 60 * 60 * 1e3;
+      // 2h, mirror knownChatIds
       // ── Mirror state (spec v2 §3) ──────────────────────────────────────────────
       // chat_ids eligible to RECEIVE mirror frames. SEPARATE from knownChatIds
       // (sonnet:f7/f12). P1#1: this set is seeded ONLY from the relay's validated
@@ -44398,19 +44499,6 @@ var init_api_bridge = __esm({
       // emitReply STILL gates on knownChatIds, so mirroring never widens the
       // outbound reply boundary (api-bridge.ts emitReply isKnownChatId check).
       mirrorChatIds = /* @__PURE__ */ new Map();
-      // The most-recently-registered active mirror chat_id (set in
-      // registerMirrorChatId, cleared/recomputed when that id is TTL-evicted).
-      // Used by emitMirror to route unresolved terminal frames to a live observer
-      // instead of the provisional buffer when one exists (fix: mirror frames
-      // previously fell into _provisional and were dropped by the dashboard client
-      // because bindSession never ran — the browser cannot send a session_id it
-      // doesn't know). SECURITY: only ever a chat_id already in mirrorChatIds.
-      // KNOWN LIMITATION (consensus 96350953-8ce94428): single-pointer, so with
-      // multiple concurrent dashboard tabs only the most-recently-registered one
-      // receives unresolved terminal frames; earlier tabs see no live activity until
-      // they send again. Accepted tradeoff — a strict improvement over the prior
-      // behaviour where the frames went to _provisional and EVERY tab saw nothing.
-      latestMirrorChatId = null;
       // Session→chat_id map (P1#5). The relay has no native "active session
       // chat_id" notion — a no-chat_id inbound POST mints a fresh UUID. We learn the
       // mapping from the dashboard turn: a turn carries BOTH a chat_id (validated)
@@ -44523,6 +44611,165 @@ var init_api_bridge = __esm({
         this.broadcast({ type: "ack", chat_id: chatId, ts: (/* @__PURE__ */ new Date()).toISOString() });
         return true;
       }
+      /**
+       * OUTBOUND: the MCP `gossip_ask` tool asks the dashboard a selection question.
+       * Gates on knownChatIds EXACTLY like emitReply — a question may only target a
+       * stream the dashboard actually opened, never an arbitrary/forged id. On
+       * success the validated question set is registered under `qid` (so a later
+       * inbound answer can be validated against what was asked) and a `question`
+       * frame is fanned out over SSE.
+       *
+       * LIVE-ONLY: like reply/ack, a `question` frame has NO per-chat_id ring — an
+       * unanswered question is LOST on a dashboard reload (acceptable v1). The
+       * registry entry survives a reload (so an answer typed after reconnect would
+       * still validate), but the rendered card does not.
+       *
+       * Returns false (no registration, no broadcast) when the chat_id is
+       * malformed/unbound or no SSE client is connected, so the MCP tool can no-op
+       * honestly — same posture as emitReply.
+       */
+      emitQuestion(rawChatId, qid, questions) {
+        const chatId = validateChatId(rawChatId);
+        if (chatId === null) return false;
+        if (!this.isKnownChatId(chatId)) return false;
+        if (this.clients.size === 0) return false;
+        if (typeof qid !== "string" || qid.length === 0) return false;
+        if (!Array.isArray(questions) || questions.length === 0) return false;
+        this.registerOutstandingQuestion(qid, chatId, questions);
+        this.broadcast({ type: "question", chat_id: chatId, qid, questions, ts: (/* @__PURE__ */ new Date()).toISOString() });
+        return true;
+      }
+      /**
+       * INBOUND ANSWER (UNTRUSTED — this is the security boundary). The dashboard
+       * POSTs `{chat_id, answer:{qid, responses:[{questionId, selected[], other?}]}}`.
+       * VALIDATES fail-closed against the registered question set:
+       *   - chat_id is known (bound to an opened stream);
+       *   - qid is an outstanding question FOR THAT chat_id (cross-chat reuse → 400);
+       *   - each questionId exists in the asked set, with no duplicates / no missing;
+       *   - each `selected` label is one of THAT question's option labels (an unknown
+       *     label → 400; a single-select question accepts at most one label);
+       *   - `other` is only allowed when that question had allowOther, and is trimmed
+       *     + length-capped.
+       * On VALID: a concise channel turn is formatted and delivered to the live CC
+       * session via the SAME sink path inbound chat messages use (so it arrives as a
+       * normal turn), then the qid is deleted (single-use). Returns a route-shaped
+       * {status,payload}: 202 on accept, 400 on any validation failure, 503 when no
+       * sink is wired.
+       */
+      handleAnswer(body) {
+        const b = body ?? {};
+        const chatId = validateChatId(b.chat_id);
+        if (chatId === null) {
+          return { status: 400, payload: { error: "invalid chat_id" } };
+        }
+        if (!this.isKnownChatId(chatId)) {
+          return { status: 400, payload: { error: "unknown chat_id (not an open dashboard stream)" } };
+        }
+        const answer = b.answer;
+        if (!answer || typeof answer !== "object") {
+          return { status: 400, payload: { error: "answer must be an object" } };
+        }
+        const qid = answer.qid;
+        if (typeof qid !== "string" || qid.length === 0) {
+          return { status: 400, payload: { error: "answer.qid must be a non-empty string" } };
+        }
+        this.evictOutstandingQuestions(Date.now());
+        const outstanding = this.outstandingQuestions.get(qid);
+        if (!outstanding) {
+          return { status: 400, payload: { error: "unknown or expired qid" } };
+        }
+        if (outstanding.chatId !== chatId) {
+          return { status: 400, payload: { error: "qid does not belong to this chat_id" } };
+        }
+        const responses = answer.responses;
+        if (!Array.isArray(responses) || responses.length === 0) {
+          return { status: 400, payload: { error: "answer.responses must be a non-empty array" } };
+        }
+        if (responses.length > outstanding.questions.length) {
+          return { status: 400, payload: { error: "too many responses" } };
+        }
+        const seen = /* @__PURE__ */ new Set();
+        const parts = [];
+        for (const r of responses) {
+          if (!r || typeof r !== "object") {
+            return { status: 400, payload: { error: "each response must be an object" } };
+          }
+          const rr = r;
+          if (typeof rr.questionId !== "string") {
+            return { status: 400, payload: { error: "response.questionId must be a string" } };
+          }
+          const questionId = rr.questionId;
+          if (seen.has(questionId)) {
+            return { status: 400, payload: { error: "duplicate questionId in responses" } };
+          }
+          const q = outstanding.questions.find((x) => x.questionId === questionId);
+          if (!q) {
+            return { status: 400, payload: { error: `unknown questionId "${questionId}"` } };
+          }
+          seen.add(questionId);
+          if (!Array.isArray(rr.selected)) {
+            return { status: 400, payload: { error: "response.selected must be an array" } };
+          }
+          const selected = rr.selected;
+          if (!q.multiSelect && selected.length > 1) {
+            return { status: 400, payload: { error: `question "${questionId}" is single-select` } };
+          }
+          if (selected.length > q.options.length) {
+            return { status: 400, payload: { error: "too many selected labels" } };
+          }
+          const labels = new Set(q.options.map((o) => o.label));
+          const chosen = [];
+          const seenLabels = /* @__PURE__ */ new Set();
+          for (const s of selected) {
+            if (typeof s !== "string" || !labels.has(s)) {
+              return { status: 400, payload: { error: `unknown option label for question "${questionId}"` } };
+            }
+            if (seenLabels.has(s)) {
+              return { status: 400, payload: { error: "duplicate selected label" } };
+            }
+            seenLabels.add(s);
+            chosen.push(s);
+          }
+          let otherText = null;
+          if (rr.other !== void 0 && rr.other !== null) {
+            if (!q.allowOther) {
+              return { status: 400, payload: { error: `question "${questionId}" does not allow other` } };
+            }
+            if (typeof rr.other !== "string") {
+              return { status: 400, payload: { error: "response.other must be a string" } };
+            }
+            const sanitized = rr.other.replace(/[\x00-\x1F\x7F]/g, " ").replace(/\s+/g, " ").replace(/\[answer/gi, "(answer").trim();
+            if (sanitized.length > ASK_MAX_OTHER) {
+              return { status: 400, payload: { error: "other text too long" } };
+            }
+            if (sanitized.length > 0) {
+              otherText = sanitized.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+            }
+          }
+          if (chosen.length === 0 && otherText === null) {
+            return { status: 400, payload: { error: `question "${questionId}" has no selection` } };
+          }
+          const segs = [];
+          if (chosen.length > 0) segs.push(chosen.join(", "));
+          if (otherText !== null) segs.push(`other: "${otherText}"`);
+          parts.push(`${q.header}: ${segs.join(" \xB7 ")}`);
+        }
+        if (!this.sink) {
+          return { status: 503, payload: { error: "No live Claude Code bridge session is active" } };
+        }
+        const turn = `[answer qid=${qid}] ${parts.join(" \xB7 ")}`;
+        let delivered;
+        try {
+          delivered = this.sink(chatId, turn);
+        } catch {
+          delivered = false;
+        }
+        if (!delivered) {
+          return { status: 503, payload: { error: "Bridge sink rejected the answer" } };
+        }
+        this.outstandingQuestions.delete(qid);
+        return { status: 202, payload: { ok: true, qid, chat_id: chatId } };
+      }
       /**
        * MIRROR ingress (spec v2 §3). Validates the (already body-capped + role-
        * checked-at-route) batch a SECOND time at the trust boundary, resolves the
@@ -44594,10 +44841,25 @@ var init_api_bridge = __esm({
             chatId = resolved;
           } else if (this.dropUnresolvedMirror) {
             return { status: 202, payload: { ok: true, chat_id: null, dropped: validated.length } };
-          } else if (this.latestMirrorChatId !== null && this.isMirrorChatId(this.latestMirrorChatId)) {
-            chatId = this.latestMirrorChatId;
           } else {
-            chatId = _BridgeHub.PROVISIONAL_CHAT_ID;
+            this.evictMirrorChatIds(Date.now());
+            const liveIds = Array.from(this.mirrorChatIds.keys());
+            if (liveIds.length > 0) {
+              let totalFrames = 0;
+              for (const id of liveIds) {
+                for (const { role, text } of validated) {
+                  const frame = this.mirror.push(id, role, text);
+                  this.broadcast(frame);
+                  totalFrames++;
+                }
+              }
+              return {
+                status: 202,
+                payload: { ok: true, chat_id: null, fanout: liveIds.length, frames: totalFrames }
+              };
+            } else {
+              chatId = _BridgeHub.PROVISIONAL_CHAT_ID;
+            }
           }
         }
         const stamped = [];
@@ -44667,6 +44929,7 @@ var init_api_bridge = __esm({
         }
         this.backpressure.set(res, 0);
         this.clients.add(res);
+        this.clientChatId.set(res, chatId);
         const keepalive = setInterval(() => {
           if (chatId !== null) this.touchMirrorChatId(chatId);
           try {
@@ -44680,6 +44943,7 @@ var init_api_bridge = __esm({
         req.on("close", () => {
           this.clearKeepalive(res);
           this.clients.delete(res);
+          this.clientChatId.delete(res);
         });
       }
       /**
@@ -44718,7 +44982,16 @@ var init_api_bridge = __esm({
           return false;
         }
       }
-      /** Fan out one frame to every connected SSE client, with backpressure eviction. */
+      /**
+       * Fan out one frame to matching connected SSE clients (server-side filter),
+       * with backpressure eviction.
+       *
+       * Each frame carries a chat_id. Only the client(s) subscribed to that
+       * chat_id receive the write — clients subscribed to a different chat_id or
+       * with a null subscription (legacy live-only consumer) are skipped. This
+       * eliminates the prior behaviour of broadcasting EVERY frame to ALL clients
+       * (the bandwidth/confidentiality gap noted in the multi-tab fix spec).
+       */
       broadcast(frame) {
         const idLine = "id" in frame && typeof frame.id === "number" ? `id: ${frame.id}
 ` : "";
@@ -44726,6 +44999,8 @@ var init_api_bridge = __esm({
 
 `;
         for (const res of this.clients) {
+          const subscribedChatId = this.clientChatId.get(res) ?? null;
+          if (subscribedChatId === null || subscribedChatId !== frame.chat_id) continue;
           try {
             const ok = res.write(data);
             if (ok) {
@@ -44737,11 +45012,13 @@ var init_api_bridge = __esm({
                 this.clearKeepalive(res);
                 res.destroy();
                 this.clients.delete(res);
+                this.clientChatId.delete(res);
               }
             }
           } catch {
             this.clearKeepalive(res);
             this.clients.delete(res);
+            this.clientChatId.delete(res);
           }
         }
       }
@@ -44790,6 +45067,34 @@ var init_api_bridge = __esm({
           if (now - v > _BridgeHub.CHAT_ID_TTL_MS) this.knownChatIds.delete(k);
         }
       }
+      // ── Outstanding-question registry helpers (gossip_ask) ──────────────────────
+      /**
+       * Register a validated question set under `qid`. Bounded + TTL'd: a stale
+       * entry is reaped before insert, and at capacity the oldest entry is dropped
+       * to make room (fail-closed — an unanswered old question is forgotten rather
+       * than letting the map grow unbounded).
+       */
+      registerOutstandingQuestion(qid, chatId, questions) {
+        const now = Date.now();
+        this.evictOutstandingQuestions(now);
+        if (!this.outstandingQuestions.has(qid) && this.outstandingQuestions.size >= _BridgeHub.MAX_OUTSTANDING_QUESTIONS) {
+          let oldestKey = null;
+          let oldest = Infinity;
+          for (const [k, v] of this.outstandingQuestions) {
+            if (v.at < oldest) {
+              oldest = v.at;
+              oldestKey = k;
+            }
+          }
+          if (oldestKey !== null) this.outstandingQuestions.delete(oldestKey);
+        }
+        this.outstandingQuestions.set(qid, { chatId, questions, at: now });
+      }
+      evictOutstandingQuestions(now) {
+        for (const [k, v] of this.outstandingQuestions) {
+          if (now - v.at > _BridgeHub.QUESTION_TTL_MS) this.outstandingQuestions.delete(k);
+        }
+      }
       // ── Mirror chat-id registry (SEPARATE from knownChatIds — P1#1/sonnet:f7) ──
       // Same bounded + TTL eviction discipline as knownChatIds, but a DISTINCT map:
       // mirrorChatIds gates emitMirror; knownChatIds gates emitReply. Keeping them
@@ -44816,7 +45121,6 @@ var init_api_bridge = __esm({
           if (oldestKey !== null) this.mirrorChatIds.delete(oldestKey);
         }
         this.mirrorChatIds.set(chatId, now);
-        this.latestMirrorChatId = chatId;
         if (isNew) this.backfillProvisional(chatId, now);
       }
       /**
@@ -44837,23 +45141,10 @@ var init_api_bridge = __esm({
         return this.mirrorChatIds.has(chatId);
       }
       evictMirrorChatIds(now) {
-        let evictedLatest = false;
         for (const [k, v] of this.mirrorChatIds) {
           if (now - v > _BridgeHub.CHAT_ID_TTL_MS) {
             this.mirrorChatIds.delete(k);
-            if (k === this.latestMirrorChatId) evictedLatest = true;
-          }
-        }
-        if (evictedLatest) {
-          let newestKey = null;
-          let newest = -Infinity;
-          for (const [k, v] of this.mirrorChatIds) {
-            if (v > newest) {
-              newest = v;
-              newestKey = k;
-            }
           }
-          this.latestMirrorChatId = newestKey;
         }
       }
       /**
@@ -45213,6 +45504,16 @@ var init_routes = __esm({
       emitBridgeReply(chatId, text) {
         return this.bridge.emitReply(chatId, text);
       }
+      /**
+       * Ask the dashboard a structured selection question (MCP `gossip_ask` tool).
+       * The hub gates chat_id on knownChatIds exactly like emitReply, registers the
+       * validated question set under `qid`, and fans out a `question` frame. Returns
+       * false when the id was unbound/malformed or no SSE client is connected so the
+       * caller can no-op honestly.
+       */
+      emitBridgeQuestion(chatId, qid, questions) {
+        return this.bridge.emitQuestion(chatId, qid, questions);
+      }
       /** Update live context (call when agents connect/disconnect) */
       updateContext(ctx2) {
         if (ctx2.agentConfigs !== void 0) this.ctx.agentConfigs = ctx2.agentConfigs;
@@ -45609,7 +45910,8 @@ var init_routes = __esm({
               this.json(res, 400, { error: "Invalid JSON body" });
               return true;
             }
-            const { status, payload } = this.bridge.handlePost(body);
+            const hasAnswer = body !== null && typeof body === "object" && "answer" in body;
+            const { status, payload } = hasAnswer ? this.bridge.handleAnswer(body) : this.bridge.handlePost(body);
             this.json(res, status, payload);
             return true;
           }
@@ -45670,7 +45972,10 @@ var init_routes = __esm({
           return true;
         }
         const html = (0, import_fs70.readFileSync)(htmlPath, "utf-8");
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.writeHead(200, {
+          "Content-Type": "text/html; charset=utf-8",
+          "Cache-Control": "no-cache"
+        });
         res.end(html);
         return true;
       }
@@ -46346,6 +46651,19 @@ var init_server = __esm({
       emitBridgeReply(chatId, text) {
         return this.dashboardRouter?.emitBridgeReply(chatId, text) ?? false;
       }
+      /**
+       * Ask the dashboard a structured selection question (MCP `gossip_ask` tool).
+       * Mirrors emitBridgeReply: chat_id is re-validated + bound to a stream the
+       * dashboard actually opened (the same knownChatIds gate as emitReply), the
+       * validated question set is registered under `qid` so a later inbound answer
+       * can be validated against what was asked, and a `question` frame fans out
+       * over SSE. Returns false (no registration, no broadcast) when the dashboard
+       * is disabled, the chat_id is unbound/malformed, or no SSE client is connected
+       * — so the caller can no-op honestly rather than claim a delivery.
+       */
+      emitBridgeQuestion(chatId, qid, questions) {
+        return this.dashboardRouter?.emitBridgeQuestion(chatId, qid, questions) ?? false;
+      }
     };
   }
 });
@@ -46381,7 +46699,8 @@ __export(src_exports4, {
   emitDashboardEvent: () => emitDashboardEvent,
   hasMemoryQuery: () => hasMemoryQuery,
   recordMemoryQueryAttribution: () => recordMemoryQueryAttribution,
-  sweepExpiredAgents: () => sweepExpiredAgents
+  sweepExpiredAgents: () => sweepExpiredAgents,
+  validateAskQuestions: () => validateAskQuestions
 });
 var init_src5 = __esm({
   "packages/relay/src/index.ts"() {
@@ -80120,6 +80439,56 @@ Note: write-mode classification unavailable on this native-only install \u2014 a
       return { content: [{ type: "text", text: `Sent reply to dashboard (chat_id ${chat_id}).` }] };
     }
   );
+  server.tool(
+    "gossip_ask",
+    `Dashboard bridge ONLY: ask the dashboard chat (identified by chat_id) a structured selection question. The dashboard renders radios (single-select) or checkboxes (multiSelect) plus an optional free-text "Other"; the user's answer comes back to you as a NORMAL channel turn (a later message prefixed "[answer qid=\u2026]"). This is the dashboard-answerable parallel to the terminal-only AskUserQuestion \u2014 use it when a <channel source="gossipcat" chat_id="..."> dashboard chat is active. NON-BLOCKING: returns at once; do NOT wait for the answer in this call. Pass the chat_id verbatim. Returns an error (no side effect) when no matching dashboard bridge stream is open.`,
+    {
+      chat_id: external_exports.string().describe('The chat_id verbatim from the <channel ... chat_id="..."> dashboard message.'),
+      questions: external_exports.array(
+        external_exports.object({
+          header: external_exports.string().describe('Short label for the question (e.g. "Approach").'),
+          question: external_exports.string().describe("The prompt text shown above the options."),
+          multiSelect: external_exports.boolean().optional().describe("true \u2192 checkboxes (multiple allowed); false/omitted \u2192 radios (one)."),
+          options: external_exports.array(
+            external_exports.object({
+              label: external_exports.string().describe("The option label the user selects; must be unique within the question."),
+              description: external_exports.string().optional().describe("Optional one-line clarification shown under the label.")
+            })
+          ).describe("Selectable options (\u22648)."),
+          allowOther: external_exports.boolean().optional().describe('When true, the dashboard shows a free-text "Other" input.')
+        })
+      ).describe("1\u20134 questions, each with \u22648 options.")
+    },
+    async ({ chat_id, questions }) => {
+      if (typeof chat_id !== "string" || chat_id.trim().length === 0) {
+        return { content: [{ type: "text", text: "gossip_ask error: chat_id is required." }], isError: true };
+      }
+      if (!ctx.relay) {
+        return { content: [{ type: "text", text: "gossip_ask error: no dashboard bridge is active (relay not started)." }], isError: true };
+      }
+      const { validateAskQuestions: validateAskQuestions2 } = await Promise.resolve().then(() => (init_src5(), src_exports4));
+      const validated = validateAskQuestions2(questions);
+      if ("error" in validated) {
+        return { content: [{ type: "text", text: `gossip_ask error: ${validated.error}.` }], isError: true };
+      }
+      const qid = (0, import_crypto37.randomUUID)();
+      let emitted = false;
+      try {
+        emitted = ctx.relay.emitBridgeQuestion(chat_id, qid, validated.questions) === true;
+      } catch {
+        emitted = false;
+      }
+      if (!emitted) {
+        return {
+          content: [{ type: "text", text: `gossip_ask error: no open dashboard bridge stream for chat_id "${chat_id}". This tool only sends to the dashboard channel.` }],
+          isError: true
+        };
+      }
+      return {
+        content: [{ type: "text", text: `Asked the dashboard (qid=${qid}); the user's answer will arrive as a channel turn prefixed "[answer qid=${qid}]". Do not wait for it here.` }]
+      };
+    }
+  );
   server.tool(
     "gossip_status",
     "Check Gossip Mesh system status, host environment, available agents, dashboard URL/key, and agent list with provider/model/skills. Pass slim:true to skip the handbook inline (~21KB savings) on reconnect refreshes.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gossipcat",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Multi-agent orchestration for Claude Code — parallel review, consensus, adaptive dispatch",
   "mcpName": "io.github.ataberk-xyz/gossipcat",
   "repository": {
@@ -59,7 +59,7 @@
   },
   "overrides": {
     "ip-address": "^10.1.1",
-    "hono": ">=4.12.16 <5",
+    "hono": ">=4.12.25 <5",
     "fast-uri": ">=3.1.2",
     "postcss": "^8.5.10",
     "js-yaml": "^4.2.0"