instar 0.26.4 → 0.26.6

package/dist/server/routes.js

@@ -1254,6 +1254,22 @@ export function createRoutes(ctx) {
             adapter: !!ctx.telegram,
             bidirectional: hasTelegramConfig && hasTelegramReplyScript && !!ctx.telegram,
         };
+        // iMessage
+        const hasIMessageConfig = ctx.config.messaging?.some(m => m.type === 'imessage' && m.enabled) ?? false;
+        const imessage = {
+            configured: hasIMessageConfig,
+            adapter: !!ctx.imessage,
+            connected: ctx.imessage?.getConnectionInfo().state === 'connected',
+            endpoints: ctx.imessage ? [
+                'GET /imessage/status',
+                'POST /imessage/validate-send/:recipient — validate + get send token (Layer 3)',
+                'POST /imessage/reply/:recipient — confirm delivery with token (called by imessage-reply.sh)',
+                'GET /imessage/chats',
+                'GET /imessage/chats/:chatId/history',
+                'GET /imessage/search?q=...',
+                'GET /imessage/log-stats',
+            ] : [],
+        };
         // Jobs
         let jobCount = 0;
         let jobSlugs = [];
@@ -1292,6 +1308,7 @@ export function createRoutes(ctx) {
             scripts,
             hooks,
             telegram,
+            imessage,
             scheduler: {
                 enabled: ctx.config.scheduler.enabled,
                 jobCount,
@@ -3253,6 +3270,144 @@ export function createRoutes(ctx) {
             links: ctx.messageBridge.getLinks(),
         });
     });
+    // ── iMessage ─────────────────────────────────────────────────────
+    router.get('/imessage/status', (_req, res) => {
+        if (!ctx.imessage) {
+            res.status(503).json({ error: 'iMessage not configured' });
+            return;
+        }
+        res.json(ctx.imessage.getConnectionInfo());
+    });
+    // ── Outbound Safety: validate-before-send endpoint ──
+    // Called by imessage-reply.sh BEFORE sending. Issues a single-use token
+    // that binds validation to the actual send (TOCTOU mitigation).
+    router.post('/imessage/validate-send/:recipient', (req, res) => {
+        if (!ctx.imessage) {
+            res.status(503).json({ error: 'iMessage not configured' });
+            return;
+        }
+        const { recipient } = req.params;
+        if (!recipient) {
+            res.status(400).json({ error: 'recipient parameter required' });
+            return;
+        }
+        const result = ctx.imessage.validateSend(decodeURIComponent(recipient));
+        if (!result.allowed) {
+            res.status(403).json({
+                allowed: false,
+                reason: result.reason,
+            });
+            return;
+        }
+        res.json({
+            allowed: true,
+            token: result.token,
+            sendMode: result.sendMode,
+        });
+    });
+    // Reply confirmation endpoint — called by imessage-reply.sh AFTER sending via imsg CLI.
+    // Requires a valid send token from validate-send (TOCTOU mitigation).
+    // Logs the outbound message and clears stall tracking.
+    router.post('/imessage/reply/:recipient', (req, res) => {
+        if (!ctx.imessage) {
+            res.status(503).json({ error: 'iMessage not configured' });
+            return;
+        }
+        const { recipient } = req.params;
+        if (!recipient) {
+            res.status(400).json({ error: 'recipient parameter required' });
+            return;
+        }
+        const decodedRecipient = decodeURIComponent(recipient);
+        // Validate recipient is authorized
+        if (!ctx.imessage.isAuthorized(decodedRecipient)) {
+            res.status(403).json({ error: 'recipient not in authorizedContacts' });
+            return;
+        }
+        const { text, sendToken } = req.body;
+        if (!text || typeof text !== 'string') {
+            res.status(400).json({ error: '"text" field required' });
+            return;
+        }
+        // Validate send token if provided (TOCTOU binding)
+        if (sendToken) {
+            const tokenResult = ctx.imessage.confirmSend(sendToken, decodedRecipient, text);
+            if (!tokenResult.ok) {
+                res.status(403).json({ error: tokenResult.reason });
+                return;
+            }
+        }
+        // Log outbound message
+        ctx.imessage.logOutboundMessage(decodedRecipient, text);
+        // Clear stall tracking for this sender
+        ctx.imessage.clearStallForSender(decodedRecipient);
+        // Also clear in SessionManager if available
+        if (ctx.sessionManager && 'clearIMessageInjectionTracker' in ctx.sessionManager) {
+            ctx.sessionManager.clearIMessageInjectionTracker(decodedRecipient);
+        }
+        res.json({ ok: true, recipient: decodedRecipient, logged: true });
+    });
+    router.get('/imessage/chats', async (req, res) => {
+        if (!ctx.imessage) {
+            res.status(503).json({ error: 'iMessage not configured' });
+            return;
+        }
+        const limit = parseInt(req.query.limit) || 20;
+        try {
+            const chats = await ctx.imessage.listChats(limit);
+            res.json(chats);
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    router.get('/imessage/chats/:chatId/history', async (req, res) => {
+        if (!ctx.imessage) {
+            res.status(503).json({ error: 'iMessage not configured' });
+            return;
+        }
+        const { chatId } = req.params;
+        const limit = parseInt(req.query.limit) || 50;
+        try {
+            const history = await ctx.imessage.getChatHistory(chatId, limit);
+            res.json(history);
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    router.get('/imessage/log-stats', (_req, res) => {
+        if (!ctx.imessage) {
+            res.status(503).json({ error: 'iMessage not configured' });
+            return;
+        }
+        try {
+            const stats = ctx.imessage.messageLogger.getStats();
+            res.json(stats);
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    router.get('/imessage/search', (_req, res) => {
+        if (!ctx.imessage) {
+            res.status(503).json({ error: 'iMessage not configured' });
+            return;
+        }
+        const query = (_req.query.q || '').trim();
+        if (!query) {
+            res.status(400).json({ error: 'q parameter required' });
+            return;
+        }
+        const limit = parseInt(_req.query.limit) || 50;
+        try {
+            const results = ctx.imessage.messageLogger.search({ query, limit });
+            res.json({ results, count: results.length });
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
     // ── Relationships ─────────────────────────────────────────────────
     router.get('/relationships', (req, res) => {
         if (!ctx.relationships) {