tandem-editor 0.8.0 → 0.9.1

package/dist/channel/index.js

@@ -17914,6 +17914,14 @@ var IDLE_TIMEOUT = 30 * 60 * 1e3;
 var SESSION_MAX_AGE = 30 * 24 * 60 * 60 * 1e3;
 var CHANNEL_MAX_RETRIES = 5;
 var CHANNEL_RETRY_DELAY_MS = 2e3;
+var CHANNEL_CONNECT_FETCH_TIMEOUT_MS = 1e4;
+var CHANNEL_SSE_INACTIVITY_TIMEOUT_MS = 6e4;
+var CHANNEL_MODE_FETCH_TIMEOUT_MS = 2e3;
+var CHANNEL_AWARENESS_FETCH_TIMEOUT_MS = 5e3;
+var CHANNEL_ERROR_REPORT_TIMEOUT_MS = 3e3;
+var CHANNEL_REPLY_FETCH_TIMEOUT_MS = 5e3;
+var CHANNEL_PERMISSION_FETCH_TIMEOUT_MS = 5e3;
+var CHANNEL_MAX_SSE_BUFFER_BYTES = 1e6;
 
 // src/shared/cli-runtime.ts
 function redirectConsoleToStderr() {
@@ -17945,6 +17953,21 @@ async function authFetch(url, init) {
   return fetch(url, init);
 }
 
+// src/shared/fetch-with-timeout.ts
+async function fetchWithTimeout(url, init, timeoutMs) {
+  const signal = AbortSignal.timeout(timeoutMs);
+  return authFetch(url, { ...init, signal });
+}
+function describeFetchError(err, endpoint, timeoutMs) {
+  if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+    return `${endpoint} timed out after ${timeoutMs}ms`;
+  }
+  return err instanceof Error ? err.message : String(err);
+}
+function isAbortOrTimeoutError(err) {
+  return err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+}
+
 // src/shared/events/types.ts
 var VALID_EVENT_TYPES = /* @__PURE__ */ new Set([
   "annotation:created",
@@ -17966,9 +17989,9 @@ function formatEventContent(event) {
   const doc = event.documentId ? ` [doc: ${event.documentId}]` : "";
   switch (event.type) {
     case "annotation:created": {
-      const { annotationType, content, textSnippet, hasSuggestedText, directedAt } = event.payload;
+      const { annotationType, content, textSnippet, hasSuggestedText } = event.payload;
       const snippet = textSnippet ? ` on "${textSnippet}"` : "";
-      const label = hasSuggestedText ? "replacement" : directedAt === "claude" ? "question for Claude" : annotationType;
+      const label = hasSuggestedText ? "replacement" : annotationType;
       return `User created ${label}${snippet}: ${content || "(no content)"}${doc}`;
     }
     case "annotation:accepted": {
@@ -18063,18 +18086,22 @@ async function startEventBridge(mcp, tandemUrl) {
       if (retries >= CHANNEL_MAX_RETRIES) {
         console.error("[Channel] SSE connection exhausted, reporting error and exiting");
         try {
-          await authFetch(`${tandemUrl}/api/channel-error`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              error: "CHANNEL_CONNECT_FAILED",
-              message: `Channel shim lost connection after ${CHANNEL_MAX_RETRIES} retries.`
-            })
-          });
+          await fetchWithTimeout(
+            `${tandemUrl}/api/channel-error`,
+            {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({
+                error: "CHANNEL_CONNECT_FAILED",
+                message: `Channel shim lost connection after ${CHANNEL_MAX_RETRIES} retries.`
+              })
+            },
+            CHANNEL_ERROR_REPORT_TIMEOUT_MS
+          );
         } catch (reportErr) {
           console.error(
             "[Channel] Could not report failure to server:",
-            reportErr instanceof Error ? reportErr.message : reportErr
+            describeFetchError(reportErr, "/api/channel-error", CHANNEL_ERROR_REPORT_TIMEOUT_MS)
           );
         }
         process.exit(1);
@@ -18086,42 +18113,80 @@ async function startEventBridge(mcp, tandemUrl) {
 async function connectAndStream(mcp, tandemUrl, lastEventId, onEventId) {
   const headers = { Accept: "text/event-stream" };
   if (lastEventId) headers["Last-Event-ID"] = lastEventId;
-  const res = await authFetch(`${tandemUrl}/api/events`, { headers });
+  const connectCtrl = new AbortController();
+  const connectTimer = setTimeout(
+    () => connectCtrl.abort(new Error("handshake timeout")),
+    CHANNEL_CONNECT_FETCH_TIMEOUT_MS
+  );
+  let res;
+  try {
+    res = await authFetch(`${tandemUrl}/api/events`, { headers, signal: connectCtrl.signal });
+  } finally {
+    clearTimeout(connectTimer);
+  }
   if (!res.ok) throw new Error(`SSE endpoint returned ${res.status}`);
   if (!res.body) throw new Error("SSE endpoint returned no body");
   const reader = res.body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
+  let lastActivityAt = Date.now();
+  let inactivityTimedOut = false;
+  const watchdog = setInterval(() => {
+    if (Date.now() - lastActivityAt > CHANNEL_SSE_INACTIVITY_TIMEOUT_MS) {
+      inactivityTimedOut = true;
+      reader.cancel(new Error("SSE inactivity timeout")).catch(() => {
+      });
+    }
+  }, CHANNEL_SSE_INACTIVITY_TIMEOUT_MS / 4);
   let awarenessTimer = null;
   let clearAwarenessTimer = null;
   let pendingAwareness = null;
   const AWARENESS_CLEAR_MS = 3e3;
   function clearAwareness(documentId) {
-    authFetch(`${tandemUrl}/api/channel-awareness`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        documentId: documentId ?? null,
-        status: "idle",
-        active: false
-      })
-    }).catch(() => {
+    fetchWithTimeout(
+      `${tandemUrl}/api/channel-awareness`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          documentId: documentId ?? null,
+          status: "idle",
+          active: false
+        })
+      },
+      CHANNEL_AWARENESS_FETCH_TIMEOUT_MS
+    ).catch((err) => {
+      console.error(
+        "[Channel] clearAwareness failed (non-fatal):",
+        describeFetchError(err, "/api/channel-awareness clear", CHANNEL_AWARENESS_FETCH_TIMEOUT_MS)
+      );
     });
   }
   function flushAwareness() {
     if (!pendingAwareness) return;
     const event = pendingAwareness;
     pendingAwareness = null;
-    authFetch(`${tandemUrl}/api/channel-awareness`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        documentId: event.documentId,
-        status: `processing: ${event.type}`,
-        active: true
-      })
-    }).catch((err) => {
-      console.error("[Channel] Awareness update failed:", err instanceof Error ? err.message : err);
+    fetchWithTimeout(
+      `${tandemUrl}/api/channel-awareness`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          documentId: event.documentId,
+          status: `processing: ${event.type}`,
+          active: true
+        })
+      },
+      CHANNEL_AWARENESS_FETCH_TIMEOUT_MS
+    ).catch((err) => {
+      console.error(
+        "[Channel] Awareness update failed:",
+        describeFetchError(
+          err,
+          "/api/channel-awareness update",
+          CHANNEL_AWARENESS_FETCH_TIMEOUT_MS
+        )
+      );
     });
     if (clearAwarenessTimer) clearTimeout(clearAwarenessTimer);
     clearAwarenessTimer = setTimeout(() => clearAwareness(event.documentId), AWARENESS_CLEAR_MS);
@@ -18131,56 +18196,81 @@ async function connectAndStream(mcp, tandemUrl, lastEventId, onEventId) {
     if (awarenessTimer) clearTimeout(awarenessTimer);
     awarenessTimer = setTimeout(flushAwareness, AWARENESS_DEBOUNCE_MS);
   }
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) throw new Error("SSE stream ended");
-    buffer += decoder.decode(value, { stream: true });
-    let boundary;
-    while ((boundary = buffer.indexOf("\n\n")) !== -1) {
-      const frame = buffer.slice(0, boundary);
-      buffer = buffer.slice(boundary + 2);
-      if (frame.startsWith(":")) continue;
-      let eventId;
-      let data;
-      for (const line of frame.split("\n")) {
-        if (line.startsWith("id: ")) eventId = line.slice(4);
-        else if (line.startsWith("data: ")) data = line.slice(6);
-      }
-      if (!data) continue;
-      let event;
-      try {
-        event = parseTandemEvent(JSON.parse(data));
-      } catch {
-        console.error("[Channel] Malformed SSE event data (skipping):", data.slice(0, 200));
-        continue;
-      }
-      if (!event) {
-        console.error("[Channel] Received invalid SSE event, skipping");
-        continue;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        if (inactivityTimedOut) throw new Error("SSE inactivity timeout");
+        throw new Error("SSE stream ended");
+      }
+      lastActivityAt = Date.now();
+      buffer += decoder.decode(value, { stream: true });
+      if (buffer.length > CHANNEL_MAX_SSE_BUFFER_BYTES) {
+        throw new Error(
+          `SSE buffer exceeded ${CHANNEL_MAX_SSE_BUFFER_BYTES} bytes without a frame boundary`
+        );
       }
-      if (event.type !== "chat:message") {
-        const mode = await getCachedMode(tandemUrl);
-        if (mode === "solo") {
-          console.error(`[Channel] Solo mode: suppressed ${event.type} event`);
+      let boundary;
+      while ((boundary = buffer.indexOf("\n\n")) !== -1) {
+        const frame = buffer.slice(0, boundary);
+        buffer = buffer.slice(boundary + 2);
+        if (frame.startsWith(":")) continue;
+        let eventId;
+        let data;
+        for (const line of frame.split("\n")) {
+          if (line.startsWith("id: ")) eventId = line.slice(4);
+          else if (line.startsWith("data: ")) data = line.slice(6);
+        }
+        if (!data) continue;
+        let event;
+        try {
+          event = parseTandemEvent(JSON.parse(data));
+        } catch {
+          console.error(
+            "[Channel] Malformed SSE event data (skipping), eventId=%s:",
+            eventId,
+            data.slice(0, 200)
+          );
           if (eventId) onEventId(eventId);
           continue;
         }
-      }
-      if (eventId) onEventId(eventId);
-      try {
-        await mcp.notification({
-          method: "notifications/claude/channel",
-          params: {
-            content: formatEventContent(event),
-            meta: formatEventMeta(event)
+        if (!event) {
+          console.error(
+            "[Channel] Invalid SSE event structure (skipping), eventId=%s:",
+            eventId,
+            data.slice(0, 200)
+          );
+          if (eventId) onEventId(eventId);
+          continue;
+        }
+        if (event.type !== "chat:message") {
+          const mode = await getCachedMode(tandemUrl);
+          if (mode === "solo") {
+            console.error(`[Channel] Solo mode: suppressed ${event.type} event`);
+            if (eventId) onEventId(eventId);
+            continue;
           }
-        });
-      } catch (err) {
-        console.error("[Channel] MCP notification failed (transport broken?):", err);
-        throw err;
+        }
+        try {
+          await mcp.notification({
+            method: "notifications/claude/channel",
+            params: {
+              content: formatEventContent(event),
+              meta: formatEventMeta(event)
+            }
+          });
+        } catch (err) {
+          console.error("[Channel] MCP notification failed (transport broken?):", err);
+          throw err;
+        }
+        if (eventId) onEventId(eventId);
+        scheduleAwareness(event);
       }
-      scheduleAwareness(event);
     }
+  } finally {
+    clearInterval(watchdog);
+    if (awarenessTimer) clearTimeout(awarenessTimer);
+    if (clearAwarenessTimer) clearTimeout(clearAwarenessTimer);
   }
 }
 var cachedMode = "tandem";
@@ -18189,7 +18279,7 @@ async function getCachedMode(tandemUrl) {
   const now = Date.now();
   if (now - cachedModeAt < MODE_CACHE_TTL_MS) return cachedMode;
   try {
-    const res = await authFetch(`${tandemUrl}/api/mode`);
+    const res = await fetchWithTimeout(`${tandemUrl}/api/mode`, {}, CHANNEL_MODE_FETCH_TIMEOUT_MS);
     if (res.ok) {
       const { mode } = await res.json();
       cachedMode = mode;
@@ -18200,7 +18290,7 @@ async function getCachedMode(tandemUrl) {
   } catch (err) {
     console.error(
       "[Channel] Mode check failed, delivering event (fail-open):",
-      err instanceof Error ? err.message : err
+      describeFetchError(err, "/api/mode", CHANNEL_MODE_FETCH_TIMEOUT_MS)
     );
     cachedModeAt = now;
   }
@@ -18227,7 +18317,7 @@ async function runChannel(opts = {}) {
         "Event types: annotation:created, annotation:accepted, annotation:dismissed, annotation:reply,",
         "chat:message, document:opened, document:closed, document:switched.",
         "Chat messages may include a 'selection' field with buffered selection context.",
-        "Use your tandem MCP tools (tandem_getTextContent, tandem_comment, tandem_highlight, etc.) to act on them.",
+        "Use your tandem MCP tools (tandem_getTextContent, tandem_comment, tandem_edit, etc.) to act on them.",
         "Reply to chat messages using tandem_reply. Pass document_id from the tag attributes.",
         "Do not reply to non-chat events \u2014 just act on them using tools.",
         "If you haven't received channel notifications recently, call tandem_checkInbox as a fallback."
@@ -18261,15 +18351,20 @@ async function runChannel(opts = {}) {
     if (req.params.name === "tandem_reply") {
       const args = req.params.arguments;
       try {
-        const res = await authFetch(`${tandemUrl}/api/channel-reply`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify(args)
-        });
+        const res = await fetchWithTimeout(
+          `${tandemUrl}/api/channel-reply`,
+          {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(args)
+          },
+          CHANNEL_REPLY_FETCH_TIMEOUT_MS
+        );
         let data;
         try {
           data = await res.json();
-        } catch {
+        } catch (parseErr) {
+          if (isAbortOrTimeoutError(parseErr)) throw parseErr;
           data = { message: "Non-JSON response" };
         }
         if (!res.ok) {
@@ -18289,7 +18384,11 @@ async function runChannel(opts = {}) {
           content: [
             {
               type: "text",
-              text: `Failed to send reply: ${err instanceof Error ? err.message : String(err)}`
+              text: `Failed to send reply: ${describeFetchError(
+                err,
+                "/api/channel-reply",
+                CHANNEL_REPLY_FETCH_TIMEOUT_MS
+              )}`
             }
           ],
           isError: true
@@ -18309,23 +18408,30 @@ async function runChannel(opts = {}) {
   });
   mcp.setNotificationHandler(PermissionRequestSchema, async ({ params }) => {
     try {
-      const res = await authFetch(`${tandemUrl}/api/channel-permission`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          requestId: params.request_id,
-          toolName: params.tool_name,
-          description: params.description,
-          inputPreview: params.input_preview
-        })
-      });
+      const res = await fetchWithTimeout(
+        `${tandemUrl}/api/channel-permission`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            requestId: params.request_id,
+            toolName: params.tool_name,
+            description: params.description,
+            inputPreview: params.input_preview
+          })
+        },
+        CHANNEL_PERMISSION_FETCH_TIMEOUT_MS
+      );
       if (!res.ok) {
         console.error(
           `[Channel] Permission relay got HTTP ${res.status} \u2014 browser may not see prompt`
         );
       }
     } catch (err) {
-      console.error("[Channel] Failed to forward permission request:", err);
+      console.error(
+        "[Channel] Failed to forward permission request:",
+        describeFetchError(err, "/api/channel-permission", CHANNEL_PERMISSION_FETCH_TIMEOUT_MS)
+      );
     }
   });
   console.error(`[Channel] Tandem channel shim starting (server: ${tandemUrl})`);