viber-channel 0.7.0 → 0.7.2

package/lib/bridge_core.ts

@@ -22,7 +22,7 @@ import {
 	RefreshNetworkError,
 	refreshConversationToken,
 } from "./conversation.js";
-import { ConversationTokenExpiredError, fetchMessages, postMessage } from "./messages.js";
+import { ackMessage, ConversationTokenExpiredError, fetchMessages, postMessage } from "./messages.js";
 import { buildSseUrl } from "./urls.js";
 import { cfAccessHeaders } from "./cfAccess.js";
 import { sessionFilePath, writeHandle } from "./channel_session.js";
@@ -534,8 +534,49 @@ export async function sseLoop(opts: {
 	const primeHistory = options.awaitInvite !== true;
 	let primed = false;
 
+	// #346 read-ACK bookkeeping. Tracked SEPARATELY from handledIds so a transient
+	// ACK failure is RETRIED on the next reconnect/catch-up instead of being lost
+	// forever (codex step-02 review): handledIds gates the reply (at-most-once),
+	// ackedIds gates the ACK (at-least-once-until-confirmed). ackInFlightIds avoids
+	// spamming concurrent ACKs for the same message within a run.
+	const ackedIds = new Set<string>();
+	const ackInFlightIds = new Set<string>();
+
+	// Emit a read-acknowledgement for a web→agent message. Run by the bridge CODE
+	// (not the LLM), fire-and-forget, BEFORE any reply — so the web "reçu" checkmark
+	// has zero impact on agent reply latency. Only role=user|user_voice with no
+	// sender_instance_id qualify (mirrors the Worker; the Worker is the source of
+	// truth and 404s anything else). Idempotent server-side, so re-acking on
+	// reconnect is safe; we only mark ackedIds on a confirmed success so a failed
+	// ACK is retried. Never throws (ackMessage swallows).
+	// TODO(#346/#280 s19): when addressed_to is revived (per-instance targeting),
+	// gate this on "this instance is an intended recipient" — otherwise an agent Y
+	// receiving the per-conversation SSE fan-out would ACK a message addressed to
+	// agent X, lighting "reçu" while X never received it. Mirror the same guard in
+	// the Worker's insertMessageAck qualification. N/A today: addressed_to is
+	// dormant and fan-out is per-conversation, so every connected bridge truly
+	// receives the message (consistent with decision A = delivered-to-bridge).
+	function ackInboundReceipt(msg: ConversationMessage): void {
+		if (msg.role !== "user" && msg.role !== "user_voice") return;
+		if (msg.sender_instance_id) return;
+		const idStr = msg.id !== undefined && msg.id !== null ? String(msg.id) : undefined;
+		if (!idStr) return;
+		if (ackedIds.has(idStr) || ackInFlightIds.has(idStr)) return;
+		ackInFlightIds.add(idStr);
+		void ackMessage(baseUrl, runtime.id, runtime.token, idStr, signal)
+			.then((ok) => {
+				if (ok) ackedIds.add(idStr);
+				else process.stderr.write(`${logPrefix} ack failed for message ${idStr} (will retry on reconnect)\n`);
+			})
+			.finally(() => ackInFlightIds.delete(idStr));
+	}
+
 	async function handleInboundMessage(msg: ConversationMessage): Promise<boolean> {
 		const idStr = msg.id !== undefined && msg.id !== null ? String(msg.id) : undefined;
+		// Confirm receipt to the web INDEPENDENTLY of handled/reply state, BEFORE the
+		// handledIds early-return — so a previously-failed ACK is retried when this
+		// message comes back through catch-up on reconnect (codex step-02 review).
+		ackInboundReceipt(msg);
 		if (idStr && handledIds.has(idStr)) return false;
 		if (!shouldHandleMessage(msg, ownInstanceKey, ownPostedIds, options)) {
 			if (idStr) handledIds.add(idStr); // skip decision is final — role won't change
@@ -561,7 +602,12 @@ export async function sseLoop(opts: {
 	async function reconcileMessages(): Promise<boolean> {
 		let msgs: Array<Record<string, unknown>>;
 		try {
-			msgs = await fetchMessages(minted.ws_url, minted.conversation_id, runtime.token);
+			// #333: catch-up is a REST call to GET /api/conversations/:id/messages,
+			// which is served by the Worker API (baseUrl) — NOT by minted.ws_url, which
+			// is the SSE/voice host (the CF tunnel in staging/prod). Using ws_url here
+			// 404s whenever the SSE host differs from the API host (masked in dev where
+			// they collapse to one origin). The SSE subscription still uses ws_url.
+			msgs = await fetchMessages(baseUrl, minted.conversation_id, runtime.token);
 		} catch (err) {
 			if (err instanceof ConversationTokenExpiredError) throw err;
 			process.stderr.write(`${logPrefix} catch-up fetch failed: ${safeErrorMessage(err)}\n`);
@@ -570,6 +616,10 @@ export async function sseLoop(opts: {
 		const seed = (msg: ConversationMessage): void => {
 			const idStr = msg.id !== undefined && msg.id !== null ? String(msg.id) : undefined;
 			if (idStr) handledIds.add(idStr);
+			// #346: a bridge that was offline still RECEIVED these messages on
+			// reconnect — ACK seeded web→agent messages so offline→online shows
+			// "reçu" even though we won't reply to backlog.
+			ackInboundReceipt(msg);
 		};
 
 		// FIRST await-invite pass: bound the replay to the TRIGGER only — forward

package/lib/dm_stream.ts

@@ -35,7 +35,14 @@ export type FetchMessagesFn = (
 ) => Promise<Array<Record<string, unknown>>>;
 
 export interface DmStreamOptions {
+  /** SSE/voice host (CF tunnel in staging/prod) — used for the events stream. */
   wsUrl: string;
+  /**
+   * Worker API host — used for the REST catch-up (GET /:id/messages). This is a
+   * DIFFERENT origin from `wsUrl` in staging/prod (the messages route lives on
+   * the Worker, not the SSE tunnel); collapsing them caused #333's catch-up 404.
+   */
+  apiBaseUrl: string;
   conversationId: string;
   conversationToken: string;
   onMessage: (msg: DmMessage) => void | Promise<void>;
@@ -135,7 +142,7 @@ async function catchUp(opts: DmStreamOptions, handledIds: Set<string>): Promise<
   const doFetch = opts.fetchMessagesImpl ?? fetchMessages;
   let msgs: Array<Record<string, unknown>>;
   try {
-    msgs = await doFetch(opts.wsUrl, opts.conversationId, opts.conversationToken);
+    msgs = await doFetch(opts.apiBaseUrl, opts.conversationId, opts.conversationToken);
   } catch (err) {
     if (err instanceof ConversationTokenExpiredError) throw new DmStreamAuthError();
     opts.log?.(

package/lib/messages.ts

@@ -95,6 +95,37 @@ export async function fetchMessages(
   return Array.isArray(body.messages) ? body.messages : [];
 }
 
+/**
+ * POST /api/conversations/:id/messages/:messageId/ack — read-acknowledgement (#346).
+ *
+ * The bridge CODE (not the LLM) confirms receipt of a web→agent message so the
+ * web UI can show a "reçu" checkmark, with zero impact on agent reply latency.
+ *
+ * Best-effort and NON-BLOCKING: never throws. Any failure (network, 401 expired
+ * token, 404 for a message the Worker deems non-ackable) resolves to `false` so
+ * the message-handling flow is never disrupted by the ACK. Idempotence is owned
+ * by the Worker (PK + INSERT OR IGNORE), so re-acking on reconnect is safe.
+ */
+export async function ackMessage(
+  baseUrl: string,
+  conversationId: string,
+  conversationToken: string,
+  messageId: string | number,
+  signal?: AbortSignal,
+): Promise<boolean> {
+  const url = `${baseUrl}/api/conversations/${conversationId}/messages/${messageId}/ack`;
+  try {
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${conversationToken}`, ...cfAccessHeaders() },
+      signal,
+    });
+    return resp.ok;
+  } catch {
+    return false;
+  }
+}
+
 export interface MessagePostSuccess {
   ok: true;
   message_id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-channel.ts

@@ -319,7 +319,7 @@ import {
   RefreshHttpError,
   RefreshNetworkError,
 } from "./lib/conversation.ts";
-import { ConversationTokenExpiredError } from "./lib/messages.ts";
+import { ackMessage, ConversationTokenExpiredError } from "./lib/messages.ts";
 import {
   listAgents as libListAgents,
   messageAgent as libMessageAgent,
@@ -876,6 +876,43 @@ async function pushTranscript(text: string, lang: string): Promise<void> {
 // mechanism, surfaced by the #254 Active section that keeps the UI open).
 const messageDedup = new MessageDedup();
 
+// #346 read-ACK bookkeeping for the Claude MCP channel (mirrors bridge_core's
+// ackInboundReceipt, which only covers the Codex/Gemma bridges). Tracks confirmed
+// ACKs so we don't re-POST on SSE replay; in-flight set avoids a double-POST race.
+const ackedMessageIds = new Set<string>();
+const ackInFlightMessageIds = new Set<string>();
+
+/**
+ * Emit a read-acknowledgement for a web→agent message received on the main
+ * conversation (#346). Run by the channel CODE (not the LLM), fire-and-forget,
+ * so the web "reçu" checkmark has zero impact on reply latency. Only
+ * role=user|user_voice with no sender_instance_id qualify (mirrors the Worker,
+ * which is the source of truth and 404s anything else). Idempotent server-side,
+ * so re-acking on reconnect is safe; ackedMessageIds is only set on a confirmed
+ * success so a failed ACK is retried on the next delivery. Never throws.
+ */
+function ackInboundReceipt(msg: {
+  id?: string | number | null;
+  role?: string;
+  sender_instance_id?: string | null;
+}): void {
+  if (msg.role !== "user" && msg.role !== "user_voice") return;
+  if (msg.sender_instance_id) return;
+  // The SSE "message" payload carries the D1 id as a NUMBER (MessageResponse.id).
+  // Coerce like bridge_core's ackInboundReceipt — a strict string check would
+  // bail on every real message and never ack.
+  const idStr = msg.id !== undefined && msg.id !== null ? String(msg.id) : undefined;
+  if (!idStr) return;
+  if (ackedMessageIds.has(idStr) || ackInFlightMessageIds.has(idStr)) return;
+  ackInFlightMessageIds.add(idStr);
+  void ackMessage(BASE_URL, CONVERSATION_ID, CONVERSATION_TOKEN, idStr)
+    .then((ok) => {
+      if (ok) ackedMessageIds.add(idStr);
+      else process.stderr.write(`[viber-channel] ack failed for message ${idStr} (will retry on next delivery)\n`);
+    })
+    .finally(() => ackInFlightMessageIds.delete(idStr));
+}
+
 /**
  * Forward a saved conversation message from the event bus to Claude.
  *
@@ -977,6 +1014,7 @@ function startDmStream(minted: ConversationMintResponse): void {
   // per-DM conversation heartbeat (#298) was removed in #315.
   void runDmStream({
     wsUrl: minted.ws_url,
+    apiBaseUrl: BASE_URL,
     conversationId: minted.conversation_id,
     conversationToken: minted.conversation_token,
     log: (m) => process.stderr.write(m),
@@ -1083,6 +1121,9 @@ async function sseLoop(): Promise<void> {
                 sender_instance_id?: string | null;
               };
               if (msg.content) {
+                // #346: confirm receipt to the web BEFORE forwarding to the LLM
+                // and independently of any reply — decoupled from reply latency.
+                ackInboundReceipt(msg);
                 await pushMessage(msg);
               } else {
                 process.stderr.write(`[viber-channel] 'message' event has empty content\n`);