viber-channel 0.8.35 → 0.8.36

package/lib/connect.ts

@@ -22,6 +22,7 @@ import { dirname, isAbsolute, join, relative } from "node:path";
 import { connectAuthPath, isQaBackend } from "./auth.js";
 import { clientFingerprint } from "./fingerprint.js";
 import { cfAccessHeaders } from "./cfAccess.js";
+import { type RecordOutcome, recordConnectedFolder } from "./machine_projects.js";
 
 interface InitResponse {
   confirm_url: string;
@@ -88,6 +89,13 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/** #674 D8 (a): one line on where the Viber app will launch this project's agents. Never fails the connect. */
+export function folderLine(o: RecordOutcome): string {
+  if (o.kind === "recorded") return `The Viber app will launch this project's agents in ${o.folder}`;
+  if (o.kind === "skipped") return `Folder not recorded for the Viber app: ${o.reason}`;
+  return `Folder not recorded for the Viber app (${o.reason}) — it will ask for it at the first launch`;
+}
+
 function writeAuthJson(
   cwd: string,
   data: ConsumedResponse,
@@ -212,7 +220,8 @@ export async function runConnect(
       writeAuthJson(cwd, data, fingerprint, authPath);
       process.stdout.write(
         `\n✓ Connected as ${data.user_email} to project '${data.project_name}'.\n` +
-          `  Wrote ${authPath}\n\n` +
+          `  Wrote ${authPath}\n` +
+          `  ${folderLine(recordConnectedFolder(data.project_id, cwd, authPath))}\n\n` +
           (isQaBackend(baseUrl) ? QA_NEXT_STEPS : DEFAULT_NEXT_STEPS),
       );
       return;

package/lib/fingerprint.ts

@@ -41,7 +41,14 @@ export function getMachineId(): string {
 }
 
 export function clientFingerprint(folderPath: string): string {
-  const machineId = getMachineId();
+  return clientFingerprintWith(getMachineId(), folderPath);
+}
+
+/**
+ * The same fingerprint with the machine id read ONCE by the caller (#674): on Windows
+ * `getMachineId` spawns `reg query`, and the Viber app checks several folders in a row.
+ */
+export function clientFingerprintWith(machineId: string, folderPath: string): string {
   const absPath = normalizePath(realpathSync(folderPath) as string);
   return createHash("sha256").update(`${machineId}:${absPath}`).digest("hex").slice(0, 32);
 }

package/lib/machine_projects.ts

@@ -0,0 +1,344 @@
+/**
+ * machine_projects.ts — the Viber app's project -> folder table, and who may write it (#674, D8).
+ *
+ * The table lives in the app's home (`<home>/projects.json`); the app's runner reads it to know
+ * where to launch a project's agents. It is written where the folder is KNOWN: at
+ * `viber-channel connect` (which writes `.viber/<auth>` IN that folder), once by the app's
+ * catch-up for projects connected before, and by the folder picker. It lives here, not in the
+ * gateway, because the channel is published alone on npm and cannot import the gateway; the
+ * gateway re-exports it.
+ *
+ * ⚠ Bound to ONE backend identity: project ids of dev and staging overlap (measured: 4 and 6), so
+ * a table read for another identity (a home re-enrolled elsewhere) is EMPTY — never a folder of
+ * another backend. ⚠ Several processes write it (connect, the app): every write is serialized by
+ * a lock file and lands by rename, so the table is never read half-written.
+ */
+import { existsSync, linkSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { isDevBackend, isQaBackend } from "./auth.js";
+import { identityBaseUrl } from "./base_urls.js";
+import type { RunnerAuthLite } from "./runner_exec.js";
+import { execFileSync } from "./hidden_proc.js";
+
+/** `%LOCALAPPDATA%\Viber`, or `VIBER_APP_HOME` (tests, a second dev instance). */
+export function appHome(env: NodeJS.ProcessEnv = process.env): string {
+  const override = env.VIBER_APP_HOME?.trim();
+  if (override) return override;
+  const local = env.LOCALAPPDATA?.trim();
+  if (!local) throw new Error("LOCALAPPDATA is not set: cannot place the Viber app state");
+  return join(local, "Viber");
+}
+
+export function runnerJsonPath(home: string): string {
+  return join(home, ".viber", "runner.json");
+}
+
+/**
+ * The identity a table belongs to: the enrolled host, else the DEFAULT — never guessed from the
+ * calling process's env: a `connect` run with `VIBER_BASE_URL=dev` must not reinterpret the
+ * app's pre-#627 `runner.json` (the app, started from the Start menu, has no such variable).
+ */
+export function tableIdentity(auth: Pick<RunnerAuthLite, "identity_base_url">): string {
+  return auth.identity_base_url ?? identityBaseUrl({});
+}
+
+/** The identity of the app enrolled in `home`, or undefined when it is not enrolled. */
+export function appIdentity(home: string): string | undefined {
+  const path = runnerJsonPath(home);
+  if (!existsSync(path)) return undefined;
+  return tableIdentity(JSON.parse(readFileSync(path, "utf-8")) as Pick<RunnerAuthLite, "identity_base_url">);
+}
+
+/**
+ * The auth file of a backend, from its identity ALONE. Never `authFilePath()`: it honours
+ * `VIBER_AUTH_FILE`, which would make every folder answer through one same file.
+ */
+export function authFileNameFor(identity: string): string {
+  if (isDevBackend(identity)) return "dev.auth.json";
+  if (isQaBackend(identity)) return "qa.auth.json";
+  return "auth.json";
+}
+
+const LOCK_WAIT_MS = 5000;
+const LOCK_RETRY_MS = 25;
+/** A write holds the lock for milliseconds: no OS query before this. NOT a proof of death. */
+const LOCK_JUDGE_AFTER_MS = 1000;
+/** `performance.timeOrigin` is the runtime start, a little after the OS creation time. */
+const START_TOLERANCE_MS = 5000;
+
+function pause(ms: number): void {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/**
+ * When the process `pid` was created (epoch ms), `null` when there is no such process, `NaN` when
+ * it exists but its creation time cannot be read. A pid ALONE does not identify a process on
+ * Windows: pids are recycled (repo sheet, trap 5).
+ */
+export function processStart(pid: number): number | null {
+  if (process.platform === "win32") {
+    try {
+      const out = execFileSync(
+        "powershell",
+        ["-NoProfile", "-Command", `$p = Get-Process -Id ${pid} -ErrorAction SilentlyContinue; if ($p) { $p.StartTime.ToUniversalTime().ToString('o') }; exit 0`],
+        { encoding: "utf-8" },
+      ).trim();
+      // `exit 0`: a missing pid makes Get-Process fail even when silenced (measured: exit 1).
+      return out === "" ? null : Date.parse(out);
+    } catch {
+      return Number.NaN;
+    }
+  }
+  try {
+    process.kill(pid, 0);
+    return Number.NaN;
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === "EPERM" ? Number.NaN : null;
+  }
+}
+
+export interface TableFs {
+  rename: (from: string, to: string) => void;
+  processStart: (pid: number) => number | null;
+  /** This process: its pid and its creation time, written into the lock. */
+  self: { pid: number; start: number };
+}
+
+const INTEGER_KEY = /^\d+$/;
+
+function integerEntries(o: unknown): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (typeof o === "object" && o !== null) {
+    for (const [k, v] of Object.entries(o)) if (INTEGER_KEY.test(k) && typeof v === "string") out[k] = v;
+  }
+  return out;
+}
+
+interface Table {
+  /** Folders of THIS identity, read at launch. */
+  folders: Record<string, string>;
+  /** Entries of the flat format of before #674: no identity, never read at launch, settled by the catch-up. */
+  unverified: Record<string, string>;
+}
+
+/** The project -> local folder table: recorded at connect (or picked), then read at launch. */
+export class ProjectFolders {
+  private readonly path: string;
+  constructor(
+    home: string,
+    private readonly identity: string,
+    private readonly fs: TableFs = { rename: renameSync, processStart, self: { pid: process.pid, start: Math.round(performance.timeOrigin) } },
+  ) {
+    this.path = join(home, "projects.json");
+  }
+
+  /** A damaged file fails closed: it is neither re-asked nor overwritten. */
+  private table(): Table {
+    if (!existsSync(this.path)) return { folders: {}, unverified: {} };
+    const raw: unknown = JSON.parse(readFileSync(this.path, "utf-8"));
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${this.path} is not a JSON object`);
+    const r = raw as Record<string, unknown>;
+    if (typeof r.folders !== "object" || r.folders === null) {
+      // The flat format (an old binary may also have left an `identity` key in it: integer keys only).
+      return { folders: {}, unverified: integerEntries(r) };
+    }
+    if (r.identity !== this.identity) return { folders: {}, unverified: {} }; // another backend's table
+    return { folders: integerEntries(r.folders), unverified: integerEntries(r.unverified) };
+  }
+
+  all(): Record<string, string> {
+    return this.table().folders;
+  }
+
+  unverified(): Record<string, string> {
+    return this.table().unverified;
+  }
+
+  get(projectId: number): string | undefined {
+    return this.table().folders[String(projectId)];
+  }
+
+  set(projectId: number, folder: string): void {
+    this.locked(() => {
+      const t = this.table();
+      t.folders[String(projectId)] = folder;
+      this.write(t);
+    });
+  }
+
+  /**
+   * The catch-up's single write (D8 b): adds each found folder whose id has no LIVE entry (re-read
+   * under the lock — a connect may have written meanwhile), and settles the unverified entries.
+   */
+  settleCatchUp(found: Record<string, string>, exists: (folder: string) => boolean): string[] {
+    const added: string[] = [];
+    this.locked(() => {
+      const t = this.table();
+      for (const [id, folder] of Object.entries(found)) {
+        const current = t.folders[id];
+        if (current !== undefined && exists(current)) continue;
+        t.folders[id] = folder;
+        added.push(id);
+      }
+      this.write({ folders: t.folders, unverified: {} });
+    });
+    return added;
+  }
+
+  private write(t: Table): void {
+    const body: Record<string, unknown> = { identity: this.identity, folders: t.folders };
+    if (Object.keys(t.unverified).length > 0) body.unverified = t.unverified;
+    const tmp = `${this.path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(body, null, 2)}\n`);
+    try {
+      this.fs.rename(tmp, this.path);
+    } catch (err) {
+      try {
+        unlinkSync(tmp);
+      } catch {
+        /* nothing left behind */
+      }
+      throw err;
+    }
+  }
+
+  /**
+   * The lock is PUBLISHED COMPLETE (review Codex/Opus): its content is written to a unique temp
+   * file, then hard-linked to the canonical name, which fails if it exists. A crash can therefore
+   * never leave an empty or half-written lock of ours behind.
+   */
+  private locked(work: () => void): void {
+    mkdirSync(dirname(this.path), { recursive: true });
+    const lock = `${this.path}.lock`;
+    const mine = JSON.stringify({ pid: this.fs.self.pid, start: this.fs.self.start, at: Date.now(), nonce: Math.random() });
+    const draft = `${lock}.${this.fs.self.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+    writeFileSync(draft, mine);
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    try {
+      for (;;) {
+        try {
+          linkSync(draft, lock);
+          break;
+        } catch (err) {
+          if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+          // A takeover may take a while (the OS probe): retry at once, before judging the deadline.
+          if (this.takeOverIfDead(lock)) continue;
+          if (Date.now() > deadline) {
+            throw new Error(`${lock} is held by another writer — if no Viber process is running, delete that file`);
+          }
+          pause(LOCK_RETRY_MS);
+        }
+      }
+    } finally {
+      try {
+        unlinkSync(draft);
+      } catch {
+        /* best effort */
+      }
+    }
+    try {
+      work();
+    } finally {
+      // Only OUR lock: never remove one a taker re-created after judging ours dead.
+      try {
+        if (readFileSync(lock, "utf-8") === mine) unlinkSync(lock);
+      } catch {
+        /* already gone */
+      }
+    }
+  }
+
+
+  /**
+   * A lock is taken over only when its holder is GONE: its pid no longer exists, or that pid now
+   * belongs to a process created at another time (recycled). Never on age alone — a suspended or
+   * sleeping writer is alive. By RENAME to a unique name, then checked to be the very lock judged
+   * dead: two takers cannot both win, and a lock re-taken meanwhile is put back.
+   */
+  private takeOverIfDead(lock: string): boolean {
+    let judged: string;
+    try {
+      judged = readFileSync(lock, "utf-8");
+    } catch {
+      return true; // released meanwhile: retry at once
+    }
+    let owner: { pid?: unknown; start?: unknown; at?: unknown } | undefined;
+    try {
+      owner = JSON.parse(judged) as typeof owner;
+    } catch {
+      owner = undefined;
+    }
+    if (owner === undefined || typeof owner !== "object" || owner === null || typeof owner.pid !== "number") {
+      // Unreadable: never one of OURS (published complete) — a crash of an older writer, or damage.
+      // Not "being written": dead once it is older than a write could take (review Opus).
+      try {
+        if (Date.now() - statSync(lock).mtimeMs < LOCK_JUDGE_AFTER_MS) return false;
+      } catch {
+        return true; // gone meanwhile
+      }
+    } else {
+      if (typeof owner.at === "number" && Date.now() - owner.at < LOCK_JUDGE_AFTER_MS) return false;
+      const now = this.fs.processStart(owner.pid);
+      const recycled =
+        now !== null && !Number.isNaN(now) && typeof owner.start === "number" && Math.abs(now - owner.start) > START_TOLERANCE_MS;
+      if (now !== null && !recycled) return false; // alive, or unknown: alive
+    }
+    const grave = `${lock}.${process.pid}.${Date.now()}.dead`;
+    try {
+      this.fs.rename(lock, grave);
+    } catch {
+      return true; // another taker won: retry at once
+    }
+    let taken = "";
+    try {
+      taken = readFileSync(grave, "utf-8");
+    } catch {
+      /* unreadable: treat as not ours */
+    }
+    const ours = taken === judged;
+    if (!ours) {
+      try {
+        linkSync(grave, lock); // put the live writer's lock back, only if none was created since
+      } catch {
+        /* a new lock exists: leave it */
+      }
+    }
+    try {
+      unlinkSync(grave);
+    } catch {
+      /* best effort */
+    }
+    return ours;
+  }
+}
+
+export type RecordOutcome =
+  | { kind: "recorded"; home: string; folder: string }
+  | { kind: "skipped"; reason: string }
+  | { kind: "failed"; reason: string };
+
+/**
+ * D8 (a): after a connect wrote `<folder>/.viber/<authFile>`, record `projectId -> folder` in the
+ * app's table — ONLY when the app serves that backend. The connect is the authority: it replaces
+ * an older entry. The folder is its realpath, the form the fingerprint hashes. Never throws: a
+ * connect must succeed even when this does not.
+ */
+export function recordConnectedFolder(
+  projectId: number,
+  folder: string,
+  authPath: string,
+  env: NodeJS.ProcessEnv = process.env,
+): RecordOutcome {
+  try {
+    const home = appHome(env);
+    const identity = appIdentity(home);
+    if (identity === undefined) return { kind: "skipped", reason: "the Viber app is not enrolled on this machine" };
+    const served = authFileNameFor(identity);
+    if (basename(authPath) !== served) return { kind: "skipped", reason: `the Viber app serves another backend (${identity})` };
+    const real = realpathSync(folder);
+    new ProjectFolders(home, identity).set(projectId, real);
+    return { kind: "recorded", home, folder: real };
+  } catch (err) {
+    return { kind: "failed", reason: (err as Error).message };
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.35",
+  "version": "0.8.36",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {