viber-channel 0.8.37 → 0.8.38

package/lib/own_join.ts

@@ -0,0 +1,22 @@
+/**
+ * own_join.ts — a `join` pushed for the channel's OWN main conversation (#687).
+ *
+ * Measured on staging: an invite of this instance into the conversation it already
+ * streams (the web invite, or the relaunch handover of #627) rotates its member token and
+ * pushes a `join`. Opening a second stream on that conversation with the same identity
+ * makes Python evict the first one with `stop` (#315), and the channel reads `stop` as a
+ * revocation and exits — the agent dies with exit 0 and nothing in its MCP log.
+ *
+ * So a join for the main conversation never opens a stream: the channel ADOPTS the new
+ * token (the old one was replaced server-side) and keeps its one stream. Any other
+ * conversation is a DM/room join, as before.
+ *
+ * `mainConversationId` is the conversation the channel ADOPTED (after mint or reattach),
+ * never `VIBER_TARGET_CONVERSATION_ID` alone: a channel that minted its own conversation
+ * has no target, and one whose target reattach fell back to a mint holds another id.
+ */
+export type JoinRoute = "adopt-main-token" | "open-stream";
+
+export function routeJoin(pushedConversationId: string, mainConversationId: string): JoinRoute {
+  return mainConversationId !== "" && pushedConversationId === mainConversationId ? "adopt-main-token" : "open-stream";
+}

package/lib/runner_registry.ts

@@ -32,7 +32,7 @@
  * which is the one loss JP asked us never to cause.
  */
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { presenceDir } from "./presence_record.js";
 
@@ -424,3 +424,105 @@ export function markClosed(registry: Registry, instanceIds: readonly string[], n
   }
   return changed;
 }
+
+// ── #687: close requests — the runner stays the ONLY writer of its registry ──────────────────
+//
+// A dissolve kills, THEN revokes: by then the runner has reported the agent `down` (ambiguous:
+// greyed, relaunchable) and deleted its record, so it never learns the end was decided — measured,
+// a dissolved and revoked agent stayed `active`. The dissolve must not write the registry itself:
+// `updateRegistry` is read-modify-write with no cross-process lock, and a second writer loses the
+// runner's own updates (review Codex). It drops a REQUEST file instead; the runner applies it on its
+// next beat, inside its own write, and removes it after that write succeeded.
+
+const CLOSE_REQUEST_RE = /^([0-9a-f]{32})\.json$/;
+
+export function closeRequestsDir(identityBaseUrl: string, lockDir?: string): string {
+  return join(runnerStateDir(identityBaseUrl, lockDir), "close-requests");
+}
+
+/**
+ * Ask EVERY runner of this machine to close these instances. Every one, not the one whose identity
+ * the caller believes in: the registry is keyed by the runner's identity base URL, which the caller's
+ * env may spell differently (review Opus) — and an instance id is globally unique, so a request in
+ * another backend's runner matches nothing there. Returns how many runner directories were found.
+ */
+export function requestCloseInEveryRunner(instanceIds: readonly string[], lockDir: string, now: number): number {
+  const root = join(lockDir, "presence");
+  let backends: string[];
+  try {
+    backends = readdirSync(root);
+  } catch {
+    return 0;
+  }
+  let dirs = 0;
+  for (const b of backends) {
+    const runnerDir = join(root, b, "runner");
+    if (!existsSync(runnerDir)) continue;
+    dirs++;
+    for (const id of instanceIds) {
+      if (!/^[0-9a-f]{32}$/.test(id)) continue;
+      atomicWriteJson(join(runnerDir, "close-requests", `${id}.json`), { instance_id: id, requested_at: now });
+    }
+  }
+  return dirs;
+}
+
+export interface CloseRequest {
+  instance_id: string;
+  /** Epoch ms; 0 when the file could not be read (then it is expired at once). */
+  requested_at: number;
+}
+
+/**
+ * A request is kept until an entry carrying its instance is CLOSED (review Codex): one read before
+ * the beat joined the instance to its entry would otherwise be consumed with nothing closed. A
+ * request that never matches — the copies sent to the machine's OTHER live runners — expires after
+ * `CLOSE_REQUEST_TTL_MS`. ⚠ Only a runner that BEATS expires anything: in the directory of a runner
+ * that no longer runs, nobody reads them, and they stay (harmless: a few bytes, matching nothing).
+ */
+export const CLOSE_REQUEST_TTL_MS = 24 * 60 * 60 * 1000;
+
+export function readCloseRequests(identityBaseUrl: string, lockDir?: string): CloseRequest[] {
+  const dir = closeRequestsDir(identityBaseUrl, lockDir);
+  let names: string[];
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out: CloseRequest[] = [];
+  for (const n of names) {
+    const id = CLOSE_REQUEST_RE.exec(n)?.[1];
+    if (id === undefined) continue;
+    let at = 0;
+    try {
+      const v: unknown = JSON.parse(readFileSync(join(dir, n), "utf8"));
+      if (isObject(v) && typeof v.requested_at === "number") at = v.requested_at;
+    } catch {
+      // unreadable: expires at once
+    }
+    out.push({ instance_id: id, requested_at: at });
+  }
+  return out;
+}
+
+/** The requests that are DONE: their instance's entry is closed, or they expired. PURE. */
+export function settledCloseRequests(registry: Registry, requests: readonly CloseRequest[], now: number): string[] {
+  const closed = new Set(
+    Object.values(registry.entries)
+      .filter((e) => e.state === "closed" && e.instance_id !== null)
+      .map((e) => e.instance_id as string),
+  );
+  return requests.filter((q) => closed.has(q.instance_id) || now - q.requested_at > CLOSE_REQUEST_TTL_MS).map((q) => q.instance_id);
+}
+
+/** Only after the registry write that applied them succeeded. */
+export function dropCloseRequests(identityBaseUrl: string, ids: readonly string[], lockDir?: string): void {
+  for (const id of ids) {
+    try {
+      unlinkSync(join(closeRequestsDir(identityBaseUrl, lockDir), `${id}.json`));
+    } catch {
+      // already gone
+    }
+  }
+}

package/lib/runner_roster.ts

@@ -90,6 +90,8 @@ export interface CollectedRoster {
   endedFiles: Map<string, { path: string; content: string }>;
   /** Why this beat reported nothing it could not prove. */
   notes: string[];
+  /** #687: one line per ended agent OBSERVED (logged even if `capRoster` defers its report), for the runner's log (`endLine`). */
+  ends: string[];
 }
 
 /** The process table: pid → start time, or `undefined` when the instrument did not see. */
@@ -108,6 +110,7 @@ function emptyCollected(note?: string): CollectedRoster {
     seen: [],
     endedFiles: new Map(),
     notes: note === undefined ? [] : [note],
+    ends: [],
   };
 }
 
@@ -116,6 +119,31 @@ type Classified =
   | { kind: "closed" | "down"; record: PresenceRecord }
   | { kind: "unknown"; why: string };
 
+/**
+ * #687 — WHY an agent ended, in the runner's log. Claude Code keeps a channel's stderr only until
+ * the MCP connection is up, and the record is deleted once the server acknowledges it: without
+ * this line, a channel that exits after its start (measured: a relaunch killed by `stop`) leaves
+ * NO trace anywhere. The reason is the one the channel wrote; a record still `active` whose
+ * process is gone wrote none.
+ */
+export function endLine(record: PresenceRecord, verdict: "closed" | "down"): string {
+  const why = record.state === "ended" ? describeEnd(record.ended_reason) : "process gone, no end written";
+  return `agent ${record.label ?? "(no label)"} (${record.instance_id}) ended: ${why} -> ${verdict}`;
+}
+
+/**
+ * ⚠ `revoked` is what the channel writes on ANY server `stop` (`viber-channel.ts`, `case "stop"`):
+ * a revocation, an offline sweep, OR a second stream of the same identity superseding the first
+ * (#315) — the very cause of #687, which a bare "revoked" would have pointed away from (review
+ * Opus). The line says what the word covers. A new reason value is NOT the fix: a runner of an
+ * older release refuses a record whose reason it does not know (`END_REASONS`), so it would stop
+ * reporting that agent at all.
+ */
+function describeEnd(reason: string | null): string {
+  if (reason === "revoked") return "revoked (a server `stop`: revocation, offline sweep, or a superseded stream)";
+  return reason ?? "unknown";
+}
+
 /** Classify ONE record against the process table. PURE — the witness's subject. */
 export function classifyRecord(record: PresenceRecord, table: ProcessTable): Classified {
   if (record.state === "ended") {
@@ -179,6 +207,7 @@ export async function collectRoster(deps: CollectDeps): Promise<CollectedRoster>
     } else {
       out.roster[c.kind].push(record.instance_id);
       out.endedFiles.set(record.instance_id, { path, content: JSON.stringify(record) });
+      out.ends.push(endLine(record, c.kind));
     }
   }
   return capRoster(out);
@@ -408,6 +437,8 @@ async function rosterBeatOnce(auth: RosterBeatAuth, deps: RosterBeatDeps): Promi
     enumerate: deps.enumerate ?? (() => enumerateStartTimes()),
   });
   for (const note of collected.notes) noteOnce(note, log);
+  // Resent every beat until acknowledged: logged ONCE per distinct line.
+  for (const end of collected.ends) noteOnce(end, log);
   // #627 step-07: an instance REPLACED by a relaunch is reported closed until the
   // server acknowledges it — so no greyed ghost stays behind the new agent.
   const { closes: pendingCloses, replaced } = pendingClosesOf(identity, deps.lockDir, collected.roster);
@@ -455,9 +486,14 @@ async function rosterBeatOnce(auth: RosterBeatAuth, deps: RosterBeatDeps): Promi
   }
   const removed = applyAck(collected, ack, { identityBaseUrl: identity, lockDir: deps.lockDir, now, log });
   const closedNow = removed.filter((id) => collected.roster.closed.includes(id));
+  // #687: closes REQUESTED by a dissolve (it revoked them after the kill) — applied in THIS write,
+  // so the runner stays the registry's only writer, and dropped only once the write succeeded.
+  const requested = reg.readCloseRequests(identity, deps.lockDir);
+  let settled: string[] = [];
   const result = reg.updateRegistry(reg.registryPath(identity, deps.lockDir), (r) => {
     const synced = reg.syncFromRecords(r, collected.seen);
-    const closed = reg.markClosed(r, closedNow, now());
+    const closed = reg.markClosed(r, [...closedNow, ...requested.map((q) => q.instance_id)], now());
+    settled = reg.settledCloseRequests(r, requested, now());
     let cleared = false;
     if (ack.presence_applied) {
       for (const e of Object.values(r.entries)) {
@@ -494,6 +530,8 @@ async function rosterBeatOnce(auth: RosterBeatAuth, deps: RosterBeatDeps): Promi
     return synced || closed || cleared;
   });
   if (!result.ok) noteOnce(`registry not updated: ${result.error}`, log);
+  // Only what is DONE (its entry closed, or expired): an instance not joined yet keeps its request.
+  else if (settled.length > 0) reg.dropCloseRequests(identity, settled, deps.lockDir);
   try {
     reg.writeRunnerState(reg.runnerStatePath(identity, deps.lockDir), { runner_id: auth.runner_id, last_beat_ok_at: now() });
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.37",
+  "version": "0.8.38",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-channel.ts

@@ -72,6 +72,7 @@ import { warnIfStale } from "./lib/version_check.ts";
 import { capabilitiesText } from "./lib/capabilities.ts";
 import { readLocalVersion } from "./lib/version_check.ts";
 import { BOW_OUT_MESSAGE, shouldBowOutToPlugin } from "./lib/cli_bow_out.ts";
+import { routeJoin } from "./lib/own_join.ts";
 import { resolveLockDir } from "./lib/lock_dir.ts";
 import { acquireLockFile, createLockSlot } from "./lib/bridge_lock.ts";
 
@@ -832,7 +833,20 @@ try {
       { getBaseUrl: apiBase, instanceId: OWN_INSTANCE_ID, instanceToken },
       {
         log: (m) => process.stderr.write(m),
-        onJoin: (pushed) => startDmStream(pushed),
+        onJoin: (pushed) => {
+          // #687: a join for our OWN main conversation must never open a second stream on it.
+          if (routeJoin(pushed.conversation_id, CONVERSATION_ID) === "adopt-main-token") {
+            // Every reader takes CONVERSATION_TOKEN at call time (send, ack, SSE headers, refresh).
+            // The refresh stays scheduled on the OLD expiry: it fires early, never late, and it
+            // presents this adopted token — safe (review Opus + Codex).
+            CONVERSATION_TOKEN = pushed.conversation_token;
+            process.stderr.write(
+              `[viber-channel] join pushed for the main conversation ${CONVERSATION_ID} — token adopted, no second stream (#687)\n`,
+            );
+            return;
+          }
+          startDmStream(pushed);
+        },
         onStop: (reason) =>
           process.stderr.write(`[viber-channel] control stream stopped (${reason})\n`),
         // #627: this agent never beats on the network — its runner answers for it