viber-channel 0.8.37 → 0.8.39

package/lib/agent_tools.ts

@@ -194,11 +194,20 @@ export async function messageAgent(
   }
   if (!outcome.ok) {
     let friendly: string;
-    if (outcome.detail === "target_offline") {
+    if (outcome.detail === "target_offline" && outcome.liveInstanceIds) {
+      // #692: the id is stale and its agent is online under several ids (a
+      // reconnect race) — the server refused to guess.
+      friendly =
+        `${trimmedPeerId} is a stale id: that agent reconnected and is online under ` +
+        `${outcome.liveInstanceIds.join(", ")}. Call message_agent again with one of them.`;
+    } else if (outcome.detail === "target_offline") {
       // #627: a just-launched agent comes online with its runner's first beat (≤ 30 s).
+      // #692: an agent that reconnected under a new id is followed by the server;
+      // reaching here means no live instance of it was found under any id.
       friendly =
         "That agent is offline right now — it must be running to receive a DM. " +
-        "If it was just launched, it comes online with its runner's next beat (within 30 s): retry then.";
+        "If it was just launched, it comes online with its runner's next beat (within 30 s): retry then. " +
+        "If you expected it online, check list_agents: it may have been relaunched under another name.";
     } else if (outcome.detail === "dm_unavailable_retry") {
       friendly = "Could not open the DM due to a transient conflict — try message_agent again.";
     } else {
@@ -233,6 +242,14 @@ export async function messageAgent(
   if (!result.ok) {
     return errorText(result.detail);
   }
+  if (outcome.redirect) {
+    // #692: say which agent was reached, and that the id used is stale.
+    return text(
+      `Message sent to agent ${outcome.redirect.to} (DM ${outcome.dm.conversation_id}). ` +
+        `Note: ${outcome.redirect.from} is a stale id — the same agent reconnected as ` +
+        `${outcome.redirect.to}; use that id from now on.`,
+    );
+  }
   return text(`Message sent to agent (DM ${outcome.dm.conversation_id}).`);
 }
 

package/lib/bridge_tool_host.ts

@@ -115,7 +115,8 @@ export const TOOL_DEFS = [
       "(from list_agents) and the text. Opens or reuses a private 1:1 DM and posts your message; " +
       "the agent's reply arrives back on this channel. Targets are normally same-project; an " +
       "ORCHESTRATOR instance (#307) can also message agents of the owner's other projects. " +
-      "Fails if the target agent is offline.",
+      "Fails if the target agent is offline. An id gone stale because the agent reconnected " +
+      "(same name, new id) still reaches it: the result then names the new id to use (#692).",
     inputSchema: {
       type: "object",
       properties: {

package/lib/claude_tool_defs.ts

@@ -104,7 +104,8 @@ export const CLAUDE_TOOL_DEFS = [
       "the agent's reply arrives back on this channel tagged source=agent-dm. " +
       "Targets are normally same-project; an ORCHESTRATOR instance (#307) can also message agents " +
       "of the owner's other projects (ids from its cross-project list_agents). " +
-      "Fails if the target agent is offline.",
+      "Fails if the target agent is offline. An id gone stale because the agent reconnected " +
+      "(same name, new id) still reaches it: the result then names the new id to use (#692).",
     inputSchema: {
       type: "object" as const,
       properties: {

package/lib/own_join.ts

@@ -0,0 +1,22 @@
+/**
+ * own_join.ts — a `join` pushed for the channel's OWN main conversation (#687).
+ *
+ * Measured on staging: an invite of this instance into the conversation it already
+ * streams (the web invite, or the relaunch handover of #627) rotates its member token and
+ * pushes a `join`. Opening a second stream on that conversation with the same identity
+ * makes Python evict the first one with `stop` (#315), and the channel reads `stop` as a
+ * revocation and exits — the agent dies with exit 0 and nothing in its MCP log.
+ *
+ * So a join for the main conversation never opens a stream: the channel ADOPTS the new
+ * token (the old one was replaced server-side) and keeps its one stream. Any other
+ * conversation is a DM/room join, as before.
+ *
+ * `mainConversationId` is the conversation the channel ADOPTED (after mint or reattach),
+ * never `VIBER_TARGET_CONVERSATION_ID` alone: a channel that minted its own conversation
+ * has no target, and one whose target reattach fell back to a mint holds another id.
+ */
+export type JoinRoute = "adopt-main-token" | "open-stream";
+
+export function routeJoin(pushedConversationId: string, mainConversationId: string): JoinRoute {
+  return mainConversationId !== "" && pushedConversationId === mainConversationId ? "adopt-main-token" : "open-stream";
+}

package/lib/peers.ts

@@ -153,9 +153,22 @@ export interface OpenDmResult {
   invited: boolean;
 }
 
+/** #692: the server opened the DM with the live instance of the identity the
+ *  caller named by a stale id. */
+export interface OpenDmRedirect {
+  from: string;
+  to: string;
+}
+
 export type OpenDmOutcome =
-  | { ok: true; dm: OpenDmResult }
-  | { ok: false; detail: string; status: number };
+  | { ok: true; dm: OpenDmResult; redirect?: OpenDmRedirect }
+  | { ok: false; detail: string; status: number; liveInstanceIds?: string[] };
+
+/** Server-supplied ids end up in the model's prompt: only an instance id shape
+ *  (32 lowercase hex) is ever echoed back, never free text. */
+function instanceIdOrNull(v: unknown): string | null {
+  return typeof v === "string" && /^[0-9a-f]{32}$/.test(v) ? v : null;
+}
 
 /**
  * Open-or-create a 1:1 DM with `peerInstanceId` (POST /api/instances/dms).
@@ -180,13 +193,20 @@ export async function openDm(
 
   if (!resp.ok) {
     let detail = `HTTP ${resp.status}`;
+    let liveInstanceIds: string[] | undefined;
     try {
-      const json = (await resp.json()) as { detail?: string };
+      const json = (await resp.json()) as { detail?: string; live_instance_ids?: unknown };
       if (typeof json.detail === "string") detail = json.detail;
+      // #692: several live instances of a stale id's identity — the server
+      // refused to guess and named them.
+      if (Array.isArray(json.live_instance_ids)) {
+        const ids = json.live_instance_ids.map(instanceIdOrNull).filter((id): id is string => id !== null);
+        if (ids.length > 0) liveInstanceIds = ids;
+      }
     } catch {
       /* non-JSON body */
     }
-    return { ok: false, detail, status: resp.status };
+    return { ok: false, detail, status: resp.status, ...(liveInstanceIds ? { liveInstanceIds } : {}) };
   }
 
   const body = (await resp.json()) as {
@@ -194,6 +214,8 @@ export async function openDm(
     conversation_token?: string;
     expires_at?: number;
     invited?: boolean;
+    peer_instance_id?: unknown;
+    redirected_from?: unknown;
   };
   if (!body.conversation?.id || typeof body.conversation_token !== "string") {
     throw new Error("openDm: malformed response (missing conversation id or token)");
@@ -206,5 +228,14 @@ export async function openDm(
       expires_at: typeof body.expires_at === "number" ? body.expires_at : 0,
       invited: body.invited === true,
     },
+    ...redirectOf(body.redirected_from, body.peer_instance_id),
   };
 }
+
+/** #692: both ids well-formed and distinct, or no redirect at all. An older
+ *  server sends neither field. */
+function redirectOf(from: unknown, to: unknown): { redirect?: OpenDmRedirect } {
+  const f = instanceIdOrNull(from);
+  const t = instanceIdOrNull(to);
+  return f && t && f !== t ? { redirect: { from: f, to: t } } : {};
+}

package/lib/runner_registry.ts

@@ -32,7 +32,7 @@
  * which is the one loss JP asked us never to cause.
  */
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { presenceDir } from "./presence_record.js";
 
@@ -424,3 +424,105 @@ export function markClosed(registry: Registry, instanceIds: readonly string[], n
   }
   return changed;
 }
+
+// ── #687: close requests — the runner stays the ONLY writer of its registry ──────────────────
+//
+// A dissolve kills, THEN revokes: by then the runner has reported the agent `down` (ambiguous:
+// greyed, relaunchable) and deleted its record, so it never learns the end was decided — measured,
+// a dissolved and revoked agent stayed `active`. The dissolve must not write the registry itself:
+// `updateRegistry` is read-modify-write with no cross-process lock, and a second writer loses the
+// runner's own updates (review Codex). It drops a REQUEST file instead; the runner applies it on its
+// next beat, inside its own write, and removes it after that write succeeded.
+
+const CLOSE_REQUEST_RE = /^([0-9a-f]{32})\.json$/;
+
+export function closeRequestsDir(identityBaseUrl: string, lockDir?: string): string {
+  return join(runnerStateDir(identityBaseUrl, lockDir), "close-requests");
+}
+
+/**
+ * Ask EVERY runner of this machine to close these instances. Every one, not the one whose identity
+ * the caller believes in: the registry is keyed by the runner's identity base URL, which the caller's
+ * env may spell differently (review Opus) — and an instance id is globally unique, so a request in
+ * another backend's runner matches nothing there. Returns how many runner directories were found.
+ */
+export function requestCloseInEveryRunner(instanceIds: readonly string[], lockDir: string, now: number): number {
+  const root = join(lockDir, "presence");
+  let backends: string[];
+  try {
+    backends = readdirSync(root);
+  } catch {
+    return 0;
+  }
+  let dirs = 0;
+  for (const b of backends) {
+    const runnerDir = join(root, b, "runner");
+    if (!existsSync(runnerDir)) continue;
+    dirs++;
+    for (const id of instanceIds) {
+      if (!/^[0-9a-f]{32}$/.test(id)) continue;
+      atomicWriteJson(join(runnerDir, "close-requests", `${id}.json`), { instance_id: id, requested_at: now });
+    }
+  }
+  return dirs;
+}
+
+export interface CloseRequest {
+  instance_id: string;
+  /** Epoch ms; 0 when the file could not be read (then it is expired at once). */
+  requested_at: number;
+}
+
+/**
+ * A request is kept until an entry carrying its instance is CLOSED (review Codex): one read before
+ * the beat joined the instance to its entry would otherwise be consumed with nothing closed. A
+ * request that never matches — the copies sent to the machine's OTHER live runners — expires after
+ * `CLOSE_REQUEST_TTL_MS`. ⚠ Only a runner that BEATS expires anything: in the directory of a runner
+ * that no longer runs, nobody reads them, and they stay (harmless: a few bytes, matching nothing).
+ */
+export const CLOSE_REQUEST_TTL_MS = 24 * 60 * 60 * 1000;
+
+export function readCloseRequests(identityBaseUrl: string, lockDir?: string): CloseRequest[] {
+  const dir = closeRequestsDir(identityBaseUrl, lockDir);
+  let names: string[];
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out: CloseRequest[] = [];
+  for (const n of names) {
+    const id = CLOSE_REQUEST_RE.exec(n)?.[1];
+    if (id === undefined) continue;
+    let at = 0;
+    try {
+      const v: unknown = JSON.parse(readFileSync(join(dir, n), "utf8"));
+      if (isObject(v) && typeof v.requested_at === "number") at = v.requested_at;
+    } catch {
+      // unreadable: expires at once
+    }
+    out.push({ instance_id: id, requested_at: at });
+  }
+  return out;
+}
+
+/** The requests that are DONE: their instance's entry is closed, or they expired. PURE. */
+export function settledCloseRequests(registry: Registry, requests: readonly CloseRequest[], now: number): string[] {
+  const closed = new Set(
+    Object.values(registry.entries)
+      .filter((e) => e.state === "closed" && e.instance_id !== null)
+      .map((e) => e.instance_id as string),
+  );
+  return requests.filter((q) => closed.has(q.instance_id) || now - q.requested_at > CLOSE_REQUEST_TTL_MS).map((q) => q.instance_id);
+}
+
+/** Only after the registry write that applied them succeeded. */
+export function dropCloseRequests(identityBaseUrl: string, ids: readonly string[], lockDir?: string): void {
+  for (const id of ids) {
+    try {
+      unlinkSync(join(closeRequestsDir(identityBaseUrl, lockDir), `${id}.json`));
+    } catch {
+      // already gone
+    }
+  }
+}

package/lib/runner_roster.ts

@@ -90,6 +90,8 @@ export interface CollectedRoster {
   endedFiles: Map<string, { path: string; content: string }>;
   /** Why this beat reported nothing it could not prove. */
   notes: string[];
+  /** #687: one line per ended agent OBSERVED (logged even if `capRoster` defers its report), for the runner's log (`endLine`). */
+  ends: string[];
 }
 
 /** The process table: pid → start time, or `undefined` when the instrument did not see. */
@@ -108,6 +110,7 @@ function emptyCollected(note?: string): CollectedRoster {
     seen: [],
     endedFiles: new Map(),
     notes: note === undefined ? [] : [note],
+    ends: [],
   };
 }
 
@@ -116,6 +119,31 @@ type Classified =
   | { kind: "closed" | "down"; record: PresenceRecord }
   | { kind: "unknown"; why: string };
 
+/**
+ * #687 — WHY an agent ended, in the runner's log. Claude Code keeps a channel's stderr only until
+ * the MCP connection is up, and the record is deleted once the server acknowledges it: without
+ * this line, a channel that exits after its start (measured: a relaunch killed by `stop`) leaves
+ * NO trace anywhere. The reason is the one the channel wrote; a record still `active` whose
+ * process is gone wrote none.
+ */
+export function endLine(record: PresenceRecord, verdict: "closed" | "down"): string {
+  const why = record.state === "ended" ? describeEnd(record.ended_reason) : "process gone, no end written";
+  return `agent ${record.label ?? "(no label)"} (${record.instance_id}) ended: ${why} -> ${verdict}`;
+}
+
+/**
+ * ⚠ `revoked` is what the channel writes on ANY server `stop` (`viber-channel.ts`, `case "stop"`):
+ * a revocation, an offline sweep, OR a second stream of the same identity superseding the first
+ * (#315) — the very cause of #687, which a bare "revoked" would have pointed away from (review
+ * Opus). The line says what the word covers. A new reason value is NOT the fix: a runner of an
+ * older release refuses a record whose reason it does not know (`END_REASONS`), so it would stop
+ * reporting that agent at all.
+ */
+function describeEnd(reason: string | null): string {
+  if (reason === "revoked") return "revoked (a server `stop`: revocation, offline sweep, or a superseded stream)";
+  return reason ?? "unknown";
+}
+
 /** Classify ONE record against the process table. PURE — the witness's subject. */
 export function classifyRecord(record: PresenceRecord, table: ProcessTable): Classified {
   if (record.state === "ended") {
@@ -179,6 +207,7 @@ export async function collectRoster(deps: CollectDeps): Promise<CollectedRoster>
     } else {
       out.roster[c.kind].push(record.instance_id);
       out.endedFiles.set(record.instance_id, { path, content: JSON.stringify(record) });
+      out.ends.push(endLine(record, c.kind));
     }
   }
   return capRoster(out);
@@ -408,6 +437,8 @@ async function rosterBeatOnce(auth: RosterBeatAuth, deps: RosterBeatDeps): Promi
     enumerate: deps.enumerate ?? (() => enumerateStartTimes()),
   });
   for (const note of collected.notes) noteOnce(note, log);
+  // Resent every beat until acknowledged: logged ONCE per distinct line.
+  for (const end of collected.ends) noteOnce(end, log);
   // #627 step-07: an instance REPLACED by a relaunch is reported closed until the
   // server acknowledges it — so no greyed ghost stays behind the new agent.
   const { closes: pendingCloses, replaced } = pendingClosesOf(identity, deps.lockDir, collected.roster);
@@ -455,9 +486,14 @@ async function rosterBeatOnce(auth: RosterBeatAuth, deps: RosterBeatDeps): Promi
   }
   const removed = applyAck(collected, ack, { identityBaseUrl: identity, lockDir: deps.lockDir, now, log });
   const closedNow = removed.filter((id) => collected.roster.closed.includes(id));
+  // #687: closes REQUESTED by a dissolve (it revoked them after the kill) — applied in THIS write,
+  // so the runner stays the registry's only writer, and dropped only once the write succeeded.
+  const requested = reg.readCloseRequests(identity, deps.lockDir);
+  let settled: string[] = [];
   const result = reg.updateRegistry(reg.registryPath(identity, deps.lockDir), (r) => {
     const synced = reg.syncFromRecords(r, collected.seen);
-    const closed = reg.markClosed(r, closedNow, now());
+    const closed = reg.markClosed(r, [...closedNow, ...requested.map((q) => q.instance_id)], now());
+    settled = reg.settledCloseRequests(r, requested, now());
     let cleared = false;
     if (ack.presence_applied) {
       for (const e of Object.values(r.entries)) {
@@ -494,6 +530,8 @@ async function rosterBeatOnce(auth: RosterBeatAuth, deps: RosterBeatDeps): Promi
     return synced || closed || cleared;
   });
   if (!result.ok) noteOnce(`registry not updated: ${result.error}`, log);
+  // Only what is DONE (its entry closed, or expired): an instance not joined yet keeps its request.
+  else if (settled.length > 0) reg.dropCloseRequests(identity, settled, deps.lockDir);
   try {
     reg.writeRunnerState(reg.runnerStatePath(identity, deps.lockDir), { runner_id: auth.runner_id, last_beat_ok_at: now() });
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.37",
+  "version": "0.8.39",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-channel.ts

@@ -72,6 +72,7 @@ import { warnIfStale } from "./lib/version_check.ts";
 import { capabilitiesText } from "./lib/capabilities.ts";
 import { readLocalVersion } from "./lib/version_check.ts";
 import { BOW_OUT_MESSAGE, shouldBowOutToPlugin } from "./lib/cli_bow_out.ts";
+import { routeJoin } from "./lib/own_join.ts";
 import { resolveLockDir } from "./lib/lock_dir.ts";
 import { acquireLockFile, createLockSlot } from "./lib/bridge_lock.ts";
 
@@ -832,7 +833,20 @@ try {
       { getBaseUrl: apiBase, instanceId: OWN_INSTANCE_ID, instanceToken },
       {
         log: (m) => process.stderr.write(m),
-        onJoin: (pushed) => startDmStream(pushed),
+        onJoin: (pushed) => {
+          // #687: a join for our OWN main conversation must never open a second stream on it.
+          if (routeJoin(pushed.conversation_id, CONVERSATION_ID) === "adopt-main-token") {
+            // Every reader takes CONVERSATION_TOKEN at call time (send, ack, SSE headers, refresh).
+            // The refresh stays scheduled on the OLD expiry: it fires early, never late, and it
+            // presents this adopted token — safe (review Opus + Codex).
+            CONVERSATION_TOKEN = pushed.conversation_token;
+            process.stderr.write(
+              `[viber-channel] join pushed for the main conversation ${CONVERSATION_ID} — token adopted, no second stream (#687)\n`,
+            );
+            return;
+          }
+          startDmStream(pushed);
+        },
         onStop: (reason) =>
           process.stderr.write(`[viber-channel] control stream stopped (${reason})\n`),
         // #627: this agent never beats on the network — its runner answers for it