viber-channel 0.8.5 → 0.8.7

package/lib/dm_stream.ts

@@ -27,6 +27,21 @@ export interface DmMessage {
   artifact?: { content: string; format?: "markdown" | "code" | "json" | "html" } | null;
 }
 
+/**
+ * Persistent cross-run dedup watermark for ONE DM conversation (#427). Holds the
+ * highest message id already DELIVERED to the agent in a prior `runDmStream`.
+ * The caller keeps one of these per conversation and passes it back on every
+ * (re-)join, so it SURVIVES the abort+restart cycle that `startDmStream` does on
+ * a re-pushed join. Mutated in place. Without it every re-join allocates a fresh
+ * `handledIds`, re-fetches the full history, and replays every already-delivered
+ * message (the "pong loop" the agent saw) — the run-scoped `handledIds` cannot
+ * catch that because it is empty at the start of each run.
+ */
+export interface DmWatermark {
+  /** Highest delivered message id (0 = nothing delivered yet). */
+  lastId: number;
+}
+
 /** Signature of the catch-up fetch (mirrors messages.ts `fetchMessages`). */
 export type FetchMessagesFn = (
   baseUrl: string,
@@ -66,6 +81,16 @@ export interface DmStreamOptions {
    * forward anything published while we were disconnected (#291 step-03).
    */
   fetchMessagesImpl?: FetchMessagesFn;
+  /**
+   * Cross-run dedup watermark (#427). The run-scoped `handledIds` only dedups
+   * WITHIN a single run; a re-join starts a fresh run with an empty set and the
+   * catch-up re-fetches the whole history. Supplying a caller-owned watermark
+   * (persisted across joins) suppresses ids already delivered in a prior run,
+   * while ids ABOVE the watermark still fire — so a message that arrived during
+   * detachment is preserved (#291 trigger-on-join). Advanced only after a
+   * successful delivery. Omitted → no cross-run dedup (legacy behaviour).
+   */
+  watermark?: DmWatermark;
 }
 
 /** Resolve after `ms`, or early when `signal` aborts. */
@@ -106,6 +131,20 @@ async function forwardMessage(
       ? String(msg.id)
       : undefined;
   if (idStr && handledIds.has(idStr)) return; // already forwarded (live or catch-up)
+  // Cross-run dedup (#427): the message id is `INTEGER PRIMARY KEY AUTOINCREMENT`
+  // in D1 (migration 0009), so the server assigns a STRICTLY INCREASING, never-
+  // reused id at insert — a genuinely new message always outranks everything
+  // already delivered. Hence any id at or below the watermark was already
+  // DELIVERED in a prior run and a re-join's full-history re-fetch must not replay
+  // it; ids ABOVE the watermark are new (incl. a trigger that arrived while
+  // detached) and still fire (#291). The AUTOINCREMENT guarantee is why a
+  // watermark is sufficient and a per-id Set is not needed (review: Opus/Codex).
+  // Use isSafeInteger (not isFinite) so an id beyond 2^53 — where Number() loses
+  // precision and could collide — falls through to normal handling + the in-run
+  // handledIds filter rather than silently mis-gating. The watermark only ever
+  // advances AFTER a successful delivery, so a NaN/absent id is never watermarked.
+  const numId = idStr !== undefined ? Number(idStr) : Number.NaN;
+  if (opts.watermark && Number.isSafeInteger(numId) && numId <= opts.watermark.lastId) return;
   // Content guard BEFORE consuming the id: a content-less payload must not burn
   // its id in handledIds, or a later (correctly-populated) catch-up of the same
   // id would be suppressed forever (review: Opus #4).
@@ -121,6 +160,12 @@ async function forwardMessage(
   try {
     await opts.onMessage(normalized);
     if (idStr) handledIds.add(idStr);
+    // Advance the cross-run watermark ONLY after a successful delivery (#427,
+    // Opus guard): a crash mid-handling leaves the id un-watermarked so the next
+    // catch-up retries it — at-least-once over at-most-once, same as handledIds.
+    if (opts.watermark && Number.isSafeInteger(numId) && numId > opts.watermark.lastId) {
+      opts.watermark.lastId = numId;
+    }
   } catch (handlerErr) {
     opts.log?.(
       `[dm-stream] onMessage handler error: ${handlerErr instanceof Error ? handlerErr.message : String(handlerErr)}\n`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-channel.ts

@@ -47,7 +47,7 @@ import {
   runPersistentControlStream,
   sendInstanceHeartbeat,
 } from "./lib/control_stream.ts";
-import { runDmStream } from "./lib/dm_stream.ts";
+import { type DmWatermark, runDmStream } from "./lib/dm_stream.ts";
 import { isOwnMessage } from "./lib/self_echo.ts";
 import {
   createTokenRefreshScheduler,
@@ -654,6 +654,19 @@ let INSTANCE_TOKEN = "";
 // starts a new one, so a stuck/stale stream can never block a fresh join.
 const activeDmStreams = new Map<string, AbortController>();
 
+// Cross-run dedup watermark per DM conversation (#427). `startDmStream` aborts
+// and RESTARTS runDmStream on every re-pushed join, and each run's `handledIds`
+// starts empty + re-fetches the full history — which replayed every already-
+// delivered message to the agent (the "pong loop"). This map persists the
+// highest delivered id ACROSS those restarts so a re-join only surfaces genuinely
+// new messages. Kept for the process lifetime and NOT purged on stream end:
+// dropping an entry while a re-join is possible would replay the whole history
+// again (Opus's purge-safety nuance). Growth is O(distinct DM conversations seen)
+// — NOT O(1) and NOT bounded by concurrent streams — but each entry is a single
+// number and the distinct-peer count is small in practice, so it is acceptable
+// without a TTL. Revisit if conversation_ids ever churn (many ephemeral DMs).
+const dmWatermarks = new Map<string, DmWatermark>();
+
 try {
   // #269: acquire this channel's server-issued instance identity — env-injected
   // VIBER_INSTANCE_TOKEN > persisted auth.json instance_token > register a new
@@ -1136,6 +1149,13 @@ function startDmStream(minted: ConversationMintResponse): void {
   }
   const controller = new AbortController();
   activeDmStreams.set(minted.conversation_id, controller);
+  // Reuse this conversation's persistent watermark (or seed one) so the restart
+  // above does not replay history already delivered in the prior run (#427).
+  let watermark = dmWatermarks.get(minted.conversation_id);
+  if (!watermark) {
+    watermark = { lastId: 0 };
+    dmWatermarks.set(minted.conversation_id, watermark);
+  }
   process.stderr.write(`[viber-channel] joining agent DM ${minted.conversation_id}\n`);
   // The agent's liveness (and thus the DM's presence in the "Active" sidebar) is
   // proven by the INSTANCE heartbeat, not a per-conversation beat — the legacy
@@ -1147,6 +1167,7 @@ function startDmStream(minted: ConversationMintResponse): void {
     conversationToken: minted.conversation_token,
     log: (m) => process.stderr.write(m),
     signal: controller.signal,
+    watermark,
     onMessage: (msg) => pushMessage(msg, { conversationId: minted.conversation_id }),
   }).finally(() => {
     // Only evict if WE are still the registered controller — a newer join may

package/viber-codex-bridge.ts

@@ -7,6 +7,7 @@
  * Codex's final assistant reply back into Viber.
  */
 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { authFilePath, loadAuth } from "./lib/auth.ts";
@@ -242,33 +243,81 @@ function buildReply(receivedContent: string, msg: ConversationMessage | undefine
 // the shared runConversationStream now owns token refresh, so the bridge no
 // longer wires it directly.
 
-// #280 step-12: the state file is per AGENT. Several agents on one machine each own
-// their own file, so concurrent read-modify-write of a single shared JSON can't drop
-// another agent's thread entry (Codex review P2-A). An explicit
-// VIBER_CODEX_BRIDGE_STATE override still wins (single file, caller's responsibility).
-function stateFilePath(instanceId?: string, cwd: string = process.cwd()): string {
+// #409: monotonic (perf) timing for diagnosing codex spawn / first-response
+// latency. Structured, greppable `timing:` lines — the user's "codex is slow" is
+// largely INHERENT (app-server initialize + first model turn), so we MEASURE where
+// the time goes rather than guess. NOT a behaviour change.
+const nowMs = (): number => performance.now();
+// #409 (Codex): classify a conversation's turn as first vs subsequent and RESERVE
+// the "first" label atomically (before any await), so two near-simultaneous
+// messages can't both be logged `which=first`. Pure/testable.
+export function classifyTurn(
+  seen: Set<string>,
+  convId: string,
+): "first" | "subsequent" {
+  if (seen.has(convId)) return "subsequent";
+  seen.add(convId);
+  return "first";
+}
+function logTiming(phase: string, ms: number, extra = ""): void {
+  process.stderr.write(
+    `[viber-codex-bridge] timing: ${phase} ms=${Math.round(ms)}${extra ? ` ${extra}` : ""}\n`,
+  );
+}
+
+// #414: the persistent thread identity. #280 keyed the thread by the server-issued
+// instanceId so multiple agents sharing one conversation each get their own Codex
+// thread — but the instanceId is FRESH on every register (#269), so a same-name
+// re-spawn never found its predecessor's thread (thread/start instead of resume,
+// runtime memory lost). Fix: when an EXPLICIT VIBER_CODEX_BRIDGE_LABEL is set (the
+// stable logical name — vibe-master always sets it to the agent id), key by
+// sha256(label) so a re-spawn under the same name resumes; distinct labels stay
+// isolated (#280 preserved). No explicit label → fall back to the instanceId (no
+// resume, but #280 isolation kept — the DEFAULT `Codex bridge • <cwd>` label is NOT
+// a unique identity, and an empty label must never collapse everyone onto
+// hash("")). The hash is filename-safe (hex) and doesn't leak the label.
+export function threadIdentity(
+  instanceId: string,
+  label: string | undefined,
+): { key: string; fileSuffix: string } {
+  const trimmed = label?.trim();
+  if (trimmed) {
+    const h = createHash("sha256").update(trimmed, "utf8").digest("hex");
+    return { key: `label:${h}`, fileSuffix: `label-${h}` };
+  }
+  return { key: `instance:${instanceId}`, fileSuffix: `instance-${instanceId}` };
+}
+
+// #280 step-12 / #414: the state file is per AGENT IDENTITY (stable label when set,
+// else instanceId). It lives in the workspace's `.viber` dir (per-folder), so two
+// folders — even a cross-project #307 pair using the same explicit label — write
+// DIFFERENT files; the fingerprint in stateKey is defence-in-depth. Concurrent RMW
+// of one file across agents can't drop another's entry (distinct identities →
+// distinct files). An explicit VIBER_CODEX_BRIDGE_STATE override still wins.
+function stateFilePath(
+  instanceId: string,
+  label: string | undefined,
+  cwd: string = process.cwd(),
+): string {
   const override = process.env.VIBER_CODEX_BRIDGE_STATE;
   if (override !== undefined && override.trim() !== "") return override;
-  // Full instance id in the filename (server-issued opaque hex): a truncated id
-  // could collide and reintroduce the shared-file write race this split avoids.
-  const name =
-    instanceId && instanceId.trim() !== ""
-      ? `codex-bridge-threads-${instanceId}.json`
-      : "codex-bridge-threads.json";
-  return join(dirname(authFilePath(cwd)), name);
+  const { fileSuffix } = threadIdentity(instanceId, label);
+  return join(dirname(authFilePath(cwd)), `codex-bridge-threads-${fileSuffix}.json`);
 }
 
-// #280 step-12: the key is per (conversation, AGENT), not per conversation. With
-// several agents sharing one conversation, a conversation-only key would make them
-// resume/clobber the same Codex thread. Including the instance id gives each agent
-// its own persisted thread.
+// #280/#414: the key is per (project, folder, conversation, AGENT IDENTITY). The
+// conversationId is KEPT (a same agent on TWO conversations must not share one
+// runtime thread — cross-conversation contamination); the fingerprint scopes it
+// per folder; the identity is the stable label (or instanceId fallback).
 export function stateKey(
   projectId: number,
   fingerprint: string,
   conversationId: string,
   instanceId: string,
+  label: string | undefined,
 ): string {
-  return `${projectId}:${fingerprint}:${conversationId}:${instanceId}`;
+  const { key } = threadIdentity(instanceId, label);
+  return `${projectId}:${fingerprint}:${conversationId}:${key}`;
 }
 
 function readThreadState(path: string): ThreadState {
@@ -584,11 +633,13 @@ class CodexAppServer {
   }
 
   async initialize(): Promise<void> {
+    const t0 = nowMs(); // #409: measure the app-server init (a big share of spawn latency)
     await this.request("initialize", {
       clientInfo: { name: "viber-codex-bridge", title: "Viber Codex Bridge", version: "0.1.0" },
       capabilities: { experimentalApi: true },
     });
     this.notify("initialized");
+    logTiming("codex.initialize", nowMs() - t0);
   }
 
   async ensureThread(options: {
@@ -598,18 +649,25 @@ class CodexAppServer {
     instanceKey: string;
     newThread: boolean;
   }): Promise<string> {
-    const path = stateFilePath(options.instanceKey);
+    // #414: prefer the STABLE explicit label over the fresh instanceId so a
+    // same-name re-spawn resumes its own thread (see threadIdentity).
+    const label = process.env.VIBER_CODEX_BRIDGE_LABEL;
+    const path = stateFilePath(options.instanceKey, label);
     const state = readThreadState(path);
     const key = stateKey(
       options.auth.project_id,
       options.fingerprint,
       options.conversationId,
       options.instanceKey,
+      label,
     );
     const existing = state.threads[key]?.thread_id;
+    const t0 = nowMs(); // #409: measure thread resume/start (the first-DM cost)
+    let resumeAttempted = false;
 
     if (existing && !options.newThread) {
       try {
+        resumeAttempted = true;
         process.stderr.write(`[viber-codex-bridge] codex: resuming persisted thread ${existing}\n`);
         const resumed = await this.request("thread/resume", {
           threadId: existing,
@@ -620,7 +678,11 @@ class CodexAppServer {
           developerInstructions: AGENT_INSTRUCTIONS,
           excludeTurns: true,
         });
-        return extractThreadId(resumed);
+        // #409 (Codex): validate/extract the id BEFORE logging success — a malformed
+        // response must NOT be logged as resume then again as resume-failed→start.
+        const resumedId = extractThreadId(resumed);
+        logTiming("ensureThread", nowMs() - t0, "outcome=resume");
+        return resumedId;
       } catch (err) {
         process.stderr.write(
           `[viber-codex-bridge] codex: resume failed (${safeErrorMessage(err)}), starting a fresh thread\n`,
@@ -651,6 +713,11 @@ class CodexAppServer {
     };
     writeThreadState(path, state);
     process.stderr.write(`[viber-codex-bridge] codex: persisted thread ${threadId} in ${path}\n`);
+    logTiming(
+      "ensureThread",
+      nowMs() - t0,
+      `outcome=${resumeAttempted ? "resume-failed→start" : "start"}`,
+    );
     return threadId;
   }
 
@@ -1166,9 +1233,15 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
 
   // codex's per-conversation adapter for the shared runConversationStream:
   // ensureThread (keyed by conversation+agent) then the tracked, queued codex turn.
+  // #409: which conversations have already run their FIRST model turn, so we can
+  // report the (expensive) first turn distinctly from the fast subsequent ones.
+  const firstTurnDone = new Set<string>();
   const makeCodexAdapter = (codex: CodexAppServer, instanceKey: string): MakeRunTurn =>
     async (convId, runtime) => {
+      // #409: time join → thread ready (the eager ensureThread on a fresh join).
+      const tJoin = nowMs();
       let threadPromise = threadCache.get(convId);
+      const cached = threadPromise !== undefined;
       if (!threadPromise) {
         threadPromise = codex
           .ensureThread({ auth, fingerprint, conversationId: convId, instanceKey, newThread: options.newThread })
@@ -1179,8 +1252,22 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
         threadCache.set(convId, threadPromise);
       }
       const codexThreadId = await threadPromise;
+      if (!cached) logTiming("join→thread-ready", nowMs() - tJoin, `conv=${convId.slice(0, 8)}`);
       process.stderr.write(`${LOG_PREFIX} codex thread ready for ${convId} (thread ${codexThreadId})\n`);
-      return makeCodexRunTurn(codex, codexThreadId, runtime, options, queue, tracker);
+      const runTurn = makeCodexRunTurn(codex, codexThreadId, runtime, options, queue, tracker);
+      // #409: wrap to measure the FIRST model turn (cold: the biggest perceived
+      // latency) apart from subsequent turns. Pure instrumentation, same behaviour.
+      return async (content, msg, signal) => {
+        // #409 (Codex): reserve first/subsequent BEFORE the await so concurrent
+        // turns can't both be classified `first`.
+        const which = classifyTurn(firstTurnDone, convId);
+        const tTurn = nowMs();
+        try {
+          return await runTurn(content, msg, signal);
+        } finally {
+          logTiming("turn", nowMs() - tTurn, `which=${which} conv=${convId.slice(0, 8)}`);
+        }
+      };
     };
 
   if (options.awaitInvite) {