viber-channel 0.8.6 → 0.8.7

package/lib/dm_stream.ts

@@ -27,6 +27,21 @@ export interface DmMessage {
   artifact?: { content: string; format?: "markdown" | "code" | "json" | "html" } | null;
 }
 
+/**
+ * Persistent cross-run dedup watermark for ONE DM conversation (#427). Holds the
+ * highest message id already DELIVERED to the agent in a prior `runDmStream`.
+ * The caller keeps one of these per conversation and passes it back on every
+ * (re-)join, so it SURVIVES the abort+restart cycle that `startDmStream` does on
+ * a re-pushed join. Mutated in place. Without it every re-join allocates a fresh
+ * `handledIds`, re-fetches the full history, and replays every already-delivered
+ * message (the "pong loop" the agent saw) — the run-scoped `handledIds` cannot
+ * catch that because it is empty at the start of each run.
+ */
+export interface DmWatermark {
+  /** Highest delivered message id (0 = nothing delivered yet). */
+  lastId: number;
+}
+
 /** Signature of the catch-up fetch (mirrors messages.ts `fetchMessages`). */
 export type FetchMessagesFn = (
   baseUrl: string,
@@ -66,6 +81,16 @@ export interface DmStreamOptions {
    * forward anything published while we were disconnected (#291 step-03).
    */
   fetchMessagesImpl?: FetchMessagesFn;
+  /**
+   * Cross-run dedup watermark (#427). The run-scoped `handledIds` only dedups
+   * WITHIN a single run; a re-join starts a fresh run with an empty set and the
+   * catch-up re-fetches the whole history. Supplying a caller-owned watermark
+   * (persisted across joins) suppresses ids already delivered in a prior run,
+   * while ids ABOVE the watermark still fire — so a message that arrived during
+   * detachment is preserved (#291 trigger-on-join). Advanced only after a
+   * successful delivery. Omitted → no cross-run dedup (legacy behaviour).
+   */
+  watermark?: DmWatermark;
 }
 
 /** Resolve after `ms`, or early when `signal` aborts. */
@@ -106,6 +131,20 @@ async function forwardMessage(
       ? String(msg.id)
       : undefined;
   if (idStr && handledIds.has(idStr)) return; // already forwarded (live or catch-up)
+  // Cross-run dedup (#427): the message id is `INTEGER PRIMARY KEY AUTOINCREMENT`
+  // in D1 (migration 0009), so the server assigns a STRICTLY INCREASING, never-
+  // reused id at insert — a genuinely new message always outranks everything
+  // already delivered. Hence any id at or below the watermark was already
+  // DELIVERED in a prior run and a re-join's full-history re-fetch must not replay
+  // it; ids ABOVE the watermark are new (incl. a trigger that arrived while
+  // detached) and still fire (#291). The AUTOINCREMENT guarantee is why a
+  // watermark is sufficient and a per-id Set is not needed (review: Opus/Codex).
+  // Use isSafeInteger (not isFinite) so an id beyond 2^53 — where Number() loses
+  // precision and could collide — falls through to normal handling + the in-run
+  // handledIds filter rather than silently mis-gating. The watermark only ever
+  // advances AFTER a successful delivery, so a NaN/absent id is never watermarked.
+  const numId = idStr !== undefined ? Number(idStr) : Number.NaN;
+  if (opts.watermark && Number.isSafeInteger(numId) && numId <= opts.watermark.lastId) return;
   // Content guard BEFORE consuming the id: a content-less payload must not burn
   // its id in handledIds, or a later (correctly-populated) catch-up of the same
   // id would be suppressed forever (review: Opus #4).
@@ -121,6 +160,12 @@ async function forwardMessage(
   try {
     await opts.onMessage(normalized);
     if (idStr) handledIds.add(idStr);
+    // Advance the cross-run watermark ONLY after a successful delivery (#427,
+    // Opus guard): a crash mid-handling leaves the id un-watermarked so the next
+    // catch-up retries it — at-least-once over at-most-once, same as handledIds.
+    if (opts.watermark && Number.isSafeInteger(numId) && numId > opts.watermark.lastId) {
+      opts.watermark.lastId = numId;
+    }
   } catch (handlerErr) {
     opts.log?.(
       `[dm-stream] onMessage handler error: ${handlerErr instanceof Error ? handlerErr.message : String(handlerErr)}\n`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-channel.ts

@@ -47,7 +47,7 @@ import {
   runPersistentControlStream,
   sendInstanceHeartbeat,
 } from "./lib/control_stream.ts";
-import { runDmStream } from "./lib/dm_stream.ts";
+import { type DmWatermark, runDmStream } from "./lib/dm_stream.ts";
 import { isOwnMessage } from "./lib/self_echo.ts";
 import {
   createTokenRefreshScheduler,
@@ -654,6 +654,19 @@ let INSTANCE_TOKEN = "";
 // starts a new one, so a stuck/stale stream can never block a fresh join.
 const activeDmStreams = new Map<string, AbortController>();
 
+// Cross-run dedup watermark per DM conversation (#427). `startDmStream` aborts
+// and RESTARTS runDmStream on every re-pushed join, and each run's `handledIds`
+// starts empty + re-fetches the full history — which replayed every already-
+// delivered message to the agent (the "pong loop"). This map persists the
+// highest delivered id ACROSS those restarts so a re-join only surfaces genuinely
+// new messages. Kept for the process lifetime and NOT purged on stream end:
+// dropping an entry while a re-join is possible would replay the whole history
+// again (Opus's purge-safety nuance). Growth is O(distinct DM conversations seen)
+// — NOT O(1) and NOT bounded by concurrent streams — but each entry is a single
+// number and the distinct-peer count is small in practice, so it is acceptable
+// without a TTL. Revisit if conversation_ids ever churn (many ephemeral DMs).
+const dmWatermarks = new Map<string, DmWatermark>();
+
 try {
   // #269: acquire this channel's server-issued instance identity — env-injected
   // VIBER_INSTANCE_TOKEN > persisted auth.json instance_token > register a new
@@ -1136,6 +1149,13 @@ function startDmStream(minted: ConversationMintResponse): void {
   }
   const controller = new AbortController();
   activeDmStreams.set(minted.conversation_id, controller);
+  // Reuse this conversation's persistent watermark (or seed one) so the restart
+  // above does not replay history already delivered in the prior run (#427).
+  let watermark = dmWatermarks.get(minted.conversation_id);
+  if (!watermark) {
+    watermark = { lastId: 0 };
+    dmWatermarks.set(minted.conversation_id, watermark);
+  }
   process.stderr.write(`[viber-channel] joining agent DM ${minted.conversation_id}\n`);
   // The agent's liveness (and thus the DM's presence in the "Active" sidebar) is
   // proven by the INSTANCE heartbeat, not a per-conversation beat — the legacy
@@ -1147,6 +1167,7 @@ function startDmStream(minted: ConversationMintResponse): void {
     conversationToken: minted.conversation_token,
     log: (m) => process.stderr.write(m),
     signal: controller.signal,
+    watermark,
     onMessage: (msg) => pushMessage(msg, { conversationId: minted.conversation_id }),
   }).finally(() => {
     // Only evict if WE are still the registered controller — a newer join may