@agentvault/agentvault 0.15.0 → 0.15.2

package/dist/channel.js

@@ -1,3411 +0,0 @@
-import { EventEmitter } from "node:events";
-import { createServer } from "node:http";
-import { randomUUID } from "node:crypto";
-import { writeFile, mkdir } from "node:fs/promises";
-import { join } from "node:path";
-import { readFile } from "node:fs/promises";
-import sodium from "libsodium-wrappers-sumo";
-import WebSocket from "ws";
-import { generateIdentityKeypair, generateEphemeralKeypair, computeFingerprint, createProofOfPossession, performX3DH, DoubleRatchet, decryptFile, encryptFile, computeFileDigest, ScanEngine, TelemetryReporter, } from "@agentvault/crypto";
-import { hexToBytes, bytesToHex, base64ToBytes, bytesToBase64, encryptedMessageToTransport, transportToEncryptedMessage, SenderKeyChain, SenderKeyState, } from "./crypto-helpers.js";
-import { saveState, loadState, clearState, backupState, restoreState, uploadBackupToServer } from "./state.js";
-import { enrollDevice, pollDeviceStatus, activateDevice, } from "./transport.js";
-const POLL_INTERVAL_MS = 6_000; // 6s — safely below the 1/5sec server-side rate limit
-const RECONNECT_BASE_MS = 1_000;
-const RECONNECT_MAX_MS = 30_000;
-const PENDING_POLL_INTERVAL_MS = 15_000;
-/**
- * Migrates legacy single-session persisted state to the new
- * multi-session format. If the state is already in the new format,
- * returns it as-is.
- */
-function migratePersistedState(raw) {
-    // New format: has `sessions` and `primaryConversationId`
-    if (raw.sessions && raw.primaryConversationId) {
-        return raw;
-    }
-    // Legacy format: single conversationId + ratchetState
-    const legacy = raw;
-    return {
-        deviceId: legacy.deviceId,
-        deviceJwt: legacy.deviceJwt,
-        primaryConversationId: legacy.conversationId,
-        sessions: {
-            [legacy.conversationId]: {
-                ownerDeviceId: "",
-                ratchetState: legacy.ratchetState,
-            },
-        },
-        identityKeypair: legacy.identityKeypair,
-        ephemeralKeypair: legacy.ephemeralKeypair,
-        fingerprint: legacy.fingerprint,
-        lastMessageTimestamp: legacy.lastMessageTimestamp,
-        messageHistory: [],
-    };
-}
-export class SecureChannel extends EventEmitter {
-    config;
-    _state = "idle";
-    _deviceId = null;
-    _fingerprint = null;
-    _primaryConversationId = "";
-    _deviceJwt = null;
-    _sessions = new Map();
-    _ws = null;
-    _pollTimer = null;
-    _reconnectAttempt = 0;
-    _reconnectTimer = null;
-    _rapidDisconnects = 0;
-    _lastWsOpenTime = 0;
-    _pingTimer = null;
-    _lastServerMessage = 0;
-    _pendingAcks = [];
-    _ackTimer = null;
-    _stopped = false;
-    _persisted = null;
-    _httpServer = null;
-    _pollFallbackTimer = null;
-    _heartbeatTimer = null;
-    _heartbeatCallback = null;
-    _heartbeatIntervalSeconds = 0;
-    _wakeDetectorTimer = null;
-    _lastWakeTick = Date.now();
-    _pendingPollTimer = null;
-    _syncMessageIds = null;
-    /** Sender Key chains — own chain per room for O(1) encryption */
-    _senderKeyChains = new Map();
-    /** Sender Key peer state — peer chains per room for decryption */
-    _senderKeyStates = new Map();
-    /** Queued A2A messages for responder channels not yet activated (no first initiator message received). */
-    _a2aPendingQueue = {};
-    /** Dedup buffer for A2A message IDs (prevents double-delivery via direct + Redis) */
-    _a2aSeenMessageIds = new Set();
-    static A2A_SEEN_MAX = 500;
-    _scanEngine = null;
-    _scanRuleSetVersion = 0;
-    _telemetryReporter = null;
-    /** Topic ID from the most recent inbound message — used as fallback for replies. */
-    _lastIncomingTopicId;
-    /** Room ID from the most recent inbound room message — used as fallback for HTTP /send replies. */
-    _lastInboundRoomId;
-    /** Rate-limit: last resync_request timestamp per conversation (5-min cooldown). */
-    _lastResyncRequest = new Map();
-    /** Debounce timer for server backup uploads (60s). */
-    _serverBackupTimer = null;
-    _serverBackupRunning = false;
-    // Liveness detection: server sends app-level {"event":"ping"} every 30s.
-    // We check every 30s; if no data received in 90s (3 missed pings), connection is dead.
-    static PING_INTERVAL_MS = 30_000;
-    static SILENCE_TIMEOUT_MS = 90_000;
-    static POLL_FALLBACK_INTERVAL_MS = 30_000; // 30s when messages found
-    static POLL_FALLBACK_IDLE_MS = 60_000; // 60s when idle
-    constructor(config) {
-        super();
-        this.config = config;
-    }
-    get state() {
-        return this._state;
-    }
-    get deviceId() {
-        return this._deviceId;
-    }
-    get fingerprint() {
-        return this._fingerprint;
-    }
-    /** Returns the primary conversation ID (backward-compatible). */
-    get conversationId() {
-        return this._primaryConversationId || null;
-    }
-    /** Returns all active conversation IDs. */
-    get conversationIds() {
-        return Array.from(this._sessions.keys());
-    }
-    /** Returns the number of active sessions. */
-    get sessionCount() {
-        return this._sessions.size;
-    }
-    /** Room ID from the most recent inbound room message (for HTTP /send fallback). */
-    get lastInboundRoomId() {
-        return this._lastInboundRoomId;
-    }
-    /** Returns all persisted room IDs and names (for outbound target registration). */
-    get roomIds() {
-        if (!this._persisted?.rooms)
-            return [];
-        return Object.values(this._persisted.rooms).map((r) => ({ roomId: r.roomId, name: r.name }));
-    }
-    /** Returns hub addresses of all persisted A2A peer channels. */
-    get a2aPeerAddresses() {
-        if (!this._persisted?.a2aChannels)
-            return [];
-        return Object.values(this._persisted.a2aChannels).map((ch) => ch.hubAddress);
-    }
-    /** Resolves an A2A channel ID to the peer's hub address, or null if not found. */
-    resolveA2AChannelHub(channelId) {
-        const entry = this._persisted?.a2aChannels?.[channelId];
-        return entry?.hubAddress ?? null;
-    }
-    /** Returns the TelemetryReporter instance (available after WebSocket connect). */
-    get telemetry() {
-        return this._telemetryReporter;
-    }
-    async start() {
-        this._stopped = false;
-        await sodium.ready;
-        // Check for persisted state (may be legacy or new format)
-        const raw = await loadState(this.config.dataDir);
-        if (raw) {
-            await backupState(this.config.dataDir);
-            this._persisted = migratePersistedState(raw);
-            if (!this._persisted.messageHistory) {
-                this._persisted.messageHistory = [];
-            }
-            this._deviceId = this._persisted.deviceId;
-            this._deviceJwt = this._persisted.deviceJwt;
-            this._primaryConversationId = this._persisted.primaryConversationId;
-            this._fingerprint = this._persisted.fingerprint;
-            // Restore sticky room context for proactive send routing
-            this._lastInboundRoomId = this._persisted.lastInboundRoomId;
-            // Restore all ratchet sessions
-            for (const [convId, sessionData] of Object.entries(this._persisted.sessions)) {
-                if (sessionData.ratchetState) {
-                    const ratchet = DoubleRatchet.deserialize(sessionData.ratchetState);
-                    this._sessions.set(convId, {
-                        ownerDeviceId: sessionData.ownerDeviceId,
-                        ratchet,
-                        activated: sessionData.activated ?? false,
-                    });
-                }
-            }
-            // Restore sender key chains/states from persisted rooms
-            if (this._persisted.rooms) {
-                for (const room of Object.values(this._persisted.rooms)) {
-                    if (room.ownSenderKeyChain) {
-                        try {
-                            this._senderKeyChains.set(room.roomId, SenderKeyChain.deserialize(room.ownSenderKeyChain));
-                        }
-                        catch { }
-                    }
-                    if (room.peerSenderKeyState) {
-                        try {
-                            this._senderKeyStates.set(room.roomId, SenderKeyState.deserialize(room.peerSenderKeyState));
-                        }
-                        catch { }
-                    }
-                }
-            }
-            this._connect();
-            return;
-        }
-        // Try restoring from backup before enrolling
-        const restored = await restoreState(this.config.dataDir);
-        if (restored) {
-            console.log("[SecureChannel] Restored state from backup");
-            const restoredRaw = await loadState(this.config.dataDir);
-            if (restoredRaw) {
-                this._persisted = migratePersistedState(restoredRaw);
-                if (!this._persisted.messageHistory)
-                    this._persisted.messageHistory = [];
-                this._deviceId = this._persisted.deviceId;
-                this._deviceJwt = this._persisted.deviceJwt;
-                this._primaryConversationId = this._persisted.primaryConversationId;
-                this._fingerprint = this._persisted.fingerprint;
-                for (const [convId, sd] of Object.entries(this._persisted.sessions)) {
-                    if (sd.ratchetState) {
-                        this._sessions.set(convId, {
-                            ownerDeviceId: sd.ownerDeviceId,
-                            ratchet: DoubleRatchet.deserialize(sd.ratchetState),
-                            activated: sd.activated ?? false,
-                        });
-                    }
-                }
-                this._connect();
-                return;
-            }
-        }
-        // Full lifecycle: enroll -> poll -> activate -> connect
-        await this._enroll();
-    }
-    /**
-     * Fetch scan rules from the server and load them into the ScanEngine.
-     */
-    async _fetchScanRules() {
-        if (!this._scanEngine)
-            return;
-        try {
-            const resp = await fetch(`${this.config.apiUrl}/api/v1/scan-rules`, {
-                headers: { Authorization: `Bearer ${this._persisted?.deviceJwt}` },
-            });
-            if (!resp.ok)
-                return;
-            const data = await resp.json();
-            if (data.rule_set_version !== this._scanRuleSetVersion) {
-                this._scanEngine.loadRules(data.rules);
-                this._scanRuleSetVersion = data.rule_set_version;
-            }
-        }
-        catch (err) {
-            console.error("[SecureChannel] Failed to fetch scan rules:", err);
-        }
-    }
-    /**
-     * Append a message to persistent history for cross-device replay.
-     */
-    _appendHistory(sender, text, topicId) {
-        if (!this._persisted)
-            return;
-        if (!this._persisted.messageHistory) {
-            this._persisted.messageHistory = [];
-        }
-        const maxSize = this.config.maxHistorySize ?? 500;
-        const entry = {
-            sender,
-            text,
-            ts: new Date().toISOString(),
-        };
-        if (topicId) {
-            entry.topicId = topicId;
-        }
-        this._persisted.messageHistory.push(entry);
-        // Evict oldest entries if over limit
-        if (this._persisted.messageHistory.length > maxSize) {
-            this._persisted.messageHistory = this._persisted.messageHistory.slice(-maxSize);
-        }
-    }
-    /**
-     * Encrypt and send a message to ALL owner devices (fanout).
-     * Each session gets the same plaintext encrypted independently.
-     */
-    async send(plaintext, options) {
-        // Permanent failures — still throw
-        if (this._state === "error" || this._state === "idle") {
-            throw new Error("Channel is not ready");
-        }
-        if (this._sessions.size === 0) {
-            throw new Error("No active sessions");
-        }
-        // Wake agent proactively before sending (fire-and-forget, best-effort)
-        import("./openclaw-compat.js")
-            .then(({ requestHeartbeatNow }) => requestHeartbeatNow({ reason: "channel-send" }))
-            .catch(() => { });
-        const targetConvId = options?.conversationId;
-        const topicId = options?.topicId ?? this._lastIncomingTopicId ?? this._persisted?.defaultTopicId;
-        const messageType = options?.messageType ?? "text";
-        const priority = options?.priority ?? "normal";
-        const parentSpanId = options?.parentSpanId;
-        const envelopeMetadata = options?.metadata;
-        // Outbound scan — before encryption
-        let scanStatus;
-        if (this._scanEngine) {
-            const scanResult = this._scanEngine.scanOutbound(plaintext);
-            if (scanResult.status === "blocked") {
-                this.emit("scan_blocked", { direction: "outbound", violations: scanResult.violations });
-                throw new Error(`Message blocked by scan rule: ${scanResult.violations[0]?.rule_name}`);
-            }
-            scanStatus = scanResult.status; // "clean" or "flagged"
-        }
-        // Store agent message in history for cross-device replay
-        this._appendHistory("agent", plaintext, topicId);
-        // Build set of room conversation IDs to exclude from 1:1 send
-        const roomConvIds = new Set();
-        if (this._persisted?.rooms) {
-            for (const room of Object.values(this._persisted.rooms)) {
-                for (const cid of room.conversationIds) {
-                    roomConvIds.add(cid);
-                }
-            }
-        }
-        const messageGroupId = randomUUID();
-        let sentCount = 0;
-        for (const [convId, session] of this._sessions) {
-            if (!session.activated)
-                continue;
-            // Skip room pairwise sessions — those use sendToRoom()
-            if (roomConvIds.has(convId))
-                continue;
-            // If a specific conversation is targeted, skip all others
-            if (targetConvId && convId !== targetConvId)
-                continue;
-            try {
-                const encrypted = session.ratchet.encrypt(plaintext);
-                const transport = encryptedMessageToTransport(encrypted);
-                const msg = {
-                    convId,
-                    headerBlob: transport.header_blob,
-                    ciphertext: transport.ciphertext,
-                    messageGroupId,
-                    topicId,
-                };
-                if (this._state === "ready" && this._ws) {
-                    // Send immediately
-                    const payload = {
-                        conversation_id: msg.convId,
-                        header_blob: msg.headerBlob,
-                        ciphertext: msg.ciphertext,
-                        message_group_id: msg.messageGroupId,
-                        topic_id: msg.topicId,
-                        message_type: messageType,
-                        priority: priority,
-                        parent_span_id: parentSpanId,
-                        metadata: scanStatus
-                            ? { ...(envelopeMetadata ?? {}), scan_status: scanStatus }
-                            : envelopeMetadata,
-                    };
-                    if (this._persisted?.hubAddress) {
-                        payload.hub_address = this._persisted.hubAddress;
-                    }
-                    if (this._persisted?.hubId) {
-                        payload.sender_hub_id = this._persisted.hubId;
-                    }
-                    this._ws.send(JSON.stringify({
-                        event: "message",
-                        data: payload,
-                    }));
-                }
-                else {
-                    // Queue for later
-                    if (!this._persisted.outboundQueue) {
-                        this._persisted.outboundQueue = [];
-                    }
-                    if (this._persisted.outboundQueue.length >= 50) {
-                        this._persisted.outboundQueue.shift(); // Drop oldest
-                        console.warn("[SecureChannel] Outbound queue full, dropping oldest message");
-                    }
-                    this._persisted.outboundQueue.push(msg);
-                    console.log(`[SecureChannel] Message queued (state=${this._state}, queue=${this._persisted.outboundQueue.length})`);
-                }
-                sentCount++;
-            }
-            catch (err) {
-                // Per-session error — log and continue to next session so one
-                // stale/broken session doesn't prevent delivery to healthy ones
-                console.error(`[SecureChannel] send() failed for conv ${convId.slice(0, 8)}...:`, err);
-            }
-        }
-        if (sentCount === 0 && this._sessions.size > 0) {
-            console.warn("[SecureChannel] send() delivered to 0 sessions (all skipped or failed)");
-        }
-        // Persist all ratchet states after encrypt
-        await this._persistState();
-    }
-    /**
-     * Send a typing indicator to all owner devices.
-     * Ephemeral (unencrypted metadata), no ratchet advancement.
-     */
-    sendTyping() {
-        if (!this._ws || this._ws.readyState !== WebSocket.OPEN)
-            return;
-        for (const convId of this._sessions.keys()) {
-            this._ws.send(JSON.stringify({
-                event: "typing",
-                data: { conversation_id: convId },
-            }));
-        }
-    }
-    /**
-     * Send an activity span to all owner devices via WS.
-     * Ephemeral (unencrypted metadata, like typing), no ratchet advancement.
-     */
-    sendActivitySpan(spanData) {
-        if (!this._ws || this._ws.readyState !== WebSocket.OPEN)
-            return;
-        this._ws.send(JSON.stringify({
-            event: "activity_span",
-            data: {
-                ...spanData,
-                agent_name: this.config.agentName ?? "Agent",
-            },
-        }));
-    }
-    /**
-     * Send a decision request to the owner.
-     * Builds a structured envelope with decision metadata and sends it
-     * as a high-priority message. Returns the generated decision_id.
-     */
-    async sendDecisionRequest(request) {
-        const decision_id = `dec_${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-        const payload = JSON.stringify({
-            type: "message",
-            text: `\u{1F4CB} ${request.title}`,
-            decision: {
-                decision_id,
-                ...request,
-            },
-        });
-        await this.send(payload, {
-            messageType: "decision_request",
-            priority: "high",
-            metadata: {
-                decision_id,
-                title: request.title,
-                description: request.description,
-                options: request.options,
-                context_refs: request.context_refs,
-                deadline: request.deadline,
-                auto_action: request.auto_action,
-            },
-        });
-        return decision_id;
-    }
-    /**
-     * Wait for a decision response matching the given decisionId.
-     * Listens on the "message" event for messages where
-     * metadata.messageType === "decision_response" and the parsed plaintext
-     * contains a matching decision.decision_id.
-     * Optional timeout rejects with an Error.
-     */
-    waitForDecision(decisionId, timeoutMs) {
-        return new Promise((resolve, reject) => {
-            let timer = null;
-            const handler = (plaintext, metadata) => {
-                if (metadata.messageType !== "decision_response")
-                    return;
-                try {
-                    const parsed = JSON.parse(plaintext);
-                    if (parsed.decision?.decision_id === decisionId) {
-                        if (timer)
-                            clearTimeout(timer);
-                        this.removeListener("message", handler);
-                        resolve({
-                            decision_id: parsed.decision.decision_id,
-                            selected_option_id: parsed.decision.selected_option_id,
-                            resolved_at: parsed.decision.resolved_at,
-                            action: parsed.decision.action,
-                            defer_until: parsed.decision.defer_until,
-                            defer_reason: parsed.decision.defer_reason,
-                        });
-                    }
-                }
-                catch {
-                    // Not valid JSON, ignore
-                }
-            };
-            this.on("message", handler);
-            if (timeoutMs !== undefined) {
-                timer = setTimeout(() => {
-                    this.removeListener("message", handler);
-                    reject(new Error(`Decision ${decisionId} timed out after ${timeoutMs}ms`));
-                }, timeoutMs);
-            }
-        });
-    }
-    // --- Multi-agent room methods ---
-    /**
-     * Join a room by performing X3DH key exchange with each member
-     * for the pairwise conversations involving this device.
-     */
-    async joinRoom(roomData) {
-        if (!this._persisted) {
-            throw new Error("Channel not initialized");
-        }
-        await sodium.ready;
-        // Force rekey: clear all existing sessions + sender key state for this room
-        if (roomData.forceRekey) {
-            let cleared = 0;
-            const existingRoom = this._persisted.rooms?.[roomData.roomId];
-            if (existingRoom) {
-                for (const convId of existingRoom.conversationIds) {
-                    if (this._sessions.has(convId)) {
-                        this._sessions.delete(convId);
-                        cleared++;
-                    }
-                    delete this._persisted.sessions[convId];
-                }
-            }
-            // Clear sender key chains/state for this room
-            this._senderKeyChains.delete(roomData.roomId);
-            this._senderKeyStates.delete(roomData.roomId);
-            if (existingRoom) {
-                delete existingRoom.ownSenderKeyChain;
-                delete existingRoom.peerSenderKeyState;
-                delete existingRoom.encryptionMode;
-                existingRoom.distributedTo = [];
-            }
-            // Advance sync timestamp to now so _syncMissedMessages skips old
-            // ciphertext that would corrupt the freshly initialized ratchets
-            if (this._persisted) {
-                this._persisted.lastMessageTimestamp = new Date().toISOString();
-            }
-            console.log(`[SecureChannel] Force rekey: cleared ${cleared} sessions for room ${roomData.roomId.slice(0, 8)}...`);
-        }
-        const identity = this._persisted.identityKeypair;
-        const ephemeral = this._persisted.ephemeralKeypair;
-        const myDeviceId = this._deviceId;
-        const conversationIds = [];
-        for (const conv of roomData.conversations) {
-            // Only process conversations involving this device
-            if (conv.participantA !== myDeviceId && conv.participantB !== myDeviceId) {
-                continue;
-            }
-            // Skip conversations that already have active sessions (idempotent re-join)
-            if (this._sessions.has(conv.id)) {
-                conversationIds.push(conv.id);
-                continue;
-            }
-            const otherDeviceId = conv.participantA === myDeviceId ? conv.participantB : conv.participantA;
-            const otherMember = roomData.members.find((m) => m.deviceId === otherDeviceId);
-            if (!otherMember?.identityPublicKey) {
-                console.warn(`[SecureChannel] No public key for member ${otherDeviceId.slice(0, 8)}..., skipping`);
-                continue;
-            }
-            // Determine initiator: lexicographically smaller deviceId is the sender (initiator)
-            const isInitiator = myDeviceId < otherDeviceId;
-            const theirEphKey = otherMember.ephemeralPublicKey ?? otherMember.identityPublicKey;
-            const sharedSecret = performX3DH({
-                myIdentityPrivate: hexToBytes(identity.privateKey),
-                myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
-                theirIdentityPublic: hexToBytes(otherMember.identityPublicKey),
-                theirEphemeralPublic: hexToBytes(theirEphKey),
-                isInitiator,
-            });
-            const peerIdentityPub = hexToBytes(otherMember.identityPublicKey);
-            const ratchet = isInitiator
-                ? DoubleRatchet.initSender(sharedSecret, {
-                    publicKey: hexToBytes(identity.publicKey),
-                    privateKey: hexToBytes(identity.privateKey),
-                    keyType: "ed25519",
-                }, peerIdentityPub)
-                : DoubleRatchet.initReceiver(sharedSecret, {
-                    publicKey: hexToBytes(identity.publicKey),
-                    privateKey: hexToBytes(identity.privateKey),
-                    keyType: "ed25519",
-                }, peerIdentityPub);
-            this._sessions.set(conv.id, {
-                ownerDeviceId: otherDeviceId,
-                ratchet,
-                activated: isInitiator, // initiator can send immediately
-            });
-            // Persist session
-            this._persisted.sessions[conv.id] = {
-                ownerDeviceId: otherDeviceId,
-                ratchetState: ratchet.serialize(),
-                activated: isInitiator,
-            };
-            conversationIds.push(conv.id);
-            console.log(`[SecureChannel] Room session initialized: conv ${conv.id.slice(0, 8)}... ` +
-                `with ${otherDeviceId.slice(0, 8)}... (initiator=${isInitiator})`);
-        }
-        // Store room state
-        if (!this._persisted.rooms) {
-            this._persisted.rooms = {};
-        }
-        this._persisted.rooms[roomData.roomId] = {
-            roomId: roomData.roomId,
-            name: roomData.name,
-            conversationIds,
-            members: roomData.members,
-        };
-        // ── Sender Key setup ──
-        // Create own chain if not already present
-        if (!this._senderKeyChains.has(roomData.roomId)) {
-            const chain = SenderKeyChain.create();
-            this._senderKeyChains.set(roomData.roomId, chain);
-            this._persisted.rooms[roomData.roomId].ownSenderKeyChain = chain.serialize();
-        }
-        if (!this._senderKeyStates.has(roomData.roomId)) {
-            const peerState = SenderKeyState.create();
-            this._senderKeyStates.set(roomData.roomId, peerState);
-            this._persisted.rooms[roomData.roomId].peerSenderKeyState = peerState.serialize();
-        }
-        await this._persistState();
-        this.emit("room_joined", { roomId: roomData.roomId, name: roomData.name });
-        // Distribute sender key to all members (fire-and-forget)
-        // Skip during force rekey — the owner hasn't re-mounted yet and can't
-        // decrypt these. Wait for the owner to distribute first, then reciprocate.
-        if (!roomData.forceRekey) {
-            this._distributeSenderKey(roomData.roomId).catch((err) => {
-                console.warn(`[SecureChannel] Sender key distribution failed for room ${roomData.roomId}:`, err);
-            });
-        }
-    }
-    /**
-     * Send an encrypted message to all members of a room.
-     * Uses Sender Key (O(1)) if available, otherwise pairwise fan-out.
-     */
-    async sendToRoom(roomId, plaintext, opts) {
-        if (!this._persisted?.rooms?.[roomId]) {
-            throw new Error(`Room ${roomId} not found`);
-        }
-        // Wake agent proactively before sending (fire-and-forget, best-effort)
-        import("./openclaw-compat.js")
-            .then(({ requestHeartbeatNow }) => requestHeartbeatNow({ reason: "channel-sendToRoom" }))
-            .catch(() => { });
-        const room = this._persisted.rooms[roomId];
-        const messageType = opts?.messageType ?? "text";
-        // ── Sender Key path (O(1) encryption) ──
-        const chain = this._senderKeyChains.get(roomId);
-        if (room.encryptionMode === "sender_key" && chain) {
-            const skMsg = chain.encrypt(plaintext);
-            // Persist updated chain state
-            room.ownSenderKeyChain = chain.serialize();
-            await this._persistState();
-            if (this._state === "ready" && this._ws) {
-                this._ws.send(JSON.stringify({
-                    event: "room_message_sk",
-                    data: {
-                        room_id: roomId,
-                        iteration: skMsg.iteration,
-                        generation_id: skMsg.generationId,
-                        nonce: skMsg.nonce,
-                        ciphertext: skMsg.ciphertext,
-                        signature: skMsg.signature,
-                        message_type: messageType,
-                        priority: opts?.priority ?? "normal",
-                        metadata: opts?.metadata,
-                    },
-                }));
-            }
-            return;
-        }
-        // ── Pairwise fallback ──
-        const recipients = [];
-        for (const convId of room.conversationIds) {
-            const session = this._sessions.get(convId);
-            if (!session) {
-                console.warn(`[SecureChannel] No session for room conv ${convId.slice(0, 8)}..., skipping`);
-                continue;
-            }
-            const encrypted = session.ratchet.encrypt(plaintext);
-            const transport = encryptedMessageToTransport(encrypted);
-            recipients.push({
-                device_id: session.ownerDeviceId,
-                header_blob: transport.header_blob,
-                ciphertext: transport.ciphertext,
-            });
-        }
-        if (recipients.length === 0) {
-            throw new Error("No active sessions in room");
-        }
-        if (this._state === "ready" && this._ws) {
-            this._ws.send(JSON.stringify({
-                event: "room_message",
-                data: {
-                    room_id: roomId,
-                    recipients,
-                    message_type: messageType,
-                    priority: opts?.priority ?? "normal",
-                    metadata: opts?.metadata,
-                },
-            }));
-        }
-        else {
-            // HTTP fallback
-            try {
-                const res = await fetch(`${this.config.apiUrl}/api/v1/rooms/${roomId}/messages`, {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/json",
-                        Authorization: `Bearer ${this._deviceJwt}`,
-                    },
-                    body: JSON.stringify({
-                        recipients,
-                        message_type: messageType,
-                        priority: opts?.priority ?? "normal",
-                        metadata: opts?.metadata,
-                    }),
-                });
-                if (!res.ok) {
-                    const detail = await res.text();
-                    throw new Error(`Room message failed (${res.status}): ${detail}`);
-                }
-            }
-            catch (err) {
-                throw new Error(`Failed to send room message: ${err}`);
-            }
-        }
-        await this._persistState();
-    }
-    /**
-     * Leave a room: remove sessions and persisted room state.
-     */
-    async leaveRoom(roomId) {
-        if (!this._persisted?.rooms?.[roomId]) {
-            return; // Already left or never joined
-        }
-        const room = this._persisted.rooms[roomId];
-        // Remove sessions for this room's conversations
-        for (const convId of room.conversationIds) {
-            this._sessions.delete(convId);
-            delete this._persisted.sessions[convId];
-        }
-        // Remove room state
-        delete this._persisted.rooms[roomId];
-        await this._persistState();
-        this.emit("room_left", { roomId });
-    }
-    /**
-     * Return info for all joined rooms.
-     */
-    getRooms() {
-        if (!this._persisted?.rooms)
-            return [];
-        return Object.values(this._persisted.rooms).map((rs) => ({
-            roomId: rs.roomId,
-            name: rs.name,
-            members: rs.members,
-            conversationIds: rs.conversationIds,
-        }));
-    }
-    // --- Heartbeat and status methods ---
-    startHeartbeat(intervalSeconds, statusCallback) {
-        this.stopHeartbeat();
-        this._heartbeatCallback = statusCallback;
-        this._heartbeatIntervalSeconds = intervalSeconds;
-        this._sendHeartbeat();
-        this._heartbeatTimer = setInterval(() => {
-            this._sendHeartbeat();
-        }, intervalSeconds * 1000);
-    }
-    async stopHeartbeat() {
-        if (this._heartbeatTimer) {
-            clearInterval(this._heartbeatTimer);
-            this._heartbeatTimer = null;
-        }
-        if (this._heartbeatCallback && this._state === "ready") {
-            try {
-                await this.send(JSON.stringify({
-                    agent_status: "shutting_down",
-                    current_task: "",
-                    timestamp: new Date().toISOString(),
-                }), {
-                    messageType: "heartbeat",
-                    metadata: { next_heartbeat_seconds: this._heartbeatIntervalSeconds },
-                });
-            }
-            catch { /* best-effort shutdown heartbeat */ }
-        }
-        this._heartbeatCallback = null;
-    }
-    async sendStatusAlert(alert) {
-        const priority = alert.severity === "error" || alert.severity === "critical"
-            ? "high" : "normal";
-        const envelope = {
-            title: alert.title,
-            message: alert.message,
-            severity: alert.severity,
-            timestamp: new Date().toISOString(),
-        };
-        if (alert.detail !== undefined)
-            envelope.detail = alert.detail;
-        if (alert.detailFormat !== undefined)
-            envelope.detail_format = alert.detailFormat;
-        if (alert.category !== undefined)
-            envelope.category = alert.category;
-        await this.send(JSON.stringify(envelope), {
-            messageType: "status_alert",
-            priority,
-            metadata: { severity: alert.severity },
-        });
-    }
-    async sendArtifact(artifact) {
-        if (this._state !== "ready" || this._sessions.size === 0 || !this._ws) {
-            throw new Error("Channel is not ready");
-        }
-        // Upload encrypted file via existing attachment infrastructure
-        const attachMeta = await this._uploadAttachment(artifact.filePath, this._primaryConversationId);
-        // Build artifact_share envelope
-        const envelope = JSON.stringify({
-            type: "artifact",
-            blob_id: attachMeta.blobId,
-            blob_url: attachMeta.blobUrl,
-            filename: artifact.filename,
-            mime_type: artifact.mimeType,
-            size_bytes: attachMeta.size,
-            description: artifact.description,
-            attachment: attachMeta,
-        });
-        const messageGroupId = randomUUID();
-        for (const [convId, session] of this._sessions) {
-            if (!session.activated)
-                continue;
-            const encrypted = session.ratchet.encrypt(envelope);
-            const transport = encryptedMessageToTransport(encrypted);
-            this._ws.send(JSON.stringify({
-                event: "message",
-                data: {
-                    conversation_id: convId,
-                    header_blob: transport.header_blob,
-                    ciphertext: transport.ciphertext,
-                    message_group_id: messageGroupId,
-                    message_type: "artifact_share",
-                },
-            }));
-        }
-        await this._persistState();
-    }
-    async sendActionConfirmation(confirmation) {
-        const envelope = {
-            type: "action_confirmation",
-            action: confirmation.action,
-            status: confirmation.status,
-        };
-        if (confirmation.decisionId !== undefined)
-            envelope.decision_id = confirmation.decisionId;
-        if (confirmation.detail !== undefined)
-            envelope.detail = confirmation.detail;
-        await this.send(JSON.stringify(envelope), {
-            messageType: "action_confirmation",
-            metadata: { status: confirmation.status },
-        });
-    }
-    async sendActionConfirmationToRoom(roomId, confirmation) {
-        const envelope = {
-            type: "action_confirmation",
-            action: confirmation.action,
-            status: confirmation.status,
-        };
-        if (confirmation.decisionId !== undefined)
-            envelope.decision_id = confirmation.decisionId;
-        if (confirmation.detail !== undefined)
-            envelope.detail = confirmation.detail;
-        const metadata = {
-            action: confirmation.action,
-            status: confirmation.status,
-        };
-        if (confirmation.estimated_cost !== undefined) {
-            metadata.estimated_cost = confirmation.estimated_cost;
-        }
-        await this.sendToRoom(roomId, JSON.stringify(envelope), {
-            messageType: "action_confirmation",
-            priority: "high",
-            metadata,
-        });
-    }
-    _sendHeartbeat() {
-        if (this._state !== "ready" || !this._heartbeatCallback)
-            return;
-        const status = this._heartbeatCallback();
-        this.send(JSON.stringify({
-            agent_status: status.agent_status,
-            current_task: status.current_task,
-            timestamp: new Date().toISOString(),
-        }), {
-            messageType: "heartbeat",
-            metadata: { next_heartbeat_seconds: this._heartbeatIntervalSeconds },
-        }).catch((err) => {
-            this.emit("error", new Error(`Heartbeat send failed: ${err}`));
-        });
-    }
-    async stop() {
-        this._stopped = true;
-        await this.stopHeartbeat();
-        this._flushAcks(); // Send any pending ACKs before stopping
-        this._stopPing();
-        this._stopWakeDetector();
-        this._stopPendingPoll();
-        this._stopPollFallback();
-        this._stopHttpServer();
-        if (this._ackTimer) {
-            clearTimeout(this._ackTimer);
-            this._ackTimer = null;
-        }
-        if (this._pollTimer) {
-            clearTimeout(this._pollTimer);
-            this._pollTimer = null;
-        }
-        if (this._reconnectTimer) {
-            clearTimeout(this._reconnectTimer);
-            this._reconnectTimer = null;
-        }
-        // Flush and clean up telemetry reporter before closing WebSocket
-        if (this._telemetryReporter) {
-            this._telemetryReporter.stopAutoFlush();
-            await this._telemetryReporter.flush();
-            this._telemetryReporter = null;
-        }
-        if (this._ws) {
-            this._ws.removeAllListeners();
-            this._ws.close();
-            this._ws = null;
-        }
-        this._setState("disconnected");
-    }
-    // --- Local HTTP server for proactive sends ---
-    startHttpServer(port) {
-        if (this._httpServer)
-            return;
-        // Lazy import to avoid circular dependency at module load time
-        let _handlers = null;
-        const getHandlers = async () => {
-            if (!_handlers)
-                _handlers = await import("./http-handlers.js");
-            return _handlers;
-        };
-        this._httpServer = createServer(async (req, res) => {
-            // Only accept local connections
-            const remote = req.socket.remoteAddress;
-            if (remote !== "127.0.0.1" && remote !== "::1" && remote !== "::ffff:127.0.0.1") {
-                res.writeHead(403, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ ok: false, error: "Forbidden" }));
-                return;
-            }
-            const handlers = await getHandlers();
-            if (req.method === "POST" && req.url === "/send") {
-                let body = "";
-                req.on("data", (chunk) => { body += chunk.toString(); });
-                req.on("end", async () => {
-                    try {
-                        const parsed = JSON.parse(body);
-                        const result = await handlers.handleSendRequest(parsed, this);
-                        res.writeHead(result.status, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify(result.body));
-                    }
-                    catch (err) {
-                        res.writeHead(500, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ ok: false, error: String(err) }));
-                    }
-                });
-            }
-            else if (req.method === "POST" && req.url === "/decision") {
-                let body = "";
-                req.on("data", (chunk) => { body += chunk.toString(); });
-                req.on("end", async () => {
-                    try {
-                        const parsed = JSON.parse(body);
-                        const result = await handlers.handleDecisionRequest(parsed, this);
-                        res.writeHead(result.status, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify(result.body));
-                    }
-                    catch (err) {
-                        res.writeHead(500, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ ok: false, error: String(err) }));
-                    }
-                });
-            }
-            else if (req.method === "POST" && req.url === "/action") {
-                let body = "";
-                req.on("data", (chunk) => { body += chunk.toString(); });
-                req.on("end", async () => {
-                    try {
-                        const parsed = JSON.parse(body);
-                        const result = await handlers.handleActionRequest(parsed, this);
-                        res.writeHead(result.status, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify(result.body));
-                    }
-                    catch (err) {
-                        res.writeHead(500, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ ok: false, error: String(err) }));
-                    }
-                });
-            }
-            else if (req.method === "GET" && req.url === "/status") {
-                const result = handlers.handleStatusRequest(this);
-                res.writeHead(result.status, { "Content-Type": "application/json" });
-                res.end(JSON.stringify(result.body));
-            }
-            else {
-                res.writeHead(404, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ ok: false, error: "Not found. Use POST /send, POST /decision, POST /action, or GET /status" }));
-            }
-        });
-        this._httpServer.listen(port, "127.0.0.1", () => {
-            this.emit("http-ready", port);
-        });
-    }
-    _stopHttpServer() {
-        if (this._httpServer) {
-            this._httpServer.close();
-            this._httpServer = null;
-        }
-    }
-    // --- Topic management ---
-    /**
-     * Create a new topic within the conversation group.
-     * Requires the channel to be initialized with a groupId (from activation).
-     */
-    async createTopic(name) {
-        if (!this._persisted?.groupId) {
-            throw new Error("Channel not initialized or groupId unknown");
-        }
-        if (!this._deviceJwt) {
-            throw new Error("Channel not authenticated");
-        }
-        const res = await fetch(`${this.config.apiUrl}/api/v1/topics`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${this._deviceJwt}`,
-            },
-            body: JSON.stringify({
-                group_id: this._persisted.groupId,
-                name,
-                creator_device_id: this._persisted.deviceId,
-            }),
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`Create topic failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const topic = { id: resp.id, name: resp.name, isDefault: resp.is_default };
-        if (!this._persisted.topics) {
-            this._persisted.topics = [];
-        }
-        this._persisted.topics.push(topic);
-        await this._persistState();
-        return topic;
-    }
-    /**
-     * List all topics in the conversation group.
-     * Requires the channel to be initialized with a groupId (from activation).
-     */
-    async listTopics() {
-        if (!this._persisted?.groupId) {
-            throw new Error("Channel not initialized or groupId unknown");
-        }
-        if (!this._deviceJwt) {
-            throw new Error("Channel not authenticated");
-        }
-        const res = await fetch(`${this.config.apiUrl}/api/v1/topics?group_id=${encodeURIComponent(this._persisted.groupId)}`, {
-            headers: {
-                Authorization: `Bearer ${this._deviceJwt}`,
-            },
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`List topics failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const topics = resp.map((t) => ({ id: t.id, name: t.name, isDefault: t.is_default }));
-        this._persisted.topics = topics;
-        await this._persistState();
-        return topics;
-    }
-    // --- A2A Channel methods (agent-to-agent communication) ---
-    /**
-     * Request a new A2A channel with another agent by their hub address.
-     * Returns the channel_id from the server response.
-     */
-    async requestA2AChannel(responderHubAddress) {
-        if (!this._persisted?.hubAddress) {
-            throw new Error("This agent does not have a hub address assigned");
-        }
-        if (!this._deviceJwt) {
-            throw new Error("Channel not authenticated");
-        }
-        const res = await fetch(`${this.config.apiUrl}/api/v1/a2a/channels/request`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${this._deviceJwt}`,
-            },
-            body: JSON.stringify({
-                initiator_hub_address: this._persisted.hubAddress,
-                responder_hub_address: responderHubAddress,
-            }),
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`A2A channel request failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const channelId = resp.channel_id || resp.id;
-        // Store channel info in persisted state
-        if (!this._persisted.a2aChannels) {
-            this._persisted.a2aChannels = {};
-        }
-        this._persisted.a2aChannels[channelId] = {
-            channelId,
-            hubAddress: responderHubAddress,
-            conversationId: resp.conversation_id || "",
-        };
-        await this._persistState();
-        return channelId;
-    }
-    /**
-     * Send a message to another agent via an active A2A channel.
-     * Looks up the A2A conversation by hub address and sends via WS.
-     *
-     * If the channel has an established E2E session, the message is encrypted
-     * with the Double Ratchet. If the responder hasn't received the initiator's
-     * first message yet (ratchet not activated), the message is queued locally
-     * and flushed when the first inbound message arrives.
-     *
-     * Falls back to plaintext for channels without a session (legacy/pre-encryption).
-     */
-    async sendToAgent(hubAddress, text, opts) {
-        if (!this._persisted?.a2aChannels) {
-            throw new Error("No A2A channels established");
-        }
-        // Find the active channel for this hub address
-        const channelEntry = Object.values(this._persisted.a2aChannels).find((ch) => ch.hubAddress === hubAddress);
-        if (!channelEntry) {
-            throw new Error(`No A2A channel found for hub address: ${hubAddress}`);
-        }
-        if (!channelEntry.conversationId) {
-            throw new Error(`A2A channel ${channelEntry.channelId} does not have a conversation yet (not activated)`);
-        }
-        if (this._state !== "ready" || !this._ws) {
-            throw new Error("Channel is not connected");
-        }
-        // --- E2E encrypted path ---
-        if (channelEntry.session?.ratchetState) {
-            // Responder must wait for first initiator message before sending
-            if (channelEntry.role === "responder" && !channelEntry.session.activated) {
-                if (!this._a2aPendingQueue[channelEntry.channelId]) {
-                    this._a2aPendingQueue[channelEntry.channelId] = [];
-                }
-                this._a2aPendingQueue[channelEntry.channelId].push({ text, opts });
-                console.log(`[SecureChannel] A2A message queued (responder not yet activated, ` +
-                    `queue=${this._a2aPendingQueue[channelEntry.channelId].length})`);
-                return;
-            }
-            // Deserialize ratchet, encrypt, update state
-            const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
-            const encrypted = ratchet.encrypt(text);
-            // Serialize header for transport (hex-encoded JSON)
-            const headerObj = {
-                dhPublicKey: bytesToHex(encrypted.header.dhPublicKey),
-                previousChainLength: encrypted.header.previousChainLength,
-                messageNumber: encrypted.header.messageNumber,
-            };
-            const headerBlobHex = Buffer.from(JSON.stringify(headerObj)).toString("hex");
-            const payload = {
-                channel_id: channelEntry.channelId,
-                conversation_id: channelEntry.conversationId,
-                header_blob: headerBlobHex,
-                header_signature: bytesToHex(encrypted.headerSignature),
-                ciphertext: bytesToHex(encrypted.ciphertext),
-                nonce: bytesToHex(encrypted.nonce),
-                parent_span_id: opts?.parentSpanId,
-            };
-            if (this._persisted.hubAddress) {
-                payload.hub_address = this._persisted.hubAddress;
-            }
-            // Observer copy (if observer session exists)
-            if (channelEntry.observerSession?.ratchetState) {
-                try {
-                    const obsRatchet = DoubleRatchet.deserialize(channelEntry.observerSession.ratchetState);
-                    const obsEncrypted = obsRatchet.encrypt(text);
-                    const obsHeaderObj = {
-                        dhPublicKey: bytesToHex(obsEncrypted.header.dhPublicKey),
-                        previousChainLength: obsEncrypted.header.previousChainLength,
-                        messageNumber: obsEncrypted.header.messageNumber,
-                    };
-                    payload.observer_header_blob = Buffer.from(JSON.stringify(obsHeaderObj)).toString("hex");
-                    payload.observer_ciphertext = bytesToHex(obsEncrypted.ciphertext);
-                    payload.observer_nonce = bytesToHex(obsEncrypted.nonce);
-                    channelEntry.observerSession.ratchetState = obsRatchet.serialize();
-                }
-                catch (obsErr) {
-                    console.error("[SecureChannel] Observer encryption failed (sending without observer copy):", obsErr);
-                }
-            }
-            // Update persisted ratchet state
-            channelEntry.session.ratchetState = ratchet.serialize();
-            await this._persistState();
-            this._ws.send(JSON.stringify({
-                event: "a2a_message",
-                data: payload,
-            }));
-            return;
-        }
-        // --- Legacy plaintext fallback (no session) ---
-        const payload = {
-            conversation_id: channelEntry.conversationId,
-            channel_id: channelEntry.channelId,
-            text: text,
-            message_type: "a2a",
-            parent_span_id: opts?.parentSpanId,
-        };
-        if (this._persisted.hubAddress) {
-            payload.hub_address = this._persisted.hubAddress;
-        }
-        this._ws.send(JSON.stringify({
-            event: "a2a_message",
-            data: payload,
-        }));
-    }
-    /**
-     * List all A2A channels for this agent.
-     * Fetches from the server and updates local persisted state.
-     */
-    async listA2AChannels() {
-        if (!this._deviceJwt) {
-            throw new Error("Channel not authenticated");
-        }
-        const res = await fetch(`${this.config.apiUrl}/api/v1/a2a/channels`, {
-            headers: {
-                Authorization: `Bearer ${this._deviceJwt}`,
-            },
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`List A2A channels failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const channels = resp.map((ch) => ({
-            channelId: ch.channel_id || ch.id,
-            initiatorHubAddress: ch.initiator_hub_address,
-            responderHubAddress: ch.responder_hub_address,
-            conversationId: ch.conversation_id,
-            status: ch.status,
-            createdAt: ch.created_at,
-        }));
-        // Update persisted a2aChannels map with latest server data
-        if (this._persisted) {
-            if (!this._persisted.a2aChannels) {
-                this._persisted.a2aChannels = {};
-            }
-            for (const ch of channels) {
-                if (ch.status === "active" || ch.status === "approved") {
-                    const otherAddress = ch.initiatorHubAddress === this._persisted.hubAddress
-                        ? ch.responderHubAddress
-                        : ch.initiatorHubAddress;
-                    this._persisted.a2aChannels[ch.channelId] = {
-                        channelId: ch.channelId,
-                        hubAddress: otherAddress,
-                        conversationId: ch.conversationId || "",
-                    };
-                }
-            }
-            await this._persistState();
-        }
-        return channels;
-    }
-    // --- Internal lifecycle ---
-    async _enroll() {
-        this._setState("enrolling");
-        try {
-            const identity = await generateIdentityKeypair();
-            const ephemeral = await generateEphemeralKeypair();
-            const fingerprint = computeFingerprint(identity.publicKey);
-            const proof = createProofOfPossession(identity.privateKey, identity.publicKey);
-            const result = await enrollDevice(this.config.apiUrl, this.config.inviteToken, bytesToHex(identity.publicKey), bytesToHex(ephemeral.publicKey), bytesToHex(proof), this.config.platform);
-            this._deviceId = result.device_id;
-            this._fingerprint = result.fingerprint;
-            // Store keypairs temporarily for activation (not persisted yet -- no JWT)
-            this._persisted = {
-                deviceId: result.device_id,
-                deviceJwt: "", // set after activation
-                primaryConversationId: "", // set after activation
-                sessions: {}, // populated after activation
-                identityKeypair: {
-                    publicKey: bytesToHex(identity.publicKey),
-                    privateKey: bytesToHex(identity.privateKey),
-                },
-                ephemeralKeypair: {
-                    publicKey: bytesToHex(ephemeral.publicKey),
-                    privateKey: bytesToHex(ephemeral.privateKey),
-                },
-                fingerprint: result.fingerprint,
-                messageHistory: [],
-            };
-            this._poll();
-        }
-        catch (err) {
-            this._handleError(err);
-        }
-    }
-    _poll() {
-        if (this._stopped)
-            return;
-        this._setState("polling");
-        const doPoll = async () => {
-            if (this._stopped)
-                return;
-            try {
-                const status = await pollDeviceStatus(this.config.apiUrl, this._deviceId);
-                if (status.rateLimited) {
-                    // Server rate-limited this poll — back off 2x before retrying
-                    this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS * 2);
-                    return;
-                }
-                if (status.status === "APPROVED") {
-                    await this._activate();
-                    return;
-                }
-                if (status.status === "REVOKED") {
-                    this._handleError(new Error("Device was revoked"));
-                    return;
-                }
-                // Still PENDING -- poll again
-                this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS);
-            }
-            catch (err) {
-                this._handleError(err);
-            }
-        };
-        this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS);
-    }
-    async _activate() {
-        this._setState("activating");
-        try {
-            const result = await activateDevice(this.config.apiUrl, this._deviceId);
-            // Support both old (single conversation_id) and new (conversations array) response
-            const conversations = result.conversations || [
-                {
-                    conversation_id: result.conversation_id,
-                    owner_device_id: "",
-                    is_primary: true,
-                },
-            ];
-            const primary = conversations.find((c) => c.is_primary) || conversations[0];
-            this._primaryConversationId = primary.conversation_id;
-            this._deviceJwt = result.device_jwt;
-            const identity = this._persisted.identityKeypair;
-            const ephemeral = this._persisted.ephemeralKeypair;
-            const sessions = {};
-            // Initialize X3DH + ratchet for EVERY conversation (not just primary)
-            for (const conv of conversations) {
-                // Use per-conversation owner keys if available, fallback to primary keys
-                const ownerIdentityKey = conv.owner_identity_public_key || result.owner_identity_public_key;
-                const ownerEphemeralKey = conv.owner_ephemeral_public_key ||
-                    result.owner_ephemeral_public_key ||
-                    ownerIdentityKey;
-                const sharedSecret = performX3DH({
-                    myIdentityPrivate: hexToBytes(identity.privateKey),
-                    myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
-                    theirIdentityPublic: hexToBytes(ownerIdentityKey),
-                    theirEphemeralPublic: hexToBytes(ownerEphemeralKey),
-                    isInitiator: false,
-                });
-                const ratchet = DoubleRatchet.initReceiver(sharedSecret, {
-                    publicKey: hexToBytes(identity.publicKey),
-                    privateKey: hexToBytes(identity.privateKey),
-                    keyType: "ed25519",
-                }, hexToBytes(ownerIdentityKey));
-                this._sessions.set(conv.conversation_id, {
-                    ownerDeviceId: conv.owner_device_id,
-                    ratchet,
-                    activated: false, // Wait for owner's first message before sending to this session
-                });
-                sessions[conv.conversation_id] = {
-                    ownerDeviceId: conv.owner_device_id,
-                    ratchetState: ratchet.serialize(),
-                };
-                console.log(`[SecureChannel] Session initialized for conv ${conv.conversation_id.slice(0, 8)}... (owner ${conv.owner_device_id.slice(0, 8)}..., primary=${conv.is_primary})`);
-            }
-            // Persist full state (preserve existing messageHistory)
-            this._persisted = {
-                ...this._persisted,
-                deviceJwt: result.device_jwt,
-                primaryConversationId: primary.conversation_id,
-                sessions,
-                messageHistory: this._persisted.messageHistory ?? [],
-            };
-            // Store group_id and default_topic_id for topic API calls
-            if (conversations.length > 0) {
-                const firstConv = conversations[0];
-                if (firstConv.group_id) {
-                    this._persisted.groupId = firstConv.group_id;
-                }
-                if (firstConv.default_topic_id) {
-                    this._persisted.defaultTopicId = firstConv.default_topic_id;
-                }
-            }
-            await saveState(this.config.dataDir, this._persisted);
-            // Register webhook if configured
-            if (this.config.webhookUrl) {
-                try {
-                    const webhookResp = await fetch(`${this.config.apiUrl}/api/v1/devices/self/webhook`, {
-                        method: "PATCH",
-                        headers: {
-                            "Content-Type": "application/json",
-                            Authorization: `Bearer ${this._deviceJwt}`,
-                        },
-                        body: JSON.stringify({ webhook_url: this.config.webhookUrl }),
-                    });
-                    if (webhookResp.ok) {
-                        const webhookData = await webhookResp.json();
-                        console.log(`[SecureChannel] Webhook registered: ${this.config.webhookUrl} (secret: ${webhookData.webhook_secret?.slice(0, 8)}...)`);
-                        this.emit("webhook_registered", {
-                            url: this.config.webhookUrl,
-                            secret: webhookData.webhook_secret,
-                        });
-                    }
-                    else {
-                        console.warn(`[SecureChannel] Webhook registration failed: ${webhookResp.status}`);
-                    }
-                }
-                catch (err) {
-                    console.warn(`[SecureChannel] Webhook registration error: ${err}`);
-                }
-            }
-            this._connect();
-        }
-        catch (err) {
-            this._handleError(err);
-        }
-    }
-    _connect() {
-        if (this._stopped)
-            return;
-        // Clear reconnect timer — we're connecting now, so any pending reconnect is superseded.
-        if (this._reconnectTimer) {
-            clearTimeout(this._reconnectTimer);
-            this._reconnectTimer = null;
-        }
-        // Clean up existing WebSocket to prevent reconnect cascade:
-        // The server disconnects old WS when same device reconnects, which fires
-        // the old close handler → _scheduleReconnect() → new _connect() → cascade.
-        if (this._ws) {
-            this._ws.removeAllListeners();
-            try {
-                this._ws.close();
-            }
-            catch { /* already closed */ }
-            this._ws = null;
-        }
-        this._setState("connecting");
-        const wsUrl = this.config.apiUrl.replace(/^http/, "ws");
-        const url = `${wsUrl}/api/v1/ws?token=${encodeURIComponent(this._deviceJwt)}&device_id=${this._deviceId}`;
-        const ws = new WebSocket(url);
-        this._ws = ws;
-        ws.on("open", async () => {
-            try {
-                this._reconnectAttempt = 0;
-                this._lastWsOpenTime = Date.now();
-                this._startPing(ws);
-                this._startWakeDetector();
-                this._startPendingPoll();
-                // Sync missed messages before declaring ready
-                await this._syncMissedMessages();
-                await this._flushOutboundQueue();
-                this._setState("ready");
-                // Initialize client-side policy scanning if enabled
-                if (this.config.enableScanning) {
-                    this._scanEngine = new ScanEngine();
-                    await this._fetchScanRules();
-                }
-                // Sync A2A channels from server (handles missed WS events after restart)
-                try {
-                    await this.listA2AChannels();
-                }
-                catch (err) {
-                    console.warn("[SecureChannel] A2A channel sync failed (non-fatal):", err);
-                }
-                // Initialize telemetry reporter for agent-side metrics
-                // (hubId may not be set yet — hub_identity_sync event will late-init if needed)
-                if (!this._telemetryReporter && this._persisted?.deviceJwt && this._persisted?.hubId) {
-                    this._telemetryReporter = new TelemetryReporter({
-                        apiBase: this.config.apiUrl,
-                        hubId: this._persisted.hubId,
-                        authHeader: `Bearer ${this._persisted.deviceJwt}`,
-                        agentName: this.config.agentName ?? this._persisted.hubAddress,
-                        agentVersion: this.config.agentVersion ?? "0.0.0",
-                    });
-                    this._telemetryReporter.startAutoFlush(30_000);
-                }
-                this.emit("ready");
-            }
-            catch (openErr) {
-                console.error("[SecureChannel] Error in WS open handler:", openErr);
-                this.emit("error", openErr);
-            }
-        });
-        ws.on("message", async (raw) => {
-            this._lastServerMessage = Date.now();
-            this._lastWakeTick = Date.now();
-            try {
-                const data = JSON.parse(raw.toString());
-                if (data.event === "ping") {
-                    ws.send(JSON.stringify({ event: "pong" }));
-                    return;
-                }
-                if (data.event === "device_revoked") {
-                    await clearState(this.config.dataDir);
-                    this._handleError(new Error("Device was revoked"));
-                    return;
-                }
-                if (data.event === "device_linked") {
-                    await this._handleDeviceLinked(data.data);
-                    return;
-                }
-                if (data.event === "resync_request") {
-                    await this._handleResyncRequest(data.data);
-                    return;
-                }
-                if (data.event === "resync_ack") {
-                    // Agent doesn't need to handle its own ack echo
-                    return;
-                }
-                if (data.event === "message") {
-                    try {
-                        await this._handleIncomingMessage(data.data);
-                    }
-                    catch (msgErr) {
-                        console.error(`[SecureChannel] Message handler failed for conv ${data.data?.conversation_id?.slice(0, 8) ?? "?"}...:`, msgErr);
-                    }
-                }
-                if (data.event === "room_joined") {
-                    const d = data.data;
-                    this.joinRoom({
-                        roomId: d.room_id,
-                        name: d.room_name ?? d.name ?? "Room",
-                        members: (d.members || []).map((m) => ({
-                            deviceId: m.device_id,
-                            entityType: m.entity_type,
-                            displayName: m.display_name,
-                            identityPublicKey: m.identity_public_key,
-                            ephemeralPublicKey: m.ephemeral_public_key,
-                        })),
-                        conversations: (d.conversations || []).map((c) => ({
-                            id: c.id,
-                            participantA: c.participant_a,
-                            participantB: c.participant_b,
-                        })),
-                        forceRekey: d.force_rekey === true,
-                    }).catch((err) => this.emit("error", err));
-                }
-                if (data.event === "room_message") {
-                    try {
-                        await this._handleRoomMessage(data.data);
-                    }
-                    catch (rmErr) {
-                        console.error(`[SecureChannel] Room message handler failed:`, rmErr);
-                    }
-                }
-                if (data.event === "sender_key_distribution") {
-                    try {
-                        await this._handleSenderKeyDistribution(data.data);
-                    }
-                    catch (skdErr) {
-                        console.error("[SecureChannel] Sender key distribution handler failed:", skdErr);
-                    }
-                }
-                if (data.event === "room_message_sk") {
-                    try {
-                        await this._handleRoomMessageSK(data.data);
-                    }
-                    catch (rmskErr) {
-                        console.error("[SecureChannel] SK room message handler failed:", rmskErr);
-                    }
-                }
-                if (data.event === "room_participant_added") {
-                    const p = data.data;
-                    this.emit("room_participant_added", {
-                        roomId: p.room_id,
-                        participant: {
-                            deviceId: p.participant?.device_id ?? p.device_id,
-                            participantType: p.participant?.participant_type ?? p.participant_type ?? "human",
-                            displayName: p.participant?.display_name ?? p.display_name,
-                        },
-                    });
-                }
-                if (data.event === "room_participant_removed") {
-                    const p = data.data;
-                    this.emit("room_participant_removed", {
-                        roomId: p.room_id,
-                        participant: {
-                            deviceId: p.participant?.device_id ?? p.device_id,
-                            participantType: p.participant?.participant_type ?? p.participant_type ?? "human",
-                            displayName: p.participant?.display_name ?? p.display_name,
-                        },
-                    });
-                }
-                if (data.event === "policy_blocked") {
-                    this.emit("policy_blocked", data.data);
-                }
-                if (data.event === "message_held") {
-                    this.emit("message_held", data.data);
-                }
-                if (data.event === "policy_rejected") {
-                    this.emit("policy_rejected", data.data);
-                }
-                if (data.event === "scan_rules_updated") {
-                    await this._fetchScanRules();
-                    return;
-                }
-                // hub_identity_sync fires on every WS connect — ensures hubId is set for telemetry
-                if (data.event === "hub_identity_sync") {
-                    if (this._persisted && data.data?.hub_id) {
-                        const changed = this._persisted.hubId !== data.data.hub_id;
-                        this._persisted.hubAddress = data.data.hub_address;
-                        this._persisted.hubId = data.data.hub_id;
-                        this._persisted.agentHubId = data.data.hub_id;
-                        if (changed)
-                            this._persistState();
-                        // Late-init telemetry reporter if it wasn't created during open handler
-                        if (!this._telemetryReporter && this._persisted.deviceJwt && this._persisted.hubId) {
-                            this._telemetryReporter = new TelemetryReporter({
-                                apiBase: this.config.apiUrl,
-                                hubId: this._persisted.hubId,
-                                authHeader: `Bearer ${this._persisted.deviceJwt}`,
-                                agentName: this.config.agentName ?? this._persisted.hubAddress,
-                                agentVersion: this.config.agentVersion ?? "0.0.0",
-                            });
-                            this._telemetryReporter.startAutoFlush(30_000);
-                        }
-                    }
-                }
-                if (data.event === "hub_identity_assigned") {
-                    if (this._persisted) {
-                        this._persisted.hubAddress = data.data.hub_address;
-                        this._persisted.hubId = data.data.hub_id;
-                        this._persistState();
-                    }
-                    this.emit("hub_identity_assigned", data.data);
-                }
-                if (data.event === "hub_identity_removed") {
-                    if (this._persisted) {
-                        delete this._persisted.hubAddress;
-                        delete this._persisted.hubId;
-                        this._persistState();
-                    }
-                    this.emit("hub_identity_removed", data.data);
-                }
-                // --- A2A Channel WS events ---
-                if (data.event === "a2a_channel_approved") {
-                    const channelData = data.data || data;
-                    const channelId = channelData.channel_id;
-                    const convId = channelData.conversation_id;
-                    // Determine role: if we are the initiator hub address, we initiated
-                    const myHub = this._persisted?.hubAddress || "";
-                    const role = channelData.role ||
-                        (channelData.initiator_hub_address === myHub ? "initiator" : "responder");
-                    const peerHub = role === "initiator"
-                        ? channelData.responder_hub_address || ""
-                        : channelData.initiator_hub_address || "";
-                    // Store in persisted state
-                    if (this._persisted && convId) {
-                        if (!this._persisted.a2aChannels)
-                            this._persisted.a2aChannels = {};
-                        // Generate ephemeral X25519 keypair for key exchange
-                        const a2aEphemeral = await generateEphemeralKeypair();
-                        const ephPubHex = bytesToHex(a2aEphemeral.publicKey);
-                        const ephPrivHex = bytesToHex(a2aEphemeral.privateKey);
-                        this._persisted.a2aChannels[channelId] = {
-                            channelId,
-                            hubAddress: peerHub,
-                            conversationId: convId,
-                            role,
-                            pendingEphemeralPrivateKey: ephPrivHex,
-                        };
-                        // Send ephemeral public key to server for key exchange
-                        if (this._ws) {
-                            this._ws.send(JSON.stringify({
-                                event: "a2a_key_exchange",
-                                data: {
-                                    channel_id: channelId,
-                                    ephemeral_key: ephPubHex,
-                                },
-                            }));
-                            console.log(`[SecureChannel] A2A key exchange sent for channel ${channelId.slice(0, 8)}... (role=${role})`);
-                        }
-                        await this._persistState();
-                    }
-                    this.emit("a2a_channel_approved", channelData);
-                    // Notify gateway — channel is ready for messaging
-                    if (this.config.onA2AChannelReady && convId) {
-                        this.config.onA2AChannelReady({
-                            channelId,
-                            peerHubAddress: peerHub,
-                            role,
-                            conversationId: convId,
-                            topic: channelData.topic || undefined,
-                        });
-                    }
-                }
-                if (data.event === "a2a_channel_activated") {
-                    const actData = data.data || data;
-                    const channelId = actData.channel_id;
-                    const convId = actData.conversation_id;
-                    const activatedRole = actData.role;
-                    const peerIdentityHex = actData.peer_identity_key;
-                    const peerEphemeralHex = actData.peer_ephemeral_key;
-                    const channelEntry = this._persisted?.a2aChannels?.[channelId];
-                    if (channelEntry && channelEntry.pendingEphemeralPrivateKey && this._persisted) {
-                        try {
-                            // Reconstruct keys from hex
-                            const myIdentityPrivate = hexToBytes(this._persisted.identityKeypair.privateKey);
-                            const myIdentityPublic = hexToBytes(this._persisted.identityKeypair.publicKey);
-                            const myEphemeralPrivate = hexToBytes(channelEntry.pendingEphemeralPrivateKey);
-                            const theirIdentityPublic = hexToBytes(peerIdentityHex);
-                            const theirEphemeralPublic = hexToBytes(peerEphemeralHex);
-                            // Perform X3DH key agreement
-                            const sharedSecret = performX3DH({
-                                myIdentityPrivate,
-                                myEphemeralPrivate,
-                                theirIdentityPublic,
-                                theirEphemeralPublic,
-                                isInitiator: activatedRole === "initiator",
-                            });
-                            // Initialize Double Ratchet
-                            const identityKp = {
-                                publicKey: myIdentityPublic,
-                                privateKey: myIdentityPrivate,
-                                keyType: "ed25519",
-                            };
-                            const ratchet = activatedRole === "initiator"
-                                ? DoubleRatchet.initSender(sharedSecret, identityKp, theirIdentityPublic)
-                                : DoubleRatchet.initReceiver(sharedSecret, identityKp, theirIdentityPublic);
-                            // Store session state
-                            channelEntry.session = {
-                                ownerDeviceId: "", // A2A sessions don't have an owner device
-                                ratchetState: ratchet.serialize(),
-                                activated: activatedRole === "initiator", // initiator can send immediately
-                            };
-                            channelEntry.role = activatedRole;
-                            if (convId)
-                                channelEntry.conversationId = convId;
-                            // Clean up ephemeral private key (no longer needed)
-                            delete channelEntry.pendingEphemeralPrivateKey;
-                            await this._persistState();
-                            console.log(`[SecureChannel] A2A channel activated: ${channelId.slice(0, 8)}... (role=${activatedRole}, ` +
-                                `canSend=${activatedRole === "initiator"})`);
-                        }
-                        catch (err) {
-                            console.error(`[SecureChannel] A2A activation failed for ${channelId.slice(0, 8)}...:`, err);
-                            this.emit("error", err);
-                        }
-                    }
-                    this.emit("a2a_channel_activated", actData);
-                }
-                // --- Observer key exchange events ---
-                if (data.event === "a2a_observer_enabled") {
-                    // Owner has enabled observation on this channel — submit observer ephemeral key
-                    const obsData = data.data || data;
-                    const obsChannelId = obsData.channel_id;
-                    const obsChannelEntry = this._persisted?.a2aChannels?.[obsChannelId];
-                    if (obsChannelEntry && this._persisted && this._ws) {
-                        try {
-                            const obsEphemeral = await generateEphemeralKeypair();
-                            const obsEphPubHex = bytesToHex(obsEphemeral.publicKey);
-                            const obsEphPrivHex = bytesToHex(obsEphemeral.privateKey);
-                            obsChannelEntry.pendingObserverEphemeralPrivateKey = obsEphPrivHex;
-                            await this._persistState();
-                            this._ws.send(JSON.stringify({
-                                event: "a2a_observer_key_submit",
-                                data: {
-                                    channel_id: obsChannelId,
-                                    ephemeral_key: obsEphPubHex,
-                                    side: obsChannelEntry.role || "initiator",
-                                },
-                            }));
-                            console.log(`[SecureChannel] Observer key submitted for channel ${obsChannelId.slice(0, 8)}... (side=${obsChannelEntry.role})`);
-                        }
-                        catch (err) {
-                            console.error("[SecureChannel] Observer key submission failed:", err);
-                        }
-                    }
-                }
-                if (data.event === "a2a_observer_key_accepted") {
-                    // Server accepted our observer key and returned owner's identity key
-                    const obsAccData = data.data || data;
-                    const obsAccChannelId = obsAccData.channel_id;
-                    const observerIdentityHex = obsAccData.observer_identity_key;
-                    const obsAccSide = obsAccData.side;
-                    const obsAccEntry = this._persisted?.a2aChannels?.[obsAccChannelId];
-                    if (obsAccEntry &&
-                        obsAccEntry.pendingObserverEphemeralPrivateKey &&
-                        this._persisted) {
-                        try {
-                            const myIdentityPrivate = hexToBytes(this._persisted.identityKeypair.privateKey);
-                            const myIdentityPublic = hexToBytes(this._persisted.identityKeypair.publicKey);
-                            const myObsEphemeralPrivate = hexToBytes(obsAccEntry.pendingObserverEphemeralPrivateKey);
-                            const ownerIdentityPublic = hexToBytes(observerIdentityHex);
-                            // Perform X3DH: agent is always initiator toward owner
-                            const obsSharedSecret = performX3DH({
-                                myIdentityPrivate,
-                                myEphemeralPrivate: myObsEphemeralPrivate,
-                                theirIdentityPublic: ownerIdentityPublic,
-                                theirEphemeralPublic: ownerIdentityPublic, // owner uses identity as ephemeral
-                                isInitiator: true,
-                            });
-                            const identityKp = {
-                                publicKey: myIdentityPublic,
-                                privateKey: myIdentityPrivate,
-                                keyType: "ed25519",
-                            };
-                            const obsRatchet = DoubleRatchet.initSender(obsSharedSecret, identityKp, ownerIdentityPublic);
-                            obsAccEntry.observerSession = {
-                                ratchetState: obsRatchet.serialize(),
-                            };
-                            delete obsAccEntry.pendingObserverEphemeralPrivateKey;
-                            await this._persistState();
-                            console.log(`[SecureChannel] Observer ratchet initialized for channel ${obsAccChannelId.slice(0, 8)}... (side=${obsAccSide})`);
-                        }
-                        catch (err) {
-                            console.error("[SecureChannel] Observer ratchet init failed:", err);
-                        }
-                    }
-                }
-                if (data.event === "a2a_channel_rejected") {
-                    this.emit("a2a_channel_rejected", data.data || data);
-                }
-                if (data.event === "a2a_channel_revoked") {
-                    const channelData = data.data || data;
-                    const channelId = channelData.channel_id;
-                    // Remove from persisted state
-                    if (this._persisted?.a2aChannels?.[channelId]) {
-                        delete this._persisted.a2aChannels[channelId];
-                        await this._persistState();
-                    }
-                    this.emit("a2a_channel_revoked", channelData);
-                }
-                if (data.event === "a2a_message") {
-                    const msgData = data.data || data;
-                    const a2aMsgId = msgData.message_id;
-                    // Dedup: skip if already processed (direct + Redis double-delivery)
-                    if (a2aMsgId && this._a2aSeenMessageIds.has(a2aMsgId)) {
-                        return;
-                    }
-                    if (a2aMsgId) {
-                        this._a2aSeenMessageIds.add(a2aMsgId);
-                        // Evict oldest if buffer full
-                        if (this._a2aSeenMessageIds.size > SecureChannel.A2A_SEEN_MAX) {
-                            const first = this._a2aSeenMessageIds.values().next().value;
-                            if (first)
-                                this._a2aSeenMessageIds.delete(first);
-                        }
-                    }
-                    // --- Encrypted A2A message (has ciphertext field) ---
-                    if (msgData.ciphertext && msgData.header_blob) {
-                        const channelId = msgData.channel_id || "";
-                        const channelEntry = this._persisted?.a2aChannels?.[channelId];
-                        if (channelEntry?.session?.ratchetState) {
-                            try {
-                                // Reconstruct EncryptedMessage from hex transport
-                                const headerJson = Buffer.from(msgData.header_blob, "hex").toString("utf-8");
-                                const headerObj = JSON.parse(headerJson);
-                                const encryptedMessage = {
-                                    header: {
-                                        dhPublicKey: hexToBytes(headerObj.dhPublicKey),
-                                        previousChainLength: headerObj.previousChainLength,
-                                        messageNumber: headerObj.messageNumber,
-                                    },
-                                    headerSignature: hexToBytes(msgData.header_signature),
-                                    ciphertext: hexToBytes(msgData.ciphertext),
-                                    nonce: hexToBytes(msgData.nonce),
-                                };
-                                // Decrypt
-                                const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
-                                const ratchetSnapshot = channelEntry.session.ratchetState; // snapshot before decrypt
-                                let a2aPlaintext;
-                                try {
-                                    a2aPlaintext = ratchet.decrypt(encryptedMessage);
-                                }
-                                catch (decryptErr) {
-                                    console.error(`[SecureChannel] A2A decrypt failed — restoring ratchet state:`, decryptErr);
-                                    channelEntry.session.ratchetState = ratchetSnapshot;
-                                    return;
-                                }
-                                // Update ratchet state
-                                channelEntry.session.ratchetState = ratchet.serialize();
-                                // If responder and not yet activated, this is the first initiator message
-                                if (channelEntry.role === "responder" && !channelEntry.session.activated) {
-                                    channelEntry.session.activated = true;
-                                    console.log(`[SecureChannel] A2A responder ratchet activated for ${channelId.slice(0, 8)}...`);
-                                    // Flush any queued messages
-                                    const queued = this._a2aPendingQueue[channelId];
-                                    if (queued && queued.length > 0) {
-                                        delete this._a2aPendingQueue[channelId];
-                                        console.log(`[SecureChannel] Flushing ${queued.length} queued A2A message(s)`);
-                                        // Flush asynchronously after persisting current state
-                                        await this._persistState();
-                                        for (const pending of queued) {
-                                            try {
-                                                await this.sendToAgent(channelEntry.hubAddress, pending.text, pending.opts);
-                                            }
-                                            catch (flushErr) {
-                                                console.error("[SecureChannel] Failed to flush queued A2A message:", flushErr);
-                                            }
-                                        }
-                                    }
-                                }
-                                await this._persistState();
-                                const a2aMsg = {
-                                    text: a2aPlaintext,
-                                    fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
-                                    channelId,
-                                    conversationId: msgData.conversation_id || "",
-                                    parentSpanId: msgData.parent_span_id,
-                                    timestamp: msgData.timestamp || new Date().toISOString(),
-                                };
-                                this.emit("a2a_message", a2aMsg);
-                                if (this.config.onA2AMessage) {
-                                    this.config.onA2AMessage(a2aMsg);
-                                }
-                            }
-                            catch (decryptErr) {
-                                console.error(`[SecureChannel] A2A decrypt failed for channel ${channelId.slice(0, 8)}...:`, decryptErr);
-                                this.emit("error", decryptErr);
-                            }
-                        }
-                        else {
-                            console.warn(`[SecureChannel] Received encrypted A2A message but no session for channel ${channelId}`);
-                        }
-                    }
-                    else {
-                        // --- Legacy plaintext A2A message ---
-                        const a2aMsg = {
-                            text: msgData.plaintext || msgData.text,
-                            fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
-                            channelId: msgData.channel_id || "",
-                            conversationId: msgData.conversation_id || "",
-                            parentSpanId: msgData.parent_span_id,
-                            timestamp: msgData.timestamp || new Date().toISOString(),
-                        };
-                        this.emit("a2a_message", a2aMsg);
-                        if (this.config.onA2AMessage) {
-                            this.config.onA2AMessage(a2aMsg);
-                        }
-                    }
-                }
-            }
-            catch (err) {
-                this.emit("error", err);
-            }
-        });
-        ws.on("close", () => {
-            this._stopPing();
-            this._stopWakeDetector();
-            this._stopPendingPoll();
-            if (this._stopped)
-                return;
-            this._setState("disconnected");
-            this._scheduleReconnect();
-        });
-        ws.on("error", (err) => {
-            this.emit("error", err);
-            // The close event will fire after this and handle reconnection
-        });
-    }
-    /**
-     * Handle an incoming encrypted message from a specific conversation.
-     * Decrypts using the appropriate session ratchet, emits to the agent,
-     * and relays as sync messages to sibling sessions.
-     */
-    async _handleIncomingMessage(msgData) {
-        // Don't decrypt our own messages
-        if (msgData.sender_device_id === this._deviceId)
-            return;
-        // Dedup: skip if this message was already processed during sync
-        if (this._syncMessageIds?.has(msgData.message_id)) {
-            return;
-        }
-        const convId = msgData.conversation_id;
-        const session = this._sessions.get(convId);
-        if (!session) {
-            // No session for this conversation — trigger resync to establish one
-            console.warn(`[SecureChannel] No session for conversation ${convId}, requesting resync`);
-            const RESYNC_COOLDOWN_MS = 5 * 60 * 1000;
-            const lastResync = this._lastResyncRequest.get(convId) ?? 0;
-            if (Date.now() - lastResync > RESYNC_COOLDOWN_MS &&
-                this._ws &&
-                this._persisted) {
-                this._lastResyncRequest.set(convId, Date.now());
-                this._ws.send(JSON.stringify({
-                    event: "resync_request",
-                    data: {
-                        conversation_id: convId,
-                        reason: "no_session",
-                        identity_public_key: this._persisted.identityKeypair.publicKey,
-                        ephemeral_public_key: this._persisted.ephemeralKeypair.publicKey,
-                    },
-                }));
-                this.emit("resync_requested", {
-                    conversationId: convId,
-                    reason: "no_session",
-                });
-            }
-            return;
-        }
-        const encrypted = transportToEncryptedMessage({
-            header_blob: msgData.header_blob,
-            ciphertext: msgData.ciphertext,
-        });
-        const ratchetSnapshot = session.ratchet.serialize();
-        let plaintext;
-        try {
-            plaintext = session.ratchet.decrypt(encrypted);
-        }
-        catch (decryptErr) {
-            console.error(`[SecureChannel] Decrypt failed for conv ${convId.slice(0, 8)}... — restoring ratchet:`, decryptErr);
-            try {
-                session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
-            }
-            catch (restoreErr) {
-                console.error("[SecureChannel] Ratchet restore failed:", restoreErr);
-            }
-            // Initiate resync if within cooldown window
-            const RESYNC_COOLDOWN_MS = 5 * 60 * 1000; // 5 minutes
-            const lastResync = this._lastResyncRequest.get(convId) ?? 0;
-            if (Date.now() - lastResync > RESYNC_COOLDOWN_MS && this._ws && this._persisted) {
-                this._lastResyncRequest.set(convId, Date.now());
-                const idPubHex = this._persisted.identityKeypair.publicKey;
-                const ephPubHex = this._persisted.ephemeralKeypair.publicKey;
-                this._ws.send(JSON.stringify({
-                    event: "resync_request",
-                    data: {
-                        conversation_id: convId,
-                        reason: "decrypt_failure",
-                        identity_public_key: idPubHex,
-                        ephemeral_public_key: ephPubHex,
-                    },
-                }));
-                console.log(`[SecureChannel] Sent resync_request for conv ${convId.slice(0, 8)}...`);
-                this.emit("resync_requested", { conversationId: convId, reason: "decrypt_failure" });
-            }
-            return;
-        }
-        // ACK delivery to server
-        this._sendAck(msgData.message_id);
-        // Mark session as activated on first owner message
-        if (!session.activated) {
-            session.activated = true;
-            console.log(`[SecureChannel] Session ${convId.slice(0, 8)}... activated by first owner message`);
-        }
-        // Parse structured payload (new format) or treat as raw text (legacy)
-        let messageText;
-        let messageType;
-        let attachmentInfo = null;
-        try {
-            const parsed = JSON.parse(plaintext);
-            messageType = parsed.type || "message";
-            messageText = parsed.text || plaintext;
-            if (parsed.attachment) {
-                attachmentInfo = parsed.attachment;
-            }
-        }
-        catch {
-            // Legacy plain string format
-            messageType = "message";
-            messageText = plaintext;
-        }
-        if (messageType === "session_init") {
-            // New device session activated — replay message history
-            console.log(`[SecureChannel] session_init received for ${convId.slice(0, 8)}..., replaying history`);
-            await this._replayHistoryToSession(convId);
-            await this._persistState();
-            return;
-        }
-        // --- Workspace file operations (no scan — these are structured commands) ---
-        if (messageType === "workspace_file_upload") {
-            try {
-                const parsed = JSON.parse(plaintext);
-                const workspaceDir = this._resolveWorkspaceDir();
-                const { handleWorkspaceUpload } = await import("./workspace-handlers.js");
-                const result = await handleWorkspaceUpload(parsed, workspaceDir);
-                await this._sendStructuredReply(convId, { type: "workspace_file_ack", filename: parsed.filename, ...result });
-            }
-            catch (err) {
-                await this._sendStructuredReply(convId, { type: "workspace_file_ack", status: "error", error: err.message });
-            }
-            return;
-        }
-        if (messageType === "workspace_file_list") {
-            try {
-                const workspaceDir = this._resolveWorkspaceDir();
-                const { handleWorkspaceList } = await import("./workspace-handlers.js");
-                const result = await handleWorkspaceList(workspaceDir);
-                await this._sendStructuredReply(convId, { type: "workspace_file_list_response", ...result });
-            }
-            catch (err) {
-                await this._sendStructuredReply(convId, { type: "workspace_file_list_response", files: [], error: err.message });
-            }
-            return;
-        }
-        if (messageType === "workspace_file_read") {
-            try {
-                const parsed = JSON.parse(plaintext);
-                const workspaceDir = this._resolveWorkspaceDir();
-                const { handleWorkspaceRead } = await import("./workspace-handlers.js");
-                const result = await handleWorkspaceRead(parsed, workspaceDir);
-                await this._sendStructuredReply(convId, { type: "workspace_file_read_response", ...result });
-            }
-            catch (err) {
-                await this._sendStructuredReply(convId, { type: "workspace_file_read_response", error: err.message });
-            }
-            return;
-        }
-        // Inbound scan — after decryption
-        if (this._scanEngine) {
-            const scanResult = this._scanEngine.scanInbound(messageText);
-            if (scanResult.status === "blocked") {
-                this.emit("scan_blocked", { direction: "inbound", violations: scanResult.violations });
-                return; // drop the message
-            }
-        }
-        if (messageType === "message") {
-            const topicId = msgData.topic_id;
-            // Track last inbound topic so replies default to the correct channel
-            this._lastIncomingTopicId = topicId;
-            // Handle attachment: download, decrypt, save to disk
-            let attachData;
-            if (attachmentInfo) {
-                try {
-                    const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
-                    attachData = {
-                        filename: attachmentInfo.filename,
-                        mime: attachmentInfo.mime,
-                        size: decrypted.length,
-                        filePath,
-                    };
-                    // For images: include base64 so LLM vision can see the content
-                    if (attachmentInfo.mime.startsWith("image/")) {
-                        attachData.base64 = `data:${attachmentInfo.mime};base64,${bytesToBase64(decrypted)}`;
-                    }
-                    // For text-based files: extract content inline
-                    const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
-                    if (textMimes.some((m) => attachmentInfo.mime.startsWith(m))) {
-                        attachData.textContent = new TextDecoder().decode(decrypted);
-                    }
-                }
-                catch (err) {
-                    console.error(`[SecureChannel] Failed to download attachment:`, err);
-                }
-            }
-            // Store owner message in history for cross-device replay
-            this._appendHistory("owner", messageText, topicId);
-            // Build display text with attachment content
-            let emitText = messageText;
-            if (attachData) {
-                if (attachData.textContent) {
-                    emitText = `[Attachment: ${attachData.filename} (${attachData.mime}) saved to ${attachData.filePath}]\n---\n${attachData.textContent}\n---\n\n${messageText}`;
-                }
-                else if (attachData.base64) {
-                    emitText = `[Image attachment: ${attachData.filename} saved to ${attachData.filePath}]\nUse your Read tool to view this image file.\n\n${messageText}`;
-                }
-                else {
-                    emitText = `[Attachment: ${attachData.filename} saved to ${attachData.filePath}]\n\n${messageText}`;
-                }
-            }
-            // Resolve room membership — check if this conversation belongs to a room
-            let roomId;
-            if (this._persisted?.rooms) {
-                for (const [rid, room] of Object.entries(this._persisted.rooms)) {
-                    if (room.conversationIds?.includes(convId)) {
-                        roomId = rid;
-                        break;
-                    }
-                }
-            }
-            // Update room context when a room message arrives (sticky — never cleared by 1:1 traffic)
-            if (roomId)
-                this._lastInboundRoomId = roomId;
-            // Emit to agent developer
-            const metadata = {
-                messageId: msgData.message_id,
-                conversationId: convId,
-                timestamp: msgData.created_at,
-                topicId,
-                attachment: attachData,
-                spanId: msgData.span_id,
-                parentSpanId: msgData.parent_span_id,
-                messageType: msgData.message_type ?? "text",
-                priority: msgData.priority ?? "normal",
-                envelopeVersion: msgData.envelope_version ?? "1.0.0",
-                roomId,
-            };
-            this.emit("message", emitText, metadata);
-            Promise.resolve(this.config.onMessage?.(emitText, metadata)).catch((err) => {
-                console.error("[SecureChannel] onMessage callback error:", err);
-            });
-            // Relay to sibling sessions as sync messages
-            await this._relaySyncToSiblings(convId, session.ownerDeviceId, messageText, topicId);
-        }
-        // If type === "sync", agent ignores it (sync is for owner devices only)
-        // Track last message timestamp for offline sync
-        if (this._persisted) {
-            this._persisted.lastMessageTimestamp = msgData.created_at;
-        }
-        // Persist all ratchet states after decrypt
-        await this._persistState();
-    }
-    /**
-     * Download an encrypted attachment blob, decrypt it, verify integrity,
-     * and save the plaintext file to disk.
-     */
-    async _downloadAndDecryptAttachment(info) {
-        const attachDir = join(this.config.dataDir, "attachments");
-        await mkdir(attachDir, { recursive: true });
-        // Download encrypted blob from API
-        const url = `${this.config.apiUrl}${info.blobUrl}`;
-        const res = await fetch(url, {
-            headers: { Authorization: `Bearer ${this._deviceJwt}` },
-        });
-        if (!res.ok) {
-            throw new Error(`Attachment download failed: ${res.status}`);
-        }
-        const buffer = await res.arrayBuffer();
-        const encryptedData = new Uint8Array(buffer);
-        // Verify integrity
-        const digest = computeFileDigest(encryptedData);
-        if (digest !== info.digest) {
-            throw new Error("Attachment digest mismatch — possible tampering");
-        }
-        // Decrypt
-        const fileKey = base64ToBytes(info.fileKey);
-        const fileNonce = base64ToBytes(info.fileNonce);
-        const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
-        // Save to disk
-        const filePath = join(attachDir, info.filename);
-        await writeFile(filePath, decrypted);
-        console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
-        return { filePath, decrypted };
-    }
-    /**
-     * Upload an attachment file: encrypt, upload to server, return metadata
-     * for inclusion in the message envelope.
-     */
-    async _uploadAttachment(filePath, conversationId) {
-        const data = await readFile(filePath);
-        const plainData = new Uint8Array(data);
-        const result = encryptFile(plainData);
-        // Upload encrypted blob via multipart form
-        const { Blob: NodeBlob, FormData: NodeFormData } = await import("node:buffer").then(() => globalThis);
-        const formData = new FormData();
-        formData.append("conversation_id", conversationId);
-        formData.append("file", new Blob([result.encryptedData.buffer], { type: "application/octet-stream" }), "attachment.bin");
-        const res = await fetch(`${this.config.apiUrl}/api/v1/attachments/upload`, {
-            method: "POST",
-            headers: { Authorization: `Bearer ${this._deviceJwt}` },
-            body: formData,
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`Attachment upload failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const filename = filePath.split("/").pop() || "file";
-        return {
-            blobId: resp.blob_id,
-            blobUrl: resp.blob_url,
-            fileKey: bytesToBase64(result.fileKey),
-            fileNonce: bytesToBase64(result.fileNonce),
-            digest: result.digest,
-            filename,
-            mime: "application/octet-stream",
-            size: plainData.length,
-        };
-    }
-    /**
-     * Send a message with an attached file. Encrypts the file, uploads it,
-     * then sends the envelope with attachment metadata via Double Ratchet.
-     */
-    async sendWithAttachment(plaintext, filePath, options) {
-        if (this._state !== "ready" || this._sessions.size === 0 || !this._ws) {
-            throw new Error("Channel is not ready");
-        }
-        const topicId = options?.topicId ?? this._persisted?.defaultTopicId;
-        // Upload attachment using primary conversation for the blob
-        const attachMeta = await this._uploadAttachment(filePath, this._primaryConversationId);
-        // Build envelope
-        const envelope = JSON.stringify({
-            type: "message",
-            text: plaintext,
-            topicId,
-            attachment: attachMeta,
-        });
-        // Store agent message in history
-        this._appendHistory("agent", plaintext, topicId);
-        const messageGroupId = randomUUID();
-        for (const [convId, session] of this._sessions) {
-            if (!session.activated)
-                continue;
-            const encrypted = session.ratchet.encrypt(envelope);
-            const transport = encryptedMessageToTransport(encrypted);
-            this._ws.send(JSON.stringify({
-                event: "message",
-                data: {
-                    conversation_id: convId,
-                    header_blob: transport.header_blob,
-                    ciphertext: transport.ciphertext,
-                    message_group_id: messageGroupId,
-                    topic_id: topicId,
-                },
-            }));
-        }
-        await this._persistState();
-    }
-    /**
-     * Relay an owner's message to all sibling sessions as encrypted sync messages.
-     * This allows all owner devices to see messages from any single device.
-     */
-    async _relaySyncToSiblings(sourceConvId, senderOwnerDeviceId, messageText, topicId) {
-        if (!this._ws || this._sessions.size <= 1)
-            return;
-        // Build set of room conversation IDs to exclude from sync relay
-        // (room pairwise sessions should NOT receive 1:1 sync messages)
-        const roomConvIds = new Set();
-        if (this._persisted?.rooms) {
-            for (const room of Object.values(this._persisted.rooms)) {
-                for (const cid of room.conversationIds) {
-                    roomConvIds.add(cid);
-                }
-            }
-        }
-        const syncPayload = JSON.stringify({
-            type: "sync",
-            sender: senderOwnerDeviceId,
-            text: messageText,
-            ts: new Date().toISOString(),
-            topicId,
-        });
-        for (const [siblingConvId, siblingSession] of this._sessions) {
-            if (siblingConvId === sourceConvId)
-                continue;
-            // Don't relay to sessions where owner hasn't sent their first message yet
-            if (!siblingSession.activated)
-                continue;
-            // Skip room pairwise sessions — those use sendToRoom()
-            if (roomConvIds.has(siblingConvId))
-                continue;
-            const syncEncrypted = siblingSession.ratchet.encrypt(syncPayload);
-            const syncTransport = encryptedMessageToTransport(syncEncrypted);
-            this._ws.send(JSON.stringify({
-                event: "message",
-                data: {
-                    conversation_id: siblingConvId,
-                    header_blob: syncTransport.header_blob,
-                    ciphertext: syncTransport.ciphertext,
-                },
-            }));
-        }
-    }
-    /**
-     * Resolve the agent's workspace directory.
-     * Looks for OpenClaw workspace config, falls back to default path.
-     */
-    _resolveWorkspaceDir() {
-        const homedir = process.env.HOME ?? process.env.USERPROFILE ?? "/tmp";
-        const agentName = this.config.agentName;
-        // Try to read OpenClaw config for workspace path
-        try {
-            const configPath = join(homedir, ".openclaw", "openclaw.json");
-            const raw = require("node:fs").readFileSync(configPath, "utf-8");
-            const config = JSON.parse(raw);
-            const agents = config?.agents?.list;
-            if (Array.isArray(agents) && agentName) {
-                // Find the agent matching this account by id or name
-                for (const agent of agents) {
-                    if ((agent.id === agentName || agent.name === agentName) &&
-                        agent.workspace && typeof agent.workspace === "string") {
-                        return agent.workspace;
-                    }
-                }
-            }
-        }
-        catch {
-            // Config not found or unreadable — fall through to default
-        }
-        // Fallback: OpenClaw convention is ~/.openclaw/workspace-<name>/
-        if (agentName && agentName !== "CLI Agent" && agentName !== "OpenClaw Agent") {
-            return join(homedir, ".openclaw", `workspace-${agentName}`);
-        }
-        // Last resort: default workspace
-        return join(homedir, ".openclaw", "workspace");
-    }
-    /**
-     * Send a structured JSON reply to a specific conversation.
-     * Encrypts the payload via the conversation's ratchet and sends via WebSocket.
-     */
-    async _sendStructuredReply(convId, payload) {
-        const session = this._sessions.get(convId);
-        if (!session || !this._ws) {
-            console.warn(`[SecureChannel] Cannot send structured reply — no session for ${convId.slice(0, 8)}...`);
-            return;
-        }
-        const plaintext = JSON.stringify(payload);
-        const encrypted = session.ratchet.encrypt(plaintext);
-        const transport = encryptedMessageToTransport(encrypted);
-        this._ws.send(JSON.stringify({
-            event: "message",
-            data: {
-                conversation_id: convId,
-                header_blob: transport.header_blob,
-                ciphertext: transport.ciphertext,
-            },
-        }));
-        await this._persistState();
-    }
-    /**
-     * Send stored message history to a newly-activated session.
-     * Batches all history into a single encrypted message.
-     */
-    async _replayHistoryToSession(convId) {
-        const session = this._sessions.get(convId);
-        if (!session || !session.activated || !this._ws)
-            return;
-        const history = this._persisted?.messageHistory ?? [];
-        if (history.length === 0) {
-            console.log(`[SecureChannel] No history to replay for ${convId.slice(0, 8)}...`);
-            return;
-        }
-        console.log(`[SecureChannel] Replaying ${history.length} messages to session ${convId.slice(0, 8)}...`);
-        const replayPayload = JSON.stringify({
-            type: "history_replay",
-            messages: history,
-        });
-        const encrypted = session.ratchet.encrypt(replayPayload);
-        const transport = encryptedMessageToTransport(encrypted);
-        this._ws.send(JSON.stringify({
-            event: "message",
-            data: {
-                conversation_id: convId,
-                header_blob: transport.header_blob,
-                ciphertext: transport.ciphertext,
-            },
-        }));
-    }
-    /**
-     * Handle a device_linked event: a new owner device has joined.
-     * Fetches the new device's public keys, performs X3DH, and initializes
-     * a new ratchet session.
-     */
-    async _handleDeviceLinked(event) {
-        console.log(`[SecureChannel] New owner device linked: ${event.owner_device_id.slice(0, 8)}...`);
-        try {
-            if (!event.owner_identity_public_key) {
-                console.error(`[SecureChannel] device_linked event missing owner keys for conv ${event.conversation_id.slice(0, 8)}...`);
-                return;
-            }
-            const identity = this._persisted.identityKeypair;
-            const ephemeral = this._persisted.ephemeralKeypair;
-            // Perform X3DH as responder with the new owner device
-            const sharedSecret = performX3DH({
-                myIdentityPrivate: hexToBytes(identity.privateKey),
-                myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
-                theirIdentityPublic: hexToBytes(event.owner_identity_public_key),
-                theirEphemeralPublic: hexToBytes(event.owner_ephemeral_public_key ?? event.owner_identity_public_key),
-                isInitiator: false,
-            });
-            // Initialize ratchet as receiver
-            const ratchet = DoubleRatchet.initReceiver(sharedSecret, {
-                publicKey: hexToBytes(identity.publicKey),
-                privateKey: hexToBytes(identity.privateKey),
-                keyType: "ed25519",
-            }, hexToBytes(event.owner_identity_public_key));
-            this._sessions.set(event.conversation_id, {
-                ownerDeviceId: event.owner_device_id,
-                ratchet,
-                activated: false, // Wait for owner's first message
-            });
-            // Persist
-            this._persisted.sessions[event.conversation_id] = {
-                ownerDeviceId: event.owner_device_id,
-                ratchetState: ratchet.serialize(),
-                activated: false,
-            };
-            // Persist owner hub_id if provided
-            if (event.owner_hub_id) {
-                this._persisted.ownerHubId = event.owner_hub_id;
-            }
-            await this._persistState();
-            console.log(`[SecureChannel] Session initialized for device ${event.owner_device_id.slice(0, 8)}... (conv ${event.conversation_id.slice(0, 8)}...)`);
-        }
-        catch (err) {
-            console.error(`[SecureChannel] Failed to handle device_linked:`, err);
-            this.emit("error", err);
-        }
-    }
-    /**
-     * Handle a resync_request from the owner (owner-initiated ratchet re-establishment).
-     * Re-derives shared secret via X3DH as responder, initializes fresh receiver ratchet,
-     * and sends resync_ack back with agent's public keys.
-     */
-    async _handleResyncRequest(data) {
-        const convId = data.conversation_id;
-        console.log(`[SecureChannel] Received resync_request for conv ${convId.slice(0, 8)}... (reason: ${data.reason ?? "unknown"})`);
-        try {
-            if (!this._persisted) {
-                console.error("[SecureChannel] Cannot handle resync — no persisted state");
-                return;
-            }
-            const identity = this._persisted.identityKeypair;
-            const ephemeral = this._persisted.ephemeralKeypair;
-            // Perform X3DH as responder (agent is always responder in 1:1)
-            const sharedSecret = performX3DH({
-                myIdentityPrivate: hexToBytes(identity.privateKey),
-                myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
-                theirIdentityPublic: hexToBytes(data.identity_public_key),
-                theirEphemeralPublic: hexToBytes(data.ephemeral_public_key),
-                isInitiator: false,
-            });
-            // Initialize fresh receiver ratchet
-            const ratchet = DoubleRatchet.initReceiver(sharedSecret, {
-                publicKey: hexToBytes(identity.publicKey),
-                privateKey: hexToBytes(identity.privateKey),
-                keyType: "ed25519",
-            }, hexToBytes(data.identity_public_key));
-            // Update session
-            const existingSession = this._sessions.get(convId);
-            const ownerDeviceId = data.sender_device_id ?? existingSession?.ownerDeviceId ?? "";
-            this._sessions.set(convId, {
-                ownerDeviceId,
-                ratchet,
-                activated: false, // Wait for owner's encrypted session_init
-            });
-            // Persist
-            this._persisted.sessions[convId] = {
-                ownerDeviceId,
-                ratchetState: ratchet.serialize(),
-                activated: false,
-            };
-            await this._persistState();
-            // Send resync_ack with agent's public keys
-            if (this._ws) {
-                this._ws.send(JSON.stringify({
-                    event: "resync_ack",
-                    data: {
-                        conversation_id: convId,
-                        identity_public_key: identity.publicKey,
-                        ephemeral_public_key: ephemeral.publicKey,
-                    },
-                }));
-            }
-            console.log(`[SecureChannel] Resync complete for conv ${convId.slice(0, 8)}... — waiting for owner session_init`);
-            this.emit("resync_completed", { conversationId: convId });
-        }
-        catch (err) {
-            console.error(`[SecureChannel] Resync failed for conv ${convId.slice(0, 8)}...:`, err);
-            this.emit("error", err);
-        }
-    }
-    /**
-     * Handle an incoming room message. Finds the pairwise conversation
-     * for the sender, decrypts, and emits a room_message event.
-     */
-    async _handleRoomMessage(msgData) {
-        // Don't decrypt our own messages
-        if (msgData.sender_device_id === this._deviceId)
-            return;
-        // Track room context so HTTP /send and OpenClaw tools auto-route to this room
-        this._lastInboundRoomId = msgData.room_id;
-        const convId = msgData.conversation_id ??
-            this._findConversationForSender(msgData.sender_device_id, msgData.room_id);
-        if (!convId) {
-            console.warn(`[SecureChannel] No conversation found for sender ${msgData.sender_device_id.slice(0, 8)}... in room ${msgData.room_id}`);
-            return;
-        }
-        let session = this._sessions.get(convId);
-        if (!session) {
-            // Unknown conversation — possibly a new member joined the room
-            // after we connected. Fetch updated room data and create a session.
-            console.warn(`[SecureChannel] No session for room conv ${convId.slice(0, 8)}..., fetching room data`);
-            try {
-                const roomRes = await fetch(`${this.config.apiUrl}/api/v1/rooms/${msgData.room_id}`, {
-                    headers: {
-                        Authorization: `Bearer ${this._persisted.deviceJwt}`,
-                    },
-                });
-                if (roomRes.ok) {
-                    const roomData = await roomRes.json();
-                    await this.joinRoom({
-                        roomId: roomData.id,
-                        name: roomData.name,
-                        members: (roomData.members || []).map((m) => ({
-                            deviceId: m.device_id,
-                            entityType: m.entity_type,
-                            displayName: m.display_name,
-                            identityPublicKey: m.identity_public_key,
-                            ephemeralPublicKey: m.ephemeral_public_key,
-                        })),
-                        conversations: (roomData.conversations || []).map((c) => ({
-                            id: c.id,
-                            participantA: c.participant_a,
-                            participantB: c.participant_b,
-                        })),
-                    });
-                    session = this._sessions.get(convId);
-                }
-            }
-            catch (fetchErr) {
-                console.error(`[SecureChannel] Failed to fetch room data for ${msgData.room_id}:`, fetchErr);
-            }
-            if (!session) {
-                console.warn(`[SecureChannel] Still no session for room conv ${convId.slice(0, 8)}... after refresh, skipping`);
-                return;
-            }
-        }
-        const encrypted = transportToEncryptedMessage({
-            header_blob: msgData.header_blob,
-            ciphertext: msgData.ciphertext,
-        });
-        let plaintext;
-        const ratchetSnapshot = session.ratchet.serialize();
-        try {
-            plaintext = session.ratchet.decrypt(encrypted);
-        }
-        catch (decryptErr) {
-            // Restore ratchet to pre-decrypt state before attempting re-init
-            try {
-                session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
-            }
-            catch { }
-            // Ratchet desync — re-initialize from X3DH and retry once
-            console.warn(`[SecureChannel] Room decrypt failed for conv ${convId.slice(0, 8)}...: ${String(decryptErr)}, re-initializing ratchet`);
-            try {
-                const roomEntry = this._persisted?.rooms
-                    ? Object.values(this._persisted.rooms).find((r) => r.conversationIds.includes(convId))
-                    : null;
-                if (!roomEntry)
-                    throw new Error("Room not found for conversation");
-                const otherMember = roomEntry.members.find((m) => m.deviceId === msgData.sender_device_id);
-                if (!otherMember?.identityPublicKey)
-                    throw new Error("No key for sender");
-                const isInitiator = this._deviceId < msgData.sender_device_id;
-                const identity = this._persisted.identityKeypair;
-                const ephemeral = this._persisted.ephemeralKeypair;
-                const sharedSecret = performX3DH({
-                    myIdentityPrivate: hexToBytes(identity.privateKey),
-                    myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
-                    theirIdentityPublic: hexToBytes(otherMember.identityPublicKey),
-                    theirEphemeralPublic: hexToBytes(otherMember.ephemeralPublicKey ?? otherMember.identityPublicKey),
-                    isInitiator,
-                });
-                const peerIdPub = hexToBytes(otherMember.identityPublicKey);
-                const newRatchet = isInitiator
-                    ? DoubleRatchet.initSender(sharedSecret, {
-                        publicKey: hexToBytes(identity.publicKey),
-                        privateKey: hexToBytes(identity.privateKey),
-                        keyType: "ed25519",
-                    }, peerIdPub)
-                    : DoubleRatchet.initReceiver(sharedSecret, {
-                        publicKey: hexToBytes(identity.publicKey),
-                        privateKey: hexToBytes(identity.privateKey),
-                        keyType: "ed25519",
-                    }, peerIdPub);
-                session.ratchet = newRatchet;
-                session.activated = false;
-                this._persisted.sessions[convId] = {
-                    ownerDeviceId: session.ownerDeviceId,
-                    ratchetState: newRatchet.serialize(),
-                    activated: false,
-                };
-                await this._persistState();
-                console.log(`[SecureChannel] Room ratchet re-initialized for conv ${convId.slice(0, 8)}...`);
-                // Retry decrypt with fresh ratchet
-                plaintext = session.ratchet.decrypt(encrypted);
-            }
-            catch (reinitErr) {
-                console.error(`[SecureChannel] Room ratchet re-init failed for conv ${convId.slice(0, 8)}...:`, reinitErr);
-                return;
-            }
-        }
-        // Parse structured message envelope (same as 1:1 handler)
-        let messageText;
-        let messageType;
-        try {
-            const parsed = JSON.parse(plaintext);
-            messageType = parsed.type || "message";
-            messageText = parsed.text || plaintext;
-        }
-        catch {
-            messageType = "message";
-            messageText = plaintext;
-        }
-        // Activate session on first received message
-        if (!session.activated) {
-            session.activated = true;
-            console.log(`[SecureChannel] Room session ${convId.slice(0, 8)}... activated by first message`);
-        }
-        // ACK if message_id present
-        if (msgData.message_id) {
-            this._sendAck(msgData.message_id);
-        }
-        // Advance sync cursor so the sync poll doesn't re-process this message
-        if (msgData.created_at && this._persisted) {
-            this._persisted.lastMessageTimestamp = msgData.created_at;
-        }
-        await this._persistState();
-        const metadata = {
-            messageId: msgData.message_id ?? "",
-            conversationId: convId,
-            timestamp: msgData.created_at ?? new Date().toISOString(),
-            messageType: messageType,
-            roomId: msgData.room_id,
-        };
-        this.emit("room_message", {
-            roomId: msgData.room_id,
-            senderDeviceId: msgData.sender_device_id,
-            plaintext: messageText,
-            messageType: messageType,
-            timestamp: msgData.created_at ?? new Date().toISOString(),
-        });
-        Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
-            console.error("[SecureChannel] onMessage callback error:", err);
-        });
-    }
-    /**
-     * Find the pairwise conversation ID for a given sender in a room.
-     */
-    _findConversationForSender(senderDeviceId, roomId) {
-        const room = this._persisted?.rooms?.[roomId];
-        if (!room)
-            return null;
-        for (const convId of room.conversationIds) {
-            const session = this._sessions.get(convId);
-            if (session && session.ownerDeviceId === senderDeviceId) {
-                return convId;
-            }
-        }
-        return null;
-    }
-    /**
-     * Distribute own sender key to all pairwise sessions in a room.
-     * Each distribution is encrypted via the pairwise ratchet and sent
-     * as a `sender_key_distribution` WS event.
-     */
-    async _distributeSenderKey(roomId) {
-        if (!this._persisted?.rooms?.[roomId])
-            return;
-        const room = this._persisted.rooms[roomId];
-        const chain = this._senderKeyChains.get(roomId);
-        if (!chain || !this._deviceId)
-            return;
-        const dist = chain.getDistribution(this._deviceId);
-        const distJson = JSON.stringify(dist);
-        const alreadyDistributed = new Set(room.distributedTo ?? []);
-        for (const convId of room.conversationIds) {
-            const session = this._sessions.get(convId);
-            if (!session || alreadyDistributed.has(session.ownerDeviceId))
-                continue;
-            // Encrypt distribution via pairwise ratchet
-            const encrypted = session.ratchet.encrypt(distJson);
-            const transport = encryptedMessageToTransport(encrypted);
-            if (this._state === "ready" && this._ws) {
-                this._ws.send(JSON.stringify({
-                    event: "sender_key_distribution",
-                    data: {
-                        room_id: roomId,
-                        recipient_device_id: session.ownerDeviceId,
-                        header_blob: transport.header_blob,
-                        ciphertext: transport.ciphertext,
-                    },
-                }));
-                alreadyDistributed.add(session.ownerDeviceId);
-            }
-        }
-        room.distributedTo = [...alreadyDistributed];
-        await this._persistState();
-    }
-    /**
-     * Handle an incoming sender_key_distribution event.
-     * Decrypts using the pairwise ratchet and ingests the peer's sender key.
-     */
-    async _handleSenderKeyDistribution(data) {
-        if (data.sender_device_id === this._deviceId)
-            return;
-        // Find the pairwise conversation for this sender
-        const convId = this._findConversationForSender(data.sender_device_id, data.room_id);
-        if (!convId) {
-            console.warn(`[SecureChannel] No pairwise conv for sender key from ${data.sender_device_id.slice(0, 8)}...`);
-            return;
-        }
-        const session = this._sessions.get(convId);
-        if (!session)
-            return;
-        // Decrypt via pairwise ratchet
-        const encrypted = transportToEncryptedMessage({
-            header_blob: data.header_blob,
-            ciphertext: data.ciphertext,
-        });
-        let distJson;
-        // Snapshot ratchet state before decrypt — DoubleRatchet.decrypt() mutates
-        // internal state (DH ratchet step, chain key derivation) BEFORE AEAD
-        // verification, so a failed decrypt permanently corrupts the ratchet.
-        const ratchetSnapshot = session.ratchet.serialize();
-        try {
-            distJson = session.ratchet.decrypt(encrypted);
-        }
-        catch (err) {
-            // Restore ratchet to pre-decrypt state
-            session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
-            if (this._persisted?.sessions[convId]) {
-                this._persisted.sessions[convId].ratchetState = ratchetSnapshot;
-            }
-            console.warn(`[SecureChannel] Failed to decrypt sender key distribution from ${data.sender_device_id.slice(0, 8)}... (ratchet restored):`, err);
-            return;
-        }
-        // Parse and ingest
-        let dist;
-        try {
-            dist = JSON.parse(distJson);
-        }
-        catch {
-            console.warn("[SecureChannel] Corrupt sender key distribution JSON");
-            return;
-        }
-        let peerState = this._senderKeyStates.get(data.room_id);
-        if (!peerState) {
-            peerState = SenderKeyState.create();
-            this._senderKeyStates.set(data.room_id, peerState);
-        }
-        peerState.addDistribution(dist);
-        // Check if all members have distributed — if so, enable sender_key mode
-        const room = this._persisted?.rooms?.[data.room_id];
-        if (room) {
-            room.peerSenderKeyState = peerState.serialize();
-            const otherMembers = room.members.filter((m) => m.deviceId !== this._deviceId);
-            const allHaveKeys = otherMembers.every((m) => peerState.hasDistribution(m.deviceId));
-            if (allHaveKeys && otherMembers.length > 0) {
-                room.encryptionMode = "sender_key";
-                console.log(`[SecureChannel] Room ${data.room_id.slice(0, 8)}... upgraded to sender_key mode ` +
-                    `(${otherMembers.length} peers)`);
-            }
-        }
-        // Activate session on first received message
-        if (!session.activated) {
-            session.activated = true;
-        }
-        await this._persistState();
-        // Reciprocate: distribute our own key to this sender if we haven't yet
-        if (room && !(room.distributedTo ?? []).includes(data.sender_device_id)) {
-            this._distributeSenderKey(data.room_id).catch(() => { });
-        }
-    }
-    /**
-     * Handle an incoming room_message_sk event (Sender Key encrypted message).
-     */
-    async _handleRoomMessageSK(msgData) {
-        if (msgData.sender_device_id === this._deviceId)
-            return;
-        // Track room context so HTTP /send and OpenClaw tools auto-route to this room
-        this._lastInboundRoomId = msgData.room_id;
-        const peerState = this._senderKeyStates.get(msgData.room_id);
-        if (!peerState) {
-            console.warn(`[SecureChannel] No sender key state for room ${msgData.room_id.slice(0, 8)}...`);
-            return;
-        }
-        const skMsg = {
-            iteration: msgData.iteration,
-            generationId: msgData.generation_id,
-            nonce: msgData.nonce,
-            ciphertext: msgData.ciphertext,
-            signature: msgData.signature,
-        };
-        let plaintext;
-        try {
-            plaintext = peerState.decrypt(msgData.sender_device_id, skMsg);
-        }
-        catch (err) {
-            console.warn(`[SecureChannel] SK decrypt failed from ${msgData.sender_device_id.slice(0, 8)}...:`, err);
-            return;
-        }
-        // Persist updated state
-        const room = this._persisted?.rooms?.[msgData.room_id];
-        if (room) {
-            room.peerSenderKeyState = peerState.serialize();
-        }
-        // Parse structured message envelope
-        let messageText;
-        let messageType;
-        try {
-            const parsed = JSON.parse(plaintext);
-            messageType = parsed.type || "message";
-            messageText = parsed.text || plaintext;
-        }
-        catch {
-            messageType = "message";
-            messageText = plaintext;
-        }
-        if (msgData.message_id) {
-            this._sendAck(msgData.message_id);
-        }
-        // Advance sync cursor so the sync poll doesn't re-process this message
-        if (msgData.created_at && this._persisted) {
-            this._persisted.lastMessageTimestamp = msgData.created_at;
-        }
-        await this._persistState();
-        const metadata = {
-            messageId: msgData.message_id ?? "",
-            conversationId: "",
-            timestamp: msgData.created_at ?? new Date().toISOString(),
-            messageType: messageType,
-            roomId: msgData.room_id,
-        };
-        this.emit("room_message", {
-            roomId: msgData.room_id,
-            senderDeviceId: msgData.sender_device_id,
-            plaintext: messageText,
-            messageType: messageType,
-            timestamp: msgData.created_at ?? new Date().toISOString(),
-        });
-        Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
-            console.error("[SecureChannel] onMessage callback error:", err);
-        });
-    }
-    /**
-     * Sync missed messages across ALL sessions.
-     * For each conversation, fetches messages since last sync and decrypts.
-     */
-    /**
-     * Paginated sync: fetch missed messages in pages of 200, up to 5 pages (1000 messages).
-     * Tracks message IDs in _syncMessageIds to prevent duplicate processing from concurrent WS messages.
-     */
-    async _syncMissedMessages() {
-        if (!this._persisted?.lastMessageTimestamp || !this._deviceJwt)
-            return;
-        this._syncMessageIds = new Set();
-        const MAX_PAGES = 5;
-        const PAGE_SIZE = 200;
-        let since = this._persisted.lastMessageTimestamp;
-        let totalProcessed = 0;
-        try {
-            for (let page = 0; page < MAX_PAGES; page++) {
-                const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/messages?since=${encodeURIComponent(since)}&limit=${PAGE_SIZE}`;
-                const res = await fetch(url, {
-                    headers: { Authorization: `Bearer ${this._deviceJwt}` },
-                });
-                if (!res.ok)
-                    break;
-                const messages = await res.json();
-                if (messages.length === 0)
-                    break;
-                for (const msg of messages) {
-                    if (msg.sender_device_id === this._deviceId)
-                        continue;
-                    // Dedup: skip if already processed
-                    if (this._syncMessageIds.has(msg.id))
-                        continue;
-                    this._syncMessageIds.add(msg.id);
-                    // Route room conversations through _handleRoomMessage so roomId
-                    // is set in metadata (agent replies to room, not 1:1).
-                    // Prefer server-provided room_id, fall back to local room state.
-                    let roomId = msg.room_id;
-                    if (!roomId && this._persisted?.rooms) {
-                        for (const room of Object.values(this._persisted.rooms)) {
-                            if (room.conversationIds?.includes(msg.conversation_id)) {
-                                roomId = room.roomId;
-                                break;
-                            }
-                        }
-                    }
-                    if (roomId) {
-                        try {
-                            await this._handleRoomMessage({
-                                room_id: roomId,
-                                sender_device_id: msg.sender_device_id,
-                                conversation_id: msg.conversation_id,
-                                header_blob: msg.header_blob,
-                                ciphertext: msg.ciphertext,
-                                message_id: msg.id,
-                                created_at: msg.created_at,
-                            });
-                        }
-                        catch (roomErr) {
-                            console.warn(`[SecureChannel] Sync room message failed for ${msg.conversation_id.slice(0, 8)}...:`, roomErr);
-                        }
-                        this._persisted.lastMessageTimestamp = msg.created_at;
-                        since = msg.created_at;
-                        continue;
-                    }
-                    const session = this._sessions.get(msg.conversation_id);
-                    if (!session) {
-                        // No session during sync — skip silently. Resync only triggers
-                        // on real-time messages when the owner's browser is connected.
-                        console.warn(`[SecureChannel] No session for conversation ${msg.conversation_id} during sync, skipping`);
-                        continue;
-                    }
-                    try {
-                        const encrypted = transportToEncryptedMessage({
-                            header_blob: msg.header_blob,
-                            ciphertext: msg.ciphertext,
-                        });
-                        const ratchetSnapshot = session.ratchet.serialize();
-                        let plaintext;
-                        try {
-                            plaintext = session.ratchet.decrypt(encrypted);
-                        }
-                        catch (decryptErr) {
-                            console.error(`[SecureChannel] Sync decrypt failed for ${msg.conversation_id.slice(0, 8)}... — restoring ratchet:`, decryptErr);
-                            try {
-                                session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
-                            }
-                            catch { }
-                            // Advance past the failing message to prevent infinite retry loop.
-                            this._persisted.lastMessageTimestamp = msg.created_at;
-                            since = msg.created_at;
-                            continue;
-                        }
-                        this._sendAck(msg.id);
-                        if (!session.activated) {
-                            session.activated = true;
-                            console.log(`[SecureChannel] Session ${msg.conversation_id.slice(0, 8)}... activated during sync`);
-                        }
-                        let messageText;
-                        let messageType;
-                        try {
-                            const parsed = JSON.parse(plaintext);
-                            messageType = parsed.type || "message";
-                            messageText = parsed.text || plaintext;
-                        }
-                        catch {
-                            messageType = "message";
-                            messageText = plaintext;
-                        }
-                        if (messageType === "message") {
-                            const topicId = msg.topic_id;
-                            this._appendHistory("owner", messageText, topicId);
-                            const metadata = {
-                                messageId: msg.id,
-                                conversationId: msg.conversation_id,
-                                timestamp: msg.created_at,
-                                topicId,
-                            };
-                            this.emit("message", messageText, metadata);
-                            Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
-                                console.error("[SecureChannel] onMessage callback error:", err);
-                            });
-                        }
-                        this._persisted.lastMessageTimestamp = msg.created_at;
-                        since = msg.created_at;
-                        totalProcessed++;
-                    }
-                    catch (err) {
-                        console.warn(`[SecureChannel] Sync failed for msg ${msg.id.slice(0, 8)}... in conv ${msg.conversation_id.slice(0, 8)}...: ${String(err)}`);
-                        // Advance past the failing message to prevent infinite retry loop.
-                        // The message is lost but the sync cursor moves forward.
-                        this._persisted.lastMessageTimestamp = msg.created_at;
-                        since = msg.created_at;
-                        continue;
-                    }
-                }
-                await this._persistState();
-                // If we got fewer than PAGE_SIZE, we've caught up
-                if (messages.length < PAGE_SIZE)
-                    break;
-            }
-            if (totalProcessed > 0) {
-                console.log(`[SecureChannel] Synced ${totalProcessed} missed messages`);
-            }
-        }
-        catch {
-            // Network error -- non-critical, will get messages via WS
-        }
-        this._syncMessageIds = null;
-    }
-    _sendAck(messageId) {
-        this._pendingAcks.push(messageId);
-        if (this._ackTimer)
-            clearTimeout(this._ackTimer);
-        this._ackTimer = setTimeout(() => this._flushAcks(), 500);
-    }
-    _flushAcks() {
-        if (this._pendingAcks.length === 0 || !this._ws)
-            return;
-        const batch = this._pendingAcks.splice(0, 50);
-        this._ws.send(JSON.stringify({ event: "ack", data: { message_ids: batch } }));
-    }
-    async _flushOutboundQueue() {
-        const queue = this._persisted?.outboundQueue;
-        if (!queue || queue.length === 0 || !this._ws)
-            return;
-        console.log(`[SecureChannel] Flushing ${queue.length} queued outbound messages`);
-        const messages = queue.splice(0); // Take all, clear queue
-        for (const msg of messages) {
-            try {
-                this._ws.send(JSON.stringify({
-                    event: "message",
-                    data: {
-                        conversation_id: msg.convId,
-                        header_blob: msg.headerBlob,
-                        ciphertext: msg.ciphertext,
-                        message_group_id: msg.messageGroupId,
-                        topic_id: msg.topicId,
-                    },
-                }));
-            }
-            catch (err) {
-                // Re-queue failed messages
-                if (!this._persisted.outboundQueue) {
-                    this._persisted.outboundQueue = [];
-                }
-                this._persisted.outboundQueue.push(msg);
-                console.warn(`[SecureChannel] Failed to flush message, re-queued: ${err}`);
-                break; // Stop flushing on first failure
-            }
-        }
-        await this._persistState();
-    }
-    _startPing(ws) {
-        this._stopPing(); // Clear any existing timers
-        this._lastServerMessage = Date.now();
-        this._pingTimer = setInterval(() => {
-            if (ws.readyState !== WebSocket.OPEN)
-                return;
-            const silence = Date.now() - this._lastServerMessage;
-            if (silence > SecureChannel.SILENCE_TIMEOUT_MS) {
-                console.log(`[SecureChannel] No server data for ${Math.round(silence / 1000)}s — reconnecting stale WebSocket`);
-                ws.terminate(); // Forces close → _scheduleReconnect fires
-            }
-        }, SecureChannel.PING_INTERVAL_MS);
-    }
-    _stopPing() {
-        if (this._pingTimer) {
-            clearInterval(this._pingTimer);
-            this._pingTimer = null;
-        }
-    }
-    _startWakeDetector() {
-        this._stopWakeDetector();
-        this._lastWakeTick = Date.now();
-        this._wakeDetectorTimer = setInterval(() => {
-            const gap = Date.now() - this._lastWakeTick;
-            this._lastWakeTick = Date.now();
-            if (gap > 120_000 && this._ws) {
-                console.log(`[SecureChannel] System wake detected (${Math.round(gap / 1000)}s gap) — forcing reconnect`);
-                this._ws.terminate();
-            }
-        }, 10_000);
-    }
-    _stopWakeDetector() {
-        if (this._wakeDetectorTimer) {
-            clearInterval(this._wakeDetectorTimer);
-            this._wakeDetectorTimer = null;
-        }
-    }
-    _startPendingPoll() {
-        this._stopPendingPoll();
-        this._pendingPollTimer = setInterval(() => {
-            this._checkPendingMessages();
-        }, PENDING_POLL_INTERVAL_MS);
-    }
-    _stopPendingPoll() {
-        if (this._pendingPollTimer) {
-            clearInterval(this._pendingPollTimer);
-            this._pendingPollTimer = null;
-        }
-    }
-    async _checkPendingMessages() {
-        // Don't poll while connecting (prevent hammering during reconnect)
-        if (this._state === "connecting" || !this._deviceId || !this._deviceJwt)
-            return;
-        try {
-            const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/pending`;
-            const resp = await fetch(url, {
-                headers: { Authorization: `Bearer ${this._deviceJwt}` },
-                signal: AbortSignal.timeout(10_000),
-            });
-            if (!resp.ok)
-                return; // Silent fail — WS silence detector is backup
-            const data = (await resp.json());
-            if (data.pending > 0 && this._state !== "ready") {
-                console.log(`[SecureChannel] Poll detected ${data.pending} pending messages — forcing reconnect`);
-                if (this._ws) {
-                    this._ws.terminate();
-                }
-                else {
-                    this._scheduleReconnect();
-                }
-            }
-            else if (data.pending > 0 && this._state === "ready") {
-                // WS claims ready but messages are pending — possible half-open connection
-                const silence = Date.now() - this._lastServerMessage;
-                if (silence > 180_000) {
-                    console.log(`[SecureChannel] Poll: ${data.pending} pending + ${Math.round(silence / 1000)}s silence — forcing reconnect`);
-                    if (this._ws)
-                        this._ws.terminate();
-                }
-            }
-        }
-        catch {
-            // Network error on poll — expected when offline, ignore silently
-        }
-    }
-    _scheduleReconnect() {
-        if (this._stopped)
-            return;
-        if (this._reconnectTimer)
-            return; // Already scheduled
-        // Detect rapid-disconnect cascade (e.g. two processes as same device).
-        // If WS opened recently (< 10s) and we're disconnecting, count it.
-        const sinceOpen = Date.now() - this._lastWsOpenTime;
-        if (this._lastWsOpenTime > 0 && sinceOpen < 10_000) {
-            this._rapidDisconnects++;
-        }
-        else {
-            this._rapidDisconnects = 0;
-        }
-        if (this._rapidDisconnects >= 5) {
-            console.error(`[SecureChannel] Detected rapid connect/disconnect loop (${this._rapidDisconnects} times in <10s each).`);
-            console.error(`[SecureChannel] This usually means another process is already connected as this device.`);
-            console.error(`[SecureChannel] Stopping reconnection. Check for duplicate gateway processes or stale CLI sessions.`);
-            this._setState("error");
-            this.emit("error", new Error("Reconnect loop detected — another process may be connected as this device"));
-            return;
-        }
-        const delay = Math.min(RECONNECT_BASE_MS * Math.pow(2, this._reconnectAttempt), RECONNECT_MAX_MS);
-        this._reconnectAttempt++;
-        console.log(`[SecureChannel] Scheduling reconnect in ${delay}ms (attempt ${this._reconnectAttempt})`);
-        this._reconnectTimer = setTimeout(() => {
-            this._reconnectTimer = null; // Clear BEFORE calling _connect so future disconnects can schedule new reconnects
-            if (!this._stopped) {
-                this._connect();
-            }
-        }, delay);
-    }
-    _setState(newState) {
-        if (this._state === newState)
-            return;
-        this._state = newState;
-        this.emit("state", newState);
-        this.config.onStateChange?.(newState);
-        // Start/stop polling fallback based on connection state
-        if (newState === "disconnected" && !this._pollFallbackTimer && this._deviceJwt) {
-            this._startPollFallback();
-        }
-        if (newState === "ready" || newState === "error" || this._stopped) {
-            this._stopPollFallback();
-        }
-    }
-    _startPollFallback() {
-        this._stopPollFallback();
-        console.log("[SecureChannel] Starting HTTP poll fallback (WS is down)");
-        let interval = SecureChannel.POLL_FALLBACK_INTERVAL_MS;
-        const poll = async () => {
-            if (this._state === "ready" || this._stopped) {
-                this._stopPollFallback();
-                return;
-            }
-            try {
-                const since = this._persisted?.lastMessageTimestamp;
-                if (!since || !this._deviceJwt)
-                    return;
-                const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/messages?since=${encodeURIComponent(since)}&limit=200`;
-                const res = await fetch(url, {
-                    headers: { Authorization: `Bearer ${this._deviceJwt}` },
-                });
-                if (!res.ok)
-                    return;
-                const messages = await res.json();
-                let foundMessages = false;
-                for (const msg of messages) {
-                    if (msg.sender_device_id === this._deviceId)
-                        continue;
-                    const session = this._sessions.get(msg.conversation_id);
-                    if (!session)
-                        continue;
-                    try {
-                        const encrypted = transportToEncryptedMessage({
-                            header_blob: msg.header_blob,
-                            ciphertext: msg.ciphertext,
-                        });
-                        const ratchetSnapshot = session.ratchet.serialize();
-                        let plaintext;
-                        try {
-                            plaintext = session.ratchet.decrypt(encrypted);
-                        }
-                        catch (decryptErr) {
-                            console.error(`[SecureChannel] Room sync decrypt failed for ${msg.conversation_id.slice(0, 8)}... — restoring ratchet:`, decryptErr);
-                            try {
-                                session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
-                            }
-                            catch { }
-                            continue;
-                        }
-                        if (!session.activated) {
-                            session.activated = true;
-                        }
-                        let messageText;
-                        let messageType;
-                        try {
-                            const parsed = JSON.parse(plaintext);
-                            messageType = parsed.type || "message";
-                            messageText = parsed.text || plaintext;
-                        }
-                        catch {
-                            messageType = "message";
-                            messageText = plaintext;
-                        }
-                        if (messageType === "message") {
-                            const topicId = msg.topic_id;
-                            this._appendHistory("owner", messageText, topicId);
-                            const metadata = {
-                                messageId: msg.id,
-                                conversationId: msg.conversation_id,
-                                timestamp: msg.created_at,
-                                topicId,
-                            };
-                            this.emit("message", messageText, metadata);
-                            Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
-                                console.error("[SecureChannel] onMessage callback error:", err);
-                            });
-                            foundMessages = true;
-                        }
-                        this._persisted.lastMessageTimestamp = msg.created_at;
-                    }
-                    catch (err) {
-                        this.emit("error", err);
-                        break;
-                    }
-                }
-                if (messages.length > 0) {
-                    await this._persistState();
-                }
-                // Adaptive rate: faster when active, slower when idle
-                const newInterval = foundMessages
-                    ? SecureChannel.POLL_FALLBACK_INTERVAL_MS
-                    : SecureChannel.POLL_FALLBACK_IDLE_MS;
-                if (newInterval !== interval) {
-                    interval = newInterval;
-                    // Restart timer with new interval
-                    if (this._pollFallbackTimer) {
-                        clearInterval(this._pollFallbackTimer);
-                        this._pollFallbackTimer = setInterval(poll, interval);
-                    }
-                }
-            }
-            catch {
-                // Network error — try again next tick
-            }
-        };
-        // Run first poll after a short delay, then on interval
-        setTimeout(poll, 1_000);
-        this._pollFallbackTimer = setInterval(poll, interval);
-    }
-    _stopPollFallback() {
-        if (this._pollFallbackTimer) {
-            clearInterval(this._pollFallbackTimer);
-            this._pollFallbackTimer = null;
-            console.log("[SecureChannel] Stopped HTTP poll fallback");
-        }
-    }
-    _handleError(err) {
-        this._setState("error");
-        this.emit("error", err);
-    }
-    /**
-     * Persist all ratchet session states to disk.
-     * Syncs live ratchet states back into the persisted sessions map.
-     */
-    async _persistState() {
-        if (!this._persisted)
-            return;
-        const hasOwnerSessions = this._sessions.size > 0;
-        const hasA2AChannels = !!this._persisted.a2aChannels && Object.keys(this._persisted.a2aChannels).length > 0;
-        if (!hasOwnerSessions && !hasA2AChannels)
-            return;
-        // Persist sticky room context for proactive send routing across restarts
-        this._persisted.lastInboundRoomId = this._lastInboundRoomId;
-        // Sync all live owner-agent ratchet states back to persisted
-        for (const [convId, session] of this._sessions) {
-            this._persisted.sessions[convId] = {
-                ownerDeviceId: session.ownerDeviceId,
-                ratchetState: session.ratchet.serialize(),
-                activated: session.activated,
-            };
-        }
-        await saveState(this.config.dataDir, this._persisted);
-        await backupState(this.config.dataDir);
-        this._scheduleServerBackup();
-    }
-    /**
-     * Debounced server backup upload (60s after last state change).
-     * Only runs when backupCode is configured.
-     */
-    _scheduleServerBackup() {
-        if (!this.config.backupCode || !this._persisted || !this._deviceJwt)
-            return;
-        if (this._serverBackupTimer)
-            clearTimeout(this._serverBackupTimer);
-        this._serverBackupTimer = setTimeout(async () => {
-            if (this._serverBackupRunning || !this._persisted || !this._deviceJwt)
-                return;
-            this._serverBackupRunning = true;
-            try {
-                await uploadBackupToServer(this._persisted, this.config.backupCode, this.config.apiUrl, this._deviceJwt);
-            }
-            catch (err) {
-                console.warn("[SecureChannel] Server backup upload failed:", err);
-            }
-            finally {
-                this._serverBackupRunning = false;
-            }
-        }, 60_000);
-    }
-}
-//# sourceMappingURL=channel.js.map