@agentvault/agentvault 0.9.5 → 0.9.7

package/dist/channel.js

@@ -0,0 +1,2257 @@
+import { EventEmitter } from "node:events";
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { writeFile, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { readFile } from "node:fs/promises";
+import sodium from "libsodium-wrappers-sumo";
+import WebSocket from "ws";
+import { generateIdentityKeypair, generateEphemeralKeypair, computeFingerprint, createProofOfPossession, performX3DH, DoubleRatchet, decryptFile, encryptFile, computeFileDigest, ScanEngine, } from "@agentvault/crypto";
+import { hexToBytes, bytesToHex, base64ToBytes, bytesToBase64, encryptedMessageToTransport, transportToEncryptedMessage, } from "./crypto-helpers.js";
+import { saveState, loadState, clearState } from "./state.js";
+import { enrollDevice, pollDeviceStatus, activateDevice, } from "./transport.js";
+const POLL_INTERVAL_MS = 6_000; // 6s — safely below the 1/5sec server-side rate limit
+const RECONNECT_BASE_MS = 1_000;
+const RECONNECT_MAX_MS = 30_000;
+const PENDING_POLL_INTERVAL_MS = 15_000;
+/**
+ * Migrates legacy single-session persisted state to the new
+ * multi-session format. If the state is already in the new format,
+ * returns it as-is.
+ */
+function migratePersistedState(raw) {
+    // New format: has `sessions` and `primaryConversationId`
+    if (raw.sessions && raw.primaryConversationId) {
+        return raw;
+    }
+    // Legacy format: single conversationId + ratchetState
+    const legacy = raw;
+    return {
+        deviceId: legacy.deviceId,
+        deviceJwt: legacy.deviceJwt,
+        primaryConversationId: legacy.conversationId,
+        sessions: {
+            [legacy.conversationId]: {
+                ownerDeviceId: "",
+                ratchetState: legacy.ratchetState,
+            },
+        },
+        identityKeypair: legacy.identityKeypair,
+        ephemeralKeypair: legacy.ephemeralKeypair,
+        fingerprint: legacy.fingerprint,
+        lastMessageTimestamp: legacy.lastMessageTimestamp,
+        messageHistory: [],
+    };
+}
+export class SecureChannel extends EventEmitter {
+    config;
+    _state = "idle";
+    _deviceId = null;
+    _fingerprint = null;
+    _primaryConversationId = "";
+    _deviceJwt = null;
+    _sessions = new Map();
+    _ws = null;
+    _pollTimer = null;
+    _reconnectAttempt = 0;
+    _reconnectTimer = null;
+    _pingTimer = null;
+    _lastServerMessage = 0;
+    _pendingAcks = [];
+    _ackTimer = null;
+    _stopped = false;
+    _persisted = null;
+    _httpServer = null;
+    _pollFallbackTimer = null;
+    _heartbeatTimer = null;
+    _heartbeatCallback = null;
+    _heartbeatIntervalSeconds = 0;
+    _wakeDetectorTimer = null;
+    _lastWakeTick = Date.now();
+    _pendingPollTimer = null;
+    _syncMessageIds = null;
+    /** Queued A2A messages for responder channels not yet activated (no first initiator message received). */
+    _a2aPendingQueue = {};
+    _scanEngine = null;
+    _scanRuleSetVersion = 0;
+    // Liveness detection: server sends app-level {"event":"ping"} every 30s.
+    // We check every 30s; if no data received in 90s (3 missed pings), connection is dead.
+    static PING_INTERVAL_MS = 30_000;
+    static SILENCE_TIMEOUT_MS = 90_000;
+    static POLL_FALLBACK_INTERVAL_MS = 30_000; // 30s when messages found
+    static POLL_FALLBACK_IDLE_MS = 60_000; // 60s when idle
+    constructor(config) {
+        super();
+        this.config = config;
+    }
+    get state() {
+        return this._state;
+    }
+    get deviceId() {
+        return this._deviceId;
+    }
+    get fingerprint() {
+        return this._fingerprint;
+    }
+    /** Returns the primary conversation ID (backward-compatible). */
+    get conversationId() {
+        return this._primaryConversationId || null;
+    }
+    /** Returns all active conversation IDs. */
+    get conversationIds() {
+        return Array.from(this._sessions.keys());
+    }
+    /** Returns the number of active sessions. */
+    get sessionCount() {
+        return this._sessions.size;
+    }
+    async start() {
+        this._stopped = false;
+        await sodium.ready;
+        // Check for persisted state (may be legacy or new format)
+        const raw = await loadState(this.config.dataDir);
+        if (raw) {
+            this._persisted = migratePersistedState(raw);
+            if (!this._persisted.messageHistory) {
+                this._persisted.messageHistory = [];
+            }
+            this._deviceId = this._persisted.deviceId;
+            this._deviceJwt = this._persisted.deviceJwt;
+            this._primaryConversationId = this._persisted.primaryConversationId;
+            this._fingerprint = this._persisted.fingerprint;
+            // Restore all ratchet sessions
+            for (const [convId, sessionData] of Object.entries(this._persisted.sessions)) {
+                if (sessionData.ratchetState) {
+                    const ratchet = DoubleRatchet.deserialize(sessionData.ratchetState);
+                    this._sessions.set(convId, {
+                        ownerDeviceId: sessionData.ownerDeviceId,
+                        ratchet,
+                        activated: sessionData.activated ?? false,
+                    });
+                }
+            }
+            this._connect();
+            return;
+        }
+        // Full lifecycle: enroll -> poll -> activate -> connect
+        await this._enroll();
+    }
+    /**
+     * Fetch scan rules from the server and load them into the ScanEngine.
+     */
+    async _fetchScanRules() {
+        if (!this._scanEngine)
+            return;
+        try {
+            const resp = await fetch(`${this.config.apiUrl}/api/v1/scan-rules`, {
+                headers: { Authorization: `Bearer ${this._persisted?.deviceJwt}` },
+            });
+            if (!resp.ok)
+                return;
+            const data = await resp.json();
+            if (data.rule_set_version !== this._scanRuleSetVersion) {
+                this._scanEngine.loadRules(data.rules);
+                this._scanRuleSetVersion = data.rule_set_version;
+            }
+        }
+        catch (err) {
+            console.error("[SecureChannel] Failed to fetch scan rules:", err);
+        }
+    }
+    /**
+     * Append a message to persistent history for cross-device replay.
+     */
+    _appendHistory(sender, text, topicId) {
+        if (!this._persisted)
+            return;
+        if (!this._persisted.messageHistory) {
+            this._persisted.messageHistory = [];
+        }
+        const maxSize = this.config.maxHistorySize ?? 500;
+        const entry = {
+            sender,
+            text,
+            ts: new Date().toISOString(),
+        };
+        if (topicId) {
+            entry.topicId = topicId;
+        }
+        this._persisted.messageHistory.push(entry);
+        // Evict oldest entries if over limit
+        if (this._persisted.messageHistory.length > maxSize) {
+            this._persisted.messageHistory = this._persisted.messageHistory.slice(-maxSize);
+        }
+    }
+    /**
+     * Encrypt and send a message to ALL owner devices (fanout).
+     * Each session gets the same plaintext encrypted independently.
+     */
+    async send(plaintext, options) {
+        // Permanent failures — still throw
+        if (this._state === "error" || this._state === "idle") {
+            throw new Error("Channel is not ready");
+        }
+        if (this._sessions.size === 0) {
+            throw new Error("No active sessions");
+        }
+        const topicId = options?.topicId ?? this._persisted?.defaultTopicId;
+        const messageType = options?.messageType ?? "text";
+        const priority = options?.priority ?? "normal";
+        const parentSpanId = options?.parentSpanId;
+        const envelopeMetadata = options?.metadata;
+        // Outbound scan — before encryption
+        let scanStatus;
+        if (this._scanEngine) {
+            const scanResult = this._scanEngine.scanOutbound(plaintext);
+            if (scanResult.status === "blocked") {
+                this.emit("scan_blocked", { direction: "outbound", violations: scanResult.violations });
+                throw new Error(`Message blocked by scan rule: ${scanResult.violations[0]?.rule_name}`);
+            }
+            scanStatus = scanResult.status; // "clean" or "flagged"
+        }
+        // Store agent message in history for cross-device replay
+        this._appendHistory("agent", plaintext, topicId);
+        const messageGroupId = randomUUID();
+        for (const [convId, session] of this._sessions) {
+            if (!session.activated)
+                continue;
+            const encrypted = session.ratchet.encrypt(plaintext);
+            const transport = encryptedMessageToTransport(encrypted);
+            const msg = {
+                convId,
+                headerBlob: transport.header_blob,
+                ciphertext: transport.ciphertext,
+                messageGroupId,
+                topicId,
+            };
+            if (this._state === "ready" && this._ws) {
+                // Send immediately
+                const payload = {
+                    conversation_id: msg.convId,
+                    header_blob: msg.headerBlob,
+                    ciphertext: msg.ciphertext,
+                    message_group_id: msg.messageGroupId,
+                    topic_id: msg.topicId,
+                    message_type: messageType,
+                    priority: priority,
+                    parent_span_id: parentSpanId,
+                    metadata: scanStatus
+                        ? { ...(envelopeMetadata ?? {}), scan_status: scanStatus }
+                        : envelopeMetadata,
+                };
+                if (this._persisted?.hubAddress) {
+                    payload.hub_address = this._persisted.hubAddress;
+                }
+                this._ws.send(JSON.stringify({
+                    event: "message",
+                    data: payload,
+                }));
+            }
+            else {
+                // Queue for later
+                if (!this._persisted.outboundQueue) {
+                    this._persisted.outboundQueue = [];
+                }
+                if (this._persisted.outboundQueue.length >= 50) {
+                    this._persisted.outboundQueue.shift(); // Drop oldest
+                    console.warn("[SecureChannel] Outbound queue full, dropping oldest message");
+                }
+                this._persisted.outboundQueue.push(msg);
+                console.log(`[SecureChannel] Message queued (state=${this._state}, queue=${this._persisted.outboundQueue.length})`);
+            }
+        }
+        // Persist all ratchet states after encrypt
+        await this._persistState();
+    }
+    /**
+     * Send a typing indicator to all owner devices.
+     * Ephemeral (unencrypted metadata), no ratchet advancement.
+     */
+    sendTyping() {
+        if (!this._ws || this._ws.readyState !== WebSocket.OPEN)
+            return;
+        for (const convId of this._sessions.keys()) {
+            this._ws.send(JSON.stringify({
+                event: "typing",
+                data: { conversation_id: convId },
+            }));
+        }
+    }
+    /**
+     * Send a decision request to the owner.
+     * Builds a structured envelope with decision metadata and sends it
+     * as a high-priority message. Returns the generated decision_id.
+     */
+    async sendDecisionRequest(request) {
+        const decision_id = `dec_${randomUUID().replace(/-/g, "").slice(0, 16)}`;
+        const payload = JSON.stringify({
+            type: "message",
+            text: `\u{1F4CB} ${request.title}`,
+            decision: {
+                decision_id,
+                ...request,
+            },
+        });
+        await this.send(payload, {
+            messageType: "decision_request",
+            priority: "high",
+            metadata: {
+                decision_id,
+                title: request.title,
+                description: request.description,
+                options: request.options,
+                context_refs: request.context_refs,
+                deadline: request.deadline,
+                auto_action: request.auto_action,
+            },
+        });
+        return decision_id;
+    }
+    /**
+     * Wait for a decision response matching the given decisionId.
+     * Listens on the "message" event for messages where
+     * metadata.messageType === "decision_response" and the parsed plaintext
+     * contains a matching decision.decision_id.
+     * Optional timeout rejects with an Error.
+     */
+    waitForDecision(decisionId, timeoutMs) {
+        return new Promise((resolve, reject) => {
+            let timer = null;
+            const handler = (plaintext, metadata) => {
+                if (metadata.messageType !== "decision_response")
+                    return;
+                try {
+                    const parsed = JSON.parse(plaintext);
+                    if (parsed.decision?.decision_id === decisionId) {
+                        if (timer)
+                            clearTimeout(timer);
+                        this.removeListener("message", handler);
+                        resolve({
+                            decision_id: parsed.decision.decision_id,
+                            selected_option_id: parsed.decision.selected_option_id,
+                            resolved_at: parsed.decision.resolved_at,
+                            action: parsed.decision.action,
+                            defer_until: parsed.decision.defer_until,
+                            defer_reason: parsed.decision.defer_reason,
+                        });
+                    }
+                }
+                catch {
+                    // Not valid JSON, ignore
+                }
+            };
+            this.on("message", handler);
+            if (timeoutMs !== undefined) {
+                timer = setTimeout(() => {
+                    this.removeListener("message", handler);
+                    reject(new Error(`Decision ${decisionId} timed out after ${timeoutMs}ms`));
+                }, timeoutMs);
+            }
+        });
+    }
+    // --- Multi-agent room methods ---
+    /**
+     * Join a room by performing X3DH key exchange with each member
+     * for the pairwise conversations involving this device.
+     */
+    async joinRoom(roomData) {
+        if (!this._persisted) {
+            throw new Error("Channel not initialized");
+        }
+        await sodium.ready;
+        const identity = this._persisted.identityKeypair;
+        const ephemeral = this._persisted.ephemeralKeypair;
+        const myDeviceId = this._deviceId;
+        const conversationIds = [];
+        for (const conv of roomData.conversations) {
+            // Only process conversations involving this device
+            if (conv.participantA !== myDeviceId && conv.participantB !== myDeviceId) {
+                continue;
+            }
+            const otherDeviceId = conv.participantA === myDeviceId ? conv.participantB : conv.participantA;
+            const otherMember = roomData.members.find((m) => m.deviceId === otherDeviceId);
+            if (!otherMember?.identityPublicKey) {
+                console.warn(`[SecureChannel] No public key for member ${otherDeviceId.slice(0, 8)}..., skipping`);
+                continue;
+            }
+            // Determine initiator: lexicographically smaller deviceId is the sender (initiator)
+            const isInitiator = myDeviceId < otherDeviceId;
+            const sharedSecret = performX3DH({
+                myIdentityPrivate: hexToBytes(identity.privateKey),
+                myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
+                theirIdentityPublic: hexToBytes(otherMember.identityPublicKey),
+                theirEphemeralPublic: hexToBytes(otherMember.ephemeralPublicKey ?? otherMember.identityPublicKey),
+                isInitiator,
+            });
+            const ratchet = isInitiator
+                ? DoubleRatchet.initSender(sharedSecret, {
+                    publicKey: hexToBytes(identity.publicKey),
+                    privateKey: hexToBytes(identity.privateKey),
+                    keyType: "ed25519",
+                })
+                : DoubleRatchet.initReceiver(sharedSecret, {
+                    publicKey: hexToBytes(identity.publicKey),
+                    privateKey: hexToBytes(identity.privateKey),
+                    keyType: "ed25519",
+                });
+            this._sessions.set(conv.id, {
+                ownerDeviceId: otherDeviceId,
+                ratchet,
+                activated: isInitiator, // initiator can send immediately
+            });
+            // Persist session
+            this._persisted.sessions[conv.id] = {
+                ownerDeviceId: otherDeviceId,
+                ratchetState: ratchet.serialize(),
+                activated: isInitiator,
+            };
+            conversationIds.push(conv.id);
+            console.log(`[SecureChannel] Room session initialized: conv ${conv.id.slice(0, 8)}... ` +
+                `with ${otherDeviceId.slice(0, 8)}... (initiator=${isInitiator})`);
+        }
+        // Store room state
+        if (!this._persisted.rooms) {
+            this._persisted.rooms = {};
+        }
+        this._persisted.rooms[roomData.roomId] = {
+            roomId: roomData.roomId,
+            name: roomData.name,
+            conversationIds,
+            members: roomData.members,
+        };
+        await this._persistState();
+        this.emit("room_joined", { roomId: roomData.roomId, name: roomData.name });
+    }
+    /**
+     * Send an encrypted message to all members of a room.
+     * Each pairwise conversation gets the plaintext encrypted independently.
+     */
+    async sendToRoom(roomId, plaintext, opts) {
+        if (!this._persisted?.rooms?.[roomId]) {
+            throw new Error(`Room ${roomId} not found`);
+        }
+        const room = this._persisted.rooms[roomId];
+        const messageType = opts?.messageType ?? "text";
+        const recipients = [];
+        for (const convId of room.conversationIds) {
+            const session = this._sessions.get(convId);
+            if (!session) {
+                console.warn(`[SecureChannel] No session for room conv ${convId.slice(0, 8)}..., skipping`);
+                continue;
+            }
+            const encrypted = session.ratchet.encrypt(plaintext);
+            const transport = encryptedMessageToTransport(encrypted);
+            recipients.push({
+                device_id: session.ownerDeviceId,
+                header_blob: transport.header_blob,
+                ciphertext: transport.ciphertext,
+            });
+        }
+        if (recipients.length === 0) {
+            throw new Error("No active sessions in room");
+        }
+        if (this._state === "ready" && this._ws) {
+            this._ws.send(JSON.stringify({
+                event: "room_message",
+                room_id: roomId,
+                recipients,
+                message_type: messageType,
+            }));
+        }
+        else {
+            // HTTP fallback
+            try {
+                const res = await fetch(`${this.config.apiUrl}/api/v1/rooms/${roomId}/messages`, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Authorization: `Bearer ${this._deviceJwt}`,
+                    },
+                    body: JSON.stringify({ recipients, message_type: messageType }),
+                });
+                if (!res.ok) {
+                    const detail = await res.text();
+                    throw new Error(`Room message failed (${res.status}): ${detail}`);
+                }
+            }
+            catch (err) {
+                throw new Error(`Failed to send room message: ${err}`);
+            }
+        }
+        await this._persistState();
+    }
+    /**
+     * Leave a room: remove sessions and persisted room state.
+     */
+    async leaveRoom(roomId) {
+        if (!this._persisted?.rooms?.[roomId]) {
+            return; // Already left or never joined
+        }
+        const room = this._persisted.rooms[roomId];
+        // Remove sessions for this room's conversations
+        for (const convId of room.conversationIds) {
+            this._sessions.delete(convId);
+            delete this._persisted.sessions[convId];
+        }
+        // Remove room state
+        delete this._persisted.rooms[roomId];
+        await this._persistState();
+        this.emit("room_left", { roomId });
+    }
+    /**
+     * Return info for all joined rooms.
+     */
+    getRooms() {
+        if (!this._persisted?.rooms)
+            return [];
+        return Object.values(this._persisted.rooms).map((rs) => ({
+            roomId: rs.roomId,
+            name: rs.name,
+            members: rs.members,
+            conversationIds: rs.conversationIds,
+        }));
+    }
+    // --- Heartbeat and status methods ---
+    startHeartbeat(intervalSeconds, statusCallback) {
+        this.stopHeartbeat();
+        this._heartbeatCallback = statusCallback;
+        this._heartbeatIntervalSeconds = intervalSeconds;
+        this._sendHeartbeat();
+        this._heartbeatTimer = setInterval(() => {
+            this._sendHeartbeat();
+        }, intervalSeconds * 1000);
+    }
+    async stopHeartbeat() {
+        if (this._heartbeatTimer) {
+            clearInterval(this._heartbeatTimer);
+            this._heartbeatTimer = null;
+        }
+        if (this._heartbeatCallback && this._state === "ready") {
+            try {
+                await this.send(JSON.stringify({
+                    agent_status: "shutting_down",
+                    current_task: "",
+                    timestamp: new Date().toISOString(),
+                }), {
+                    messageType: "heartbeat",
+                    metadata: { next_heartbeat_seconds: this._heartbeatIntervalSeconds },
+                });
+            }
+            catch { /* best-effort shutdown heartbeat */ }
+        }
+        this._heartbeatCallback = null;
+    }
+    async sendStatusAlert(alert) {
+        const priority = alert.severity === "error" || alert.severity === "critical"
+            ? "high" : "normal";
+        const envelope = {
+            title: alert.title,
+            message: alert.message,
+            severity: alert.severity,
+            timestamp: new Date().toISOString(),
+        };
+        if (alert.detail !== undefined)
+            envelope.detail = alert.detail;
+        if (alert.detailFormat !== undefined)
+            envelope.detail_format = alert.detailFormat;
+        if (alert.category !== undefined)
+            envelope.category = alert.category;
+        await this.send(JSON.stringify(envelope), {
+            messageType: "status_alert",
+            priority,
+            metadata: { severity: alert.severity },
+        });
+    }
+    async sendArtifact(artifact) {
+        if (this._state !== "ready" || this._sessions.size === 0 || !this._ws) {
+            throw new Error("Channel is not ready");
+        }
+        // Upload encrypted file via existing attachment infrastructure
+        const attachMeta = await this._uploadAttachment(artifact.filePath, this._primaryConversationId);
+        // Build artifact_share envelope
+        const envelope = JSON.stringify({
+            type: "artifact",
+            blob_id: attachMeta.blobId,
+            blob_url: attachMeta.blobUrl,
+            filename: artifact.filename,
+            mime_type: artifact.mimeType,
+            size_bytes: attachMeta.size,
+            description: artifact.description,
+            attachment: attachMeta,
+        });
+        const messageGroupId = randomUUID();
+        for (const [convId, session] of this._sessions) {
+            if (!session.activated)
+                continue;
+            const encrypted = session.ratchet.encrypt(envelope);
+            const transport = encryptedMessageToTransport(encrypted);
+            this._ws.send(JSON.stringify({
+                event: "message",
+                data: {
+                    conversation_id: convId,
+                    header_blob: transport.header_blob,
+                    ciphertext: transport.ciphertext,
+                    message_group_id: messageGroupId,
+                    message_type: "artifact_share",
+                },
+            }));
+        }
+        await this._persistState();
+    }
+    async sendActionConfirmation(confirmation) {
+        const envelope = {
+            type: "action_confirmation",
+            action: confirmation.action,
+            status: confirmation.status,
+        };
+        if (confirmation.decisionId !== undefined)
+            envelope.decision_id = confirmation.decisionId;
+        if (confirmation.detail !== undefined)
+            envelope.detail = confirmation.detail;
+        await this.send(JSON.stringify(envelope), {
+            messageType: "action_confirmation",
+            metadata: { status: confirmation.status },
+        });
+    }
+    _sendHeartbeat() {
+        if (this._state !== "ready" || !this._heartbeatCallback)
+            return;
+        const status = this._heartbeatCallback();
+        this.send(JSON.stringify({
+            agent_status: status.agent_status,
+            current_task: status.current_task,
+            timestamp: new Date().toISOString(),
+        }), {
+            messageType: "heartbeat",
+            metadata: { next_heartbeat_seconds: this._heartbeatIntervalSeconds },
+        }).catch((err) => {
+            this.emit("error", new Error(`Heartbeat send failed: ${err}`));
+        });
+    }
+    async stop() {
+        this._stopped = true;
+        await this.stopHeartbeat();
+        this._flushAcks(); // Send any pending ACKs before stopping
+        this._stopPing();
+        this._stopWakeDetector();
+        this._stopPendingPoll();
+        this._stopPollFallback();
+        this._stopHttpServer();
+        if (this._ackTimer) {
+            clearTimeout(this._ackTimer);
+            this._ackTimer = null;
+        }
+        if (this._pollTimer) {
+            clearTimeout(this._pollTimer);
+            this._pollTimer = null;
+        }
+        if (this._reconnectTimer) {
+            clearTimeout(this._reconnectTimer);
+            this._reconnectTimer = null;
+        }
+        if (this._ws) {
+            this._ws.removeAllListeners();
+            this._ws.close();
+            this._ws = null;
+        }
+        this._setState("disconnected");
+    }
+    // --- Local HTTP server for proactive sends ---
+    startHttpServer(port) {
+        if (this._httpServer)
+            return;
+        this._httpServer = createServer(async (req, res) => {
+            // Only accept local connections
+            const remote = req.socket.remoteAddress;
+            if (remote !== "127.0.0.1" && remote !== "::1" && remote !== "::ffff:127.0.0.1") {
+                res.writeHead(403, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: false, error: "Forbidden" }));
+                return;
+            }
+            if (req.method === "POST" && req.url === "/send") {
+                let body = "";
+                req.on("data", (chunk) => { body += chunk.toString(); });
+                req.on("end", async () => {
+                    try {
+                        const parsed = JSON.parse(body);
+                        const text = parsed.text;
+                        if (!text || typeof text !== "string") {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({ ok: false, error: "Missing 'text' field" }));
+                            return;
+                        }
+                        // Optional file attachment
+                        if (parsed.file_path && typeof parsed.file_path === "string") {
+                            await this.sendWithAttachment(text, parsed.file_path, { topicId: parsed.topicId });
+                        }
+                        else {
+                            await this.send(text, { topicId: parsed.topicId });
+                        }
+                        res.writeHead(200, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ ok: true }));
+                    }
+                    catch (err) {
+                        res.writeHead(500, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ ok: false, error: String(err) }));
+                    }
+                });
+            }
+            else if (req.method === "GET" && req.url === "/status") {
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({
+                    ok: true,
+                    state: this._state,
+                    deviceId: this._deviceId,
+                    sessions: this._sessions.size,
+                }));
+            }
+            else {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: false, error: "Not found. Use POST /send or GET /status" }));
+            }
+        });
+        this._httpServer.listen(port, "127.0.0.1", () => {
+            this.emit("http-ready", port);
+        });
+    }
+    _stopHttpServer() {
+        if (this._httpServer) {
+            this._httpServer.close();
+            this._httpServer = null;
+        }
+    }
+    // --- Topic management ---
+    /**
+     * Create a new topic within the conversation group.
+     * Requires the channel to be initialized with a groupId (from activation).
+     */
+    async createTopic(name) {
+        if (!this._persisted?.groupId) {
+            throw new Error("Channel not initialized or groupId unknown");
+        }
+        if (!this._deviceJwt) {
+            throw new Error("Channel not authenticated");
+        }
+        const res = await fetch(`${this.config.apiUrl}/api/v1/topics`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${this._deviceJwt}`,
+            },
+            body: JSON.stringify({
+                group_id: this._persisted.groupId,
+                name,
+                creator_device_id: this._persisted.deviceId,
+            }),
+        });
+        if (!res.ok) {
+            const detail = await res.text();
+            throw new Error(`Create topic failed (${res.status}): ${detail}`);
+        }
+        const resp = await res.json();
+        const topic = { id: resp.id, name: resp.name, isDefault: resp.is_default };
+        if (!this._persisted.topics) {
+            this._persisted.topics = [];
+        }
+        this._persisted.topics.push(topic);
+        await this._persistState();
+        return topic;
+    }
+    /**
+     * List all topics in the conversation group.
+     * Requires the channel to be initialized with a groupId (from activation).
+     */
+    async listTopics() {
+        if (!this._persisted?.groupId) {
+            throw new Error("Channel not initialized or groupId unknown");
+        }
+        if (!this._deviceJwt) {
+            throw new Error("Channel not authenticated");
+        }
+        const res = await fetch(`${this.config.apiUrl}/api/v1/topics?group_id=${encodeURIComponent(this._persisted.groupId)}`, {
+            headers: {
+                Authorization: `Bearer ${this._deviceJwt}`,
+            },
+        });
+        if (!res.ok) {
+            const detail = await res.text();
+            throw new Error(`List topics failed (${res.status}): ${detail}`);
+        }
+        const resp = await res.json();
+        const topics = resp.map((t) => ({ id: t.id, name: t.name, isDefault: t.is_default }));
+        this._persisted.topics = topics;
+        await this._persistState();
+        return topics;
+    }
+    // --- A2A Channel methods (agent-to-agent communication) ---
+    /**
+     * Request a new A2A channel with another agent by their hub address.
+     * Returns the channel_id from the server response.
+     */
+    async requestA2AChannel(responderHubAddress) {
+        if (!this._persisted?.hubAddress) {
+            throw new Error("This agent does not have a hub address assigned");
+        }
+        if (!this._deviceJwt) {
+            throw new Error("Channel not authenticated");
+        }
+        const res = await fetch(`${this.config.apiUrl}/api/v1/a2a/channels/request`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${this._deviceJwt}`,
+            },
+            body: JSON.stringify({
+                initiator_hub_address: this._persisted.hubAddress,
+                responder_hub_address: responderHubAddress,
+            }),
+        });
+        if (!res.ok) {
+            const detail = await res.text();
+            throw new Error(`A2A channel request failed (${res.status}): ${detail}`);
+        }
+        const resp = await res.json();
+        const channelId = resp.channel_id || resp.id;
+        // Store channel info in persisted state
+        if (!this._persisted.a2aChannels) {
+            this._persisted.a2aChannels = {};
+        }
+        this._persisted.a2aChannels[channelId] = {
+            channelId,
+            hubAddress: responderHubAddress,
+            conversationId: resp.conversation_id || "",
+        };
+        await this._persistState();
+        return channelId;
+    }
+    /**
+     * Send a message to another agent via an active A2A channel.
+     * Looks up the A2A conversation by hub address and sends via WS.
+     *
+     * If the channel has an established E2E session, the message is encrypted
+     * with the Double Ratchet. If the responder hasn't received the initiator's
+     * first message yet (ratchet not activated), the message is queued locally
+     * and flushed when the first inbound message arrives.
+     *
+     * Falls back to plaintext for channels without a session (legacy/pre-encryption).
+     */
+    async sendToAgent(hubAddress, text, opts) {
+        if (!this._persisted?.a2aChannels) {
+            throw new Error("No A2A channels established");
+        }
+        // Find the active channel for this hub address
+        const channelEntry = Object.values(this._persisted.a2aChannels).find((ch) => ch.hubAddress === hubAddress);
+        if (!channelEntry) {
+            throw new Error(`No A2A channel found for hub address: ${hubAddress}`);
+        }
+        if (!channelEntry.conversationId) {
+            throw new Error(`A2A channel ${channelEntry.channelId} does not have a conversation yet (not activated)`);
+        }
+        if (this._state !== "ready" || !this._ws) {
+            throw new Error("Channel is not connected");
+        }
+        // --- E2E encrypted path ---
+        if (channelEntry.session?.ratchetState) {
+            // Responder must wait for first initiator message before sending
+            if (channelEntry.role === "responder" && !channelEntry.session.activated) {
+                if (!this._a2aPendingQueue[channelEntry.channelId]) {
+                    this._a2aPendingQueue[channelEntry.channelId] = [];
+                }
+                this._a2aPendingQueue[channelEntry.channelId].push({ text, opts });
+                console.log(`[SecureChannel] A2A message queued (responder not yet activated, ` +
+                    `queue=${this._a2aPendingQueue[channelEntry.channelId].length})`);
+                return;
+            }
+            // Deserialize ratchet, encrypt, update state
+            const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
+            const encrypted = ratchet.encrypt(text);
+            // Serialize header for transport (hex-encoded JSON)
+            const headerObj = {
+                dhPublicKey: bytesToHex(encrypted.header.dhPublicKey),
+                previousChainLength: encrypted.header.previousChainLength,
+                messageNumber: encrypted.header.messageNumber,
+            };
+            const headerBlobHex = Buffer.from(JSON.stringify(headerObj)).toString("hex");
+            const payload = {
+                channel_id: channelEntry.channelId,
+                conversation_id: channelEntry.conversationId,
+                header_blob: headerBlobHex,
+                header_signature: bytesToHex(encrypted.headerSignature),
+                ciphertext: bytesToHex(encrypted.ciphertext),
+                nonce: bytesToHex(encrypted.nonce),
+                parent_span_id: opts?.parentSpanId,
+            };
+            if (this._persisted.hubAddress) {
+                payload.hub_address = this._persisted.hubAddress;
+            }
+            // Update persisted ratchet state
+            channelEntry.session.ratchetState = ratchet.serialize();
+            await this._persistState();
+            this._ws.send(JSON.stringify({
+                event: "a2a_message",
+                data: payload,
+            }));
+            return;
+        }
+        // --- Legacy plaintext fallback (no session) ---
+        const payload = {
+            conversation_id: channelEntry.conversationId,
+            plaintext: text,
+            message_type: "a2a",
+            parent_span_id: opts?.parentSpanId,
+        };
+        if (this._persisted.hubAddress) {
+            payload.hub_address = this._persisted.hubAddress;
+        }
+        this._ws.send(JSON.stringify({
+            event: "a2a_message",
+            data: payload,
+        }));
+    }
+    /**
+     * List all A2A channels for this agent.
+     * Fetches from the server and updates local persisted state.
+     */
+    async listA2AChannels() {
+        if (!this._deviceJwt) {
+            throw new Error("Channel not authenticated");
+        }
+        const res = await fetch(`${this.config.apiUrl}/api/v1/a2a/channels`, {
+            headers: {
+                Authorization: `Bearer ${this._deviceJwt}`,
+            },
+        });
+        if (!res.ok) {
+            const detail = await res.text();
+            throw new Error(`List A2A channels failed (${res.status}): ${detail}`);
+        }
+        const resp = await res.json();
+        const channels = resp.map((ch) => ({
+            channelId: ch.channel_id || ch.id,
+            initiatorHubAddress: ch.initiator_hub_address,
+            responderHubAddress: ch.responder_hub_address,
+            conversationId: ch.conversation_id,
+            status: ch.status,
+            createdAt: ch.created_at,
+        }));
+        // Update persisted a2aChannels map with latest server data
+        if (this._persisted) {
+            if (!this._persisted.a2aChannels) {
+                this._persisted.a2aChannels = {};
+            }
+            for (const ch of channels) {
+                if (ch.status === "active" || ch.status === "approved") {
+                    const otherAddress = ch.initiatorHubAddress === this._persisted.hubAddress
+                        ? ch.responderHubAddress
+                        : ch.initiatorHubAddress;
+                    this._persisted.a2aChannels[ch.channelId] = {
+                        channelId: ch.channelId,
+                        hubAddress: otherAddress,
+                        conversationId: ch.conversationId || "",
+                    };
+                }
+            }
+            await this._persistState();
+        }
+        return channels;
+    }
+    // --- Internal lifecycle ---
+    async _enroll() {
+        this._setState("enrolling");
+        try {
+            const identity = await generateIdentityKeypair();
+            const ephemeral = await generateEphemeralKeypair();
+            const fingerprint = computeFingerprint(identity.publicKey);
+            const proof = createProofOfPossession(identity.privateKey, identity.publicKey);
+            const result = await enrollDevice(this.config.apiUrl, this.config.inviteToken, bytesToHex(identity.publicKey), bytesToHex(ephemeral.publicKey), bytesToHex(proof), this.config.platform);
+            this._deviceId = result.device_id;
+            this._fingerprint = result.fingerprint;
+            // Store keypairs temporarily for activation (not persisted yet -- no JWT)
+            this._persisted = {
+                deviceId: result.device_id,
+                deviceJwt: "", // set after activation
+                primaryConversationId: "", // set after activation
+                sessions: {}, // populated after activation
+                identityKeypair: {
+                    publicKey: bytesToHex(identity.publicKey),
+                    privateKey: bytesToHex(identity.privateKey),
+                },
+                ephemeralKeypair: {
+                    publicKey: bytesToHex(ephemeral.publicKey),
+                    privateKey: bytesToHex(ephemeral.privateKey),
+                },
+                fingerprint: result.fingerprint,
+                messageHistory: [],
+            };
+            this._poll();
+        }
+        catch (err) {
+            this._handleError(err);
+        }
+    }
+    _poll() {
+        if (this._stopped)
+            return;
+        this._setState("polling");
+        const doPoll = async () => {
+            if (this._stopped)
+                return;
+            try {
+                const status = await pollDeviceStatus(this.config.apiUrl, this._deviceId);
+                if (status.rateLimited) {
+                    // Server rate-limited this poll — back off 2x before retrying
+                    this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS * 2);
+                    return;
+                }
+                if (status.status === "APPROVED") {
+                    await this._activate();
+                    return;
+                }
+                if (status.status === "REVOKED") {
+                    this._handleError(new Error("Device was revoked"));
+                    return;
+                }
+                // Still PENDING -- poll again
+                this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS);
+            }
+            catch (err) {
+                this._handleError(err);
+            }
+        };
+        this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS);
+    }
+    async _activate() {
+        this._setState("activating");
+        try {
+            const result = await activateDevice(this.config.apiUrl, this._deviceId);
+            // Support both old (single conversation_id) and new (conversations array) response
+            const conversations = result.conversations || [
+                {
+                    conversation_id: result.conversation_id,
+                    owner_device_id: "",
+                    is_primary: true,
+                },
+            ];
+            const primary = conversations.find((c) => c.is_primary) || conversations[0];
+            this._primaryConversationId = primary.conversation_id;
+            this._deviceJwt = result.device_jwt;
+            const identity = this._persisted.identityKeypair;
+            const ephemeral = this._persisted.ephemeralKeypair;
+            const sessions = {};
+            // Initialize X3DH + ratchet for EVERY conversation (not just primary)
+            for (const conv of conversations) {
+                // Use per-conversation owner keys if available, fallback to primary keys
+                const ownerIdentityKey = conv.owner_identity_public_key || result.owner_identity_public_key;
+                const ownerEphemeralKey = conv.owner_ephemeral_public_key ||
+                    result.owner_ephemeral_public_key ||
+                    ownerIdentityKey;
+                const sharedSecret = performX3DH({
+                    myIdentityPrivate: hexToBytes(identity.privateKey),
+                    myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
+                    theirIdentityPublic: hexToBytes(ownerIdentityKey),
+                    theirEphemeralPublic: hexToBytes(ownerEphemeralKey),
+                    isInitiator: false,
+                });
+                const ratchet = DoubleRatchet.initReceiver(sharedSecret, {
+                    publicKey: hexToBytes(identity.publicKey),
+                    privateKey: hexToBytes(identity.privateKey),
+                    keyType: "ed25519",
+                });
+                this._sessions.set(conv.conversation_id, {
+                    ownerDeviceId: conv.owner_device_id,
+                    ratchet,
+                    activated: false, // Wait for owner's first message before sending to this session
+                });
+                sessions[conv.conversation_id] = {
+                    ownerDeviceId: conv.owner_device_id,
+                    ratchetState: ratchet.serialize(),
+                };
+                console.log(`[SecureChannel] Session initialized for conv ${conv.conversation_id.slice(0, 8)}... (owner ${conv.owner_device_id.slice(0, 8)}..., primary=${conv.is_primary})`);
+            }
+            // Persist full state (preserve existing messageHistory)
+            this._persisted = {
+                ...this._persisted,
+                deviceJwt: result.device_jwt,
+                primaryConversationId: primary.conversation_id,
+                sessions,
+                messageHistory: this._persisted.messageHistory ?? [],
+            };
+            // Store group_id and default_topic_id for topic API calls
+            if (conversations.length > 0) {
+                const firstConv = conversations[0];
+                if (firstConv.group_id) {
+                    this._persisted.groupId = firstConv.group_id;
+                }
+                if (firstConv.default_topic_id) {
+                    this._persisted.defaultTopicId = firstConv.default_topic_id;
+                }
+            }
+            await saveState(this.config.dataDir, this._persisted);
+            // Register webhook if configured
+            if (this.config.webhookUrl) {
+                try {
+                    const webhookResp = await fetch(`${this.config.apiUrl}/api/v1/devices/self/webhook`, {
+                        method: "PATCH",
+                        headers: {
+                            "Content-Type": "application/json",
+                            Authorization: `Bearer ${this._deviceJwt}`,
+                        },
+                        body: JSON.stringify({ webhook_url: this.config.webhookUrl }),
+                    });
+                    if (webhookResp.ok) {
+                        const webhookData = await webhookResp.json();
+                        console.log(`[SecureChannel] Webhook registered: ${this.config.webhookUrl} (secret: ${webhookData.webhook_secret?.slice(0, 8)}...)`);
+                        this.emit("webhook_registered", {
+                            url: this.config.webhookUrl,
+                            secret: webhookData.webhook_secret,
+                        });
+                    }
+                    else {
+                        console.warn(`[SecureChannel] Webhook registration failed: ${webhookResp.status}`);
+                    }
+                }
+                catch (err) {
+                    console.warn(`[SecureChannel] Webhook registration error: ${err}`);
+                }
+            }
+            this._connect();
+        }
+        catch (err) {
+            this._handleError(err);
+        }
+    }
+    _connect() {
+        if (this._stopped)
+            return;
+        // Clear reconnect timer — we're connecting now, so any pending reconnect is superseded.
+        if (this._reconnectTimer) {
+            clearTimeout(this._reconnectTimer);
+            this._reconnectTimer = null;
+        }
+        // Clean up existing WebSocket to prevent reconnect cascade:
+        // The server disconnects old WS when same device reconnects, which fires
+        // the old close handler → _scheduleReconnect() → new _connect() → cascade.
+        if (this._ws) {
+            this._ws.removeAllListeners();
+            try {
+                this._ws.close();
+            }
+            catch { /* already closed */ }
+            this._ws = null;
+        }
+        this._setState("connecting");
+        const wsUrl = this.config.apiUrl.replace(/^http/, "ws");
+        const url = `${wsUrl}/api/v1/ws?token=${encodeURIComponent(this._deviceJwt)}&device_id=${this._deviceId}`;
+        const ws = new WebSocket(url);
+        this._ws = ws;
+        ws.on("open", async () => {
+            this._reconnectAttempt = 0;
+            this._startPing(ws);
+            this._startWakeDetector();
+            this._startPendingPoll();
+            // Sync missed messages before declaring ready
+            await this._syncMissedMessages();
+            await this._flushOutboundQueue();
+            this._setState("ready");
+            // Initialize client-side policy scanning if enabled
+            if (this.config.enableScanning) {
+                this._scanEngine = new ScanEngine();
+                await this._fetchScanRules();
+            }
+            this.emit("ready");
+        });
+        ws.on("message", async (raw) => {
+            this._lastServerMessage = Date.now();
+            this._lastWakeTick = Date.now();
+            try {
+                const data = JSON.parse(raw.toString());
+                if (data.event === "ping") {
+                    ws.send(JSON.stringify({ event: "pong" }));
+                    return;
+                }
+                if (data.event === "device_revoked") {
+                    await clearState(this.config.dataDir);
+                    this._handleError(new Error("Device was revoked"));
+                    return;
+                }
+                if (data.event === "device_linked") {
+                    await this._handleDeviceLinked(data.data);
+                    return;
+                }
+                if (data.event === "message") {
+                    await this._handleIncomingMessage(data.data);
+                }
+                if (data.event === "room_joined") {
+                    const d = data.data;
+                    this.joinRoom({
+                        roomId: d.room_id,
+                        name: d.name,
+                        members: (d.members || []).map((m) => ({
+                            deviceId: m.device_id,
+                            entityType: m.entity_type,
+                            displayName: m.display_name,
+                            identityPublicKey: m.identity_public_key,
+                            ephemeralPublicKey: m.ephemeral_public_key,
+                        })),
+                        conversations: (d.conversations || []).map((c) => ({
+                            id: c.id,
+                            participantA: c.participant_a,
+                            participantB: c.participant_b,
+                        })),
+                    }).catch((err) => this.emit("error", err));
+                }
+                if (data.event === "room_message") {
+                    await this._handleRoomMessage(data.data);
+                }
+                if (data.event === "room_participant_added") {
+                    const p = data.data;
+                    this.emit("room_participant_added", {
+                        roomId: p.room_id,
+                        participant: {
+                            deviceId: p.participant?.device_id ?? p.device_id,
+                            participantType: p.participant?.participant_type ?? p.participant_type ?? "human",
+                            displayName: p.participant?.display_name ?? p.display_name,
+                        },
+                    });
+                }
+                if (data.event === "room_participant_removed") {
+                    const p = data.data;
+                    this.emit("room_participant_removed", {
+                        roomId: p.room_id,
+                        participant: {
+                            deviceId: p.participant?.device_id ?? p.device_id,
+                            participantType: p.participant?.participant_type ?? p.participant_type ?? "human",
+                            displayName: p.participant?.display_name ?? p.display_name,
+                        },
+                    });
+                }
+                if (data.event === "policy_blocked") {
+                    this.emit("policy_blocked", data.data);
+                }
+                if (data.event === "message_held") {
+                    this.emit("message_held", data.data);
+                }
+                if (data.event === "policy_rejected") {
+                    this.emit("policy_rejected", data.data);
+                }
+                if (data.event === "scan_rules_updated") {
+                    await this._fetchScanRules();
+                    return;
+                }
+                if (data.event === "hub_identity_assigned") {
+                    if (this._persisted) {
+                        this._persisted.hubAddress = data.data.hub_address;
+                        this._persistState();
+                    }
+                    this.emit("hub_identity_assigned", data.data);
+                }
+                if (data.event === "hub_identity_removed") {
+                    if (this._persisted) {
+                        delete this._persisted.hubAddress;
+                        this._persistState();
+                    }
+                    this.emit("hub_identity_removed", data.data);
+                }
+                // --- A2A Channel WS events ---
+                if (data.event === "a2a_channel_approved") {
+                    const channelData = data.data || data;
+                    const channelId = channelData.channel_id;
+                    const convId = channelData.conversation_id;
+                    // Determine role: if we are the initiator hub address, we initiated
+                    const myHub = this._persisted?.hubAddress || "";
+                    const role = channelData.role ||
+                        (channelData.initiator_hub_address === myHub ? "initiator" : "responder");
+                    const peerHub = role === "initiator"
+                        ? channelData.responder_hub_address || ""
+                        : channelData.initiator_hub_address || "";
+                    // Store in persisted state
+                    if (this._persisted && convId) {
+                        if (!this._persisted.a2aChannels)
+                            this._persisted.a2aChannels = {};
+                        // Generate ephemeral X25519 keypair for key exchange
+                        const a2aEphemeral = await generateEphemeralKeypair();
+                        const ephPubHex = bytesToHex(a2aEphemeral.publicKey);
+                        const ephPrivHex = bytesToHex(a2aEphemeral.privateKey);
+                        this._persisted.a2aChannels[channelId] = {
+                            channelId,
+                            hubAddress: peerHub,
+                            conversationId: convId,
+                            role,
+                            pendingEphemeralPrivateKey: ephPrivHex,
+                        };
+                        // Send ephemeral public key to server for key exchange
+                        if (this._ws) {
+                            this._ws.send(JSON.stringify({
+                                event: "a2a_key_exchange",
+                                data: {
+                                    channel_id: channelId,
+                                    ephemeral_key: ephPubHex,
+                                },
+                            }));
+                            console.log(`[SecureChannel] A2A key exchange sent for channel ${channelId.slice(0, 8)}... (role=${role})`);
+                        }
+                        await this._persistState();
+                    }
+                    this.emit("a2a_channel_approved", channelData);
+                }
+                if (data.event === "a2a_channel_activated") {
+                    const actData = data.data || data;
+                    const channelId = actData.channel_id;
+                    const convId = actData.conversation_id;
+                    const activatedRole = actData.role;
+                    const peerIdentityHex = actData.peer_identity_key;
+                    const peerEphemeralHex = actData.peer_ephemeral_key;
+                    const channelEntry = this._persisted?.a2aChannels?.[channelId];
+                    if (channelEntry && channelEntry.pendingEphemeralPrivateKey && this._persisted) {
+                        try {
+                            // Reconstruct keys from hex
+                            const myIdentityPrivate = hexToBytes(this._persisted.identityKeypair.privateKey);
+                            const myIdentityPublic = hexToBytes(this._persisted.identityKeypair.publicKey);
+                            const myEphemeralPrivate = hexToBytes(channelEntry.pendingEphemeralPrivateKey);
+                            const theirIdentityPublic = hexToBytes(peerIdentityHex);
+                            const theirEphemeralPublic = hexToBytes(peerEphemeralHex);
+                            // Perform X3DH key agreement
+                            const sharedSecret = performX3DH({
+                                myIdentityPrivate,
+                                myEphemeralPrivate,
+                                theirIdentityPublic,
+                                theirEphemeralPublic,
+                                isInitiator: activatedRole === "initiator",
+                            });
+                            // Initialize Double Ratchet
+                            const identityKp = {
+                                publicKey: myIdentityPublic,
+                                privateKey: myIdentityPrivate,
+                                keyType: "ed25519",
+                            };
+                            const ratchet = activatedRole === "initiator"
+                                ? DoubleRatchet.initSender(sharedSecret, identityKp)
+                                : DoubleRatchet.initReceiver(sharedSecret, identityKp);
+                            // Store session state
+                            channelEntry.session = {
+                                ownerDeviceId: "", // A2A sessions don't have an owner device
+                                ratchetState: ratchet.serialize(),
+                                activated: activatedRole === "initiator", // initiator can send immediately
+                            };
+                            channelEntry.role = activatedRole;
+                            if (convId)
+                                channelEntry.conversationId = convId;
+                            // Clean up ephemeral private key (no longer needed)
+                            delete channelEntry.pendingEphemeralPrivateKey;
+                            await this._persistState();
+                            console.log(`[SecureChannel] A2A channel activated: ${channelId.slice(0, 8)}... (role=${activatedRole}, ` +
+                                `canSend=${activatedRole === "initiator"})`);
+                        }
+                        catch (err) {
+                            console.error(`[SecureChannel] A2A activation failed for ${channelId.slice(0, 8)}...:`, err);
+                            this.emit("error", err);
+                        }
+                    }
+                    this.emit("a2a_channel_activated", actData);
+                }
+                if (data.event === "a2a_channel_rejected") {
+                    this.emit("a2a_channel_rejected", data.data || data);
+                }
+                if (data.event === "a2a_channel_revoked") {
+                    const channelData = data.data || data;
+                    const channelId = channelData.channel_id;
+                    // Remove from persisted state
+                    if (this._persisted?.a2aChannels?.[channelId]) {
+                        delete this._persisted.a2aChannels[channelId];
+                        await this._persistState();
+                    }
+                    this.emit("a2a_channel_revoked", channelData);
+                }
+                if (data.event === "a2a_message") {
+                    const msgData = data.data || data;
+                    // --- Encrypted A2A message (has ciphertext field) ---
+                    if (msgData.ciphertext && msgData.header_blob) {
+                        const channelId = msgData.channel_id || "";
+                        const channelEntry = this._persisted?.a2aChannels?.[channelId];
+                        if (channelEntry?.session?.ratchetState) {
+                            try {
+                                // Reconstruct EncryptedMessage from hex transport
+                                const headerJson = Buffer.from(msgData.header_blob, "hex").toString("utf-8");
+                                const headerObj = JSON.parse(headerJson);
+                                const encryptedMessage = {
+                                    header: {
+                                        dhPublicKey: hexToBytes(headerObj.dhPublicKey),
+                                        previousChainLength: headerObj.previousChainLength,
+                                        messageNumber: headerObj.messageNumber,
+                                    },
+                                    headerSignature: hexToBytes(msgData.header_signature),
+                                    ciphertext: hexToBytes(msgData.ciphertext),
+                                    nonce: hexToBytes(msgData.nonce),
+                                };
+                                // Decrypt
+                                const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
+                                const plaintext = ratchet.decrypt(encryptedMessage);
+                                // Update ratchet state
+                                channelEntry.session.ratchetState = ratchet.serialize();
+                                // If responder and not yet activated, this is the first initiator message
+                                if (channelEntry.role === "responder" && !channelEntry.session.activated) {
+                                    channelEntry.session.activated = true;
+                                    console.log(`[SecureChannel] A2A responder ratchet activated for ${channelId.slice(0, 8)}...`);
+                                    // Flush any queued messages
+                                    const queued = this._a2aPendingQueue[channelId];
+                                    if (queued && queued.length > 0) {
+                                        delete this._a2aPendingQueue[channelId];
+                                        console.log(`[SecureChannel] Flushing ${queued.length} queued A2A message(s)`);
+                                        // Flush asynchronously after persisting current state
+                                        await this._persistState();
+                                        for (const pending of queued) {
+                                            try {
+                                                await this.sendToAgent(channelEntry.hubAddress, pending.text, pending.opts);
+                                            }
+                                            catch (flushErr) {
+                                                console.error("[SecureChannel] Failed to flush queued A2A message:", flushErr);
+                                            }
+                                        }
+                                    }
+                                }
+                                await this._persistState();
+                                const a2aMsg = {
+                                    text: plaintext,
+                                    fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
+                                    channelId,
+                                    conversationId: msgData.conversation_id || "",
+                                    parentSpanId: msgData.parent_span_id,
+                                    timestamp: msgData.timestamp || new Date().toISOString(),
+                                };
+                                this.emit("a2a_message", a2aMsg);
+                                if (this.config.onA2AMessage) {
+                                    this.config.onA2AMessage(a2aMsg);
+                                }
+                            }
+                            catch (decryptErr) {
+                                console.error(`[SecureChannel] A2A decrypt failed for channel ${channelId.slice(0, 8)}...:`, decryptErr);
+                                this.emit("error", decryptErr);
+                            }
+                        }
+                        else {
+                            console.warn(`[SecureChannel] Received encrypted A2A message but no session for channel ${channelId}`);
+                        }
+                    }
+                    else {
+                        // --- Legacy plaintext A2A message ---
+                        const a2aMsg = {
+                            text: msgData.plaintext || msgData.text,
+                            fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
+                            channelId: msgData.channel_id || "",
+                            conversationId: msgData.conversation_id || "",
+                            parentSpanId: msgData.parent_span_id,
+                            timestamp: msgData.timestamp || new Date().toISOString(),
+                        };
+                        this.emit("a2a_message", a2aMsg);
+                        if (this.config.onA2AMessage) {
+                            this.config.onA2AMessage(a2aMsg);
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                this.emit("error", err);
+            }
+        });
+        ws.on("close", () => {
+            this._stopPing();
+            this._stopWakeDetector();
+            this._stopPendingPoll();
+            if (this._stopped)
+                return;
+            this._setState("disconnected");
+            this._scheduleReconnect();
+        });
+        ws.on("error", (err) => {
+            this.emit("error", err);
+            // The close event will fire after this and handle reconnection
+        });
+    }
+    /**
+     * Handle an incoming encrypted message from a specific conversation.
+     * Decrypts using the appropriate session ratchet, emits to the agent,
+     * and relays as sync messages to sibling sessions.
+     */
+    async _handleIncomingMessage(msgData) {
+        // Don't decrypt our own messages
+        if (msgData.sender_device_id === this._deviceId)
+            return;
+        // Dedup: skip if this message was already processed during sync
+        if (this._syncMessageIds?.has(msgData.message_id)) {
+            return;
+        }
+        const convId = msgData.conversation_id;
+        const session = this._sessions.get(convId);
+        if (!session) {
+            // Could be a message for a conversation we haven't initialized yet
+            console.warn(`[SecureChannel] No session for conversation ${convId}, skipping`);
+            return;
+        }
+        const encrypted = transportToEncryptedMessage({
+            header_blob: msgData.header_blob,
+            ciphertext: msgData.ciphertext,
+        });
+        const plaintext = session.ratchet.decrypt(encrypted);
+        // ACK delivery to server
+        this._sendAck(msgData.message_id);
+        // Mark session as activated on first owner message
+        if (!session.activated) {
+            session.activated = true;
+            console.log(`[SecureChannel] Session ${convId.slice(0, 8)}... activated by first owner message`);
+        }
+        // Parse structured payload (new format) or treat as raw text (legacy)
+        let messageText;
+        let messageType;
+        let attachmentInfo = null;
+        try {
+            const parsed = JSON.parse(plaintext);
+            messageType = parsed.type || "message";
+            messageText = parsed.text || plaintext;
+            if (parsed.attachment) {
+                attachmentInfo = parsed.attachment;
+            }
+        }
+        catch {
+            // Legacy plain string format
+            messageType = "message";
+            messageText = plaintext;
+        }
+        if (messageType === "session_init") {
+            // New device session activated — replay message history
+            console.log(`[SecureChannel] session_init received for ${convId.slice(0, 8)}..., replaying history`);
+            await this._replayHistoryToSession(convId);
+            await this._persistState();
+            return;
+        }
+        // Inbound scan — after decryption
+        if (this._scanEngine) {
+            const scanResult = this._scanEngine.scanInbound(messageText);
+            if (scanResult.status === "blocked") {
+                this.emit("scan_blocked", { direction: "inbound", violations: scanResult.violations });
+                return; // drop the message
+            }
+        }
+        if (messageType === "message") {
+            const topicId = msgData.topic_id;
+            // Handle attachment: download, decrypt, save to disk
+            let attachData;
+            if (attachmentInfo) {
+                try {
+                    const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
+                    attachData = {
+                        filename: attachmentInfo.filename,
+                        mime: attachmentInfo.mime,
+                        size: decrypted.length,
+                        filePath,
+                    };
+                    // For images: include base64 so LLM vision can see the content
+                    if (attachmentInfo.mime.startsWith("image/")) {
+                        attachData.base64 = `data:${attachmentInfo.mime};base64,${bytesToBase64(decrypted)}`;
+                    }
+                    // For text-based files: extract content inline
+                    const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
+                    if (textMimes.some((m) => attachmentInfo.mime.startsWith(m))) {
+                        attachData.textContent = new TextDecoder().decode(decrypted);
+                    }
+                }
+                catch (err) {
+                    console.error(`[SecureChannel] Failed to download attachment:`, err);
+                }
+            }
+            // Store owner message in history for cross-device replay
+            this._appendHistory("owner", messageText, topicId);
+            // Build display text with attachment content
+            let emitText = messageText;
+            if (attachData) {
+                if (attachData.textContent) {
+                    emitText = `[Attachment: ${attachData.filename} (${attachData.mime}) saved to ${attachData.filePath}]\n---\n${attachData.textContent}\n---\n\n${messageText}`;
+                }
+                else if (attachData.base64) {
+                    emitText = `[Image attachment: ${attachData.filename} saved to ${attachData.filePath}]\nUse your Read tool to view this image file.\n\n${messageText}`;
+                }
+                else {
+                    emitText = `[Attachment: ${attachData.filename} saved to ${attachData.filePath}]\n\n${messageText}`;
+                }
+            }
+            // Emit to agent developer
+            const metadata = {
+                messageId: msgData.message_id,
+                conversationId: convId,
+                timestamp: msgData.created_at,
+                topicId,
+                attachment: attachData,
+                spanId: msgData.span_id,
+                parentSpanId: msgData.parent_span_id,
+                messageType: msgData.message_type ?? "text",
+                priority: msgData.priority ?? "normal",
+                envelopeVersion: msgData.envelope_version ?? "1.0.0",
+            };
+            this.emit("message", emitText, metadata);
+            this.config.onMessage?.(emitText, metadata);
+            // Relay to sibling sessions as sync messages
+            await this._relaySyncToSiblings(convId, session.ownerDeviceId, messageText, topicId);
+        }
+        // If type === "sync", agent ignores it (sync is for owner devices only)
+        // Track last message timestamp for offline sync
+        if (this._persisted) {
+            this._persisted.lastMessageTimestamp = msgData.created_at;
+        }
+        // Persist all ratchet states after decrypt
+        await this._persistState();
+    }
+    /**
+     * Download an encrypted attachment blob, decrypt it, verify integrity,
+     * and save the plaintext file to disk.
+     */
+    async _downloadAndDecryptAttachment(info) {
+        const attachDir = join(this.config.dataDir, "attachments");
+        await mkdir(attachDir, { recursive: true });
+        // Download encrypted blob from API
+        const url = `${this.config.apiUrl}${info.blobUrl}`;
+        const res = await fetch(url, {
+            headers: { Authorization: `Bearer ${this._deviceJwt}` },
+        });
+        if (!res.ok) {
+            throw new Error(`Attachment download failed: ${res.status}`);
+        }
+        const buffer = await res.arrayBuffer();
+        const encryptedData = new Uint8Array(buffer);
+        // Verify integrity
+        const digest = computeFileDigest(encryptedData);
+        if (digest !== info.digest) {
+            throw new Error("Attachment digest mismatch — possible tampering");
+        }
+        // Decrypt
+        const fileKey = base64ToBytes(info.fileKey);
+        const fileNonce = base64ToBytes(info.fileNonce);
+        const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
+        // Save to disk
+        const filePath = join(attachDir, info.filename);
+        await writeFile(filePath, decrypted);
+        console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
+        return { filePath, decrypted };
+    }
+    /**
+     * Upload an attachment file: encrypt, upload to server, return metadata
+     * for inclusion in the message envelope.
+     */
+    async _uploadAttachment(filePath, conversationId) {
+        const data = await readFile(filePath);
+        const plainData = new Uint8Array(data);
+        const result = encryptFile(plainData);
+        // Upload encrypted blob via multipart form
+        const { Blob: NodeBlob, FormData: NodeFormData } = await import("node:buffer").then(() => globalThis);
+        const formData = new FormData();
+        formData.append("conversation_id", conversationId);
+        formData.append("file", new Blob([result.encryptedData.buffer], { type: "application/octet-stream" }), "attachment.bin");
+        const res = await fetch(`${this.config.apiUrl}/api/v1/attachments/upload`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${this._deviceJwt}` },
+            body: formData,
+        });
+        if (!res.ok) {
+            const detail = await res.text();
+            throw new Error(`Attachment upload failed (${res.status}): ${detail}`);
+        }
+        const resp = await res.json();
+        const filename = filePath.split("/").pop() || "file";
+        return {
+            blobId: resp.blob_id,
+            blobUrl: resp.blob_url,
+            fileKey: bytesToBase64(result.fileKey),
+            fileNonce: bytesToBase64(result.fileNonce),
+            digest: result.digest,
+            filename,
+            mime: "application/octet-stream",
+            size: plainData.length,
+        };
+    }
+    /**
+     * Send a message with an attached file. Encrypts the file, uploads it,
+     * then sends the envelope with attachment metadata via Double Ratchet.
+     */
+    async sendWithAttachment(plaintext, filePath, options) {
+        if (this._state !== "ready" || this._sessions.size === 0 || !this._ws) {
+            throw new Error("Channel is not ready");
+        }
+        const topicId = options?.topicId ?? this._persisted?.defaultTopicId;
+        // Upload attachment using primary conversation for the blob
+        const attachMeta = await this._uploadAttachment(filePath, this._primaryConversationId);
+        // Build envelope
+        const envelope = JSON.stringify({
+            type: "message",
+            text: plaintext,
+            topicId,
+            attachment: attachMeta,
+        });
+        // Store agent message in history
+        this._appendHistory("agent", plaintext, topicId);
+        const messageGroupId = randomUUID();
+        for (const [convId, session] of this._sessions) {
+            if (!session.activated)
+                continue;
+            const encrypted = session.ratchet.encrypt(envelope);
+            const transport = encryptedMessageToTransport(encrypted);
+            this._ws.send(JSON.stringify({
+                event: "message",
+                data: {
+                    conversation_id: convId,
+                    header_blob: transport.header_blob,
+                    ciphertext: transport.ciphertext,
+                    message_group_id: messageGroupId,
+                    topic_id: topicId,
+                },
+            }));
+        }
+        await this._persistState();
+    }
+    /**
+     * Relay an owner's message to all sibling sessions as encrypted sync messages.
+     * This allows all owner devices to see messages from any single device.
+     */
+    async _relaySyncToSiblings(sourceConvId, senderOwnerDeviceId, messageText, topicId) {
+        if (!this._ws || this._sessions.size <= 1)
+            return;
+        const syncPayload = JSON.stringify({
+            type: "sync",
+            sender: senderOwnerDeviceId,
+            text: messageText,
+            ts: new Date().toISOString(),
+            topicId,
+        });
+        for (const [siblingConvId, siblingSession] of this._sessions) {
+            if (siblingConvId === sourceConvId)
+                continue;
+            // Don't relay to sessions where owner hasn't sent their first message yet
+            if (!siblingSession.activated)
+                continue;
+            const syncEncrypted = siblingSession.ratchet.encrypt(syncPayload);
+            const syncTransport = encryptedMessageToTransport(syncEncrypted);
+            this._ws.send(JSON.stringify({
+                event: "message",
+                data: {
+                    conversation_id: siblingConvId,
+                    header_blob: syncTransport.header_blob,
+                    ciphertext: syncTransport.ciphertext,
+                },
+            }));
+        }
+    }
+    /**
+     * Send stored message history to a newly-activated session.
+     * Batches all history into a single encrypted message.
+     */
+    async _replayHistoryToSession(convId) {
+        const session = this._sessions.get(convId);
+        if (!session || !session.activated || !this._ws)
+            return;
+        const history = this._persisted?.messageHistory ?? [];
+        if (history.length === 0) {
+            console.log(`[SecureChannel] No history to replay for ${convId.slice(0, 8)}...`);
+            return;
+        }
+        console.log(`[SecureChannel] Replaying ${history.length} messages to session ${convId.slice(0, 8)}...`);
+        const replayPayload = JSON.stringify({
+            type: "history_replay",
+            messages: history,
+        });
+        const encrypted = session.ratchet.encrypt(replayPayload);
+        const transport = encryptedMessageToTransport(encrypted);
+        this._ws.send(JSON.stringify({
+            event: "message",
+            data: {
+                conversation_id: convId,
+                header_blob: transport.header_blob,
+                ciphertext: transport.ciphertext,
+            },
+        }));
+    }
+    /**
+     * Handle a device_linked event: a new owner device has joined.
+     * Fetches the new device's public keys, performs X3DH, and initializes
+     * a new ratchet session.
+     */
+    async _handleDeviceLinked(event) {
+        console.log(`[SecureChannel] New owner device linked: ${event.owner_device_id.slice(0, 8)}...`);
+        try {
+            if (!event.owner_identity_public_key) {
+                console.error(`[SecureChannel] device_linked event missing owner keys for conv ${event.conversation_id.slice(0, 8)}...`);
+                return;
+            }
+            const identity = this._persisted.identityKeypair;
+            const ephemeral = this._persisted.ephemeralKeypair;
+            // Perform X3DH as responder with the new owner device
+            const sharedSecret = performX3DH({
+                myIdentityPrivate: hexToBytes(identity.privateKey),
+                myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
+                theirIdentityPublic: hexToBytes(event.owner_identity_public_key),
+                theirEphemeralPublic: hexToBytes(event.owner_ephemeral_public_key ?? event.owner_identity_public_key),
+                isInitiator: false,
+            });
+            // Initialize ratchet as receiver
+            const ratchet = DoubleRatchet.initReceiver(sharedSecret, {
+                publicKey: hexToBytes(identity.publicKey),
+                privateKey: hexToBytes(identity.privateKey),
+                keyType: "ed25519",
+            });
+            this._sessions.set(event.conversation_id, {
+                ownerDeviceId: event.owner_device_id,
+                ratchet,
+                activated: false, // Wait for owner's first message
+            });
+            // Persist
+            this._persisted.sessions[event.conversation_id] = {
+                ownerDeviceId: event.owner_device_id,
+                ratchetState: ratchet.serialize(),
+                activated: false,
+            };
+            await this._persistState();
+            console.log(`[SecureChannel] Session initialized for device ${event.owner_device_id.slice(0, 8)}... (conv ${event.conversation_id.slice(0, 8)}...)`);
+        }
+        catch (err) {
+            console.error(`[SecureChannel] Failed to handle device_linked:`, err);
+            this.emit("error", err);
+        }
+    }
+    /**
+     * Handle an incoming room message. Finds the pairwise conversation
+     * for the sender, decrypts, and emits a room_message event.
+     */
+    async _handleRoomMessage(msgData) {
+        // Don't decrypt our own messages
+        if (msgData.sender_device_id === this._deviceId)
+            return;
+        const convId = msgData.conversation_id ??
+            this._findConversationForSender(msgData.sender_device_id, msgData.room_id);
+        if (!convId) {
+            console.warn(`[SecureChannel] No conversation found for sender ${msgData.sender_device_id.slice(0, 8)}... in room ${msgData.room_id}`);
+            return;
+        }
+        const session = this._sessions.get(convId);
+        if (!session) {
+            console.warn(`[SecureChannel] No session for room conv ${convId.slice(0, 8)}..., skipping`);
+            return;
+        }
+        const encrypted = transportToEncryptedMessage({
+            header_blob: msgData.header_blob,
+            ciphertext: msgData.ciphertext,
+        });
+        const plaintext = session.ratchet.decrypt(encrypted);
+        // Activate session on first received message
+        if (!session.activated) {
+            session.activated = true;
+            console.log(`[SecureChannel] Room session ${convId.slice(0, 8)}... activated by first message`);
+        }
+        // ACK if message_id present
+        if (msgData.message_id) {
+            this._sendAck(msgData.message_id);
+        }
+        await this._persistState();
+        const metadata = {
+            messageId: msgData.message_id ?? "",
+            conversationId: convId,
+            timestamp: msgData.created_at ?? new Date().toISOString(),
+            messageType: msgData.message_type ?? "text",
+        };
+        this.emit("room_message", {
+            roomId: msgData.room_id,
+            senderDeviceId: msgData.sender_device_id,
+            plaintext,
+            messageType: msgData.message_type ?? "text",
+            timestamp: msgData.created_at ?? new Date().toISOString(),
+        });
+        this.config.onMessage?.(plaintext, metadata);
+    }
+    /**
+     * Find the pairwise conversation ID for a given sender in a room.
+     */
+    _findConversationForSender(senderDeviceId, roomId) {
+        const room = this._persisted?.rooms?.[roomId];
+        if (!room)
+            return null;
+        for (const convId of room.conversationIds) {
+            const session = this._sessions.get(convId);
+            if (session && session.ownerDeviceId === senderDeviceId) {
+                return convId;
+            }
+        }
+        return null;
+    }
+    /**
+     * Sync missed messages across ALL sessions.
+     * For each conversation, fetches messages since last sync and decrypts.
+     */
+    /**
+     * Paginated sync: fetch missed messages in pages of 200, up to 5 pages (1000 messages).
+     * Tracks message IDs in _syncMessageIds to prevent duplicate processing from concurrent WS messages.
+     */
+    async _syncMissedMessages() {
+        if (!this._persisted?.lastMessageTimestamp || !this._deviceJwt)
+            return;
+        this._syncMessageIds = new Set();
+        const MAX_PAGES = 5;
+        const PAGE_SIZE = 200;
+        let since = this._persisted.lastMessageTimestamp;
+        let totalProcessed = 0;
+        try {
+            for (let page = 0; page < MAX_PAGES; page++) {
+                const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/messages?since=${encodeURIComponent(since)}&limit=${PAGE_SIZE}`;
+                const res = await fetch(url, {
+                    headers: { Authorization: `Bearer ${this._deviceJwt}` },
+                });
+                if (!res.ok)
+                    break;
+                const messages = await res.json();
+                if (messages.length === 0)
+                    break;
+                for (const msg of messages) {
+                    if (msg.sender_device_id === this._deviceId)
+                        continue;
+                    // Dedup: skip if already processed
+                    if (this._syncMessageIds.has(msg.id))
+                        continue;
+                    this._syncMessageIds.add(msg.id);
+                    const session = this._sessions.get(msg.conversation_id);
+                    if (!session) {
+                        console.warn(`[SecureChannel] No session for conversation ${msg.conversation_id} during sync, skipping`);
+                        continue;
+                    }
+                    try {
+                        const encrypted = transportToEncryptedMessage({
+                            header_blob: msg.header_blob,
+                            ciphertext: msg.ciphertext,
+                        });
+                        const plaintext = session.ratchet.decrypt(encrypted);
+                        this._sendAck(msg.id);
+                        if (!session.activated) {
+                            session.activated = true;
+                            console.log(`[SecureChannel] Session ${msg.conversation_id.slice(0, 8)}... activated during sync`);
+                        }
+                        let messageText;
+                        let messageType;
+                        try {
+                            const parsed = JSON.parse(plaintext);
+                            messageType = parsed.type || "message";
+                            messageText = parsed.text || plaintext;
+                        }
+                        catch {
+                            messageType = "message";
+                            messageText = plaintext;
+                        }
+                        if (messageType === "message") {
+                            const topicId = msg.topic_id;
+                            this._appendHistory("owner", messageText, topicId);
+                            const metadata = {
+                                messageId: msg.id,
+                                conversationId: msg.conversation_id,
+                                timestamp: msg.created_at,
+                                topicId,
+                            };
+                            this.emit("message", messageText, metadata);
+                            this.config.onMessage?.(messageText, metadata);
+                        }
+                        this._persisted.lastMessageTimestamp = msg.created_at;
+                        since = msg.created_at;
+                        totalProcessed++;
+                    }
+                    catch (err) {
+                        this.emit("error", err);
+                        break; // Ratchet desync -- stop processing
+                    }
+                }
+                await this._persistState();
+                // If we got fewer than PAGE_SIZE, we've caught up
+                if (messages.length < PAGE_SIZE)
+                    break;
+            }
+            if (totalProcessed > 0) {
+                console.log(`[SecureChannel] Synced ${totalProcessed} missed messages`);
+            }
+        }
+        catch {
+            // Network error -- non-critical, will get messages via WS
+        }
+        this._syncMessageIds = null;
+    }
+    _sendAck(messageId) {
+        this._pendingAcks.push(messageId);
+        if (this._ackTimer)
+            clearTimeout(this._ackTimer);
+        this._ackTimer = setTimeout(() => this._flushAcks(), 500);
+    }
+    _flushAcks() {
+        if (this._pendingAcks.length === 0 || !this._ws)
+            return;
+        const batch = this._pendingAcks.splice(0, 50);
+        this._ws.send(JSON.stringify({ event: "ack", data: { message_ids: batch } }));
+    }
+    async _flushOutboundQueue() {
+        const queue = this._persisted?.outboundQueue;
+        if (!queue || queue.length === 0 || !this._ws)
+            return;
+        console.log(`[SecureChannel] Flushing ${queue.length} queued outbound messages`);
+        const messages = queue.splice(0); // Take all, clear queue
+        for (const msg of messages) {
+            try {
+                this._ws.send(JSON.stringify({
+                    event: "message",
+                    data: {
+                        conversation_id: msg.convId,
+                        header_blob: msg.headerBlob,
+                        ciphertext: msg.ciphertext,
+                        message_group_id: msg.messageGroupId,
+                        topic_id: msg.topicId,
+                    },
+                }));
+            }
+            catch (err) {
+                // Re-queue failed messages
+                if (!this._persisted.outboundQueue) {
+                    this._persisted.outboundQueue = [];
+                }
+                this._persisted.outboundQueue.push(msg);
+                console.warn(`[SecureChannel] Failed to flush message, re-queued: ${err}`);
+                break; // Stop flushing on first failure
+            }
+        }
+        await this._persistState();
+    }
+    _startPing(ws) {
+        this._stopPing(); // Clear any existing timers
+        this._lastServerMessage = Date.now();
+        this._pingTimer = setInterval(() => {
+            if (ws.readyState !== WebSocket.OPEN)
+                return;
+            const silence = Date.now() - this._lastServerMessage;
+            if (silence > SecureChannel.SILENCE_TIMEOUT_MS) {
+                console.log(`[SecureChannel] No server data for ${Math.round(silence / 1000)}s — reconnecting stale WebSocket`);
+                ws.terminate(); // Forces close → _scheduleReconnect fires
+            }
+        }, SecureChannel.PING_INTERVAL_MS);
+    }
+    _stopPing() {
+        if (this._pingTimer) {
+            clearInterval(this._pingTimer);
+            this._pingTimer = null;
+        }
+    }
+    _startWakeDetector() {
+        this._stopWakeDetector();
+        this._lastWakeTick = Date.now();
+        this._wakeDetectorTimer = setInterval(() => {
+            const gap = Date.now() - this._lastWakeTick;
+            this._lastWakeTick = Date.now();
+            if (gap > 120_000 && this._ws) {
+                console.log(`[SecureChannel] System wake detected (${Math.round(gap / 1000)}s gap) — forcing reconnect`);
+                this._ws.terminate();
+            }
+        }, 10_000);
+    }
+    _stopWakeDetector() {
+        if (this._wakeDetectorTimer) {
+            clearInterval(this._wakeDetectorTimer);
+            this._wakeDetectorTimer = null;
+        }
+    }
+    _startPendingPoll() {
+        this._stopPendingPoll();
+        this._pendingPollTimer = setInterval(() => {
+            this._checkPendingMessages();
+        }, PENDING_POLL_INTERVAL_MS);
+    }
+    _stopPendingPoll() {
+        if (this._pendingPollTimer) {
+            clearInterval(this._pendingPollTimer);
+            this._pendingPollTimer = null;
+        }
+    }
+    async _checkPendingMessages() {
+        // Don't poll while connecting (prevent hammering during reconnect)
+        if (this._state === "connecting" || !this._deviceId || !this._deviceJwt)
+            return;
+        try {
+            const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/pending`;
+            const resp = await fetch(url, {
+                headers: { Authorization: `Bearer ${this._deviceJwt}` },
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!resp.ok)
+                return; // Silent fail — WS silence detector is backup
+            const data = (await resp.json());
+            if (data.pending > 0 && this._state !== "ready") {
+                console.log(`[SecureChannel] Poll detected ${data.pending} pending messages — forcing reconnect`);
+                if (this._ws) {
+                    this._ws.terminate();
+                }
+                else {
+                    this._scheduleReconnect();
+                }
+            }
+            else if (data.pending > 0 && this._state === "ready") {
+                // WS claims ready but messages are pending — possible half-open connection
+                const silence = Date.now() - this._lastServerMessage;
+                if (silence > 180_000) {
+                    console.log(`[SecureChannel] Poll: ${data.pending} pending + ${Math.round(silence / 1000)}s silence — forcing reconnect`);
+                    if (this._ws)
+                        this._ws.terminate();
+                }
+            }
+        }
+        catch {
+            // Network error on poll — expected when offline, ignore silently
+        }
+    }
+    _scheduleReconnect() {
+        if (this._stopped)
+            return;
+        if (this._reconnectTimer)
+            return; // Already scheduled
+        const delay = Math.min(RECONNECT_BASE_MS * Math.pow(2, this._reconnectAttempt), RECONNECT_MAX_MS);
+        this._reconnectAttempt++;
+        console.log(`[SecureChannel] Scheduling reconnect in ${delay}ms (attempt ${this._reconnectAttempt})`);
+        this._reconnectTimer = setTimeout(() => {
+            this._reconnectTimer = null; // Clear BEFORE calling _connect so future disconnects can schedule new reconnects
+            if (!this._stopped) {
+                this._connect();
+            }
+        }, delay);
+    }
+    _setState(newState) {
+        if (this._state === newState)
+            return;
+        this._state = newState;
+        this.emit("state", newState);
+        this.config.onStateChange?.(newState);
+        // Start/stop polling fallback based on connection state
+        if (newState === "disconnected" && !this._pollFallbackTimer && this._deviceJwt) {
+            this._startPollFallback();
+        }
+        if (newState === "ready" || newState === "error" || this._stopped) {
+            this._stopPollFallback();
+        }
+    }
+    _startPollFallback() {
+        this._stopPollFallback();
+        console.log("[SecureChannel] Starting HTTP poll fallback (WS is down)");
+        let interval = SecureChannel.POLL_FALLBACK_INTERVAL_MS;
+        const poll = async () => {
+            if (this._state === "ready" || this._stopped) {
+                this._stopPollFallback();
+                return;
+            }
+            try {
+                const since = this._persisted?.lastMessageTimestamp;
+                if (!since || !this._deviceJwt)
+                    return;
+                const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/messages?since=${encodeURIComponent(since)}&limit=200`;
+                const res = await fetch(url, {
+                    headers: { Authorization: `Bearer ${this._deviceJwt}` },
+                });
+                if (!res.ok)
+                    return;
+                const messages = await res.json();
+                let foundMessages = false;
+                for (const msg of messages) {
+                    if (msg.sender_device_id === this._deviceId)
+                        continue;
+                    const session = this._sessions.get(msg.conversation_id);
+                    if (!session)
+                        continue;
+                    try {
+                        const encrypted = transportToEncryptedMessage({
+                            header_blob: msg.header_blob,
+                            ciphertext: msg.ciphertext,
+                        });
+                        const plaintext = session.ratchet.decrypt(encrypted);
+                        if (!session.activated) {
+                            session.activated = true;
+                        }
+                        let messageText;
+                        let messageType;
+                        try {
+                            const parsed = JSON.parse(plaintext);
+                            messageType = parsed.type || "message";
+                            messageText = parsed.text || plaintext;
+                        }
+                        catch {
+                            messageType = "message";
+                            messageText = plaintext;
+                        }
+                        if (messageType === "message") {
+                            const topicId = msg.topic_id;
+                            this._appendHistory("owner", messageText, topicId);
+                            const metadata = {
+                                messageId: msg.id,
+                                conversationId: msg.conversation_id,
+                                timestamp: msg.created_at,
+                                topicId,
+                            };
+                            this.emit("message", messageText, metadata);
+                            this.config.onMessage?.(messageText, metadata);
+                            foundMessages = true;
+                        }
+                        this._persisted.lastMessageTimestamp = msg.created_at;
+                    }
+                    catch (err) {
+                        this.emit("error", err);
+                        break;
+                    }
+                }
+                if (messages.length > 0) {
+                    await this._persistState();
+                }
+                // Adaptive rate: faster when active, slower when idle
+                const newInterval = foundMessages
+                    ? SecureChannel.POLL_FALLBACK_INTERVAL_MS
+                    : SecureChannel.POLL_FALLBACK_IDLE_MS;
+                if (newInterval !== interval) {
+                    interval = newInterval;
+                    // Restart timer with new interval
+                    if (this._pollFallbackTimer) {
+                        clearInterval(this._pollFallbackTimer);
+                        this._pollFallbackTimer = setInterval(poll, interval);
+                    }
+                }
+            }
+            catch {
+                // Network error — try again next tick
+            }
+        };
+        // Run first poll after a short delay, then on interval
+        setTimeout(poll, 1_000);
+        this._pollFallbackTimer = setInterval(poll, interval);
+    }
+    _stopPollFallback() {
+        if (this._pollFallbackTimer) {
+            clearInterval(this._pollFallbackTimer);
+            this._pollFallbackTimer = null;
+            console.log("[SecureChannel] Stopped HTTP poll fallback");
+        }
+    }
+    _handleError(err) {
+        this._setState("error");
+        this.emit("error", err);
+    }
+    /**
+     * Persist all ratchet session states to disk.
+     * Syncs live ratchet states back into the persisted sessions map.
+     */
+    async _persistState() {
+        if (!this._persisted)
+            return;
+        const hasOwnerSessions = this._sessions.size > 0;
+        const hasA2AChannels = !!this._persisted.a2aChannels && Object.keys(this._persisted.a2aChannels).length > 0;
+        if (!hasOwnerSessions && !hasA2AChannels)
+            return;
+        // Sync all live owner-agent ratchet states back to persisted
+        for (const [convId, session] of this._sessions) {
+            this._persisted.sessions[convId] = {
+                ownerDeviceId: session.ownerDeviceId,
+                ratchetState: session.ratchet.serialize(),
+                activated: session.activated,
+            };
+        }
+        await saveState(this.config.dataDir, this._persisted);
+    }
+}
+//# sourceMappingURL=channel.js.map