@agentvault/agentvault 0.9.8 → 0.10.0

package/dist/channel.js

@@ -1,2257 +0,0 @@
-import { EventEmitter } from "node:events";
-import { createServer } from "node:http";
-import { randomUUID } from "node:crypto";
-import { writeFile, mkdir } from "node:fs/promises";
-import { join } from "node:path";
-import { readFile } from "node:fs/promises";
-import sodium from "libsodium-wrappers-sumo";
-import WebSocket from "ws";
-import { generateIdentityKeypair, generateEphemeralKeypair, computeFingerprint, createProofOfPossession, performX3DH, DoubleRatchet, decryptFile, encryptFile, computeFileDigest, ScanEngine, } from "@agentvault/crypto";
-import { hexToBytes, bytesToHex, base64ToBytes, bytesToBase64, encryptedMessageToTransport, transportToEncryptedMessage, } from "./crypto-helpers.js";
-import { saveState, loadState, clearState } from "./state.js";
-import { enrollDevice, pollDeviceStatus, activateDevice, } from "./transport.js";
-const POLL_INTERVAL_MS = 6_000; // 6s — safely below the 1/5sec server-side rate limit
-const RECONNECT_BASE_MS = 1_000;
-const RECONNECT_MAX_MS = 30_000;
-const PENDING_POLL_INTERVAL_MS = 15_000;
-/**
- * Migrates legacy single-session persisted state to the new
- * multi-session format. If the state is already in the new format,
- * returns it as-is.
- */
-function migratePersistedState(raw) {
-    // New format: has `sessions` and `primaryConversationId`
-    if (raw.sessions && raw.primaryConversationId) {
-        return raw;
-    }
-    // Legacy format: single conversationId + ratchetState
-    const legacy = raw;
-    return {
-        deviceId: legacy.deviceId,
-        deviceJwt: legacy.deviceJwt,
-        primaryConversationId: legacy.conversationId,
-        sessions: {
-            [legacy.conversationId]: {
-                ownerDeviceId: "",
-                ratchetState: legacy.ratchetState,
-            },
-        },
-        identityKeypair: legacy.identityKeypair,
-        ephemeralKeypair: legacy.ephemeralKeypair,
-        fingerprint: legacy.fingerprint,
-        lastMessageTimestamp: legacy.lastMessageTimestamp,
-        messageHistory: [],
-    };
-}
-export class SecureChannel extends EventEmitter {
-    config;
-    _state = "idle";
-    _deviceId = null;
-    _fingerprint = null;
-    _primaryConversationId = "";
-    _deviceJwt = null;
-    _sessions = new Map();
-    _ws = null;
-    _pollTimer = null;
-    _reconnectAttempt = 0;
-    _reconnectTimer = null;
-    _pingTimer = null;
-    _lastServerMessage = 0;
-    _pendingAcks = [];
-    _ackTimer = null;
-    _stopped = false;
-    _persisted = null;
-    _httpServer = null;
-    _pollFallbackTimer = null;
-    _heartbeatTimer = null;
-    _heartbeatCallback = null;
-    _heartbeatIntervalSeconds = 0;
-    _wakeDetectorTimer = null;
-    _lastWakeTick = Date.now();
-    _pendingPollTimer = null;
-    _syncMessageIds = null;
-    /** Queued A2A messages for responder channels not yet activated (no first initiator message received). */
-    _a2aPendingQueue = {};
-    _scanEngine = null;
-    _scanRuleSetVersion = 0;
-    // Liveness detection: server sends app-level {"event":"ping"} every 30s.
-    // We check every 30s; if no data received in 90s (3 missed pings), connection is dead.
-    static PING_INTERVAL_MS = 30_000;
-    static SILENCE_TIMEOUT_MS = 90_000;
-    static POLL_FALLBACK_INTERVAL_MS = 30_000; // 30s when messages found
-    static POLL_FALLBACK_IDLE_MS = 60_000; // 60s when idle
-    constructor(config) {
-        super();
-        this.config = config;
-    }
-    get state() {
-        return this._state;
-    }
-    get deviceId() {
-        return this._deviceId;
-    }
-    get fingerprint() {
-        return this._fingerprint;
-    }
-    /** Returns the primary conversation ID (backward-compatible). */
-    get conversationId() {
-        return this._primaryConversationId || null;
-    }
-    /** Returns all active conversation IDs. */
-    get conversationIds() {
-        return Array.from(this._sessions.keys());
-    }
-    /** Returns the number of active sessions. */
-    get sessionCount() {
-        return this._sessions.size;
-    }
-    async start() {
-        this._stopped = false;
-        await sodium.ready;
-        // Check for persisted state (may be legacy or new format)
-        const raw = await loadState(this.config.dataDir);
-        if (raw) {
-            this._persisted = migratePersistedState(raw);
-            if (!this._persisted.messageHistory) {
-                this._persisted.messageHistory = [];
-            }
-            this._deviceId = this._persisted.deviceId;
-            this._deviceJwt = this._persisted.deviceJwt;
-            this._primaryConversationId = this._persisted.primaryConversationId;
-            this._fingerprint = this._persisted.fingerprint;
-            // Restore all ratchet sessions
-            for (const [convId, sessionData] of Object.entries(this._persisted.sessions)) {
-                if (sessionData.ratchetState) {
-                    const ratchet = DoubleRatchet.deserialize(sessionData.ratchetState);
-                    this._sessions.set(convId, {
-                        ownerDeviceId: sessionData.ownerDeviceId,
-                        ratchet,
-                        activated: sessionData.activated ?? false,
-                    });
-                }
-            }
-            this._connect();
-            return;
-        }
-        // Full lifecycle: enroll -> poll -> activate -> connect
-        await this._enroll();
-    }
-    /**
-     * Fetch scan rules from the server and load them into the ScanEngine.
-     */
-    async _fetchScanRules() {
-        if (!this._scanEngine)
-            return;
-        try {
-            const resp = await fetch(`${this.config.apiUrl}/api/v1/scan-rules`, {
-                headers: { Authorization: `Bearer ${this._persisted?.deviceJwt}` },
-            });
-            if (!resp.ok)
-                return;
-            const data = await resp.json();
-            if (data.rule_set_version !== this._scanRuleSetVersion) {
-                this._scanEngine.loadRules(data.rules);
-                this._scanRuleSetVersion = data.rule_set_version;
-            }
-        }
-        catch (err) {
-            console.error("[SecureChannel] Failed to fetch scan rules:", err);
-        }
-    }
-    /**
-     * Append a message to persistent history for cross-device replay.
-     */
-    _appendHistory(sender, text, topicId) {
-        if (!this._persisted)
-            return;
-        if (!this._persisted.messageHistory) {
-            this._persisted.messageHistory = [];
-        }
-        const maxSize = this.config.maxHistorySize ?? 500;
-        const entry = {
-            sender,
-            text,
-            ts: new Date().toISOString(),
-        };
-        if (topicId) {
-            entry.topicId = topicId;
-        }
-        this._persisted.messageHistory.push(entry);
-        // Evict oldest entries if over limit
-        if (this._persisted.messageHistory.length > maxSize) {
-            this._persisted.messageHistory = this._persisted.messageHistory.slice(-maxSize);
-        }
-    }
-    /**
-     * Encrypt and send a message to ALL owner devices (fanout).
-     * Each session gets the same plaintext encrypted independently.
-     */
-    async send(plaintext, options) {
-        // Permanent failures — still throw
-        if (this._state === "error" || this._state === "idle") {
-            throw new Error("Channel is not ready");
-        }
-        if (this._sessions.size === 0) {
-            throw new Error("No active sessions");
-        }
-        const topicId = options?.topicId ?? this._persisted?.defaultTopicId;
-        const messageType = options?.messageType ?? "text";
-        const priority = options?.priority ?? "normal";
-        const parentSpanId = options?.parentSpanId;
-        const envelopeMetadata = options?.metadata;
-        // Outbound scan — before encryption
-        let scanStatus;
-        if (this._scanEngine) {
-            const scanResult = this._scanEngine.scanOutbound(plaintext);
-            if (scanResult.status === "blocked") {
-                this.emit("scan_blocked", { direction: "outbound", violations: scanResult.violations });
-                throw new Error(`Message blocked by scan rule: ${scanResult.violations[0]?.rule_name}`);
-            }
-            scanStatus = scanResult.status; // "clean" or "flagged"
-        }
-        // Store agent message in history for cross-device replay
-        this._appendHistory("agent", plaintext, topicId);
-        const messageGroupId = randomUUID();
-        for (const [convId, session] of this._sessions) {
-            if (!session.activated)
-                continue;
-            const encrypted = session.ratchet.encrypt(plaintext);
-            const transport = encryptedMessageToTransport(encrypted);
-            const msg = {
-                convId,
-                headerBlob: transport.header_blob,
-                ciphertext: transport.ciphertext,
-                messageGroupId,
-                topicId,
-            };
-            if (this._state === "ready" && this._ws) {
-                // Send immediately
-                const payload = {
-                    conversation_id: msg.convId,
-                    header_blob: msg.headerBlob,
-                    ciphertext: msg.ciphertext,
-                    message_group_id: msg.messageGroupId,
-                    topic_id: msg.topicId,
-                    message_type: messageType,
-                    priority: priority,
-                    parent_span_id: parentSpanId,
-                    metadata: scanStatus
-                        ? { ...(envelopeMetadata ?? {}), scan_status: scanStatus }
-                        : envelopeMetadata,
-                };
-                if (this._persisted?.hubAddress) {
-                    payload.hub_address = this._persisted.hubAddress;
-                }
-                this._ws.send(JSON.stringify({
-                    event: "message",
-                    data: payload,
-                }));
-            }
-            else {
-                // Queue for later
-                if (!this._persisted.outboundQueue) {
-                    this._persisted.outboundQueue = [];
-                }
-                if (this._persisted.outboundQueue.length >= 50) {
-                    this._persisted.outboundQueue.shift(); // Drop oldest
-                    console.warn("[SecureChannel] Outbound queue full, dropping oldest message");
-                }
-                this._persisted.outboundQueue.push(msg);
-                console.log(`[SecureChannel] Message queued (state=${this._state}, queue=${this._persisted.outboundQueue.length})`);
-            }
-        }
-        // Persist all ratchet states after encrypt
-        await this._persistState();
-    }
-    /**
-     * Send a typing indicator to all owner devices.
-     * Ephemeral (unencrypted metadata), no ratchet advancement.
-     */
-    sendTyping() {
-        if (!this._ws || this._ws.readyState !== WebSocket.OPEN)
-            return;
-        for (const convId of this._sessions.keys()) {
-            this._ws.send(JSON.stringify({
-                event: "typing",
-                data: { conversation_id: convId },
-            }));
-        }
-    }
-    /**
-     * Send a decision request to the owner.
-     * Builds a structured envelope with decision metadata and sends it
-     * as a high-priority message. Returns the generated decision_id.
-     */
-    async sendDecisionRequest(request) {
-        const decision_id = `dec_${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-        const payload = JSON.stringify({
-            type: "message",
-            text: `\u{1F4CB} ${request.title}`,
-            decision: {
-                decision_id,
-                ...request,
-            },
-        });
-        await this.send(payload, {
-            messageType: "decision_request",
-            priority: "high",
-            metadata: {
-                decision_id,
-                title: request.title,
-                description: request.description,
-                options: request.options,
-                context_refs: request.context_refs,
-                deadline: request.deadline,
-                auto_action: request.auto_action,
-            },
-        });
-        return decision_id;
-    }
-    /**
-     * Wait for a decision response matching the given decisionId.
-     * Listens on the "message" event for messages where
-     * metadata.messageType === "decision_response" and the parsed plaintext
-     * contains a matching decision.decision_id.
-     * Optional timeout rejects with an Error.
-     */
-    waitForDecision(decisionId, timeoutMs) {
-        return new Promise((resolve, reject) => {
-            let timer = null;
-            const handler = (plaintext, metadata) => {
-                if (metadata.messageType !== "decision_response")
-                    return;
-                try {
-                    const parsed = JSON.parse(plaintext);
-                    if (parsed.decision?.decision_id === decisionId) {
-                        if (timer)
-                            clearTimeout(timer);
-                        this.removeListener("message", handler);
-                        resolve({
-                            decision_id: parsed.decision.decision_id,
-                            selected_option_id: parsed.decision.selected_option_id,
-                            resolved_at: parsed.decision.resolved_at,
-                            action: parsed.decision.action,
-                            defer_until: parsed.decision.defer_until,
-                            defer_reason: parsed.decision.defer_reason,
-                        });
-                    }
-                }
-                catch {
-                    // Not valid JSON, ignore
-                }
-            };
-            this.on("message", handler);
-            if (timeoutMs !== undefined) {
-                timer = setTimeout(() => {
-                    this.removeListener("message", handler);
-                    reject(new Error(`Decision ${decisionId} timed out after ${timeoutMs}ms`));
-                }, timeoutMs);
-            }
-        });
-    }
-    // --- Multi-agent room methods ---
-    /**
-     * Join a room by performing X3DH key exchange with each member
-     * for the pairwise conversations involving this device.
-     */
-    async joinRoom(roomData) {
-        if (!this._persisted) {
-            throw new Error("Channel not initialized");
-        }
-        await sodium.ready;
-        const identity = this._persisted.identityKeypair;
-        const ephemeral = this._persisted.ephemeralKeypair;
-        const myDeviceId = this._deviceId;
-        const conversationIds = [];
-        for (const conv of roomData.conversations) {
-            // Only process conversations involving this device
-            if (conv.participantA !== myDeviceId && conv.participantB !== myDeviceId) {
-                continue;
-            }
-            const otherDeviceId = conv.participantA === myDeviceId ? conv.participantB : conv.participantA;
-            const otherMember = roomData.members.find((m) => m.deviceId === otherDeviceId);
-            if (!otherMember?.identityPublicKey) {
-                console.warn(`[SecureChannel] No public key for member ${otherDeviceId.slice(0, 8)}..., skipping`);
-                continue;
-            }
-            // Determine initiator: lexicographically smaller deviceId is the sender (initiator)
-            const isInitiator = myDeviceId < otherDeviceId;
-            const sharedSecret = performX3DH({
-                myIdentityPrivate: hexToBytes(identity.privateKey),
-                myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
-                theirIdentityPublic: hexToBytes(otherMember.identityPublicKey),
-                theirEphemeralPublic: hexToBytes(otherMember.ephemeralPublicKey ?? otherMember.identityPublicKey),
-                isInitiator,
-            });
-            const ratchet = isInitiator
-                ? DoubleRatchet.initSender(sharedSecret, {
-                    publicKey: hexToBytes(identity.publicKey),
-                    privateKey: hexToBytes(identity.privateKey),
-                    keyType: "ed25519",
-                })
-                : DoubleRatchet.initReceiver(sharedSecret, {
-                    publicKey: hexToBytes(identity.publicKey),
-                    privateKey: hexToBytes(identity.privateKey),
-                    keyType: "ed25519",
-                });
-            this._sessions.set(conv.id, {
-                ownerDeviceId: otherDeviceId,
-                ratchet,
-                activated: isInitiator, // initiator can send immediately
-            });
-            // Persist session
-            this._persisted.sessions[conv.id] = {
-                ownerDeviceId: otherDeviceId,
-                ratchetState: ratchet.serialize(),
-                activated: isInitiator,
-            };
-            conversationIds.push(conv.id);
-            console.log(`[SecureChannel] Room session initialized: conv ${conv.id.slice(0, 8)}... ` +
-                `with ${otherDeviceId.slice(0, 8)}... (initiator=${isInitiator})`);
-        }
-        // Store room state
-        if (!this._persisted.rooms) {
-            this._persisted.rooms = {};
-        }
-        this._persisted.rooms[roomData.roomId] = {
-            roomId: roomData.roomId,
-            name: roomData.name,
-            conversationIds,
-            members: roomData.members,
-        };
-        await this._persistState();
-        this.emit("room_joined", { roomId: roomData.roomId, name: roomData.name });
-    }
-    /**
-     * Send an encrypted message to all members of a room.
-     * Each pairwise conversation gets the plaintext encrypted independently.
-     */
-    async sendToRoom(roomId, plaintext, opts) {
-        if (!this._persisted?.rooms?.[roomId]) {
-            throw new Error(`Room ${roomId} not found`);
-        }
-        const room = this._persisted.rooms[roomId];
-        const messageType = opts?.messageType ?? "text";
-        const recipients = [];
-        for (const convId of room.conversationIds) {
-            const session = this._sessions.get(convId);
-            if (!session) {
-                console.warn(`[SecureChannel] No session for room conv ${convId.slice(0, 8)}..., skipping`);
-                continue;
-            }
-            const encrypted = session.ratchet.encrypt(plaintext);
-            const transport = encryptedMessageToTransport(encrypted);
-            recipients.push({
-                device_id: session.ownerDeviceId,
-                header_blob: transport.header_blob,
-                ciphertext: transport.ciphertext,
-            });
-        }
-        if (recipients.length === 0) {
-            throw new Error("No active sessions in room");
-        }
-        if (this._state === "ready" && this._ws) {
-            this._ws.send(JSON.stringify({
-                event: "room_message",
-                room_id: roomId,
-                recipients,
-                message_type: messageType,
-            }));
-        }
-        else {
-            // HTTP fallback
-            try {
-                const res = await fetch(`${this.config.apiUrl}/api/v1/rooms/${roomId}/messages`, {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/json",
-                        Authorization: `Bearer ${this._deviceJwt}`,
-                    },
-                    body: JSON.stringify({ recipients, message_type: messageType }),
-                });
-                if (!res.ok) {
-                    const detail = await res.text();
-                    throw new Error(`Room message failed (${res.status}): ${detail}`);
-                }
-            }
-            catch (err) {
-                throw new Error(`Failed to send room message: ${err}`);
-            }
-        }
-        await this._persistState();
-    }
-    /**
-     * Leave a room: remove sessions and persisted room state.
-     */
-    async leaveRoom(roomId) {
-        if (!this._persisted?.rooms?.[roomId]) {
-            return; // Already left or never joined
-        }
-        const room = this._persisted.rooms[roomId];
-        // Remove sessions for this room's conversations
-        for (const convId of room.conversationIds) {
-            this._sessions.delete(convId);
-            delete this._persisted.sessions[convId];
-        }
-        // Remove room state
-        delete this._persisted.rooms[roomId];
-        await this._persistState();
-        this.emit("room_left", { roomId });
-    }
-    /**
-     * Return info for all joined rooms.
-     */
-    getRooms() {
-        if (!this._persisted?.rooms)
-            return [];
-        return Object.values(this._persisted.rooms).map((rs) => ({
-            roomId: rs.roomId,
-            name: rs.name,
-            members: rs.members,
-            conversationIds: rs.conversationIds,
-        }));
-    }
-    // --- Heartbeat and status methods ---
-    startHeartbeat(intervalSeconds, statusCallback) {
-        this.stopHeartbeat();
-        this._heartbeatCallback = statusCallback;
-        this._heartbeatIntervalSeconds = intervalSeconds;
-        this._sendHeartbeat();
-        this._heartbeatTimer = setInterval(() => {
-            this._sendHeartbeat();
-        }, intervalSeconds * 1000);
-    }
-    async stopHeartbeat() {
-        if (this._heartbeatTimer) {
-            clearInterval(this._heartbeatTimer);
-            this._heartbeatTimer = null;
-        }
-        if (this._heartbeatCallback && this._state === "ready") {
-            try {
-                await this.send(JSON.stringify({
-                    agent_status: "shutting_down",
-                    current_task: "",
-                    timestamp: new Date().toISOString(),
-                }), {
-                    messageType: "heartbeat",
-                    metadata: { next_heartbeat_seconds: this._heartbeatIntervalSeconds },
-                });
-            }
-            catch { /* best-effort shutdown heartbeat */ }
-        }
-        this._heartbeatCallback = null;
-    }
-    async sendStatusAlert(alert) {
-        const priority = alert.severity === "error" || alert.severity === "critical"
-            ? "high" : "normal";
-        const envelope = {
-            title: alert.title,
-            message: alert.message,
-            severity: alert.severity,
-            timestamp: new Date().toISOString(),
-        };
-        if (alert.detail !== undefined)
-            envelope.detail = alert.detail;
-        if (alert.detailFormat !== undefined)
-            envelope.detail_format = alert.detailFormat;
-        if (alert.category !== undefined)
-            envelope.category = alert.category;
-        await this.send(JSON.stringify(envelope), {
-            messageType: "status_alert",
-            priority,
-            metadata: { severity: alert.severity },
-        });
-    }
-    async sendArtifact(artifact) {
-        if (this._state !== "ready" || this._sessions.size === 0 || !this._ws) {
-            throw new Error("Channel is not ready");
-        }
-        // Upload encrypted file via existing attachment infrastructure
-        const attachMeta = await this._uploadAttachment(artifact.filePath, this._primaryConversationId);
-        // Build artifact_share envelope
-        const envelope = JSON.stringify({
-            type: "artifact",
-            blob_id: attachMeta.blobId,
-            blob_url: attachMeta.blobUrl,
-            filename: artifact.filename,
-            mime_type: artifact.mimeType,
-            size_bytes: attachMeta.size,
-            description: artifact.description,
-            attachment: attachMeta,
-        });
-        const messageGroupId = randomUUID();
-        for (const [convId, session] of this._sessions) {
-            if (!session.activated)
-                continue;
-            const encrypted = session.ratchet.encrypt(envelope);
-            const transport = encryptedMessageToTransport(encrypted);
-            this._ws.send(JSON.stringify({
-                event: "message",
-                data: {
-                    conversation_id: convId,
-                    header_blob: transport.header_blob,
-                    ciphertext: transport.ciphertext,
-                    message_group_id: messageGroupId,
-                    message_type: "artifact_share",
-                },
-            }));
-        }
-        await this._persistState();
-    }
-    async sendActionConfirmation(confirmation) {
-        const envelope = {
-            type: "action_confirmation",
-            action: confirmation.action,
-            status: confirmation.status,
-        };
-        if (confirmation.decisionId !== undefined)
-            envelope.decision_id = confirmation.decisionId;
-        if (confirmation.detail !== undefined)
-            envelope.detail = confirmation.detail;
-        await this.send(JSON.stringify(envelope), {
-            messageType: "action_confirmation",
-            metadata: { status: confirmation.status },
-        });
-    }
-    _sendHeartbeat() {
-        if (this._state !== "ready" || !this._heartbeatCallback)
-            return;
-        const status = this._heartbeatCallback();
-        this.send(JSON.stringify({
-            agent_status: status.agent_status,
-            current_task: status.current_task,
-            timestamp: new Date().toISOString(),
-        }), {
-            messageType: "heartbeat",
-            metadata: { next_heartbeat_seconds: this._heartbeatIntervalSeconds },
-        }).catch((err) => {
-            this.emit("error", new Error(`Heartbeat send failed: ${err}`));
-        });
-    }
-    async stop() {
-        this._stopped = true;
-        await this.stopHeartbeat();
-        this._flushAcks(); // Send any pending ACKs before stopping
-        this._stopPing();
-        this._stopWakeDetector();
-        this._stopPendingPoll();
-        this._stopPollFallback();
-        this._stopHttpServer();
-        if (this._ackTimer) {
-            clearTimeout(this._ackTimer);
-            this._ackTimer = null;
-        }
-        if (this._pollTimer) {
-            clearTimeout(this._pollTimer);
-            this._pollTimer = null;
-        }
-        if (this._reconnectTimer) {
-            clearTimeout(this._reconnectTimer);
-            this._reconnectTimer = null;
-        }
-        if (this._ws) {
-            this._ws.removeAllListeners();
-            this._ws.close();
-            this._ws = null;
-        }
-        this._setState("disconnected");
-    }
-    // --- Local HTTP server for proactive sends ---
-    startHttpServer(port) {
-        if (this._httpServer)
-            return;
-        this._httpServer = createServer(async (req, res) => {
-            // Only accept local connections
-            const remote = req.socket.remoteAddress;
-            if (remote !== "127.0.0.1" && remote !== "::1" && remote !== "::ffff:127.0.0.1") {
-                res.writeHead(403, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ ok: false, error: "Forbidden" }));
-                return;
-            }
-            if (req.method === "POST" && req.url === "/send") {
-                let body = "";
-                req.on("data", (chunk) => { body += chunk.toString(); });
-                req.on("end", async () => {
-                    try {
-                        const parsed = JSON.parse(body);
-                        const text = parsed.text;
-                        if (!text || typeof text !== "string") {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ ok: false, error: "Missing 'text' field" }));
-                            return;
-                        }
-                        // Optional file attachment
-                        if (parsed.file_path && typeof parsed.file_path === "string") {
-                            await this.sendWithAttachment(text, parsed.file_path, { topicId: parsed.topicId });
-                        }
-                        else {
-                            await this.send(text, { topicId: parsed.topicId });
-                        }
-                        res.writeHead(200, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ ok: true }));
-                    }
-                    catch (err) {
-                        res.writeHead(500, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ ok: false, error: String(err) }));
-                    }
-                });
-            }
-            else if (req.method === "GET" && req.url === "/status") {
-                res.writeHead(200, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({
-                    ok: true,
-                    state: this._state,
-                    deviceId: this._deviceId,
-                    sessions: this._sessions.size,
-                }));
-            }
-            else {
-                res.writeHead(404, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ ok: false, error: "Not found. Use POST /send or GET /status" }));
-            }
-        });
-        this._httpServer.listen(port, "127.0.0.1", () => {
-            this.emit("http-ready", port);
-        });
-    }
-    _stopHttpServer() {
-        if (this._httpServer) {
-            this._httpServer.close();
-            this._httpServer = null;
-        }
-    }
-    // --- Topic management ---
-    /**
-     * Create a new topic within the conversation group.
-     * Requires the channel to be initialized with a groupId (from activation).
-     */
-    async createTopic(name) {
-        if (!this._persisted?.groupId) {
-            throw new Error("Channel not initialized or groupId unknown");
-        }
-        if (!this._deviceJwt) {
-            throw new Error("Channel not authenticated");
-        }
-        const res = await fetch(`${this.config.apiUrl}/api/v1/topics`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${this._deviceJwt}`,
-            },
-            body: JSON.stringify({
-                group_id: this._persisted.groupId,
-                name,
-                creator_device_id: this._persisted.deviceId,
-            }),
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`Create topic failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const topic = { id: resp.id, name: resp.name, isDefault: resp.is_default };
-        if (!this._persisted.topics) {
-            this._persisted.topics = [];
-        }
-        this._persisted.topics.push(topic);
-        await this._persistState();
-        return topic;
-    }
-    /**
-     * List all topics in the conversation group.
-     * Requires the channel to be initialized with a groupId (from activation).
-     */
-    async listTopics() {
-        if (!this._persisted?.groupId) {
-            throw new Error("Channel not initialized or groupId unknown");
-        }
-        if (!this._deviceJwt) {
-            throw new Error("Channel not authenticated");
-        }
-        const res = await fetch(`${this.config.apiUrl}/api/v1/topics?group_id=${encodeURIComponent(this._persisted.groupId)}`, {
-            headers: {
-                Authorization: `Bearer ${this._deviceJwt}`,
-            },
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`List topics failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const topics = resp.map((t) => ({ id: t.id, name: t.name, isDefault: t.is_default }));
-        this._persisted.topics = topics;
-        await this._persistState();
-        return topics;
-    }
-    // --- A2A Channel methods (agent-to-agent communication) ---
-    /**
-     * Request a new A2A channel with another agent by their hub address.
-     * Returns the channel_id from the server response.
-     */
-    async requestA2AChannel(responderHubAddress) {
-        if (!this._persisted?.hubAddress) {
-            throw new Error("This agent does not have a hub address assigned");
-        }
-        if (!this._deviceJwt) {
-            throw new Error("Channel not authenticated");
-        }
-        const res = await fetch(`${this.config.apiUrl}/api/v1/a2a/channels/request`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${this._deviceJwt}`,
-            },
-            body: JSON.stringify({
-                initiator_hub_address: this._persisted.hubAddress,
-                responder_hub_address: responderHubAddress,
-            }),
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`A2A channel request failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const channelId = resp.channel_id || resp.id;
-        // Store channel info in persisted state
-        if (!this._persisted.a2aChannels) {
-            this._persisted.a2aChannels = {};
-        }
-        this._persisted.a2aChannels[channelId] = {
-            channelId,
-            hubAddress: responderHubAddress,
-            conversationId: resp.conversation_id || "",
-        };
-        await this._persistState();
-        return channelId;
-    }
-    /**
-     * Send a message to another agent via an active A2A channel.
-     * Looks up the A2A conversation by hub address and sends via WS.
-     *
-     * If the channel has an established E2E session, the message is encrypted
-     * with the Double Ratchet. If the responder hasn't received the initiator's
-     * first message yet (ratchet not activated), the message is queued locally
-     * and flushed when the first inbound message arrives.
-     *
-     * Falls back to plaintext for channels without a session (legacy/pre-encryption).
-     */
-    async sendToAgent(hubAddress, text, opts) {
-        if (!this._persisted?.a2aChannels) {
-            throw new Error("No A2A channels established");
-        }
-        // Find the active channel for this hub address
-        const channelEntry = Object.values(this._persisted.a2aChannels).find((ch) => ch.hubAddress === hubAddress);
-        if (!channelEntry) {
-            throw new Error(`No A2A channel found for hub address: ${hubAddress}`);
-        }
-        if (!channelEntry.conversationId) {
-            throw new Error(`A2A channel ${channelEntry.channelId} does not have a conversation yet (not activated)`);
-        }
-        if (this._state !== "ready" || !this._ws) {
-            throw new Error("Channel is not connected");
-        }
-        // --- E2E encrypted path ---
-        if (channelEntry.session?.ratchetState) {
-            // Responder must wait for first initiator message before sending
-            if (channelEntry.role === "responder" && !channelEntry.session.activated) {
-                if (!this._a2aPendingQueue[channelEntry.channelId]) {
-                    this._a2aPendingQueue[channelEntry.channelId] = [];
-                }
-                this._a2aPendingQueue[channelEntry.channelId].push({ text, opts });
-                console.log(`[SecureChannel] A2A message queued (responder not yet activated, ` +
-                    `queue=${this._a2aPendingQueue[channelEntry.channelId].length})`);
-                return;
-            }
-            // Deserialize ratchet, encrypt, update state
-            const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
-            const encrypted = ratchet.encrypt(text);
-            // Serialize header for transport (hex-encoded JSON)
-            const headerObj = {
-                dhPublicKey: bytesToHex(encrypted.header.dhPublicKey),
-                previousChainLength: encrypted.header.previousChainLength,
-                messageNumber: encrypted.header.messageNumber,
-            };
-            const headerBlobHex = Buffer.from(JSON.stringify(headerObj)).toString("hex");
-            const payload = {
-                channel_id: channelEntry.channelId,
-                conversation_id: channelEntry.conversationId,
-                header_blob: headerBlobHex,
-                header_signature: bytesToHex(encrypted.headerSignature),
-                ciphertext: bytesToHex(encrypted.ciphertext),
-                nonce: bytesToHex(encrypted.nonce),
-                parent_span_id: opts?.parentSpanId,
-            };
-            if (this._persisted.hubAddress) {
-                payload.hub_address = this._persisted.hubAddress;
-            }
-            // Update persisted ratchet state
-            channelEntry.session.ratchetState = ratchet.serialize();
-            await this._persistState();
-            this._ws.send(JSON.stringify({
-                event: "a2a_message",
-                data: payload,
-            }));
-            return;
-        }
-        // --- Legacy plaintext fallback (no session) ---
-        const payload = {
-            conversation_id: channelEntry.conversationId,
-            plaintext: text,
-            message_type: "a2a",
-            parent_span_id: opts?.parentSpanId,
-        };
-        if (this._persisted.hubAddress) {
-            payload.hub_address = this._persisted.hubAddress;
-        }
-        this._ws.send(JSON.stringify({
-            event: "a2a_message",
-            data: payload,
-        }));
-    }
-    /**
-     * List all A2A channels for this agent.
-     * Fetches from the server and updates local persisted state.
-     */
-    async listA2AChannels() {
-        if (!this._deviceJwt) {
-            throw new Error("Channel not authenticated");
-        }
-        const res = await fetch(`${this.config.apiUrl}/api/v1/a2a/channels`, {
-            headers: {
-                Authorization: `Bearer ${this._deviceJwt}`,
-            },
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`List A2A channels failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const channels = resp.map((ch) => ({
-            channelId: ch.channel_id || ch.id,
-            initiatorHubAddress: ch.initiator_hub_address,
-            responderHubAddress: ch.responder_hub_address,
-            conversationId: ch.conversation_id,
-            status: ch.status,
-            createdAt: ch.created_at,
-        }));
-        // Update persisted a2aChannels map with latest server data
-        if (this._persisted) {
-            if (!this._persisted.a2aChannels) {
-                this._persisted.a2aChannels = {};
-            }
-            for (const ch of channels) {
-                if (ch.status === "active" || ch.status === "approved") {
-                    const otherAddress = ch.initiatorHubAddress === this._persisted.hubAddress
-                        ? ch.responderHubAddress
-                        : ch.initiatorHubAddress;
-                    this._persisted.a2aChannels[ch.channelId] = {
-                        channelId: ch.channelId,
-                        hubAddress: otherAddress,
-                        conversationId: ch.conversationId || "",
-                    };
-                }
-            }
-            await this._persistState();
-        }
-        return channels;
-    }
-    // --- Internal lifecycle ---
-    async _enroll() {
-        this._setState("enrolling");
-        try {
-            const identity = await generateIdentityKeypair();
-            const ephemeral = await generateEphemeralKeypair();
-            const fingerprint = computeFingerprint(identity.publicKey);
-            const proof = createProofOfPossession(identity.privateKey, identity.publicKey);
-            const result = await enrollDevice(this.config.apiUrl, this.config.inviteToken, bytesToHex(identity.publicKey), bytesToHex(ephemeral.publicKey), bytesToHex(proof), this.config.platform);
-            this._deviceId = result.device_id;
-            this._fingerprint = result.fingerprint;
-            // Store keypairs temporarily for activation (not persisted yet -- no JWT)
-            this._persisted = {
-                deviceId: result.device_id,
-                deviceJwt: "", // set after activation
-                primaryConversationId: "", // set after activation
-                sessions: {}, // populated after activation
-                identityKeypair: {
-                    publicKey: bytesToHex(identity.publicKey),
-                    privateKey: bytesToHex(identity.privateKey),
-                },
-                ephemeralKeypair: {
-                    publicKey: bytesToHex(ephemeral.publicKey),
-                    privateKey: bytesToHex(ephemeral.privateKey),
-                },
-                fingerprint: result.fingerprint,
-                messageHistory: [],
-            };
-            this._poll();
-        }
-        catch (err) {
-            this._handleError(err);
-        }
-    }
-    _poll() {
-        if (this._stopped)
-            return;
-        this._setState("polling");
-        const doPoll = async () => {
-            if (this._stopped)
-                return;
-            try {
-                const status = await pollDeviceStatus(this.config.apiUrl, this._deviceId);
-                if (status.rateLimited) {
-                    // Server rate-limited this poll — back off 2x before retrying
-                    this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS * 2);
-                    return;
-                }
-                if (status.status === "APPROVED") {
-                    await this._activate();
-                    return;
-                }
-                if (status.status === "REVOKED") {
-                    this._handleError(new Error("Device was revoked"));
-                    return;
-                }
-                // Still PENDING -- poll again
-                this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS);
-            }
-            catch (err) {
-                this._handleError(err);
-            }
-        };
-        this._pollTimer = setTimeout(doPoll, POLL_INTERVAL_MS);
-    }
-    async _activate() {
-        this._setState("activating");
-        try {
-            const result = await activateDevice(this.config.apiUrl, this._deviceId);
-            // Support both old (single conversation_id) and new (conversations array) response
-            const conversations = result.conversations || [
-                {
-                    conversation_id: result.conversation_id,
-                    owner_device_id: "",
-                    is_primary: true,
-                },
-            ];
-            const primary = conversations.find((c) => c.is_primary) || conversations[0];
-            this._primaryConversationId = primary.conversation_id;
-            this._deviceJwt = result.device_jwt;
-            const identity = this._persisted.identityKeypair;
-            const ephemeral = this._persisted.ephemeralKeypair;
-            const sessions = {};
-            // Initialize X3DH + ratchet for EVERY conversation (not just primary)
-            for (const conv of conversations) {
-                // Use per-conversation owner keys if available, fallback to primary keys
-                const ownerIdentityKey = conv.owner_identity_public_key || result.owner_identity_public_key;
-                const ownerEphemeralKey = conv.owner_ephemeral_public_key ||
-                    result.owner_ephemeral_public_key ||
-                    ownerIdentityKey;
-                const sharedSecret = performX3DH({
-                    myIdentityPrivate: hexToBytes(identity.privateKey),
-                    myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
-                    theirIdentityPublic: hexToBytes(ownerIdentityKey),
-                    theirEphemeralPublic: hexToBytes(ownerEphemeralKey),
-                    isInitiator: false,
-                });
-                const ratchet = DoubleRatchet.initReceiver(sharedSecret, {
-                    publicKey: hexToBytes(identity.publicKey),
-                    privateKey: hexToBytes(identity.privateKey),
-                    keyType: "ed25519",
-                });
-                this._sessions.set(conv.conversation_id, {
-                    ownerDeviceId: conv.owner_device_id,
-                    ratchet,
-                    activated: false, // Wait for owner's first message before sending to this session
-                });
-                sessions[conv.conversation_id] = {
-                    ownerDeviceId: conv.owner_device_id,
-                    ratchetState: ratchet.serialize(),
-                };
-                console.log(`[SecureChannel] Session initialized for conv ${conv.conversation_id.slice(0, 8)}... (owner ${conv.owner_device_id.slice(0, 8)}..., primary=${conv.is_primary})`);
-            }
-            // Persist full state (preserve existing messageHistory)
-            this._persisted = {
-                ...this._persisted,
-                deviceJwt: result.device_jwt,
-                primaryConversationId: primary.conversation_id,
-                sessions,
-                messageHistory: this._persisted.messageHistory ?? [],
-            };
-            // Store group_id and default_topic_id for topic API calls
-            if (conversations.length > 0) {
-                const firstConv = conversations[0];
-                if (firstConv.group_id) {
-                    this._persisted.groupId = firstConv.group_id;
-                }
-                if (firstConv.default_topic_id) {
-                    this._persisted.defaultTopicId = firstConv.default_topic_id;
-                }
-            }
-            await saveState(this.config.dataDir, this._persisted);
-            // Register webhook if configured
-            if (this.config.webhookUrl) {
-                try {
-                    const webhookResp = await fetch(`${this.config.apiUrl}/api/v1/devices/self/webhook`, {
-                        method: "PATCH",
-                        headers: {
-                            "Content-Type": "application/json",
-                            Authorization: `Bearer ${this._deviceJwt}`,
-                        },
-                        body: JSON.stringify({ webhook_url: this.config.webhookUrl }),
-                    });
-                    if (webhookResp.ok) {
-                        const webhookData = await webhookResp.json();
-                        console.log(`[SecureChannel] Webhook registered: ${this.config.webhookUrl} (secret: ${webhookData.webhook_secret?.slice(0, 8)}...)`);
-                        this.emit("webhook_registered", {
-                            url: this.config.webhookUrl,
-                            secret: webhookData.webhook_secret,
-                        });
-                    }
-                    else {
-                        console.warn(`[SecureChannel] Webhook registration failed: ${webhookResp.status}`);
-                    }
-                }
-                catch (err) {
-                    console.warn(`[SecureChannel] Webhook registration error: ${err}`);
-                }
-            }
-            this._connect();
-        }
-        catch (err) {
-            this._handleError(err);
-        }
-    }
-    _connect() {
-        if (this._stopped)
-            return;
-        // Clear reconnect timer — we're connecting now, so any pending reconnect is superseded.
-        if (this._reconnectTimer) {
-            clearTimeout(this._reconnectTimer);
-            this._reconnectTimer = null;
-        }
-        // Clean up existing WebSocket to prevent reconnect cascade:
-        // The server disconnects old WS when same device reconnects, which fires
-        // the old close handler → _scheduleReconnect() → new _connect() → cascade.
-        if (this._ws) {
-            this._ws.removeAllListeners();
-            try {
-                this._ws.close();
-            }
-            catch { /* already closed */ }
-            this._ws = null;
-        }
-        this._setState("connecting");
-        const wsUrl = this.config.apiUrl.replace(/^http/, "ws");
-        const url = `${wsUrl}/api/v1/ws?token=${encodeURIComponent(this._deviceJwt)}&device_id=${this._deviceId}`;
-        const ws = new WebSocket(url);
-        this._ws = ws;
-        ws.on("open", async () => {
-            this._reconnectAttempt = 0;
-            this._startPing(ws);
-            this._startWakeDetector();
-            this._startPendingPoll();
-            // Sync missed messages before declaring ready
-            await this._syncMissedMessages();
-            await this._flushOutboundQueue();
-            this._setState("ready");
-            // Initialize client-side policy scanning if enabled
-            if (this.config.enableScanning) {
-                this._scanEngine = new ScanEngine();
-                await this._fetchScanRules();
-            }
-            this.emit("ready");
-        });
-        ws.on("message", async (raw) => {
-            this._lastServerMessage = Date.now();
-            this._lastWakeTick = Date.now();
-            try {
-                const data = JSON.parse(raw.toString());
-                if (data.event === "ping") {
-                    ws.send(JSON.stringify({ event: "pong" }));
-                    return;
-                }
-                if (data.event === "device_revoked") {
-                    await clearState(this.config.dataDir);
-                    this._handleError(new Error("Device was revoked"));
-                    return;
-                }
-                if (data.event === "device_linked") {
-                    await this._handleDeviceLinked(data.data);
-                    return;
-                }
-                if (data.event === "message") {
-                    await this._handleIncomingMessage(data.data);
-                }
-                if (data.event === "room_joined") {
-                    const d = data.data;
-                    this.joinRoom({
-                        roomId: d.room_id,
-                        name: d.name,
-                        members: (d.members || []).map((m) => ({
-                            deviceId: m.device_id,
-                            entityType: m.entity_type,
-                            displayName: m.display_name,
-                            identityPublicKey: m.identity_public_key,
-                            ephemeralPublicKey: m.ephemeral_public_key,
-                        })),
-                        conversations: (d.conversations || []).map((c) => ({
-                            id: c.id,
-                            participantA: c.participant_a,
-                            participantB: c.participant_b,
-                        })),
-                    }).catch((err) => this.emit("error", err));
-                }
-                if (data.event === "room_message") {
-                    await this._handleRoomMessage(data.data);
-                }
-                if (data.event === "room_participant_added") {
-                    const p = data.data;
-                    this.emit("room_participant_added", {
-                        roomId: p.room_id,
-                        participant: {
-                            deviceId: p.participant?.device_id ?? p.device_id,
-                            participantType: p.participant?.participant_type ?? p.participant_type ?? "human",
-                            displayName: p.participant?.display_name ?? p.display_name,
-                        },
-                    });
-                }
-                if (data.event === "room_participant_removed") {
-                    const p = data.data;
-                    this.emit("room_participant_removed", {
-                        roomId: p.room_id,
-                        participant: {
-                            deviceId: p.participant?.device_id ?? p.device_id,
-                            participantType: p.participant?.participant_type ?? p.participant_type ?? "human",
-                            displayName: p.participant?.display_name ?? p.display_name,
-                        },
-                    });
-                }
-                if (data.event === "policy_blocked") {
-                    this.emit("policy_blocked", data.data);
-                }
-                if (data.event === "message_held") {
-                    this.emit("message_held", data.data);
-                }
-                if (data.event === "policy_rejected") {
-                    this.emit("policy_rejected", data.data);
-                }
-                if (data.event === "scan_rules_updated") {
-                    await this._fetchScanRules();
-                    return;
-                }
-                if (data.event === "hub_identity_assigned") {
-                    if (this._persisted) {
-                        this._persisted.hubAddress = data.data.hub_address;
-                        this._persistState();
-                    }
-                    this.emit("hub_identity_assigned", data.data);
-                }
-                if (data.event === "hub_identity_removed") {
-                    if (this._persisted) {
-                        delete this._persisted.hubAddress;
-                        this._persistState();
-                    }
-                    this.emit("hub_identity_removed", data.data);
-                }
-                // --- A2A Channel WS events ---
-                if (data.event === "a2a_channel_approved") {
-                    const channelData = data.data || data;
-                    const channelId = channelData.channel_id;
-                    const convId = channelData.conversation_id;
-                    // Determine role: if we are the initiator hub address, we initiated
-                    const myHub = this._persisted?.hubAddress || "";
-                    const role = channelData.role ||
-                        (channelData.initiator_hub_address === myHub ? "initiator" : "responder");
-                    const peerHub = role === "initiator"
-                        ? channelData.responder_hub_address || ""
-                        : channelData.initiator_hub_address || "";
-                    // Store in persisted state
-                    if (this._persisted && convId) {
-                        if (!this._persisted.a2aChannels)
-                            this._persisted.a2aChannels = {};
-                        // Generate ephemeral X25519 keypair for key exchange
-                        const a2aEphemeral = await generateEphemeralKeypair();
-                        const ephPubHex = bytesToHex(a2aEphemeral.publicKey);
-                        const ephPrivHex = bytesToHex(a2aEphemeral.privateKey);
-                        this._persisted.a2aChannels[channelId] = {
-                            channelId,
-                            hubAddress: peerHub,
-                            conversationId: convId,
-                            role,
-                            pendingEphemeralPrivateKey: ephPrivHex,
-                        };
-                        // Send ephemeral public key to server for key exchange
-                        if (this._ws) {
-                            this._ws.send(JSON.stringify({
-                                event: "a2a_key_exchange",
-                                data: {
-                                    channel_id: channelId,
-                                    ephemeral_key: ephPubHex,
-                                },
-                            }));
-                            console.log(`[SecureChannel] A2A key exchange sent for channel ${channelId.slice(0, 8)}... (role=${role})`);
-                        }
-                        await this._persistState();
-                    }
-                    this.emit("a2a_channel_approved", channelData);
-                }
-                if (data.event === "a2a_channel_activated") {
-                    const actData = data.data || data;
-                    const channelId = actData.channel_id;
-                    const convId = actData.conversation_id;
-                    const activatedRole = actData.role;
-                    const peerIdentityHex = actData.peer_identity_key;
-                    const peerEphemeralHex = actData.peer_ephemeral_key;
-                    const channelEntry = this._persisted?.a2aChannels?.[channelId];
-                    if (channelEntry && channelEntry.pendingEphemeralPrivateKey && this._persisted) {
-                        try {
-                            // Reconstruct keys from hex
-                            const myIdentityPrivate = hexToBytes(this._persisted.identityKeypair.privateKey);
-                            const myIdentityPublic = hexToBytes(this._persisted.identityKeypair.publicKey);
-                            const myEphemeralPrivate = hexToBytes(channelEntry.pendingEphemeralPrivateKey);
-                            const theirIdentityPublic = hexToBytes(peerIdentityHex);
-                            const theirEphemeralPublic = hexToBytes(peerEphemeralHex);
-                            // Perform X3DH key agreement
-                            const sharedSecret = performX3DH({
-                                myIdentityPrivate,
-                                myEphemeralPrivate,
-                                theirIdentityPublic,
-                                theirEphemeralPublic,
-                                isInitiator: activatedRole === "initiator",
-                            });
-                            // Initialize Double Ratchet
-                            const identityKp = {
-                                publicKey: myIdentityPublic,
-                                privateKey: myIdentityPrivate,
-                                keyType: "ed25519",
-                            };
-                            const ratchet = activatedRole === "initiator"
-                                ? DoubleRatchet.initSender(sharedSecret, identityKp)
-                                : DoubleRatchet.initReceiver(sharedSecret, identityKp);
-                            // Store session state
-                            channelEntry.session = {
-                                ownerDeviceId: "", // A2A sessions don't have an owner device
-                                ratchetState: ratchet.serialize(),
-                                activated: activatedRole === "initiator", // initiator can send immediately
-                            };
-                            channelEntry.role = activatedRole;
-                            if (convId)
-                                channelEntry.conversationId = convId;
-                            // Clean up ephemeral private key (no longer needed)
-                            delete channelEntry.pendingEphemeralPrivateKey;
-                            await this._persistState();
-                            console.log(`[SecureChannel] A2A channel activated: ${channelId.slice(0, 8)}... (role=${activatedRole}, ` +
-                                `canSend=${activatedRole === "initiator"})`);
-                        }
-                        catch (err) {
-                            console.error(`[SecureChannel] A2A activation failed for ${channelId.slice(0, 8)}...:`, err);
-                            this.emit("error", err);
-                        }
-                    }
-                    this.emit("a2a_channel_activated", actData);
-                }
-                if (data.event === "a2a_channel_rejected") {
-                    this.emit("a2a_channel_rejected", data.data || data);
-                }
-                if (data.event === "a2a_channel_revoked") {
-                    const channelData = data.data || data;
-                    const channelId = channelData.channel_id;
-                    // Remove from persisted state
-                    if (this._persisted?.a2aChannels?.[channelId]) {
-                        delete this._persisted.a2aChannels[channelId];
-                        await this._persistState();
-                    }
-                    this.emit("a2a_channel_revoked", channelData);
-                }
-                if (data.event === "a2a_message") {
-                    const msgData = data.data || data;
-                    // --- Encrypted A2A message (has ciphertext field) ---
-                    if (msgData.ciphertext && msgData.header_blob) {
-                        const channelId = msgData.channel_id || "";
-                        const channelEntry = this._persisted?.a2aChannels?.[channelId];
-                        if (channelEntry?.session?.ratchetState) {
-                            try {
-                                // Reconstruct EncryptedMessage from hex transport
-                                const headerJson = Buffer.from(msgData.header_blob, "hex").toString("utf-8");
-                                const headerObj = JSON.parse(headerJson);
-                                const encryptedMessage = {
-                                    header: {
-                                        dhPublicKey: hexToBytes(headerObj.dhPublicKey),
-                                        previousChainLength: headerObj.previousChainLength,
-                                        messageNumber: headerObj.messageNumber,
-                                    },
-                                    headerSignature: hexToBytes(msgData.header_signature),
-                                    ciphertext: hexToBytes(msgData.ciphertext),
-                                    nonce: hexToBytes(msgData.nonce),
-                                };
-                                // Decrypt
-                                const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
-                                const plaintext = ratchet.decrypt(encryptedMessage);
-                                // Update ratchet state
-                                channelEntry.session.ratchetState = ratchet.serialize();
-                                // If responder and not yet activated, this is the first initiator message
-                                if (channelEntry.role === "responder" && !channelEntry.session.activated) {
-                                    channelEntry.session.activated = true;
-                                    console.log(`[SecureChannel] A2A responder ratchet activated for ${channelId.slice(0, 8)}...`);
-                                    // Flush any queued messages
-                                    const queued = this._a2aPendingQueue[channelId];
-                                    if (queued && queued.length > 0) {
-                                        delete this._a2aPendingQueue[channelId];
-                                        console.log(`[SecureChannel] Flushing ${queued.length} queued A2A message(s)`);
-                                        // Flush asynchronously after persisting current state
-                                        await this._persistState();
-                                        for (const pending of queued) {
-                                            try {
-                                                await this.sendToAgent(channelEntry.hubAddress, pending.text, pending.opts);
-                                            }
-                                            catch (flushErr) {
-                                                console.error("[SecureChannel] Failed to flush queued A2A message:", flushErr);
-                                            }
-                                        }
-                                    }
-                                }
-                                await this._persistState();
-                                const a2aMsg = {
-                                    text: plaintext,
-                                    fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
-                                    channelId,
-                                    conversationId: msgData.conversation_id || "",
-                                    parentSpanId: msgData.parent_span_id,
-                                    timestamp: msgData.timestamp || new Date().toISOString(),
-                                };
-                                this.emit("a2a_message", a2aMsg);
-                                if (this.config.onA2AMessage) {
-                                    this.config.onA2AMessage(a2aMsg);
-                                }
-                            }
-                            catch (decryptErr) {
-                                console.error(`[SecureChannel] A2A decrypt failed for channel ${channelId.slice(0, 8)}...:`, decryptErr);
-                                this.emit("error", decryptErr);
-                            }
-                        }
-                        else {
-                            console.warn(`[SecureChannel] Received encrypted A2A message but no session for channel ${channelId}`);
-                        }
-                    }
-                    else {
-                        // --- Legacy plaintext A2A message ---
-                        const a2aMsg = {
-                            text: msgData.plaintext || msgData.text,
-                            fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
-                            channelId: msgData.channel_id || "",
-                            conversationId: msgData.conversation_id || "",
-                            parentSpanId: msgData.parent_span_id,
-                            timestamp: msgData.timestamp || new Date().toISOString(),
-                        };
-                        this.emit("a2a_message", a2aMsg);
-                        if (this.config.onA2AMessage) {
-                            this.config.onA2AMessage(a2aMsg);
-                        }
-                    }
-                }
-            }
-            catch (err) {
-                this.emit("error", err);
-            }
-        });
-        ws.on("close", () => {
-            this._stopPing();
-            this._stopWakeDetector();
-            this._stopPendingPoll();
-            if (this._stopped)
-                return;
-            this._setState("disconnected");
-            this._scheduleReconnect();
-        });
-        ws.on("error", (err) => {
-            this.emit("error", err);
-            // The close event will fire after this and handle reconnection
-        });
-    }
-    /**
-     * Handle an incoming encrypted message from a specific conversation.
-     * Decrypts using the appropriate session ratchet, emits to the agent,
-     * and relays as sync messages to sibling sessions.
-     */
-    async _handleIncomingMessage(msgData) {
-        // Don't decrypt our own messages
-        if (msgData.sender_device_id === this._deviceId)
-            return;
-        // Dedup: skip if this message was already processed during sync
-        if (this._syncMessageIds?.has(msgData.message_id)) {
-            return;
-        }
-        const convId = msgData.conversation_id;
-        const session = this._sessions.get(convId);
-        if (!session) {
-            // Could be a message for a conversation we haven't initialized yet
-            console.warn(`[SecureChannel] No session for conversation ${convId}, skipping`);
-            return;
-        }
-        const encrypted = transportToEncryptedMessage({
-            header_blob: msgData.header_blob,
-            ciphertext: msgData.ciphertext,
-        });
-        const plaintext = session.ratchet.decrypt(encrypted);
-        // ACK delivery to server
-        this._sendAck(msgData.message_id);
-        // Mark session as activated on first owner message
-        if (!session.activated) {
-            session.activated = true;
-            console.log(`[SecureChannel] Session ${convId.slice(0, 8)}... activated by first owner message`);
-        }
-        // Parse structured payload (new format) or treat as raw text (legacy)
-        let messageText;
-        let messageType;
-        let attachmentInfo = null;
-        try {
-            const parsed = JSON.parse(plaintext);
-            messageType = parsed.type || "message";
-            messageText = parsed.text || plaintext;
-            if (parsed.attachment) {
-                attachmentInfo = parsed.attachment;
-            }
-        }
-        catch {
-            // Legacy plain string format
-            messageType = "message";
-            messageText = plaintext;
-        }
-        if (messageType === "session_init") {
-            // New device session activated — replay message history
-            console.log(`[SecureChannel] session_init received for ${convId.slice(0, 8)}..., replaying history`);
-            await this._replayHistoryToSession(convId);
-            await this._persistState();
-            return;
-        }
-        // Inbound scan — after decryption
-        if (this._scanEngine) {
-            const scanResult = this._scanEngine.scanInbound(messageText);
-            if (scanResult.status === "blocked") {
-                this.emit("scan_blocked", { direction: "inbound", violations: scanResult.violations });
-                return; // drop the message
-            }
-        }
-        if (messageType === "message") {
-            const topicId = msgData.topic_id;
-            // Handle attachment: download, decrypt, save to disk
-            let attachData;
-            if (attachmentInfo) {
-                try {
-                    const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
-                    attachData = {
-                        filename: attachmentInfo.filename,
-                        mime: attachmentInfo.mime,
-                        size: decrypted.length,
-                        filePath,
-                    };
-                    // For images: include base64 so LLM vision can see the content
-                    if (attachmentInfo.mime.startsWith("image/")) {
-                        attachData.base64 = `data:${attachmentInfo.mime};base64,${bytesToBase64(decrypted)}`;
-                    }
-                    // For text-based files: extract content inline
-                    const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
-                    if (textMimes.some((m) => attachmentInfo.mime.startsWith(m))) {
-                        attachData.textContent = new TextDecoder().decode(decrypted);
-                    }
-                }
-                catch (err) {
-                    console.error(`[SecureChannel] Failed to download attachment:`, err);
-                }
-            }
-            // Store owner message in history for cross-device replay
-            this._appendHistory("owner", messageText, topicId);
-            // Build display text with attachment content
-            let emitText = messageText;
-            if (attachData) {
-                if (attachData.textContent) {
-                    emitText = `[Attachment: ${attachData.filename} (${attachData.mime}) saved to ${attachData.filePath}]\n---\n${attachData.textContent}\n---\n\n${messageText}`;
-                }
-                else if (attachData.base64) {
-                    emitText = `[Image attachment: ${attachData.filename} saved to ${attachData.filePath}]\nUse your Read tool to view this image file.\n\n${messageText}`;
-                }
-                else {
-                    emitText = `[Attachment: ${attachData.filename} saved to ${attachData.filePath}]\n\n${messageText}`;
-                }
-            }
-            // Emit to agent developer
-            const metadata = {
-                messageId: msgData.message_id,
-                conversationId: convId,
-                timestamp: msgData.created_at,
-                topicId,
-                attachment: attachData,
-                spanId: msgData.span_id,
-                parentSpanId: msgData.parent_span_id,
-                messageType: msgData.message_type ?? "text",
-                priority: msgData.priority ?? "normal",
-                envelopeVersion: msgData.envelope_version ?? "1.0.0",
-            };
-            this.emit("message", emitText, metadata);
-            this.config.onMessage?.(emitText, metadata);
-            // Relay to sibling sessions as sync messages
-            await this._relaySyncToSiblings(convId, session.ownerDeviceId, messageText, topicId);
-        }
-        // If type === "sync", agent ignores it (sync is for owner devices only)
-        // Track last message timestamp for offline sync
-        if (this._persisted) {
-            this._persisted.lastMessageTimestamp = msgData.created_at;
-        }
-        // Persist all ratchet states after decrypt
-        await this._persistState();
-    }
-    /**
-     * Download an encrypted attachment blob, decrypt it, verify integrity,
-     * and save the plaintext file to disk.
-     */
-    async _downloadAndDecryptAttachment(info) {
-        const attachDir = join(this.config.dataDir, "attachments");
-        await mkdir(attachDir, { recursive: true });
-        // Download encrypted blob from API
-        const url = `${this.config.apiUrl}${info.blobUrl}`;
-        const res = await fetch(url, {
-            headers: { Authorization: `Bearer ${this._deviceJwt}` },
-        });
-        if (!res.ok) {
-            throw new Error(`Attachment download failed: ${res.status}`);
-        }
-        const buffer = await res.arrayBuffer();
-        const encryptedData = new Uint8Array(buffer);
-        // Verify integrity
-        const digest = computeFileDigest(encryptedData);
-        if (digest !== info.digest) {
-            throw new Error("Attachment digest mismatch — possible tampering");
-        }
-        // Decrypt
-        const fileKey = base64ToBytes(info.fileKey);
-        const fileNonce = base64ToBytes(info.fileNonce);
-        const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
-        // Save to disk
-        const filePath = join(attachDir, info.filename);
-        await writeFile(filePath, decrypted);
-        console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
-        return { filePath, decrypted };
-    }
-    /**
-     * Upload an attachment file: encrypt, upload to server, return metadata
-     * for inclusion in the message envelope.
-     */
-    async _uploadAttachment(filePath, conversationId) {
-        const data = await readFile(filePath);
-        const plainData = new Uint8Array(data);
-        const result = encryptFile(plainData);
-        // Upload encrypted blob via multipart form
-        const { Blob: NodeBlob, FormData: NodeFormData } = await import("node:buffer").then(() => globalThis);
-        const formData = new FormData();
-        formData.append("conversation_id", conversationId);
-        formData.append("file", new Blob([result.encryptedData.buffer], { type: "application/octet-stream" }), "attachment.bin");
-        const res = await fetch(`${this.config.apiUrl}/api/v1/attachments/upload`, {
-            method: "POST",
-            headers: { Authorization: `Bearer ${this._deviceJwt}` },
-            body: formData,
-        });
-        if (!res.ok) {
-            const detail = await res.text();
-            throw new Error(`Attachment upload failed (${res.status}): ${detail}`);
-        }
-        const resp = await res.json();
-        const filename = filePath.split("/").pop() || "file";
-        return {
-            blobId: resp.blob_id,
-            blobUrl: resp.blob_url,
-            fileKey: bytesToBase64(result.fileKey),
-            fileNonce: bytesToBase64(result.fileNonce),
-            digest: result.digest,
-            filename,
-            mime: "application/octet-stream",
-            size: plainData.length,
-        };
-    }
-    /**
-     * Send a message with an attached file. Encrypts the file, uploads it,
-     * then sends the envelope with attachment metadata via Double Ratchet.
-     */
-    async sendWithAttachment(plaintext, filePath, options) {
-        if (this._state !== "ready" || this._sessions.size === 0 || !this._ws) {
-            throw new Error("Channel is not ready");
-        }
-        const topicId = options?.topicId ?? this._persisted?.defaultTopicId;
-        // Upload attachment using primary conversation for the blob
-        const attachMeta = await this._uploadAttachment(filePath, this._primaryConversationId);
-        // Build envelope
-        const envelope = JSON.stringify({
-            type: "message",
-            text: plaintext,
-            topicId,
-            attachment: attachMeta,
-        });
-        // Store agent message in history
-        this._appendHistory("agent", plaintext, topicId);
-        const messageGroupId = randomUUID();
-        for (const [convId, session] of this._sessions) {
-            if (!session.activated)
-                continue;
-            const encrypted = session.ratchet.encrypt(envelope);
-            const transport = encryptedMessageToTransport(encrypted);
-            this._ws.send(JSON.stringify({
-                event: "message",
-                data: {
-                    conversation_id: convId,
-                    header_blob: transport.header_blob,
-                    ciphertext: transport.ciphertext,
-                    message_group_id: messageGroupId,
-                    topic_id: topicId,
-                },
-            }));
-        }
-        await this._persistState();
-    }
-    /**
-     * Relay an owner's message to all sibling sessions as encrypted sync messages.
-     * This allows all owner devices to see messages from any single device.
-     */
-    async _relaySyncToSiblings(sourceConvId, senderOwnerDeviceId, messageText, topicId) {
-        if (!this._ws || this._sessions.size <= 1)
-            return;
-        const syncPayload = JSON.stringify({
-            type: "sync",
-            sender: senderOwnerDeviceId,
-            text: messageText,
-            ts: new Date().toISOString(),
-            topicId,
-        });
-        for (const [siblingConvId, siblingSession] of this._sessions) {
-            if (siblingConvId === sourceConvId)
-                continue;
-            // Don't relay to sessions where owner hasn't sent their first message yet
-            if (!siblingSession.activated)
-                continue;
-            const syncEncrypted = siblingSession.ratchet.encrypt(syncPayload);
-            const syncTransport = encryptedMessageToTransport(syncEncrypted);
-            this._ws.send(JSON.stringify({
-                event: "message",
-                data: {
-                    conversation_id: siblingConvId,
-                    header_blob: syncTransport.header_blob,
-                    ciphertext: syncTransport.ciphertext,
-                },
-            }));
-        }
-    }
-    /**
-     * Send stored message history to a newly-activated session.
-     * Batches all history into a single encrypted message.
-     */
-    async _replayHistoryToSession(convId) {
-        const session = this._sessions.get(convId);
-        if (!session || !session.activated || !this._ws)
-            return;
-        const history = this._persisted?.messageHistory ?? [];
-        if (history.length === 0) {
-            console.log(`[SecureChannel] No history to replay for ${convId.slice(0, 8)}...`);
-            return;
-        }
-        console.log(`[SecureChannel] Replaying ${history.length} messages to session ${convId.slice(0, 8)}...`);
-        const replayPayload = JSON.stringify({
-            type: "history_replay",
-            messages: history,
-        });
-        const encrypted = session.ratchet.encrypt(replayPayload);
-        const transport = encryptedMessageToTransport(encrypted);
-        this._ws.send(JSON.stringify({
-            event: "message",
-            data: {
-                conversation_id: convId,
-                header_blob: transport.header_blob,
-                ciphertext: transport.ciphertext,
-            },
-        }));
-    }
-    /**
-     * Handle a device_linked event: a new owner device has joined.
-     * Fetches the new device's public keys, performs X3DH, and initializes
-     * a new ratchet session.
-     */
-    async _handleDeviceLinked(event) {
-        console.log(`[SecureChannel] New owner device linked: ${event.owner_device_id.slice(0, 8)}...`);
-        try {
-            if (!event.owner_identity_public_key) {
-                console.error(`[SecureChannel] device_linked event missing owner keys for conv ${event.conversation_id.slice(0, 8)}...`);
-                return;
-            }
-            const identity = this._persisted.identityKeypair;
-            const ephemeral = this._persisted.ephemeralKeypair;
-            // Perform X3DH as responder with the new owner device
-            const sharedSecret = performX3DH({
-                myIdentityPrivate: hexToBytes(identity.privateKey),
-                myEphemeralPrivate: hexToBytes(ephemeral.privateKey),
-                theirIdentityPublic: hexToBytes(event.owner_identity_public_key),
-                theirEphemeralPublic: hexToBytes(event.owner_ephemeral_public_key ?? event.owner_identity_public_key),
-                isInitiator: false,
-            });
-            // Initialize ratchet as receiver
-            const ratchet = DoubleRatchet.initReceiver(sharedSecret, {
-                publicKey: hexToBytes(identity.publicKey),
-                privateKey: hexToBytes(identity.privateKey),
-                keyType: "ed25519",
-            });
-            this._sessions.set(event.conversation_id, {
-                ownerDeviceId: event.owner_device_id,
-                ratchet,
-                activated: false, // Wait for owner's first message
-            });
-            // Persist
-            this._persisted.sessions[event.conversation_id] = {
-                ownerDeviceId: event.owner_device_id,
-                ratchetState: ratchet.serialize(),
-                activated: false,
-            };
-            await this._persistState();
-            console.log(`[SecureChannel] Session initialized for device ${event.owner_device_id.slice(0, 8)}... (conv ${event.conversation_id.slice(0, 8)}...)`);
-        }
-        catch (err) {
-            console.error(`[SecureChannel] Failed to handle device_linked:`, err);
-            this.emit("error", err);
-        }
-    }
-    /**
-     * Handle an incoming room message. Finds the pairwise conversation
-     * for the sender, decrypts, and emits a room_message event.
-     */
-    async _handleRoomMessage(msgData) {
-        // Don't decrypt our own messages
-        if (msgData.sender_device_id === this._deviceId)
-            return;
-        const convId = msgData.conversation_id ??
-            this._findConversationForSender(msgData.sender_device_id, msgData.room_id);
-        if (!convId) {
-            console.warn(`[SecureChannel] No conversation found for sender ${msgData.sender_device_id.slice(0, 8)}... in room ${msgData.room_id}`);
-            return;
-        }
-        const session = this._sessions.get(convId);
-        if (!session) {
-            console.warn(`[SecureChannel] No session for room conv ${convId.slice(0, 8)}..., skipping`);
-            return;
-        }
-        const encrypted = transportToEncryptedMessage({
-            header_blob: msgData.header_blob,
-            ciphertext: msgData.ciphertext,
-        });
-        const plaintext = session.ratchet.decrypt(encrypted);
-        // Activate session on first received message
-        if (!session.activated) {
-            session.activated = true;
-            console.log(`[SecureChannel] Room session ${convId.slice(0, 8)}... activated by first message`);
-        }
-        // ACK if message_id present
-        if (msgData.message_id) {
-            this._sendAck(msgData.message_id);
-        }
-        await this._persistState();
-        const metadata = {
-            messageId: msgData.message_id ?? "",
-            conversationId: convId,
-            timestamp: msgData.created_at ?? new Date().toISOString(),
-            messageType: msgData.message_type ?? "text",
-        };
-        this.emit("room_message", {
-            roomId: msgData.room_id,
-            senderDeviceId: msgData.sender_device_id,
-            plaintext,
-            messageType: msgData.message_type ?? "text",
-            timestamp: msgData.created_at ?? new Date().toISOString(),
-        });
-        this.config.onMessage?.(plaintext, metadata);
-    }
-    /**
-     * Find the pairwise conversation ID for a given sender in a room.
-     */
-    _findConversationForSender(senderDeviceId, roomId) {
-        const room = this._persisted?.rooms?.[roomId];
-        if (!room)
-            return null;
-        for (const convId of room.conversationIds) {
-            const session = this._sessions.get(convId);
-            if (session && session.ownerDeviceId === senderDeviceId) {
-                return convId;
-            }
-        }
-        return null;
-    }
-    /**
-     * Sync missed messages across ALL sessions.
-     * For each conversation, fetches messages since last sync and decrypts.
-     */
-    /**
-     * Paginated sync: fetch missed messages in pages of 200, up to 5 pages (1000 messages).
-     * Tracks message IDs in _syncMessageIds to prevent duplicate processing from concurrent WS messages.
-     */
-    async _syncMissedMessages() {
-        if (!this._persisted?.lastMessageTimestamp || !this._deviceJwt)
-            return;
-        this._syncMessageIds = new Set();
-        const MAX_PAGES = 5;
-        const PAGE_SIZE = 200;
-        let since = this._persisted.lastMessageTimestamp;
-        let totalProcessed = 0;
-        try {
-            for (let page = 0; page < MAX_PAGES; page++) {
-                const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/messages?since=${encodeURIComponent(since)}&limit=${PAGE_SIZE}`;
-                const res = await fetch(url, {
-                    headers: { Authorization: `Bearer ${this._deviceJwt}` },
-                });
-                if (!res.ok)
-                    break;
-                const messages = await res.json();
-                if (messages.length === 0)
-                    break;
-                for (const msg of messages) {
-                    if (msg.sender_device_id === this._deviceId)
-                        continue;
-                    // Dedup: skip if already processed
-                    if (this._syncMessageIds.has(msg.id))
-                        continue;
-                    this._syncMessageIds.add(msg.id);
-                    const session = this._sessions.get(msg.conversation_id);
-                    if (!session) {
-                        console.warn(`[SecureChannel] No session for conversation ${msg.conversation_id} during sync, skipping`);
-                        continue;
-                    }
-                    try {
-                        const encrypted = transportToEncryptedMessage({
-                            header_blob: msg.header_blob,
-                            ciphertext: msg.ciphertext,
-                        });
-                        const plaintext = session.ratchet.decrypt(encrypted);
-                        this._sendAck(msg.id);
-                        if (!session.activated) {
-                            session.activated = true;
-                            console.log(`[SecureChannel] Session ${msg.conversation_id.slice(0, 8)}... activated during sync`);
-                        }
-                        let messageText;
-                        let messageType;
-                        try {
-                            const parsed = JSON.parse(plaintext);
-                            messageType = parsed.type || "message";
-                            messageText = parsed.text || plaintext;
-                        }
-                        catch {
-                            messageType = "message";
-                            messageText = plaintext;
-                        }
-                        if (messageType === "message") {
-                            const topicId = msg.topic_id;
-                            this._appendHistory("owner", messageText, topicId);
-                            const metadata = {
-                                messageId: msg.id,
-                                conversationId: msg.conversation_id,
-                                timestamp: msg.created_at,
-                                topicId,
-                            };
-                            this.emit("message", messageText, metadata);
-                            this.config.onMessage?.(messageText, metadata);
-                        }
-                        this._persisted.lastMessageTimestamp = msg.created_at;
-                        since = msg.created_at;
-                        totalProcessed++;
-                    }
-                    catch (err) {
-                        this.emit("error", err);
-                        break; // Ratchet desync -- stop processing
-                    }
-                }
-                await this._persistState();
-                // If we got fewer than PAGE_SIZE, we've caught up
-                if (messages.length < PAGE_SIZE)
-                    break;
-            }
-            if (totalProcessed > 0) {
-                console.log(`[SecureChannel] Synced ${totalProcessed} missed messages`);
-            }
-        }
-        catch {
-            // Network error -- non-critical, will get messages via WS
-        }
-        this._syncMessageIds = null;
-    }
-    _sendAck(messageId) {
-        this._pendingAcks.push(messageId);
-        if (this._ackTimer)
-            clearTimeout(this._ackTimer);
-        this._ackTimer = setTimeout(() => this._flushAcks(), 500);
-    }
-    _flushAcks() {
-        if (this._pendingAcks.length === 0 || !this._ws)
-            return;
-        const batch = this._pendingAcks.splice(0, 50);
-        this._ws.send(JSON.stringify({ event: "ack", data: { message_ids: batch } }));
-    }
-    async _flushOutboundQueue() {
-        const queue = this._persisted?.outboundQueue;
-        if (!queue || queue.length === 0 || !this._ws)
-            return;
-        console.log(`[SecureChannel] Flushing ${queue.length} queued outbound messages`);
-        const messages = queue.splice(0); // Take all, clear queue
-        for (const msg of messages) {
-            try {
-                this._ws.send(JSON.stringify({
-                    event: "message",
-                    data: {
-                        conversation_id: msg.convId,
-                        header_blob: msg.headerBlob,
-                        ciphertext: msg.ciphertext,
-                        message_group_id: msg.messageGroupId,
-                        topic_id: msg.topicId,
-                    },
-                }));
-            }
-            catch (err) {
-                // Re-queue failed messages
-                if (!this._persisted.outboundQueue) {
-                    this._persisted.outboundQueue = [];
-                }
-                this._persisted.outboundQueue.push(msg);
-                console.warn(`[SecureChannel] Failed to flush message, re-queued: ${err}`);
-                break; // Stop flushing on first failure
-            }
-        }
-        await this._persistState();
-    }
-    _startPing(ws) {
-        this._stopPing(); // Clear any existing timers
-        this._lastServerMessage = Date.now();
-        this._pingTimer = setInterval(() => {
-            if (ws.readyState !== WebSocket.OPEN)
-                return;
-            const silence = Date.now() - this._lastServerMessage;
-            if (silence > SecureChannel.SILENCE_TIMEOUT_MS) {
-                console.log(`[SecureChannel] No server data for ${Math.round(silence / 1000)}s — reconnecting stale WebSocket`);
-                ws.terminate(); // Forces close → _scheduleReconnect fires
-            }
-        }, SecureChannel.PING_INTERVAL_MS);
-    }
-    _stopPing() {
-        if (this._pingTimer) {
-            clearInterval(this._pingTimer);
-            this._pingTimer = null;
-        }
-    }
-    _startWakeDetector() {
-        this._stopWakeDetector();
-        this._lastWakeTick = Date.now();
-        this._wakeDetectorTimer = setInterval(() => {
-            const gap = Date.now() - this._lastWakeTick;
-            this._lastWakeTick = Date.now();
-            if (gap > 120_000 && this._ws) {
-                console.log(`[SecureChannel] System wake detected (${Math.round(gap / 1000)}s gap) — forcing reconnect`);
-                this._ws.terminate();
-            }
-        }, 10_000);
-    }
-    _stopWakeDetector() {
-        if (this._wakeDetectorTimer) {
-            clearInterval(this._wakeDetectorTimer);
-            this._wakeDetectorTimer = null;
-        }
-    }
-    _startPendingPoll() {
-        this._stopPendingPoll();
-        this._pendingPollTimer = setInterval(() => {
-            this._checkPendingMessages();
-        }, PENDING_POLL_INTERVAL_MS);
-    }
-    _stopPendingPoll() {
-        if (this._pendingPollTimer) {
-            clearInterval(this._pendingPollTimer);
-            this._pendingPollTimer = null;
-        }
-    }
-    async _checkPendingMessages() {
-        // Don't poll while connecting (prevent hammering during reconnect)
-        if (this._state === "connecting" || !this._deviceId || !this._deviceJwt)
-            return;
-        try {
-            const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/pending`;
-            const resp = await fetch(url, {
-                headers: { Authorization: `Bearer ${this._deviceJwt}` },
-                signal: AbortSignal.timeout(10_000),
-            });
-            if (!resp.ok)
-                return; // Silent fail — WS silence detector is backup
-            const data = (await resp.json());
-            if (data.pending > 0 && this._state !== "ready") {
-                console.log(`[SecureChannel] Poll detected ${data.pending} pending messages — forcing reconnect`);
-                if (this._ws) {
-                    this._ws.terminate();
-                }
-                else {
-                    this._scheduleReconnect();
-                }
-            }
-            else if (data.pending > 0 && this._state === "ready") {
-                // WS claims ready but messages are pending — possible half-open connection
-                const silence = Date.now() - this._lastServerMessage;
-                if (silence > 180_000) {
-                    console.log(`[SecureChannel] Poll: ${data.pending} pending + ${Math.round(silence / 1000)}s silence — forcing reconnect`);
-                    if (this._ws)
-                        this._ws.terminate();
-                }
-            }
-        }
-        catch {
-            // Network error on poll — expected when offline, ignore silently
-        }
-    }
-    _scheduleReconnect() {
-        if (this._stopped)
-            return;
-        if (this._reconnectTimer)
-            return; // Already scheduled
-        const delay = Math.min(RECONNECT_BASE_MS * Math.pow(2, this._reconnectAttempt), RECONNECT_MAX_MS);
-        this._reconnectAttempt++;
-        console.log(`[SecureChannel] Scheduling reconnect in ${delay}ms (attempt ${this._reconnectAttempt})`);
-        this._reconnectTimer = setTimeout(() => {
-            this._reconnectTimer = null; // Clear BEFORE calling _connect so future disconnects can schedule new reconnects
-            if (!this._stopped) {
-                this._connect();
-            }
-        }, delay);
-    }
-    _setState(newState) {
-        if (this._state === newState)
-            return;
-        this._state = newState;
-        this.emit("state", newState);
-        this.config.onStateChange?.(newState);
-        // Start/stop polling fallback based on connection state
-        if (newState === "disconnected" && !this._pollFallbackTimer && this._deviceJwt) {
-            this._startPollFallback();
-        }
-        if (newState === "ready" || newState === "error" || this._stopped) {
-            this._stopPollFallback();
-        }
-    }
-    _startPollFallback() {
-        this._stopPollFallback();
-        console.log("[SecureChannel] Starting HTTP poll fallback (WS is down)");
-        let interval = SecureChannel.POLL_FALLBACK_INTERVAL_MS;
-        const poll = async () => {
-            if (this._state === "ready" || this._stopped) {
-                this._stopPollFallback();
-                return;
-            }
-            try {
-                const since = this._persisted?.lastMessageTimestamp;
-                if (!since || !this._deviceJwt)
-                    return;
-                const url = `${this.config.apiUrl}/api/v1/devices/${this._deviceId}/messages?since=${encodeURIComponent(since)}&limit=200`;
-                const res = await fetch(url, {
-                    headers: { Authorization: `Bearer ${this._deviceJwt}` },
-                });
-                if (!res.ok)
-                    return;
-                const messages = await res.json();
-                let foundMessages = false;
-                for (const msg of messages) {
-                    if (msg.sender_device_id === this._deviceId)
-                        continue;
-                    const session = this._sessions.get(msg.conversation_id);
-                    if (!session)
-                        continue;
-                    try {
-                        const encrypted = transportToEncryptedMessage({
-                            header_blob: msg.header_blob,
-                            ciphertext: msg.ciphertext,
-                        });
-                        const plaintext = session.ratchet.decrypt(encrypted);
-                        if (!session.activated) {
-                            session.activated = true;
-                        }
-                        let messageText;
-                        let messageType;
-                        try {
-                            const parsed = JSON.parse(plaintext);
-                            messageType = parsed.type || "message";
-                            messageText = parsed.text || plaintext;
-                        }
-                        catch {
-                            messageType = "message";
-                            messageText = plaintext;
-                        }
-                        if (messageType === "message") {
-                            const topicId = msg.topic_id;
-                            this._appendHistory("owner", messageText, topicId);
-                            const metadata = {
-                                messageId: msg.id,
-                                conversationId: msg.conversation_id,
-                                timestamp: msg.created_at,
-                                topicId,
-                            };
-                            this.emit("message", messageText, metadata);
-                            this.config.onMessage?.(messageText, metadata);
-                            foundMessages = true;
-                        }
-                        this._persisted.lastMessageTimestamp = msg.created_at;
-                    }
-                    catch (err) {
-                        this.emit("error", err);
-                        break;
-                    }
-                }
-                if (messages.length > 0) {
-                    await this._persistState();
-                }
-                // Adaptive rate: faster when active, slower when idle
-                const newInterval = foundMessages
-                    ? SecureChannel.POLL_FALLBACK_INTERVAL_MS
-                    : SecureChannel.POLL_FALLBACK_IDLE_MS;
-                if (newInterval !== interval) {
-                    interval = newInterval;
-                    // Restart timer with new interval
-                    if (this._pollFallbackTimer) {
-                        clearInterval(this._pollFallbackTimer);
-                        this._pollFallbackTimer = setInterval(poll, interval);
-                    }
-                }
-            }
-            catch {
-                // Network error — try again next tick
-            }
-        };
-        // Run first poll after a short delay, then on interval
-        setTimeout(poll, 1_000);
-        this._pollFallbackTimer = setInterval(poll, interval);
-    }
-    _stopPollFallback() {
-        if (this._pollFallbackTimer) {
-            clearInterval(this._pollFallbackTimer);
-            this._pollFallbackTimer = null;
-            console.log("[SecureChannel] Stopped HTTP poll fallback");
-        }
-    }
-    _handleError(err) {
-        this._setState("error");
-        this.emit("error", err);
-    }
-    /**
-     * Persist all ratchet session states to disk.
-     * Syncs live ratchet states back into the persisted sessions map.
-     */
-    async _persistState() {
-        if (!this._persisted)
-            return;
-        const hasOwnerSessions = this._sessions.size > 0;
-        const hasA2AChannels = !!this._persisted.a2aChannels && Object.keys(this._persisted.a2aChannels).length > 0;
-        if (!hasOwnerSessions && !hasA2AChannels)
-            return;
-        // Sync all live owner-agent ratchet states back to persisted
-        for (const [convId, session] of this._sessions) {
-            this._persisted.sessions[convId] = {
-                ownerDeviceId: session.ownerDeviceId,
-                ratchetState: session.ratchet.serialize(),
-                activated: session.activated,
-            };
-        }
-        await saveState(this.config.dataDir, this._persisted);
-    }
-}
-//# sourceMappingURL=channel.js.map