@awebai/claude-channel 1.1.0 → 1.3.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aweb-channel",
   "description": "aweb agent coordination channel — receive mail, chat, tasks, and control signals from your agent team in real time.",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "author": {
     "name": "awebai"
   },

package/README.md

@@ -49,5 +49,5 @@ The directory must already be connected to an aweb team workspace
 ## More info
 
 - [Channel documentation](https://github.com/awebai/aweb/blob/main/docs/channel.md)
-- [Agent guide](https://github.com/awebai/aweb/blob/main/docs/agent-guide.txt)
+- [Agent guide](https://github.com/awebai/aweb/blob/main/docs/agent-guide.md)
 - [aweb.ai](https://aweb.ai)

package/dist/index.js

@@ -25130,6 +25130,7 @@ async function loadSigningKey(path) {
 etc.sha512Sync = (...m) => sha512(etc.concatBytes(...m));
 async function resolveConfig(workdir) {
   const workspacePath = join(workdir, ".aw", "workspace.yaml");
+  const teamsPath = join(workdir, ".aw", "teams.yaml");
   const identityPath = join(workdir, ".aw", "identity.yaml");
   const signingKeyPath = join(workdir, ".aw", "signing.key");
   const workspace = await readYAML(workspacePath);
@@ -25143,19 +25144,25 @@ async function resolveConfig(workdir) {
       "This workspace is on the legacy single-team shape (.aw/workspace.yaml has team_address but no memberships). Run aw workspace migrate-multi-team to convert, then retry."
     );
   }
-  const activeTeam = (workspace.active_team || "").trim();
-  const membership = (workspace.memberships || []).find((item) => (item.team_id || "").trim() === activeTeam);
+  const teamState = await readYAML(teamsPath);
+  if (!teamState) {
+    throw new Error("worktree team state is missing .aw/teams.yaml; run `aw init` or `aw id team add` first");
+  }
+  const activeTeam = (teamState.active_team || "").trim();
+  const teamMembership = (teamState.memberships || []).find((item) => (item.team_id || "").trim() === activeTeam);
+  const workspaceMembership = (workspace.memberships || []).find((item) => (item.team_id || "").trim() === activeTeam);
   const teamID = activeTeam;
-  const alias = (membership?.alias || "").trim();
-  if (!baseURL || !teamID || !membership || !alias) {
+  const alias = (teamMembership?.alias || "").trim();
+  const certPath = (teamMembership?.cert_path || "").trim();
+  if (!baseURL || !teamID || !teamMembership || !workspaceMembership || !alias || !certPath) {
     throw new Error("worktree workspace binding is missing aweb_url, active_team, or the active membership alias");
   }
   const signingKey = await loadSigningKey(signingKeyPath);
-  const certificate = await loadActiveTeamCertificate(workdir, teamID);
+  const certificate = await loadConfiguredTeamCertificate(workdir, teamID, certPath);
   const identity = await readYAML(identityPath);
   const did = computeDIDKey(getPublicKey(signingKey));
   const stableID = (identity?.stable_id || "").trim() || (certificate.member_did_aw || "").trim();
-  const address = (identity?.address || "").trim() || (certificate.member_address || "").trim();
+  const address = (certificate.member_address || "").trim() || (identity?.address || "").trim();
   if ((identity?.did || "").trim() && did !== identity?.did?.trim()) {
     throw new Error("identity.yaml did does not match .aw/signing.key");
   }
@@ -25163,10 +25170,10 @@ async function resolveConfig(workdir) {
     throw new Error("team certificate member_did_key does not match .aw/signing.key");
   }
   if ((certificate.team_id || "").trim() !== teamID) {
-    throw new Error(`workspace.yaml active_team does not match certificate for ${teamID}`);
+    throw new Error(`team certificate does not match active team ${teamID}`);
   }
   if ((certificate.alias || "").trim() !== alias) {
-    throw new Error("workspace.yaml active membership alias does not match the team certificate");
+    throw new Error("active membership alias does not match the team certificate");
   }
   return {
     baseURL,
@@ -25179,6 +25186,16 @@ async function resolveConfig(workdir) {
     teamCertificateHeader: encodeTeamCertificateHeader(certificate)
   };
 }
+async function loadConfiguredTeamCertificate(workdir, activeTeam, certPath) {
+  try {
+    return await loadTeamCertificate(join(workdir, ".aw", certPath));
+  } catch (error2) {
+    if (error2.code !== "ENOENT") {
+      throw error2;
+    }
+    return loadActiveTeamCertificate(workdir, activeTeam);
+  }
+}
 async function loadActiveTeamCertificate(workdir, activeTeam) {
   const certsDir = join(workdir, ".aw", "team-certs");
   let files;
@@ -26313,12 +26330,13 @@ var SenderTrustManager = class {
     }
     const trustAddress = this.canonicalTrustAddress(rawAddress);
     const meta3 = await this.resolveAgentMeta(rawAddress);
-    status = await this.checkStableIdentityRegistry(
+    const registryCheck = await this.checkStableIdentityRegistry(
       status,
       (verificationAddress || rawAddress).trim(),
       fromDID,
       fromStableID
     );
+    status = registryCheck.status;
     return this.checkTOFUPinWithMeta(
       store,
       status,
@@ -26328,7 +26346,8 @@ var SenderTrustManager = class {
       fromStableID,
       rotationAnnouncement,
       replacementAnnouncement,
-      meta3
+      meta3,
+      registryCheck.confirmedCurrentKey
     );
   }
   checkRecipientBinding(status, toDID) {
@@ -26339,18 +26358,21 @@ var SenderTrustManager = class {
   }
   async checkStableIdentityRegistry(status, trustAddress, fromDID, fromStableID) {
     if (status !== "verified" || !fromDID || !fromStableID?.startsWith("did:aw:")) {
-      return status;
+      return { status, confirmedCurrentKey: false };
     }
     const registryResult = await this.registry.verifyStableIdentity(trustAddress, fromStableID);
     if (registryResult.outcome === "HARD_ERROR") {
-      return "identity_mismatch";
+      return { status: "identity_mismatch", confirmedCurrentKey: false };
     }
     if (registryResult.outcome === "OK_VERIFIED" && registryResult.currentDidKey && registryResult.currentDidKey !== fromDID) {
-      return "identity_mismatch";
+      return { status: "identity_mismatch", confirmedCurrentKey: false };
     }
-    return status;
+    return {
+      status,
+      confirmedCurrentKey: registryResult.outcome === "OK_VERIFIED" && registryResult.currentDidKey === fromDID
+    };
   }
-  checkTOFUPinWithMeta(store, status, rawAddress, trustAddress, fromDID, fromStableID, rotationAnnouncement, replacementAnnouncement, meta3) {
+  checkTOFUPinWithMeta(store, status, rawAddress, trustAddress, fromDID, fromStableID, rotationAnnouncement, replacementAnnouncement, meta3, registryConfirmedCurrentKey) {
     if (!status || status !== "verified" && status !== "verified_custodial" || !fromDID || !trustAddress || !meta3.resolved) {
       return { status, stored: false };
     }
@@ -26395,6 +26417,13 @@ var SenderTrustManager = class {
         if (fromStableID) {
           const pin = store.pins.get(pinKey);
           if (pin?.did_key && pin.did_key !== fromDID) {
+            if (registryConfirmedCurrentKey) {
+              store.storePin(pinKey, trustAddress, "", "");
+              const updated = store.pins.get(pinKey);
+              updated.stable_id = fromStableID;
+              updated.did_key = fromDID;
+              return { status, stored: true };
+            }
             if (!this.verifyRotationAnnouncement(rotationAnnouncement, fromDID, pin.did_key) && !this.verifyReplacementAnnouncement(trustAddress, replacementAnnouncement, fromDID, pin.did_key, meta3)) {
               return { status: "identity_mismatch", stored: false };
             }
@@ -26410,6 +26439,14 @@ var SenderTrustManager = class {
       }
       case "mismatch": {
         const pinnedKey = store.addresses.get(trustAddress) || "";
+        if (registryConfirmedCurrentKey && fromStableID) {
+          store.removeAddress(trustAddress);
+          store.storePin(pinKey, trustAddress, "", "");
+          const pin = store.pins.get(pinKey);
+          pin.stable_id = fromStableID;
+          pin.did_key = fromDID;
+          return { status, stored: true };
+        }
         if (fromStableID && pinnedKey === fromStableID) {
           const pin = store.pins.get(pinnedKey);
           if (pin?.did_key === fromDID) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/claude-channel",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "type": "module",
   "main": "./dist/index.js",
   "bin": "./dist/index.js",

package/skills/configure/SKILL.md

@@ -79,4 +79,4 @@ Diagnose and fix the aweb channel setup for this project.
    ```
 
 Reference model: `docs/aweb-sot.md`, `docs/awid-sot.md`, and
-`docs/agent-guide.txt`.
+`docs/agent-guide.md`.