@cello-protocol/daemon 0.0.14 → 0.0.16

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAMrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAK/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAoB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA2sH7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAoB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAyzH7E"}

package/dist/daemon.js

@@ -32,6 +32,7 @@ import { loadAgents } from "./agent-loader.js";
 import { acquireLock, removeLock } from "./lock-file.js";
 import { createIpcServer } from "./ipc-server.js";
 import { SessionNodeManager } from "./session-node-manager.js";
+import { classifySession } from "./session-category.js";
 import { RetryQueue } from "./retry-queue.js";
 import { NonceDedupStore } from "./nonce-dedup.js";
 import { ContentParkClient } from "./content-park-client.js";
@@ -54,7 +55,7 @@ import { wireSessionCeremonyHandler, wireSessionOfferHandler, wireSealCeremonyHa
 import { reDeriveFrontiers, findInflatedFrontier } from "./seal-frontier-verify.js";
 import { LocalAutoNatStub } from "@cello-protocol/transport";
 import { startHttpManifestPoll } from "./http-manifest-poll.js";
-import { resolveDirectoryUrl } from "./directory-bootstrap.js";
+import { resolveDirectoryUrl, manifestNodesToEndpoints } from "./directory-bootstrap.js";
 /**
  * M7-SESSION-001 (H-1): canonical byte encoding of a SEAL-INTERRUPTED leaf for
  * Ed25519 signing/verification. Field order is fixed and deterministic. Both the
@@ -225,6 +226,10 @@ export async function startDaemon(config) {
     // M7 Keystone: the version of the verified manifest, surfaced in ConnectResult.
     // Stays 0 when no manifestProvider is configured (the M6 backward-compat path).
     let verifiedManifestVersion = 0;
+    // DOD-MANIFEST-1: the consortium node set resolved to live directory endpoints from
+    // the VERIFIED manifest — the N-node roster a T-of-N ceremony (DOD-DKG-1) fans out to.
+    // Empty in the M6 backward-compat path (no manifest) or if no node resolves.
+    let consortiumEndpoints = [];
     if (manifestProvider && manifestRootKeys && manifestThreshold !== undefined) {
         try {
             const manifest = await manifestProvider.loadAndVerify(manifestRootKeys, manifestThreshold);
@@ -261,6 +266,38 @@ export async function startDaemon(config) {
                         manifestVersion: manifest.version,
                         signerCount: manifest.signatures.length,
                     });
+                    // DOD-MANIFEST-1: resolve the FULL verified node set to live directory
+                    // endpoints (replaces the implicit single-endpoint assumption). This is the
+                    // roster T-of-N ceremonies fan out to. Availability-aware — a node that is
+                    // down is skipped, the rest still resolve (redundancy invariant: a ceremony
+                    // needs only T of N). The resolved count is logged so an operator sees the
+                    // real reachable consortium at startup; the ceremony layer (DOD-DKG-1)
+                    // re-checks the threshold against this roster and never silently falls back
+                    // to the single hardcoded endpoint for a missing/forged node.
+                    consortiumEndpoints = await manifestNodesToEndpoints(manifest.nodes, { logger });
+                    const declaredNodes = manifest.nodes.length;
+                    const resolvedNodes = consortiumEndpoints.length;
+                    // Carry the nodeId↔peerId pairing (not just peerIds) so a consumer/test can verify
+                    // each manifest identity bound to the right live directory, not merely the set.
+                    const consortiumLog = {
+                        manifestVersion: manifest.version,
+                        declaredNodes,
+                        resolvedNodes,
+                        nodes: consortiumEndpoints.map((e) => ({ nodeId: e.nodeId, peerId: e.peerId })),
+                    };
+                    // Degraded ≠ healthy: a verified manifest whose nodes don't all resolve must NOT
+                    // log at the same severity as a full roster. Threshold-REFUSAL (refusing to run a
+                    // ceremony below T) is DOD-DKG-1's gate; here we make the health signal loud so a
+                    // shrunken/empty roster is visible and never buried at info.
+                    if (resolvedNodes === 0) {
+                        logger.error("directory.consortium.none", consortiumLog);
+                    }
+                    else if (resolvedNodes < declaredNodes) {
+                        logger.warn("directory.consortium.partial", consortiumLog);
+                    }
+                    else {
+                        logger.info("directory.consortium.resolved", consortiumLog);
+                    }
                 }
             }
         }
@@ -285,6 +322,14 @@ export async function startDaemon(config) {
         throw new Error("Manifest verification failed. The daemon cannot start with an unverified manifest when manifestProvider is configured. " +
             "Check the logs for the specific failure reason (manifest_signature_invalid, manifest_expired, or manifest_version_rollback).");
     }
+    // DOD-SIGN-1: resolve the consortium roster for a session/seal FROST ceremony (same source as
+    // registration's DOD-DKG-1 path — the verified manifest, re-resolved at ceremony time). NULL when
+    // no consortium manifest is configured → single-node ceremony (M6/M7 back-compat). Shared by all
+    // wireSessionCeremonyHandler / wireSealCeremonyHandler call sites below.
+    const resolveConsortiumRoster = async () => {
+        const m = manifestProvider?.getCurrentManifest();
+        return m ? await manifestNodesToEndpoints(m.nodes, { logger }) : null;
+    };
     // CELLO-M7-CONN-001 (DOD-CONN-3): start the daemon-level HTTP manifest poll. It fetches
     // ${directoryHttpUrl}/manifest, verifies the threshold signature against the locally-pinned
     // root keys, applies anti-rollback + expiry, and adopts a newer manifest — independent of any
@@ -439,6 +484,7 @@ export async function startDaemon(config) {
             agentPubkeyHex,
             getNode: entry.getNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
         });
@@ -449,6 +495,7 @@ export async function startDaemon(config) {
             agentPubkeyHex,
             getNode: entry.getNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
         });
@@ -515,6 +562,7 @@ export async function startDaemon(config) {
             agentPubkeyHex: agent.pubkey,
             getNode: getDirectoryNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
         });
@@ -524,6 +572,7 @@ export async function startDaemon(config) {
             agentPubkeyHex: agent.pubkey,
             getNode: getDirectoryNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
         });
@@ -911,9 +960,18 @@ export async function startDaemon(config) {
     // array from SQLite. Shared by both getStatus() (daemon-wide) and the
     // cello_status MCP handler (per-connection) so live MCP clients see the same
     // interrupted sessions a CLI `cello status` would.
+    // `cello status` is a health snapshot, not a session archive. It surfaces ONLY genuinely
+    // RESUMABLE sessions (interrupted with messages exchanged) — never failed inits (interrupted,
+    // 0 messages — a dead handshake), which classify as "failed" and would otherwise accumulate
+    // unbounded and confuse. The list is also capped; the full, queryable history is `cello sessions`
+    // / cello_list_sessions (with filter + limit flags).
+    const STATUS_RESUMABLE_CAP = 10;
     function buildInterruptedSessions() {
-        const interruptedRows = sessionNodeManager.getSessionsByStatus("interrupted");
-        return interruptedRows.map((row) => ({
+        return sessionNodeManager
+            .getSessionsByStatus("interrupted")
+            .filter((row) => (row.message_count ?? 0) > 0) // resumable only — drop failed 0-message inits
+            .slice(0, STATUS_RESUMABLE_CAP)
+            .map((row) => ({
             sessionId: row.session_id,
             agentName: row.agent_name,
             counterpartyPubkey: row.counterparty_pubkey,
@@ -1363,10 +1421,21 @@ export async function startDaemon(config) {
                 };
             }
             const persistence = getPersistence(name);
+            // DOD-DKG-1: resolve the full consortium roster from the VERIFIED manifest so the DKG fans
+            // across all N directory nodes. Re-resolved here (ceremony time) for fresh failover
+            // coordinates. NULL when NO manifest is configured (→ single-node DKG, M6/M7 back-compat);
+            // a (possibly EMPTY) array when a manifest IS configured. The null-vs-empty distinction is
+            // load-bearing: an empty roster (consortium configured but unreachable) must REFUSE in
+            // registration-manager, NOT downgrade to single-node (code-reviewer B1 / fallback-finder).
+            const currentManifest = manifestProvider?.getCurrentManifest();
+            const consortiumRoster = currentManifest
+                ? await manifestNodesToEndpoints(currentManifest.nodes, { logger })
+                : null;
             const ctx = new DaemonRegistrationContext({
                 signaling: agentSignaling,
                 getDirectoryNode: agentGetNode,
                 getDirectoryEndpoint: () => directoryEndpoint,
+                getConsortiumEndpoints: () => consortiumRoster,
                 keyProvider,
                 persistence,
                 logger,
@@ -2123,27 +2192,56 @@ export async function startDaemon(config) {
     // and the guidance strings that point here ("See cello_list_sessions") dead-end.
     // Read from the persisted SQLite store, so it works after a daemon restart and
     // from a fresh MCP connection (no in-memory session-node required).
-    handlers.set("cello_list_sessions", async (_params, connectionId) => {
-        const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent) {
-            return NO_CURRENT_AGENT_RESPONSE;
-        }
-        const agentName = connState.currentAgent;
-        const sessions = sessionNodeManager
-            .getSessionsForAgent(agentName)
-            .map((row) => ({
+    // Classify → filter → cap a set of session rows into a SessionListResponse. Shared by the
+    // per-agent MCP surface (cello_list_sessions) and the daemon-wide CLI surface (list_sessions),
+    // so the operator-facing categories (open/closed/failed) and the default cap never drift.
+    // Default filter = "open" (live/resumable only — the common case); default limit bounds the
+    // response so a long-lived agent's history can't balloon it. `all` includes failed/closed.
+    const DEFAULT_LIST_LIMIT = 50;
+    const MAX_LIST_LIMIT = 500;
+    function selectSessions(rows, params) {
+        const rawFilter = typeof params?.filter === "string" ? params.filter : "open";
+        const filter = rawFilter === "closed" || rawFilter === "failed" || rawFilter === "all" ? rawFilter : "open";
+        let limit = Number(params?.limit);
+        if (!Number.isFinite(limit) || limit < 1)
+            limit = DEFAULT_LIST_LIMIT;
+        limit = Math.min(Math.floor(limit), MAX_LIST_LIMIT);
+        const classified = rows.map((row) => {
+            const messageCount = row.message_count ?? 0;
+            const category = classifySession(row.status, messageCount);
+            return { row, messageCount, category };
+        });
+        const matched = filter === "all" ? classified : classified.filter((c) => c.category === filter);
+        const sessions = matched.slice(0, limit).map(({ row, messageCount, category }) => ({
             sessionId: row.session_id,
             agentName: row.agent_name,
             counterpartyPubkey: row.counterparty_pubkey,
             status: row.status,
-            messageCount: row.message_count ?? 0,
+            category,
+            messageCount,
             createdAt: new Date(row.created_at).toISOString(),
             updatedAt: new Date(row.updated_at).toISOString(),
             // interrupted_at is the canonical ISO interruption stamp; null for any
             // session that was never interrupted (active/sealed).
             interruptedAt: row.interrupted_at ?? null,
         }));
-        return { ok: true, sessions };
+        return { ok: true, filter, limit, totalMatched: matched.length, sessions };
+    }
+    // cello_list_sessions (MCP, per current agent): the discovery surface for the by-id reads
+    // (cello_get_transcript / cello_get_sealed_receipt). Accepts { filter?: open|closed|failed|all,
+    // limit?: number } — defaults to open + DEFAULT_LIST_LIMIT so failed/dead handshakes don't drown
+    // the live ones. Read from persisted SQLite, so it survives a daemon restart / fresh connection.
+    handlers.set("cello_list_sessions", async (params, connectionId) => {
+        const connState = perConnectionState.get(connectionId);
+        if (!connState || !connState.currentAgent) {
+            return NO_CURRENT_AGENT_RESPONSE;
+        }
+        return selectSessions(sessionNodeManager.getSessionsForAgent(connState.currentAgent), params);
+    });
+    // list_sessions (daemon-wide, for the `cello sessions` CLI which has no current agent): same
+    // filter/limit semantics, across ALL agents.
+    handlers.set("list_sessions", async (params) => {
+        return selectSessions(sessionNodeManager.getAllSessions(), params);
     });
     // DAEMON-003 IPC handlers: queue_failed_send and check_nonce (AC-010)
     handlers.set("queue_failed_send", async (params, _connectionId) => {