@cello-protocol/daemon 0.0.148 → 0.0.150

package/dist/away-detection.d.ts

@@ -0,0 +1,51 @@
+/**
+ * DOD-AWAY-MUTUAL-SEAL-1 — recognising this daemon's own away auto-replies.
+ *
+ * ── WHY THIS EXISTS ──────────────────────────────────────────────────────────────────────────────
+ *
+ * When two agents contact each other while BOTH are unattended, each side's away responder answers
+ * the other's away responder. The second such arrival looks exactly like "a caller who ignored the
+ * leave-a-message instruction", which is what `DOD-INBOX-ONESHOT-1` exists to handle — so both sides
+ * send a `[[WRAP]]` rejection and initiate a seal. Two distinct-sender SEAL ctrl leaves is precisely
+ * what triggers notarization.
+ *
+ * Measured on the relay's own log 2026-08-09: a session **sealed three seconds after it opened**,
+ * its entire content being two machines telling each other nobody was home. Neither daemon learned
+ * (the seal completion is pushed with no pull twin), so both kept showing `active`; the operators
+ * came back, talked into a closed room for 68 minutes, and found out only at close.
+ *
+ * The one-shot rule is right about a human who keeps typing. It is wrong about another away
+ * responder, which is not a caller ignoring anything.
+ *
+ * ── WHY EXACT MATCHING, AND NOT A MARKER ─────────────────────────────────────────────────────────
+ *
+ * A marker in the wire frame would be cleaner and is the right long-term answer, but it is a wire
+ * change: an older peer would not send it, and this defect fires precisely when talking to a peer we
+ * do not control. Exact text match works today against the case that actually loops — both sides
+ * running THIS logic — and needs no version agreement.
+ *
+ * EXACT, never substring. A human who quotes the away message must still be answered; silencing a
+ * real message is a worse failure than the one being fixed, because the operator would never learn
+ * it arrived.
+ *
+ * The texts live HERE and are read by both the sender and the detector. A second hardcoded copy is
+ * how a reworded away message stops being recognised and the loop quietly returns.
+ */
+/** The exact strings this daemon sends as away auto-replies. */
+export declare const AWAY_AUTO_REPLY_TEXTS: {
+    /**
+     * The one-shot acknowledgement, sent when a message arrives for an unattended agent.
+     * States the one-shot rule, because without it a cooperative caller has no reason to stop.
+     */
+    readonly oneShot: string;
+    /** The session-offer answer, which names the away agent — so it is built, not fixed. */
+    readonly offerFor: (agentName: string) => string;
+};
+/**
+ * True when `text` is one of THIS daemon's away auto-replies — machine traffic, not a caller.
+ *
+ * The caller must neither answer it nor count it toward the one-shot rule. Answering produces the
+ * ping-pong; counting it produces the seal.
+ */
+export declare function isOwnAwayAutoReply(text: string): boolean;
+//# sourceMappingURL=away-detection.d.ts.map

package/dist/away-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"away-detection.d.ts","sourceRoot":"","sources":["../src/away-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,gEAAgE;AAChE,eAAO,MAAM,qBAAqB;IAChC;;;OAGG;;IAKH,wFAAwF;mCACpE,MAAM,KAAG,MAAM;CAG3B,CAAC;AAKX;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOxD"}

package/dist/away-detection.js

@@ -0,0 +1,66 @@
+/**
+ * DOD-AWAY-MUTUAL-SEAL-1 — recognising this daemon's own away auto-replies.
+ *
+ * ── WHY THIS EXISTS ──────────────────────────────────────────────────────────────────────────────
+ *
+ * When two agents contact each other while BOTH are unattended, each side's away responder answers
+ * the other's away responder. The second such arrival looks exactly like "a caller who ignored the
+ * leave-a-message instruction", which is what `DOD-INBOX-ONESHOT-1` exists to handle — so both sides
+ * send a `[[WRAP]]` rejection and initiate a seal. Two distinct-sender SEAL ctrl leaves is precisely
+ * what triggers notarization.
+ *
+ * Measured on the relay's own log 2026-08-09: a session **sealed three seconds after it opened**,
+ * its entire content being two machines telling each other nobody was home. Neither daemon learned
+ * (the seal completion is pushed with no pull twin), so both kept showing `active`; the operators
+ * came back, talked into a closed room for 68 minutes, and found out only at close.
+ *
+ * The one-shot rule is right about a human who keeps typing. It is wrong about another away
+ * responder, which is not a caller ignoring anything.
+ *
+ * ── WHY EXACT MATCHING, AND NOT A MARKER ─────────────────────────────────────────────────────────
+ *
+ * A marker in the wire frame would be cleaner and is the right long-term answer, but it is a wire
+ * change: an older peer would not send it, and this defect fires precisely when talking to a peer we
+ * do not control. Exact text match works today against the case that actually loops — both sides
+ * running THIS logic — and needs no version agreement.
+ *
+ * EXACT, never substring. A human who quotes the away message must still be answered; silencing a
+ * real message is a worse failure than the one being fixed, because the operator would never learn
+ * it arrived.
+ *
+ * The texts live HERE and are read by both the sender and the detector. A second hardcoded copy is
+ * how a reworded away message stops being recognised and the loop quietly returns.
+ */
+/** The exact strings this daemon sends as away auto-replies. */
+export const AWAY_AUTO_REPLY_TEXTS = {
+    /**
+     * The one-shot acknowledgement, sent when a message arrives for an unattended agent.
+     * States the one-shot rule, because without it a cooperative caller has no reason to stop.
+     */
+    oneShot: "Agent is currently away. Your message has been received and will be read when the operator returns. " +
+        "This inbox accepts one message per visit — please close the session now (send with signal: wrap) instead of sending more.",
+    /** The session-offer answer, which names the away agent — so it is built, not fixed. */
+    offerFor(agentName) {
+        return `${agentName} is currently away. Leave a message (send with signal: wrap to close) and it will be read when they return.`;
+    },
+};
+/** The offer text with the agent name removed, so any agent's offer is recognised. */
+const OFFER_SUFFIX = " is currently away. Leave a message (send with signal: wrap to close) and it will be read when they return.";
+/**
+ * True when `text` is one of THIS daemon's away auto-replies — machine traffic, not a caller.
+ *
+ * The caller must neither answer it nor count it toward the one-shot rule. Answering produces the
+ * ping-pong; counting it produces the seal.
+ */
+export function isOwnAwayAutoReply(text) {
+    if (text.length === 0)
+        return false;
+    if (text === AWAY_AUTO_REPLY_TEXTS.oneShot)
+        return true;
+    // The offer names an agent, so match the invariant tail — but require a non-empty name in front
+    // of it, so a bare quote of the suffix alone is not treated as machine traffic.
+    if (text.endsWith(OFFER_SUFFIX) && text.length > OFFER_SUFFIX.length)
+        return true;
+    return false;
+}
+//# sourceMappingURL=away-detection.js.map

package/dist/away-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"away-detection.js","sourceRoot":"","sources":["../src/away-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC;;;OAGG;IACH,OAAO,EACL,sGAAsG;QACtG,2HAA2H;IAE7H,wFAAwF;IACxF,QAAQ,CAAC,SAAiB;QACxB,OAAO,GAAG,SAAS,6GAA6G,CAAC;IACnI,CAAC;CACO,CAAC;AAEX,sFAAsF;AACtF,MAAM,YAAY,GAAG,6GAA6G,CAAC;AAEnI;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,IAAI,KAAK,qBAAqB,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACxD,gGAAgG;IAChG,gFAAgF;IAChF,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAKrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAmC,KAAK,UAAU,EAAsB,MAAM,iBAAiB,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiB7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAS5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA2BnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAUlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACxC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CA8B3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAKrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAmC,KAAK,UAAU,EAAsB,MAAM,iBAAiB,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiB7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAS5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA2BnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAWlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACxC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CA8B3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}

package/dist/daemon.js

@@ -91,6 +91,7 @@ import { startRegistryPoll } from "./registry-poll.js";
 import { CONSENT_ACCEPTED } from "./consent-migration.js";
 import { TrustSignalStore } from "./trust-signal-store.js";
 import { countAttendance, ContentTakeLedger } from "./co-attendance.js";
+import { isOwnAwayAutoReply, AWAY_AUTO_REPLY_TEXTS } from "./away-detection.js";
 import { FrontierMismatchStore, renderFrontierMismatch } from "./frontier-mismatch.js";
 import { encodeCbor, decodeCbor } from "@cello-protocol/protocol-types";
 // Minimal no-op KeyProvider stub for session nodes.
@@ -870,7 +871,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // DOD-AWAY-ACK-ONESHOT-TEXT-1 (live defect 2026-07-24): the ack must state the one-shot rule —
     // without it a cooperative caller LLM has no reason to stop, sends a follow-up, and eats the
     // DOD-INBOX-ONESHOT-1 rejection the design itself invited.
-    const AWAY_MESSAGE_TEXT = "Agent is currently away. Your message has been received and will be read when the operator returns. This inbox accepts one message per visit — please close the session now (send with signal: wrap) instead of sending more.";
+    // ONE definition, shared with the detector in away-detection.ts. A second copy here is how a
+    // reworded away message stops being recognised as machine traffic and the mutual-seal loop
+    // (DOD-AWAY-MUTUAL-SEAL-1) quietly comes back.
+    const AWAY_MESSAGE_TEXT = AWAY_AUTO_REPLY_TEXTS.oneShot;
     // M8C-CONTACT-1: "unknown senders learn only 'dispatched' by default" — a single shared,
     // deliberately minimal template regardless of kind, distinct from AWAY-1's richer per-type text.
     const STRANGER_TEXT = "Dispatched.";
@@ -898,6 +902,30 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     logger.info("session.away.response.skipped_wrap", { agentName, sessionId });
                     return;
                 }
+                // DOD-AWAY-MUTUAL-SEAL-1: an away responder must not answer ANOTHER away responder, and
+                // must not count one toward the one-shot rule.
+                //
+                // When both agents are unattended, each side's auto-reply arrives at the other as an inbound
+                // message. The second such arrival looks exactly like "a caller who ignored the
+                // leave-a-message instruction" — so the one-shot fires on BOTH sides, each sends a [[WRAP]]
+                // rejection and initiates a seal, and two distinct-sender SEAL ctrl leaves is precisely what
+                // notarizes a session.
+                //
+                // Measured from the relay's own log 2026-08-09: sealed THREE SECONDS after opening, its
+                // entire content two machines telling each other nobody was home. Neither daemon learned —
+                // the seal completion is pushed with no pull twin — so both showed `active`, and the
+                // operators returned and talked into a closed room for 68 minutes before finding out.
+                //
+                // Returned silently rather than answered: a reply would continue the ping-pong, and there is
+                // nobody on the far side to read one.
+                if (isOwnAwayAutoReply(text)) {
+                    logger.info("session.away.mutual.skipped", {
+                        agentName,
+                        sessionId,
+                        impact: "no away reply and no one-shot seal — two away agents must not notarize a conversation nobody had",
+                    });
+                    return;
+                }
             }
         }
         const dedupKey = `${agentName}:${sessionId}:${kind}`;
@@ -1060,7 +1088,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
         const isKnown = sessionNodeManager.isKnown(agentName, record.counterparty_pubkey);
         // DOD-AWAY-WRAP-1 AC1: request kind uses a leave-a-message greeting that names the away agent.
         const systemDefault = kind === "request"
-            ? `${agentName} is currently away. Leave a message (send with signal: wrap to close) and it will be read when they return.`
+            ? AWAY_AUTO_REPLY_TEXTS.offerFor(agentName)
             : AWAY_MESSAGE_TEXT;
         awayAckSent.add(dedupKey); // guard BEFORE the async send — concurrent arrivals must not double-ack
         try {