@cello-protocol/daemon 0.0.175 → 0.0.176

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAOrB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAmC,KAAK,UAAU,EAAsB,MAAM,iBAAiB,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiB7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAS5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA2BnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAYlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;;OAKG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACpE;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACxC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CA8B3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAOrB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAmC,KAAK,UAAU,EAAsB,MAAM,iBAAiB,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAA6C,MAAM,2BAA2B,CAAC;AAO1G,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiB7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAS5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA2BnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAYlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;;OAKG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACpE;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACxC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CAuC3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}

package/dist/daemon.js

@@ -35,7 +35,7 @@ import { acquireLock, removeLockIfOwned } from "./lock-file.js";
 import { acquireSingletonLock } from "./singleton-lock.js";
 import { createIpcServer } from "./ipc-server.js";
 import { renderForSurface } from "./vocabulary.js";
-import { SessionNodeManager } from "./session-node-manager.js";
+import { SessionNodeManager, REVIVAL_WINDOW_MS, REVIVAL_BOUND_SWEEP_MS } from "./session-node-manager.js";
 import { registerGatewayConfigHandlers } from "./gateway-config-handlers.js";
 import { RetryQueue } from "./retry-queue.js";
 import { NonceDedupStore } from "./nonce-dedup.js";
@@ -115,7 +115,11 @@ export class ProductionSessionNodeFactory {
         // agent ever did). CELLO_LISTEN_ADDR / CELLO_ANNOUNCE_ADDRS remain as
         // overrides for publicly-hosted agents (M6 parity). Ephemeral session nodes
         // (which dial OUT and need no inbound reachability) stay on loopback.
-        const isReceiver = config.nodeType === "standing_receiver";
+        // DOD-M12B-SESSION-SEED-1 (case B review HIGH-1): `inboundReachable` is the REVIVED session
+        // node. Every production session node reached its role by promotion and so inherited the
+        // receiver's routable bind; a rebuilt one inherits nothing and would come back on loopback,
+        // preserving an identity nobody can dial.
+        const isReceiver = config.nodeType === "standing_receiver" || config.inboundReachable === true;
         const listenAddr = isReceiver
             ? (process.env["CELLO_LISTEN_ADDR"] ?? "/ip4/0.0.0.0/tcp/0")
             : "/ip4/127.0.0.1/tcp/0";
@@ -134,6 +138,11 @@ export class ProductionSessionNodeFactory {
             // type; nodeType's remaining transport effect is the HOP gate (client
             // types never advertise circuit-relay HOP).
             nodeType: config.nodeType,
+            // DOD-M12B-SESSION-SEED-1: forward the caller's transport seed when it supplied one, so a
+            // rebuilt session node returns at the peer id the counterparty already holds. Omitted (rather
+            // than passed as undefined) when absent, keeping createNode's "generate a fresh key" default
+            // for every node that is not session-scoped.
+            ...(config.transportPrivateKey ? { transportPrivateKey: config.transportPrivateKey } : {}),
         });
     }
 }
@@ -3963,6 +3972,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
     let stoppedHookFired = false;
     async function stop(reason) {
         clearInterval(reconcileSweepTimer);
+        clearInterval(revivalBoundSweepTimer);
         // DOD-M12B-SHUTDOWN-1: clearing the timer only stops the NEXT tick. The pass already running
         // walks every agent, and each step dials a peer and opens a session — which is why a daemon
         // reported down, with its socket already removed, was still logging `document.reconcile.sweep`
@@ -4147,6 +4157,48 @@ async function startDaemonHoldingLock(config, singletonLock) {
         markGaveUp: (agentName, sessionId, reason) => sessionNodeManager.markRestartSealGaveUp(agentName, sessionId, reason),
     });
     restartSealResolver.start();
+    /**
+     * DOD-M12B-REVIVAL-BOUND-1 — close the interrupted sessions the revival window has expired.
+     *
+     * Runs at boot beside the restart-seal resolver, and is its complement: the resolver takes the
+     * sessions we can describe truthfully (`interrupted_by = 'local'`) and gets them a receipt; this
+     * takes everything else and shuts the door without asserting a cause.
+     *
+     * It must run even though nothing has revived a session yet — the reason is Andre's 2026-08-18
+     * tenet, *"leave nothing open that is no longer needed."* `ingestReceivedContent` accepts content
+     * into an `interrupted` session by design, so a session that can never be revived is a write
+     * surface a reprogrammed peer can use for as long as the row exists. Boot is where the store is
+     * swept for exactly that.
+     *
+     * NOT AWAITED, and caught: this is a best-effort sweep over rows that have already waited a day.
+     * Blocking the daemon's startup on a directory-free DB walk buys nothing, and a throw here would
+     * take down a daemon that is otherwise healthy.
+     */
+    const runRevivalBoundSweep = () => {
+        void sessionNodeManager
+            .closeExpiredUnrevivableSessions(Date.now(), REVIVAL_WINDOW_MS)
+            .catch((err) => {
+            logger.warn("session.revival_bound.sweep.failed", {
+                error: err instanceof Error ? err.message : String(err),
+                impact: "expired sessions were not closed this pass and still accept content",
+            });
+        });
+    };
+    runRevivalBoundSweep();
+    /**
+     * RE-ARMED, because boot alone is not a bound.
+     *
+     * A session interrupted at 09:00 on a daemon that stays up all week would otherwise be writable
+     * for the whole week — and a long-lived daemon is the normal case, not the exception. Boot-only
+     * would have made the control fire exactly when it is least needed (a machine that restarts often
+     * is a machine whose sessions get swept often) and never when it is most needed.
+     *
+     * Hourly against a 24-hour window: the overshoot is at most an hour on a bound measured in days,
+     * and the pass is a single indexed DB walk with no network in it. `unref` so a pending timer
+     * never holds the process open, matching `reconcileSweepTimer` beside it.
+     */
+    const revivalBoundSweepTimer = setInterval(runRevivalBoundSweep, REVIVAL_BOUND_SWEEP_MS);
+    revivalBoundSweepTimer.unref?.();
     /**
      * The live handler map.
      *