@cello-protocol/daemon 0.0.19 → 0.0.21

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAqB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAg6H7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EASrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAqB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAwjI7E"}

package/dist/daemon.js

@@ -983,7 +983,14 @@ export async function startDaemon(config) {
             else {
                 state = "registered";
             }
-            return { name: a.name, state, pubkey: a.pubkey };
+            return {
+                name: a.name,
+                state,
+                pubkey: a.pubkey,
+                // M8B F14 (fix 5): per-agent standing-receiver readiness on the MCP surface
+                // (cello_status / cello_list_agents), so a deaf agent is visible to the operator.
+                standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
+            };
         });
     }
     // M7-SESSION-001 AC-006/AC-007 (and M-1 PULL): build the interrupted_sessions
@@ -1009,6 +1016,18 @@ export async function startDaemon(config) {
             interruptedAt: row.interrupted_at ?? new Date(row.updated_at).toISOString(),
         }));
     }
+    // M8B F16: per-session liveness for ACTIVE sessions, shared by both status surfaces
+    // ("status" for the CLI, "cello_status" for MCP). The signal (session.liveness.changed,
+    // tracked in the node manager) existed but nothing consumed it — a dead counterparty
+    // was invisible to the operator.
+    function buildActiveSessions() {
+        return sessionNodeManager.getSessionsByStatus("active").map((row) => ({
+            sessionId: row.session_id,
+            agentName: row.agent_name,
+            counterpartyPubkey: row.counterparty_pubkey,
+            liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
+        }));
+    }
     // Build status response factory
     function getStatus() {
         // M7-SESSION-001 AC-006/AC-007: surface interrupted sessions
@@ -1016,11 +1035,19 @@ export async function startDaemon(config) {
         return {
             daemon: "running",
             directory_signaling: directorySignalingStatus(),
-            agents,
+            // M8B F14 (fix 5): per-agent standing-receiver readiness, so a deaf agent (online but
+            // no armed receiver) is visible in cello_status instead of hiding behind the ANY-agent
+            // aggregate below (kept for backward compatibility).
+            agents: agents.map((a) => ({
+                ...a,
+                standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
+            })),
             connections,
             standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(),
             retryQueueDepth: retryQueue.getTotalDepth(),
             interrupted_sessions,
+            // M8B F16: per-session liveness so a counterparty-gone session is visible.
+            active_sessions: buildActiveSessions(),
         };
     }
     // Register IPC handlers
@@ -1576,7 +1603,14 @@ export async function startDaemon(config) {
                         logger.error("session.sealed.signature.invalid", { sessionId: sidHex, reason: verdict.reason });
                         return;
                     }
-                    logger.info("session.sealed.signature.checked", { sessionId: sidHex, verified: verdict.verified });
+                    // F2-a: on verified:false, surface WHY (signer_key_not_held / no_frost_share / …) so this
+                    // event can never be mistaken for a tolerated failed check. A real failure took the early
+                    // return above (session.sealed.signature.invalid) and never reaches here.
+                    logger.info("session.sealed.signature.checked", {
+                        sessionId: sidHex,
+                        verified: verdict.verified,
+                        ...(verdict.verified ? {} : { reason: verdict.reason }),
+                    });
                 }
                 // M7-SESSION-004 (AC-005): normalise the wire legibility (Uint8Array pubkeys → hex) into a
                 // JSON-safe certificate and persist it with the sealed record so it survives a restart and
@@ -1690,7 +1724,14 @@ export async function startDaemon(config) {
                 return;
             if (ftype === "seal_unilateral_too_early") {
                 pendingUnilateralWaiters.delete(sidHex);
-                waiter({ ok: false, reason: "seal_unilateral_too_early" });
+                // F20: thread the directory's remaining_seconds through so the close guidance can
+                // say when the unilateral seal becomes available.
+                const rs = frame["remaining_seconds"];
+                waiter({
+                    ok: false,
+                    reason: "seal_unilateral_too_early",
+                    ...(typeof rs === "number" ? { remainingSeconds: rs } : {}),
+                });
                 return;
             }
             void (async () => {
@@ -1870,6 +1911,8 @@ export async function startDaemon(config) {
             // M-1 PULL: live MCP clients must see interrupted sessions too, exactly as
             // the daemon-wide getStatus() surfaces them.
             interrupted_sessions: buildInterruptedSessions(),
+            // M8B F16: per-session liveness on the MCP surface too.
+            active_sessions: buildActiveSessions(),
         };
     });
     // ─── MCP-001: no_current_agent guard for session tools ───
@@ -1878,9 +1921,10 @@ export async function startDaemon(config) {
     // NOTE: cello_await_session is NOT in this stub list — Seam 2 registers a real
     // handler for it below (inbound session establishment), with its own inline
     // no_current_agent guard.
-    const SESSION_TOOLS_REQUIRING_AGENT = [
-        "cello_receive_session",
-    ];
+    // F1-a2: cello_receive_session is NO LONGER stubbed here — it is registered below as a true
+    // alias of the real (blocking) cello_receive handler. Kept as an (empty) extension point for
+    // future tools that need the plain no_current_agent guard without their own handler.
+    const SESSION_TOOLS_REQUIRING_AGENT = [];
     const NO_CURRENT_AGENT_RESPONSE = {
         ok: false,
         reason: "no_current_agent",
@@ -1937,6 +1981,25 @@ export async function startDaemon(config) {
         // SI-001: the selector consumes the assignment's signed transport_mode as the
         // sole dial authority — never inferred from address format.
         const assignment = negotiation.assignment;
+        // M8B F13: validate-what-you-receive at the trust boundary. When the responder cannot
+        // proceed it aborts SILENTLY (session-ceremony.ts wireSessionOfferHandler sends nothing)
+        // and the directory folds an EMPTY counterparty endpoint into the FROST-signed
+        // assignment. Accepting that assignment produced a false ok:true + a phantom session
+        // whose failure only surfaced on the first cello_send. Reject it HERE — before any
+        // local session state exists — covering every cause of a missing accept (abort,
+        // offline, crash, timeout) without needing a directory change.
+        if (!assignment.counterparty_session_peer_id) {
+            logger.warn("session.initiate.counterparty_unavailable", {
+                sessionId: Buffer.from(assignment.session_id).toString("hex"),
+                agentName,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "counterparty_unavailable",
+                guidance: "The counterparty did not accept the session offer (it may be offline or unable to receive). No session was established. Verify the counterparty agent is online (its operator can check cello_status), then retry cello_initiate_session.",
+            };
+        }
         const result = await transportSelector.dial(assignment, { correlationId });
         const sessionId = Buffer.from(assignment.session_id).toString("hex");
         if (!result.ok) {
@@ -2147,12 +2210,23 @@ export async function startDaemon(config) {
                     // per-party frontiers, attestation modes, and final_message.answered.
                     return { ok: true, sealed_root: sealedCompletion.rootHex, legibility: sealedCompletion.legibility };
                 }
-                // M7-UPGRADE-002: if THIS close fell through via the auto-ack 'already submitted' path, we
-                // hold no local reported_root to escalate with — and we should not need to: the
-                // counterparty's SEAL ctrl leaf is what triggered our auto-ack, so its seal is already on
-                // the relay and the bilateral seal should finalize. A timeout here is unexpected; report it
-                // as pending rather than escalating to a unilateral seal with no root.
-                if (!submit.ok) {
+                // M8B FINDING-1: `responder_seal_already_submitted` has two producers — (a) the auto-ack
+                // path submitted our leaf because the COUNTERPARTY's SEAL arrived, or (b) our OWN earlier
+                // close submitted it and the counterparty never co-closed. The result now carries the
+                // first submit's reportedRootHex/sequenceNumber, so a retry close can still escalate to a
+                // unilateral seal (case b — the live-deadlock path). We deliberately do NOT distinguish
+                // (a) from (b) client-side: the bilateral wait above already gave case (a) its window, and
+                // the directory's grace/already-sealed gates arbitrate a redundant seal_unilateral — that
+                // is the sovereign-node-correct shape. Only when the not-ok result carries NO root (the
+                // first submit is still in flight) is "pending" the honest terminal answer here.
+                const escalation = submit.ok
+                    ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
+                    : submit.reason === "responder_seal_already_submitted" &&
+                        typeof submit.reportedRootHex === "string" &&
+                        typeof submit.sequenceNumber === "number"
+                        ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
+                        : null;
+                if (!escalation) {
                     return {
                         ok: false,
                         reason: "seal_pending_bilateral",
@@ -2185,8 +2259,8 @@ export async function startDaemon(config) {
                 const sent = await sendOver(record.agent_name, {
                     type: "seal_unilateral",
                     session_id: new Uint8Array(Buffer.from(sessionId, "hex")),
-                    reported_root: new Uint8Array(Buffer.from(submit.reportedRootHex, "hex")),
-                    reported_seq: submit.sequenceNumber,
+                    reported_root: new Uint8Array(Buffer.from(escalation.reportedRootHex, "hex")),
+                    reported_seq: escalation.sequenceNumber,
                     seal_leaves,
                 });
                 if (!sent.ok) {
@@ -2209,10 +2283,14 @@ export async function startDaemon(config) {
                     return { ok: true, sealed_root: uniResult.sealedRootHex, seal_type: "unilateral" };
                 }
                 if (uniResult.reason === "seal_unilateral_too_early") {
+                    // F20: tell the operator WHEN the unilateral seal becomes available, not just "later".
+                    const when = typeof uniResult.remainingSeconds === "number"
+                        ? `A unilateral seal becomes available in ~${uniResult.remainingSeconds}s. `
+                        : "";
                     return {
                         ok: false,
                         reason: "seal_counterparty_pending",
-                        guidance: "Your SEAL leaf is recorded, but the counterparty has not closed and the directory's delivery-grace window has not yet elapsed, so a unilateral seal is not yet allowed. Retry cello_close_session after the grace period, or once the counterparty closes.",
+                        guidance: `Your SEAL leaf is recorded, but the counterparty has not closed and the directory's delivery-grace window has not yet elapsed, so a unilateral seal is not yet allowed. ${when}Retry cello_close_session after the grace period, or once the counterparty closes.`,
                     };
                 }
                 return {
@@ -2907,6 +2985,17 @@ export async function startDaemon(config) {
     }
     async function acceptInboundAssignment(parsed, agentName, correlationId) {
         try {
+            // M8B F14 (fix 2): KICK creation before polling — an inbound offer arriving while no
+            // receiver exists and none is being created must trigger the ensure itself (the doc
+            // comment's "retries on demand" made true), instead of polling a creation nobody
+            // started and dropping the offer. Fire-and-forget: the poll below observes readiness.
+            void sessionNodeManager.ensureStandingReceiverForAgent(agentName).catch((err) => {
+                logger.warn("session.standing_receiver.ensure.failed", {
+                    agentName,
+                    reason: err instanceof Error ? err.message : String(err),
+                    correlationId,
+                });
+            });
             // M2: do not drop the session if this agent's standing receiver is mid-rebuild.
             const ready = await waitForStandingReceiver(agentName);
             if (!ready) {
@@ -3030,11 +3119,15 @@ export async function startDaemon(config) {
         // is NOT yet verified here. The old client's receiveSessionAssignment performed that
         // check; it must be re-homed natively before this path faces a real (untrusted)
         // directory. Until then we accept directory-pushed assignments on trust — the in-process
-        // seam tests inject trusted frames. This is logged loudly, never silent.
-        logger.warn("session.inbound.assignment.unverified", {
+        // seam tests inject trusted frames.
+        // M8B F15: logged at DEBUG with an "expected" note — it fires on EVERY healthy inbound
+        // session, and at WARN it read as a failure and actively misled live diagnosis. The
+        // deferred-verification state is a known, tracked gap (SESSION-004), not a per-session
+        // anomaly.
+        logger.debug("session.inbound.assignment.unverified", {
             sessionId: parsed.sessionIdHex,
             agentName: localAgent.name,
-            note: "FROST assignment signature verification deferred to SESSION-004 re-home",
+            note: "FROST assignment signature verification deferred to SESSION-004 re-home (expected on every inbound session until SESSION-004)",
             correlationId,
         });
         inboundInFlight.add(parsed.sessionIdHex);
@@ -3671,35 +3764,87 @@ export async function startDaemon(config) {
         void newRootHex;
         return { ok: true, sequence_number: leafIndex };
     });
-    // ─── CELLO-M7-DAEMON-004: cello_receive (returns from the daemon's own buffer) ──
-    handlers.set("cello_receive", async (params, connectionId) => {
+    // ─── CELLO-M7-DAEMON-004 / F1-a: cello_receive (BLOCKING, session-scoped) ────────
+    // F1-a fix: the daemon port had dropped the blocking receive (the handler was a
+    // non-blocking buf.shift and cello_receive_session was a not_implemented stub). It now
+    // BLOCKS up to timeout_ms, polling the received-content buffer — resolved by the next
+    // arrival, a terminal seal answer (F1-b), or timeout. This is the "blocking receive
+    // variant" the guidance names. Registered under both cello_receive and cello_receive_session
+    // (F1-a2: one implementation, both names — the redundant tools are collapsed).
+    const RECEIVE_DEFAULT_TIMEOUT_MS = 30000; // matches the cello-mcp shim's documented default
+    const handleReceive = async (params, connectionId) => {
         const connState = perConnectionState.get(connectionId);
         if (!connState || !connState.currentAgent)
             return NO_CURRENT_AGENT_RESPONSE;
-        // round-2 BLOCKING: read the snake_case public field cello-mcp.ts actually sends.
+        const agentName = connState.currentAgent;
+        // Read the snake_case public field cello-mcp.ts actually sends.
         const sessionId = params?.session_id;
         if (!sessionId) {
             return { ok: false, reason: "missing_params", guidance: "Provide 'session_id' (hex) to receive content for a specific session." };
         }
-        const record = sessionNodeManager.getSessionRecord(connState.currentAgent, sessionId);
+        const record = sessionNodeManager.getSessionRecord(agentName, sessionId);
         if (!record) {
             return { ok: false, reason: "session_not_found", guidance: "No session found with this ID. Check cello_list_sessions." };
         }
-        if (record.agent_name !== connState.currentAgent) {
+        if (record.agent_name !== agentName) {
             return { ok: false, reason: "session_not_owned", guidance: "This session belongs to a different agent. Call cello_use_agent to switch to the agent that owns it, then retry." };
         }
-        const entry = sessionNodeManager.takeReceivedContent(connState.currentAgent, sessionId);
-        if (!entry) {
-            return { ok: true, content: null, guidance: "No content is currently buffered for this session. Call cello_receive again after the counterparty sends, or use the blocking receive variant." };
+        const rawTimeout = params?.timeout_ms;
+        const timeoutMs = typeof rawTimeout === "number" && Number.isFinite(rawTimeout) && rawTimeout >= 0
+            ? rawTimeout
+            : RECEIVE_DEFAULT_TIMEOUT_MS;
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            // 1) Deliverable content wins — drain one buffered message per call (FIFO).
+            const entry = sessionNodeManager.takeReceivedContent(agentName, sessionId);
+            if (entry) {
+                return {
+                    ok: true,
+                    content: Buffer.from(entry.contentHex, "hex").toString("utf8"),
+                    sessionId,
+                    sequence_number: entry.sequenceNumber,
+                    senderPubkey: entry.senderPubkey,
+                };
+            }
+            // 2) F1-b: the session sealed while we were (or before we started) waiting — return the
+            //    terminal answer instead of hanging to timeout. unread_count reports messages that
+            //    were evicted unread (still durable — recoverable via cello_get_transcript).
+            const terminal = sessionNodeManager.peekTerminalMarker(agentName, sessionId);
+            if (terminal) {
+                const sealedRoot = sessionNodeManager.getSealedRootHex(agentName, sessionId);
+                return {
+                    ok: true,
+                    type: "session_sealed",
+                    session_id: sessionId,
+                    ...(sealedRoot ? { sealed_root: sealedRoot } : {}),
+                    unread_count: terminal.unreadCount,
+                    guidance: terminal.unreadCount > 0
+                        ? `The session has been sealed by both parties. ${terminal.unreadCount} message(s) arrived that were not read live — call cello_get_transcript to retrieve the full sealed history. No further actions are required on this session.`
+                        : "The session has been sealed by both parties. The full history is available via cello_get_transcript. No further actions are required on this session.",
+                };
+            }
+            // 3) Out of time — non-blocking-equivalent empty answer.
+            const remaining = deadline - Date.now();
+            if (remaining <= 0) {
+                // M8B F16: a dead session must not return the SAME null timeout as a
+                // quiet-but-healthy one. The liveness signal (session.liveness.changed → gone,
+                // tracked per session by the node manager) finally reaches the MCP surface here.
+                if (sessionNodeManager.getSessionLiveness(agentName, sessionId) === "gone") {
+                    return {
+                        ok: true,
+                        content: null,
+                        reason: "counterparty_gone",
+                        liveness: "gone",
+                        guidance: "The counterparty's session connection has dropped (liveness: gone) — it may have crashed or gone offline. No more content will arrive on the direct path. Call cello_close_session to seal the session; if the counterparty never co-closes, a unilateral seal becomes available after the directory's delivery-grace window.",
+                    };
+                }
+                return { ok: true, content: null, guidance: "No content arrived within timeout_ms. Call cello_receive again to keep waiting, or read cello_get_transcript for the full session history." };
+            }
+            await new Promise((r) => setTimeout(r, Math.min(20, remaining)));
         }
-        return {
-            ok: true,
-            content: Buffer.from(entry.contentHex, "hex").toString("utf8"),
-            sessionId,
-            sequence_number: entry.sequenceNumber,
-            senderPubkey: entry.senderPubkey,
-        };
-    });
+    };
+    handlers.set("cello_receive", handleReceive);
+    handlers.set("cello_receive_session", handleReceive);
     let shutdownPromise = null;
     handlers.set("shutdown", async (_params, _connectionId) => {
         if (!shutdownPromise) {