@cello-protocol/daemon 0.0.20 → 0.0.22

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAqB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAi9H7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EASrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAqB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAwjI7E"}

package/dist/daemon.js

@@ -983,7 +983,14 @@ export async function startDaemon(config) {
             else {
                 state = "registered";
             }
-            return { name: a.name, state, pubkey: a.pubkey };
+            return {
+                name: a.name,
+                state,
+                pubkey: a.pubkey,
+                // M8B F14 (fix 5): per-agent standing-receiver readiness on the MCP surface
+                // (cello_status / cello_list_agents), so a deaf agent is visible to the operator.
+                standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
+            };
         });
     }
     // M7-SESSION-001 AC-006/AC-007 (and M-1 PULL): build the interrupted_sessions
@@ -1009,6 +1016,18 @@ export async function startDaemon(config) {
             interruptedAt: row.interrupted_at ?? new Date(row.updated_at).toISOString(),
         }));
     }
+    // M8B F16: per-session liveness for ACTIVE sessions, shared by both status surfaces
+    // ("status" for the CLI, "cello_status" for MCP). The signal (session.liveness.changed,
+    // tracked in the node manager) existed but nothing consumed it — a dead counterparty
+    // was invisible to the operator.
+    function buildActiveSessions() {
+        return sessionNodeManager.getSessionsByStatus("active").map((row) => ({
+            sessionId: row.session_id,
+            agentName: row.agent_name,
+            counterpartyPubkey: row.counterparty_pubkey,
+            liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
+        }));
+    }
     // Build status response factory
     function getStatus() {
         // M7-SESSION-001 AC-006/AC-007: surface interrupted sessions
@@ -1016,11 +1035,19 @@ export async function startDaemon(config) {
         return {
             daemon: "running",
             directory_signaling: directorySignalingStatus(),
-            agents,
+            // M8B F14 (fix 5): per-agent standing-receiver readiness, so a deaf agent (online but
+            // no armed receiver) is visible in cello_status instead of hiding behind the ANY-agent
+            // aggregate below (kept for backward compatibility).
+            agents: agents.map((a) => ({
+                ...a,
+                standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
+            })),
             connections,
             standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(),
             retryQueueDepth: retryQueue.getTotalDepth(),
             interrupted_sessions,
+            // M8B F16: per-session liveness so a counterparty-gone session is visible.
+            active_sessions: buildActiveSessions(),
         };
     }
     // Register IPC handlers
@@ -1697,7 +1724,14 @@ export async function startDaemon(config) {
                 return;
             if (ftype === "seal_unilateral_too_early") {
                 pendingUnilateralWaiters.delete(sidHex);
-                waiter({ ok: false, reason: "seal_unilateral_too_early" });
+                // F20: thread the directory's remaining_seconds through so the close guidance can
+                // say when the unilateral seal becomes available.
+                const rs = frame["remaining_seconds"];
+                waiter({
+                    ok: false,
+                    reason: "seal_unilateral_too_early",
+                    ...(typeof rs === "number" ? { remainingSeconds: rs } : {}),
+                });
                 return;
             }
             void (async () => {
@@ -1877,6 +1911,8 @@ export async function startDaemon(config) {
             // M-1 PULL: live MCP clients must see interrupted sessions too, exactly as
             // the daemon-wide getStatus() surfaces them.
             interrupted_sessions: buildInterruptedSessions(),
+            // M8B F16: per-session liveness on the MCP surface too.
+            active_sessions: buildActiveSessions(),
         };
     });
     // ─── MCP-001: no_current_agent guard for session tools ───
@@ -1945,6 +1981,25 @@ export async function startDaemon(config) {
         // SI-001: the selector consumes the assignment's signed transport_mode as the
         // sole dial authority — never inferred from address format.
         const assignment = negotiation.assignment;
+        // M8B F13: validate-what-you-receive at the trust boundary. When the responder cannot
+        // proceed it aborts SILENTLY (session-ceremony.ts wireSessionOfferHandler sends nothing)
+        // and the directory folds an EMPTY counterparty endpoint into the FROST-signed
+        // assignment. Accepting that assignment produced a false ok:true + a phantom session
+        // whose failure only surfaced on the first cello_send. Reject it HERE — before any
+        // local session state exists — covering every cause of a missing accept (abort,
+        // offline, crash, timeout) without needing a directory change.
+        if (!assignment.counterparty_session_peer_id) {
+            logger.warn("session.initiate.counterparty_unavailable", {
+                sessionId: Buffer.from(assignment.session_id).toString("hex"),
+                agentName,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "counterparty_unavailable",
+                guidance: "The counterparty did not accept the session offer (it may be offline or unable to receive). No session was established. Verify the counterparty agent is online (its operator can check cello_status), then retry cello_initiate_session.",
+            };
+        }
         const result = await transportSelector.dial(assignment, { correlationId });
         const sessionId = Buffer.from(assignment.session_id).toString("hex");
         if (!result.ok) {
@@ -2155,12 +2210,23 @@ export async function startDaemon(config) {
                     // per-party frontiers, attestation modes, and final_message.answered.
                     return { ok: true, sealed_root: sealedCompletion.rootHex, legibility: sealedCompletion.legibility };
                 }
-                // M7-UPGRADE-002: if THIS close fell through via the auto-ack 'already submitted' path, we
-                // hold no local reported_root to escalate with — and we should not need to: the
-                // counterparty's SEAL ctrl leaf is what triggered our auto-ack, so its seal is already on
-                // the relay and the bilateral seal should finalize. A timeout here is unexpected; report it
-                // as pending rather than escalating to a unilateral seal with no root.
-                if (!submit.ok) {
+                // M8B FINDING-1: `responder_seal_already_submitted` has two producers — (a) the auto-ack
+                // path submitted our leaf because the COUNTERPARTY's SEAL arrived, or (b) our OWN earlier
+                // close submitted it and the counterparty never co-closed. The result now carries the
+                // first submit's reportedRootHex/sequenceNumber, so a retry close can still escalate to a
+                // unilateral seal (case b — the live-deadlock path). We deliberately do NOT distinguish
+                // (a) from (b) client-side: the bilateral wait above already gave case (a) its window, and
+                // the directory's grace/already-sealed gates arbitrate a redundant seal_unilateral — that
+                // is the sovereign-node-correct shape. Only when the not-ok result carries NO root (the
+                // first submit is still in flight) is "pending" the honest terminal answer here.
+                const escalation = submit.ok
+                    ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
+                    : submit.reason === "responder_seal_already_submitted" &&
+                        typeof submit.reportedRootHex === "string" &&
+                        typeof submit.sequenceNumber === "number"
+                        ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
+                        : null;
+                if (!escalation) {
                     return {
                         ok: false,
                         reason: "seal_pending_bilateral",
@@ -2193,8 +2259,8 @@ export async function startDaemon(config) {
                 const sent = await sendOver(record.agent_name, {
                     type: "seal_unilateral",
                     session_id: new Uint8Array(Buffer.from(sessionId, "hex")),
-                    reported_root: new Uint8Array(Buffer.from(submit.reportedRootHex, "hex")),
-                    reported_seq: submit.sequenceNumber,
+                    reported_root: new Uint8Array(Buffer.from(escalation.reportedRootHex, "hex")),
+                    reported_seq: escalation.sequenceNumber,
                     seal_leaves,
                 });
                 if (!sent.ok) {
@@ -2217,10 +2283,14 @@ export async function startDaemon(config) {
                     return { ok: true, sealed_root: uniResult.sealedRootHex, seal_type: "unilateral" };
                 }
                 if (uniResult.reason === "seal_unilateral_too_early") {
+                    // F20: tell the operator WHEN the unilateral seal becomes available, not just "later".
+                    const when = typeof uniResult.remainingSeconds === "number"
+                        ? `A unilateral seal becomes available in ~${uniResult.remainingSeconds}s. `
+                        : "";
                     return {
                         ok: false,
                         reason: "seal_counterparty_pending",
-                        guidance: "Your SEAL leaf is recorded, but the counterparty has not closed and the directory's delivery-grace window has not yet elapsed, so a unilateral seal is not yet allowed. Retry cello_close_session after the grace period, or once the counterparty closes.",
+                        guidance: `Your SEAL leaf is recorded, but the counterparty has not closed and the directory's delivery-grace window has not yet elapsed, so a unilateral seal is not yet allowed. ${when}Retry cello_close_session after the grace period, or once the counterparty closes.`,
                     };
                 }
                 return {
@@ -2915,6 +2985,17 @@ export async function startDaemon(config) {
     }
     async function acceptInboundAssignment(parsed, agentName, correlationId) {
         try {
+            // M8B F14 (fix 2): KICK creation before polling — an inbound offer arriving while no
+            // receiver exists and none is being created must trigger the ensure itself (the doc
+            // comment's "retries on demand" made true), instead of polling a creation nobody
+            // started and dropping the offer. Fire-and-forget: the poll below observes readiness.
+            void sessionNodeManager.ensureStandingReceiverForAgent(agentName).catch((err) => {
+                logger.warn("session.standing_receiver.ensure.failed", {
+                    agentName,
+                    reason: err instanceof Error ? err.message : String(err),
+                    correlationId,
+                });
+            });
             // M2: do not drop the session if this agent's standing receiver is mid-rebuild.
             const ready = await waitForStandingReceiver(agentName);
             if (!ready) {
@@ -3038,11 +3119,15 @@ export async function startDaemon(config) {
         // is NOT yet verified here. The old client's receiveSessionAssignment performed that
         // check; it must be re-homed natively before this path faces a real (untrusted)
         // directory. Until then we accept directory-pushed assignments on trust — the in-process
-        // seam tests inject trusted frames. This is logged loudly, never silent.
-        logger.warn("session.inbound.assignment.unverified", {
+        // seam tests inject trusted frames.
+        // M8B F15: logged at DEBUG with an "expected" note — it fires on EVERY healthy inbound
+        // session, and at WARN it read as a failure and actively misled live diagnosis. The
+        // deferred-verification state is a known, tracked gap (SESSION-004), not a per-session
+        // anomaly.
+        logger.debug("session.inbound.assignment.unverified", {
             sessionId: parsed.sessionIdHex,
             agentName: localAgent.name,
-            note: "FROST assignment signature verification deferred to SESSION-004 re-home",
+            note: "FROST assignment signature verification deferred to SESSION-004 re-home (expected on every inbound session until SESSION-004)",
             correlationId,
         });
         inboundInFlight.add(parsed.sessionIdHex);
@@ -3741,6 +3826,18 @@ export async function startDaemon(config) {
             // 3) Out of time — non-blocking-equivalent empty answer.
             const remaining = deadline - Date.now();
             if (remaining <= 0) {
+                // M8B F16: a dead session must not return the SAME null timeout as a
+                // quiet-but-healthy one. The liveness signal (session.liveness.changed → gone,
+                // tracked per session by the node manager) finally reaches the MCP surface here.
+                if (sessionNodeManager.getSessionLiveness(agentName, sessionId) === "gone") {
+                    return {
+                        ok: true,
+                        content: null,
+                        reason: "counterparty_gone",
+                        liveness: "gone",
+                        guidance: "The counterparty's session connection has dropped (liveness: gone) — it may have crashed or gone offline. No more content will arrive on the direct path. Call cello_close_session to seal the session; if the counterparty never co-closes, a unilateral seal becomes available after the directory's delivery-grace window.",
+                    };
+                }
                 return { ok: true, content: null, guidance: "No content arrived within timeout_ms. Call cello_receive again to keep waiting, or read cello_get_transcript for the full session history." };
             }
             await new Promise((r) => setTimeout(r, Math.min(20, remaining)));