@cello-protocol/daemon 0.0.35 → 0.0.36

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAO/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA+7K7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAO/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAi9K7E"}

package/dist/daemon.js

@@ -1559,13 +1559,19 @@ export async function startDaemon(config) {
     // no background timer). A session the standing receiver opened from an inbound offer the initiator
     // ABANDONED stays "active" forever (the counterparty never joins), clutters the open/active lists, and
     // its normal close fires an unsealable bilateral seal. Mark such a session terminal ("abandoned") once
-    // it is PROVABLY dead: status active + counterparty never established (liveness != "alive" AND 0
-    // RECEIVED messages — message_count alone counts our own auto-"Dispatched." ack, so it is NOT the
-    // signal) + age past the grace TTL (a genuinely fresh session still setting up must survive).
+    // it is PROVABLY dead: counterparty never established (liveness != "alive" AND 0 RECEIVED messages —
+    // message_count alone counts our own auto-"Dispatched." ack, so it is NOT the signal) + age past the
+    // grace TTL (a genuinely fresh session still setting up must survive).
+    // CC-10 (live 2026-07-08 Phase-2 block): scan 'interrupted' too, not just 'active'. A daemon restart
+    // flips dead half-opens to 'interrupted'; those classify as "failed" (invisible in every list) yet
+    // still count toward the unknown-sender acceptance bound (D18 deliberately counts 'interrupted') — so
+    // a stranger whose first handshakes died was silently locked out FOREVER. Reaping only 0-RECEIVED
+    // ghosts keeps D18 intact: the disconnect-evasion attacker's sessions always carry received content.
     const HALF_OPEN_TTL_MS = Number(process.env["CELLO_HALF_OPEN_TTL_MS"]) || 5 * 60 * 1000;
     function reapDeadHalfOpenSessions(agentName) {
         const now = Date.now();
-        for (const row of sessionNodeManager.getSessionsByStatus("active")) {
+        const candidates = [...sessionNodeManager.getSessionsByStatus("active"), ...sessionNodeManager.getSessionsByStatus("interrupted")];
+        for (const row of candidates) {
             if (agentName !== undefined && row.agent_name !== agentName)
                 continue;
             if (now - row.created_at <= HALF_OPEN_TTL_MS)
@@ -1575,11 +1581,18 @@ export async function startDaemon(config) {
             if (sessionNodeManager.countReceivedMessages(row.agent_name, row.session_id) > 0)
                 continue; // counterparty spoke
             // Non-awaited: abandonSession flips the DB status synchronously (before its first await), so THIS
-            // read reflects it; the async node teardown finishes in the background.
-            void sessionNodeManager.abandonSession(row.agent_name, row.session_id).catch((err) => {
+            // read reflects it; the async node teardown finishes in the background. CC-10 reviewer LOW: only
+            // log "reaped" if the status flip actually wrote — a swallowed write failure already logs
+            // session.status.write.failed, and reporting success over it would hide a still-counting ghost.
+            void sessionNodeManager.abandonSession(row.agent_name, row.session_id)
+                .then((flipped) => {
+                if (flipped) {
+                    logger.info("session.half_open.reaped", { agentName: row.agent_name, sessionId: row.session_id, priorStatus: row.status, ageMs: now - row.created_at });
+                }
+            })
+                .catch((err) => {
                 logger.warn("session.half_open.reap.failed", { agentName: row.agent_name, sessionId: row.session_id, reason: err instanceof Error ? err.message : String(err) });
             });
-            logger.info("session.half_open.reaped", { agentName: row.agent_name, sessionId: row.session_id, ageMs: now - row.created_at });
         }
     }
     // M8B F16: per-session liveness for ACTIVE sessions, shared by both status surfaces
@@ -4044,6 +4057,11 @@ export async function startDaemon(config) {
             // senders — a per-sender cap (many sessions from ONE stranger) and a global cap (many
             // sessions across ALL strangers combined). Known contacts are exempt ("bounded only by
             // disk" — DoD). Checked FIRST, before any standing-receiver work, so a refusal is cheap.
+            // CC-10: reap provably-dead ghosts for THIS agent before counting — otherwise invisible
+            // interrupted 0-received sessions (post-restart shape) consume the sender's budget forever
+            // and lock the stranger out with no list read ever clearing them. Safe here: abandonSession
+            // flips the DB status synchronously, so the bound query below sees the reaped state.
+            reapDeadHalfOpenSessions(agentName);
             const bound = sessionNodeManager.checkUnknownSenderAcceptanceBound(agentName, parsed.participantAPubkeyHex);
             if (!bound.ok) {
                 logger.warn("session.inbound.accept.failed", {