@cello-protocol/daemon 0.0.37 → 0.0.38

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAO/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAw9K7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAwoL7E"}

package/dist/daemon.js

@@ -50,10 +50,11 @@ import { attemptSealUpgrade as attemptSealUpgradeImpl, verifyUpgradeConfirmedCer
 import { upgradeAbsentToRecovered, hasAbsentParticipant } from "./seal-receipt-upgrade.js";
 // CELLO-M7-MSG-001 (AC-013/AC-018): the single application content-size cap, enforced
 // at the send point here (the receive point lives in the transport content decode).
-import { MAX_CONTENT_BYTES, computeGenesisPrevRoot, buildAgentRevocationTbs } from "@cello-protocol/protocol-types";
+import { MAX_CONTENT_BYTES, computeGenesisPrevRoot, buildAgentRevocationTbs, MONIKER_RE, validateMoniker } from "@cello-protocol/protocol-types";
 import { resolveCelloEnv, createTransportSelector, isProductionVariant, } from "./transport-composition.js";
 import { selectAdvertisedAddress } from "./transport-selector.js";
-import { parseSessionAssignment, sessionRequestErrorReason, parseDiscoveryLookupResult, discoveryLookupErrorReason } from "./session-assignment-parser.js";
+import { parseSessionAssignment, sessionRequestErrorReason, parseDiscoveryLookupResult, discoveryLookupErrorReason, extractOfferedMoniker, resolveOutboundMoniker } from "./session-assignment-parser.js";
+import { whoLabel } from "./who-label.js";
 import { classifyOnlineResult } from "./cross-node-negotiation.js";
 import { wireSessionCeremonyHandler, wireSessionOfferHandler, wireSealCeremonyHandler, verifyUnilateralCertificate, verifyBilateralSealCertificate, runAgentRefresh } from "./session-ceremony.js";
 import { reDeriveFrontiers, findInflatedFrontier, checkUnilateralFrontier } from "./seal-frontier-verify.js";
@@ -900,8 +901,27 @@ export async function startDaemon(config) {
     // Wraps notificationDispatcher.dispatchSessionStateChanged so every call site gets the
     // Telegram state-change doorbell for free (DoD: state changes ALWAYS ring, never coalesced) —
     // one wrapper rather than hooking each of the several existing call sites individually.
+    // MONIKER-4 AC2: resolve the counterparty's display label — local pet name (MONIKER-3) ??
+    // offered name for this session (MONIKER-2) ?? fingerprint. Total: any failure inside
+    // resolution degrades to fingerprint via whoLabel's own tiers; a label can never block a
+    // doorbell (spec §8).
+    function resolveWho(agentName, pubkeyHex, sessionIdHex) {
+        let localMoniker = null;
+        try {
+            localMoniker = sessionNodeManager.getContactMoniker(agentName, pubkeyHex);
+        }
+        catch (err) {
+            logger.warn("moniker.local.read_failed", { agentName, pubkey: pubkeyHex, reason: err instanceof Error ? err.message : String(err) });
+        }
+        const resolved = whoLabel({ localMoniker, offeredMoniker: offeredMonikers.get(sessionIdHex) ?? null, pubkeyHex });
+        logger.debug("moniker.resolved", { agentName, pubkey: pubkeyHex, source: resolved.source });
+        return { who: resolved.who, whoKnown: resolved.whoKnown };
+    }
     function dispatchSessionStateChangedWithTelegram(agentName, sessionId, state, counterpartyPubkey) {
-        notificationDispatcher.dispatchSessionStateChanged(agentName, sessionId, state, counterpartyPubkey);
+        // MONIKER-4 AC2: stamp who/whoKnown on the counterparty-bearing frame. Resolved BEFORE the
+        // offered-name drop below so a terminal state's own doorbell still shows the name.
+        const who = counterpartyPubkey ? resolveWho(agentName, counterpartyPubkey, sessionId) : undefined;
+        notificationDispatcher.dispatchSessionStateChanged(agentName, sessionId, state, counterpartyPubkey, who);
         void sendTelegramDoorbell(agentName, sessionId, "state_change", `Session ${state}`);
         // Reviewer HIGH fix (a60d68ed): telegramRungUnread had NO cleanup at all — a session that
         // rings once and is never read via cello_receive/since_seq (e.g. the operator only ever uses
@@ -911,6 +931,14 @@ export async function startDaemon(config) {
         // preferable to an unbounded leak (the exact class of bug fixed for TTL-1's expired-log at
         // af8a701 in this same milestone).
         clearTelegramRung(agentName, sessionId);
+        // MONIKER-2 AC2b (review F1): the offered name is display material for the session's
+        // lifetime only. Production emits "created", "interrupted", "counterparty_closing" through
+        // this wrapper — a terminal-only check was dead code and left the map growing for the
+        // daemon's lifetime (remote-fed). Drop on ANY state past "created": a prematurely dropped
+        // label degrades to fingerprint, which the spec sanctions; an unbounded map does not.
+        if (state !== "created" && offeredMonikers.delete(sessionId)) {
+            logger.debug("moniker.offer.dropped", { sessionId, state });
+        }
     }
     async function handleInboundTelegramUpdate(update, client) {
         const chatId = update.message?.chat?.id !== undefined ? String(update.message.chat.id) : undefined;
@@ -1084,6 +1112,28 @@ export async function startDaemon(config) {
             if (t === "session_assignment" || t === "session_request_error")
                 resolveFrame(frame);
         });
+        // MONIKER-2 AC1: the outbound name rides the request (agent name, or the MONIKER-1
+        // override), re-validated at offer construction (defense in depth) and OMITTED — never
+        // an empty string — when absent or invalid. A failure reading it must never block the
+        // session (spec §8: the label degrades, the session forms), but it is logged loudly.
+        let moniker;
+        try {
+            const outboundName = new DbIdentityStore(sessionNodeManager.getDb(), logger).getOutboundName(agentName);
+            moniker = resolveOutboundMoniker(outboundName);
+            // Review F4: omit-not-send is the designed degradation, but an agent whose STORED name
+            // fails the rule should be visible, not silently nameless on the wire.
+            if (outboundName !== null && moniker === undefined) {
+                logger.debug("moniker.outbound.invalid_name_omitted", { agentName, correlationId });
+            }
+        }
+        catch (err) {
+            logger.warn("moniker.outbound.read_failed", {
+                agentName,
+                reason: err instanceof Error ? err.message : String(err),
+                correlationId,
+            });
+            moniker = undefined;
+        }
         try {
             const sent = await signaling.sendRaw({
                 type: "session_request",
@@ -1091,6 +1141,7 @@ export async function startDaemon(config) {
                 initiator_session_peer_id: sr.peerId,
                 initiator_session_addrs: sr.addrs,
                 wants_session_offer: true,
+                ...(moniker !== undefined ? { moniker } : {}),
             });
             if (!sent.ok) {
                 return { ok: false, reason: sent.reason ?? "directory_unreachable", guidance: sent.guidance ?? "Could not send session_request over the directory signaling stream." };
@@ -1744,9 +1795,9 @@ export async function startDaemon(config) {
     // the encrypted DB (NO key file), and wire the agent into the live daemon so it can be registered
     // and used WITHOUT a restart. Creation is explicit — cello_start_agent never auto-creates on a typo.
     handlers.set("cello_create_agent", async (params, _connectionId) => {
-        const name = params?.name;
-        if (!name || typeof name !== "string" || !/^[a-zA-Z0-9_-]{1,64}$/.test(name)) {
-            return { ok: false, reason: "invalid_agent_name", guidance: "Provide a 'name' (1-64 chars: letters, digits, '-' or '_') for the new agent." };
+        const name = validateMoniker(params?.name);
+        if (name === null) {
+            return { ok: false, reason: "invalid_agent_name", guidance: `Provide a 'name' (1-64 chars: letters, digits, '-' or '_'; regex ${MONIKER_RE.source}) for the new agent.` };
         }
         const store = new DbIdentityStore(sessionNodeManager.getDb(), logger);
         if (store.hasActiveAgent(name) || agents.some((a) => a.name === name)) {
@@ -1851,9 +1902,9 @@ export async function startDaemon(config) {
         }
     }
     handlers.set("cello_remove_agent", async (params, _connectionId) => {
-        const name = params?.name;
-        if (!name || typeof name !== "string" || !/^[a-zA-Z0-9_-]{1,64}$/.test(name)) {
-            return { ok: false, reason: "invalid_agent_name", guidance: "Provide the 'name' of the agent to remove (1-64 chars: letters, digits, '-' or '_')." };
+        const name = validateMoniker(params?.name);
+        if (name === null) {
+            return { ok: false, reason: "invalid_agent_name", guidance: `Provide the 'name' of the agent to remove (1-64 chars: letters, digits, '-' or '_'; regex ${MONIKER_RE.source}).` };
         }
         const store = new DbIdentityStore(sessionNodeManager.getDb(), logger);
         // The active row (a fresh removal) OR the most-recent retired row (a DB-001 re-push). Captured BEFORE
@@ -3381,6 +3432,8 @@ export async function startDaemon(config) {
             sessionId: row.session_id,
             agentName: row.agent_name,
             counterpartyPubkey: row.counterparty_pubkey,
+            // MONIKER-5 AC1: the same resolution the doorbell uses — pet name ?? offered ?? fingerprint.
+            ...resolveWho(row.agent_name, row.counterparty_pubkey, row.session_id),
             status: row.status,
             category,
             messageCount,
@@ -3868,6 +3921,10 @@ export async function startDaemon(config) {
             correlationId,
         });
     }
+    // MONIKER-2 AC2b: sessionIdHex → the initiator's validated offered name. Session-scoped
+    // display material ONLY (spec: promotion to a stored pet name needs an explicit operator
+    // action). In-memory by design — a restart degrades the label to fingerprint, never worse.
+    const offeredMonikers = new Map();
     // Expired requests move HERE (from inboundSessionQueues) rather than vanishing — visible via
     // cello_check_notifications so the operator can see what they missed, not just silence.
     const expiredSessionRequests = new Map();
@@ -3928,6 +3985,10 @@ export async function startDaemon(config) {
                     expiredList.splice(0, expiredList.length - EXPIRED_SESSION_REQUESTS_CAP); // keep newest N
                 }
                 logger.info("session.request.expired", { agentName, sessionId: e.sessionIdHex, enqueuedAt: e.enqueuedAt });
+                // MONIKER-2 AC2b (review F1): the offer's display name expires with the offer.
+                if (offeredMonikers.delete(e.sessionIdHex)) {
+                    logger.debug("moniker.offer.dropped", { sessionId: e.sessionIdHex, state: "expired" });
+                }
             }
             else {
                 live.push(e);
@@ -4024,6 +4085,8 @@ export async function startDaemon(config) {
         const relayAddrs = relayEndpoint && Array.isArray(relayEndpoint["multiaddrs"])
             ? relayEndpoint["multiaddrs"].filter((m) => typeof m === "string")
             : [];
+        // MONIKER-2 AC2: validate the offered name ONCE, at this wire boundary.
+        const monikerResult = extractOfferedMoniker(a);
         return {
             sessionIdHex,
             participantAPubkeyHex,
@@ -4038,6 +4101,9 @@ export async function startDaemon(config) {
             signerPubkeyHex: a["signer_pubkey"] !== undefined ? frameValueToHex(a["signer_pubkey"]) : null,
             relayPeerId,
             relayAddrs,
+            offeredMoniker: monikerResult.offeredMoniker,
+            monikerRejected: monikerResult.rejected,
+            monikerRejectReason: monikerResult.reason ?? null,
         };
     }
     // Wait (bounded) for THIS AGENT's standing receiver to be ready. acceptSession consumes the
@@ -4142,10 +4208,28 @@ export async function startDaemon(config) {
                 sessionPeerId: result.peerId,
                 correlationId,
             });
+            // MONIKER-2 AC2: a present-but-invalid moniker is a red flag (the sender runs modified
+            // code) — logged with the spec'd fields and NEVER the raw value. Not grounds to refuse
+            // the session (version skew is real; refusing hands strangers a DoS lever).
+            if (parsed.monikerRejected) {
+                logger.info("moniker.rejected", {
+                    agentName,
+                    pubkey: parsed.participantAPubkeyHex,
+                    reason: parsed.monikerRejectReason ?? "invalid",
+                    correlationId,
+                });
+            }
+            // MONIKER-2 AC2b: display material for THIS offer/session only (never persisted, never
+            // auto-written to contacts — AC3). Session-scoped: MONIKER-4's dispatcher resolves
+            // whoLabel from here; entries are dropped when the session's terminal state dispatches.
+            if (parsed.offeredMoniker !== null) {
+                offeredMonikers.set(parsed.sessionIdHex, parsed.offeredMoniker);
+            }
             enqueueInboundSession(agentName, {
                 sessionIdHex: parsed.sessionIdHex,
                 counterpartyPubkeyHex: parsed.participantAPubkeyHex,
                 genesisPrevRootHex,
+                offeredMoniker: parsed.offeredMoniker,
             });
             dispatchSessionStateChangedWithTelegram(agentName, parsed.sessionIdHex, "created", parsed.participantAPubkeyHex);
             // M8C-TGDOOR-1: session requests ALWAYS ring (DoD) — no coalescing, unlike message-waiting.
@@ -4362,6 +4446,8 @@ export async function startDaemon(config) {
             session_id: e.sessionIdHex,
             counterparty_pubkey: e.counterpartyPubkeyHex,
             genesis_prev_root: e.genesisPrevRootHex,
+            // MONIKER-2: validated-at-boundary display hint; null = absent or rejected.
+            offered_moniker: e.offeredMoniker ?? null,
         });
         reapExpiredInboundSessions(agentName); // M8C-TTL-1: don't hand back a stale expired entry
         const queued = inboundSessionQueues.get(agentName);
@@ -5214,9 +5300,54 @@ export async function startDaemon(config) {
         const resolved = resolveContactAgent(perConnectionState.get(connectionId), params);
         if (!resolved.ok)
             return resolved;
-        sessionNodeManager.addContact(resolved.agent, pubkey);
+        // MONIKER-3 AC3: optional pet name. Invalid → reject the request WHOLE (no contact row
+        // either) — a half-applied add would store trust without the name the operator asked for.
+        let moniker;
+        if (params && "moniker" in params && params.moniker !== undefined && params.moniker !== null) {
+            moniker = validateMoniker(params.moniker);
+            if (moniker === null) {
+                return {
+                    ok: false,
+                    reason: "invalid_moniker",
+                    guidance: `A moniker is 1-64 chars: letters, digits, '-' or '_' (regex ${MONIKER_RE.source}).`,
+                };
+            }
+        }
+        sessionNodeManager.addContact(resolved.agent, pubkey, moniker);
         logger.info("contact.added", { agent: resolved.agent, pubkey });
-        return { ok: true, agent: resolved.agent, pubkey };
+        if (moniker !== undefined) {
+            logger.info("contact.moniker.set", { agentName: resolved.agent, pubkey });
+        }
+        // Review F3: echo the moniker ONLY when one rode this request — a re-add without a moniker
+        // must not report null while an earlier pet name is still stored.
+        return moniker !== undefined
+            ? { ok: true, agent: resolved.agent, pubkey, moniker }
+            : { ok: true, agent: resolved.agent, pubkey };
+    });
+    // MONIKER-3 AC3: rename (string) or clear (null) an existing contact's pet name. Absence of the
+    // key is NOT a clear (Entry-66-F3): a request that omits it is malformed and rejected.
+    handlers.set("cello_contact_set_moniker", async (params, connectionId) => {
+        const pubkey = typeof params?.pubkey === "string" ? params.pubkey : undefined;
+        if (!pubkey || !params || !("moniker" in params)) {
+            return { ok: false, reason: "missing_params", guidance: "Provide 'pubkey' (hex) and 'moniker' — a string to set the pet name, or null to clear it." };
+        }
+        const resolved = resolveContactAgent(perConnectionState.get(connectionId), params);
+        if (!resolved.ok)
+            return resolved;
+        const raw = params.moniker ?? null;
+        const moniker = raw === null ? null : validateMoniker(raw);
+        if (raw !== null && moniker === null) {
+            return {
+                ok: false,
+                reason: "invalid_moniker",
+                guidance: `A moniker is 1-64 chars: letters, digits, '-' or '_' (regex ${MONIKER_RE.source}). Pass null to clear.`,
+            };
+        }
+        if (!sessionNodeManager.setContactMoniker(resolved.agent, pubkey, moniker)) {
+            return { ok: false, reason: "contact_not_found", guidance: `No contact ${pubkey.slice(0, 16)}… for agent '${resolved.agent}'. Add it first with cello_contact_add.` };
+        }
+        logger.info("contact.moniker.set", { agentName: resolved.agent, pubkey, cleared: moniker === null });
+        return { ok: true, agent: resolved.agent, pubkey, moniker };
     });
     handlers.set("cello_contact_remove", async (params, connectionId) => {
         const pubkey = typeof params?.pubkey === "string" ? params.pubkey : undefined;
@@ -5234,9 +5365,44 @@ export async function startDaemon(config) {
         const resolved = resolveContactAgent(perConnectionState.get(connectionId), params);
         if (!resolved.ok)
             return resolved;
-        const contacts = sessionNodeManager.listContacts(resolved.agent);
+        // MONIKER-5 AC1: each row shows the resolved who (a contact has no session, so the offered
+        // tier doesn't apply — pet name ?? fingerprint).
+        const contacts = sessionNodeManager.listContacts(resolved.agent).map((c) => ({
+            ...c,
+            ...whoLabel({ localMoniker: c.moniker, offeredMoniker: null, pubkeyHex: c.pubkey }),
+        }));
         return { ok: true, agent: resolved.agent, contacts };
     });
+    // MONIKER-1 AC2/AC3: cello_set_moniker — set (or clear, via explicit null) an agent's outbound-name
+    // override on the agents table. Validated at set-time with the shared MONIKER-0 rule; an invalid
+    // value is rejected here AND at the store (backstop) — it can never be stored. Local-only: the
+    // name is never sent to the directory (AC4).
+    handlers.set("cello_set_moniker", async (params, connectionId) => {
+        const resolved = resolveContactAgent(perConnectionState.get(connectionId), params);
+        if (!resolved.ok)
+            return resolved;
+        // Absence is NOT a clear (review Finding 3): JSON preserves explicit null, so a request
+        // that omits the key is malformed — rejecting it keeps a dropped field from silently
+        // deleting a stored override while reporting success.
+        if (!params || !("moniker" in params)) {
+            return { ok: false, reason: "missing_params", guidance: "Provide 'moniker' — a string to set the outbound name, or null to clear the override." };
+        }
+        const raw = params.moniker ?? null;
+        const moniker = raw === null ? null : validateMoniker(raw);
+        if (raw !== null && moniker === null) {
+            return {
+                ok: false,
+                reason: "invalid_moniker",
+                guidance: `A moniker is 1-64 chars: letters, digits, '-' or '_' (regex ${MONIKER_RE.source}). Pass null to clear the override.`,
+            };
+        }
+        const store = new DbIdentityStore(sessionNodeManager.getDb(), logger);
+        if (!store.setMoniker(resolved.agent, moniker)) {
+            return { ok: false, reason: "agent_not_found", guidance: `No active agent named '${resolved.agent}'. See cello_list_agents.` };
+        }
+        logger.info("agent.moniker.set", { agentName: resolved.agent, cleared: moniker === null });
+        return { ok: true, agent: resolved.agent, moniker };
+    });
     // M8C-TGDOOR-1: cello_telegram_set_token — persist the daemon-wide bot token + allowlisted
     // operator chat ID, then start the poller immediately (no restart needed).
     handlers.set("cello_telegram_set_token", async (params, _connectionId) => {
@@ -5289,7 +5455,8 @@ export async function startDaemon(config) {
     // content-free `cello_message` doorbell to the current-agent connection(s). The shim's generic
     // bridge (WAKE) forwards it to a live --channels session as notifications/claude/channel.
     sessionNodeManager.setOnContentArrived((agentName, sessionId, senderPubkey) => {
-        notificationDispatcher.dispatchCelloMessage(agentName, sessionId, senderPubkey);
+        // MONIKER-4 AC2: the message doorbell names the sender the same way the session doorbell does.
+        notificationDispatcher.dispatchCelloMessage(agentName, sessionId, senderPubkey, resolveWho(agentName, senderPubkey, sessionId));
         // M8C-AWAY-1: an unattended agent auto-acks an inbound message on an existing session.
         void sendAwayResponse(agentName, sessionId, "message");
         // M8C-TGDOOR-1: message-waiting — coalesced (ring-once-until-read) inside sendTelegramDoorbell.