@cello-protocol/daemon 0.0.48 → 0.0.50

package/dist/session-node-manager.js

@@ -81,11 +81,14 @@ import { SessionTree } from "./session-tree.js";
 import { CELLO_CONTENT_PROTOCOL_ID, NodeAutoNatService } from "@cello-protocol/transport";
 import { verify } from "@cello-protocol/crypto";
 import { encodeSealPayload, MONIKER_RE, validateMoniker } from "@cello-protocol/protocol-types";
+import { decodeParkEnvelope, authenticateParkedEntry, pubkeyMatchesHex } from "./park-envelope.js";
 import { AgentRelayClient, LEAF_KIND_CTRL } from "./session-relay-client.js";
 import { RelayReceiptStore } from "./relay-receipt-store.js";
 import { SessionSealLeafStore } from "./session-seal-leaf-store.js";
 import { PassthroughGatewayClient, GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, } from "@cello-protocol/gateway";
 const CBOR_ENC = new Encoder({ tagUint8Array: false });
+/** SEC-1 / review M4: cap on the refused-parked-entry memo (remote-fed → must be bounded). */
+const MAX_REFUSED_PARKED_ENTRIES = 512;
 // M8C-ABUSE-1 + DOD-TIER-2: persistence bounds. Formerly a binary "known contacts exempt entirely,
 // everyone else 3 sessions / 25 MB"; now TIER-GRADUATED via DEFAULT_TIER_BOUNDS (contacts-tier-
 // migration). The two consts below are kept for back-compat but DERIVE from the grid's UNKNOWN row —
@@ -231,6 +234,12 @@ export class SessionNodeManager {
      * (direct-fail or TTF expiry). The daemon's hook seals (sealToRecipient) + deposits via
      * ContentParkClient. Best-effort.
      */
+    /**
+     * SEC-1 / review M4: parked entries already refused by the authentication gate, keyed
+     * `${agent}:${session}:${contentHash}` → the refusal reason. Bounded (see
+     * #rememberRefusedParkedEntry) because its keys come from a REMOTE mailbox.
+     */
+    #refusedParkedEntries = new Map();
     #contentParkHook = null;
     constructor(opts) {
         this.#factory = opts.factory;
@@ -286,6 +295,8 @@ export class SessionNodeManager {
             return false;
         try {
             const result = await hook({
+                // SEC-1: the hook must sign as the SENDING agent — it needs to know who that is.
+                agentName,
                 sessionId,
                 recipientPubkeyHex: entry.counterpartyPubkey,
                 relayPeerId: entry.relayPeerId,
@@ -3464,37 +3475,101 @@ export class SessionNodeManager {
      * structure2_cbor = [seq, sender_pubkey, content_hash, sender_signature, scan_result, prev_root].
      */
     /**
-     * DOD-MSG-4 (2b): encode the pre-seal park envelope `[1, content, structure1_cbor|null,
-     * structure2_cbor|null]`. The daemon seals THIS (not the bare content) so a parked entry carries
-     * its own signed ordering record — recover then orders it the same way the direct frame does. The
-     * relay still only ever holds the sealed ciphertext (INV-3 preserved).
+     * DOD-MSG-4 (2b) / SEC-1: decode a park envelope. Legacy/unsigned shapes still DECODE so that
+     * `recoverParkedEntry` can refuse them BY NAME (`unsigned_envelope`) — decoding is not accepting.
+     * Encoding lives in park-envelope.ts and REQUIRES a sender signature (see SEC-1); it is not
+     * exposed here, so no caller can seal an unsigned envelope through this class.
      */
-    encodeParkEnvelope(content, structure1Cbor, structure2Cbor) {
-        return CBOR_ENC.encode([1, content, structure1Cbor ?? null, structure2Cbor ?? null]);
+    decodeParkEnvelope(plaintext) {
+        return decodeParkEnvelope(plaintext);
     }
     /**
-     * DOD-MSG-4 (2b): decode a park envelope produced by encodeParkEnvelope. Falls back to treating the
-     * whole plaintext as raw content (no ordering record) for entries sealed the old way (e.g. test
-     * fixtures that seal bare content) — so recover stays backward-compatible.
+     * SEC-1 — THE ONLY WAY PARKED CONTENT ENTERS THE TRANSCRIPT.
+     *
+     * Authentication and ingest are fused here on purpose. Before SEC-1 the recover loop in daemon.ts
+     * did `decode → (maybe verify ordering) → ingest`, where the verify step was OPTIONAL (skipped
+     * entirely when the attacker simply omitted the ordering record) and could not reject anything
+     * even when it ran — it gated ORDERING, not INGEST. Splitting the check from the write is what
+     * made the downgrade possible, so they no longer live apart: a caller cannot ingest parked content
+     * without passing the signature gate, because there is no other entry point.
+     *
+     * FAILS CLOSED. No signature / bad signature / signer is not this session's counterparty / no
+     * session at all → REFUSED, nothing is appended, nothing is written, and the caller MUST NOT
+     * confirm-delete the entry from the relay (a forgery must not be able to evict itself, and a
+     * genuine bug must not silently eat mail).
      */
-    decodeParkEnvelope(plaintext) {
-        try {
-            const arr = decode(plaintext);
-            // Discriminator (review #2): a 4-element array tagged with version 1 + a byte-string content.
-            // The content-hash cross-check in ingestReceivedContent is the real safety net, but narrowing
-            // to length 4 makes a bare-content false-positive astronomically less likely still.
-            if (Array.isArray(arr) && arr.length === 4 && arr[0] === 1 && arr[1] instanceof Uint8Array) {
-                return {
-                    content: arr[1],
-                    structure1Cbor: arr[2] instanceof Uint8Array ? arr[2] : undefined,
-                    structure2Cbor: arr[3] instanceof Uint8Array ? arr[3] : undefined,
-                };
-            }
+    async recoverParkedEntry(agentName, sessionId, recipientPubkey, unsealed, contentHash, correlationId) {
+        const contentHashHex = Buffer.from(contentHash).toString("hex");
+        // Review M4: a refused entry is deliberately NOT confirm-deleted (a forgery must not be able to
+        // evict itself), which means an adversary could otherwise make us unseal + Ed25519-verify the
+        // same forged entries on EVERY reconnect, forever — turning the mailbox into an amplification
+        // vector against our own recover path. Remember what we already refused and skip the crypto on
+        // re-pull. Still never confirmed, so nothing is destroyed. In-memory and BOUNDED: the cost of
+        // forgetting across a restart is one more verify, which is exactly the pre-existing behavior.
+        const refusalKey = `${this.#k(agentName, sessionId)}:${contentHashHex}`;
+        const remembered = this.#refusedParkedEntries.get(refusalKey);
+        if (remembered) {
+            this.#logger.warn("content.recover.unauthenticated", {
+                agentName,
+                sessionId,
+                contentHash: contentHashHex,
+                reason: remembered,
+                repeat: true,
+                correlationId,
+            });
+            return { ok: false, reason: remembered };
+        }
+        const env = decodeParkEnvelope(unsealed);
+        const verdict = authenticateParkedEntry({
+            env,
+            sessionIdHex: sessionId,
+            recipientPubkey,
+            contentHash,
+            counterpartyPubkeyHex: this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey,
+        });
+        if (!verdict.ok) {
+            // SEC-1: loud, and specific about WHICH gate refused — a silent drop here would look
+            // identical to "no mail", which is how an injection attempt would go unnoticed.
+            this.#rememberRefusedParkedEntry(refusalKey, verdict.reason);
+            this.#logger.warn("content.recover.unauthenticated", {
+                agentName,
+                sessionId,
+                contentHash: contentHashHex,
+                reason: verdict.reason,
+                envelopeVersion: env.version,
+                correlationId,
+            });
+            return { ok: false, reason: verdict.reason };
         }
-        catch {
-            /* not an envelope — fall through to raw */
+        // Authenticated. The ordering record (when present) is still verified independently by
+        // #recordFrameOrdering — it answers a different question (WHERE this message sits in the
+        // canonical sequence, per the relay) and is still best-effort: a bad record must not block a
+        // message whose AUTHORSHIP we have now proven.
+        if (env.structure1Cbor && env.structure2Cbor) {
+            this.recordOrderingRecord(agentName, sessionId, env.structure1Cbor, env.structure2Cbor, contentHash, correlationId);
+        }
+        this.#logger.info("content.recover.verified", {
+            agentName,
+            sessionId,
+            contentHash: contentHashHex,
+            correlationId,
+        });
+        return await this.ingestReceivedContent(agentName, sessionId, env.content, contentHash, correlationId);
+    }
+    /**
+     * Review M4: bounded memo of parked entries we have already refused, so a mailbox stuffed with
+     * forgeries cannot force an unbounded unseal+verify on every reconnect. FIFO-capped — the cap
+     * matters more than the retention: forgetting an entry only costs one extra verification, whereas
+     * an unbounded map would be a memory leak fed by a remote party (the exact class the DOD-MSG-4
+     * review already caught once in the offered-moniker map).
+     */
+    #rememberRefusedParkedEntry(key, reason) {
+        if (this.#refusedParkedEntries.size >= MAX_REFUSED_PARKED_ENTRIES) {
+            const oldest = this.#refusedParkedEntries.keys().next();
+            if (!oldest.done)
+                this.#refusedParkedEntries.delete(oldest.value);
         }
-        return { content: plaintext };
+        this.#refusedParkedEntries.set(key, reason);
     }
     /**
      * DOD-MSG-4 (2b): public entry for the recover path to verify + record a parked entry's ordering
@@ -3531,8 +3606,11 @@ export class SessionNodeManager {
             // key. FAIL CLOSED (review L) — if the counterparty pubkey is unknown we cannot prove the signer,
             // so we do NOT trust the framed ordering record (fall back to the witness stream / arrival). The
             // "B does not trust the counterparty for ordering" invariant is non-negotiable; never fail open.
+            // Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from the
+            // IPC param and is never case-normalized, so a string compare would fail for a mixed-case
+            // pubkey and silently strip the canonical ordering from every message in that session.
             const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
-            if (!counterparty || Buffer.from(s1Pubkey).toString("hex") !== counterparty) {
+            if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
                 this.#logger.warn("session.content.ordering.wrong_signer", {
                     sessionId,
                     reason: counterparty ? "signer_not_counterparty" : "counterparty_unknown",