@evomap/evolver 1.89.14 → 1.89.15

package/src/proxy/lifecycle/manager.js

@@ -11,6 +11,7 @@ const {
   isHubUnreachableError,
   readHubResponseJson,
   readHubResponseText,
+  sanitizeHubResponseForLog,
   throwIfHubUnreachableResponse,
 } = require('../../gep/hubFetch');
 const { getEvomapPath } = require('../../gep/paths');
@@ -367,6 +368,81 @@ function parseNodeSecretVersion(value) {
   return Number.isInteger(n) && n > 0 ? n : null;
 }
 
+const NODE_SECRET_RE = /^[a-f0-9]{64}$/i;
+const NODE_SECRET_SUPPRESSION_RE = /^sha256:[a-f0-9]{64}$/i;
+const SECRET_DIVERGENCE_ERROR = 'secret_diverged_cleared';
+const SECRET_DIVERGENCE_REASON_CODES = [
+  'node_secret_invalid',
+  'invalid_secret',
+  'rotation_requires_current_secret',
+];
+
+function validNodeSecret(value) {
+  return typeof value === 'string' && NODE_SECRET_RE.test(value);
+}
+
+function getEnvNodeSecret() {
+  return ((process.env.A2A_NODE_SECRET || process.env.EVOMAP_NODE_SECRET || '').trim() || null);
+}
+
+function fingerprintNodeSecret(secret) {
+  if (!validNodeSecret(secret)) return null;
+  const normalized = String(secret).trim().toLowerCase();
+  return 'sha256:' + crypto.createHash('sha256').update(normalized).digest('hex');
+}
+
+function truthyState(value) {
+  const v = String(value || '').trim().toLowerCase();
+  return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+
+function matchSecretDivergenceReason(value) {
+  const reason = String(value || '').trim().toLowerCase();
+  if (!reason) return null;
+  return SECRET_DIVERGENCE_REASON_CODES.find((code) => reason.includes(code)) || null;
+}
+
+function extractSecretDivergenceReason(data) {
+  const candidates = [
+    data?.payload?.reason,
+    data?.payload?.error,
+    data?.reason,
+    data?.error,
+  ];
+  for (const value of candidates) {
+    const reason = matchSecretDivergenceReason(value);
+    if (reason) return reason;
+  }
+  return null;
+}
+
+function isSecretDivergenceError(error) {
+  return error === SECRET_DIVERGENCE_ERROR || Boolean(matchSecretDivergenceReason(error));
+}
+
+function safeHubErrorCode(data, statusCode) {
+  const candidates = [
+    data?.error,
+    data?.reason,
+    data?.payload?.error,
+    data?.payload?.reason,
+  ];
+  for (const value of candidates) {
+    if (typeof value !== 'string') continue;
+    const code = value.trim();
+    if (/^[a-z][a-z0-9_:-]{0,79}$/i.test(code)) return code;
+  }
+  return `http_${statusCode}`;
+}
+
+function normalizeNodeSecretEnvSuppression(value) {
+  const raw = String(value || '').trim();
+  if (!raw) return null;
+  if (truthyState(raw)) return 'true';
+  const lower = raw.toLowerCase();
+  return NODE_SECRET_SUPPRESSION_RE.test(lower) ? lower : null;
+}
+
 class LifecycleManager {
   constructor({ hubUrl, store, logger, getTaskMeta } = {}) {
     this.hubUrl = (hubUrl || process.env.A2A_HUB_URL || '').replace(/\/+$/, '');
@@ -386,6 +462,11 @@ class LifecycleManager {
     this._lastDriftCheckAt = 0;
     this._hubUnreachableFailures = 0;
     this._hubUnreachableUntil = 0;
+    this._envSecretSuppressionMarker = normalizeNodeSecretEnvSuppression(this.store && this.store.getState
+      ? this.store.getState('node_secret_env_suppressed')
+      : null);
+    this._envSuppressionClearedForSecret = null;
+    this._suppressEnvSecret = Boolean(this._envSecretSuppressionMarker && getEnvNodeSecret());
 
     // H4 fix: persist the legacy node_id file as soon as the in-memory
     // node_id is known, NOT only after a successful hello(). The original
@@ -439,14 +520,13 @@ class LifecycleManager {
   }
 
   get nodeSecretVersion() {
+    this._resolveNodeSecret();
     const storeVersion = parseNodeSecretVersion(this.store.getState('node_secret_version'));
     const storeSecret = this.store.getState('node_secret') || null;
     const storeSource = this.store.getState('node_secret_source') || null;
-    const envSecret = this._suppressEnvSecret
-      ? null
-      : ((process.env.A2A_NODE_SECRET || process.env.EVOMAP_NODE_SECRET || '').trim() || null);
+    const envSecret = this._effectiveEnvNodeSecret();
     const envVersion = parseNodeSecretVersion(process.env.A2A_NODE_SECRET_VERSION || process.env.EVOMAP_NODE_SECRET_VERSION);
-    const validStoreSecret = typeof storeSecret === 'string' && /^[a-f0-9]{64}$/i.test(storeSecret);
+    const validStoreSecret = validNodeSecret(storeSecret);
     if (this._suppressEnvSecret) return validStoreSecret ? storeVersion : null;
     if (storeSource === 'hub_rotate' && validStoreSecret) return storeVersion;
     if (envSecret) {
@@ -487,37 +567,41 @@ class LifecycleManager {
    * @returns {string|null}
    */
   _resolveNodeSecret() {
-    const envSecret = this._suppressEnvSecret
-      ? null
-      : ((process.env.A2A_NODE_SECRET || process.env.EVOMAP_NODE_SECRET || '').trim() || null);
+    const envSecret = this._effectiveEnvNodeSecret();
+    const envUpdatedAfterSuppression = this._envSuppressionClearedForSecret === envSecret;
     const storeSecret = this.store.getState('node_secret') || null;
     const storeSource = this.store.getState('node_secret_source') || null;
-    const valid = (s) => typeof s === 'string' && /^[a-f0-9]{64}$/i.test(s);
+
+    if (
+      envSecret &&
+      envUpdatedAfterSuppression &&
+      validNodeSecret(envSecret) &&
+      (!storeSecret || envSecret === storeSecret) &&
+      !(storeSecret && envSecret === storeSecret && storeSource === 'hub_rotate')
+    ) {
+      this._syncEnvNodeSecretToStore(envSecret);
+      return envSecret;
+    }
 
     if (envSecret && storeSecret && envSecret !== storeSecret) {
       // Store value came from a successful hub rotation -> trust it.
       // The env var is necessarily stale: it was captured by the parent
       // shell before the rotation and a child process cannot mutate it
       // back into its parent.
-      if (storeSource === 'hub_rotate' && valid(storeSecret)) {
+      if (storeSource === 'hub_rotate' && validNodeSecret(storeSecret) && !envUpdatedAfterSuppression) {
         if (!this._storeSourceLogged) {
           this._storeSourceLogged = true;
           this.logger.warn(
             '[lifecycle] A2A_NODE_SECRET env var differs from MailboxStore; ' +
               'store value originated from a hub rotation, treating env as stale. ' +
-              'Run `evolver reset-local-secret` after a manual web reset, or ' +
-              'unset A2A_NODE_SECRET to silence this warning.'
+              'After a manual web reset, run `evolver reset-local-secret` to clear local ' +
+              'secret and env suppression state before relying only on updated env vars.'
           );
         }
         return storeSecret;
       }
-      if (valid(envSecret)) {
-        const envVersion = parseNodeSecretVersion(process.env.A2A_NODE_SECRET_VERSION || process.env.EVOMAP_NODE_SECRET_VERSION);
-        this.store.setState('node_secret', envSecret);
-        this.store.setState('node_secret_version', envVersion ? String(envVersion) : '');
-        // Mark the new store value as env-seeded so a future rotation can
-        // distinguish "operator pasted this in" from "hub returned this".
-        this.store.setState('node_secret_source', 'env_seed');
+      if (validNodeSecret(envSecret)) {
+        this._syncEnvNodeSecretToStore(envSecret);
         if (!this._envOverrideLogged) {
           this._envOverrideLogged = true;
           this.logger.warn(
@@ -534,6 +618,68 @@ class LifecycleManager {
     return storeSecret || envSecret || null;
   }
 
+  _syncEnvNodeSecretToStore(envSecret) {
+    const envVersion = parseNodeSecretVersion(process.env.A2A_NODE_SECRET_VERSION || process.env.EVOMAP_NODE_SECRET_VERSION);
+    this.store.setState('node_secret', envSecret);
+    this.store.setState('node_secret_version', envVersion ? String(envVersion) : '');
+    // Mark the new store value as env-seeded so a future rotation can
+    // distinguish "operator pasted this in" from "hub returned this".
+    this.store.setState('node_secret_source', 'env_seed');
+    this._clearEnvSecretSuppression();
+  }
+
+  _effectiveEnvNodeSecret() {
+    const envSecret = getEnvNodeSecret();
+    return this._isEnvNodeSecretSuppressed(envSecret) ? null : envSecret;
+  }
+
+  _isEnvNodeSecretSuppressed(envSecret) {
+    this._envSuppressionClearedForSecret = null;
+    const persistedMarker = normalizeNodeSecretEnvSuppression(this.store && this.store.getState
+      ? this.store.getState('node_secret_env_suppressed')
+      : null);
+    const marker = persistedMarker || this._envSecretSuppressionMarker;
+    if (!marker) {
+      this._envSecretSuppressionMarker = null;
+      this._suppressEnvSecret = false;
+      return false;
+    }
+    this._envSecretSuppressionMarker = marker;
+    if (marker === 'true') {
+      this._suppressEnvSecret = Boolean(envSecret);
+      return Boolean(envSecret);
+    }
+    const envFingerprint = fingerprintNodeSecret(envSecret);
+    if (!envFingerprint) {
+      this._suppressEnvSecret = false;
+      return false;
+    }
+    if (envFingerprint === marker) {
+      this._suppressEnvSecret = true;
+      return true;
+    }
+    this._clearEnvSecretSuppression();
+    this._envSuppressionClearedForSecret = envSecret;
+    return false;
+  }
+
+  _markCurrentEnvSecretSuppressed() {
+    const marker = fingerprintNodeSecret(getEnvNodeSecret());
+    if (!marker) {
+      this._clearEnvSecretSuppression();
+      return;
+    }
+    try { this.store.setState('node_secret_env_suppressed', marker); } catch { /* best-effort */ }
+    this._envSecretSuppressionMarker = marker;
+    this._suppressEnvSecret = true;
+  }
+
+  _clearEnvSecretSuppression() {
+    try { this.store.setState('node_secret_env_suppressed', ''); } catch { /* best-effort */ }
+    this._envSecretSuppressionMarker = null;
+    this._suppressEnvSecret = false;
+  }
+
   _buildHeaders() {
     const headers = { 'Content-Type': 'application/json' };
     const secret = this.nodeSecret;
@@ -607,28 +753,64 @@ class LifecycleManager {
       await throwIfHubUnreachableResponse(res, 'lifecycle hello');
       this._recordHubReachable();
       if (!res.ok) {
-        const errData = await readHubResponseJson(res).catch(() => ({}));
-        const errMsg = errData?.error || `http_${res.status}`;
+        const errText = await readHubResponseText(res).catch(() => '');
+        let errData = {};
+        try { errData = errText ? JSON.parse(errText) : {}; } catch (_) { /* non-JSON API error */ }
+        const errMsg = safeHubErrorCode(errData, res.status);
         if (res.status === 429) {
           const retryAfter = parseInt(res.headers.get('retry-after') || '3600', 10);
           this._helloRateLimitUntil = Date.now() + retryAfter * 1000;
           this.logger.error(`[lifecycle] hello rate limited (429): retry after ${retryAfter}s`);
           return { ok: false, error: 'hello_rate_limited', retryAfter };
         }
-        this.logger.error(`[lifecycle] hello HTTP ${res.status}: ${errMsg}`);
+        const divergenceReason = (res.status === 401 || res.status === 403)
+          ? extractSecretDivergenceReason(errData)
+          : null;
+        if (divergenceReason) {
+          this.logger.warn(
+            `[lifecycle] hello rejected secret rotation (${res.status}, reason=${divergenceReason}); ` +
+              'local secret divergence detected'
+          );
+          return {
+            ok: false,
+            error: SECRET_DIVERGENCE_ERROR,
+            reason: divergenceReason,
+            statusCode: res.status,
+          };
+        }
+        const safeErrText = errText ? sanitizeHubResponseForLog(errText) : errMsg;
+        this.logger.error(`[lifecycle] hello HTTP ${res.status}: ${safeErrText}`);
         return { ok: false, error: errMsg, statusCode: res.status };
       }
 
       const data = await readHubResponseJson(res);
 
       if (data?.payload?.status === 'rejected') {
-        this.logger.error(`[lifecycle] hello rejected: ${data.payload.reason || 'unknown'}`);
-        return { ok: false, error: data.payload.reason || 'hello_rejected', response: data };
+        const divergenceReason = extractSecretDivergenceReason(data);
+        if (divergenceReason) {
+          this.logger.warn(
+            `[lifecycle] hello rejected secret rotation (reason=${divergenceReason}); ` +
+              'local secret divergence detected'
+          );
+          return {
+            ok: false,
+            error: SECRET_DIVERGENCE_ERROR,
+            reason: divergenceReason,
+            response: data,
+          };
+        }
+        const reason = data.payload.reason || 'unknown';
+        const safeReason = sanitizeHubResponseForLog(reason);
+        this.logger.error(`[lifecycle] hello rejected: ${safeReason}`);
+        const error = String(reason || '').startsWith('node_id_already_claimed')
+          ? reason
+          : 'hello_rejected';
+        return { ok: false, error, response: data };
       }
 
       const secret = data?.payload?.node_secret || data?.node_secret || null;
       const secretVersion = parseNodeSecretVersion(data?.payload?.node_secret_version || data?.node_secret_version);
-      if (secret && /^[a-f0-9]{64}$/i.test(secret)) {
+      if (secret && validNodeSecret(secret)) {
         this.store.setState('node_secret', secret);
         // Tag the store entry so the next process that boots into a stale
         // shell env can recognise this value as hub-authoritative and
@@ -643,7 +825,11 @@ class LifecycleManager {
         // and overwrite the freshly rotated secret with the stale one,
         // re-creating the auth loop the previous patch fixed (see #529
         // and the Bugbot review on PR #22).
-        this._suppressEnvSecret = true;
+        if (getEnvNodeSecret() && getEnvNodeSecret() !== secret) {
+          this._markCurrentEnvSecretSuppressed();
+        } else {
+          this._clearEnvSecretSuppression();
+        }
         this.logger.log('[lifecycle] new node_secret stored from hello response');
       }
       if (secretVersion) {
@@ -713,6 +899,7 @@ class LifecycleManager {
     this._reauthInProgress = true;
     let manualResetRequired = false;
     let hubUnreachable = false;
+    let droppedDivergedSecret = false;
     try {
       for (let attempt = 1; attempt <= MAX_REAUTH_ATTEMPTS; attempt++) {
         this.logger.warn(`[lifecycle] re-auth attempt ${attempt}/${MAX_REAUTH_ATTEMPTS}: rotating secret via hello...`);
@@ -731,6 +918,18 @@ class LifecycleManager {
             hubUnreachable = true;
             break;
           }
+          if (isSecretDivergenceError(helloResult.error)) {
+            // The hub has explicitly rejected our current secret as diverged
+            // from its record. Drop store/env-derived auth once, then spend
+            // the second attempt on an unauthenticated rotate hello instead
+            // of backing off while still presenting the same stale Bearer.
+            if (attempt < MAX_REAUTH_ATTEMPTS && !droppedDivergedSecret) {
+              this._dropLocalSecret(SECRET_DIVERGENCE_ERROR);
+              droppedDivergedSecret = true;
+              continue;
+            }
+            break;
+          }
           if (typeof helloResult.error === 'string' && helloResult.error.startsWith('node_id_already_claimed')) {
             // Hub does not believe we own this nodeId. Our locally cached
             // secret(s) are useless. Drop them so attempt 2 retries WITHOUT
@@ -806,10 +1005,9 @@ class LifecycleManager {
     try { this.store.setState('node_secret_version', ''); } catch { /* best-effort */ }
     // Clear the source tag too -- nothing is stored, nothing to attribute.
     try { this.store.setState('node_secret_source', ''); } catch { /* best-effort */ }
-    try { this.store.setState('node_secret_env_suppressed', 'true'); } catch { /* best-effort */ }
-    // Suppress the env override for this process so _resolveNodeSecret stops
-    // re-seeding the store with the same stale env value next call.
-    this._suppressEnvSecret = true;
+    // Suppress only the exact env secret that was just proven stale. If no
+    // env secret is present, do not leave a marker that blocks a future reset.
+    this._markCurrentEnvSecretSuppressed();
   }
 
   _emitManualResetNeeded() {
@@ -821,7 +1019,7 @@ class LifecycleManager {
         payload: {
           action: 'manual_secret_reset_required',
           message:
-            'Hub disowns this node_id (node_id_already_claimed). Local node_secret in MailboxStore and A2A_NODE_SECRET env var are both invalid. Visit https://evomap.ai/account, click "Reset Secret" on the agent card, then update A2A_NODE_SECRET (or delete ~/.evomap/mailbox/state.json) and restart proxy.',
+            'Hub disowns this node_id (node_id_already_claimed). Local node_secret and the current node secret env value are invalid. Visit https://evomap.ai/account, click "Reset Secret" on the agent card, run `evolver reset-local-secret` to clear local secret and env suppression state, then update A2A_NODE_SECRET/EVOMAP_NODE_SECRET and restart proxy. Only changing env before clearing suppression state can keep an older local marker active.',
           docs_url: 'https://evomap.ai/account',
         },
       });
@@ -924,7 +1122,8 @@ class LifecycleManager {
       if (res.status === 403 || res.status === 401) {
         this._consecutiveFailures++;
         const errText = await readHubResponseText(res).catch(() => '');
-        this.logger.error(`[lifecycle] heartbeat auth failed (${res.status}): ${errText}`);
+        const safeErrText = sanitizeHubResponseForLog(errText);
+        this.logger.error(`[lifecycle] heartbeat auth failed (${res.status}): ${safeErrText}`);
         if (!_skipReauth) {
           const recovered = await this.reAuthenticate();
           if (recovered) {
@@ -937,6 +1136,7 @@ class LifecycleManager {
 
       if (!res.ok) {
         const errText = await readHubResponseText(res).catch(() => '');
+        const safeErrText = sanitizeHubResponseForLog(errText);
         // 426 Upgrade Required: hub emits this when our evolver_version is
         // below the minimum version it requires. The body is JSON of shape
         // `{ error: 'evolver_min_version_required', force_update: {...} }`
@@ -961,7 +1161,7 @@ class LifecycleManager {
             _maybeTriggerForceUpdateFromHeartbeat(fu, this.logger);
           } else {
             this.logger.warn(
-              `[lifecycle] heartbeat HTTP 426 without parseable force_update payload: ${errText}`
+              `[lifecycle] heartbeat HTTP 426 without parseable force_update payload: ${safeErrText}`
             );
           }
         }
@@ -1000,7 +1200,7 @@ class LifecycleManager {
           }
         }
         this._consecutiveFailures++;
-        this.logger.error(`[lifecycle] heartbeat HTTP ${res.status}: ${errText}`);
+        this.logger.error(`[lifecycle] heartbeat HTTP ${res.status}: ${safeErrText}`);
         return { ok: false, error: `http_${res.status}`, statusCode: res.status };
       }
 

package/src/proxy/sync/inbound.js

@@ -9,6 +9,7 @@ const {
   isHubUnreachableError,
   readHubResponseJson,
   readHubResponseText,
+  sanitizeHubResponseForLog,
   throwIfHubUnreachableResponse,
 } = require('../../gep/hubFetch');
 
@@ -75,12 +76,12 @@ class InboundSync {
 
       if (res.status === 403 || res.status === 401) {
         const errText = await readHubResponseText(res).catch(() => 'unknown');
-        throw new AuthError(`Hub ${res.status}: ${errText}`, res.status);
+        throw new AuthError(`Hub ${res.status}: ${sanitizeHubResponseForLog(errText)}`, res.status);
       }
 
       if (!res.ok) {
         const errText = await readHubResponseText(res).catch(() => 'unknown');
-        throw new Error(`Hub returned ${res.status}: ${errText}`);
+        throw new Error(`Hub returned ${res.status}: ${sanitizeHubResponseForLog(errText)}`);
       }
 
       const data = await readHubResponseJson(res);
@@ -163,11 +164,11 @@ class InboundSync {
       this._recordHubReachable();
       if (res.status === 403 || res.status === 401) {
         const errText = await readHubResponseText(res).catch(() => 'unknown');
-        throw new AuthError(`Hub ${res.status}: ${errText}`, res.status);
+        throw new AuthError(`Hub ${res.status}: ${sanitizeHubResponseForLog(errText)}`, res.status);
       }
       if (!res.ok) {
         const errText = await readHubResponseText(res).catch(() => 'unknown');
-        throw new Error(`Hub returned ${res.status}: ${errText}`);
+        throw new Error(`Hub returned ${res.status}: ${sanitizeHubResponseForLog(errText)}`);
       }
       await drainHubResponse(res);
       return { acked: delivered.length };

package/src/proxy/sync/outbound.js

@@ -9,6 +9,7 @@ const {
   isHubUnreachableError,
   readHubResponseJson,
   readHubResponseText,
+  sanitizeHubResponseForLog,
   throwIfHubUnreachableResponse,
 } = require('../../gep/hubFetch');
 
@@ -109,12 +110,12 @@ class OutboundSync {
 
       if (res.status === 403 || res.status === 401) {
         const errText = await readHubResponseText(res).catch(() => 'unknown');
-        throw new AuthError(`Hub ${res.status}: ${errText}`, res.status);
+        throw new AuthError(`Hub ${res.status}: ${sanitizeHubResponseForLog(errText)}`, res.status);
       }
 
       if (!res.ok) {
         const errText = await readHubResponseText(res).catch(() => 'unknown');
-        throw new Error(`Hub returned ${res.status}: ${errText}`);
+        throw new Error(`Hub returned ${res.status}: ${sanitizeHubResponseForLog(errText)}`);
       }
 
       const data = await readHubResponseJson(res);