@robota-sdk/agent-transport-webrtc 3.0.0-beta.100

package/src/__tests__/pairing-gate-e4.test.ts

@@ -0,0 +1,110 @@
+import { createIdentityContext } from '@robota-sdk/agent-remote-pairing';
+const testIdentity = createIdentityContext('test-product');
+import { SessionResumeBridge } from '@robota-sdk/agent-transport';
+import { createTestInteractiveSession } from '@robota-sdk/agent-interface-session/testing';
+import type { IInteractiveSession } from '@robota-sdk/agent-interface-session';
+import { describe, expect, it, vi } from 'vitest';
+
+import { PairingGate } from '../pairing-gate.js';
+
+/**
+ * REMOTE-013 E4 — when a `resumeBridge` is supplied, the gate routes the paired session through the bridge
+ * (seq-stamped) instead of a fresh handler, and `cleanup()` DETACHES the bridge (session survives the drop).
+ */
+
+function fakeSession(): {
+  session: IInteractiveSession;
+  fire: (event: string, arg: unknown) => void;
+} {
+  const handlers = new Map<string, (arg: unknown) => void>();
+  // ARCH-012: the conformant double. The three-member partial this replaces was accepted only by a
+  // cast, so the suite ran against a session shape no implementation could have.
+  const session = createTestInteractiveSession({
+    on: ((e: string, h: (arg: unknown) => void) => {
+      handlers.set(e, h);
+    }) as IInteractiveSession['on'],
+    off: ((e: string) => {
+      handlers.delete(e);
+    }) as IInteractiveSession['off'],
+  });
+  return { session, fire: (e, a) => handlers.get(e)?.(a) };
+}
+
+describe('PairingGate E4 resume bridge (REMOTE-013)', () => {
+  it('routes the paired session through the bridge (seq-stamped) and detaches on cleanup', async () => {
+    const { session, fire } = fakeSession();
+    const bridge = new SessionResumeBridge({ session });
+    const sent: string[] = [];
+    const channel = { send: (d: string) => sent.push(d), close: () => {} };
+    // Fake handshake that accepts immediately (isolates the bridge wiring from real B3 crypto).
+    const fakeHandshake = (() => ({
+      result: Promise.resolve({ sessionKey: 'k' }),
+      onFrame: () => {},
+    })) as never;
+
+    const gate = new PairingGate({cryptoContext: testIdentity,
+      channel,
+      session,
+      secret: 's',
+      role: 'initiator',
+      localFingerprint: 'A',
+      remoteFingerprint: 'B',
+      resumeBridge: bridge,
+      startHandshake: fakeHandshake,
+    });
+    // Drive to accept (the fake handshake resolves on a microtask).
+    gate.onInbound(JSON.stringify({ t: 'pair-nonce', nonce: 'n' }));
+    await Promise.resolve();
+    await Promise.resolve();
+
+    // A session event now flows through the bridge → the channel, seq-stamped.
+    fire('text_delta', 'hi');
+    expect(sent).toHaveLength(1);
+    const frame = JSON.parse(sent[0]);
+    expect(frame).toMatchObject({ type: 'text_delta', delta: 'hi', seq: 1 });
+
+    // Cleanup DETACHES (does not dispose) — a subsequent event is buffered, not sent, and the session survives.
+    gate.cleanup();
+    fire('text_delta', 'gap'); // buffered at seq 2, not sent (detached)
+    expect(sent).toHaveLength(1);
+
+    // Re-attach a new channel + resume → the gap frame replays with its ORIGINAL seq 2 (continuity).
+    const sent2: string[] = [];
+    bridge.attach((d) => sent2.push(d), { onDeliveryError: vi.fn() });
+    bridge.onClientMessage(JSON.stringify({ type: 'resume', lastSeq: 1 }));
+    expect(sent2.map((s) => JSON.parse(s).seq)).toEqual([2]);
+    bridge.dispose();
+  });
+
+  it('a resume/ack inbound frame post-accept is routed to the bridge (not the session)', async () => {
+    const { session, fire } = fakeSession();
+    const bridge = new SessionResumeBridge({ session });
+    const sent: string[] = [];
+    const channel = { send: (d: string) => sent.push(d), close: () => {} };
+    const fakeHandshake = (() => ({
+      result: Promise.resolve({ sessionKey: 'k' }),
+      onFrame: () => {},
+    })) as never;
+    const gate = new PairingGate({cryptoContext: testIdentity,
+      channel,
+      session,
+      secret: 's',
+      role: 'initiator',
+      localFingerprint: 'A',
+      remoteFingerprint: 'B',
+      resumeBridge: bridge,
+      startHandshake: fakeHandshake,
+    });
+    gate.onInbound(JSON.stringify({ t: 'pair-nonce', nonce: 'n' }));
+    await Promise.resolve();
+    await Promise.resolve();
+    fire('text_delta', 'a'); // seq 1
+    fire('text_delta', 'b'); // seq 2
+    sent.length = 0;
+    // ack via the channel → bridge frees ≤1; resume lastSeq 1 → replays only seq 2.
+    gate.onInbound(JSON.stringify({ type: 'ack', seq: 1 }));
+    gate.onInbound(JSON.stringify({ type: 'resume', lastSeq: 1 }));
+    expect(sent.map((s) => JSON.parse(s).seq)).toEqual([2]);
+    bridge.dispose();
+  });
+});

package/src/__tests__/pairing-gate.test.ts

@@ -0,0 +1,296 @@
+import { createIdentityContext } from '@robota-sdk/agent-remote-pairing';
+const testIdentity = createIdentityContext('test-product');
+import { createTestInteractiveSession } from '@robota-sdk/agent-interface-session/testing';
+
+import { describe, expect, it, vi } from 'vitest';
+
+import { PairingGate, type IPairingGateOptions } from '../pairing-gate.js';
+import { WebRtcDeliveryLifecycle } from '../webrtc-delivery-lifecycle.js';
+
+import type { startPairingHandshake, TPairingFrame } from '@robota-sdk/agent-remote-pairing';
+import type { createSessionMessageHandler } from '@robota-sdk/agent-transport';
+import type { IInteractiveSession } from '@robota-sdk/agent-interface-session';
+
+/**
+ * REMOTE-008 Step 1 (SECURITY milestone) — the pairing gate's fail-closed routing switch, driven with a stub
+ * channel + injected handshake + injected session-bridge (no real peer/crypto/session).
+ */
+
+/** A controllable stub of the pairing handshake: capture frames, resolve/reject on demand. */
+function makeHandshakeStub() {
+  const sent: TPairingFrame[] = [];
+  const received: TPairingFrame[] = [];
+  let resolveResult!: (value: { sessionKey: string }) => void;
+  let rejectResult!: (error: Error) => void;
+  const start: typeof startPairingHandshake = (_cryptoContext, options) => {
+    // Record what the gate asked us to send (it wraps this over the channel).
+    const controller = {
+      result: new Promise<{ sessionKey: string }>((res, rej) => {
+        resolveResult = res;
+        rejectResult = rej;
+      }),
+      onFrame: (frame: TPairingFrame) => received.push(frame),
+    };
+    // Expose the send seam so a test can assert the gate serialized a frame.
+    options.send({ t: 'pair-nonce', nonce: 'stub' });
+    return controller;
+  };
+  return {
+    start,
+    received,
+    sentByGate: sent,
+    accept: () => resolveResult({ sessionKey: 'k' }),
+    reject: () => rejectResult(new Error('pairing rejected')),
+  };
+}
+
+function makeGate(over: Partial<IPairingGateOptions> = {}) {
+  const channelSends: string[] = [];
+  const channel = { send: (d: string) => channelSends.push(d), close: vi.fn() };
+  const session = Object.assign(createTestInteractiveSession(), {});
+  const sessionOnMessage = vi.fn();
+  const handlerCleanup = vi.fn();
+  const createHandler: typeof createSessionMessageHandler = () => ({
+    onMessage: sessionOnMessage,
+    cleanup: handlerCleanup,
+  });
+  const hs = makeHandshakeStub();
+  const gate = new PairingGate({cryptoContext: testIdentity,
+    channel,
+    session,
+    secret: 's',
+    role: 'initiator',
+    localFingerprint: 'AA',
+    remoteFingerprint: 'BB',
+    startHandshake: hs.start,
+    createHandler,
+    ...over,
+  });
+  return { gate, channel, channelSends, sessionOnMessage, handlerCleanup, hs };
+}
+
+describe('PairingGate (REMOTE-008 Step 1 — fail-closed routing switch)', () => {
+  it('does not expose the session before the handshake accepts (no session bridge built)', () => {
+    const { sessionOnMessage } = makeGate();
+    // The handshake sent its nonce, but no session handler exists yet.
+    expect(sessionOnMessage).not.toHaveBeenCalled();
+  });
+
+  it('serializes the handshake frames it sends over the channel', () => {
+    const { channelSends } = makeGate();
+    // The stub handshake emits a pair-nonce on start; the gate must have serialized it.
+    expect(channelSends).toContain(JSON.stringify({ t: 'pair-nonce', nonce: 'stub' }));
+  });
+
+  it('pre-accept: routes a pairing frame to the handshake and keeps a non-pairing frame from the session', () => {
+    const { gate, hs, sessionOnMessage } = makeGate();
+    gate.onInbound(JSON.stringify({ t: 'pair-confirm', mac: 'm' }));
+    expect(hs.received).toEqual([{ t: 'pair-confirm', mac: 'm' }]);
+    // A well-formed but non-pairing frame pre-accept must never reach the (nonexistent) session.
+    gate.onInbound(JSON.stringify({ type: 'submit', prompt: 'p' }));
+    expect(sessionOnMessage).not.toHaveBeenCalled();
+    // Undecodable garbage pre-accept is dropped without throwing.
+    expect(() => gate.onInbound('not json')).not.toThrow();
+  });
+
+  it.each([
+    ['an empty mac', { t: 'pair-confirm', mac: '' }],
+    ['a numeric nonce', { t: 'pair-nonce', nonce: 7 }],
+    ['a padded (non-base64url) mac', { t: 'pair-confirm', mac: 'bWFj==' }],
+    ['a mac over the ceiling', { t: 'pair-confirm', mac: 'A'.repeat(129) }],
+  ])(
+    'issue #2046: a pairing frame with the right discriminator but %s never reaches the handshake',
+    (_label, frame) => {
+      // Against the old discriminator-only predicate every one of these was handed to the controller.
+      const { gate, hs } = makeGate();
+      gate.onInbound(JSON.stringify(frame));
+      expect(hs.received).toEqual([]);
+    },
+  );
+
+  it('on ACCEPT: builds the session bridge and routes subsequent frames to it', async () => {
+    const { gate, hs, sessionOnMessage } = makeGate();
+    hs.accept();
+    await Promise.resolve(); // let the result.then microtask run
+    gate.onInbound(JSON.stringify({ type: 'submit', prompt: 'hi' }));
+    expect(sessionOnMessage).toHaveBeenCalledWith(JSON.stringify({ type: 'submit', prompt: 'hi' }));
+  });
+
+  it('a session frame the peer sends before this side accepts is held, then delivered after acceptance', async () => {
+    // The peer finishes its half of the handshake first and asks for the history at once.
+    const { gate, hs, sessionOnMessage } = makeGate();
+    const early = JSON.stringify({ type: 'get-messages' });
+    gate.onInbound(early);
+    expect(sessionOnMessage).not.toHaveBeenCalled();
+    hs.accept();
+    await Promise.resolve();
+    expect(sessionOnMessage).toHaveBeenCalledWith(early);
+  });
+
+  it('frames held before a rejection are discarded, never delivered', async () => {
+    const { gate, hs, sessionOnMessage } = makeGate();
+    gate.onInbound(JSON.stringify({ type: 'get-messages' }));
+    hs.reject();
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(sessionOnMessage).not.toHaveBeenCalled();
+  });
+
+  it('on REJECT: closes the channel and NEVER exposes the session', async () => {
+    const { gate, channel, hs, sessionOnMessage } = makeGate();
+    hs.reject();
+    await Promise.resolve();
+    expect(channel.close).toHaveBeenCalledTimes(1);
+    // Any frame after a failed pairing is ignored — the session is never reachable.
+    gate.onInbound(JSON.stringify({ type: 'submit', prompt: 'hi' }));
+    expect(sessionOnMessage).not.toHaveBeenCalled();
+  });
+
+  it('post-close (cleanup): ignores further inbound frames', async () => {
+    const { gate, hs, sessionOnMessage } = makeGate();
+    hs.accept();
+    await Promise.resolve();
+    gate.cleanup();
+    gate.onInbound(JSON.stringify({ type: 'submit', prompt: 'hi' }));
+    expect(sessionOnMessage).not.toHaveBeenCalled();
+  });
+
+  it('fires onAccept on accept (not onReject)', async () => {
+    const onAccept = vi.fn();
+    const onReject = vi.fn();
+    const { hs } = makeGate({ onAccept, onReject });
+    hs.accept();
+    await Promise.resolve();
+    expect(onAccept).toHaveBeenCalledTimes(1);
+    expect(onReject).not.toHaveBeenCalled();
+  });
+
+  it('fires onReject on reject (not onAccept)', async () => {
+    const onAccept = vi.fn();
+    const onReject = vi.fn();
+    const { hs } = makeGate({ onAccept, onReject });
+    hs.reject();
+    await Promise.resolve();
+    expect(onReject).toHaveBeenCalledTimes(1);
+    expect(onAccept).not.toHaveBeenCalled();
+  });
+
+  it('cleanup tears down the session bridge when one was built', async () => {
+    const { gate, hs, handlerCleanup } = makeGate();
+    hs.accept();
+    await Promise.resolve();
+    gate.cleanup();
+    expect(handlerCleanup).toHaveBeenCalledTimes(1);
+  });
+
+  it('post-accept send failure closes the carrier and reports without escaping the session event', async () => {
+    const handlers = new Map<string, (value: unknown) => void>();
+    const session = createTestInteractiveSession({
+      on: ((event: string, handler: (value: unknown) => void) => {
+        handlers.set(event, handler);
+      }) as IInteractiveSession['on'],
+      off: ((event: string) => {
+        handlers.delete(event);
+      }) as IInteractiveSession['off'],
+    });
+    let failSend = false;
+    const channel = {
+      send: vi.fn(() => {
+        if (failSend) throw new Error('paired channel closed');
+      }),
+      close: vi.fn(),
+    };
+    const onDeliveryError = vi.fn();
+    const hs = makeHandshakeStub();
+    new PairingGate({cryptoContext: testIdentity,
+      channel,
+      session,
+      secret: 's',
+      role: 'initiator',
+      localFingerprint: 'AA',
+      remoteFingerprint: 'BB',
+      startHandshake: hs.start,
+      onDeliveryError,
+    });
+    hs.accept();
+    await Promise.resolve();
+    failSend = true;
+
+    expect(() =>
+      handlers.get('branch_event')?.({
+        kind: 'checkpoint_created',
+        checkpointId: 'turn-0001',
+        branchId: 'main',
+      }),
+    ).not.toThrow();
+    expect(channel.close).toHaveBeenCalledTimes(1);
+    expect(onDeliveryError).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'paired channel closed' }),
+      'branch_event',
+    );
+    expect(handlers.size).toBe(0);
+  });
+
+  it('reports a paired delivery failure before a synchronous closing transition drops the carrier', async () => {
+    const handlers = new Map<string, (value: unknown) => void>();
+    const session = createTestInteractiveSession({
+      on: ((event: string, handler: (value: unknown) => void) => {
+        handlers.set(event, handler);
+      }) as IInteractiveSession['on'],
+      off: ((event: string) => {
+        handlers.delete(event);
+      }) as IInteractiveSession['off'],
+    });
+    const cleanup = vi.fn();
+    const onDropped = vi.fn();
+    const onDeliveryError = vi.fn();
+    let gate!: PairingGate;
+    let lifecycle!: WebRtcDeliveryLifecycle;
+    let failSend = false;
+    const channel = {
+      send: vi.fn(() => {
+        if (failSend) throw new Error('paired channel closed synchronously');
+      }),
+      close: vi.fn(() => lifecycle.handleDrop(1)),
+    };
+    lifecycle = new WebRtcDeliveryLifecycle({
+      cleanup: () => {
+        cleanup();
+        gate.cleanup();
+      },
+      onDropped,
+      onDeliveryError,
+    });
+    lifecycle.reset(1);
+    const hs = makeHandshakeStub();
+    gate = new PairingGate({cryptoContext: testIdentity,
+      channel,
+      session,
+      secret: 's',
+      role: 'initiator',
+      localFingerprint: 'AA',
+      remoteFingerprint: 'BB',
+      startHandshake: hs.start,
+      onAccept: () => lifecycle.accept(1),
+      onDeliveryError: (error, event) => lifecycle.handleFailure(channel, 1, error, event),
+    });
+    hs.accept();
+    await Promise.resolve();
+    failSend = true;
+
+    expect(() =>
+      handlers.get('branch_event')?.({
+        kind: 'checkpoint_created',
+        checkpointId: 'turn-0001',
+        branchId: 'main',
+      }),
+    ).not.toThrow();
+    expect(onDeliveryError).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'paired channel closed synchronously' }),
+      'branch_event',
+    );
+    expect(cleanup).toHaveBeenCalledTimes(1);
+    expect(onDropped).toHaveBeenCalledTimes(1);
+    expect(handlers.size).toBe(0);
+  });
+});

package/src/__tests__/pairing-relay-in-the-middle.test.ts

@@ -0,0 +1,225 @@
+import { createIdentityContext } from '@robota-sdk/agent-remote-pairing';
+const testIdentity = createIdentityContext('test-product');
+import { createTestInteractiveSession } from '@robota-sdk/agent-interface-session/testing';
+
+import { extractDtlsFingerprint, startPairingHandshake } from '@robota-sdk/agent-remote-pairing';
+import { describe, expect, it, vi } from 'vitest';
+
+import { WebRtcTransport } from '../webrtc-transport.js';
+import { RtcPeer, type RtcChannel } from '../rtc-peer.js';
+import { createInMemorySignalingPair, type ISignalingClient } from '../signaling.js';
+import { fakeDataChannel } from './fake-datachannel.js';
+
+import type { IInteractiveSession } from '@robota-sdk/agent-interface-session';
+import type { TPairingFrame } from '@robota-sdk/agent-remote-pairing';
+
+/**
+ * The pairing confirmation must bind to the certificate the DTLS layer actually verified. A relay that
+ * terminates DTLS on both sides and forwards the data channel must not be able to make the two honest
+ * peers compute the same binding.
+ */
+
+function createStubSession(): IInteractiveSession {
+  return Object.assign(createTestInteractiveSession(), {
+    getMessages: vi.fn().mockReturnValue([{ role: 'user', content: 'hi' }]),
+    getActiveDriverId: () => null,
+    on: vi.fn(),
+    off: vi.fn(),
+  });
+}
+
+/** Insert `a=fingerprint:sha-256 <value>` before the first existing fingerprint line. */
+function prependFingerprint(sdp: string, value: string): string {
+  return sdp.replace(/^a=fingerprint:/m, `a=fingerprint:sha-256 ${value}\r\na=fingerprint:`);
+}
+
+type TDescription = { type: 'offer' | 'answer'; sdp: string };
+type TCandidate = { candidate: string; sdpMid?: string };
+
+function sendCandidates(peer: RtcPeer, signaling: ISignalingClient): void {
+  peer.onLocalCandidate((c) =>
+    signaling.send({ kind: 'ice', data: { candidate: c.candidate, sdpMid: c.mid } }),
+  );
+}
+
+function addCandidate(peer: RtcPeer, data: unknown): void {
+  const c = data as TCandidate;
+  peer.addRemoteCandidate({ candidate: c.candidate, mid: c.sdpMid ?? '0' });
+}
+
+/** Pairing responder on the far side. Resolves true only if its own handshake accepts. */
+function connectResponder(signaling: ISignalingClient, secret: string): Promise<boolean> {
+  return new Promise<boolean>((resolvePaired) => {
+    const peer = new RtcPeer();
+    sendCandidates(peer, signaling);
+    let hostFingerprint: string | undefined;
+    let localFingerprint: string | undefined;
+    let chain: Promise<void> = Promise.resolve();
+    signaling.onSignal((message) => {
+      chain = chain
+        .then(async () => {
+          if (message.kind === 'offer') {
+            const offer = message.data as TDescription;
+            hostFingerprint = extractDtlsFingerprint(offer.sdp);
+            const answer = await peer.acceptOffer(offer.sdp);
+            localFingerprint = extractDtlsFingerprint(answer);
+            signaling.send({ kind: 'answer', data: { type: 'answer', sdp: answer } });
+          } else if (message.kind === 'ice') {
+            addCandidate(peer, message.data);
+          }
+        })
+        .catch(() => resolvePaired(false));
+    });
+    peer.onDataChannel((channel) => {
+      const controller = startPairingHandshake(testIdentity, {
+        secret,
+        role: 'responder',
+        localFingerprint: localFingerprint!,
+        remoteFingerprint: hostFingerprint!,
+        send: (frame: TPairingFrame) => {
+          try {
+            channel.send(JSON.stringify(frame));
+          } catch {
+            /* closing */
+          }
+        },
+        timeoutMs: 6000,
+      });
+      controller.result.then(
+        () => resolvePaired(true),
+        () => resolvePaired(false),
+      );
+      channel.onMessage((text) => {
+        try {
+          controller.onFrame(JSON.parse(text) as TPairingFrame);
+        } catch {
+          /* ignore */
+        }
+      });
+    });
+  });
+}
+
+/**
+ * A signaling relay that terminates DTLS with each side using its own certificates, forwards the data
+ * channel between them, and advertises the honest peer's fingerprint FIRST next to its own.
+ */
+function startRelay(toHost: ISignalingClient, toRemote: ISignalingClient): void {
+  const facingHost = new RtcPeer();
+  const facingRemote = new RtcPeer();
+  let hostChannel: RtcChannel | undefined;
+  const remoteChannel = facingRemote.createDataChannel('agent-session');
+  const toRemoteQueue: string[] = [];
+  const toHostQueue: string[] = [];
+  let pendingHostOffer: TDescription | undefined;
+
+  sendCandidates(facingHost, toHost);
+  sendCandidates(facingRemote, toRemote);
+
+  facingHost.onDataChannel((channel) => {
+    hostChannel = channel;
+    for (const m of toHostQueue.splice(0)) channel.send(m);
+    channel.onMessage((text) => {
+      if (remoteChannel.readyState === 'open') remoteChannel.send(text);
+      else toRemoteQueue.push(text);
+    });
+  });
+  remoteChannel.onStateChange((state) => {
+    if (state === 'open') for (const m of toRemoteQueue.splice(0)) remoteChannel.send(m);
+  });
+  remoteChannel.onMessage((text) => {
+    if (hostChannel) hostChannel.send(text);
+    else toHostQueue.push(text);
+  });
+
+  let hostChain: Promise<void> = Promise.resolve();
+  toHost.onSignal((message) => {
+    hostChain = hostChain
+      .then(async () => {
+        if (message.kind === 'offer') {
+          pendingHostOffer = message.data as TDescription;
+          const hostFingerprint = extractDtlsFingerprint(pendingHostOffer.sdp);
+          const own = await facingRemote.createOffer();
+          toRemote.send({
+            kind: 'offer',
+            data: { type: 'offer', sdp: prependFingerprint(own, hostFingerprint) },
+          });
+        } else if (message.kind === 'ice') {
+          addCandidate(facingHost, message.data);
+        }
+      })
+      .catch(() => undefined);
+  });
+
+  let remoteChain: Promise<void> = Promise.resolve();
+  toRemote.onSignal((message) => {
+    remoteChain = remoteChain
+      .then(async () => {
+        if (message.kind === 'answer') {
+          const answer = message.data as TDescription;
+          const remoteFingerprint = extractDtlsFingerprint(answer.sdp);
+          facingRemote.acceptAnswer(answer.sdp);
+          const own = await facingHost.acceptOffer(pendingHostOffer!.sdp);
+          toHost.send({
+            kind: 'answer',
+            data: { type: 'answer', sdp: prependFingerprint(own, remoteFingerprint) },
+          });
+        } else if (message.kind === 'ice') {
+          addCandidate(facingRemote, message.data);
+        }
+      })
+      .catch(() => undefined);
+  });
+}
+
+describe('WebRTC pairing with a relay in the middle', () => {
+  it('refuses to pair when the relay advertises the honest fingerprint next to its own', async () => {
+    const secret = 'shared-secret-256bit-base64url-relay';
+    const [hostSig, relayHostSide] = createInMemorySignalingPair();
+    const [relayRemoteSide, remoteSig] = createInMemorySignalingPair();
+    const session = createStubSession();
+    const onPaired = vi.fn();
+    const transport = new WebRtcTransport({cryptoContext: testIdentity,  signaling: hostSig, secret, onPaired });
+    transport.attach(session);
+
+    startRelay(relayHostSide, relayRemoteSide);
+    const remotePaired = connectResponder(remoteSig, secret);
+    await transport.start();
+
+    await expect(remotePaired).resolves.toBe(false);
+    expect(onPaired).not.toHaveBeenCalled();
+    await transport.stop();
+  }, 20000);
+});
+
+describe('WebRTC transport answer handling', () => {
+  it('takes one answer per start and ignores any later one', async () => {
+    const remoteDescriptions: string[] = [];
+    const fake = fakeDataChannel({
+      offerSdp: 'a=fingerprint:sha-256 AA:AA',
+      setRemoteDescription: (_sdp, type) => remoteDescriptions.push(type),
+    });
+    const [hostSig, remoteSig] = createInMemorySignalingPair();
+    const transport = new WebRtcTransport({cryptoContext: testIdentity,
+      signaling: hostSig,
+      secret: 'shared-secret-256bit-base64url-answers',
+      loadDataChannel: () => fake.module,
+    });
+    transport.attach(createStubSession());
+
+    const answer = { type: 'answer', sdp: 'a=fingerprint:sha-256 BB:BB' };
+    const answered = new Promise<void>((resolve) => {
+      remoteSig.onSignal((message) => {
+        if (message.kind !== 'offer') return;
+        remoteSig.send({ kind: 'answer', data: answer });
+        remoteSig.send({ kind: 'answer', data: answer });
+        setTimeout(resolve, 200);
+      });
+    });
+    await transport.start();
+    await answered;
+
+    expect(remoteDescriptions).toEqual(['answer']);
+    await transport.stop();
+  }, 15000);
+});

package/src/__tests__/rtc-channel-close.test.ts

@@ -0,0 +1,52 @@
+/**
+ * Closing a channel right after a send must not lose that send. The implementation resets the
+ * channel's stream as soon as it is told to close, and a message sent just before can then never
+ * reach the peer; so the channel reads closed at once and its stream is reset only after a grace.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { RtcPeer } from '../rtc-peer.js';
+
+import { fakeDataChannel } from './fake-datachannel.js';
+
+beforeEach(() => {
+  vi.useFakeTimers();
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe('RtcChannel close', () => {
+  it('reads closed at once and resets the stream only after what was sent had time to leave', () => {
+    const nativeClose = vi.fn();
+    const fake = fakeDataChannel({ channel: { close: nativeClose } });
+    const channel = new RtcPeer({ loadDataChannel: () => fake.module }).createDataChannel('x');
+    const states: string[] = [];
+    channel.onStateChange((state) => states.push(state));
+
+    channel.send('the last word');
+    channel.close();
+    expect(channel.readyState).toBe('closed');
+    expect(states).toEqual(['closed']);
+    expect(nativeClose).not.toHaveBeenCalled();
+
+    vi.advanceTimersByTime(1_000);
+    expect(nativeClose).toHaveBeenCalledTimes(1);
+    channel.close();
+    vi.advanceTimersByTime(1_000);
+    expect(nativeClose).toHaveBeenCalledTimes(1);
+  });
+
+  it('hands out nothing that arrives after this side closed it', () => {
+    const fake = fakeDataChannel();
+    const channel = new RtcPeer({ loadDataChannel: () => fake.module }).createDataChannel('x');
+    const received: string[] = [];
+    channel.onMessage((text) => received.push(text));
+
+    fake.connections[0]!.channelMessage!('before');
+    channel.close();
+    fake.connections[0]!.channelMessage!('after');
+    expect(received).toEqual(['before']);
+  });
+});