@saadnvd1/agent-os 0.3.700 → 0.3.715

package/lib/peer/links.ts

@@ -64,16 +64,18 @@ export const pinForHost = (hostId: string): PeerPin | null =>
 
 /** Pins a peer's keys to a Connect host. Pairing (S2) is the only caller. */
 export function savePin(pin: Omit<PeerPin, "state" | "suspendedReason">) {
-  getDb()
-    .prepare(
-      `INSERT INTO peer_links (host_id, machine_id, hostname, sign_pub, box_pub)
+  const db = getDb();
+  db.prepare(`DELETE FROM peer_unlinked WHERE machine_id = ?`).run(
+    pin.machineId
+  );
+  db.prepare(
+    `INSERT INTO peer_links (host_id, machine_id, hostname, sign_pub, box_pub)
        VALUES (?, ?, ?, ?, ?)
        ON CONFLICT(host_id) DO UPDATE SET machine_id = excluded.machine_id,
          hostname = excluded.hostname, sign_pub = excluded.sign_pub,
          box_pub = excluded.box_pub, state = 'active', suspended_reason = NULL,
          paired_at = datetime('now'), last_error = NULL`
-    )
-    .run(pin.hostId, pin.machineId, pin.hostname, pin.signPub, pin.boxPub);
+  ).run(pin.hostId, pin.machineId, pin.hostname, pin.signPub, pin.boxPub);
 }
 
 export function suspendPin(hostId: string, reason: string) {
@@ -84,6 +86,112 @@ export function suspendPin(hostId: string, reason: string) {
     .run(reason, hostId);
 }
 
+export function resumePin(hostId: string) {
+  getDb()
+    .prepare(
+      `UPDATE peer_links SET state = 'active', suspended_reason = NULL WHERE host_id = ?`
+    )
+    .run(hostId);
+}
+
+/** Every pin, for checking them against the account (revoke.ts). */
+export const allPins = (): PeerPin[] =>
+  (getDb().prepare(SELECT).all() as Row[]).map((r) => toPin(r)!);
+
+/** How long an unlinked machine is still answered "unknown peer", signed. */
+export const UNLINKED_KEEP_MS = 30 * 24 * 3_600_000;
+
+export interface Unlinked {
+  machineId: string;
+  hostId: string | null;
+  signPub: string;
+  /** The other machine unlinked it, rather than a person here. */
+  byPeer: boolean;
+  reason: string;
+  at: number;
+}
+
+interface UnlinkedRow {
+  machine_id: string;
+  host_id: string | null;
+  sign_pub: string;
+  by_peer: number;
+  reason: string;
+  at: number;
+}
+
+const toUnlinked = (r: UnlinkedRow | undefined): Unlinked | null =>
+  r
+    ? {
+        machineId: r.machine_id,
+        hostId: r.host_id,
+        signPub: r.sign_pub,
+        byPeer: r.by_peer === 1,
+        reason: r.reason,
+        at: r.at,
+      }
+    : null;
+
+/** A machine unlinked here within the last 30 days, by its Connect id. */
+export const unlinkedMachine = (
+  machineId: string,
+  now = Date.now()
+): Unlinked | null =>
+  toUnlinked(
+    getDb()
+      .prepare(`SELECT * FROM peer_unlinked WHERE machine_id = ? AND at > ?`)
+      .get(machineId, now - UNLINKED_KEEP_MS) as UnlinkedRow | undefined
+  );
+
+export const unlinkedHost = (hostId: string): Unlinked | null =>
+  toUnlinked(
+    getDb()
+      .prepare(
+        `SELECT * FROM peer_unlinked WHERE host_id = ? ORDER BY at DESC LIMIT 1`
+      )
+      .get(hostId) as UnlinkedRow | undefined
+  );
+
+export const hasRecentUnlinked = (now = Date.now()): boolean =>
+  getDb()
+    .prepare(`SELECT 1 FROM peer_unlinked WHERE at > ? LIMIT 1`)
+    .get(now - UNLINKED_KEEP_MS) !== undefined;
+
+/**
+ * Removes a pin, keeping its signing key as unlinked (see the migration).
+ * The host stays: it may still hold sessions, and it says who unlinked it.
+ */
+export function dropPin(
+  hostId: string,
+  o: { byPeer: boolean; reason: string },
+  now = Date.now()
+): PeerPin | null {
+  const pin = pinForHost(hostId);
+  if (!pin) return null;
+  const db = getDb();
+  db.transaction(() => {
+    db.prepare(`DELETE FROM peer_unlinked WHERE at <= ?`).run(
+      now - UNLINKED_KEEP_MS
+    );
+    db.prepare(
+      `INSERT INTO peer_unlinked (machine_id, host_id, sign_pub, by_peer, reason, at)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT(machine_id) DO UPDATE SET host_id = excluded.host_id,
+         sign_pub = excluded.sign_pub, by_peer = excluded.by_peer,
+         reason = excluded.reason, at = excluded.at`
+    ).run(
+      pin.machineId,
+      hostId,
+      pin.signPub,
+      o.byPeer ? 1 : 0,
+      o.reason.slice(0, 200),
+      now
+    );
+    db.prepare(`DELETE FROM peer_links WHERE host_id = ?`).run(hostId);
+  })();
+  return pin;
+}
+
 /** Last outcome of a call to that peer, for Machines. */
 export function notePinResult(hostId: string, error: string | null) {
   getDb()
@@ -94,3 +202,7 @@ export function notePinResult(hostId: string, error: string | null) {
     )
     .run(...(error ? [error.slice(0, 300), hostId] : [hostId]));
 }
+
+/** The other machine, `name`, unlinked this one: its signed call or refusal. */
+export const unlinkedByPeer = (hostId: string, name: string): boolean =>
+  dropPin(hostId, { byPeer: true, reason: `Unlinked by ${name}` }) !== null;

package/lib/peer/machines.ts

@@ -17,6 +17,7 @@ export interface AccountMachine {
   /** The Machines host it's linked as, when it is. */
   hostId: string | null;
   linkState: "active" | "suspended" | null;
+  suspendedReason: string | null;
 }
 
 export interface AccountMachines {
@@ -24,6 +25,8 @@ export interface AccountMachines {
   entitlements: Entitlements | null;
   fetchedAt: number;
   error: string | null;
+  /** Set when the service hasn't answered for a day: since when. */
+  uncheckedSince: number | null;
   machines: AccountMachine[];
 }
 
@@ -39,10 +42,16 @@ export async function accountMachines(
     (
       getDb()
         .prepare(
-          `SELECT p.machine_id, p.host_id, p.state FROM peer_links p
+          `SELECT p.machine_id, p.host_id, p.state, p.suspended_reason
+           FROM peer_links p
            JOIN hosts h ON h.id = p.host_id WHERE h.kind = 'connect'`
         )
-        .all() as { machine_id: string; host_id: string; state: string }[]
+        .all() as {
+        machine_id: string;
+        host_id: string;
+        state: string;
+        suspended_reason: string | null;
+      }[]
     ).map((r) => [r.machine_id, r])
   );
   return {
@@ -50,6 +59,7 @@ export async function accountMachines(
     entitlements: view.entitlements,
     fetchedAt: view.fetchedAt,
     error: view.error,
+    uncheckedSince: view.uncheckedSince,
     machines: view.peers.map((p) => {
       const pin = pins.get(p.id);
       const seen = p.lastSeenAt ? Date.parse(p.lastSeenAt) : NaN;
@@ -66,6 +76,8 @@ export async function accountMachines(
             ? "active"
             : "suspended"
           : null,
+        suspendedReason:
+          pin && pin.state !== "active" ? pin.suspended_reason : null,
       };
     }),
   };

package/lib/peer/name.ts

@@ -0,0 +1,32 @@
+/**
+ * A machine's name as the Connect service tells it, made safe to show next
+ * to a pairing code: plain text on one line, no direction overrides, short,
+ * and with no digits at all once it holds 4 or more, so a lying service
+ * can't name a machine "type 482, 913" and have the person type that
+ * instead. Separators can't be enumerated ("482 and 913"), so the count is
+ * over the whole name.
+ */
+
+export const NAME_MAX = 48;
+
+// C0/C1 controls, zero-width and joiner characters, bidi embeddings,
+// overrides and isolates, the byte-order mark.
+const INVISIBLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+// Digits, any script.
+const DIGIT = /\p{Nd}/gu;
+const MAX_DIGITS = 3;
+
+export const UNNAMED = "Unnamed machine";
+
+export function cleanMachineName(raw: unknown): string {
+  if (typeof raw !== "string") return UNNAMED;
+  let s = raw
+    .normalize("NFKC")
+    .replace(/\s+/g, " ")
+    .replace(INVISIBLE, "")
+    .trim();
+  if ((s.match(DIGIT) ?? []).length > MAX_DIGITS) s = s.replace(DIGIT, "#");
+  if ([...s].length > NAME_MAX)
+    s = `${[...s].slice(0, NAME_MAX - 1).join("")}…`;
+  return s || UNNAMED;
+}

package/lib/peer/pairing.ts

@@ -159,7 +159,10 @@ export async function receiveHello(
     s.hellos.length >= UNPROVEN
   )
     return no(429, "too many requests");
-  s.hellos.push({ at: now, from: null, source });
+  // Tagged later through this reference: other hellos may have been pushed
+  // by then, while this one waited on the plan and the account list.
+  const entry: Store["hellos"][number] = { at: now, from: null, source };
+  s.hellos.push(entry);
   const allowed = await deps.allowed();
   if (allowed !== true)
     return no(402, "Linking machines needs AgentOS Connect Pro");
@@ -179,7 +182,7 @@ export async function receiveHello(
     proven.filter((h) => h.from === hello.from).length >= PER_SENDER
   )
     return no(429, "too many link requests; wait a few minutes");
-  s.hellos[s.hellos.length - 1].from = hello.from;
+  entry.from = hello.from;
   for (const old of s.requests.values())
     if (old.peer.id === hello.from && open(old)) {
       old.state = "declined";
@@ -309,14 +312,28 @@ export interface PendingView {
   lastSeenAt: string | null;
   expiresAt: number;
   attemptsLeft: number;
+  /** `accepted`: the code matched here; `confirmCode` goes on the other machine. */
+  state: "pending" | "accepted";
+  /** Only for a caller that could have accepted it (withCodes). */
+  confirmCode?: string;
 }
 
-/** Requests waiting for a person here to type the code. */
-export function pendingRequests(now = Date.now()): PendingView[] {
+/**
+ * Requests waiting for a person here to type the code, and accepted ones
+ * still within their 5 minutes, whose second code must survive a reload.
+ */
+export function pendingRequests(
+  now = Date.now(),
+  o: { withCodes?: boolean } = {}
+): PendingView[] {
   const s = store();
   sweep(s, now);
   return [...s.requests.values()]
-    .filter((r) => r.state === "pending")
+    .filter(
+      (r) =>
+        r.state === "pending" ||
+        (r.state === "accepted" && now - r.createdAt <= REQUEST_TTL_MS)
+    )
     .map((r) => ({
       id: r.id,
       machineId: r.peer.id,
@@ -324,6 +341,10 @@ export function pendingRequests(now = Date.now()): PendingView[] {
       lastSeenAt: r.peer.lastSeenAt,
       expiresAt: r.createdAt + REQUEST_TTL_MS,
       attemptsLeft: MAX_WRONG - r.wrong,
+      state: r.state === "accepted" ? "accepted" : "pending",
+      ...(o.withCodes &&
+        r.state === "accepted" &&
+        r.confirm && { confirmCode: r.confirm }),
     }));
 }
 
@@ -379,6 +400,14 @@ export async function acceptRequest(
       status: 402,
       error: "Linking machines needs AgentOS Connect Pro.",
     };
+  // It may have been declined, replaced, expired or accepted meanwhile.
+  sweep(s, deps.now());
+  if (r.state !== "pending" || s.requests.get(id) !== r)
+    return {
+      ok: false,
+      status: 404,
+      error: "That request has ended. Start again from the other machine.",
+    };
   let hostId: string;
   try {
     hostId = deps.pin({ ...r.peer, signPub: r.aSign, boxPub: r.aBox });

package/lib/peer/pin.ts

@@ -4,8 +4,9 @@
  * of a pin: a machine whose keys changed is unlinked first, by a person.
  */
 
-import { createConnectHost, listRemoteHosts } from "../hosts";
-import { pinForMachine, savePin } from "./links";
+import { createConnectHost, getHost, listRemoteHosts } from "../hosts";
+import { pinForMachine, savePin, unlinkedMachine } from "./links";
+import { cleanMachineName } from "./name";
 
 export interface Paired {
   id: string;
@@ -43,7 +44,13 @@ export function keysChanged(
 export function pinPeer(p: Paired): string {
   const pinned = pinForMachine(p.id);
   if (keysChanged(p.id, p)) throw new Error(KEY_CHANGED);
-  const hostId = pinned?.hostId ?? createConnectHost(freeName(p.name)).id;
+  // Linked again after an unlink: back on the host it had, if it's still here.
+  const was = unlinkedMachine(p.id)?.hostId;
+  const reuse = was && getHost(was)?.kind === "connect" ? was : null;
+  const hostId =
+    pinned?.hostId ??
+    reuse ??
+    createConnectHost(freeName(cleanMachineName(p.name))).id;
   savePin({
     hostId,
     machineId: p.id,

package/lib/peer/reasons.ts

@@ -0,0 +1,7 @@
+/** Why a Connect link is suspended (revoke.ts), shared with the UI. */
+
+import { CONNECT_SITE } from "../connect/view";
+
+export const REMOVED_FROM_ACCOUNT = "removed from your account";
+export const NEEDS_PRO = "Linking machines needs Pro";
+export const UPGRADE_URL = `${CONNECT_SITE}/settings/billing`;

package/lib/peer/revoke.ts

@@ -0,0 +1,75 @@
+/**
+ * Suspending links when the account says so, and lifting that when it says
+ * otherwise. A pin is never deleted here: a machine removed from the
+ * account by mistake comes back linked as soon as its key is listed again,
+ * with no new pairing. The account can only take trust away this way, never
+ * add it: a pin it didn't suspend is never touched, and a suspended pin is
+ * resumed only with the very key it was paired with.
+ */
+
+import { allPins, resumePin, suspendPin, type PeerPin } from "./links";
+import { NEEDS_PRO, REMOVED_FROM_ACCOUNT } from "./reasons";
+
+export { NEEDS_PRO, REMOVED_FROM_ACCOUNT };
+
+const OURS: ReadonlySet<string> = new Set([REMOVED_FROM_ACCOUNT, NEEDS_PRO]);
+
+export interface AccountSays {
+  /** The plan's answer; null when it hasn't said. */
+  linkMachines: boolean | null;
+  /** Each listed machine's signing key, or null when this isn't a fresh list. */
+  listed: Map<string, string> | null;
+}
+
+/** What this pin's state should be, or null to leave it as it is. */
+export function wanted(
+  pin: PeerPin,
+  says: AccountSays
+): { state: "active" } | { state: "suspended"; reason: string } | null {
+  if (pin.state === "suspended" && !OURS.has(pin.suspendedReason ?? ""))
+    return null;
+  if (says.linkMachines === false)
+    return { state: "suspended", reason: NEEDS_PRO };
+  const key = says.listed?.get(pin.machineId);
+  if (says.listed && key !== pin.signPub)
+    return { state: "suspended", reason: REMOVED_FROM_ACCOUNT };
+  if (pin.state === "active") return null;
+  const lifted =
+    pin.suspendedReason === NEEDS_PRO
+      ? says.linkMachines === true
+      : says.listed !== null && key === pin.signPub;
+  return lifted ? { state: "active" } : null;
+}
+
+export interface Changed {
+  hostId: string;
+  state: "active" | "suspended";
+  reason: string | null;
+}
+
+/** Applies what the account says to every pin; returns what changed. */
+export function reconcilePins(
+  says: AccountSays,
+  pins: PeerPin[] = allPins()
+): Changed[] {
+  const changed: Changed[] = [];
+  for (const pin of pins) {
+    const want = wanted(pin, says);
+    if (!want) continue;
+    if (want.state === "active") {
+      resumePin(pin.hostId);
+      changed.push({ hostId: pin.hostId, state: "active", reason: null });
+    } else if (
+      pin.state !== "suspended" ||
+      pin.suspendedReason !== want.reason
+    ) {
+      suspendPin(pin.hostId, want.reason);
+      changed.push({
+        hostId: pin.hostId,
+        state: "suspended",
+        reason: want.reason,
+      });
+    }
+  }
+  return changed;
+}

package/lib/peer/rpc-server.ts

@@ -15,7 +15,10 @@
  * Refusals before decryption are plain and fixed (`bad envelope`, `bad
  * signature`, `stale`, `replay`, `busy`). An unknown sender, a suspended one
  * and a bad signature all read `bad signature`, so a stranger can't tell
- * which machines are linked here; the audit keeps the difference. Everything
+ * which machines are linked here; the audit keeps the difference. The one
+ * exception is a machine unlinked here, proven by the key it was pinned
+ * with: it gets 403 `unknown peer`, signed (unlinked-proof.ts), so it can
+ * show that it was unlinked. Everything
  * after is inside the envelope,
  * always HTTP 200, so whoever carries the traffic never learns the route or
  * its status.
@@ -45,7 +48,14 @@ import {
   type BoxKey,
   type Identity,
 } from "./keys";
-import { hasActivePin, pinForMachine, type PeerPin } from "./links";
+import {
+  hasActivePin,
+  hasRecentUnlinked,
+  pinForMachine,
+  unlinkedMachine,
+  type PeerPin,
+} from "./links";
+import { UNLINKED_PROOF_HEADER, signUnlinked } from "./unlinked-proof";
 import { sqliteNonceStore } from "./nonce-store";
 import { createReplayGuard, type ReplayGuard } from "./replay";
 import {
@@ -75,7 +85,11 @@ export interface RpcDeps {
   identity: () => Identity | null;
   boxKey: () => BoxKey;
   pinForMachine: (machineId: string) => PeerPin | null;
-  /** False while no link is active: the route is closed to everyone. */
+  /** A machine unlinked here lately: the key it was pinned with. */
+  unlinked?: (
+    machineId: string
+  ) => { signPub: string; hostId: string | null } | null;
+  /** False while no link is active or recently unlinked: the route is closed to everyone. */
   anyActive: () => boolean;
   replay: ReplayGuard;
   dispatch: (d: Dispatch) => Promise<PeerResponse>;
@@ -125,6 +139,10 @@ export async function handlePeerRpc(
   const self = deps.identity();
   let fromMachine: string | null = null;
   let pin: PeerPin | null = null;
+  // An unlinked sender whose header its old key proved, and its nonce.
+  let unlinkedHost: string | null = null;
+  let viaUnlinked = false;
+  let provenUnlinked: string | null = null;
   const audit = (
     outcome: Outcome,
     status: number,
@@ -133,7 +151,7 @@ export async function handlePeerRpc(
     bytes = 0
   ) =>
     deps.audit({
-      hostId: pin?.hostId ?? null,
+      hostId: pin?.hostId ?? unlinkedHost,
       machineId: fromMachine,
       direction: "in",
       method,
@@ -144,6 +162,19 @@ export async function handlePeerRpc(
       outcome,
     });
   const refuse = (refusal: Refusal): null => {
+    if (refusal === "unknown_peer" && provenUnlinked && self && fromMachine) {
+      audit("unknown_peer", 403);
+      res.setHeader(
+        UNLINKED_PROOF_HEADER,
+        signUnlinked(self.signKey, {
+          from: self.machineId,
+          to: fromMachine,
+          nonce: provenUnlinked,
+        })
+      );
+      plain(res, 403, "unknown peer");
+      return null;
+    }
     const [status, text, outcome] = REFUSED[refusal];
     audit(outcome, status);
     plain(res, status, text);
@@ -161,6 +192,18 @@ export async function handlePeerRpc(
       : found.state !== "active"
         ? "suspended"
         : null;
+    if (!found) {
+      const gone = deps.unlinked?.(machineId);
+      if (gone)
+        try {
+          const key = signPublic(gone.signPub);
+          unlinkedHost = gone.hostId;
+          viaUnlinked = true;
+          return key;
+        } catch {
+          // Unreadable: a decoy, like any stranger.
+        }
+    }
     if (!found || hidden) return DECOY_KEY;
     try {
       return signPublic(found.signPub);
@@ -210,6 +253,10 @@ export async function handlePeerRpc(
             now
           );
           if (fresh !== "ok") return { refusal: fresh };
+          if (viaUnlinked) {
+            provenUnlinked = header.nonce;
+            return { refusal: "unknown_peer" };
+          }
           claimed = `${header.from}:${header.nonce}`;
           return { peer: header.from };
         },
@@ -360,7 +407,8 @@ export function rpcDeps(port: number): RpcDeps {
     identity: () => currentIdentity(),
     boxKey: () => (box ??= loadBoxKey()),
     pinForMachine,
-    anyActive: hasActivePin,
+    unlinked: (machineId) => unlinkedMachine(machineId),
+    anyActive: () => hasActivePin() || hasRecentUnlinked(),
     replay: createReplayGuard({ store: sqliteNonceStore() }),
     dispatch: loopbackDispatch(port),
     audit: recordPeerCall,

package/lib/peer/unlink.ts

@@ -0,0 +1,62 @@
+/**
+ * Unlinking a machine linked through Connect, from either side. Here: the
+ * pin goes at once (links.ts dropPin), then the other machine is told with a
+ * signed POST /api/peer/unlink, best effort. There: the same call drops its
+ * pin and its Machines says "Unlinked by <this machine>". If that call never
+ * arrives, the other machine's next call here is answered with a signed
+ * "unknown peer" (rpc-server.ts), which does the same.
+ */
+
+import { deleteHost } from "../hosts";
+import { hostLink, type HostLink } from "../hosts/remote-api";
+import { peerCall } from "./client";
+import { dropPin, pinForHost } from "./links";
+
+export const UNLINKED_HERE = "Unlinked here";
+
+export interface UnlinkDeps {
+  tell: (link: HostLink) => Promise<unknown>;
+  remove: (hostId: string) => void;
+}
+
+const realDeps: UnlinkDeps = {
+  tell: (link) =>
+    peerCall(link, "/api/peer/unlink", { body: {}, timeout: 8_000 }),
+  remove: deleteHost,
+};
+
+export interface UnlinkResult {
+  name: string;
+  /** The other machine confirmed it dropped its side. */
+  told: boolean;
+  /** The machine left Machines here too (it held no sessions or projects). */
+  removed: boolean;
+}
+
+/** A person here unlinks it. Throws when it isn't linked through Connect. */
+export async function unlinkPeer(
+  hostId: string,
+  deps: UnlinkDeps = realDeps
+): Promise<UnlinkResult> {
+  const link = hostLink(hostId);
+  if (!link?.connect || !pinForHost(hostId))
+    throw new Error("That machine isn't linked through Connect.");
+  dropPin(hostId, { byPeer: false, reason: UNLINKED_HERE });
+  let told = false;
+  // A suspended link is refused there too; nothing would arrive.
+  if (link.connect.state === "active")
+    try {
+      await deps.tell(link);
+      told = true;
+    } catch {
+      // Best effort: its next call here is refused and says why.
+    }
+  let removed = false;
+  try {
+    deps.remove(hostId);
+    removed = true;
+  } catch {
+    // It still holds sessions or projects; it stays, unlinked.
+  }
+  return { name: link.hostName, told, removed };
+}

package/lib/peer/unlinked-proof.ts

@@ -0,0 +1,44 @@
+/**
+ * The one refusal that is signed: "unknown peer", sent to a machine that was
+ * unlinked here, bound to its own request's nonce. Only the key it had pinned
+ * for this machine verifies it, so whoever carries the traffic can't forge an
+ * unlink, and a replayed one never matches a new request.
+ */
+
+import crypto, { type KeyObject } from "crypto";
+
+export const UNLINKED_PROOF_HEADER = "x-agentos-peer-unlinked";
+const DOMAIN = "agentos-peer-unlinked-v1";
+
+interface Bound {
+  /** The machine refusing: the one that unlinked. */
+  from: string;
+  /** The caller, which it no longer knows. */
+  to: string;
+  /** The caller's request nonce, base64url. */
+  nonce: string;
+}
+
+const message = (o: Bound) =>
+  Buffer.from(`${DOMAIN}|${o.from}|${o.to}|${o.nonce}`);
+
+export const signUnlinked = (signKey: KeyObject, o: Bound): string =>
+  crypto.sign(null, message(o), signKey).toString("base64url");
+
+export function verifyUnlinked(
+  signPub: KeyObject,
+  o: Bound,
+  sig: string | null
+): boolean {
+  if (!sig || !/^[A-Za-z0-9_-]{86}$/.test(sig)) return false;
+  try {
+    return crypto.verify(
+      null,
+      message(o),
+      signPub,
+      Buffer.from(sig, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}

package/lib/projects.ts

@@ -19,6 +19,7 @@ import {
   type DevServerType,
 } from "./db";
 import { resolveModelForAgent } from "./model-catalog";
+import { clearForeignGroup } from "./session-groups/assignSessions";
 import type { AgentType } from "./providers";
 
 const execAsync = promisify(exec);
@@ -312,7 +313,7 @@ export function getProjectSessions(projectId: string): Session[] {
 export function moveSessionToProject(
   sessionId: string,
   projectId: string
-): void {
+): { clearedGroup: string | null } {
   const to = getProject(projectId);
   const from = db
     .prepare(
@@ -321,7 +322,7 @@ export function moveSessionToProject(
     )
     .get(sessionId) as
     { workspace_id: string | null; own: string | null } | undefined;
-  db.transaction(() => {
+  return db.transaction(() => {
     queries.updateSessionProject(db).run(projectId, sessionId);
     // A project's session follows the project; one left in none keeps the
     // workspace it was in.
@@ -333,6 +334,8 @@ export function moveSessionToProject(
         : (from?.workspace_id ?? from?.own ?? null),
       sessionId
     );
+    // A group belongs to the workspace the session just left.
+    return { clearedGroup: clearForeignGroup(sessionId) };
   })();
 }