@soyeht/soyeht 0.2.11 → 0.2.12

package/openclaw.plugin.json

@@ -5,7 +5,7 @@
   ],
   "name": "Soyeht",
   "description": "Channel plugin for the Soyeht Flutter mobile app",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soyeht/soyeht",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "OpenClaw channel plugin for the Soyeht Flutter mobile app",
   "type": "module",
   "main": "src/index.ts",

package/src/http.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { OpenClawPluginApi, PluginRuntimeChannel } from "openclaw/plugin-sdk";
 import { normalizeAccountId, resolveSoyehtAccount } from "./config.js";
@@ -78,6 +78,11 @@ export type ProcessInboundResult =
   | { ok: true; plaintext: string; accountId: string; envelope: EnvelopeV2 }
   | { ok: false; status: number; error: string };
 
+// Short hash for safe diagnostic logging (no key material leaked)
+function diagHash(buf: Buffer): string {
+  return createHash("sha256").update(buf).digest("hex").slice(0, 8);
+}
+
 export function processInboundEnvelope(
   api: OpenClawPluginApi,
   v2deps: SecurityV2Deps,
@@ -92,6 +97,7 @@ export function processInboundEnvelope(
   const accountId = hintedAccountId ?? envelopeAccountId;
   const session = v2deps.sessions.get(accountId);
   if (!session) {
+    api.logger.warn("[soyeht] DIAG: no session for account", { accountId, knownAccounts: [...v2deps.sessions.keys()] });
     return { ok: false, status: 401, error: "session_required" };
   }
 
@@ -103,9 +109,41 @@ export function processInboundEnvelope(
     return { ok: false, status: 401, error: "account_mismatch" };
   }
 
+  // --- Diagnostic logging: envelope + session state before decrypt ---
+  let ivLen = 0, ctLen = 0, tagLen = 0;
+  let b64DecodeError: string | undefined;
+  try {
+    ivLen = base64UrlDecode(envelope.iv).length;
+    ctLen = base64UrlDecode(envelope.ciphertext).length;
+    tagLen = base64UrlDecode(envelope.tag).length;
+  } catch (e) {
+    b64DecodeError = e instanceof Error ? e.message : String(e);
+  }
+
+  api.logger.info("[soyeht] DIAG inbound", {
+    accountId,
+    peerExists: v2deps.peers.has(accountId),
+    rootKeyHash: diagHash(session.rootKey),
+    recvChainKeyHash: diagHash(session.receiving.chainKey),
+    sendChainKeyHash: diagHash(session.sending.chainKey),
+    sessionRecvCounter: session.receiving.counter,
+    sessionSendCounter: session.sending.counter,
+    envelopeVersion: envelope.v,
+    envelopeDirection: envelope.direction,
+    envelopeCounter: envelope.counter,
+    envelopeTimestamp: envelope.timestamp,
+    hasDhRatchetKey: Boolean(envelope.dhRatchetKey),
+    ivLen,
+    ctLen,
+    tagLen,
+    b64DecodeError: b64DecodeError ?? "none",
+    aad: `${envelope.v}|${envelope.accountId}|${envelope.direction}|${envelope.counter}|${envelope.timestamp}`,
+  });
+  // --- End diagnostic logging ---
+
   const validation = validateEnvelopeV2(envelope, session);
   if (!validation.valid) {
-    api.logger.warn("[soyeht] Envelope validation failed", { error: validation.error, accountId });
+    api.logger.warn("[soyeht] DIAG validation failed", { error: validation.error, accountId });
     return { ok: false, status: 401, error: validation.error };
   }
 
@@ -121,10 +159,23 @@ export function processInboundEnvelope(
     updatedSession = result.updatedSession;
   } catch (err) {
     const msg = err instanceof Error ? err.message : "decryption_failed";
-    api.logger.warn("[soyeht] Envelope decryption failed", { error: msg, accountId });
+    const isAuthFailure = msg.includes("authenticate data") || msg.includes("auth");
+    api.logger.error("[soyeht] DIAG decrypt FAILED", {
+      accountId,
+      error: msg,
+      isGcmAuthFailure: isAuthFailure,
+      envelopeCounter: envelope.counter,
+      sessionRecvCounter: session.receiving.counter,
+      hasDhRatchetKey: Boolean(envelope.dhRatchetKey),
+      ivLen,
+      ctLen,
+      tagLen,
+    });
     return { ok: false, status: 401, error: msg };
   }
 
+  api.logger.info("[soyeht] DIAG decrypt OK", { accountId, plaintextLen: plaintext.length });
+
   // Update session
   v2deps.sessions.set(accountId, updatedSession);
 

package/src/version.ts

@@ -1 +1 @@
-export const PLUGIN_VERSION = "0.2.11";
+export const PLUGIN_VERSION = "0.2.12";