@twinsearth/w2m-dsh-plugin 1.2.5 → 1.2.6

package/src/agent/crypto.mjs

@@ -336,6 +336,37 @@ export function rawPrivateOf(privateKey) {
  * stored: the public half is derived, which is what makes a hand-edited file unable to publish a
  * public key that does not match its private key.
  */
+/**
+ * v1.2.6: the Ed25519 key this machine signs envelopes with.
+ *
+ * ## Why derived rather than a second file
+ *
+ * `DeviceKey` is X25519: it does key agreement for the p2p handshake and cannot sign (the runtime refuses it outright). A second
+ * on-disk key would be a second thing to back up, rotate and lose. The device's 32-byte private scalar is a perfectly good
+ * Ed25519 seed, so the signing key is derived from it: one secret to protect, and a machine that re-pairs cannot end up with a
+ * signature key nobody can verify.
+ *
+ * The public half travels INSIDE the signature so a reader can verify the tuple without knowing this machine beforehand. Binding
+ * that key to the relay's device record is the remaining step for non-repudiation across machines -- recorded in the roadmap.
+ *
+ * @param {DeviceKey} deviceKey
+ * @returns {{privateKey: import('node:crypto').KeyObject, publicKeyBase64: string}|null}
+ */
+export function deriveSigningKey(deviceKey) {
+  if (!(deviceKey instanceof DeviceKey)) return null;
+  try {
+    const seed = rawPrivateOf(deviceKey.privateKey);
+    if (seed.length !== 32) return null;
+    const pkcs8 = Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), seed]);
+    const privateKey = createPrivateKey({ key: pkcs8, format: 'der', type: 'pkcs8' });
+    const publicKey = createPublicKey(privateKey);
+    const raw = publicKey.export({ format: 'der', type: 'spki' }).subarray(-32);
+    return { privateKey, publicKeyBase64: raw.toString('base64') };
+  } catch {
+    return null;
+  }
+}
+
 export class DeviceKey {
   /**
    * @param {object} options

package/src/plugin/tools.mjs

@@ -1,4 +1,4 @@
-/**
+/**
  * DSH: Windows2MacO - the DSH Cordis plugin.
  *
  * # What this exposes
@@ -94,6 +94,7 @@ import { resolveChannels } from './update-channels.mjs';
 import { fetchLatestRelease, fetchPrereleaseRelease, requireChecksum, downloadVerified, DEFAULT_REPO } from './update-source.mjs';
 import { installUpdate } from './update-install.mjs';import { createHash, randomUUID } from 'node:crypto';
 import { promises as fs } from 'node:fs';
+import { join } from 'node:path';
 import os from 'node:os';
 import path from 'node:path';
 // The individual memory layer (v0.9.6). Read through the agent's own module rather than re-parsing the
@@ -186,8 +187,51 @@ import { registerChatRoutes } from './fleet-chat-route.mjs';
 import { createFleetCouncil, fleetCouncilThread } from './council-fleet.mjs';
 import { renderMemoryView } from './memory-view.mjs';
 import { buildBoard } from './task-graph.mjs';
+import { verifyEnvelopeSignature } from '../util/envelope-signature.mjs';
 import { createAskStore } from './ask-store.mjs';
 import { deriveTurns } from './turn.mjs';
+import { decryptChatMessage, deriveChatKey, encryptChatText, isEncrypted } from '../util/chat-crypto.mjs';
+
+/**
+ * v1.2.6 reliability: two small files beside the plugin's state.
+ *
+ * `chat-cursor.json` remembers how far each conversation has been read, so "list" continues where the last page ended instead of
+ * starting over. `chat-spool.jsonl` holds messages that could not be sent because the Rabbit was unreachable; each carries the
+ * idempotency key it will be posted with, so a replay that the relay already received does not post the sentence twice.
+ */
+const CHAT_CURSOR_FILE = 'chat-cursor.json';
+const CHAT_SPOOL_FILE = 'chat-spool.jsonl';
+
+async function readChatCursors(stateDir) {
+  if (typeof stateDir !== 'string' || stateDir === '') return {};
+  try {
+    const parsed = JSON.parse(await fs.readFile(join(stateDir, CHAT_CURSOR_FILE), 'utf8'));
+    return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  } catch { return {}; }
+}
+
+async function writeChatCursors(stateDir, cursors) {
+  if (typeof stateDir !== 'string' || stateDir === '') return false;
+  try { await fs.writeFile(join(stateDir, CHAT_CURSOR_FILE), JSON.stringify(cursors, null, 2), 'utf8'); return true; }
+  catch { return false; }
+}
+
+async function readChatSpool(stateDir) {
+  if (typeof stateDir !== 'string' || stateDir === '') return [];
+  try {
+    const text = await fs.readFile(join(stateDir, CHAT_SPOOL_FILE), 'utf8');
+    return text.split('\n').map((line) => { try { return JSON.parse(line); } catch { return null; } }).filter((entry) => entry !== null && typeof entry === 'object');
+  } catch { return []; }
+}
+
+async function writeChatSpool(stateDir, entries) {
+  if (typeof stateDir !== 'string' || stateDir === '') return false;
+  try {
+    await fs.writeFile(join(stateDir, CHAT_SPOOL_FILE), entries.map((entry) => JSON.stringify(entry)).join('\n') + (entries.length === 0 ? '' : '\n'), 'utf8');
+    return true;
+  } catch { return false; }
+}
+
 import { buildReducePlan } from '../util/dataflow.mjs';
 import { schemaProblems, strayParameterProblems } from './schema-spec.mjs';
 import { listIntents, resolveIntent } from './intents.mjs';
@@ -228,7 +272,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.2.5';
+const PLUGIN_VERSION = '1.2.6';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -4423,6 +4467,14 @@ export async function apply(ctx, config = {}) {
       const machines = Array.isArray(aggregate.detail?.machines)
         ? aggregate.detail.machines.map((machine) => {
             const envelope = machine?.envelope ?? machine?.result ?? null;
+            // v1.2.6: the signature covers the command tuple; a reader is told which of the three states it is in.
+            const relayVerdict = typeof machine?.signature_status === 'string' && machine.signature_status !== '' ? machine.signature_status : null;
+          const signatureStatus = relayVerdict ?? verifyEnvelopeSignature({
+              signature: envelope?.signature ?? null,
+              task_id: envelope?.task_id ?? taskId,
+              argv_hash: envelope?.command_hash,
+              machine_id: envelope?.machine_id ?? machine?.machine_id,
+            });
             return {
               machine_id: machine?.machine_id ?? null,
               machine_name: machine?.machine_name ?? null,
@@ -4440,6 +4492,7 @@ export async function apply(ctx, config = {}) {
                * v0.3.9 agent sends, so a missing value must not be dressed up as `'relay'`.
                */
               transport: envelope?.transport ?? machine?.transport ?? null,
+              signature_status: signatureStatus,
               p2p: envelope?.p2p ?? machine?.p2p ?? null,
               reasons: machine?.reasons ?? [],
               envelope: compactEnvelope(envelope, COMPARABLE_FIELDS),
@@ -4447,6 +4500,15 @@ export async function apply(ctx, config = {}) {
           })
         : [];
 
+      // v1.2.6: a signature state is never silently flattened into success.
+      const signatureCounts = machines.reduce((counts, machine) => {
+        const key = machine.signature_status ?? 'unsigned';
+        counts[key] = (counts[key] ?? 0) + 1;
+        return counts;
+      }, {});
+      const unsigned = signatureCounts.unsigned ?? 0;
+      const badSignature = signatureCounts.bad_signature ?? 0;
+
       // v1.2.4: a task whose machines produced blobs is only complete when EVERY map result names one and a reducer was
       // declared. The plan is built from the RAW envelopes: the comparable copy intentionally drops the fields this needs,
       // and a reduce over a partial fleet that reports itself complete is the failure this guards.
@@ -4480,6 +4542,9 @@ export async function apply(ctx, config = {}) {
           state_known: aggregate.known,
           states: aggregate.states,
           machines,
+          signatures: signatureCounts,
+          ...(badSignature > 0 ? { signature_warning: 'bad_signature' } : {}),
+          ...(badSignature === 0 && unsigned > 0 ? { signature_warning: 'unsigned' } : {}),
           ...(reduce === null ? {} : { reduce }),
           ...(dataflowDegraded ? { dataflow_degraded: true } : {}),
           counts: aggregate.detail?.counts ?? null,
@@ -6549,6 +6614,10 @@ export async function apply(ctx, config = {}) {
         // The persisted questions for this conversation, in the states they are in. A read, so it needs no relay.
         return JSON.stringify({ ok: true, action, session_id: sessionId, ...askStore.list({ sessionId }) });
       }
+      if (action === 'cursor') {
+        const cursors = await readChatCursors(cfg.stateDir);
+        return JSON.stringify({ ok: true, action, session_id: sessionId, cursor: Object.prototype.hasOwnProperty.call(cursors, sessionId) ? cursors[sessionId] : null, spool_count: (await readChatSpool(cfg.stateDir)).length });
+      }
       const rabbitUrl = cfg.rabbitUrl ?? null;
       if (rabbitUrl === null) throw new W2MError('W2M_NO_RELAY', 'W2M_NO_RELAY: no relay is configured, so chat cannot be reached', { hint: 'set rabbitUrl in the profile patch' });
       // resolveToken, not readDevice: readDevice returns an empty identity whenever `stateDir` is
@@ -6557,6 +6626,22 @@ export async function apply(ctx, config = {}) {
       // one reported W2M_NO_TOKEN on a machine that was paired and answering every other call.
       const token = await resolveToken(cfg);
       if (token === null) throw new W2MError('W2M_NO_TOKEN', 'W2M_NO_TOKEN: this machine has no device token, so chat cannot be authenticated', { hint: 'pair this machine first (autoStartAgent or a pairing code), then retry' });
+      const stateDir = typeof cfg.stateDir === 'string' ? cfg.stateDir : '';
+      // v1.2.6 reliability: try to deliver what the last unreachable attempt had to leave behind, before doing anything else.
+      let spool = await readChatSpool(stateDir);
+      let spoolDelivered = 0;
+      if (spool.length > 0) {
+        const remaining = [];
+        for (const entry of spool) {
+          try {
+            const replayed = await request({ rabbitUrl, token, signal: exec?.signal, method: 'POST', pathname: '/v1/fleet/messages', body: entry.body });
+            if (replayed?.ok === true) { spoolDelivered += 1; continue; }
+          } catch { /* still unreachable: keep it for next time */ }
+          remaining.push(entry);
+        }
+        spool = remaining;
+        await writeChatSpool(stateDir, spool);
+      }
       // Addressing + correlation travel only when the caller supplied them, so a plain broadcast stays byte-identical.
       const addressing = {};
       if (typeof args?.to === 'string' && args.to.trim() !== '') {
@@ -6594,40 +6679,83 @@ export async function apply(ctx, config = {}) {
       }
       if (action === 'send' || action === 'ask') {
         const mentions = Array.isArray(args?.mentions) ? args.mentions.filter((id) => typeof id === 'string' && id !== '') : [];
-        const posted = await request({
-          rabbitUrl,
-          token,
-          signal: exec?.signal,
-          method: 'POST',
-          pathname: '/v1/fleet/messages',
-          body: {
-            session_id: sessionId,
-            text: typeof args?.text === 'string' ? args.text : '',
-            ...addressing,
-            // v1.2.5: a mention is a notification hint; the idempotency key lets a retry after a lost response replay the
-            // first message instead of posting the same sentence twice.
-            ...(mentions.length === 0 ? {} : { mentions }),
-            ...(typeof args?.idempotency_key === 'string' && args.idempotency_key.trim() !== '' ? { idempotency_key: args.idempotency_key.trim() } : {}),
-          },
-        });
+        /**
+         * v1.2.6: the chat is end-to-end encrypted when a fleet key is available (configured, or derived from the account join).
+         * Without one the tool keeps sending plaintext rather than refusing: a fleet that has not joined yet is a normal state,
+         * and a silent refusal would read as a broken chat.
+         */
+        const chatKey = deriveChatKey(cfg.fleetKey ?? resolvedFleetKey.value ?? null);
+        const plainText = typeof args?.text === 'string' ? args.text : '';
+        const sealed = chatKey === null ? null : encryptChatText(chatKey, plainText);
+        /**
+         * v1.2.6 reliability: an unreachable Rabbit does not lose the message. The exact body that could not be sent is
+         * spooled to disk and replayed with the SAME idempotency key next time, so a message the relay actually received
+         * before the connection died is not posted twice.
+         */
+        const messageBody = {
+          session_id: sessionId,
+          text: sealed !== null && sealed.ok === true ? sealed.text : plainText,
+          ...(sealed !== null && sealed.ok === true ? { enc: sealed.enc } : {}),
+          ...addressing,
+          ...(mentions.length === 0 ? {} : { mentions }),
+          ...(typeof args?.idempotency_key === 'string' && args.idempotency_key.trim() !== '' ? { idempotency_key: args.idempotency_key.trim() } : { idempotency_key: 'spool-' + Date.now() + '-' + Math.random().toString(36).slice(2) }),
+        };
+        let posted = null;
+        try {
+          posted = await request({ rabbitUrl, token, signal: exec?.signal, method: 'POST', pathname: '/v1/fleet/messages', body: messageBody });
+        } catch (error) {
+          if (error?.code === 'W2M_UNREACHABLE') {
+            spool.push({ body: messageBody, created_at: new Date().toISOString() });
+            await writeChatSpool(stateDir, spool);
+            return JSON.stringify({ ok: true, action, spooled: true, spool_count: spool.length, encrypted: sealed !== null && sealed.ok === true });
+          }
+          throw error;
+        }
         if (posted?.ok !== true) {
           const code = posted?.json?.error?.code ?? posted?.error?.code ?? 'W2M_CHAT_SEND';
           throw new W2MError('W2M_CHAT_SEND', code + ': the message was refused', { reason_code: code, hint: 'quota, size and non-text each need a different answer' });
         }
-        return JSON.stringify({ ok: true, action, message: posted.json?.message ?? null, message_id: posted.json?.message?.message_id ?? null, ...(posted.json?.deduped === true ? { deduped: true } : {}) });
+        return JSON.stringify({
+          ok: true, action, message: posted.json?.message ?? null, message_id: posted.json?.message?.message_id ?? null,
+          encrypted: sealed !== null && sealed.ok === true,
+          ...(posted.json?.deduped === true ? { deduped: true } : {}),
+        });
       }
+      const query = { session_id: sessionId };
+      // v1.2.6 reliability: continue where the last page ended, unless the caller asked for an explicit start.
+      const cursors = await readChatCursors(stateDir);
+      const storedCursor = Object.prototype.hasOwnProperty.call(cursors, sessionId) ? cursors[sessionId] : null;
+      if (!Number.isFinite(args?.since_ms) && storedCursor !== null && Number.isFinite(storedCursor.at_ms)) query.since_ms = String(storedCursor.at_ms);
       if (typeof args?.thread_id === 'string' && args.thread_id.trim() !== '') query.thread_id = args.thread_id.trim();
       if (typeof args?.to === 'string' && args.to.trim() !== '') query.to = args.to.trim();
-      const query = { session_id: sessionId };
       if (Number.isFinite(args?.since_ms)) query.since_ms = String(args.since_ms);
       if (Number.isInteger(args?.limit)) query.limit = String(args.limit);
       const listed = await request({ rabbitUrl, token, signal: exec?.signal, method: 'GET', pathname: '/v1/fleet/messages', query });
       if (listed?.ok !== true) throw new W2MError('W2M_CHAT_LIST', 'W2M_CHAT_LIST: the relay refused the read', { hint: 'check the relay and this machine token' });
-      const messages = listed.json?.messages ?? [];
+      const rawMessages = listed.json?.messages ?? [];
+      /**
+       * v1.2.6: a reader decrypts what its key covers and marks the rest. An undecryptable message keeps its ciphertext and its
+       * reason instead of failing the page -- the relay is allowed to hold a message this machine cannot open.
+       */
+      const listKey = deriveChatKey(cfg.fleetKey ?? resolvedFleetKey.value ?? null);
+      const messages = rawMessages.map((message) => {
+        if (!isEncrypted(message)) return message;
+        const opened = decryptChatMessage(listKey, message);
+        if (opened.ok === true) return { ...message, text: opened.text, decrypted: true };
+        return { ...message, text: '', decrypted: false, encrypted: true, decrypt_error: opened.code };
+      });
+      const encryptedCount = messages.filter((message) => message.encrypted === true || message.decrypted === true).length;
+      // The cursor advances only over what was actually read, so a page that failed mid-way does not skip messages.
+      const newestAt = messages.reduce((max, message) => (Number.isFinite(message?.at_ms) && message.at_ms > max ? message.at_ms : max), 0);
+      let cursor = storedCursor;
+      if (newestAt > 0 && (storedCursor === null || newestAt > storedCursor.at_ms)) {
+        cursor = { at_ms: newestAt, message_id: messages.filter((message) => message.at_ms === newestAt)[0]?.message_id ?? null };
+        await writeChatCursors(stateDir, { ...cursors, [sessionId]: cursor });
+      }
       // v1.2.4: the page is annotated with turns derived from the relay's own numbering, so a reader does not have to order
       // replies by arrival time.
       const turns = deriveTurns(messages);
-      return JSON.stringify({ ok: true, action, session_id: sessionId, messages, count: messages.length, turns: turns.threads, inferred_turns: turns.inferred_turns, count_was: listed.json?.count ?? 0, usage: listed.json?.usage ?? null });
+      return JSON.stringify({ ok: true, action, session_id: sessionId, messages, count: messages.length, encrypted_count: encryptedCount, cursor, spooled: spoolDelivered, turns: turns.threads ?? [], inferred_turns: turns.inferred_turns ?? [] });
     },
   }));
 
@@ -7182,6 +7310,8 @@ async function startLocalStack(ctx, cfg) {
       caps,
       platform,
       allowedCommands: cfg.allowedCommands,
+      // v1.2.6: on by default; a profile may turn it off for debugging, and the envelope then says `unredacted: true`.
+      redactOutput: cfg.redactOutput !== false,
     });
     /**
      * v0.8.9: derive the fleet key, RETRYING until the account actually answers.

package/src/relay/fleet-messages.mjs

@@ -105,6 +105,20 @@ export function createFleetMessages(options = {}) {
     if (to !== 'all' && (to.length > 64 || /\s/.test(to))) return { ok: false, code: 'BAD_ADDRESS' };
     // Correlation: a thread groups a conversation, reply_to points at the message being answered, turn orders the
     // exchange inside one thread. Plain fields, validated rather than trusted.
+    /**
+     * v1.2.6 end-to-end encryption: the relay carries the ciphertext and its metadata, and never a key. It validates the SHAPE
+     * because a malformed envelope would be stored and later fail on every reader; it cannot check the content, and that is the
+     * point -- which also means it cannot search messages or know their real length.
+     */
+    const rawEnc = input?.enc;
+    let enc = null;
+    if (rawEnc !== undefined && rawEnc !== null) {
+      const ivOk = typeof rawEnc.iv === 'string' && rawEnc.iv.length > 0 && rawEnc.iv.length <= 64;
+      const tagOk = typeof rawEnc.tag === 'string' && rawEnc.tag.length > 0 && rawEnc.tag.length <= 64;
+      if (rawEnc.v !== 1 || rawEnc.alg !== 'aes-256-gcm' || !ivOk || !tagOk) return { ok: false, code: 'BAD_ENCRYPTION' };
+      enc = { v: 1, alg: 'aes-256-gcm', iv: rawEnc.iv, tag: rawEnc.tag };
+    }
+
     // v1.2.5 idempotency: replay the first message instead of storing the text twice.
     const idempotencyKey = typeof input?.idempotency_key === 'string' && input.idempotency_key.trim() !== ''
       ? input.idempotency_key.trim().slice(0, 64)
@@ -161,6 +175,9 @@ export function createFleetMessages(options = {}) {
       text,
       // Omitted when empty so a message without mentions keeps the pre-1.2.5 shape.
       ...(mentions.length === 0 ? {} : { mentions }),
+      // v1.2.6: ciphertext metadata travels beside the text so an old client can read it as opaque text and a new one can name
+      // the cipher it does not have a key for.
+      ...(enc === null ? {} : { enc }),
       ...(idempotencyKey === null ? {} : { idempotency_key: idempotencyKey }),
       at_ms: now(),
       bytes,

package/src/relay/report.mjs

@@ -148,6 +148,8 @@ export function aggregate(task, resultRecords = [], opts = {}) {
       observing: lease.state === 'observing',
       result: rec,
       envelope: rec?.envelope ?? null,
+      // v1.2.6: the relay's own signature verdict (bound to the key registered at pairing), not a client claim.
+      signature_status: rec?.validation?.signature_status ?? null,
       outcome: null,
       reasons: [],
     });
@@ -166,6 +168,7 @@ export function aggregate(task, resultRecords = [], opts = {}) {
       gate_refused: false,
       result: rec,
       envelope: rec.envelope,
+      signature_status: rec?.validation?.signature_status ?? null,
       outcome: null,
       reasons: [],
     });
@@ -487,6 +490,8 @@ export function aggregate(task, resultRecords = [], opts = {}) {
       transport: m.envelope?.transport ?? null,
       p2p: m.envelope?.p2p ?? null,
       reasons: m.reasons,
+      // v1.2.6: the relay's verdict, bound to the key registered at pairing.
+      signature_status: m.signature_status ?? null,
     })),
     steps,
     differences: step3.differences ?? [],

package/src/relay/server.mjs

@@ -23,6 +23,7 @@ import {
   rfc3339,
 } from './state.mjs';
 import { createFleetMessages } from './fleet-messages.mjs';
+import { can as mayAct } from '../util/policy-matrix.mjs';
 import { createFleetMemory } from './fleet-memory.mjs';
 import { createJoinChallenges } from './join-challenge.mjs';
 import { createAdmission } from './admission.mjs';
@@ -1114,6 +1115,25 @@ export class RelayServer {
     this.fleetMemory ??= createFleetMemory({ now: () => this.state.nowMs() });
 
     if (method === 'POST' && path === '/v1/fleet/messages') {
+      /**
+       * v1.2.6: posting to the group is a dispatch-class action. An observer may read the flow and may not speak into it, and
+       * the refusal names the action and both roles so it is actionable.
+       */
+      const permitted = mayAct({ role: this.state.roleOf(device.machine_id), action: 'dispatch' });
+      if (permitted.ok !== true) {
+        return sendJson(res, 403, {
+          protocol_version: PROTOCOL_VERSION,
+          ok: false,
+          error: { code: permitted.code, message: 'role may not post to the fleet group' },
+          detail: {
+            action: permitted.action,
+            required_level: permitted.required_level,
+            current_level: permitted.current_level,
+            required_role: permitted.required_role,
+            current_role: permitted.current_role,
+          },
+        });
+      }
       const body = takeJson();
       const posted = this.fleetMessages.post({
         session_id: body.session_id,
@@ -1124,6 +1144,7 @@ export class RelayServer {
         reply_to: body.reply_to,
         text: body.text,
         mentions: body.mentions,
+        enc: body.enc,
         idempotency_key: body.idempotency_key,
       });
       if (posted.ok !== true) {

package/src/relay/state.mjs

@@ -11,7 +11,7 @@
  * there is intentionally no snapshot/serialization hook yet.
  */
 
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash, randomBytes , verify as verifyBytes } from 'node:crypto';
 
 // v0.7.7: fleet scoping. Imported rather than inlined so the rule has one home with its own
 // exhaustive tests — three lines inside this object would be untestable without a live relay.
@@ -23,7 +23,8 @@ import { scopeFleetId } from '../chatops/fleet-wiring.mjs';
 // v0.8.1: the account-derived fleet key, so a machine can join with no pairing code.
 import { planJoin } from '../chatops/fleet-join.mjs';
 import { validateTaskDependencies } from './task-deps.mjs';
-import { buildMembers, setMemberRole as applyMemberRole } from './fleet-members.mjs';
+import { buildMembers, isMemberRole, setMemberRole as applyMemberRole } from './fleet-members.mjs';
+import { canonicalSignedPayload, publicKeyFromBase64 } from '../util/envelope-signature.mjs';
 
 export const PROTOCOL_VERSION = 1;
 
@@ -750,6 +751,16 @@ export class RabbitState {
         this.tasks.set(task.task_id, task);
         return true;
       }
+      case 'member.role': {
+        /**
+         * v1.2.6: a role survives a restart. The ledger entry already existed (setMemberRole writes it); replaying it here is
+         * what stops "the relay restarted" from silently demoting every owner to the default worker.
+         */
+        if (typeof entry.machine_id !== 'string' || entry.machine_id === '') return false;
+        if (isMemberRole(entry.role) !== true) return false;
+        this.roles.set(entry.machine_id, entry.role);
+        return false;
+      }
       case 'lease.changed': {
         const task = this.tasks.get(entry.task_id);
         const lease = task?.leases.get(entry.machine_id);
@@ -2214,6 +2225,11 @@ export class RabbitState {
     };
   }
 
+  /** v1.2.6: the role this machine holds, for the permission matrix. Unknown means worker, never owner. */
+  roleOf(machineId) {
+    return typeof machineId === 'string' ? (this.roles.get(machineId) ?? null) : null;
+  }
+
   /** v1.2.5: the fleet's members, with the role each holds and when it joined. */
   listMembers() {
     return buildMembers({ devices: this.devices, roles: this.roles });
@@ -2631,6 +2647,42 @@ export class RabbitState {
       return { deduped: true, task_id: taskId, dedupe_key: dedupeKey, seq: prior.seq };
     }
 
+    /**
+     * v1.2.6: verify the envelope signature against the key this machine registered WHEN IT PAIRED.
+     *
+     * This is the difference between "the result matches the key it carries" and "the key belongs to this machine". The relay is
+     * the place that can answer the second question, because pairing is the moment the operator (or the account) let the machine
+     * in, and that is the only moment its signing key has a reason to be believed. A signature whose key differs from the
+     * registered one is bad_signature even when it verifies against itself.
+     */
+    let signatureStatus = 'unsigned';
+    const signature = envelope.signature ?? null;
+    if (signature !== null) {
+      signatureStatus = 'bad_signature';
+      if (signature.alg !== 'ed25519') {
+        signatureStatus = 'unsupported_algorithm';
+      } else {
+        const registeredKey = machineId === null ? null : (typeof this.devices.get(machineId)?.public_key === 'string' ? this.devices.get(machineId).public_key : null);
+        if (registeredKey === null) {
+          signatureStatus = 'unbound';
+        } else if (signature.public_key !== registeredKey) {
+          signatureStatus = 'bad_signature';
+        } else {
+          const key = publicKeyFromBase64(registeredKey);
+          const payload = canonicalSignedPayload({
+            task_id: envelope.task_id,
+            argv_hash: envelope.command_hash,
+            machine_id: envelope.machine_id,
+            ts: signature.ts,
+          });
+          try {
+            signatureStatus = key !== null && verifyBytes(null, Buffer.from(payload, 'utf8'), key, Buffer.from(String(signature.value ?? ''), 'base64'))
+              ? 'signed' : 'bad_signature';
+          } catch { signatureStatus = 'bad_signature'; }
+        }
+      }
+    }
+
     const now = this.nowMs();
     let envelopeShaOk = null;
     if (typeof envelope.envelope_sha256 === 'string') {
@@ -2649,6 +2701,7 @@ export class RabbitState {
         missing: [...new Set(missing)],
         problems,
         envelope_sha256_ok: envelopeShaOk,
+        signature_status: signatureStatus,
       },
     };
 

package/src/util/chat-crypto.mjs

@@ -0,0 +1,98 @@
+/**
+ * The fleet chat's end-to-end encryption.
+ *
+ * ## Why the relay never sees the key
+ *
+ * The group key is HKDF over the fleet key, and the fleet key is derived from the account identity on each machine -- it never
+ * travels to the relay. So the relay stores ciphertext it cannot open, and the honest consequence is written down rather than
+ * discovered later: the relay cannot search message content, and the quota it enforces is measured on ciphertext length.
+ *
+ * ## Why the metadata is next to the ciphertext, not inside it
+ *
+ * `{v, alg, iv, tag}` has to be readable by every client of every version, including one that cannot decrypt. Keeping it in a
+ * plain field means a reader can say "encrypted with aes-256-gcm, version 1" even when it has no key, instead of guessing from
+ * random-looking text.
+ *
+ * ## Backward compatibility, both directions
+ *
+ * A message with no `enc` field is plaintext and stays readable. A reader with no key keeps the ciphertext and marks it
+ * `encrypted: true` rather than throwing: an unreadable message must not break a whole page.
+ */
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from 'node:crypto';
+
+export const CHAT_CIPHER = Object.freeze({ version: 1, alg: 'aes-256-gcm' });
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+
+/**
+ * Turn the fleet key into the chat group key. Deterministic: every machine in the fleet derives the same key from the same
+ * fleet key, which is what makes a message encrypted on one machine readable on another.
+ *
+ * @param {string} fleetKey base64 (the usual shape) or a passphrase
+ * @returns {Buffer|null}
+ */
+export function deriveChatKey(fleetKey) {
+  if (typeof fleetKey !== 'string' || fleetKey.trim() === '') return null;
+  try {
+    let material = null;
+    try {
+      const decoded = Buffer.from(fleetKey.trim(), 'base64');
+      material = decoded.length >= 16 ? decoded : Buffer.from(fleetKey.trim(), 'utf8');
+    } catch {
+      material = Buffer.from(fleetKey.trim(), 'utf8');
+    }
+    return Buffer.from(hkdfSync('sha256', material, Buffer.from('w2m-fleet-chat-salt'), Buffer.from('fleet-chat-v1'), KEY_BYTES));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Buffer|null} key
+ * @param {string} text
+ * @returns {{ok: true, text: string, enc: {v: number, alg: string, iv: string, tag: string}} | {ok: false, code: string}}
+ */
+export function encryptChatText(key, text) {
+  if (key === null || !Buffer.isBuffer(key) || key.length !== KEY_BYTES) return { ok: false, code: 'CHAT_NO_KEY' };
+  if (typeof text !== 'string' || text === '') return { ok: false, code: 'CHAT_EMPTY_TEXT' };
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  const ciphertext = Buffer.concat([cipher.update(Buffer.from(text, 'utf8')), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    ok: true,
+    text: ciphertext.toString('base64'),
+    enc: { v: CHAT_CIPHER.version, alg: CHAT_CIPHER.alg, iv: iv.toString('base64'), tag: tag.toString('base64') },
+  };
+}
+
+/**
+ * @param {Buffer|null} key
+ * @param {{text?: string, enc?: object|null}} message
+ * @returns {{ok: true, text: string} | {ok: false, code: string}}
+ */
+export function decryptChatMessage(key, message = {}) {
+  const enc = message?.enc ?? null;
+  if (enc === null || enc === undefined) {
+    // Plaintext: the pre-encryption shape, still readable by everyone.
+    return typeof message?.text === 'string' ? { ok: true, text: message.text } : { ok: false, code: 'CHAT_TEXT_MISSING' };
+  }
+  if (key === null || !Buffer.isBuffer(key) || key.length !== KEY_BYTES) return { ok: false, code: 'CHAT_NO_KEY' };
+  if (enc.alg !== CHAT_CIPHER.alg || enc.v !== CHAT_CIPHER.version) return { ok: false, code: 'CHAT_UNSUPPORTED_CIPHER' };
+  try {
+    const iv = Buffer.from(String(enc.iv ?? ''), 'base64');
+    const tag = Buffer.from(String(enc.tag ?? ''), 'base64');
+    if (iv.length !== IV_BYTES || tag.length !== 16) return { ok: false, code: 'CHAT_BAD_ENCRYPTION' };
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const plain = Buffer.concat([decipher.update(Buffer.from(String(message.text ?? ''), 'base64')), decipher.final()]);
+    return { ok: true, text: plain.toString('utf8') };
+  } catch {
+    return { ok: false, code: 'CHAT_DECRYPT_FAILED' };
+  }
+}
+
+/** True when a message carries the encryption metadata, whatever its text looks like. */
+export function isEncrypted(message) {
+  return message?.enc !== null && message?.enc !== undefined && typeof message.enc === 'object';
+}