@vantran-se/openchamber-web 2.1.1 → 2.2.0

package/server/lib/relay/DOCUMENTATION.md

@@ -21,8 +21,9 @@ Traffic is modeled as three stacked layers. The relay understands only Layer 1;
 Host side (`packages/web/server/lib/relay/`):
 - `service.js` — thin entrypoint: relay config (enabled flag + relay URL), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. Started from `packages/web/server/index.js` only when the user has explicitly enabled the relay. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay (`pinnedRelayUrl`: `relayUrl` in the machine policy file, else the `OPENCHAMBER_RELAY_URL` env var; see `../enterprise-mode.js`; must be `ws://`/`wss://`, an invalid value pins nothing); when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. In enterprise mode (`../enterprise-mode.js`) the relay runs only with that pin (`relayBlockedByEnterprise`): `start()` refuses otherwise (every path in passes through it), `enable` answers 403, `getPairingCandidate()` is null, `ensureEnabledForPairing()` throws (the pairing route drops the candidate and direct pairing still works), status carries `blockedByEnterprise`, and `resolvePairingTransports` in `index.js` reports `relayAvailable: false`.
 - `identity.js` — the host's stable identity: the long-lived signing keypair (shared with the push relay, defines the routing id) plus a long-lived encryption keypair (the E2EE trust anchor). Reused across restarts; never rotated implicitly.
-- `signing-key.js` — storage/derivation of the signing keypair and the routing id, shared with the notifications runtime.
-- `host-client.js` — the long-lived connection manager: one outbound control connection to the relay, a per-client data connection for each connected device, reconnect/backoff, and the E2EE responder handshake per connection.
+- `signing-key.js` — the signing keypair and the routing id derivation, shared with the notifications runtime.
+- `key-store.js` — where both keypairs live: `<data-dir>/relay-identity.json` (`0600`), never `settings.json`, so the private keys do not travel with every copy of the settings file. Installs that kept them in `settings.json` (`relaySigningKey` / `relayEncryptionKey`) have them moved on first load, unchanged so `serverId` and the trust anchor survive, then stripped from settings; an older build sharing the data dir then mints its own identity. A key is minted only when neither file holds it, and both are read strictly so a corrupt or unreadable file fails instead of reading as first run. `index.js` builds one store for the push relay and the private relay, so their concurrent first loads mint one key.
+- `host-client.js` — the long-lived connection manager: one outbound control connection to the relay, a per-client data connection for each connected device, reconnect/backoff, and the E2EE responder handshake per connection. A data connection dial that never opens (refused, or no answer within 5 s, doubling to 15 s per failure) is retried after 1 s, doubling to 8 s, for as long as the relay still reports that client and the control connection is up. The relay sends no second `connected` for a waiting client, so without the retry the device waits for the relay's 15 s stuck-control reset or its own 30 s handshake timeout. A data connection that opened and then closed is not retried: the relay closes the client with it, and the client's reconnect arrives as a new `connected`.
 - `host-lock.js` — the per-machine host claim. Every local instance sharing the data dir shares the relay identity (same serverId), so concurrent relay hosts evict each other at the relay worker (`4001: Control replaced`) and paired devices land on whichever local process won last. The claim file (`<data-dir>/relay-host.lock`, `{ pid }`) makes this deterministic: `service.js` only starts the host when no LIVE process holds the claim (stale claims from dead pids are ignored), goes to `standby` otherwise, and a 30s watcher both takes over when the claimant dies and stands down when another process claims. A standby watcher waits a 2-minute grace after the claim frees before taking over, so a cleanly restarting host (app update/relaunch) — which reclaims at boot with no wait — always wins the restart window over a bystander instance. Explicit user intent — creating a pairing link or hitting `/relay/enable` — force-claims; the previous holder's watcher sees the takeover and backs off instead of fighting. Instances created with `allowPassiveHost: false` (dev servers via `OPENCHAMBER_RELAY_HOST=off`, the Electron dev shell via `OPENCHAMBER_ELECTRON_DEV`; `OPENCHAMBER_RELAY_HOST=on` overrides) never start the host passively at all — boot, demand reconcile, and watcher takeover leave them in `standby`; only explicit enable/pairing hosts there. The claim is cooperative (the relay worker still enforces the single host slot); it only decides which process keeps retrying.
 - `tunnel-host.js` — the per-connection dispatcher: decrypts tunnel frames and forwards HTTP/SSE/WS to the local server over loopback, then streams responses back. Enforces a path allowlist and never injects credentials.
 - `downstream-scheduler.js` owns end-client delivery credit and round-robin transmission across response streams. It selects plaintext frames before encryption.
@@ -164,7 +165,20 @@ occur transiently in the field (a same-identity dial taking the leg, relay state
 left by a host restart), so the client keeps its wake listeners armed and the
 next `online` event or return to the foreground clears the error and makes one
 fresh attempt. There is still no background loop. Transient failures use the
-existing reconnect/backoff path.
+existing reconnect/backoff path. The client status marks such a parked error
+with `terminal: true`, so callers can tell it apart from a pending reconnect.
+
+Mobile connect flows (`packages/ui/src/apps/mobileConnections.ts`, helpers in
+`mobileRelayFetch.ts`) log the relay failure reason (close message or
+`timeout`) in the connect trail. Idempotent probes (`/health`,
+`/auth/session`) wait for the tunnel's own reconnect after a dropped socket and
+ask again within their budget; pairing redeem and password login are sent once.
+Pairing, logging in again, and the session probes of auto-connect and connect
+ride the connected runtime tunnel when the phone is already on that server
+through the relay, and do not open a second tunnel to the same server: the
+relay keeps one client leg per device and server, so a second dial drops the
+live session. A probe dials its own tunnel only when the live one gives no
+answer.
 
 Relay mode plugs into the existing client transport layer rather than a parallel path: `runtime-switch` activates the tunnel singleton, `runtime-fetch` routes runtime requests through it, `runtime-url`/`runtime-socket` yield tunnel-backed URLs and sockets, and `runtime-auth` mints the URL-scoped token through the tunnel. Direct-URL connections and the Electron realtime-proxy path are unaffected.
 
@@ -172,6 +186,7 @@ Relay mode plugs into the existing client transport layer rather than a parallel
 
 - The relay never sees plaintext application traffic; it sees only routing metadata (routing id, connection identifiers, timestamps, coarse counts).
 - Pairing secrets travel in URL fragments only, never in query strings, never logged.
+- Host dial URLs carry the signed relay auth in their query string, and Bun's WebSocket copies the whole URL into its error messages. Relay errors reach logs and the relay status only through `describeRelayError` in `host-client.js`, which strips query strings and userinfo from every URL in the text.
 - The host dispatcher never injects credentials; the server authenticates each tunneled request.
 - The tunnel is transparent to the app: adding relay support to a feature should not require the feature to know the relay exists — it goes through the shared runtime transport helpers.
 - The two implementations stay byte-compatible and the wire format is versioned/negotiated so mixed client/host app versions degrade gracefully rather than break.

package/server/lib/relay/e2ee.js

@@ -9,12 +9,12 @@
 const subtle = globalThis.crypto.subtle;
 
 export const RELAY_PROTOCOL_VERSION = 1;
-export const RELAY_HKDF_INFO = 'openchamber-relay-v1';
+const RELAY_HKDF_INFO = 'openchamber-relay-v1';
 
 // Encrypted frame layout: [1 byte version][12 byte IV][ciphertext + 16 byte GCM tag].
-export const ENCRYPTED_FRAME_VERSION = 1;
-export const ENCRYPTED_FRAME_IV_BYTES = 12;
-export const ENCRYPTED_FRAME_HEADER_BYTES = 1 + ENCRYPTED_FRAME_IV_BYTES;
+const ENCRYPTED_FRAME_VERSION = 1;
+const ENCRYPTED_FRAME_IV_BYTES = 12;
+const ENCRYPTED_FRAME_HEADER_BYTES = 1 + ENCRYPTED_FRAME_IV_BYTES;
 export const MAX_PLAINTEXT_FRAME_BYTES = 64 * 1024;
 
 // Relay-assigned WebSocket close codes (subset the host needs).
@@ -31,7 +31,7 @@ const GCM_TAG_BYTES = 16;
 const IV_PREFIX_BYTES = 4;
 const IV_COUNTER_BYTES = 8;
 
-export class RelayCryptoError extends Error {
+class RelayCryptoError extends Error {
   constructor(message) {
     super(message);
     this.name = 'RelayCryptoError';
@@ -51,7 +51,7 @@ export const exportPublicKeyJwk = async (key) => {
 };
 
 /** @param {JsonWebKey} jwk */
-export const importEcdhPublicKey = async (jwk) => {
+const importEcdhPublicKey = async (jwk) => {
   if (jwk.kty !== 'EC' || jwk.crv !== 'P-256' || typeof jwk.x !== 'string' || typeof jwk.y !== 'string') {
     throw new RelayCryptoError('invalid ECDH public key JWK');
   }
@@ -79,7 +79,7 @@ export const importEcdhPrivateKey = async (jwk) => {
 
 // Stable fingerprint of a public key, used to detect rekey attempts on re-hello.
 /** @param {JsonWebKey} jwk */
-export const publicKeyJwkFingerprint = (jwk) =>
+const publicKeyJwkFingerprint = (jwk) =>
   JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
 
 export const generateHandshakeNonce = () => {

package/server/lib/relay/host-client.js

@@ -10,10 +10,20 @@ import { RELAY_PROTOCOL_VERSION, RelayCloseCode, createHostHandshake } from './e
 import { createOutboundFrameBatcher, decodeFrameBatch, decodeTunnelFrame, decodeDeliveryAck, encodeFrameBatch, TunnelFrameType } from './tunnel-codec.js';
 import { createTunnelHost } from './tunnel-host.js';
 import { createDownstreamScheduler, DOWNSTREAM_CHUNK_BYTES } from './downstream-scheduler.js';
+import { redactSensitiveText } from '../source-control/url-redaction.js';
 
 const BACKOFF_BASE_MS = 1000;
 const BACKOFF_CAP_MS = 30000;
+// A data socket dial that never opens is retried while the relay still reports
+// its client: the relay holds the client and buffers its frames, and sends no
+// new `connected` for it. Without a retry the client waits for the relay's 15 s
+// stuck-control reset, or for its own 30 s handshake timeout when that fails too.
+// The open timeout starts short so a hung dial leaves room for retries inside
+// that 30 s, and doubles per failed dial so a slow network still gets 15 s.
+const DATA_SOCKET_FIRST_OPEN_TIMEOUT_MS = 5000;
 const DATA_SOCKET_OPEN_TIMEOUT_MS = 15000;
+const DATA_SOCKET_REDIAL_BASE_MS = 1000;
+const DATA_SOCKET_REDIAL_CAP_MS = 8000;
 // Clients send a tunnel Ping at least every ~30s when idle, so a data socket
 // with no inbound traffic for 3 ping intervals belongs to a client that died
 // without a WebSocket close (network loss, battery kill). The relay worker may
@@ -40,6 +50,11 @@ const resolveBatchWindowMs = (option) => {
   return DEFAULT_BATCH_WINDOW_MS;
 };
 
+// Bun's WebSocket puts the full dial URL into its error messages, and that URL
+// carries the signed relay auth in its query string. Every relay error passes
+// through here before it reaches a log line or the relay status.
+export const describeRelayError = (error) => redactSensitiveText(error?.message ?? error);
+
 /**
  * @param {{
  *   relayUrl: string,
@@ -48,9 +63,10 @@ const resolveBatchWindowMs = (option) => {
  *   getLocalPort?: () => number,
  *   onStatus?: (status: { state: string, lastError: string | null, connectedClients: number }) => void,
  *   logger?: Pick<Console, 'warn'>,
+ *   createSocket?: (url: string) => WebSocket,
  * }} options
  */
-export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, onStatus, logger = console, batchWindowMs, batch, flowControl }) => {
+export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, onStatus, logger = console, createSocket = (url) => new WebSocket(url), batchWindowMs, batch, flowControl }) => {
   const { version } = createRequire(import.meta.url)('../../../package.json');
   const platform = process.env.OPENCHAMBER_RUNTIME || 'web';
   const resolveLocalPort = typeof getLocalPort === 'function' ? getLocalPort : () => localPort;
@@ -65,6 +81,9 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
   let consecutiveFailures = 0;
   /** @type {Map<string, { socket: WebSocket, tunnel: ReturnType<typeof createTunnelHost> | null, openTimer: NodeJS.Timeout | null }>} */
   const dataSockets = new Map();
+  // Clients the relay reported (`connected`/`sync`) and has not reported gone.
+  /** @type {Map<string, { failedDials: number, redialTimer: NodeJS.Timeout | null }>} */
+  const announcedClients = new Map();
 
   const emitStatus = () => {
     try {
@@ -97,10 +116,43 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
     return url.toString();
   };
 
+  const announceClient = (connectionId) => {
+    if (!announcedClients.has(connectionId)) announcedClients.set(connectionId, { failedDials: 0, redialTimer: null });
+  };
+
+  const forgetClient = (connectionId) => {
+    const client = announcedClients.get(connectionId);
+    if (client?.redialTimer) clearTimeout(client.redialTimer);
+    announcedClients.delete(connectionId);
+  };
+
+  const cancelRedials = () => {
+    for (const client of announcedClients.values()) {
+      if (client.redialTimer) clearTimeout(client.redialTimer);
+      client.redialTimer = null;
+    }
+  };
+
+  // Only a dial that never opened is retried. Once the relay attached a data
+  // socket, its close makes the relay close the client too, and the client's
+  // reconnect arrives as a new `connected`. With the control socket down the
+  // next `sync` decides which clients still wait.
+  const scheduleRedial = (connectionId) => {
+    const client = announcedClients.get(connectionId);
+    if (stopped || !client || client.redialTimer || controlSocket?.readyState !== WebSocket.OPEN) return;
+    const delay = Math.min(DATA_SOCKET_REDIAL_BASE_MS * 2 ** client.failedDials, DATA_SOCKET_REDIAL_CAP_MS);
+    client.failedDials += 1;
+    client.redialTimer = setTimeout(() => {
+      client.redialTimer = null;
+      openDataSocket(connectionId);
+    }, delay);
+  };
+
   const teardownDataSocket = (connectionId, closeCode, reason) => {
     const entry = dataSockets.get(connectionId);
     if (!entry) return;
     dataSockets.delete(connectionId);
+    if (!entry.opened) scheduleRedial(connectionId);
     if (entry.openTimer) clearTimeout(entry.openTimer);
     entry.batcher?.dispose();
     entry.scheduler?.close();
@@ -118,21 +170,28 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
 
   const openDataSocket = (connectionId) => {
     if (stopped || dataSockets.has(connectionId)) return;
+    const client = announcedClients.get(connectionId);
+    if (client?.redialTimer) {
+      clearTimeout(client.redialTimer);
+      client.redialTimer = null;
+    }
 
     let socket;
     try {
-      socket = new WebSocket(buildSocketUrl('host-data', connectionId));
+      socket = createSocket(buildSocketUrl('host-data', connectionId));
     } catch (error) {
-      logger.warn(`[Relay] host-data dial failed: ${error?.message ?? error}`);
+      logger.warn(`[Relay] host-data dial failed: ${describeRelayError(error)}`);
+      scheduleRedial(connectionId);
       return;
     }
 
-    const entry = { socket, tunnel: null, openTimer: null, batcher: null, scheduler: null, lastActivityAt: Date.now() };
+    const entry = { socket, opened: false, tunnel: null, openTimer: null, batcher: null, scheduler: null, lastActivityAt: Date.now() };
     dataSockets.set(connectionId, entry);
+    const openTimeoutMs = Math.min(DATA_SOCKET_FIRST_OPEN_TIMEOUT_MS * 2 ** (client?.failedDials ?? 0), DATA_SOCKET_OPEN_TIMEOUT_MS);
     entry.openTimer = setTimeout(() => {
       logger.warn('[Relay] host-data socket open timeout');
       teardownDataSocket(connectionId);
-    }, DATA_SOCKET_OPEN_TIMEOUT_MS);
+    }, openTimeoutMs);
 
     const handshake = createHostHandshake(identity.hostEncPrivateKey, { batch: localBatch, flowControl });
     let channel = null;
@@ -153,7 +212,7 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
           socket.send(encrypted, { binary: true });
         })
         .catch((error) => {
-          logger.warn(`[Relay] host-data send failed: ${error?.message ?? error}`);
+          logger.warn(`[Relay] host-data send failed: ${describeRelayError(error)}`);
           failChannel(RelayCloseCode.ChannelFailure, 'send failed');
         });
       return sendChain;
@@ -231,7 +290,7 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
           await dispatchFrame(plaintext);
         }
       } catch (error) {
-        logger.warn(`[Relay] tunnel frame handling failed: ${error?.message ?? error}`);
+        logger.warn(`[Relay] tunnel frame handling failed: ${describeRelayError(error)}`);
         failChannel(RelayCloseCode.ChannelFailure, 'invalid tunnel frame');
       }
     };
@@ -256,21 +315,25 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
         clearTimeout(entry.openTimer);
         entry.openTimer = null;
       }
+      entry.opened = true;
+      const current = announcedClients.get(connectionId);
+      if (current) current.failedDials = 0;
       emitStatus();
     });
     socket.on('message', (data, isBinary) => {
       processing = processing
         .then(() => handleMessage(data, isBinary))
         .catch((error) => {
-          logger.warn(`[Relay] data socket message failed: ${error?.message ?? error}`);
+          logger.warn(`[Relay] data socket message failed: ${describeRelayError(error)}`);
           failChannel(RelayCloseCode.ChannelFailure, 'internal error');
         });
     });
     socket.on('close', () => {
-      teardownDataSocket(connectionId);
+      // A retry may already own this connectionId.
+      if (dataSockets.get(connectionId) === entry) teardownDataSocket(connectionId);
     });
     socket.on('error', (error) => {
-      logger.warn(`[Relay] host-data socket error: ${error?.message ?? error}`);
+      logger.warn(`[Relay] host-data socket error: ${describeRelayError(error)}`);
     });
   };
 
@@ -284,19 +347,25 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
     if (!message || typeof message !== 'object') return;
     if (message.type === 'sync' && Array.isArray(message.connectionIds)) {
       const wanted = new Set(message.connectionIds.filter((id) => typeof id === 'string' && id.length > 0));
+      for (const connectionId of [...announcedClients.keys()]) {
+        if (!wanted.has(connectionId)) forgetClient(connectionId);
+      }
       for (const connectionId of [...dataSockets.keys()]) {
         if (!wanted.has(connectionId)) teardownDataSocket(connectionId);
       }
       for (const connectionId of wanted) {
+        announceClient(connectionId);
         openDataSocket(connectionId);
       }
       return;
     }
     if (message.type === 'connected' && typeof message.connectionId === 'string') {
+      announceClient(message.connectionId);
       openDataSocket(message.connectionId);
       return;
     }
     if (message.type === 'disconnected' && typeof message.connectionId === 'string') {
+      forgetClient(message.connectionId);
       teardownDataSocket(message.connectionId);
     }
   };
@@ -318,9 +387,9 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
 
     let socket;
     try {
-      socket = new WebSocket(buildSocketUrl('host-control'));
+      socket = createSocket(buildSocketUrl('host-control'));
     } catch (error) {
-      lastError = error?.message ?? String(error);
+      lastError = describeRelayError(error);
       scheduleReconnect();
       return;
     }
@@ -365,7 +434,7 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
     });
     socket.on('error', (error) => {
       if (controlSocket !== socket) return;
-      lastError = error?.message ?? String(error);
+      lastError = describeRelayError(error);
     });
     socket.on('close', (code, reasonBuffer) => {
       clearInterval(pingTimer);
@@ -377,6 +446,7 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
       }
       // Data sockets ride their own relay connections; the relay keeps clients
       // alive through a 30 s control-reconnect grace window, so leave them up.
+      cancelRedials();
       scheduleReconnect();
     });
   };
@@ -397,6 +467,7 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, on
     if (stopped) return;
     stopped = true;
     clearInterval(idleSweepTimer);
+    cancelRedials();
     if (reconnectTimer) {
       clearTimeout(reconnectTimer);
       reconnectTimer = null;

package/server/lib/relay/host-client.test.js

@@ -2,9 +2,10 @@
 // client using the JS e2ee initiator. Verifies the full handshake and a tunneled
 // HTTP GET /health, and asserts only binary frames cross the relay post-handshake.
 
-import { afterAll, beforeAll, describe, expect, it } from 'bun:test';
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'bun:test';
 import http from 'node:http';
 import crypto from 'node:crypto';
+import { EventEmitter } from 'node:events';
 import { WebSocket, WebSocketServer } from 'ws';
 
 import { startRelayHost } from './host-client.js';
@@ -315,3 +316,202 @@ describe('relay host-client integration', () => {
     expect(forwarded.filter((f) => f.isBinary).length).toBeGreaterThan(0);
   });
 });
+
+// Control-only relay whose host-data upgrades the test scripts: each dial is
+// answered by the next entry of `outcomes` ('reject' -> 503, 'hang' -> no
+// answer, 'accept' -> 101),
+// accepting once the list runs out.
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+const startScriptedRelay = (outcomes) => {
+  const server = http.createServer();
+  const wss = new WebSocketServer({ noServer: true });
+  const state = { control: null, dials: [], dataSockets: [] };
+  // Upgraded sockets leave the server's connection tracking, so a hung one
+  // would hold server.close() open: destroy them on stop.
+  const hungSockets = [];
+  let notifyDial = () => {};
+  server.on('upgrade', (req, socket, head) => {
+    const url = new URL(req.url, 'http://localhost');
+    const role = url.searchParams.get('role');
+    if (role === 'host-data') {
+      state.dials.push(url.searchParams.get('connectionId'));
+      notifyDial();
+      const outcome = outcomes.shift() ?? 'accept';
+      if (outcome === 'reject') {
+        socket.end('HTTP/1.1 503 Service Unavailable\r\nContent-Length: 0\r\n\r\n');
+        return;
+      }
+      if (outcome === 'hang') {
+        socket.on('error', () => {});
+        hungSockets.push(socket);
+        return;
+      }
+    }
+    wss.handleUpgrade(req, socket, head, (ws) => {
+      if (role === 'host-control') state.control = ws;
+      else state.dataSockets.push(ws);
+    });
+  });
+  const waitForDials = (count, timeoutMs) => new Promise((resolve) => {
+    const check = () => {
+      if (state.dials.length >= count) resolve(true);
+    };
+    notifyDial = check;
+    check();
+    setTimeout(() => resolve(state.dials.length >= count), timeoutMs);
+  });
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      resolve({
+        wsUrl: `ws://127.0.0.1:${server.address().port}/`,
+        state,
+        waitForDials,
+        send: (message) => state.control.send(JSON.stringify(message)),
+        stop: () => new Promise((r) => {
+          for (const client of wss.clients) client.terminate();
+          for (const socket of hungSockets) socket.destroy();
+          server.closeAllConnections();
+          wss.close();
+          server.close(() => r());
+        }),
+      });
+    });
+  });
+};
+
+describe('relay host-client data socket retry', () => {
+  let relay;
+  let host;
+
+  afterEach(async () => {
+    host?.stop();
+    host = null;
+    await relay?.stop();
+    relay = null;
+  });
+
+  const startHost = async (outcomes) => {
+    relay = await startScriptedRelay(outcomes);
+    const identity = await buildIdentity();
+    let markConnected;
+    const connected = new Promise((resolve) => { markConnected = resolve; });
+    host = startRelayHost({
+      relayUrl: relay.wsUrl,
+      identity,
+      getLocalPort: () => 1,
+      onStatus: (status) => {
+        if (status.state === 'connected') markConnected();
+      },
+      logger: { warn: () => {}, info: () => {} },
+    });
+    await connected;
+  };
+
+  it('dials a waiting client again after a dial the relay refused', async () => {
+    await startHost(['reject', 'reject']);
+    relay.send({ type: 'connected', connectionId: 'conn-retry' });
+
+    // No second `connected` arrives: the host retries on its own.
+    expect(await relay.waitForDials(3, 6000)).toBe(true);
+    expect(relay.state.dials).toEqual(['conn-retry', 'conn-retry', 'conn-retry']);
+    await sleep(100);
+    expect(host.getStatus().connectedClients).toBe(1);
+  }, 10000);
+
+  it('gives up on a hung dial well inside the client handshake timeout and dials again', async () => {
+    await startHost(['hang']);
+    relay.send({ type: 'connected', connectionId: 'conn-hung' });
+
+    expect(await relay.waitForDials(2, 9000)).toBe(true);
+    await sleep(100);
+    expect(host.getStatus().connectedClients).toBe(1);
+  }, 12000);
+
+  it('stops retrying once the relay reports the client gone', async () => {
+    await startHost(['reject', 'reject', 'reject']);
+    relay.send({ type: 'connected', connectionId: 'conn-gone' });
+    expect(await relay.waitForDials(1, 2000)).toBe(true);
+    relay.send({ type: 'disconnected', connectionId: 'conn-gone' });
+
+    expect(await relay.waitForDials(2, 2500)).toBe(false);
+    expect(relay.state.dials).toEqual(['conn-gone']);
+  }, 10000);
+
+  it('leaves a data socket that opened and then closed to the client reconnect', async () => {
+    await startHost([]);
+    relay.send({ type: 'connected', connectionId: 'conn-opened' });
+    expect(await relay.waitForDials(1, 2000)).toBe(true);
+    await sleep(100);
+    relay.state.dataSockets[0].close(1012, 'gone');
+
+    expect(await relay.waitForDials(2, 2500)).toBe(false);
+  }, 10000);
+});
+
+// Bun's WebSocket fails a dial with an error whose message and `url` hold the
+// whole dial URL, signed relay auth included. Node's `ws` never does, so these
+// sockets stand in for Bun.
+class BunLikeFailingSocket extends EventEmitter {
+  constructor(url) {
+    super();
+    this.url = url;
+    this.readyState = WebSocket.CONNECTING;
+  }
+
+  fail(reason) {
+    this.readyState = WebSocket.CLOSED;
+    this.emit('error', Object.assign(new Error(`WebSocket connection to '${this.url}' failed: ${reason}`), { url: this.url }));
+    this.emit('close', 1006, Buffer.alloc(0));
+  }
+
+  close() {}
+
+  terminate() {}
+
+  ping() {}
+}
+
+describe('relay host-client error redaction', () => {
+  const fakeIdentity = {
+    serverId: 'fake-server-id',
+    hostEncPrivateKey: null,
+    signRelayAuth: () => ({ ts: 1, sig: 'FAKE-SIGNATURE', pk: 'FAKE-PUBLIC-KEY' }),
+  };
+
+  it('keeps the signed relay auth out of logs and status when a dial fails', () => {
+    const sockets = [];
+    const warnings = [];
+    const host = startRelayHost({
+      relayUrl: 'wss://relay.example.test/ws',
+      identity: fakeIdentity,
+      getLocalPort: () => 1,
+      logger: { warn: (line) => warnings.push(line) },
+      createSocket: (url) => {
+        const socket = new BunLikeFailingSocket(url);
+        sockets.push(socket);
+        return socket;
+      },
+    });
+
+    try {
+      const control = sockets[0];
+      control.readyState = WebSocket.OPEN;
+      control.emit('open');
+      control.emit('message', Buffer.from(JSON.stringify({ type: 'connected', connectionId: 'conn-1' })), false);
+      expect(sockets[1].url).toContain('sig=FAKE-SIGNATURE');
+      sockets[1].fail('Expected 101 status code');
+      control.fail('Failed to connect');
+
+      const lastError = host.getStatus().lastError;
+      expect(warnings).toEqual(["[Relay] host-data socket error: WebSocket connection to 'wss://relay.example.test/ws' failed: Expected 101 status code"]);
+      expect(lastError).toBe("WebSocket connection to 'wss://relay.example.test/ws' failed: Failed to connect");
+      for (const text of [...warnings, lastError]) {
+        expect(text).not.toContain('FAKE-SIGNATURE');
+        expect(text).not.toContain('FAKE-PUBLIC-KEY');
+      }
+    } finally {
+      host.stop();
+    }
+  });
+});

package/server/lib/relay/identity.js

@@ -2,8 +2,7 @@
 // the push relay via signing-key.js — same storage, same serverId) plus a NEW
 // long-lived ECDH P-256 encryption keypair for the E2EE channel (WebCrypto
 // keys are single-purpose, so signing and encryption keys must differ).
-// The encryption keypair is persisted as `settings.relayEncryptionKey =
-// { privateJwk, publicJwk }`, mirroring the relaySigningKey precedent.
+// Both keypairs are stored by key-store.js.
 
 import {
   canonicalPublicJwkString,
@@ -13,48 +12,26 @@ import {
 } from './signing-key.js';
 import { exportPublicKeyJwk, generateEcdhKeyPair, importEcdhPrivateKey } from './e2ee.js';
 
-const isJwkPair = (value) => Boolean(value && typeof value === 'object' && value.privateJwk && value.publicJwk);
-
 /**
  * @param {{
  *   crypto: typeof import('node:crypto'),
- *   readSettingsFromDiskMigrated: () => Promise<object>,
- *   writeSettingsToDisk: (settings: object) => Promise<void>,
- *   readSettingsStrict?: () => Promise<object>,
+ *   relayKeyStore: ReturnType<typeof import('./key-store.js').createRelayKeyStore>,
  * }} deps
  */
 export const createRelayIdentityRuntime = (deps) => {
-  const { crypto, readSettingsFromDiskMigrated, writeSettingsToDisk, readSettingsStrict } = deps;
+  const { crypto, relayKeyStore } = deps;
 
   let cachedIdentity = null;
 
-  const getOrCreateEncryptionKeypair = async () => {
-    const settings = await readSettingsFromDiskMigrated();
-    const existing = settings?.relayEncryptionKey;
-    if (isJwkPair(existing)) {
-      return existing;
-    }
-    // Same regeneration gate as the signing key: never mint a replacement
-    // identity key off a swallowed read failure — a new encryption key breaks
-    // the E2EE trust anchor pinned by every paired device. Verify "missing" via
-    // the strict reader (throws on corrupt/unreadable) before generating.
-    let verifiedSettings = settings;
-    if (readSettingsStrict) {
-      verifiedSettings = await readSettingsStrict();
-      const verified = verifiedSettings?.relayEncryptionKey;
-      if (isJwkPair(verified)) {
-        return verified;
-      }
-    }
+  const getOrCreateEncryptionKeypair = () => relayKeyStore.getOrCreate('encryption', async () => {
     // Loud on purpose: a new encryption key invalidates the E2EE trust anchor of
     // every paired device. Expected exactly once, on first relay use.
     console.warn('[relay-identity] Generating NEW relay encryption keypair (E2EE trust anchor changes; previously paired devices must re-pair)');
     const keyPair = await generateEcdhKeyPair();
     const privateJwk = await globalThis.crypto.subtle.exportKey('jwk', keyPair.privateKey);
     const publicJwk = await exportPublicKeyJwk(keyPair.publicKey);
-    await writeSettingsToDisk({ ...settings, ...(verifiedSettings || {}), relayEncryptionKey: { privateJwk, publicJwk } });
     return { privateJwk, publicJwk };
-  };
+  });
 
   /**
    * @returns {Promise<{
@@ -66,7 +43,7 @@ export const createRelayIdentityRuntime = (deps) => {
    */
   const getRelayIdentity = async () => {
     if (cachedIdentity) return cachedIdentity;
-    const signing = await getOrCreateRelaySigningKeypair({ crypto, readSettingsFromDiskMigrated, writeSettingsToDisk, readSettingsStrict });
+    const signing = await getOrCreateRelaySigningKeypair({ crypto, relayKeyStore });
     const serverId = deriveServerId({ crypto }, signing.publicJwk);
     const encryption = await getOrCreateEncryptionKeypair();
     const hostEncPrivateKey = await importEcdhPrivateKey(encryption.privateJwk);