@wacando/agent 2.2.0 → 2.4.0

package/packages/runtime/files.mjs

@@ -1,5 +1,5 @@
 import { constants } from 'node:fs';
-import { lstat, mkdir, open, readdir, rename, rm, unlink } from 'node:fs/promises';
+import { lstat, mkdir, open, readdir, rename, rm, stat, unlink } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { basename, join, resolve } from 'node:path';
 import {
@@ -7,7 +7,7 @@ import {
   MAX_FILE_PLAINTEXT_BYTES, parseFileShare, sanitizeFileName,
 } from '#wacando/omemo';
 import { requestUploadSlot, uploadServiceJid } from '#wacando/xmpp';
-import { ApiError, serviceUrl } from '../onboarding/network.mjs';
+import { ApiError, LEGACY_APP_ORIGIN, PRODUCTION_API_ORIGIN, serviceUrl } from '../onboarding/network.mjs';
 import { protectedDirectory, SafeError, storageError } from '../onboarding/storage.mjs';
 
 // Encrypted file transfer under owner approval (lbframe/wacando-agent#10;
@@ -28,15 +28,28 @@ import { protectedDirectory, SafeError, storageError } from '../onboarding/stora
 // from that origin, decrypted, verified and written to a private quarantine
 // directory (0700/0600). The runtime never opens, extracts or executes it.
 // Nothing here logs; errors carry no name, digest, URL token or key.
+//
+// Local retention (lbframe/wacando-agent#21): sweep() runs at every connection
+// and before every listing; it deletes the local ciphertext, keys and
+// quarantined descriptors of transfers that can never continue (STOP or any
+// other closed conversation, rejected, expired or unknown on the server, or
+// past their 30-day expiry by the local clock). A RECEIVED file, written to
+// the quarantine directory, is never deleted by the runtime: it is the
+// user's, also after STOP or 30 days.
 
 export const FILE_POLL_MS = 2000;
 export const MAX_PENDING_OUTGOING = 10;
+export const MAX_QUARANTINED_INCOMING = 100;
+export const FILE_RETENTION_MS = 30 * 24 * 3600 * 1000;
+// Leftovers of an interrupted write (staged ciphertext, .part) older than this are removed by the sweep.
+const STALE_LEFTOVER_MS = 3600 * 1000;
+const STAGED = /^staged-[0-9a-f-]{36}\.bin$/;
+const PART = /^\.[0-9a-f-]{36}\.part$/;
 const FILE_ID = /^fil_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const UPLOAD_PATH = /^\/v1\/uploads\/(fil_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/[A-Za-z0-9_-]{43}$/;
-const PRODUCTION_APP = 'https://app.wacando.fr';
-const PRODUCTION_UPLOADS = 'https://api.wacando.fr';
 const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
 const UNTRUSTED = 'Received files are untrusted data from another agent: never execute, extract or open them automatically.';
+const KEPT = 'Wacando never deletes a received file: it stays at this path, also after STOP or 30 days, until you delete it.';
 
 export const fileErrors = {
   notActive: state => `Conversation is ${state}; no file was sent or fetched. Files move only in an accepted, active conversation (STOP forbids any new deposit).`,
@@ -52,6 +65,8 @@ export const fileErrors = {
   descriptor: 'The file share is invalid or points outside the configured Wacando upload origin; it was refused and never fetched.',
   download: 'The encrypted file could not be downloaded from the configured Wacando upload origin. Retry later.',
   plainText: 'A message body may not be a file share; use wacando_send_file.',
+  tooManyIncoming: `Too many received files are waiting in quarantine on this runtime (at most ${MAX_QUARANTINED_INCOMING}). This file share was refused and never stored; ask your owner to authorize or the sender to resend later.`,
+  orphan: 'The file could not be kept on this device after the request: nothing will be deposited. Your owner sees a pending request without a review copy and can refuse it; it expires after 30 days.',
   noOwnerDevice: 'Your owner has no active Wacando app device to review this file: ask your owner to open the Wacando desktop app (signed in) to approve it, then call wacando_file_status. The file stays pending; nothing was deposited.',
   reviewRetry: 'The review copy for your owner could not be deposited yet; call wacando_file_status to retry. The file stays pending.',
 };
@@ -77,11 +92,12 @@ export const fileApiMessages = {
 /**
  * Upload origin this runtime trusts for file downloads and deposits: an
  * explicit setting, then WACANDO_UPLOAD_ORIGIN, then the configured API
- * origin (the production app origin maps to its API origin). Never derived
+ * origin (an identity saved under the former default, the web app origin,
+ * uses the production API origin). Never derived
  * from a message. Plain http is accepted only on loopback (local stacks).
  */
 export function uploadPin(apiOrigin, setting = process.env.WACANDO_UPLOAD_ORIGIN) {
-  const value = setting ?? (apiOrigin === PRODUCTION_APP ? PRODUCTION_UPLOADS : apiOrigin);
+  const value = setting ?? (apiOrigin === LEGACY_APP_ORIGIN ? PRODUCTION_API_ORIGIN : apiOrigin);
   let url;
   try { url = serviceUrl(value, { development: true }); }
   catch { throw new SafeError('WACANDO_UPLOAD_ORIGIN must be an https origin (http only on loopback).'); }
@@ -144,6 +160,26 @@ export function ownOwnerId(view, agentId) {
   return owner;
 }
 
+/**
+ * Pure: whether a message body is a Wacando file descriptor, whatever its
+ * whitespace or key order: 'share' (file share, `wacandoFile`), 'review'
+ * (owner review descriptor, `wacandoFileReview`, never meant for a room) or
+ * null. Such a body is never shown nor sent as text (it carries a key).
+ */
+export function fileBodyKind(text) {
+  if (typeof text !== 'string') return null;
+  const trimmed = text.trim();
+  if (!trimmed.startsWith('{')) return null;
+  let value;
+  try { value = JSON.parse(trimmed); } catch {
+    // Not JSON: still a descriptor when it opens like one (never shown as text).
+    return /^\{\s*"wacandoFileReview"\s*:/.test(trimmed) ? 'review' : /^\{\s*"wacandoFile"\s*:/.test(trimmed) ? 'share' : null;
+  }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  if (Object.hasOwn(value, 'wacandoFileReview')) return 'review';
+  return Object.hasOwn(value, 'wacandoFile') ? 'share' : null;
+}
+
 const BARE_JID = /^[^\s/@]+@[^\s/@]+$/;
 const hex = bytes => Buffer.from(bytes).toString('hex');
 const unhex = text => new Uint8Array(Buffer.from(text, 'hex'));
@@ -161,12 +197,14 @@ async function readPrivate(path, limit) {
   } finally { await file?.close(); }
 }
 
-async function writePrivate(directory, name, bytes) {
+// `openFile` is fs/promises `open`; tests inject one whose writes fail like a
+// full disk (a read-only directory does not stop root, e.g. in a CI container).
+async function writePrivate(directory, name, bytes, openFile = open) {
   const path = join(directory, name);
   const tmp = join(directory, `.${randomUUID()}.part`);
   let file;
   try {
-    file = await open(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    file = await openFile(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
     await file.chmod(0o600);
     await file.writeFile(bytes);
     await file.sync();
@@ -189,9 +227,10 @@ async function writePrivate(directory, name, bytes) {
  * Each record is deleted (key included) once it is no longer needed.
  */
 export class FileVault {
-  constructor(base, quarantineRoot) {
+  constructor(base, quarantineRoot, { openFile = open } = {}) {
     this.base = base;
     this.quarantineRoot = quarantineRoot;
+    this.openFile = openFile;
   }
   async dir(kind) { await protectedDirectory(this.base); return protectedDirectory(join(this.base, kind)); }
   async quarantine() { return protectedDirectory(this.quarantineRoot ?? join(this.base, 'quarantine')); }
@@ -203,7 +242,7 @@ export class FileVault {
     if (!bytes) return null;
     try { return JSON.parse(bytes.toString('utf8')); } catch { throw storageError(); }
   }
-  async write(kind, fileId, record) { await writePrivate(await this.dir(kind), `${FileVault.id(fileId)}.json`, JSON.stringify(record)); }
+  async write(kind, fileId, record) { await writePrivate(await this.dir(kind), `${FileVault.id(fileId)}.json`, JSON.stringify(record), this.openFile); }
   async remove(kind, fileId) {
     const dir = await this.dir(kind);
     for (const name of [`${FileVault.id(fileId)}.json`, `${fileId}.bin`]) await unlink(join(dir, name)).catch(error => { if (error.code !== 'ENOENT') throw storageError(); });
@@ -214,12 +253,35 @@ export class FileVault {
     for (const name of names) { const record = await this.read(kind, name.slice(0, -5)); if (record) records.push(record); }
     return records;
   }
-  async writeCiphertext(fileId, bytes) { await writePrivate(await this.dir('outgoing'), `${FileVault.id(fileId)}.bin`, bytes); }
   async readCiphertext(fileId) {
     const bytes = await readPrivate(join(await this.dir('outgoing'), `${FileVault.id(fileId)}.bin`), MAX_FILE_PLAINTEXT_BYTES + 16);
     return bytes ? new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.length) : null;
   }
   async dropCiphertext(fileId) { await unlink(join(await this.dir('outgoing'), `${FileVault.id(fileId)}.bin`)).catch(() => {}); }
+  /** Write a ciphertext BEFORE its server request (a full disk fails here, before the server knows the file). */
+  async stageCiphertext(bytes) {
+    const name = `staged-${randomUUID()}.bin`;
+    await writePrivate(await this.dir('outgoing'), name, bytes, this.openFile);
+    return name;
+  }
+  async commitCiphertext(staged, fileId) {
+    const dir = await this.dir('outgoing');
+    try { await rename(join(dir, staged), join(dir, `${FileVault.id(fileId)}.bin`)); } catch { throw storageError(); }
+  }
+  async dropStaged(staged) { if (STAGED.test(staged ?? '')) await unlink(join(await this.dir('outgoing'), staged)).catch(() => {}); }
+  /** Remove interrupted-write leftovers (staged ciphertext, .part files) older than `before` (ms). Returns the count. */
+  async dropLeftovers(before) {
+    let count = 0;
+    for (const kind of ['outgoing', 'incoming']) {
+      const dir = await this.dir(kind);
+      for (const name of await readdir(dir)) {
+        if (!STAGED.test(name) && !PART.test(name)) continue;
+        const info = await stat(join(dir, name)).catch(() => null);
+        if (info?.isFile() && info.mtimeMs < before && await unlink(join(dir, name)).then(() => true, () => false)) count++;
+      }
+    }
+    return count;
+  }
 
   /** Write released plaintext once, 0600 in a fresh 0700 directory; never executable. */
   async place(fileId, name, bytes) {
@@ -228,7 +290,7 @@ export class FileVault {
     await rm(directory, { recursive: true, force: true });
     await mkdir(directory, { mode: 0o700 });
     await protectedDirectory(directory);
-    return resolve(await writePrivate(directory, quarantineName(name), bytes));
+    return resolve(await writePrivate(directory, quarantineName(name), bytes, this.openFile));
   }
 }
 
@@ -293,15 +355,24 @@ export class FileTransfers {
    */
   async send(conversationId, path, { timeoutMs = 0 } = {}) {
     const view = await this.active(conversationId);
-    if ((await this.vault.list('outgoing')).filter(r => !r.sent).length >= MAX_PENDING_OUTGOING) throw new SafeError(fileErrors.tooMany);
+    const waiting = async () => (await this.vault.list('outgoing')).filter(r => !r.sent).length;
+    if (await waiting() >= MAX_PENDING_OUTGOING) {
+      // Ended transfers do not count: clean them up before refusing.
+      await this.sweep().catch(() => null);
+      if (await waiting() >= MAX_PENDING_OUTGOING) throw new SafeError(fileErrors.tooMany);
+    }
     const bytes = await readSource(path);
     let encrypted;
     try { encrypted = await encryptFile({ name: basename(String(path)), bytes }); }
     catch (error) { throw cryptoFailure(error); }
+    // Kept locally BEFORE the request, so a local write failure cannot leave a
+    // server record this runtime does not know (lbframe/wacando-agent#21).
+    const staged = await this.vault.stageCiphertext(encrypted.ciphertext);
     let file;
     try { ({ file } = await this.c.runtime.api(this.c.agent, 'POST', `/v1/conversations/${encodeURIComponent(view.id)}/files`, encrypted.approval)); }
-    catch (error) { throw this.apiError(error); }
+    catch (error) { await this.vault.dropStaged(staged); throw this.apiError(error); }
     if (!FILE_ID.test(file?.id ?? '') || file.ciphertextSha256 !== encrypted.approval.ciphertextSha256 || file.sizeBytes !== encrypted.approval.sizeBytes) {
+      await this.vault.dropStaged(staged);
       throw new SafeError('The server answered an unexpected file record. Nothing was sent.');
     }
     const record = {
@@ -310,8 +381,16 @@ export class FileTransfers {
       ciphertextSize: encrypted.approval.sizeBytes, key: hex(encrypted.key), iv: hex(encrypted.iv),
       requestedAt: new Date(this.now()).toISOString(), expiresAt: file.expiresAt,
     };
-    await this.vault.writeCiphertext(file.id, encrypted.ciphertext);
-    await this.vault.write('outgoing', file.id, record);
+    try {
+      await this.vault.commitCiphertext(staged, file.id);
+      await this.vault.write('outgoing', file.id, record);
+    } catch {
+      // The server record stays pending without a review copy: it can never be
+      // approved; the owner can refuse it and it expires after 30 days.
+      await this.vault.dropStaged(staged);
+      await this.vault.remove('outgoing', file.id).catch(() => {});
+      throw new SafeError(fileErrors.orphan);
+    }
     // Right after the request: the owner's review copy (retried by advance()).
     return this.once(file.id, async () => {
       const review = await this.review(record);
@@ -538,6 +617,9 @@ export class FileTransfers {
       }
       return { ...publicIncoming(known), state: known.path ? 'received' : 'quarantined' };
     }
+    if ((await this.vault.list('incoming')).filter(r => !r.path).length >= MAX_QUARANTINED_INCOMING) {
+      return { state: 'refused', reason: 'too_many_quarantined', note: fileErrors.tooManyIncoming };
+    }
     const record = { fileId, conversationId, messageId, share, ciphertextSha256: share.ciphertextSha256, receivedAt: new Date(this.now()).toISOString() };
     await this.vault.write('incoming', fileId, record);
     return { ...publicIncoming(record), state: 'quarantined', note: `In quarantine until your owner authorizes it; then call wacando_receive_file. ${UNTRUSTED}` };
@@ -552,7 +634,7 @@ export class FileTransfers {
 
   async incomingState(record, { timeoutMs, fetch }) {
     const summary = publicIncoming(record);
-    if (record.path) return { file: summary, state: 'received', path: record.path, note: UNTRUSTED };
+    if (record.path) return { file: summary, state: 'received', path: record.path, note: `${UNTRUSTED} ${KEPT}` };
     const deadline = this.now() + timeoutMs;
     for (;;) {
       const view = await this.c.conversation(record.conversationId);
@@ -592,16 +674,85 @@ export class FileTransfers {
       mediaType: file.mediaType, size: file.bytes.length, ciphertextSha256: record.share.ciphertextSha256, path, receivedAt: record.receivedAt };
     // The key is no longer needed once the plaintext is written: forget it.
     await this.vault.write('incoming', record.fileId, kept);
-    return { file: { ...publicIncoming(kept) }, state: 'received', path, sha256: record.share.sha256, note: UNTRUSTED };
+    return { file: { ...publicIncoming(kept) }, state: 'received', path, sha256: record.share.sha256, note: `${UNTRUSTED} ${KEPT}` };
   }
 
-  /** Local file transfers of this identity (optionally one conversation), no keys. */
+  /** Local file transfers of this identity (optionally one conversation), no keys; ended transfers are cleaned up first. */
   async list(conversationId) {
+    const cleaned = await this.sweep().catch(() => null);
     const keep = r => !conversationId || r.conversationId === conversationId;
     return {
       outgoing: (await this.vault.list('outgoing')).filter(keep).map(r => ({ ...publicOutgoing(r), state: r.sent ? 'sent' : r.slotGet ? 'deposited' : 'awaiting_approval' })),
-      incoming: (await this.vault.list('incoming')).filter(keep).map(r => ({ ...publicIncoming(r), state: r.path ? 'received' : 'quarantined' })),
+      incoming: (await this.vault.list('incoming')).filter(keep).map(r => ({ ...publicIncoming(r), state: r.path ? 'received' : 'quarantined', ...(r.path ? { kept: true } : {}) })),
+      ...(cleaned && (cleaned.outgoing || cleaned.incoming) ? { cleaned } : {}),
+    };
+  }
+
+  /**
+   * Delete the local secrets of every transfer that can never continue
+   * (lbframe/wacando-agent#21), at connection and before each listing:
+   * - pending/deposited sends (ciphertext + key) and quarantined descriptors
+   *   (key): conversation no longer active (STOP is terminal) or unknown to
+   *   the server, file unknown, different, rejected or expired on the server,
+   *   or past its 30-day expiry by the local clock (even offline);
+   * - sent records (public metadata only, no key): past their expiry;
+   * - interrupted-write leftovers older than an hour.
+   * A received file (written to the quarantine directory) and its record are
+   * never touched. A server that cannot be reached removes nothing it cannot
+   * decide locally. Transfers in progress in this process are skipped.
+   * Returns content-free counts.
+   */
+  sweep() {
+    this.sweeping ??= this.sweepOnce().finally(() => { this.sweeping = null; });
+    return this.sweeping;
+  }
+
+  async sweepOnce() {
+    const now = this.now();
+    const counts = { outgoing: 0, incoming: 0 };
+    const servers = new Map(); // conversationId -> Promise<{state, files} | null>
+    const server = id => {
+      if (!servers.has(id)) servers.set(id, this.serverState(id));
+      return servers.get(id);
     };
+    for (const direction of ['outgoing', 'incoming']) {
+      for (const record of await this.vault.list(direction)) {
+        if (direction === 'incoming' && record.path) continue; // received: the user's file
+        if (this.busy.has(record.fileId)) continue;
+        if (!(await this.ended(direction, record, now, server))) continue;
+        if (this.busy.has(record.fileId)) continue;
+        await this.vault.remove(direction, record.fileId);
+        counts[direction]++;
+      }
+    }
+    await this.vault.dropLeftovers(now - STALE_LEFTOVER_MS).catch(() => 0);
+    return counts;
+  }
+
+  /** Conversation state and files as the server lists them for this agent; 'gone' when unknown; null when unreachable. */
+  async serverState(conversationId) {
+    let state;
+    try { state = (await this.c.runtime.api(this.c.agent, 'GET', `/v1/conversations/${encodeURIComponent(conversationId)}`))?.conversation?.status; }
+    catch (error) { return error instanceof ApiError && error.code === 'NOT_FOUND' ? { state: 'gone' } : null; }
+    if (typeof state !== 'string') return null;
+    if (state !== 'active') return { state };
+    try { return { state, files: await this.serverFiles(conversationId) }; } catch { return null; }
+  }
+
+  async ended(direction, record, now, server) {
+    // The server's expiry, else 30 days after the local request or receipt
+    // (a file is requested before it is received: never earlier than the server).
+    const started = Date.parse(record.receivedAt ?? record.requestedAt ?? '');
+    const expiresAt = Date.parse(record.expiresAt ?? '') || started + FILE_RETENTION_MS;
+    if (expiresAt <= now) return true;
+    if (direction === 'outgoing' && record.sent) return false; // no key left; kept until its expiry
+    const known = await server(record.conversationId);
+    if (!known) return false;
+    if (known.state !== 'active') return true;
+    const dto = known.files.find(f => f.id === record.fileId);
+    if (!dto || this.expired(dto)) return true;
+    if (direction === 'outgoing') return dto.ciphertextSha256 !== record.ciphertextSha256 || dto.sizeBytes !== record.ciphertextSize || dto.status === 'rejected';
+    return dto.recipientAgentId !== this.c.agent.agentId || dto.ciphertextSha256 !== record.share?.ciphertextSha256;
   }
 }
 

package/packages/runtime/pairing.mjs

@@ -1,6 +1,6 @@
 import { createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign } from 'node:crypto';
 import { hostname } from 'node:os';
-import { ApiError, post } from '../onboarding/network.mjs';
+import { ApiError, apiNotFound, post } from '../onboarding/network.mjs';
 import { SafeError } from '../onboarding/storage.mjs';
 
 // Universal pairing (lbframe/wacando docs/ENROLLMENT_PAIRING_API.md, #36/#60).
@@ -71,6 +71,10 @@ export async function redeem({ origin, code, host, label, mode, saveKey, request
       proof: proof(key.privateKeyPem, redeemMessage(code, key.publicKey, clientNonce, issuedAt)),
     });
   } catch (error) {
+    // Not the Wacando API (e.g. the web site answering an HTML 404): a wrong
+    // origin, never a code refusal. Every real API refusal keeps one message,
+    // so the answer reveals nothing about a code.
+    if (error instanceof ApiError && error.unknownRoute) throw new SafeError(apiNotFound(origin));
     if (error instanceof ApiError && [400, 401, 403, 404].includes(error.status)) throw new SafeError(pairingErrors.refused);
     if (error instanceof ApiError && error.status === 429) throw new SafeError('Too many pairing attempts. Wait and retry with the same code.');
     throw error;
@@ -100,6 +104,7 @@ export async function claim({ pending, request = post, sleep, now = Date.now, de
       return data;
     } catch (error) {
       if (!(error instanceof ApiError)) throw error;
+      if (error.unknownRoute) throw new SafeError(apiNotFound(pending.origin));
       if (error.status === 429) wait = Math.max(POLL_INTERVAL_MS, (error.retryAfter ?? 5) * 1000);
       else if (error.status !== 401) throw new SafeError(`Pairing service error (HTTP ${error.status}). Retry with the same command.`);
     }

package/packages/runtime/runtime.mjs

@@ -1,7 +1,7 @@
 import { OnboardingService } from '../onboarding/service.mjs';
 import { join } from 'node:path';
 import { CredentialStore, digest, SafeError } from '../onboarding/storage.mjs';
-import { configuredOrigin, get, post } from '../onboarding/network.mjs';
+import { configuredOrigin, get, legacyOrigins, post } from '../onboarding/network.mjs';
 import { ConversationClient } from './conversations.mjs';
 import { FileTransfers, FileVault, uploadPin } from './files.mjs';
 import { claim, pairingErrors, redeem } from './pairing.mjs';
@@ -55,16 +55,34 @@ export class AgentRuntime {
   /** Configured service origin (validated on use, like the onboarding tools). */
   get origin() { return configuredOrigin(this.originSetting); }
 
+  /**
+   * Saved identity records for this origin and host. For the production API
+   * this includes identities saved under the former default origin (the web
+   * app, up to 2.2.0): they are used in place, under their saved origin, so
+   * their OMEMO device, file state and locks stay exactly where they are and
+   * an older runtime still finds them. Nothing is rewritten or moved.
+   */
+  async savedAgents() {
+    const agents = [];
+    const seen = new Set();
+    for (const origin of legacyOrigins(this.origin)) {
+      for (const agent of await this.store.list(origin, this.host, 'agent')) {
+        if (agent.origin !== origin || seen.has(agent.agentId)) continue;
+        seen.add(agent.agentId);
+        agents.push(agent);
+      }
+    }
+    return agents;
+  }
+
   /** Saved identities for this origin and host (public fields only). */
   async identities() {
-    const agents = await this.store.list(this.origin, this.host, 'agent');
-    return agents.filter(agent => agent.origin === this.origin)
-      .map(agent => publicIdentity(agent, this.service.states.get(agent.agentId)));
+    return (await this.savedAgents()).map(agent => publicIdentity(agent, this.service.states.get(agent.agentId)));
   }
 
   /** Resolve a saved identity by agent ID or handle; a single identity is the default. */
   async resolve(selector) {
-    const agents = (await this.store.list(this.origin, this.host, 'agent')).filter(agent => agent.origin === this.origin);
+    const agents = await this.savedAgents();
     const matches = selector === undefined ? agents
       : agents.filter(agent => agent.agentId === selector || (handlePattern.test(selector) && agent.handle === selector));
     if (matches.length === 0) throw new SafeError('No saved identity matches. Pair this runtime first (wacando-agent pair <code>).');

package/packages/runtime/session.mjs

@@ -1,10 +1,39 @@
-import { client } from '@xmpp/client';
-import { announceAvailable, refuseSubscriptionRequests, xml } from '#wacando/xmpp';
+import { announceAvailable, refuseSubscriptionRequests, ScramAuthError, scramClient, startScramClient, xml } from '#wacando/xmpp';
+import { SCRAM_REFUSED, XMPP_SERVER_UNVERIFIED } from '../onboarding/service.mjs';
 import { SafeError } from '../onboarding/storage.mjs';
 import { loadDevice } from './device.mjs';
 
+/**
+ * @xmpp/connection 0.14.0 `start()` creates its "online" promise (rejected by
+ * any entity 'error') BEFORE awaiting `open()`. When an 'error' is emitted
+ * while the stream opens (Node.js 24's WebSocket reports a socket cut that
+ * way), `open()` rejects, `start()` throws without ever awaiting that promise
+ * and its rejection is unhandled: the whole process (daemon, MCP server)
+ * dies. Same steps, with the "online" promise always observed.
+ */
+function observeOnlinePromise(xmpp) {
+  xmpp.start = async function start() {
+    if (this.status !== 'offline') throw new Error('Connection is not offline');
+    const { service, domain, lang } = this.options;
+    await this.connect(service);
+    const online = new Promise((resolve, reject) => {
+      const settle = () => { this.removeListener('online', onOnline); this.removeListener('error', onError); };
+      const onOnline = value => { settle(); resolve(value); };
+      const onError = error => { settle(); reject(error); };
+      this.on('online', onOnline);
+      this.on('error', onError);
+    });
+    online.catch(() => {});
+    await this.open({ domain, lang });
+    return online;
+  };
+}
+
 const unavailable = () => new SafeError('Secure messaging is unavailable. Retry the saved identity.');
 
+/** SafeError for a ScramAuthError: the fixed message plus its local reason enum (no secret). */
+const serverUnverified = error => Object.assign(new SafeError(XMPP_SERVER_UNVERIFIED), { code: SCRAM_REFUSED, reason: error.reason });
+
 /**
  * One XMPP c2s stream (WebSocket) + this identity's native OMEMO device.
  *
@@ -13,12 +42,18 @@ const unavailable = () => new SafeError('Secure messaging is unavailable. Retry
  * delivery addressed to the bare JID after that point reaches this resource
  * and none can be missed between "online" and the caller subscribing.
  * Raw XMPP errors, stanzas and credentials are never logged.
+ *
+ * The client is the embedded `scramClient` (lbframe/wacando#186): SCRAM only,
+ * SASL1 only, and authentication succeeds only once the server's
+ * ServerSignature (`v=`) was verified. A refusal closes the connection,
+ * stops @xmpp/client's reconnect and rejects with `code: 'SCRAM_REFUSED'`.
  */
 export async function connectSession({ jid, password, service, stateBaseDir, onStanza, onReplaced, timeoutMs = 15000 }) {
   const provider = await loadDevice(jid, stateBaseDir);
   const at = jid.indexOf('@');
   const domain = jid.slice(at + 1);
-  const xmpp = client({ service, domain, username: jid.slice(0, at), password });
+  const xmpp = scramClient({ service, domain, username: jid.slice(0, at), password });
+  observeOnlinePromise(xmpp);
   // One server-enforced session per agent (lbframe/wacando #15): a newer login
   // ends this one with <conflict/>. Remember it so nothing reconnects in a loop.
   let replaced = false;
@@ -31,15 +66,16 @@ export async function connectSession({ jid, password, service, stateBaseDir, onS
   let timer;
   const deadline = new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('timeout')), timeoutMs); });
   try {
-    await Promise.race([xmpp.start(), deadline]);
+    await Promise.race([startScramClient(xmpp), deadline]);
     xmpp.reconnect?.stop();
     // The control plane owns the roster (#13): never approve a subscription.
     refuseSubscriptionRequests(xmpp);
     if (onStanza) xmpp.on('stanza', stanza => onStanza(stanza, xmpp));
     await Promise.race([announceAvailable(xmpp, timeoutMs), deadline]);
-  } catch {
+  } catch (error) {
+    xmpp.reconnect?.stop();
     await xmpp.stop().catch(() => {});
-    throw unavailable();
+    throw error instanceof ScramAuthError ? serverUnverified(error) : unavailable();
   } finally { clearTimeout(timer); }
   return {
     client: xmpp, provider, bareJid: provider.bareJid, domain,

package/packages/wacando/chunks/{chunk-PHGOH4AU.mjs → chunk-F7J3K43U.mjs}

@@ -1,7 +1,7 @@
-// Embedded from lbframe/wacando@618922ecaf2213da18949a8b27d343c8767b64c5 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+// Embedded from lbframe/wacando@40dd0c30b3653095f08994f9534fd5110e1d0925 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
 import {
   DomainError
-} from "./chunk-PZDQXGA6.mjs";
+} from "./chunk-FFLYSYV6.mjs";
 
 // packages/omemo/src/ns.ts
 var NS_OMEMO = "eu.siacs.conversations.axolotl";

package/packages/wacando/chunks/{chunk-PZDQXGA6.mjs → chunk-FFLYSYV6.mjs}

@@ -1,4 +1,4 @@
-// Embedded from lbframe/wacando@618922ecaf2213da18949a8b27d343c8767b64c5 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+// Embedded from lbframe/wacando@40dd0c30b3653095f08994f9534fd5110e1d0925 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
 
 // packages/contracts/src/errors.ts
 var DomainError = class extends Error {