abtars 0.3.4-alpha.7 → 0.3.4

package/bundle/ws-peer-client-U3NNPOK7.js

@@ -0,0 +1,370 @@
+#!/usr/bin/env node
+ import { createRequire as __bundleCreateRequire } from 'node:module'; import { fileURLToPath as __bundleFileURLToPath } from 'node:url'; import { dirname as __bundleDirname } from 'node:path'; const require = __bundleCreateRequire(import.meta.url); const __chunk_filename = __bundleFileURLToPath(import.meta.url); const __chunk_dirname = __bundleDirname(__chunk_filename);
+import {
+  init_wrapper,
+  wrapper_default
+} from "./chunk-ZT5ZBGWS.js";
+import "./chunk-R76K6L6H.js";
+import {
+  init_peer_config,
+  loadPeerConfig
+} from "./chunk-3BG3AIDP.js";
+import "./chunk-5RVOEFGT.js";
+import {
+  init_peer_auth,
+  signRequest,
+  verifyServerCert
+} from "./chunk-WC5O5KOE.js";
+import {
+  init_logger,
+  logDebug,
+  logInfo,
+  logWarn
+} from "./chunk-XRTXYN66.js";
+import {
+  abtarsHome,
+  init_paths
+} from "./chunk-GALQBVKO.js";
+import "./chunk-O7KQG6ME.js";
+import {
+  __esm,
+  __require
+} from "./chunk-7K2YZTLD.js";
+
+// src/components/peer-transport/ws-peer-client.ts
+import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+var TAG, MAX_BACKOFF_MS, REQUEST_TIMEOUT_MS, QUEUE_MAX, WsPeerClient;
+var init_ws_peer_client = __esm({
+  "src/components/peer-transport/ws-peer-client.ts"() {
+    init_wrapper();
+    init_peer_auth();
+    init_peer_config();
+    init_logger();
+    init_paths();
+    TAG = "ws-peer";
+    MAX_BACKOFF_MS = 3e4;
+    REQUEST_TIMEOUT_MS = 3e4;
+    QUEUE_MAX = 200;
+    WsPeerClient = class {
+      ws = null;
+      peerName;
+      entry;
+      backoff = 1e3;
+      reconnectTimer = null;
+      pushHandler = null;
+      pending = /* @__PURE__ */ new Map();
+      destroyed = false;
+      /** Durable outbound queue: pending messages while disconnected. */
+      _queue = [];
+      queuePath;
+      constructor(peerName, entry) {
+        this.peerName = peerName;
+        this.entry = entry;
+        this.queuePath = join(abtarsHome(), `ws-queue-${peerName}.json`);
+        this.loadQueue();
+      }
+      onPush(handler) {
+        this.pushHandler = handler;
+      }
+      connect() {
+        if (this.destroyed) return;
+        if (this.ws && (this.ws.readyState === wrapper_default.OPEN || this.ws.readyState === wrapper_default.CONNECTING)) {
+          return;
+        }
+        const config = loadPeerConfig();
+        if (!this.entry.verifyKey) {
+          logWarn(TAG, `Cannot connect to ${this.peerName}: no verifyKey (not enrolled)`);
+          return;
+        }
+        const url = `wss://${this.entry.host}:${this.entry.port}/v1/ws`;
+        const sigHeaders = signRequest("GET", "/v1/ws", "", config.self.signingKey, config.self.name);
+        this.ws = new wrapper_default(url, {
+          headers: sigHeaders,
+          minVersion: "TLSv1.3",
+          rejectUnauthorized: true,
+          checkServerIdentity: (_host, cert) => {
+            if (!cert.raw) return new Error("No cert from peer");
+            try {
+              const { createPublicKey } = __require("node:crypto");
+              const keyObj = createPublicKey({ key: cert.raw, format: "der", type: "spki" });
+              const certDerB64 = cert.raw.toString("base64");
+              const certPemBlock = `-----BEGIN CERTIFICATE-----
+${certDerB64.match(/.{1,64}/g).join("\n")}
+-----END CERTIFICATE-----
+`;
+              if (!verifyServerCert(certPemBlock, this.entry.verifyKey)) {
+                return new Error(`${this.peerName} cert key != enrolled verifyKey`);
+              }
+            } catch (e) {
+              return new Error(`Cert verify: ${e instanceof Error ? e.message : String(e)}`);
+            }
+            return void 0;
+          }
+        });
+        this.ws.on("open", () => {
+          logInfo(TAG, `Connected to ${this.peerName}`);
+          this.backoff = 1e3;
+          this.ws._socket?.setKeepAlive(true, 2e4);
+          this.drainQueue();
+        });
+        this.ws.on("message", (data) => this.handleMessage(data.toString()));
+        this.ws.on("close", () => {
+          this.cleanup();
+          if (!this.destroyed) this.scheduleReconnect();
+        });
+        this.ws.on("error", (err) => {
+          logDebug(TAG, `WS error (${this.peerName}): ${err.message}`);
+          this.ws?.close();
+        });
+      }
+      /**
+       * Send a message over the WS. If disconnected, enqueues it for delivery on reconnect.
+       */
+      async send(method, payload) {
+        if (!this.ws || this.ws.readyState !== wrapper_default.OPEN) {
+          return this.enqueue(method, payload);
+        }
+        return this.sendNow(method, payload);
+      }
+      get connected() {
+        return this.ws?.readyState === wrapper_default.OPEN;
+      }
+      destroy() {
+        this.destroyed = true;
+        if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+        this.cleanup();
+        this.ws?.close();
+        this.clearPersistedQueue();
+      }
+      async sendNow(method, payload) {
+        if (!this.ws || this.ws.readyState !== wrapper_default.OPEN) {
+          throw new Error(`WS not connected to ${this.peerName}`);
+        }
+        const id = randomUUID();
+        const config = loadPeerConfig();
+        const payloadStr = JSON.stringify(payload);
+        const sigHeaders = signRequest("POST", `/${method}`, payloadStr, config.self.signingKey, config.self.name);
+        return new Promise((resolve, reject) => {
+          const timer = setTimeout(() => {
+            this.pending.delete(id);
+            reject(new Error(`WS request timeout (${this.peerName}/${method})`));
+          }, REQUEST_TIMEOUT_MS);
+          this.pending.set(id, { resolve, reject, timer });
+          this.ws.send(JSON.stringify({ type: "request", id, method, payload, ...sigHeaders }));
+        });
+      }
+      enqueue(method, payload) {
+        return new Promise((resolve, reject) => {
+          if (this._queue.length >= QUEUE_MAX) {
+            const dropped = this._queue.shift();
+            logWarn(TAG, `[warn] ws queue for ${this.peerName} full, dropping oldest (${dropped.method})`);
+          }
+          const entry = { method, payload, id: randomUUID() };
+          this._queue.push(entry);
+          this.persistQueue();
+          resolve({ queued: true, id: entry.id });
+        });
+      }
+      drainQueue() {
+        if (this._queue.length === 0) return;
+        logInfo(TAG, `Draining ${this._queue.length} queued message(s) for ${this.peerName}`);
+        const queue = this._queue.splice(0);
+        this.clearPersistedQueue();
+        for (const entry of queue) {
+          this.sendNow(entry.method, entry.payload).catch((err) => {
+            logWarn(TAG, `Queue drain failed for ${this.peerName}/${entry.method}: ${err.message}`);
+          });
+        }
+      }
+      persistQueue() {
+        try {
+          writeFileSync(this.queuePath, JSON.stringify(this._queue), { encoding: "utf-8", mode: 384 });
+        } catch {
+        }
+      }
+      clearPersistedQueue() {
+        try {
+          if (existsSync(this.queuePath)) unlinkSync(this.queuePath);
+        } catch {
+        }
+      }
+      loadQueue() {
+        try {
+          if (existsSync(this.queuePath)) {
+            const data = readFileSync(this.queuePath, "utf-8");
+            const parsed = JSON.parse(data);
+            if (Array.isArray(parsed)) {
+              this._queue = parsed.slice(0, QUEUE_MAX);
+              if (this._queue.length > 0) {
+                logInfo(TAG, `Loaded ${this._queue.length} queued message(s) for ${this.peerName} from disk`);
+              }
+            }
+          }
+        } catch {
+        }
+      }
+      handleMessage(raw) {
+        try {
+          const msg = JSON.parse(raw);
+          if (msg.type === "response" && msg.id && this.pending.has(msg.id)) {
+            const p = this.pending.get(msg.id);
+            this.pending.delete(msg.id);
+            clearTimeout(p.timer);
+            p.resolve(msg.payload);
+          } else if (msg.type === "push") {
+            this.pushHandler?.(msg.method, msg.payload);
+          }
+        } catch {
+        }
+      }
+      cleanup() {
+        for (const [, p] of this.pending) {
+          clearTimeout(p.timer);
+          p.reject(new Error("WS connection closed"));
+        }
+        this.pending.clear();
+      }
+      scheduleReconnect() {
+        const jitter = this.backoff * (0.8 + Math.random() * 0.4);
+        logDebug(TAG, `Reconnecting to ${this.peerName} in ${Math.round(jitter)}ms`);
+        this.reconnectTimer = setTimeout(() => {
+          this.reconnectTimer = null;
+          this.connect();
+        }, jitter);
+        this.backoff = Math.min(this.backoff * 2, MAX_BACKOFF_MS);
+      }
+      /**
+       * Dialer-side enrollment handshake over /v1/enroll-ws.
+       * Called by `abtars tribe join`.
+       */
+      async enroll(tribeToken, selfSigningKey, selfVerifyKey, selfName) {
+        const { randomBytes } = await import("node:crypto");
+        const {
+          macTribe,
+          signEnroll,
+          verifyAck
+        } = await import("./peer-auth-RI43DKJE.js");
+        const { clearPeerConfigCache } = await import("./peer-config-URM7DCW6.js");
+        const { writeFileSync: writeFileSync2, existsSync: exSync, mkdirSync } = await import("node:fs");
+        const enrollUrl = `wss://${this.entry.host}:${this.entry.port}/v1/enroll-ws`;
+        const nonceI = randomBytes(16).toString("hex");
+        const tsNow = Math.floor(Date.now() / 1e3);
+        return new Promise((resolve, reject) => {
+          const enrollWs = new wrapper_default(enrollUrl, {
+            minVersion: "TLSv1.3",
+            rejectUnauthorized: false
+            // Can't pin yet — cert is verified via MAC binding in step B
+          });
+          let stage = 0;
+          let nonceR = "";
+          let pubKeyR = "";
+          enrollWs.on("open", () => {
+            enrollWs.send(JSON.stringify({
+              pubKey_i: selfVerifyKey,
+              nonce_i: nonceI,
+              ts: tsNow
+            }));
+            stage = 1;
+          });
+          enrollWs.on("message", async (rawData) => {
+            try {
+              const msg = JSON.parse(rawData.toString());
+              if (stage === 1) {
+                const { pubKey_r, nonce_r, ts, mac_r } = msg;
+                if (!pubKey_r || !nonce_r || !mac_r) {
+                  reject(new Error("Invalid challenge"));
+                  enrollWs.close();
+                  return;
+                }
+                const expectedMacR = macTribe(tribeToken, pubKey_r + nonceI);
+                if (mac_r !== expectedMacR) {
+                  reject(new Error("tribe token mismatch \u2014 not same tribe"));
+                  enrollWs.close();
+                  return;
+                }
+                nonceR = nonce_r;
+                pubKeyR = pubKey_r;
+                stage = 2;
+                const macI = macTribe(tribeToken, selfVerifyKey + nonceR);
+                const selfSig = signEnroll(selfSigningKey, selfVerifyKey, nonceR, selfName);
+                enrollWs.send(JSON.stringify({
+                  mac_i: macI,
+                  name: selfName,
+                  nonce_r: nonceR,
+                  ts: Math.floor(Date.now() / 1e3),
+                  selfSig
+                }));
+                return;
+              }
+              if (stage === 2) {
+                const { name_r, pubKey_r: pubKeyRd, ackSig } = msg;
+                if (!ackSig || !name_r) {
+                  reject(new Error("Invalid ack"));
+                  enrollWs.close();
+                  return;
+                }
+                if (!verifyAck(ackSig, pubKeyRd, name_r, pubKeyRd, nonceR)) {
+                  reject(new Error("Invalid ack signature"));
+                  enrollWs.close();
+                  return;
+                }
+                const peersPath = join(abtarsHome(), "config", "peers.json");
+                let raw = {};
+                if (exSync(peersPath)) {
+                  try {
+                    raw = JSON.parse(__require("fs").readFileSync(peersPath, "utf-8"));
+                  } catch {
+                    raw = {};
+                  }
+                }
+                if (!raw.peers || typeof raw.peers !== "object") raw.peers = {};
+                raw.peers[name_r] = {
+                  host: this.entry.host,
+                  port: this.entry.port,
+                  verifyKey: pubKeyRd,
+                  trust: 1,
+                  transport: "ws-outbound"
+                };
+                writeFileSync2(peersPath, JSON.stringify(raw, null, 2) + "\n", { encoding: "utf-8" });
+                clearPeerConfigCache();
+                logInfo(TAG, `Enrolled with '${name_r}' at trust=1`);
+                this.ws = enrollWs;
+                enrollWs.removeAllListeners("message");
+                enrollWs.on("message", (data) => this.handleMessage(data.toString()));
+                enrollWs.on("close", () => {
+                  this.cleanup();
+                  if (!this.destroyed) this.scheduleReconnect();
+                });
+                enrollWs.on("error", (err) => {
+                  logDebug(TAG, `WS error (${this.peerName}): ${err.message}`);
+                  this.ws?.close();
+                });
+                resolve();
+              }
+            } catch (err) {
+              reject(err);
+              enrollWs.close();
+            }
+          });
+          enrollWs.on("error", (err) => reject(new Error(`Enrollment WS error: ${err.message}`)));
+          enrollWs.on("close", (code, reason) => {
+            if (stage < 2) reject(new Error(`Enrollment WS closed early: ${code} ${reason}`));
+          });
+          setTimeout(() => {
+            if (stage < 2) {
+              reject(new Error("Enrollment timeout"));
+              enrollWs.close();
+            }
+          }, 3e4);
+        });
+      }
+    };
+  }
+});
+init_ws_peer_client();
+export {
+  WsPeerClient
+};
+//# sourceMappingURL=ws-peer-client-U3NNPOK7.js.map

package/bundle/ws-peer-client-U3NNPOK7.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/components/peer-transport/ws-peer-client.ts"],
+  "sourcesContent": ["/**\n * ws-peer-client.ts \u2014 Persistent outbound WebSocket to a peer (#972, #1293).\n *\n * #1293 changes:\n * - Auth: Ed25519 request signatures replacing JWT header\n * - Removed own ping setInterval (dead-detection via HB tick)\n * - setKeepAlive(true, 20_000) to hold NAT hole\n * - Durable outbound queue (persist to disk, drain on reconnect)\n */\nimport WebSocket from \"ws\";\nimport { randomUUID } from \"node:crypto\";\nimport { signRequest, verifyServerCert } from \"./peer-auth.js\";\nimport { loadPeerConfig, deriveVerifyKey, type PeerEntry } from \"../peer-config.js\";\nimport { logInfo, logWarn, logDebug } from \"../logger.js\";\nimport { existsSync, readFileSync, writeFileSync, unlinkSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { abtarsHome } from \"../../paths.js\";\n\nconst TAG = \"ws-peer\";\nconst MAX_BACKOFF_MS = 30_000;\nconst REQUEST_TIMEOUT_MS = 30_000;\nconst QUEUE_MAX = 200;\n\ntype PushHandler = (method: string, payload: unknown) => void;\ntype PendingRequest = { resolve: (v: unknown) => void; reject: (e: Error) => void; timer: ReturnType<typeof setTimeout> };\n\ninterface QueueEntry {\n  method: string;\n  payload: unknown;\n  id: string;\n}\n\nexport class WsPeerClient {\n  private ws: WebSocket | null = null;\n  private readonly peerName: string;\n  private readonly entry: PeerEntry;\n  private backoff = 1000;\n  private reconnectTimer: ReturnType<typeof setTimeout> | null = null;\n  private pushHandler: PushHandler | null = null;\n  private pending = new Map<string, PendingRequest>();\n  private destroyed = false;\n  /** Durable outbound queue: pending messages while disconnected. */\n  private _queue: QueueEntry[] = [];\n  private readonly queuePath: string;\n\n  constructor(peerName: string, entry: PeerEntry) {\n    this.peerName = peerName;\n    this.entry = entry;\n    this.queuePath = join(abtarsHome(), `ws-queue-${peerName}.json`);\n    this.loadQueue();\n  }\n\n  onPush(handler: PushHandler): void { this.pushHandler = handler; }\n\n  connect(): void {\n    if (this.destroyed) return;\n    if (this.ws && (this.ws.readyState === WebSocket.OPEN || this.ws.readyState === WebSocket.CONNECTING)) {\n      return; // already connected / connecting\n    }\n\n    const config = loadPeerConfig();\n    if (!this.entry.verifyKey) {\n      logWarn(TAG, `Cannot connect to ${this.peerName}: no verifyKey (not enrolled)`);\n      return;\n    }\n\n    const url = `wss://${this.entry.host}:${this.entry.port}/v1/ws`;\n    const sigHeaders = signRequest(\"GET\", \"/v1/ws\", \"\", config.self.signingKey, config.self.name);\n\n    this.ws = new WebSocket(url, {\n      headers: sigHeaders,\n      minVersion: \"TLSv1.3\",\n      rejectUnauthorized: true,\n      checkServerIdentity: (_host: string, cert: { raw?: Buffer }) => {\n        if (!cert.raw) return new Error(\"No cert from peer\");\n        try {\n          const { createPublicKey } = require(\"node:crypto\") as typeof import(\"node:crypto\");\n          const keyObj = createPublicKey({ key: cert.raw, format: \"der\", type: \"spki\" });\n          // Build PEM cert block from raw DER\n          const certDerB64 = cert.raw.toString(\"base64\");\n          const certPemBlock = `-----BEGIN CERTIFICATE-----\\n${certDerB64.match(/.{1,64}/g)!.join(\"\\n\")}\\n-----END CERTIFICATE-----\\n`;\n          if (!verifyServerCert(certPemBlock, this.entry.verifyKey)) {\n            return new Error(`${this.peerName} cert key != enrolled verifyKey`);\n          }\n        } catch (e) {\n          return new Error(`Cert verify: ${e instanceof Error ? e.message : String(e)}`);\n        }\n        return undefined;\n      },\n    } as any);\n\n    this.ws.on(\"open\", () => {\n      logInfo(TAG, `Connected to ${this.peerName}`);\n      this.backoff = 1000;\n      // NAT keepalive: 20s idle probe\n      (this.ws as any)._socket?.setKeepAlive(true, 20_000);\n      this.drainQueue();\n    });\n\n    this.ws.on(\"message\", (data) => this.handleMessage(data.toString()));\n\n    this.ws.on(\"close\", () => {\n      this.cleanup();\n      if (!this.destroyed) this.scheduleReconnect();\n    });\n\n    this.ws.on(\"error\", (err) => {\n      logDebug(TAG, `WS error (${this.peerName}): ${err.message}`);\n      this.ws?.close();\n    });\n  }\n\n  /**\n   * Send a message over the WS. If disconnected, enqueues it for delivery on reconnect.\n   */\n  async send(method: string, payload: unknown): Promise<unknown> {\n    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {\n      // Enqueue instead of throwing\n      return this.enqueue(method, payload);\n    }\n    return this.sendNow(method, payload);\n  }\n\n  get connected(): boolean { return this.ws?.readyState === WebSocket.OPEN; }\n\n  destroy(): void {\n    this.destroyed = true;\n    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);\n    this.cleanup();\n    this.ws?.close();\n    this.clearPersistedQueue();\n  }\n\n  private async sendNow(method: string, payload: unknown): Promise<unknown> {\n    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {\n      throw new Error(`WS not connected to ${this.peerName}`);\n    }\n    const id = randomUUID();\n    const config = loadPeerConfig();\n    // Sign the serialized payload as a \"request\"\n    const payloadStr = JSON.stringify(payload);\n    const sigHeaders = signRequest(\"POST\", `/${method}`, payloadStr, config.self.signingKey, config.self.name);\n\n    return new Promise((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.pending.delete(id);\n        reject(new Error(`WS request timeout (${this.peerName}/${method})`));\n      }, REQUEST_TIMEOUT_MS);\n      this.pending.set(id, { resolve, reject, timer });\n      this.ws!.send(JSON.stringify({ type: \"request\", id, method, payload, ...sigHeaders }));\n    });\n  }\n\n  private enqueue(method: string, payload: unknown): Promise<unknown> {\n    return new Promise((resolve, reject) => {\n      if (this._queue.length >= QUEUE_MAX) {\n        const dropped = this._queue.shift()!;\n        logWarn(TAG, `[warn] ws queue for ${this.peerName} full, dropping oldest (${dropped.method})`);\n      }\n      const entry: QueueEntry = { method, payload, id: randomUUID() };\n      this._queue.push(entry);\n      this.persistQueue();\n      // We can't resolve/reject immediately for queued messages\n      // Resolve immediately with a sentinel (fire-and-forget semantics)\n      resolve({ queued: true, id: entry.id });\n    });\n  }\n\n  private drainQueue(): void {\n    if (this._queue.length === 0) return;\n    logInfo(TAG, `Draining ${this._queue.length} queued message(s) for ${this.peerName}`);\n    const queue = this._queue.splice(0);\n    this.clearPersistedQueue();\n    for (const entry of queue) {\n      this.sendNow(entry.method, entry.payload).catch(err => {\n        logWarn(TAG, `Queue drain failed for ${this.peerName}/${entry.method}: ${err.message}`);\n      });\n    }\n  }\n\n  private persistQueue(): void {\n    try {\n      writeFileSync(this.queuePath, JSON.stringify(this._queue), { encoding: \"utf-8\", mode: 0o600 });\n    } catch { /* best effort */ }\n  }\n\n  private clearPersistedQueue(): void {\n    try { if (existsSync(this.queuePath)) unlinkSync(this.queuePath); } catch { /* best effort */ }\n  }\n\n  private loadQueue(): void {\n    try {\n      if (existsSync(this.queuePath)) {\n        const data = readFileSync(this.queuePath, \"utf-8\");\n        const parsed = JSON.parse(data) as QueueEntry[];\n        if (Array.isArray(parsed)) {\n          this._queue = parsed.slice(0, QUEUE_MAX);\n          if (this._queue.length > 0) {\n            logInfo(TAG, `Loaded ${this._queue.length} queued message(s) for ${this.peerName} from disk`);\n          }\n        }\n      }\n    } catch { /* best effort \u2014 corrupt queue, start fresh */ }\n  }\n\n  private handleMessage(raw: string): void {\n    try {\n      const msg = JSON.parse(raw);\n      if (msg.type === \"response\" && msg.id && this.pending.has(msg.id)) {\n        const p = this.pending.get(msg.id)!;\n        this.pending.delete(msg.id);\n        clearTimeout(p.timer);\n        p.resolve(msg.payload);\n      } else if (msg.type === \"push\") {\n        this.pushHandler?.(msg.method, msg.payload);\n      }\n    } catch { /* malformed \u2014 ignore */ }\n  }\n\n  private cleanup(): void {\n    // Reject all pending requests\n    for (const [, p] of this.pending) {\n      clearTimeout(p.timer);\n      p.reject(new Error(\"WS connection closed\"));\n    }\n    this.pending.clear();\n  }\n\n  private scheduleReconnect(): void {\n    const jitter = this.backoff * (0.8 + Math.random() * 0.4); // \u00B120%\n    logDebug(TAG, `Reconnecting to ${this.peerName} in ${Math.round(jitter)}ms`);\n    this.reconnectTimer = setTimeout(() => {\n      this.reconnectTimer = null;\n      this.connect();\n    }, jitter);\n    this.backoff = Math.min(this.backoff * 2, MAX_BACKOFF_MS);\n  }\n\n  /**\n   * Dialer-side enrollment handshake over /v1/enroll-ws.\n   * Called by `abtars tribe join`.\n   */\n  async enroll(tribeToken: string, selfSigningKey: string, selfVerifyKey: string, selfName: string): Promise<void> {\n    const { randomBytes } = await import(\"node:crypto\");\n    const {\n      macTribe, signEnroll, verifyAck,\n    } = await import(\"./peer-auth.js\");\n    const { clearPeerConfigCache } = await import(\"../peer-config.js\");\n    const { writeFileSync, existsSync: exSync, mkdirSync } = await import(\"node:fs\");\n\n    const enrollUrl = `wss://${this.entry.host}:${this.entry.port}/v1/enroll-ws`;\n    const nonceI = randomBytes(16).toString(\"hex\");\n    const tsNow = Math.floor(Date.now() / 1000);\n\n    return new Promise((resolve, reject) => {\n      // No auth headers for enrollment path\n      const enrollWs = new WebSocket(enrollUrl, {\n        minVersion: \"TLSv1.3\",\n        rejectUnauthorized: false, // Can't pin yet \u2014 cert is verified via MAC binding in step B\n      } as any);\n\n      let stage = 0;\n      let nonceR = \"\";\n      let pubKeyR = \"\";\n\n      enrollWs.on(\"open\", () => {\n        // Step A: knock\n        enrollWs.send(JSON.stringify({\n          pubKey_i: selfVerifyKey,\n          nonce_i: nonceI,\n          ts: tsNow,\n        }));\n        stage = 1;\n      });\n\n      enrollWs.on(\"message\", async (rawData) => {\n        try {\n          const msg = JSON.parse(rawData.toString());\n\n          if (stage === 1) {\n            // Step B: challenge\n            const { pubKey_r, nonce_r, ts, mac_r } = msg as { pubKey_r: string; nonce_r: string; ts: number; mac_r: string };\n            if (!pubKey_r || !nonce_r || !mac_r) { reject(new Error(\"Invalid challenge\")); enrollWs.close(); return; }\n\n            // Verify mac_r: HMAC(tribeToken, pubKey_r + nonce_i)\n            const expectedMacR = macTribe(tribeToken, pubKey_r + nonceI);\n            if (mac_r !== expectedMacR) { reject(new Error(\"tribe token mismatch \u2014 not same tribe\")); enrollWs.close(); return; }\n\n            nonceR = nonce_r;\n            pubKeyR = pubKey_r;\n            stage = 2;\n\n            // Step C: enroll\n            const macI = macTribe(tribeToken, selfVerifyKey + nonceR);\n            const selfSig = signEnroll(selfSigningKey, selfVerifyKey, nonceR, selfName);\n            enrollWs.send(JSON.stringify({\n              mac_i: macI,\n              name: selfName,\n              nonce_r: nonceR,\n              ts: Math.floor(Date.now() / 1000),\n              selfSig,\n            }));\n            return;\n          }\n\n          if (stage === 2) {\n            // Step D: ack\n            const { name_r, pubKey_r: pubKeyRd, ackSig } = msg as { name_r: string; pubKey_r: string; ackSig: string };\n            if (!ackSig || !name_r) { reject(new Error(\"Invalid ack\")); enrollWs.close(); return; }\n\n            if (!verifyAck(ackSig, pubKeyRd, name_r, pubKeyRd, nonceR)) {\n              reject(new Error(\"Invalid ack signature\")); enrollWs.close(); return;\n            }\n\n            // Persist responder to own peers.json\n            const peersPath = join(abtarsHome(), \"config\", \"peers.json\");\n            let raw: Record<string, unknown> = {};\n            if (exSync(peersPath)) { try { raw = JSON.parse(require(\"fs\").readFileSync(peersPath, \"utf-8\")); } catch { raw = {}; } }\n            if (!raw.peers || typeof raw.peers !== \"object\") raw.peers = {};\n            (raw.peers as Record<string, unknown>)[name_r] = {\n              host: this.entry.host,\n              port: this.entry.port,\n              verifyKey: pubKeyRd,\n              trust: 1,\n              transport: \"ws-outbound\",\n            };\n            writeFileSync(peersPath, JSON.stringify(raw, null, 2) + \"\\n\", { encoding: \"utf-8\" });\n            clearPeerConfigCache();\n\n            logInfo(TAG, `Enrolled with '${name_r}' at trust=1`);\n            // Keep WS alive as steady-state peer connection\n            this.ws = enrollWs;\n            enrollWs.removeAllListeners(\"message\");\n            enrollWs.on(\"message\", (data) => this.handleMessage(data.toString()));\n            enrollWs.on(\"close\", () => { this.cleanup(); if (!this.destroyed) this.scheduleReconnect(); });\n            enrollWs.on(\"error\", (err) => { logDebug(TAG, `WS error (${this.peerName}): ${err.message}`); this.ws?.close(); });\n            resolve();\n          }\n        } catch (err) {\n          reject(err);\n          enrollWs.close();\n        }\n      });\n\n      enrollWs.on(\"error\", (err) => reject(new Error(`Enrollment WS error: ${err.message}`)));\n      enrollWs.on(\"close\", (code, reason) => {\n        if (stage < 2) reject(new Error(`Enrollment WS closed early: ${code} ${reason}`));\n      });\n\n      setTimeout(() => { if (stage < 2) { reject(new Error(\"Enrollment timeout\")); enrollWs.close(); } }, 30_000);\n    });\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,SAAS,kBAAkB;AAI3B,SAAS,YAAY,cAAc,eAAe,kBAAkB;AACpE,SAAS,YAAY;AAfrB,IAkBM,KACA,gBACA,oBACA,WAWO;AAhCb;AAAA;AASA;AAEA;AACA;AACA;AAGA;AAEA,IAAM,MAAM;AACZ,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAC3B,IAAM,YAAY;AAWX,IAAM,eAAN,MAAmB;AAAA,MAChB,KAAuB;AAAA,MACd;AAAA,MACA;AAAA,MACT,UAAU;AAAA,MACV,iBAAuD;AAAA,MACvD,cAAkC;AAAA,MAClC,UAAU,oBAAI,IAA4B;AAAA,MAC1C,YAAY;AAAA;AAAA,MAEZ,SAAuB,CAAC;AAAA,MACf;AAAA,MAEjB,YAAY,UAAkB,OAAkB;AAC9C,aAAK,WAAW;AAChB,aAAK,QAAQ;AACb,aAAK,YAAY,KAAK,WAAW,GAAG,YAAY,QAAQ,OAAO;AAC/D,aAAK,UAAU;AAAA,MACjB;AAAA,MAEA,OAAO,SAA4B;AAAE,aAAK,cAAc;AAAA,MAAS;AAAA,MAEjE,UAAgB;AACd,YAAI,KAAK,UAAW;AACpB,YAAI,KAAK,OAAO,KAAK,GAAG,eAAe,gBAAU,QAAQ,KAAK,GAAG,eAAe,gBAAU,aAAa;AACrG;AAAA,QACF;AAEA,cAAM,SAAS,eAAe;AAC9B,YAAI,CAAC,KAAK,MAAM,WAAW;AACzB,kBAAQ,KAAK,qBAAqB,KAAK,QAAQ,+BAA+B;AAC9E;AAAA,QACF;AAEA,cAAM,MAAM,SAAS,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI;AACvD,cAAM,aAAa,YAAY,OAAO,UAAU,IAAI,OAAO,KAAK,YAAY,OAAO,KAAK,IAAI;AAE5F,aAAK,KAAK,IAAI,gBAAU,KAAK;AAAA,UAC3B,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,oBAAoB;AAAA,UACpB,qBAAqB,CAAC,OAAe,SAA2B;AAC9D,gBAAI,CAAC,KAAK,IAAK,QAAO,IAAI,MAAM,mBAAmB;AACnD,gBAAI;AACF,oBAAM,EAAE,gBAAgB,IAAI,UAAQ,aAAa;AACjD,oBAAM,SAAS,gBAAgB,EAAE,KAAK,KAAK,KAAK,QAAQ,OAAO,MAAM,OAAO,CAAC;AAE7E,oBAAM,aAAa,KAAK,IAAI,SAAS,QAAQ;AAC7C,oBAAM,eAAe;AAAA,EAAgC,WAAW,MAAM,UAAU,EAAG,KAAK,IAAI,CAAC;AAAA;AAAA;AAC7F,kBAAI,CAAC,iBAAiB,cAAc,KAAK,MAAM,SAAS,GAAG;AACzD,uBAAO,IAAI,MAAM,GAAG,KAAK,QAAQ,iCAAiC;AAAA,cACpE;AAAA,YACF,SAAS,GAAG;AACV,qBAAO,IAAI,MAAM,gBAAgB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,EAAE;AAAA,YAC/E;AACA,mBAAO;AAAA,UACT;AAAA,QACF,CAAQ;AAER,aAAK,GAAG,GAAG,QAAQ,MAAM;AACvB,kBAAQ,KAAK,gBAAgB,KAAK,QAAQ,EAAE;AAC5C,eAAK,UAAU;AAEf,UAAC,KAAK,GAAW,SAAS,aAAa,MAAM,GAAM;AACnD,eAAK,WAAW;AAAA,QAClB,CAAC;AAED,aAAK,GAAG,GAAG,WAAW,CAAC,SAAS,KAAK,cAAc,KAAK,SAAS,CAAC,CAAC;AAEnE,aAAK,GAAG,GAAG,SAAS,MAAM;AACxB,eAAK,QAAQ;AACb,cAAI,CAAC,KAAK,UAAW,MAAK,kBAAkB;AAAA,QAC9C,CAAC;AAED,aAAK,GAAG,GAAG,SAAS,CAAC,QAAQ;AAC3B,mBAAS,KAAK,aAAa,KAAK,QAAQ,MAAM,IAAI,OAAO,EAAE;AAC3D,eAAK,IAAI,MAAM;AAAA,QACjB,CAAC;AAAA,MACH;AAAA;AAAA;AAAA;AAAA,MAKA,MAAM,KAAK,QAAgB,SAAoC;AAC7D,YAAI,CAAC,KAAK,MAAM,KAAK,GAAG,eAAe,gBAAU,MAAM;AAErD,iBAAO,KAAK,QAAQ,QAAQ,OAAO;AAAA,QACrC;AACA,eAAO,KAAK,QAAQ,QAAQ,OAAO;AAAA,MACrC;AAAA,MAEA,IAAI,YAAqB;AAAE,eAAO,KAAK,IAAI,eAAe,gBAAU;AAAA,MAAM;AAAA,MAE1E,UAAgB;AACd,aAAK,YAAY;AACjB,YAAI,KAAK,eAAgB,cAAa,KAAK,cAAc;AACzD,aAAK,QAAQ;AACb,aAAK,IAAI,MAAM;AACf,aAAK,oBAAoB;AAAA,MAC3B;AAAA,MAEA,MAAc,QAAQ,QAAgB,SAAoC;AACxE,YAAI,CAAC,KAAK,MAAM,KAAK,GAAG,eAAe,gBAAU,MAAM;AACrD,gBAAM,IAAI,MAAM,uBAAuB,KAAK,QAAQ,EAAE;AAAA,QACxD;AACA,cAAM,KAAK,WAAW;AACtB,cAAM,SAAS,eAAe;AAE9B,cAAM,aAAa,KAAK,UAAU,OAAO;AACzC,cAAM,aAAa,YAAY,QAAQ,IAAI,MAAM,IAAI,YAAY,OAAO,KAAK,YAAY,OAAO,KAAK,IAAI;AAEzG,eAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,gBAAM,QAAQ,WAAW,MAAM;AAC7B,iBAAK,QAAQ,OAAO,EAAE;AACtB,mBAAO,IAAI,MAAM,uBAAuB,KAAK,QAAQ,IAAI,MAAM,GAAG,CAAC;AAAA,UACrE,GAAG,kBAAkB;AACrB,eAAK,QAAQ,IAAI,IAAI,EAAE,SAAS,QAAQ,MAAM,CAAC;AAC/C,eAAK,GAAI,KAAK,KAAK,UAAU,EAAE,MAAM,WAAW,IAAI,QAAQ,SAAS,GAAG,WAAW,CAAC,CAAC;AAAA,QACvF,CAAC;AAAA,MACH;AAAA,MAEQ,QAAQ,QAAgB,SAAoC;AAClE,eAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,cAAI,KAAK,OAAO,UAAU,WAAW;AACnC,kBAAM,UAAU,KAAK,OAAO,MAAM;AAClC,oBAAQ,KAAK,uBAAuB,KAAK,QAAQ,2BAA2B,QAAQ,MAAM,GAAG;AAAA,UAC/F;AACA,gBAAM,QAAoB,EAAE,QAAQ,SAAS,IAAI,WAAW,EAAE;AAC9D,eAAK,OAAO,KAAK,KAAK;AACtB,eAAK,aAAa;AAGlB,kBAAQ,EAAE,QAAQ,MAAM,IAAI,MAAM,GAAG,CAAC;AAAA,QACxC,CAAC;AAAA,MACH;AAAA,MAEQ,aAAmB;AACzB,YAAI,KAAK,OAAO,WAAW,EAAG;AAC9B,gBAAQ,KAAK,YAAY,KAAK,OAAO,MAAM,0BAA0B,KAAK,QAAQ,EAAE;AACpF,cAAM,QAAQ,KAAK,OAAO,OAAO,CAAC;AAClC,aAAK,oBAAoB;AACzB,mBAAW,SAAS,OAAO;AACzB,eAAK,QAAQ,MAAM,QAAQ,MAAM,OAAO,EAAE,MAAM,SAAO;AACrD,oBAAQ,KAAK,0BAA0B,KAAK,QAAQ,IAAI,MAAM,MAAM,KAAK,IAAI,OAAO,EAAE;AAAA,UACxF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MAEQ,eAAqB;AAC3B,YAAI;AACF,wBAAc,KAAK,WAAW,KAAK,UAAU,KAAK,MAAM,GAAG,EAAE,UAAU,SAAS,MAAM,IAAM,CAAC;AAAA,QAC/F,QAAQ;AAAA,QAAoB;AAAA,MAC9B;AAAA,MAEQ,sBAA4B;AAClC,YAAI;AAAE,cAAI,WAAW,KAAK,SAAS,EAAG,YAAW,KAAK,SAAS;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAAA,MAChG;AAAA,MAEQ,YAAkB;AACxB,YAAI;AACF,cAAI,WAAW,KAAK,SAAS,GAAG;AAC9B,kBAAM,OAAO,aAAa,KAAK,WAAW,OAAO;AACjD,kBAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,gBAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,mBAAK,SAAS,OAAO,MAAM,GAAG,SAAS;AACvC,kBAAI,KAAK,OAAO,SAAS,GAAG;AAC1B,wBAAQ,KAAK,UAAU,KAAK,OAAO,MAAM,0BAA0B,KAAK,QAAQ,YAAY;AAAA,cAC9F;AAAA,YACF;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAAiD;AAAA,MAC3D;AAAA,MAEQ,cAAc,KAAmB;AACvC,YAAI;AACF,gBAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,cAAI,IAAI,SAAS,cAAc,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,EAAE,GAAG;AACjE,kBAAM,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE;AACjC,iBAAK,QAAQ,OAAO,IAAI,EAAE;AAC1B,yBAAa,EAAE,KAAK;AACpB,cAAE,QAAQ,IAAI,OAAO;AAAA,UACvB,WAAW,IAAI,SAAS,QAAQ;AAC9B,iBAAK,cAAc,IAAI,QAAQ,IAAI,OAAO;AAAA,UAC5C;AAAA,QACF,QAAQ;AAAA,QAA2B;AAAA,MACrC;AAAA,MAEQ,UAAgB;AAEtB,mBAAW,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS;AAChC,uBAAa,EAAE,KAAK;AACpB,YAAE,OAAO,IAAI,MAAM,sBAAsB,CAAC;AAAA,QAC5C;AACA,aAAK,QAAQ,MAAM;AAAA,MACrB;AAAA,MAEQ,oBAA0B;AAChC,cAAM,SAAS,KAAK,WAAW,MAAM,KAAK,OAAO,IAAI;AACrD,iBAAS,KAAK,mBAAmB,KAAK,QAAQ,OAAO,KAAK,MAAM,MAAM,CAAC,IAAI;AAC3E,aAAK,iBAAiB,WAAW,MAAM;AACrC,eAAK,iBAAiB;AACtB,eAAK,QAAQ;AAAA,QACf,GAAG,MAAM;AACT,aAAK,UAAU,KAAK,IAAI,KAAK,UAAU,GAAG,cAAc;AAAA,MAC1D;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,OAAO,YAAoB,gBAAwB,eAAuB,UAAiC;AAC/G,cAAM,EAAE,YAAY,IAAI,MAAM,OAAO,aAAa;AAClD,cAAM;AAAA,UACJ;AAAA,UAAU;AAAA,UAAY;AAAA,QACxB,IAAI,MAAM,OAAO,yBAAgB;AACjC,cAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,2BAAmB;AACjE,cAAM,EAAE,eAAAA,gBAAe,YAAY,QAAQ,UAAU,IAAI,MAAM,OAAO,SAAS;AAE/E,cAAM,YAAY,SAAS,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI;AAC7D,cAAM,SAAS,YAAY,EAAE,EAAE,SAAS,KAAK;AAC7C,cAAM,QAAQ,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE1C,eAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAEtC,gBAAM,WAAW,IAAI,gBAAU,WAAW;AAAA,YACxC,YAAY;AAAA,YACZ,oBAAoB;AAAA;AAAA,UACtB,CAAQ;AAER,cAAI,QAAQ;AACZ,cAAI,SAAS;AACb,cAAI,UAAU;AAEd,mBAAS,GAAG,QAAQ,MAAM;AAExB,qBAAS,KAAK,KAAK,UAAU;AAAA,cAC3B,UAAU;AAAA,cACV,SAAS;AAAA,cACT,IAAI;AAAA,YACN,CAAC,CAAC;AACF,oBAAQ;AAAA,UACV,CAAC;AAED,mBAAS,GAAG,WAAW,OAAO,YAAY;AACxC,gBAAI;AACF,oBAAM,MAAM,KAAK,MAAM,QAAQ,SAAS,CAAC;AAEzC,kBAAI,UAAU,GAAG;AAEf,sBAAM,EAAE,UAAU,SAAS,IAAI,MAAM,IAAI;AACzC,oBAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO;AAAE,yBAAO,IAAI,MAAM,mBAAmB,CAAC;AAAG,2BAAS,MAAM;AAAG;AAAA,gBAAQ;AAGzG,sBAAM,eAAe,SAAS,YAAY,WAAW,MAAM;AAC3D,oBAAI,UAAU,cAAc;AAAE,yBAAO,IAAI,MAAM,4CAAuC,CAAC;AAAG,2BAAS,MAAM;AAAG;AAAA,gBAAQ;AAEpH,yBAAS;AACT,0BAAU;AACV,wBAAQ;AAGR,sBAAM,OAAO,SAAS,YAAY,gBAAgB,MAAM;AACxD,sBAAM,UAAU,WAAW,gBAAgB,eAAe,QAAQ,QAAQ;AAC1E,yBAAS,KAAK,KAAK,UAAU;AAAA,kBAC3B,OAAO;AAAA,kBACP,MAAM;AAAA,kBACN,SAAS;AAAA,kBACT,IAAI,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,kBAChC;AAAA,gBACF,CAAC,CAAC;AACF;AAAA,cACF;AAEA,kBAAI,UAAU,GAAG;AAEf,sBAAM,EAAE,QAAQ,UAAU,UAAU,OAAO,IAAI;AAC/C,oBAAI,CAAC,UAAU,CAAC,QAAQ;AAAE,yBAAO,IAAI,MAAM,aAAa,CAAC;AAAG,2BAAS,MAAM;AAAG;AAAA,gBAAQ;AAEtF,oBAAI,CAAC,UAAU,QAAQ,UAAU,QAAQ,UAAU,MAAM,GAAG;AAC1D,yBAAO,IAAI,MAAM,uBAAuB,CAAC;AAAG,2BAAS,MAAM;AAAG;AAAA,gBAChE;AAGA,sBAAM,YAAY,KAAK,WAAW,GAAG,UAAU,YAAY;AAC3D,oBAAI,MAA+B,CAAC;AACpC,oBAAI,OAAO,SAAS,GAAG;AAAE,sBAAI;AAAE,0BAAM,KAAK,MAAM,UAAQ,IAAI,EAAE,aAAa,WAAW,OAAO,CAAC;AAAA,kBAAG,QAAQ;AAAE,0BAAM,CAAC;AAAA,kBAAG;AAAA,gBAAE;AACvH,oBAAI,CAAC,IAAI,SAAS,OAAO,IAAI,UAAU,SAAU,KAAI,QAAQ,CAAC;AAC9D,gBAAC,IAAI,MAAkC,MAAM,IAAI;AAAA,kBAC/C,MAAM,KAAK,MAAM;AAAA,kBACjB,MAAM,KAAK,MAAM;AAAA,kBACjB,WAAW;AAAA,kBACX,OAAO;AAAA,kBACP,WAAW;AAAA,gBACb;AACA,gBAAAA,eAAc,WAAW,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,UAAU,QAAQ,CAAC;AACnF,qCAAqB;AAErB,wBAAQ,KAAK,kBAAkB,MAAM,cAAc;AAEnD,qBAAK,KAAK;AACV,yBAAS,mBAAmB,SAAS;AACrC,yBAAS,GAAG,WAAW,CAAC,SAAS,KAAK,cAAc,KAAK,SAAS,CAAC,CAAC;AACpE,yBAAS,GAAG,SAAS,MAAM;AAAE,uBAAK,QAAQ;AAAG,sBAAI,CAAC,KAAK,UAAW,MAAK,kBAAkB;AAAA,gBAAG,CAAC;AAC7F,yBAAS,GAAG,SAAS,CAAC,QAAQ;AAAE,2BAAS,KAAK,aAAa,KAAK,QAAQ,MAAM,IAAI,OAAO,EAAE;AAAG,uBAAK,IAAI,MAAM;AAAA,gBAAG,CAAC;AACjH,wBAAQ;AAAA,cACV;AAAA,YACF,SAAS,KAAK;AACZ,qBAAO,GAAG;AACV,uBAAS,MAAM;AAAA,YACjB;AAAA,UACF,CAAC;AAED,mBAAS,GAAG,SAAS,CAAC,QAAQ,OAAO,IAAI,MAAM,wBAAwB,IAAI,OAAO,EAAE,CAAC,CAAC;AACtF,mBAAS,GAAG,SAAS,CAAC,MAAM,WAAW;AACrC,gBAAI,QAAQ,EAAG,QAAO,IAAI,MAAM,+BAA+B,IAAI,IAAI,MAAM,EAAE,CAAC;AAAA,UAClF,CAAC;AAED,qBAAW,MAAM;AAAE,gBAAI,QAAQ,GAAG;AAAE,qBAAO,IAAI,MAAM,oBAAoB,CAAC;AAAG,uBAAS,MAAM;AAAA,YAAG;AAAA,UAAE,GAAG,GAAM;AAAA,QAC5G,CAAC;AAAA,MACH;AAAA,IACF;AAAA;AAAA;",
+  "names": ["writeFileSync"]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abtars",
-  "version": "0.3.4-alpha.7",
+  "version": "0.3.4",
   "description": "Agentic framework for connecting LLMs to messaging platforms, with persistent memory, skills, scheduled tasks, self-healing supervision, and distributed multi-agent collaboration",
   "type": "module",
   "main": "bundle/abtars.js",

package/scripts/abtars-watchdog.service

@@ -5,7 +5,8 @@ After=network.target
 [Service]
 Type=simple
 ExecStart=%h/.abtars-releases/src/abtars/scripts/abtars-watchdog.sh
-Restart=on-success
+Restart=always
+RestartPreventExitStatus=2
 RestartSec=5
 Environment=PATH=%h/.abtars/bin:%h/.local/bin:%h/.npm-global/bin:/usr/local/bin:/usr/bin:/bin
 Environment=NODE_PATH=%h/.local/lib/node_modules

package/scripts/abtars-watchdog.sh

@@ -5,7 +5,6 @@ AB="${ABTARS_HOME:-$HOME/.abtars}"
 LOCK="$AB/bridge.lock"
 STALE=300
 POLL=60
-LOG="$AB/logs/bridge.log"
 STATE="$AB/deploy.state"
 
 # Singleton: flock (Linux) / lockf (macOS)
@@ -59,15 +58,12 @@ while true; do
       exit 0 ;;
   esac
 
-  # Pre-flight doctor
-  command -v abtars &>/dev/null && abtars doctor --fix >> "$AB/logs/watchdog.log" 2>&1 || true
-
   # Start bridge
   BRIDGE_REASON="${REASON:-watchdog-respawn}"
   # #1261: exec replaces the subshell with the env->nohup->node chain so $! is the real node PID.
   # Without exec, bash forks a subshell for `cd && env=value cmd &` and $! returns the subshell,
   # leaving node as a grandchild that gets orphaned when the subshell dies.
-  cd "$AB" && exec env ABTARS_WATCHDOG_PID=$$ NODE_PATH="$HOME/.local/lib/node_modules:${NODE_PATH:-}" ABTARS_START_REASON="$BRIDGE_REASON" nohup node --max-old-space-size=1024 app/bundle/abtars.js >> "$LOG" 2>&1 200>&- &
+  cd "$AB" && exec env ABTARS_WATCHDOG_PID=$$ NODE_PATH="$HOME/.local/lib/node_modules:${NODE_PATH:-}" ABTARS_START_REASON="$BRIDGE_REASON" nohup node --max-old-space-size=1024 app/bundle/abtars.js 200>&- &
   PID=$!
   disown $PID
   SPAWNED_AT=$(date +%s)

package/scripts/emergency-deploy.sh

@@ -77,10 +77,10 @@ echo "Restarting..."
 if launchctl list 2>/dev/null | grep -q abtars; then
   echo "LaunchAgent manages watchdog — it will restart the bridge."
 elif [ -f "$HOME_DIR/scripts/abtars-watchdog.sh" ]; then
-  nohup bash "$HOME_DIR/scripts/abtars-watchdog.sh" >> "$HOME_DIR/logs/watchdog.log" 2>&1 &
+  nohup bash "$HOME_DIR/scripts/abtars-watchdog.sh" &
   echo "Watchdog restarted (PID $!) — it will start the bridge."
 else
-  nohup node "$HOME_DIR/app/bundle/abtars.js" >> "$HOME_DIR/logs/bridge.log" 2>&1 &
+  nohup node "$HOME_DIR/app/bundle/abtars.js" &
   echo $! > "$HOME_DIR/bridge.pid"
   echo "Bridge started (PID $!)."
 fi