echoclaw-relay-agent 0.15.2 → 0.15.3

package/dist/RelayAgent.js

@@ -311,7 +311,16 @@ export class RelayAgent extends EventEmitter {
             this.emit('pairing_code', receivedCode);
         });
         const result = await this.pairing.pairAsAgent(code);
-        await this.onPaired(result, true); // fresh pairing — force identity exchange
+        try {
+            await this.onPaired(result, true); // fresh pairing — force identity exchange
+        }
+        catch (err) {
+            // Identity exchange failed on fresh pairing — tear down transport to
+            // prevent leaking an authenticated-but-unusable WebSocket, then re-throw.
+            // Do NOT emit('error') here — the throw propagates to start() caller.
+            this.transport?.disconnect();
+            throw err;
+        }
     }
     async resumeSession(session) {
         this.setStatus('connecting');
@@ -538,7 +547,14 @@ export class RelayAgent extends EventEmitter {
                 await this._handleIdentityExchange(sessionData, freshPairing);
             }
             catch (err) {
-                this.emit('error', new IdentityExchangeError(`Identity exchange failed: ${err instanceof Error ? err.message : err}`));
+                const ixErr = new IdentityExchangeError(`Identity exchange failed: ${err instanceof Error ? err.message : err}`);
+                if (freshPairing) {
+                    // Fresh pairing MUST establish identity — re-throw to fail the
+                    // connection; reconnect will retry with a new ECDH handshake.
+                    throw ixErr;
+                }
+                // Resume/re-key: non-fatal — identity was already established previously.
+                this.emit('error', ixErr);
             }
         }
         // Persist session (with identity fields if exchange succeeded)

package/dist/RelayClient.js

@@ -282,7 +282,16 @@ export class RelayClient extends EventEmitter {
             this.emit('pairing_code', code);
         });
         const result = await pairing.pairAsClient(); // no code = initiator mode
-        await this.onPaired(result, 'paired');
+        try {
+            await this.onPaired(result, 'paired');
+        }
+        catch (err) {
+            // Identity exchange failed on fresh pairing — tear down transport to
+            // prevent leaking an authenticated-but-unusable WebSocket, then re-throw.
+            // Do NOT emit('error') here — the throw propagates to connect() caller.
+            this.transport?.disconnect();
+            throw err;
+        }
     }
     async resumeSession(session) {
         this.setStatus('connecting');
@@ -510,15 +519,22 @@ export class RelayClient extends EventEmitter {
         // On fresh pairing (event='paired'): always exchange, even if we had a previous peer
         //   — this handles the case where user pairs with a NEW agent machine.
         // On resume/re-key (event='resumed'): only exchange if not already done.
-        const shouldExchange = event === 'paired' || !this._identityExchanged;
+        const freshPairing = event === 'paired';
+        const shouldExchange = freshPairing || !this._identityExchanged;
         if (shouldExchange) {
             try {
-                await this._performIdentityExchange(sessionData, event === 'paired');
+                await this._performIdentityExchange(sessionData, freshPairing);
             }
             catch (err) {
-                // Identity exchange failure is non-fatal — connection works without it,
-                // but identity reconnect won't be available.
-                this.emit('error', new IdentityExchangeError(`Identity exchange failed: ${err instanceof Error ? err.message : err}`));
+                const ixErr = new IdentityExchangeError(`Identity exchange failed: ${err instanceof Error ? err.message : err}`);
+                if (freshPairing) {
+                    // Fresh pairing MUST establish identity — without it, identity reconnect
+                    // is permanently unavailable for this pairing. Re-throw to fail the
+                    // connection; user can retry with a new pairing code.
+                    throw ixErr;
+                }
+                // Resume/re-key: non-fatal — identity was already established previously.
+                this.emit('error', ixErr);
             }
         }
         // Persist session (with identity fields if exchange succeeded)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "echoclaw-relay-agent",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "description": "EchoClaw Relay Connection — E2E encrypted relay transport, pairing, and session management",
   "type": "module",
   "main": "./dist/index.js",