echoclaw-relay-agent 0.8.0 → 0.8.2

package/dist/RelayAgent.d.ts

@@ -29,6 +29,8 @@ export declare class RelayAgent extends EventEmitter {
     private _dataHandler;
     private _stopped;
     private _starting;
+    private _paired;
+    private _activePairing;
     private readonly config;
     private readonly subscribers;
     private gatewayManager;

package/dist/RelayAgent.js

@@ -91,6 +91,18 @@ export class RelayAgent extends EventEmitter {
             writable: true,
             value: false
         });
+        Object.defineProperty(this, "_paired", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "_activePairing", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
         Object.defineProperty(this, "config", {
             enumerable: true,
             configurable: true,
@@ -194,6 +206,9 @@ export class RelayAgent extends EventEmitter {
     /** Gracefully stop the agent. */
     async stop() {
         this._stopped = true;
+        this._paired = false;
+        this._activePairing?.abort();
+        this._activePairing = null;
         this.gatewayManager?.stop();
         this.transport?.disconnect();
         this.transport = null;
@@ -245,12 +260,21 @@ export class RelayAgent extends EventEmitter {
             await this.onPaired(result);
         }
         catch (err) {
-            // Resume failed — clear stale session to prevent infinite retry loop
+            // Resume failed — only clear session for permanent errors
             this.transport?.disconnect();
             this.transport = null;
             this.frameCrypto = null;
             this.setStatus('disconnected');
-            await this.sessionStore.clear();
+            const errMsg = err instanceof Error ? err.message : String(err);
+            const isPermanent = errMsg.includes('DEVICE_TOKEN_MISMATCH') ||
+                errMsg.includes('SESSION_NOT_FOUND') ||
+                errMsg.includes('SESSION_EXPIRED') ||
+                errMsg.includes('INVALID_SESSION');
+            if (isPermanent) {
+                // Permanent rejection — session is truly dead, clear it
+                await this.sessionStore.clear();
+            }
+            // Transient errors (network, timeout) — keep session.json for retry
             throw err;
         }
     }
@@ -259,6 +283,8 @@ export class RelayAgent extends EventEmitter {
         this.sessionId = result.sessionId;
         this.pairingCode = result.pairingCode;
         this.frameCrypto = new FrameCrypto(result.sessionKey);
+        this._paired = true;
+        this._activePairing = null;
         // Persist session for future auto-resume
         await this.sessionStore.save({
             pairingCode: result.pairingCode,
@@ -346,18 +372,33 @@ export class RelayAgent extends EventEmitter {
             this.emit('error', err);
         });
         this.transport.on('open', () => {
-            if (this.sessionKey) {
-                this.setStatus('connected');
-                this.emit('connected');
-                // V2: Reattach gateway callbacks after reconnect
-                if (this.gatewayManager) {
-                    this.gatewayManager.onReconnected(async (r) => {
-                        try {
-                            await this.send(r);
-                        }
-                        catch { /* send may fail */ }
-                    });
-                }
+            if (this._paired && this.transport) {
+                // Transport reconnected after prior successful pairing —
+                // redo ECDH because desktop may have new ephemeral keys.
+                // Cancel any in-flight pairing and invalidate old crypto state.
+                this._activePairing?.abort();
+                this.sessionKey = null;
+                this.frameCrypto = null;
+                this.setStatus('connecting');
+                const pairing = new PairingProtocol(this.transport);
+                this._activePairing = pairing;
+                pairing.pairAsAgent()
+                    .then(result => {
+                    this.onPaired(result);
+                    // V2: Reattach gateway callbacks after reconnect
+                    if (this.gatewayManager) {
+                        this.gatewayManager.onReconnected(async (r) => {
+                            try {
+                                await this.send(r);
+                            }
+                            catch { /* send may fail */ }
+                        });
+                    }
+                })
+                    .catch(err => {
+                    this._activePairing = null;
+                    this.emit('error', err);
+                });
             }
         });
     }

package/dist/RelayClient.d.ts

@@ -34,6 +34,9 @@ export declare class RelayClient extends EventEmitter {
     private _status;
     private _connecting;
     private _stopped;
+    private _paired;
+    private _needsRekey;
+    private _activePairing;
     private readonly config;
     private readonly sessionStore;
     private readonly subscribers;

package/dist/RelayClient.js

@@ -79,6 +79,24 @@ export class RelayClient extends EventEmitter {
             writable: true,
             value: false
         });
+        Object.defineProperty(this, "_paired", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "_needsRekey", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "_activePairing", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
         Object.defineProperty(this, "config", {
             enumerable: true,
             configurable: true,
@@ -178,6 +196,10 @@ export class RelayClient extends EventEmitter {
     /** Disconnect from the relay. */
     async disconnect() {
         this._stopped = true;
+        this._paired = false;
+        this._needsRekey = false;
+        this._activePairing?.abort();
+        this._activePairing = null;
         this.transport?.disconnect();
         this.transport = null;
         this.sessionKey = null;
@@ -250,6 +272,8 @@ export class RelayClient extends EventEmitter {
         this.sessionId = result.sessionId;
         this.pairingCode = result.pairingCode;
         this.frameCrypto = new FrameCrypto(result.sessionKey);
+        this._paired = true;
+        this._activePairing = null;
         // Update transport URL so auto-reconnect uses ?resume=sessionId
         // instead of the original /client/connect (which would create a new session)
         if (this.transport) {
@@ -319,8 +343,34 @@ export class RelayClient extends EventEmitter {
         this.transport.on('error', (err) => {
             this.emit('error', err);
         });
+        // Listen for server CLOSE messages (e.g. AGENT_RESTARTED) to know re-ECDH is needed.
+        // Without this, normal network drops would unnecessarily trigger re-ECDH.
+        this.transport.on('message', (msg) => {
+            if (msg.type === 'CLOSE' && msg.sender_role === 'server') {
+                this._needsRekey = true;
+            }
+        });
         this.transport.on('open', () => {
-            if (this.sessionKey) {
+            if (this._paired && this._needsRekey && this.pairingCode && this.transport) {
+                // Server requested re-ECDH (e.g. AGENT_RESTARTED) —
+                // cancel any in-flight pairing and start fresh handshake.
+                // Invalidate old crypto state to prevent sending with stale keys.
+                this._needsRekey = false;
+                this._activePairing?.abort();
+                this.sessionKey = null;
+                this.frameCrypto = null;
+                this.setStatus('connecting');
+                const pairing = new PairingProtocol(this.transport);
+                this._activePairing = pairing;
+                pairing.pairAsClient(this.pairingCode)
+                    .then(result => this.onPaired(result, 'resumed'))
+                    .catch(err => {
+                    this._activePairing = null;
+                    this.emit('error', err);
+                });
+            }
+            else if (this.sessionKey) {
+                // Normal reconnect (network drop) — old session key still valid
                 this.setStatus('connected');
                 this.emit('connected');
             }

package/dist/cli.js

@@ -234,6 +234,13 @@ async function runSetup(code, relay, bridgePort) {
     console.log();
     // Step 2: Stop the foreground agent (service will take over)
     await agent.stop();
+    // Verify session.json exists before installing service
+    const { SessionStore } = await import('./relay/SessionStore.js');
+    const store = new SessionStore();
+    const savedSession = await store.load();
+    if (!savedSession) {
+        throw new Error('Session file not found after pairing — cannot install service. Try setup again.');
+    }
     // Step 3: Install as system service (WITHOUT pairing code — it resumes from session)
     printStep('2/3', 'Installing system service...');
     const svc = await getServiceManager();
@@ -354,7 +361,32 @@ async function runDaemon(relay, code, gateway, bridgePort) {
     process.once('SIGINT', shutdown);
     process.once('SIGTERM', shutdown);
     console.log(`  [start] relay=${relay} gateway=${!!gateway}`);
-    await agent.start(code);
+    // Retry logic — transient failures (network, server restart) shouldn't kill the service
+    const MAX_RETRIES = 5;
+    const RETRY_DELAY = 3000;
+    let lastErr;
+    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+        try {
+            await agent.start(code);
+            return; // success — stay alive
+        }
+        catch (err) {
+            lastErr = err;
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`  [start-failed] attempt=${attempt}/${MAX_RETRIES} error=${msg}`);
+            // Permanent errors — don't retry
+            if (msg.includes('No saved session found') ||
+                msg.includes('DEVICE_TOKEN_MISMATCH') ||
+                msg.includes('SESSION_NOT_FOUND')) {
+                break;
+            }
+            if (attempt < MAX_RETRIES) {
+                console.log(`  [retry] waiting ${RETRY_DELAY / 1000}s...`);
+                await new Promise(r => setTimeout(r, RETRY_DELAY));
+            }
+        }
+    }
+    throw lastErr;
 }
 // ── Main ─────────────────────────────────────────────────────
 async function main() {

package/dist/relay/PairingProtocol.d.ts

@@ -24,7 +24,10 @@ export interface PairingResult {
 export declare class PairingProtocol extends EventEmitter {
     private readonly transport;
     private keyPair;
+    private _cleanup;
     constructor(transport: RelayTransport);
+    /** Abort an in-flight pairing attempt. Safe to call multiple times. */
+    abort(): void;
     /**
      * Agent-side pairing: register with relay, wait for client to pair.
      * Returns the E2E session key once pairing is complete.

package/dist/relay/PairingProtocol.js

@@ -31,6 +31,17 @@ export class PairingProtocol extends EventEmitter {
             writable: true,
             value: null
         });
+        Object.defineProperty(this, "_cleanup", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
+    }
+    /** Abort an in-flight pairing attempt. Safe to call multiple times. */
+    abort() {
+        this._cleanup?.();
+        this._cleanup = null;
     }
     /**
      * Agent-side pairing: register with relay, wait for client to pair.
@@ -52,7 +63,10 @@ export class PairingProtocol extends EventEmitter {
                 resolved = true;
                 clearTimeout(timeout);
                 this.transport.removeListener('message', onMessage);
+                this._cleanup = null;
             };
+            // Expose cleanup for external abort()
+            this._cleanup = cleanup;
             const onMessage = async (msg) => {
                 if (resolved)
                     return;
@@ -124,7 +138,10 @@ export class PairingProtocol extends EventEmitter {
                 clearTimeout(timeout);
                 this.transport.removeListener('message', onMessage);
                 this.transport.removeListener('open', onOpen);
+                this._cleanup = null;
             };
+            // Expose cleanup for external abort()
+            this._cleanup = cleanup;
             const sendPubkey = () => {
                 if (sentHello)
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "echoclaw-relay-agent",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "EchoClaw Relay Connection — E2E encrypted relay transport, pairing, and session management",
   "type": "module",
   "main": "./dist/index.js",