echoclaw-relay-agent 0.8.1 → 0.8.2

package/dist/RelayAgent.d.ts

@@ -29,6 +29,8 @@ export declare class RelayAgent extends EventEmitter {
     private _dataHandler;
     private _stopped;
     private _starting;
+    private _paired;
+    private _activePairing;
     private readonly config;
     private readonly subscribers;
     private gatewayManager;

package/dist/RelayAgent.js

@@ -91,6 +91,18 @@ export class RelayAgent extends EventEmitter {
             writable: true,
             value: false
         });
+        Object.defineProperty(this, "_paired", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "_activePairing", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
         Object.defineProperty(this, "config", {
             enumerable: true,
             configurable: true,
@@ -194,6 +206,9 @@ export class RelayAgent extends EventEmitter {
     /** Gracefully stop the agent. */
     async stop() {
         this._stopped = true;
+        this._paired = false;
+        this._activePairing?.abort();
+        this._activePairing = null;
         this.gatewayManager?.stop();
         this.transport?.disconnect();
         this.transport = null;
@@ -268,6 +283,8 @@ export class RelayAgent extends EventEmitter {
         this.sessionId = result.sessionId;
         this.pairingCode = result.pairingCode;
         this.frameCrypto = new FrameCrypto(result.sessionKey);
+        this._paired = true;
+        this._activePairing = null;
         // Persist session for future auto-resume
         await this.sessionStore.save({
             pairingCode: result.pairingCode,
@@ -355,18 +372,33 @@ export class RelayAgent extends EventEmitter {
             this.emit('error', err);
         });
         this.transport.on('open', () => {
-            if (this.sessionKey) {
-                this.setStatus('connected');
-                this.emit('connected');
-                // V2: Reattach gateway callbacks after reconnect
-                if (this.gatewayManager) {
-                    this.gatewayManager.onReconnected(async (r) => {
-                        try {
-                            await this.send(r);
-                        }
-                        catch { /* send may fail */ }
-                    });
-                }
+            if (this._paired && this.transport) {
+                // Transport reconnected after prior successful pairing —
+                // redo ECDH because desktop may have new ephemeral keys.
+                // Cancel any in-flight pairing and invalidate old crypto state.
+                this._activePairing?.abort();
+                this.sessionKey = null;
+                this.frameCrypto = null;
+                this.setStatus('connecting');
+                const pairing = new PairingProtocol(this.transport);
+                this._activePairing = pairing;
+                pairing.pairAsAgent()
+                    .then(result => {
+                    this.onPaired(result);
+                    // V2: Reattach gateway callbacks after reconnect
+                    if (this.gatewayManager) {
+                        this.gatewayManager.onReconnected(async (r) => {
+                            try {
+                                await this.send(r);
+                            }
+                            catch { /* send may fail */ }
+                        });
+                    }
+                })
+                    .catch(err => {
+                    this._activePairing = null;
+                    this.emit('error', err);
+                });
             }
         });
     }

package/dist/RelayClient.d.ts

@@ -34,6 +34,9 @@ export declare class RelayClient extends EventEmitter {
     private _status;
     private _connecting;
     private _stopped;
+    private _paired;
+    private _needsRekey;
+    private _activePairing;
     private readonly config;
     private readonly sessionStore;
     private readonly subscribers;

package/dist/RelayClient.js

@@ -79,6 +79,24 @@ export class RelayClient extends EventEmitter {
             writable: true,
             value: false
         });
+        Object.defineProperty(this, "_paired", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "_needsRekey", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "_activePairing", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
         Object.defineProperty(this, "config", {
             enumerable: true,
             configurable: true,
@@ -178,6 +196,10 @@ export class RelayClient extends EventEmitter {
     /** Disconnect from the relay. */
     async disconnect() {
         this._stopped = true;
+        this._paired = false;
+        this._needsRekey = false;
+        this._activePairing?.abort();
+        this._activePairing = null;
         this.transport?.disconnect();
         this.transport = null;
         this.sessionKey = null;
@@ -250,6 +272,8 @@ export class RelayClient extends EventEmitter {
         this.sessionId = result.sessionId;
         this.pairingCode = result.pairingCode;
         this.frameCrypto = new FrameCrypto(result.sessionKey);
+        this._paired = true;
+        this._activePairing = null;
         // Update transport URL so auto-reconnect uses ?resume=sessionId
         // instead of the original /client/connect (which would create a new session)
         if (this.transport) {
@@ -319,8 +343,34 @@ export class RelayClient extends EventEmitter {
         this.transport.on('error', (err) => {
             this.emit('error', err);
         });
+        // Listen for server CLOSE messages (e.g. AGENT_RESTARTED) to know re-ECDH is needed.
+        // Without this, normal network drops would unnecessarily trigger re-ECDH.
+        this.transport.on('message', (msg) => {
+            if (msg.type === 'CLOSE' && msg.sender_role === 'server') {
+                this._needsRekey = true;
+            }
+        });
         this.transport.on('open', () => {
-            if (this.sessionKey) {
+            if (this._paired && this._needsRekey && this.pairingCode && this.transport) {
+                // Server requested re-ECDH (e.g. AGENT_RESTARTED) —
+                // cancel any in-flight pairing and start fresh handshake.
+                // Invalidate old crypto state to prevent sending with stale keys.
+                this._needsRekey = false;
+                this._activePairing?.abort();
+                this.sessionKey = null;
+                this.frameCrypto = null;
+                this.setStatus('connecting');
+                const pairing = new PairingProtocol(this.transport);
+                this._activePairing = pairing;
+                pairing.pairAsClient(this.pairingCode)
+                    .then(result => this.onPaired(result, 'resumed'))
+                    .catch(err => {
+                    this._activePairing = null;
+                    this.emit('error', err);
+                });
+            }
+            else if (this.sessionKey) {
+                // Normal reconnect (network drop) — old session key still valid
                 this.setStatus('connected');
                 this.emit('connected');
             }

package/dist/relay/PairingProtocol.d.ts

@@ -24,7 +24,10 @@ export interface PairingResult {
 export declare class PairingProtocol extends EventEmitter {
     private readonly transport;
     private keyPair;
+    private _cleanup;
     constructor(transport: RelayTransport);
+    /** Abort an in-flight pairing attempt. Safe to call multiple times. */
+    abort(): void;
     /**
      * Agent-side pairing: register with relay, wait for client to pair.
      * Returns the E2E session key once pairing is complete.

package/dist/relay/PairingProtocol.js

@@ -31,6 +31,17 @@ export class PairingProtocol extends EventEmitter {
             writable: true,
             value: null
         });
+        Object.defineProperty(this, "_cleanup", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
+    }
+    /** Abort an in-flight pairing attempt. Safe to call multiple times. */
+    abort() {
+        this._cleanup?.();
+        this._cleanup = null;
     }
     /**
      * Agent-side pairing: register with relay, wait for client to pair.
@@ -52,7 +63,10 @@ export class PairingProtocol extends EventEmitter {
                 resolved = true;
                 clearTimeout(timeout);
                 this.transport.removeListener('message', onMessage);
+                this._cleanup = null;
             };
+            // Expose cleanup for external abort()
+            this._cleanup = cleanup;
             const onMessage = async (msg) => {
                 if (resolved)
                     return;
@@ -124,7 +138,10 @@ export class PairingProtocol extends EventEmitter {
                 clearTimeout(timeout);
                 this.transport.removeListener('message', onMessage);
                 this.transport.removeListener('open', onOpen);
+                this._cleanup = null;
             };
+            // Expose cleanup for external abort()
+            this._cleanup = cleanup;
             const sendPubkey = () => {
                 if (sentHello)
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "echoclaw-relay-agent",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "EchoClaw Relay Connection — E2E encrypted relay transport, pairing, and session management",
   "type": "module",
   "main": "./dist/index.js",