ftown 0.20.9 → 0.24.0

package/dist/ledger-startup.js

@@ -0,0 +1,233 @@
+/*
+ * Account-mode startup decisions (passkey ledger), kept out of index.ts so each one is unit-tested:
+ * - step 2: which identity reset runs before anything else (resetIdentityForStart);
+ * - steps 3-4: pairing, ledger recovery and this bridge's own status (startAccountIdentity);
+ * - steps 5-6: the first relay token (online, offline or exit) and the endpoint registration (startRelay, createEndpointRegistrar).
+ * Solo and --local never enter any of it: they only finish a reset that is already pending, exactly as before.
+ */
+import { beginIdentityReset, completePendingIdentityReset } from './identity-reset.js';
+import { hasLegacyAccountState, loadOrCreateLedgerIdentity, readLedgerIdentity } from './security/bridge/ledger-identity.js';
+import { BridgeLedgerStore, LedgerStoreError, reconcileIdentityAndStore } from './security/bridge/ledger-store.js';
+import { MISSING_RELAY_URL_MESSAGE, isRefusal, relayTokenFailureMessage } from './ledger-relay.js';
+export const LEGACY_ACCOUNT_RESET_MESSAGE = '[Bridge] Old account data from a previous ftown version was cleared. Pair this computer again with the link below.';
+export const NOT_IN_LEDGER_MESSAGE = "This computer is not in your account's ledger. Run `ftown start --new-identity` to pair it again.";
+export const PAIRING_REJECTED_HINT = 'Pairing did not complete. Run `ftown start` to try again.';
+export const PAIRING_REVOKED_MESSAGE = "[Bridge] This computer's id was removed from the account before pairing completed. "
+    + 'Run `ftown start --new-identity` to pair it with a new id.';
+export const SERVER_LEDGER_MISMATCH_MESSAGE = "[Bridge] The server's account ledger does not list this computer. If it was removed from your account, run `ftown start --new-identity` to pair it again.";
+export const UPDATE_RESTART_UNPAIRED_MESSAGE = '[Bridge] An update restart cannot pair this computer. Run `ftown start` to pair it.';
+export const UPDATED_TO_LEDGER_MESSAGE = '[Bridge] ftown was updated to the passkey ledger; run `ftown start` to pair this computer.';
+export const DO_NOT_RESET_LINE = '[Bridge] Do NOT run --new-identity: this computer may hold the only copy. Open Security in the dashboard to choose a history.';
+export const HELD_OFFLINE_LINE = '[Bridge] Starting offline: local sessions keep working, and the relay is retried in the background.';
+export const HELD_NO_RELAY_URL_LINE = '[Bridge] No relay URL was saved by an earlier start, so this computer cannot start offline. Run `ftown start` again later.';
+const plural = (count, word) => `${count} ${word}${count === 1 ? '' : 's'}`;
+/** Printed once when the server refuses the key of a computer that is an active member of its own history (step 5): never reset advice. */
+export function heldHistoryNotice(unique) {
+    const detail = unique === null || unique.records === 0
+        ? 'this computer holds changes the server does not have'
+        : `this computer holds account history the server does not have: ${plural(unique.removals, 'removal')} and ${plural(unique.passkeys, 'passkey')} `
+            + `among ${plural(unique.records, 'change')} after revision ${unique.afterRevision}`;
+    return [`[Bridge] The ftown server refused this computer's key, and ${detail}.`, DO_NOT_RESET_LINE];
+}
+/** Only account bridges use the passkey ledger (legacy reset, pairing, ledger replica, relay token by proof). */
+export function usesLedger(mode) {
+    return mode === 'account';
+}
+/**
+ * Step 2. Account mode: `--new-identity`, or any v1 account state on disk, starts a manual reset (the latter says so in one line).
+ * An update restart (a v1 -> v2 auto-update) has no visible terminal for the pairing link: with v1 state on disk it changes nothing
+ * and exits, and the next `ftown start` resets and pairs. Every mode then finishes a pending reset, as before (a revoked restart or a
+ * crash may have left one).
+ */
+export function resetIdentityForStart(input, deps = {}) {
+    const legacy = deps.hasLegacyAccountState ?? hasLegacyAccountState;
+    const begin = deps.beginIdentityReset ?? beginIdentityReset;
+    const complete = deps.completePendingIdentityReset ?? completePendingIdentityReset;
+    if (usesLedger(input.mode)) {
+        if (input.newIdentity)
+            begin(input.dataDir, 'manual');
+        else if (legacy(input.dataDir)) {
+            if (input.updateRestart)
+                return { kind: 'exit', message: UPDATED_TO_LEDGER_MESSAGE };
+            input.log(LEGACY_ACCOUNT_RESET_MESSAGE);
+            begin(input.dataDir, 'manual');
+        }
+    }
+    return { kind: 'continue', reset: complete(input.dataDir) };
+}
+/** Step 4. Only a signed revocation resets the identity; a bridge the ledger does not list fails closed and is never reset. */
+export function ownStatusAction(own) {
+    if (own === 'active')
+        return 'continue';
+    if (own === 'revoked')
+        return 'revoked_restart';
+    return 'exit_absent';
+}
+const messageOf = (error) => error instanceof Error ? error.message : String(error);
+export function ledgerUnavailableMessage(reason) {
+    return `[Bridge] Could not load your account ledger from the server (${reason}). Check the connection and run \`ftown start\` again.`;
+}
+function bound(identity) {
+    return identity !== null && identity.endpoint !== null && identity.accountId !== null;
+}
+/**
+ * Steps 3-4, account mode only, before any network use of the identity:
+ * - keys exist (created when absent), then identity and replica are reconciled;
+ * - 'unpaired' -> one pairing attempt (expired/rejected -> exit 1 with the hint);
+ * - 'needs_ledger' -> the server ledger is adopted only through adoptBound (any failure -> exit 1; the identity stays bound);
+ * - own status from the trusted replica: 'revoked' -> revoked restart; 'absent' -> exit 1 (never a reset); 'active' -> ready.
+ * Corrupted local files throw (they are never reset).
+ */
+export async function startAccountIdentity(deps) {
+    const loadOrCreate = deps.loadOrCreateIdentity ?? loadOrCreateLedgerIdentity;
+    const reconcile = deps.reconcile ?? ((dataDir) => reconcileIdentityAndStore(dataDir));
+    const readIdentity = deps.readIdentity ?? readLedgerIdentity;
+    const keys = await loadOrCreate(deps.dataDir);
+    const reconciled = await reconcile(deps.dataDir);
+    if (reconciled === 'unpaired') {
+        if (!deps.allowPairing)
+            return { kind: 'exit', message: UPDATE_RESTART_UNPAIRED_MESSAGE };
+        try {
+            await deps.pair(keys, new BridgeLedgerStore(deps.dataDir, { bridgeId: deps.bridgeId }));
+        }
+        catch (error) {
+            const code = messageOf(error);
+            if (code === 'pairing_expired')
+                return { kind: 'exit', message: null };
+            if (code === 'pairing_rejected')
+                return { kind: 'exit', message: PAIRING_REJECTED_HINT };
+            // Not a removal of a paired bridge: nothing is reset; the owner picks a new id.
+            if (code === 'pairing_revoked')
+                return { kind: 'exit', message: PAIRING_REVOKED_MESSAGE };
+            throw error;
+        }
+    }
+    const identity = await readIdentity(deps.dataDir);
+    if (!bound(identity))
+        return { kind: 'exit', message: PAIRING_REJECTED_HINT };
+    const store = new BridgeLedgerStore(deps.dataDir, { accountId: identity.accountId, bridgeId: deps.bridgeId });
+    if (reconciled === 'needs_ledger') {
+        try {
+            await store.adoptBound(await deps.fetchLedger(identity.accountId));
+        }
+        catch (error) {
+            if (error instanceof LedgerStoreError && error.code === 'ledger_store_bound_rejected')
+                return { kind: 'exit', message: SERVER_LEDGER_MISMATCH_MESSAGE };
+            return { kind: 'exit', message: ledgerUnavailableMessage(messageOf(error)) };
+        }
+    }
+    const action = ownStatusAction(await store.ownBridgeStatus({
+        bridgeId: deps.bridgeId, endpointId: identity.endpoint.id, endpointPublicKey: identity.endpoint.publicKey, authPublicKey: identity.authPublicKey,
+    }));
+    if (action === 'revoked_restart')
+        return { kind: 'revoked' };
+    if (action === 'exit_absent')
+        return { kind: 'exit', message: NOT_IN_LEDGER_MESSAGE };
+    return { kind: 'ready', identity, store, reconciled };
+}
+export function offlineWithoutRelayUrlMessage(reason) {
+    return `[Bridge] Could not reach the ftown server (${reason}) and no relay URL was saved by an earlier start. Check the connection and run \`ftown start\` again.`;
+}
+/**
+ * Step 5, the first relay token. A proven revocation (the token hooks offer the server's evidence first) wins over everything. A refusal
+ * (401/403) of a computer that is still an active member of its own history (`held` returns the notice: a divergence with the server, a
+ * server behind us, a failed re-offer, or any refusal without proof of our removal) starts OFFLINE and prints the notice once, never the
+ * reset advice: this computer may hold the only copy. Any other refusal (this computer is not an active member: unpaired/absent) exits
+ * with the reset advice. A temporary failure (network, timeout, 5xx, cooldown) starts offline with the saved relay URL. Without a saved
+ * relay URL there is no offline start: exit. After a successful token the revocation is checked again (the token response's ledger may
+ * prove it).
+ */
+export async function startRelay(input) {
+    let token;
+    try {
+        token = await input.getToken();
+    }
+    catch (error) {
+        if (input.bridgeRevoked())
+            return { kind: 'revoked' };
+        if (isRefusal(error)) {
+            const notice = input.held?.() ?? null;
+            if (notice === null)
+                return { kind: 'exit', message: relayTokenFailureMessage(error, input.apiUrl) };
+            const savedUrl = input.relayUrl();
+            if (savedUrl === null)
+                return { kind: 'exit', message: [...notice, HELD_NO_RELAY_URL_LINE].join('\n') };
+            return { kind: 'offline', relayUrl: savedUrl, reason: messageOf(error), notice: [...notice, HELD_OFFLINE_LINE] };
+        }
+        const reason = messageOf(error);
+        const relayUrl = input.relayUrl();
+        return relayUrl === null ? { kind: 'exit', message: offlineWithoutRelayUrlMessage(reason) } : { kind: 'offline', relayUrl, reason };
+    }
+    if (input.bridgeRevoked())
+        return { kind: 'revoked' };
+    const relayUrl = input.relayUrl();
+    if (relayUrl === null)
+        return { kind: 'exit', message: MISSING_RELAY_URL_MESSAGE };
+    return { kind: 'online', token, relayUrl };
+}
+export function endpointRefusedMessage(reason) {
+    return `[Bridge] The ftown server refused this computer's encrypted endpoint (${reason}). If it was removed from your account, run \`ftown start --new-identity\` to pair it again.`;
+}
+export function createEndpointRegistrar(deps) {
+    const schedule = deps.schedule ?? ((run, ms) => { const timer = setTimeout(run, ms); timer.unref(); return () => clearTimeout(timer); });
+    const maxDelay = deps.maxDelayMs ?? 600_000;
+    let delay = deps.baseDelayMs ?? 15_000;
+    let done = false;
+    let stopped = false;
+    let cancel = null;
+    const next = () => {
+        const wait = Math.max(deps.tokens.cooldownRemainingMs(), delay);
+        delay = Math.min(delay * 2, maxDelay);
+        cancel = schedule(() => { cancel = null; void attempt(); }, wait);
+    };
+    const attempt = async () => {
+        if (done || stopped)
+            return;
+        try {
+            await deps.register(await deps.tokens.getToken());
+            done = true;
+            deps.log('[Bridge] Registered this computer\'s encrypted endpoint.');
+        }
+        catch (error) {
+            if (stopped)
+                return;
+            if (isRefusal(error) && !deps.held?.()) {
+                // A verified revocation restarts the bridge on its own; anything else needs the owner.
+                if (!deps.bridgeRevoked())
+                    deps.log(endpointRefusedMessage(messageOf(error)));
+                stopped = true;
+                return;
+            }
+            next();
+        }
+    };
+    return {
+        async registerNow(token) {
+            try {
+                await deps.register(token);
+                done = true;
+                return { kind: 'registered' };
+            }
+            catch (error) {
+                if (deps.bridgeRevoked())
+                    return { kind: 'revoked' };
+                if (isRefusal(error) && !deps.held?.())
+                    return { kind: 'exit', message: endpointRefusedMessage(messageOf(error)) };
+                deps.log(`[Bridge] Could not register this computer's encrypted endpoint yet (${messageOf(error)}); retrying in the background.`);
+                return { kind: 'retry' };
+            }
+        },
+        retryInBackground() {
+            if (done || stopped || cancel !== null)
+                return;
+            next();
+        },
+        registered: () => done,
+        stop() {
+            stopped = true;
+            cancel?.();
+            cancel = null;
+        },
+    };
+}
+//# sourceMappingURL=ledger-startup.js.map

package/dist/ledger-startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-startup.js","sourceRoot":"","sources":["../src/ledger-startup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAsD,MAAM,qBAAqB,CAAC;AAE3I,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,kBAAkB,EAA6B,MAAM,sCAAsC,CAAC;AACxJ,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,yBAAyB,EAA8C,MAAM,mCAAmC,CAAC;AAE/J,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAEnG,MAAM,CAAC,MAAM,4BAA4B,GAAG,oHAAoH,CAAC;AACjK,MAAM,CAAC,MAAM,qBAAqB,GAAG,mGAAmG,CAAC;AACzI,MAAM,CAAC,MAAM,qBAAqB,GAAG,2DAA2D,CAAC;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,qFAAqF;MACxH,4DAA4D,CAAC;AACjE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2JAA2J,CAAC;AAC1M,MAAM,CAAC,MAAM,+BAA+B,GAAG,qFAAqF,CAAC;AACrI,MAAM,CAAC,MAAM,yBAAyB,GAAG,4FAA4F,CAAC;AACtI,MAAM,CAAC,MAAM,iBAAiB,GAAG,+HAA+H,CAAC;AACjK,MAAM,CAAC,MAAM,iBAAiB,GAAG,qGAAqG,CAAC;AACvI,MAAM,CAAC,MAAM,sBAAsB,GAAG,4HAA4H,CAAC;AAKnK,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACpG,2IAA2I;AAC3I,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QACpD,CAAC,CAAC,sDAAsD;QACxD,CAAC,CAAC,iEAAiE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG;cAC9I,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,MAAM,CAAC,aAAa,EAAE,CAAC;IACzF,OAAO,CAAC,8DAA8D,MAAM,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACtG,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuH,EACvH,OAAmC,EAAE;IAErC,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,qBAAqB,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,4BAA4B,IAAI,4BAA4B,CAAC;IACnF,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,WAAW;YAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;aACjD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,aAAa;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YACrF,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YACxC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9D,CAAC;AAID,+HAA+H;AAC/H,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IAChD,OAAO,aAAa,CAAC;AACvB,CAAC;AA4BD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,OAAO,gEAAgE,MAAM,wDAAwD,CAAC;AACxI,CAAC;AAED,SAAS,KAAK,CAAC,QAAqC;IAClD,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAwB;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,IAAI,0BAA0B,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC;IAE7D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;QAC1F,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAChG,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACvE,IAAI,IAAI,KAAK,kBAAkB;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;YACzF,gFAAgF;YAChF,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;YAC1F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9G,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3E,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,6BAA6B;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACxJ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC;QACzD,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa;KACjJ,CAAC,CAAC,CAAC;IACJ,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7D,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACtF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAWD,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,OAAO,8CAA8C,MAAM,uGAAuG,CAAC;AACrK,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAIhC;IACC,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,aAAa,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtD,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;YACtC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACrG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACnH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACtI,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,yEAAyE,MAAM,8FAA8F,CAAC;AACvL,CAAC;AA6BD,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAe,EAAE,EAAU,EAAE,EAAE,GAAG,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7J,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC;IAC5C,IAAI,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC;IACvC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAwB,IAAI,CAAC;IAEvC,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;QAChE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,IAAI,IAAI,OAAO;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACvC,uFAAuF;gBACvF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;oBAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9E,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,GAAG,IAAI,CAAC;gBACZ,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,IAAI,CAAC,aAAa,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBACrD,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACnH,IAAI,CAAC,GAAG,CAAC,uEAAuE,SAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAClI,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,iBAAiB;YACf,IAAI,IAAI,IAAI,OAAO,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,EAAE,CAAC;YACX,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/local-api-server.d.ts

@@ -73,6 +73,9 @@ export declare class LocalApiServer extends EventEmitter<HookServerEvents> {
     private localEventBytes;
     private readonly localEventWaiters;
     setSecurity(security: BridgeSecurityService, info: BridgeSecurityInfo, command: (message: VerifiedApplication) => Promise<ApplicationJson>, observer?: SecureExecutionObserver): void;
+    /** GET /api/security/info: the static info, plus in account mode `ledger: { divergence, serverBehind, removedOnOtherHistory }` (CONTRACT §5: a computer
+     *  holding a different account history is shown with a warning). */
+    private securityInfoPayload;
     recordPublication(channel: string, data: unknown): void;
     dispatchSecure(message: VerifiedApplication, clientGone?: AbortSignal): Promise<ApplicationJson>;
     private port;

package/dist/local-api-server.js

@@ -137,6 +137,15 @@ export class LocalApiServer extends EventEmitter {
         this.secureCommand = command;
         this.secureObserver = observer;
     }
+    /** GET /api/security/info: the static info, plus in account mode `ledger: { divergence, serverBehind, removedOnOtherHistory }` (CONTRACT §5: a computer
+     *  holding a different account history is shown with a warning). */
+    securityInfoPayload() {
+        const info = this.securityInfo;
+        if (!this.security?.options.ledger)
+            return info;
+        const status = this.security.ledgerStatus();
+        return { ...info, ledger: { divergence: status.divergence, serverBehind: status.serverBehind, removedOnOtherHistory: status.removedOnOtherHistory } };
+    }
     recordPublication(channel, data) {
         const item = { channel, data: applicationJson(data), cursor: ++this.localEventSequence };
         this.localEvents.push(item);
@@ -459,7 +468,7 @@ export class LocalApiServer extends EventEmitter {
                 return;
             }
             if (path === '/api/security/info' && req.method === 'GET') {
-                jsonResponse(res, 200, this.securityInfo);
+                jsonResponse(res, 200, this.securityInfoPayload());
                 return;
             }
             if (req.method === 'POST' && (path === '/api/security/envelope' || path === '/api/security/events')) {
@@ -830,11 +839,42 @@ export class LocalApiServer extends EventEmitter {
                 return;
             }
             const body = await parseBody(req);
-            if (req.method === 'PUT' ? Object.keys(body).length !== 1 || typeof body.path !== 'string' : Object.keys(body).length !== 0) {
+            if (req.method === 'PUT') {
+                if (Object.keys(body).some((key) => key !== 'paths' && key !== 'mode') || !('paths' in body) || !Array.isArray(body.paths) || body.paths.length < 1 || body.paths.length > 12 || body.paths.some((entry) => typeof entry !== 'string' || entry.length === 0)) {
+                    jsonResponse(res, 400, { error: 'Invalid preview request' });
+                    return;
+                }
+                const mode = body.mode;
+                if (mode !== undefined && mode !== 'replace' && mode !== 'add') {
+                    jsonResponse(res, 400, { error: 'Invalid preview request' });
+                    return;
+                }
+                const result = mode === 'add' ? await controller.addPreview(sessionPreviewMatch[1], body.paths) : await controller.setPreview(sessionPreviewMatch[1], body.paths);
+                if (!result.ok) {
+                    jsonResponse(res, result.code === 'not_found' ? 404 : result.code === 'too_large' ? 413 : 400, { error: result.message });
+                    return;
+                }
+                jsonResponse(res, 200, { session: toWireSession(result.session) });
+                return;
+            }
+            if (Object.keys(body).some((key) => key !== 'names')) {
+                jsonResponse(res, 400, { error: 'Invalid preview request' });
+                return;
+            }
+            if (body.names === undefined || (Array.isArray(body.names) && body.names.length === 0)) {
+                const result = await controller.clearPreview(sessionPreviewMatch[1]);
+                if (!result.ok) {
+                    jsonResponse(res, result.code === 'not_found' ? 404 : 400, { error: result.message });
+                    return;
+                }
+                jsonResponse(res, 200, { session: toWireSession(result.session) });
+                return;
+            }
+            if (!Array.isArray(body.names) || body.names.some((entry) => typeof entry !== 'string' || entry.length === 0)) {
                 jsonResponse(res, 400, { error: 'Invalid preview request' });
                 return;
             }
-            const result = req.method === 'PUT' ? await controller.setPreview(sessionPreviewMatch[1], body.path) : await controller.clearPreview(sessionPreviewMatch[1]);
+            const result = await controller.removePreview(sessionPreviewMatch[1], body.names);
             if (!result.ok) {
                 jsonResponse(res, result.code === 'not_found' ? 404 : result.code === 'too_large' ? 413 : 400, { error: result.message });
                 return;
@@ -895,6 +935,7 @@ export class LocalApiServer extends EventEmitter {
                 return;
             }
             await controller.remove(sessionId);
+            this.mail.markSessionEnded(sessionId);
             jsonResponse(res, 200, { removed: true, sessionId });
             return;
         }
@@ -1357,6 +1398,18 @@ export class LocalApiServer extends EventEmitter {
                 }
                 return;
             }
+            if (payload.hook_event_name === 'FtownWakeSubmitted') {
+                // Opencode announces the wake before submitting it (same 200 either way).
+                // Record only: never forwarded to the dashboard, never attention.
+                const submittedId = typeof payload.ftown_session_id === 'string' ? payload.ftown_session_id : undefined;
+                const submittedSource = typeof payload.ftown_session_source === 'string' ? payload.ftown_session_source : undefined;
+                if (submittedId && submittedSource !== 'workspace' && /^[a-zA-Z0-9_-]+$/.test(submittedId)
+                    && await this.store?.loadSession(submittedId)) {
+                    this.mail.notePluginHandoff(submittedId);
+                }
+                jsonResponse(res, 200, { ok: true });
+                return;
+            }
             const hookEventName = typeof payload.hook_event_name === 'string' ? payload.hook_event_name : undefined;
             let ftownSessionId = typeof payload.ftown_session_id === 'string' ? payload.ftown_session_id : undefined;
             let source = typeof payload.ftown_session_source === 'string' ? payload.ftown_session_source : undefined;
@@ -1369,22 +1422,31 @@ export class LocalApiServer extends EventEmitter {
                 jsonResponse(res, 200, { ok: true });
                 return;
             }
-            const { ftown_session_id: _, ftown_session_source: __, attentionId: _attentionId, attentionSequence: _attentionSequence, attentionCreatedAt: _attentionCreatedAt, ...rest } = payload;
+            const { ftown_session_id: _, ftown_session_source: __, attentionId: _attentionId, attentionSequence: _attentionSequence, attentionCreatedAt: _attentionCreatedAt, ...restWithInjected } = payload;
+            // Never trust a harness-supplied injected flag.
+            const { injected: _incomingInjected, ...rest } = restWithInjected;
+            const isPromptSubmit = hookEventName === 'UserPromptSubmit' || hookEventName === 'beforeSubmitPrompt';
+            const injected = isPromptSubmit && this.mail.isInjectedPrompt(ftownSessionId, rest);
             let committedAttention = undefined;
             // Workspace fallback can identify a foreign agent in the same directory.
             // Only known explicit/native-attributed sessions may produce authoritative records.
             if (this.attention && source !== 'workspace' && /^[a-zA-Z0-9_-]+$/.test(ftownSessionId) && await this.store?.loadSession(ftownSessionId)) {
-                committedAttention = await this.attention.record(ftownSessionId, hookEventName, rest);
+                committedAttention = await this.attention.record(ftownSessionId, hookEventName, rest, isPromptSubmit ? { promptOrigin: injected ? 'injected' : 'human' } : undefined);
             }
             if (hookEventName === 'UserPromptSubmit' || hookEventName === 'PreToolUse' || hookEventName === 'PostToolUse')
                 this.mail.markAgentBusy(ftownSessionId);
-            else if (hookEventName === 'Stop' || hookEventName === 'SessionEnd')
+            else if (hookEventName === 'Stop')
                 this.mail.markAgentIdle(ftownSessionId);
+            else if (hookEventName === 'SessionEnd') {
+                this.mail.markAgentIdle(ftownSessionId);
+                this.mail.markSessionEnded(ftownSessionId);
+            }
             const conversationId = payload.conversation_id;
             if (typeof conversationId === 'string' && conversationId && source !== 'workspace')
                 registerSessionConversation(ftownSessionId, conversationId);
             const hookEvent = { sessionId: ftownSessionId, eventName: hookEventName, data: {
                     ...rest,
+                    ...(injected ? { injected: true } : {}),
                     ...(committedAttention ? { attentionId: committedAttention.id, attentionSequence: committedAttention.sequence, attentionCreatedAt: committedAttention.createdAt } : {}),
                 }, source };
             // Persistence is complete before listeners can publish and before HTTP success.