instar 1.3.104 → 1.3.105

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmSH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwvDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAo7OtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmSH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwvDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+7OtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -2214,9 +2214,20 @@ export async function startServer(options) {
         let localSigningKeyPem = '';
         if (coordinator.enabled && coordinator.identity) {
             try {
-                const keyPath = path.join(config.stateDir, 'machine', 'signing-private.pem');
-                if (fs.existsSync(keyPath)) {
-                    localSigningKeyPem = fs.readFileSync(keyPath, 'utf-8');
+                // The canonical signing-key filename is `signing-key.pem` (MachineIdentity.SIGNING_KEY_FILE,
+                // what every normally-created install has + what idMgr.loadSigningKey reads). This loader
+                // historically hard-coded `signing-private.pem`, which only EXISTS on installs that were
+                // propagated with that (non-canonical) name — so a normally-created machine got an EMPTY
+                // localSigningKeyPem, its MeshRpcClient then signed every cross-machine command with no key,
+                // the send threw, and it could not PULL/transfer to any peer (while still RECEIVING fine,
+                // since receive verifies the OTHER machine's key). Try the canonical name first, then fall
+                // back to the legacy/propagated name so both layouts work.
+                for (const name of ['signing-key.pem', 'signing-private.pem']) {
+                    const keyPath = path.join(config.stateDir, 'machine', name);
+                    if (fs.existsSync(keyPath)) {
+                        localSigningKeyPem = fs.readFileSync(keyPath, 'utf-8');
+                        break;
+                    }
                 }
             }
             catch { /* @silent-fallback-ok — signing key optional */ }