instar 1.3.265 → 1.3.266

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAkxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAi9QtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAkxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAi+QtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -9191,8 +9191,15 @@ export async function startServer(options) {
                 // by the mesh acceptance layer before this runs; confidentiality is enforced by the
                 // decryption (a payload not sealed to our key fails). The OUTBOUND provisioner is wired
                 // after the MeshRpcClient is constructed (below).
-                const _secretSyncEnabled = config.multiMachine?.secretSync?.enabled
-                    ?? !!config.developmentAgent;
+                const _secretSyncCfg = config.multiMachine?.secretSync;
+                const _secretSyncEnabled = _secretSyncCfg?.enabled ?? !!config.developmentAgent;
+                // SAFETY: pushing is opt-in SEPARATELY from receiving and DEFAULTS OFF. A machine
+                // whose local secret store is stale/divergent (e.g. recovered from a key drift) would
+                // otherwise auto-push its stale set to peers on boot and CLOBBER their good secrets —
+                // the exact corruption class this guard prevents. So `enabled` alone = RECEIVE-ONLY;
+                // outbound (boot best-effort + POST /secrets/sync-now) requires `pushEnabled: true`,
+                // which you set only on the machine whose store is authoritative.
+                const _secretSyncPushEnabled = _secretSyncEnabled && (_secretSyncCfg?.pushEnabled ?? false);
                 let _secretShareHandler;
                 if (_secretSyncEnabled) {
                     try {
@@ -9379,16 +9386,26 @@ export async function startServer(options) {
                             });
                             _secretSyncHandle = {
                                 enabled: true,
-                                provisionAll: () => provisioner.provisionAll(),
+                                pushEnabled: _secretSyncPushEnabled,
+                                // Outbound is gated on pushEnabled: a receive-only machine NEVER pushes its
+                                // (possibly stale) set to peers. The route surfaces a clear refusal instead.
+                                provisionAll: () => _secretSyncPushEnabled
+                                    ? provisioner.provisionAll()
+                                    : Promise.resolve([]),
                                 localKeyPaths: () => secretSyncMod.secretKeyPaths(readSecrets()),
                                 syncTargets: onlinePeers,
                             };
-                            // Boot best-effort: push current secrets to any peer already online.
-                            // @silent-fallback-ok — fire-and-forget; per-peer failures are already captured
-                            // in provisionAll's result array, and a fresh push fires on the next provision /
-                            // the deterministic POST /secrets/sync-now. Boot must never block on a peer.
-                            void provisioner.provisionAll().catch(() => { });
-                            console.log(pc.dim('  [secret-sync] enabled — outbound provisioner wired'));
+                            if (_secretSyncPushEnabled) {
+                                // Boot best-effort: push current secrets to any peer already online.
+                                // @silent-fallback-ok — fire-and-forget; per-peer failures are already captured
+                                // in provisionAll's result array, and a fresh push fires on the next provision /
+                                // the deterministic POST /secrets/sync-now. Boot must never block on a peer.
+                                void provisioner.provisionAll().catch(() => { });
+                                console.log(pc.dim('  [secret-sync] enabled — outbound provisioner wired (push ON)'));
+                            }
+                            else {
+                                console.log(pc.dim('  [secret-sync] enabled — RECEIVE-ONLY (push disabled; set multiMachine.secretSync.pushEnabled=true on the authoritative machine to push)'));
+                            }
                         }
                         catch (err) {
                             console.log(pc.dim(`  [secret-sync] outbound provisioner not wired: ${err instanceof Error ? err.message : String(err)}`));