kai/web-terminal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(relay): close F6 replay K_content nonce reuse via per-generation epoch-in-key

Browse Source 
The recoverable replay key was stable per (hostContentSecret, sessionId) while the
agent-side sealer resets its deterministic-nonce seq to 0 on every restart/re-attach
→ two sealer generations sealed distinct plaintext under the SAME (key, nonce).

Add a required 'epoch' to ReplayKeyParams, fold it into the K_content HKDF salt
(sessionId U+001F epoch), mint a fresh epoch per createReplaySealer generation and
expose it, and thread it through ReplaySource so the browser re-derives the matching
key. Fresh epoch per generation ⇒ fresh key ⇒ seq=0 can never collide; recoverability
within a generation is preserved.

Touches relay-contracts/relay-e2e/agent/relay-web. Green: contracts 81, e2e 78,
agent 133, web 99; tsc clean. Regression proves same seq-0 nonce, different key.
This commit is contained in:
Yaojia Wang
2026-07-02 16:41:19 +02:00
parent a09c131539
commit 3020184054
13 changed files with 243 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
relay-web/src/entry/manage-page.ts
View File

@@ -16,11 +16,23 @@ import { createApiClient } from '../api-client'
import { mountPreviewGrid } from '../preview-grid'
import type { ReplaySource } from '../preview-client'
/**
* FIX 3b / F6 placeholder epoch. The real per-generation `epoch` MUST be served by P1/P2 alongside
* the ciphertext ring buffer (the agent stamps a fresh epoch each time it reconstructs the sealer and
* resets seq to 0). This constant only keeps the `ReplaySource` shape explicit until those endpoints
* land; the stub still throws, so no frame is ever decrypted under it.
*/
const PLACEHOLDER_EPOCH = 'PENDING_P1_P2_EPOCH'
async function loadReplay(
_hostId: string,
): Promise<{ replay: ReplaySource; hostContentSecret: Uint8Array }> {
// TODO(P5/P1): fetch ciphertext replay + hostContentSecret (post auth/step-up). Not yet available.
throw new Error('replay source not yet wired (pending P5/P1 endpoints)')
// TODO(P5/P1/P2): fetch ciphertext replay + hostContentSecret (post auth/step-up) AND the real
// per-generation `epoch` (FIX 3b / F6) that the frames were sealed under. Until then the shape is:
// { replay: { sessionId, alg, epoch: PLACEHOLDER_EPOCH, frames }, hostContentSecret }
// Not yet available → throw so a card shows "unavailable" rather than a fabricated screen.
void PLACEHOLDER_EPOCH
throw new Error('replay source not yet wired (pending P5/P1/P2 endpoints)')
}
function boot(): void {