feat(sdk): self-healing Signal session reset + idle daemon watchdog + bypass mode (#257)

* feat(sdk): self-healing Signal session reset + daemon bypass mode

Add resetSession across the SDK (EncryptionContext -> TinyPlaceClient ->
Agent) to drop a peer's persisted Double Ratchet session so the next send
re-runs X3DH from a fresh pre-key bundle. Agent.resetSession resolves the
recipient the same way sendMessage does, so the correct cryptoId-keyed
session is cleared for a @handle/base64/cryptoId address.

Wrap the daemon's outbound send with reset+retry: on a session-class error
(relay 400 / ratchet / decrypt / prekey / contact), reset the session and
retry once so daemon replies self-heal after a crash/restart mid-handshake.

Also pass --dangerously-skip-permissions to the claude provider so daemon
workers run unattended in bypass mode.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(daemon): idle (no-event) task watchdog instead of a hard cap

Convert the daemon's per-task timeout from a fixed wall-clock kill into an
idle watchdog: the child CLI is reaped only after --task-timeout-ms with NO
new provider event. `armIdle` re-arms on every parsed event, so a long-but-
active run (streaming tool calls / output) keeps going while a genuinely
wedged one is killed ~timeout after it goes silent. Default stays 600000ms.

Also update the claude headless-argv test for the --dangerously-skip-
permissions flag added with bypass mode.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(daemon): address review — opt-in bypass, narrow session classifier, propagate reset

- Security (P1): `--dangerously-skip-permissions` is now opt-in behind a
  `--dangerously-skip-permissions` daemon flag (threaded through
  DaemonRuntime → RunTaskOptions → buildRunArgs), default OFF. A daemon
  auto-accepts contacts and runs remote task text, so bypassing approval must
  be an explicit operator choice, not the default.
- Narrow isSessionError to explicit stale-ratchet/decrypt/prekey/session
  faults; stop treating a not-yet-contact 400 (or a bare HTTP status) as
  recoverable — resetting won't accept the contact and the failed retry would
  leave an undelivered X3DH session, making the next send undecryptable.
- Do not swallow a failed resetSession: propagate it instead of retrying over
  an uncleared ratchet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sanil-23

sdk/typescript/src/agent/agent.ts

@@ -41,6 +41,7 @@ import {
 import {
   publishKeys,
   readMessages,
+  resolveRecipientKey,
   sendMessage,
 } from "./messaging.js";
 import type { PublishKeysResult, ReadMessage, SendMessageResult } from "./messaging.js";
@@ -289,6 +290,17 @@ export class Agent {
     return sendMessage(this.client, this.signer, recipient, text);
   }
 
+  /**
+   * Clear the persisted Signal session for `recipient` (a @handle, cryptoId, or
+   * base64 key — resolved the same way `sendMessage` resolves it) so the next send
+   * re-runs X3DH from the peer's pre-key bundle. Use to recover from a poisoned/
+   * desynced ratchet the relay rejects, then retry the send.
+   */
+  async resetSession(recipient: string): Promise<void> {
+    const to = await resolveRecipientKey(this.client, recipient);
+    await this.client.resetSession(to);
+  }
+
   /** Read + decrypt + acknowledge the inbox. */
   readMessages(options?: { limit?: number }): Promise<Array<ReadMessage>> {
     return readMessages(this.client, this.signer, options);

sdk/typescript/src/cli/daemon.ts

@@ -31,6 +31,9 @@ import type { Flags } from "./types.js";
 import type { HarnessProvider } from "../types/harness.js";
 
 const DEFAULT_CONCURRENCY = 2;
+// Idle (no-event) watchdog, not a hard cap: a task is killed only after this many
+// ms with NO new event from the provider CLI; each event re-arms it. A long-but-
+// active run survives, a wedged one is reaped ~10 min after it goes silent.
 const DEFAULT_TASK_TIMEOUT_MS = 600_000;
 const DEFAULT_POLL_MS = 2_000;
 
@@ -132,6 +135,10 @@ export async function runDaemon(
     );
   }
   const model = stringFlag(flags, "model");
+  // Opt-in: run claude workers with --dangerously-skip-permissions. OFF unless the
+  // operator passes the flag, because the daemon auto-accepts contacts and executes
+  // remote task text — unattended approval bypass must be an explicit choice.
+  const skipPermissions = boolFlag(flags, "dangerously-skip-permissions");
   const opencodeAgent = stringFlag(flags, "opencode-agent");
   const handle = stringFlag(flags, "handle");
   const displayName = stringFlag(flags, "name");
@@ -172,8 +179,23 @@ export async function runDaemon(
     maxPending,
     ...(statusThrottleMs !== undefined ? { statusThrottleMs } : {}),
     ...(model ? { model } : {}),
+    ...(skipPermissions ? { skipPermissions: true } : {}),
     ...(opencodeAgent ? { agent: opencodeAgent } : {}),
-    send: (to, body) => lock(() => agent.sendMessage(to, body)).then(() => {}),
+    send: (to, body) =>
+      lock(async () => {
+        try {
+          await agent.sendMessage(to, body);
+        } catch (error) {
+          if (!isSessionError(error)) throw error;
+          // Poisoned/desynced Signal ratchet — the relay rejects the ciphertext.
+          // Drop the session so the retry re-runs X3DH from a fresh pre-key bundle.
+          // Do NOT swallow a reset failure: retrying over an uncleared ratchet just
+          // fails again and masks the cause, so let it propagate.
+          log(`session error sending to ${to}, resetting: ${describe(error)}`);
+          await agent.resetSession(to);
+          await agent.sendMessage(to, body);
+        }
+      }),
     log,
   });
 
@@ -264,3 +286,16 @@ async function accepterTick(
 function describe(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
+
+/**
+ * A send failure that dropping the Signal session can actually fix: an explicit
+ * stale-ratchet / decrypt / prekey / session fault. Deliberately NOT matched:
+ * a not-yet-contact rejection (resetting won't accept the contact, and the retry
+ * would leave an undelivered X3DH session that makes the next send undecryptable)
+ * or a bare HTTP status, which says nothing about the ratchet.
+ */
+function isSessionError(error: unknown): boolean {
+  const e = error as { code?: string; message?: string };
+  const text = `${e?.code ?? ""} ${e?.message ?? ""}`.toLowerCase();
+  return /ratchet|decrypt|prekey|pre-key|signal session|no session/.test(text);
+}

sdk/typescript/src/cli/daemon/providers.ts

@@ -118,6 +118,8 @@ export interface RunTaskOptions {
   agent?: string;
   /** Extra args appended before the prompt (advanced / permissions). */
   extraArgs?: ReadonlyArray<string>;
+  /** Opt-in bypass of claude's permission prompts. OFF by default. */
+  skipPermissions?: boolean;
   signal?: AbortSignal;
   /** Fired for each parsed semantic event — drives periodic status frames. */
   onEvent?: (event: HarnessSemanticEvent) => void;
@@ -141,6 +143,11 @@ export function buildRunArgs(options: {
   model?: string;
   agent?: string;
   extraArgs?: ReadonlyArray<string>;
+  /** Opt-in: bypass the claude permission prompts (`--dangerously-skip-
+   *  permissions`). OFF by default — a daemon auto-accepts contacts and runs
+   *  remote DM task text, so skipping approval must be an explicit operator
+   *  choice, never the default. */
+  skipPermissions?: boolean;
 }): Array<string> {
   const extra = options.extraArgs ?? [];
   // A prompt beginning with "-" would be parsed as a CLI flag by the provider
@@ -158,6 +165,7 @@ export function buildRunArgs(options: {
         "--output-format",
         "stream-json",
         "--verbose",
+        ...(options.skipPermissions ? ["--dangerously-skip-permissions"] : []),
         ...extra,
         prompt,
       ];
@@ -252,6 +260,7 @@ function runProviderAttempt(options: RunTaskOptions): Promise<RunTaskResult> {
     ...(options.model ? { model: options.model } : {}),
     ...(options.agent ? { agent: options.agent } : {}),
     ...(options.extraArgs ? { extraArgs: options.extraArgs } : {}),
+    ...(options.skipPermissions ? { skipPermissions: true } : {}),
   });
   const bin = providerBin(options.provider, options.env);
   const child = spawn(bin, args, { cwd: options.cwd, env: options.env });
@@ -278,22 +287,33 @@ function runProviderAttempt(options: RunTaskOptions): Promise<RunTaskResult> {
       });
     }
 
-    const timer = setTimeout(() => {
-      finishError(
-        new Error(
-          `${options.provider} task timed out after ${options.timeoutMs}ms`,
-        ),
-      );
-      child.kill("SIGKILL");
-    }, options.timeoutMs);
+    // Idle watchdog, not a hard cap: kill the child only after `timeoutMs` with NO
+    // new event. `armIdle` re-arms on every parsed event (see consumeLine), so a
+    // long-but-active task (streaming tool calls / output) keeps running while a
+    // genuinely wedged one is reaped. Armed once at start to cover a child that
+    // never emits anything.
+    let idleTimer: ReturnType<typeof setTimeout> | undefined;
+    function armIdle(): void {
+      if (settled) return;
+      if (idleTimer) clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        finishError(
+          new Error(
+            `${options.provider} task idle for ${options.timeoutMs}ms (no events)`,
+          ),
+        );
+        child.kill("SIGKILL");
+      }, options.timeoutMs);
+    }
+    armIdle();
 
     const onAbort = (): void => {
       child.kill("SIGTERM");
     };
     options.signal?.addEventListener("abort", onAbort, { once: true });
 
     function cleanup(): void {
-      clearTimeout(timer);
+      if (idleTimer) clearTimeout(idleTimer);
       options.signal?.removeEventListener("abort", onAbort);
     }
 
@@ -316,6 +336,7 @@ function runProviderAttempt(options: RunTaskOptions): Promise<RunTaskResult> {
       }
       for (const event of mapEventsFromLine(raw, line)) {
         events += 1;
+        armIdle(); // progress — the task is alive; push the no-event deadline out.
         options.onEvent?.(event);
         if (event.event.kind === "agent_message") {
           messages.push(event.event.payload.text);

sdk/typescript/src/cli/daemon/runtime.ts

@@ -251,6 +251,15 @@ export class TinyPlaceClient {
     await this.encryptionContext.publishKeyBundle(options?.preKeyCount);
   }
 
+  /**
+   * Drop the persisted Signal session for `cryptoId` (a resolved base58 address)
+   * so the next send bootstraps a fresh X3DH session. Recovery path for a poisoned
+   * ratchet the relay rejects. No-op when encryption is not configured.
+   */
+  async resetSession(cryptoId: string): Promise<void> {
+    await this.encryptionContext?.resetSession(cryptoId);
+  }
+
   healthz(): Promise<unknown> {
     return this.http.get<unknown>("/healthz");
   }

sdk/typescript/src/client.ts

@@ -124,6 +124,17 @@ export class EncryptionContext implements MessageCipher {
     return session.decrypt(envelope.from, senderX25519, envelope);
   }
 
+  /**
+   * Drop the persisted Double Ratchet session for `address` (an already-resolved
+   * base58 cryptoId). The next `encryptEnvelope` finds no session, re-fetches the
+   * peer's pre-key bundle, and bootstraps a fresh X3DH session — the recovery path
+   * for a poisoned/desynced ratchet that makes the relay reject sends. Pre-keys and
+   * identity are untouched; only this peer's session is cleared.
+   */
+  async resetSession(address: string): Promise<void> {
+    await this.store.removeSession(address);
+  }
+
   /** Lazily build the session — the store's identity key load is async. */
   private async getSession(): Promise<SignalSession> {
     if (!this.session) {

sdk/typescript/src/messaging/encryption.ts

@@ -120,13 +120,23 @@ describe("provider detection", () => {
   });
 
   it("builds provider-specific headless argv", () => {
+    // Default: claude runs with its normal permission prompts (no bypass).
     expect(buildRunArgs({ provider: "claude", prompt: "hi" })).toEqual([
       "-p",
       "--output-format",
       "stream-json",
       "--verbose",
       "hi",
     ]);
+    // Opt-in bypass only when explicitly requested.
+    expect(buildRunArgs({ provider: "claude", prompt: "hi", skipPermissions: true })).toEqual([
+      "-p",
+      "--output-format",
+      "stream-json",
+      "--verbose",
+      "--dangerously-skip-permissions",
+      "hi",
+    ]);
     expect(buildRunArgs({ provider: "codex", prompt: "hi", model: "gpt-5" })).toEqual([
       "exec",
       "--json",