From f7c52315f1e1834f384353436f5d309f328b8121 Mon Sep 17 00:00:00 2001
From: YairEtzion <yetzion4@gmail.com>
Date: Sat, 4 Apr 2026 14:03:46 +0300
Subject: [PATCH] fix: consistent device ID derivation in invite/listen

invite and listen derived device IDs with raw base64url(pubkey) while
init used SHA-256(pubkey). The relay matches on device ID, so the
controller's allow list entry never matched the agent's registration,
breaking shell routing silently (relay sends fake peer_found per C3 fix).

All 4 files now use generateDeviceId() from identity.ts (SHA-256 based),
matching what init produces. Existing pairings need re-pairing.
---
 packages/agent/src/commands/invite.ts | 3 ++-
 packages/agent/src/commands/listen.ts | 3 ++-
 packages/cli/src/commands/invite.ts   | 3 ++-
 packages/cli/src/commands/listen.ts   | 3 ++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/packages/agent/src/commands/invite.ts b/packages/agent/src/commands/invite.ts
index 30b2381..a0c4fdc 100644
--- a/packages/agent/src/commands/invite.ts
+++ b/packages/agent/src/commands/invite.ts
@@ -1,6 +1,7 @@
 import { Command, Args, Flags } from '@oclif/core';
 import { loadContext } from '../context.js';
 import { runControllerHandshake } from '../handshake.js';
+import { generateDeviceId } from '../identity.js';
 const DEFAULT_RELAY = 'wss://relay.authmesh.dev/ws';
 
 export default class Invite extends Command {
@@ -65,7 +66,7 @@ export default class Invite extends Command {
     this.log('');
 
     await allowList.addDevice({
-      deviceId: `am_${Buffer.from(result.peerPublicKey).toString('base64url').slice(0, 16)}`,
+      deviceId: generateDeviceId(result.peerPublicKey),
       publicKey: Buffer.from(result.peerPublicKey).toString('base64'),
       friendlyName: result.peerFriendlyName,
       addedAt: new Date().toISOString(),
diff --git a/packages/agent/src/commands/listen.ts b/packages/agent/src/commands/listen.ts
index 875dd34..13f057d 100644
--- a/packages/agent/src/commands/listen.ts
+++ b/packages/agent/src/commands/listen.ts
@@ -1,6 +1,7 @@
 import { Command, Flags } from '@oclif/core';
 import { loadContext } from '../context.js';
 import { generateOTC, runTargetHandshake, verifySAS } from '../handshake.js';
+import { generateDeviceId } from '../identity.js';
 import { createInterface } from 'node:readline';
 
 const DEFAULT_RELAY = 'wss://relay.authmesh.dev/ws';
@@ -72,7 +73,7 @@ export default class Listen extends Command {
     }
 
     const newDevice = {
-      deviceId: `am_${Buffer.from(result.peerPublicKey).toString('base64url').slice(0, 16)}`,
+      deviceId: generateDeviceId(result.peerPublicKey),
       publicKey: Buffer.from(result.peerPublicKey).toString('base64'),
       friendlyName: result.peerFriendlyName,
       addedAt: new Date().toISOString(),
diff --git a/packages/cli/src/commands/invite.ts b/packages/cli/src/commands/invite.ts
index 30b2381..a0c4fdc 100644
--- a/packages/cli/src/commands/invite.ts
+++ b/packages/cli/src/commands/invite.ts
@@ -1,6 +1,7 @@
 import { Command, Args, Flags } from '@oclif/core';
 import { loadContext } from '../context.js';
 import { runControllerHandshake } from '../handshake.js';
+import { generateDeviceId } from '../identity.js';
 const DEFAULT_RELAY = 'wss://relay.authmesh.dev/ws';
 
 export default class Invite extends Command {
@@ -65,7 +66,7 @@ export default class Invite extends Command {
     this.log('');
 
     await allowList.addDevice({
-      deviceId: `am_${Buffer.from(result.peerPublicKey).toString('base64url').slice(0, 16)}`,
+      deviceId: generateDeviceId(result.peerPublicKey),
       publicKey: Buffer.from(result.peerPublicKey).toString('base64'),
       friendlyName: result.peerFriendlyName,
       addedAt: new Date().toISOString(),
diff --git a/packages/cli/src/commands/listen.ts b/packages/cli/src/commands/listen.ts
index 875dd34..13f057d 100644
--- a/packages/cli/src/commands/listen.ts
+++ b/packages/cli/src/commands/listen.ts
@@ -1,6 +1,7 @@
 import { Command, Flags } from '@oclif/core';
 import { loadContext } from '../context.js';
 import { generateOTC, runTargetHandshake, verifySAS } from '../handshake.js';
+import { generateDeviceId } from '../identity.js';
 import { createInterface } from 'node:readline';
 
 const DEFAULT_RELAY = 'wss://relay.authmesh.dev/ws';
@@ -72,7 +73,7 @@ export default class Listen extends Command {
     }
 
     const newDevice = {
-      deviceId: `am_${Buffer.from(result.peerPublicKey).toString('base64url').slice(0, 16)}`,
+      deviceId: generateDeviceId(result.peerPublicKey),
       publicKey: Buffer.from(result.peerPublicKey).toString('base64'),
       friendlyName: result.peerFriendlyName,
       addedAt: new Date().toISOString(),