fix(concord): harden fetch_plane per pre-publish review; bump vector-core 0.4.0 / vector_sdk 0.5.0

Pre-publish review of the plane-key auth-fetch path surfaced fixable issues; the
core security properties (owner always protected, no cross-account client handoff,
escalation fix correct for the in-roster case) held.

- Tor: fetch_plane added relays BARE (ConnectionMode::Direct), so under active Tor
  the plane fetch + its NIP-42 auth as the plane key could connect direct and tie
  the user's IP to community membership. Now adds via pool().add_relay with the
  Tor-aware community relay options, matching warm_client.
- Cross-swap: clear_plane_pool drained the map but left the generation stamp, so a
  fetch_plane in flight during an account swap could re-pool a client still authed
  as the swapped-out account's plane key. Now stamps the live generation on clear.
- Confident-empty: fetch_plane returned Ok(empty) when every relay refused/timed
  out (indistinguishable from a genuinely empty plane). Now Err on zero EOSE.
- Pool insert no longer returns the in-use client for disconnect (only real LRU
  victims), so a raced same-key miss can't tear down the connection it fetches on.
- disconnect_clients is runtime-guarded (clear_plane_pool is pub; a bot author may
  call it off a non-tokio thread).

Documented residual (bounded, non-blocking): base_admissible reads the persisted
roster, so a superior whose grant hasn't folded yet is unprotected within the
grant-propagation window; the owner is always hard-protected and can counter-refound.

Version bump is minor: fetch_plane is a new required method on the public Transport
trait (breaking for external Transport impls).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JSKitty

crates/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "vector-core"
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 description = "Core library for Vector — the single source of truth for all Vector clients, SDKs, and interfaces."
 license = "MIT"

crates/vector-core/Cargo.toml

@@ -420,11 +420,22 @@ fn plane_pool_key(plane_pk: &str, relays: &[String]) -> String {
 }
 
 /// Disconnect the given clients off the hot path (never awaited under the lock).
+/// Runtime-guarded: `clear_plane_pool` is public and a bot author may call it from
+/// a non-tokio thread — `disconnect` off a live handle if there is one, else drop
+/// the client (its background task ends on drop).
 fn disconnect_clients(clients: Vec<Client>) {
-    for c in clients {
-        tokio::spawn(async move {
-            let _ = c.disconnect();
-        });
+    if clients.is_empty() {
+        return;
+    }
+    match tokio::runtime::Handle::try_current() {
+        Ok(handle) => {
+            for c in clients {
+                handle.spawn(async move {
+                    let _ = c.disconnect();
+                });
+            }
+        }
+        Err(_) => drop(clients),
     }
 }
 
@@ -433,6 +444,11 @@ fn disconnect_clients(clients: Vec<Client>) {
 pub fn clear_plane_pool() {
     let drained: Vec<Client> = {
         let mut g = PLANE_POOL.lock().unwrap_or_else(|e| e.into_inner());
+        // Stamp the LIVE generation so an insert still in flight from the prior
+        // generation (a fetch_plane that captured the old value before the swap)
+        // sees the mismatch and disconnects its client instead of re-pooling one
+        // still authed as the swapped-out account's plane key.
+        g.0 = crate::state::current_session_generation();
         g.1.drain().map(|(_, p)| p.client).collect()
     };
     disconnect_clients(drained);
@@ -467,18 +483,19 @@ fn plane_pool_take(generation: u64, key: &str) -> (Option<Client>, Vec<Client>)
 }
 
 /// Insert a freshly-built client for `key`, LRU-evicting if over the cap. Returns
-/// clients to disconnect (a raced sibling insert, or the LRU victim).
+/// ONLY the displaced LRU victim(s) to disconnect — NEVER the just-built `client`.
+/// If we don't pool it (swapped mid-build, or a concurrent miss already pooled
+/// this key), we return nothing: the caller still uses the client for this one
+/// fetch and it closes on drop, so we must not disconnect the connection it's
+/// about to run on.
 fn plane_pool_insert(generation: u64, key: String, client: Client) -> Vec<Client> {
     let mut g = PLANE_POOL.lock().unwrap_or_else(|e| e.into_inner());
-    if g.0 != generation {
-        // Swapped mid-build — don't pool into the new generation; caller still uses it once.
-        return vec![client];
+    // Swapped mid-build, or a concurrent miss already pooled this key — don't pool
+    // ours (the caller uses it once, then it drops).
+    if g.0 != generation || g.1.contains_key(&key) {
+        return Vec::new();
     }
     let mut evicted: Vec<Client> = Vec::new();
-    // A concurrent miss for the same key already inserted — keep theirs, drop ours.
-    if g.1.contains_key(&key) {
-        return vec![client];
-    }
     if g.1.len() >= PLANE_POOL_MAX {
         if let Some(lru_key) = g.1.iter().min_by_key(|(_, p)| p.last_used).map(|(k, _)| k.clone()) {
             if let Some(p) = g.1.remove(&lru_key) {
@@ -1054,8 +1071,12 @@ impl Transport for LiveTransport {
             // connection holds ONE identity; the shared client's is the user's).
             let opts = crate::nostr_client_options().automatic_authentication(true);
             let client = nostr_sdk::Client::builder().signer(plane.clone()).opts(opts).build();
+            // Community relay options (GOSSIP|PING + Tor-aware ConnectionMode): a
+            // bare add_relay leaves ConnectionMode::Direct, so under active Tor the
+            // plane fetch — and the NIP-42 auth AS the plane key — would connect
+            // direct and tie the user's IP to community membership.
             for r in &targets {
-                let _ = client.add_relay(r.clone()).await;
+                let _ = client.pool().add_relay(r.clone(), crate::community_relay_options()).await;
             }
             client.connect().await;
             // Warmup with the gated filter shape triggers each relay's NIP-42
@@ -1072,19 +1093,28 @@ impl Transport for LiveTransport {
 
         let mut result: Vec<Event> = Vec::new();
         let mut seen: std::collections::HashSet<EventId> = std::collections::HashSet::new();
+        let mut successes = 0usize;
         for r in &targets {
             let res = fetch_relay_eose(&client, r, filter.clone(), self.timeout).await;
             // Feed the shared breaker so this auth path both benefits from AND
             // contributes to the pool-wide dead-relay knowledge.
             breaker_record(r, res.is_ok(), true);
             if let Ok(events) = res {
+                successes += 1;
                 for e in events {
                     if seen.insert(e.id) {
                         result.push(e);
                     }
                 }
             }
         }
+        // Zero EOSE = every relay refused/timed out — an honest transient failure,
+        // NOT a "the plane is empty" verdict (a genuine empty plane EOSEs with no
+        // events, which counts as a success). A confident-empty here could mask a
+        // rotation from a caller that concludes absence.
+        if successes == 0 {
+            return Err(format!("no relay answered the plane fetch (0/{} attempted)", targets.len()));
+        }
         // The client stays POOLED (not disconnected) for the next page/epoch/community.
         Ok(result)
     }

crates/vector-core/src/community/transport.rs

@@ -3340,9 +3340,17 @@ pub async fn follow_rekeys<T: Transport + ?Sized>(
     let mut cur = community.clone();
     let mut changed = false;
 
-    // The channel-rotator gates. Loaded once per follow: a roster change lands via
-    // follow_control (which the worker runs right after this), so at worst an
-    // admin's rotation adopts one pass late — never early.
+    // The rotator/admissibility gates read the PERSISTED roster (folded by a prior
+    // follow_control; the worker folds control right after this rekey pass). This
+    // is "one pass late" for the rotator-AUTHORIZATION direction (a newly-granted
+    // admin's rotation adopts a pass late, never early — safe). It is fail-OPEN for
+    // the base-admissibility protected-set: a superior whose grant this receiver
+    // has not yet folded is not in `roster.grants`, so a non-owner Refounding
+    // excluding them can be adopted within that propagation window. Bounded — the
+    // owner is ALWAYS hard-protected below (independent of the roster) and can
+    // counter-refound; and it is inherent to eventual consistency (one cannot gate
+    // on a grant never seen). Tightening this (fold control before the first rekey,
+    // or gate non-owner adoption on roster freshness) is a follow-on.
     let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
     let banned = crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default();
     let me_hex = me.public_key().to_hex();

crates/vector-core/src/community/v2/service.rs

@@ -1,6 +1,6 @@
 [package]
 name = "vector_sdk"
-version = "0.4.1"
+version = "0.5.0"
 edition = "2021"
 description = "Ergonomic Rust SDK for building Vector bots and clients on top of vector-core."
 license = "MIT"
@@ -17,7 +17,7 @@ readme = "README.md"
 # (vector-core's `tor` feature is off by default) so the SDK's dep tree is light.
 # `version` is set so the crate is publishable once vector-core ships to crates.io;
 # until then the `path` wins for local builds.
-vector-core = { path = "../vector-core", version = "0.3.0", default-features = false }
+vector-core = { path = "../vector-core", version = "0.4.0", default-features = false }
 nostr-sdk = "0.44.1"
 tokio = { version = "1.49", features = ["rt", "rt-multi-thread", "macros", "time"] }
 serde = { version = "1", features = ["derive"] }