BloopAI/vibe-kanban · error

unsupported relay WS envelope version

Error message

unsupported relay WS envelope version

What it means

Relay WS messages are carried in signed envelopes with a version field; decode() rejects envelopes whose version differs from the compiled-in ENVELOPE_VERSION to prevent cross-version protocol confusion and downgrade attacks. A mismatch means the peer speaks a different envelope format.

Source

Thrown at crates/relay-ws/src/crypto.rs:90

    pub(crate) fn new(request_signature: &RequestSignature, peer_verify_key: VerifyingKey) -> Self {
        Self {
            request_signature: request_signature.clone(),
            inbound_seq: 0,
            peer_verify_key,
        }
    }

    /// Verify a signed JSON envelope and deserialize it back into a frame.
    ///
    /// Checks the Ed25519 signature and enforces monotonic sequence ordering.
    pub(crate) fn decode(&mut self, raw: &[u8]) -> anyhow::Result<RelayWsFrame> {
        use anyhow::Context as _;

        let envelope: SignedWsEnvelope =
            serde_json::from_slice(raw).context("invalid relay WS envelope JSON")?;

        if envelope.version != ENVELOPE_VERSION {
            anyhow::bail!("unsupported relay WS envelope version");
        }

        let expected_seq = self.inbound_seq.saturating_add(1);
        if envelope.seq != expected_seq {
            anyhow::bail!(
                "invalid relay WS sequence: expected {expected_seq}, got {}",
                envelope.seq
            );
        }

        let payload = BASE64_STANDARD
            .decode(&envelope.payload_b64)
            .context("invalid relay WS payload")?;

        let signing_input = ws_signing_input(
            &self.request_signature,
            envelope.seq,
            envelope.msg_type,

View on GitHub (pinned to 4deb7eca8f)

Solutions

1. Deploy matching versions of relay-ws on both peers (upgrade the outdated one)
2. Confirm ENVELOPE_VERSION on both sides after pulls/releases
3. Pin protocol version in deployment configuration

Example fix

// before
let envelope = SignedWsEnvelope { version: 1, .. }; // peer expects version 2
// after
let envelope = SignedWsEnvelope { version: ENVELOPE_VERSION, .. }; // rebuild/redeploy both sides

fn has_supported_version(env: &SignedWsEnvelope) -> bool { env.version == ENVELOPE_VERSION }

match crypto.decode(raw) { Err(e) if e.to_string().contains("unsupported relay WS envelope version") => negotiate_version_and_reconnect(), other => other? }

When it happens

Trigger: decode() receives an envelope JSON with a version number not equal to ENVELOPE_VERSION — e.g. produced by an older or newer relay node, or corrupted envelope JSON that happens to parse.

Common situations: Mixed-version cluster after a protocol bump; host/relay deployed from different builds; manually crafted or replayed envelope data.

Related errors

• Server message has invalid length.
• Server message has invalid side identifier.
• invalid close payload
• invalid relay WS sequence: expected {expected_seq}, got {}
• request_id called for unsupported request variant

AI-assisted analysis of BloopAI/vibe-kanban@4deb7eca8f (2026-08-29). Data as JSON: /api/errors/405cb1aeef668f5d. Report an issue: GitHub.