@agentvault/agentvault 0.19.26 → 0.19.27

package/dist/index.js

@@ -47145,6 +47145,10 @@ var init_channel = __esm({
       /** Dedup buffer for A2A message IDs (prevents double-delivery via direct + Redis) */
       _a2aSeenMessageIds = /* @__PURE__ */ new Set();
       static A2A_SEEN_MAX = 500;
+      /** Whether A2A channel sync has completed after (re)connect */
+      _a2aSyncComplete = false;
+      /** Messages buffered while A2A sync is in progress */
+      _a2aBufferedMessages = [];
       /** Dedup buffer for regular message IDs (prevents double-decrypt via direct WS + Redis pub/sub) */
       _seenMessageIds = /* @__PURE__ */ new Set();
       static SEEN_MSG_MAX = 500;
@@ -48796,6 +48800,8 @@ var init_channel = __esm({
         ws.on("open", async () => {
           try {
             this._reconnectAttempt = 0;
+            this._a2aSyncComplete = false;
+            this._a2aBufferedMessages = [];
             this._lastWsOpenTime = Date.now();
             this._startPing(ws);
             this._startWakeDetector();
@@ -48841,8 +48847,21 @@ var init_channel = __esm({
                   }, 3e3);
                 }
               }
+              this._a2aSyncComplete = true;
+              if (this._a2aBufferedMessages.length > 0) {
+                console.log(`[SecureChannel] Replaying ${this._a2aBufferedMessages.length} buffered A2A message(s)`);
+                const buffered = this._a2aBufferedMessages.splice(0);
+                for (const msg of buffered) {
+                  try {
+                    await this._handleA2AMessage(msg.data);
+                  } catch (err) {
+                    console.warn("[SecureChannel] Failed to replay buffered A2A message:", err);
+                  }
+                }
+              }
             } catch (err) {
               console.warn("[SecureChannel] A2A channel sync failed (non-fatal):", err);
+              this._a2aSyncComplete = true;
             }
             if (!this._telemetryReporter && this._persisted?.deviceJwt && this._persisted?.hubId) {
               this._telemetryReporter = new TelemetryReporter({
@@ -49333,99 +49352,13 @@ var init_channel = __esm({
               this.emit("error", new Error(`Server: ${detail}`));
             }
             if (data.event === "a2a_message") {
-              const msgData = data.data || data;
-              const a2aMsgId = msgData.message_id;
-              if (a2aMsgId && this._a2aSeenMessageIds.has(a2aMsgId)) {
+              if (!this._a2aSyncComplete) {
+                const msgId = (data.data || data).message_id;
+                console.log(`[SecureChannel] Buffering A2A message (sync not complete): ${msgId?.slice(0, 8)}`);
+                this._a2aBufferedMessages.push({ data });
                 return;
               }
-              if (a2aMsgId) {
-                this._a2aSeenMessageIds.add(a2aMsgId);
-                if (this._a2aSeenMessageIds.size > _SecureChannel.A2A_SEEN_MAX) {
-                  const first = this._a2aSeenMessageIds.values().next().value;
-                  if (first) this._a2aSeenMessageIds.delete(first);
-                }
-              }
-              if (msgData.ciphertext && msgData.header_blob) {
-                const channelId = msgData.channel_id || "";
-                const channelEntry = this._persisted?.a2aChannels?.[channelId];
-                if (channelEntry?.session?.ratchetState) {
-                  try {
-                    const headerJson = Buffer.from(msgData.header_blob, "hex").toString("utf-8");
-                    const headerObj = JSON.parse(headerJson);
-                    const encryptedMessage = {
-                      header: {
-                        dhPublicKey: hexToBytes(headerObj.dhPublicKey),
-                        previousChainLength: headerObj.previousChainLength,
-                        messageNumber: headerObj.messageNumber
-                      },
-                      headerSignature: msgData.header_signature ? hexToBytes(msgData.header_signature) : new Uint8Array(64),
-                      ciphertext: hexToBytes(msgData.ciphertext),
-                      nonce: hexToBytes(msgData.nonce)
-                    };
-                    const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
-                    const ratchetSnapshot = channelEntry.session.ratchetState;
-                    let a2aPlaintext;
-                    try {
-                      a2aPlaintext = ratchet.decrypt(encryptedMessage);
-                    } catch (decryptErr) {
-                      console.error(`[SecureChannel] A2A decrypt failed \u2014 restoring ratchet state:`, decryptErr);
-                      channelEntry.session.ratchetState = ratchetSnapshot;
-                      return;
-                    }
-                    channelEntry.session.ratchetState = ratchet.serialize();
-                    if (channelEntry.role === "responder" && !channelEntry.session.activated) {
-                      channelEntry.session.activated = true;
-                      console.log(
-                        `[SecureChannel] A2A responder ratchet activated for ${channelId.slice(0, 8)}...`
-                      );
-                      const queued = this._a2aPendingQueue[channelId];
-                      if (queued && queued.length > 0) {
-                        delete this._a2aPendingQueue[channelId];
-                        console.log(`[SecureChannel] Flushing ${queued.length} queued A2A message(s)`);
-                        await this._persistState();
-                        for (const pending of queued) {
-                          try {
-                            await this.sendToAgent(channelEntry.hubAddress, pending.text, pending.opts);
-                          } catch (flushErr) {
-                            console.error("[SecureChannel] Failed to flush queued A2A message:", flushErr);
-                          }
-                        }
-                      }
-                    }
-                    await this._persistState();
-                    const a2aMsg = {
-                      text: a2aPlaintext,
-                      fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
-                      channelId,
-                      conversationId: msgData.conversation_id || "",
-                      parentSpanId: msgData.parent_span_id,
-                      timestamp: msgData.timestamp || (/* @__PURE__ */ new Date()).toISOString()
-                    };
-                    this.emit("a2a_message", a2aMsg);
-                    if (this.config.onA2AMessage) {
-                      this.config.onA2AMessage(a2aMsg);
-                    }
-                  } catch (decryptErr) {
-                    console.error(`[SecureChannel] A2A decrypt failed for channel ${channelId.slice(0, 8)}...:`, decryptErr);
-                    this.emit("error", decryptErr);
-                  }
-                } else {
-                  console.warn(`[SecureChannel] Received encrypted A2A message but no session for channel ${channelId}`);
-                }
-              } else {
-                const a2aMsg = {
-                  text: msgData.plaintext || msgData.text,
-                  fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
-                  channelId: msgData.channel_id || "",
-                  conversationId: msgData.conversation_id || "",
-                  parentSpanId: msgData.parent_span_id,
-                  timestamp: msgData.timestamp || (/* @__PURE__ */ new Date()).toISOString()
-                };
-                this.emit("a2a_message", a2aMsg);
-                if (this.config.onA2AMessage) {
-                  this.config.onA2AMessage(a2aMsg);
-                }
-              }
+              await this._handleA2AMessage(data);
             }
           } catch (err) {
             this.emit("error", err);
@@ -50504,6 +50437,123 @@ ${messageText}`;
        * Sync missed messages across ALL sessions.
        * For each conversation, fetches messages since last sync and decrypts.
        */
+      /**
+       * Handle an incoming A2A message (extracted from WS handler for reuse during buffer replay).
+       * Includes dedup, encrypted path (with on-demand key exchange), and legacy plaintext path.
+       */
+      async _handleA2AMessage(data) {
+        const msgData = data.data || data;
+        const a2aMsgId = msgData.message_id;
+        if (a2aMsgId && this._a2aSeenMessageIds.has(a2aMsgId)) {
+          return;
+        }
+        if (a2aMsgId) {
+          this._a2aSeenMessageIds.add(a2aMsgId);
+          if (this._a2aSeenMessageIds.size > _SecureChannel.A2A_SEEN_MAX) {
+            const first = this._a2aSeenMessageIds.values().next().value;
+            if (first) this._a2aSeenMessageIds.delete(first);
+          }
+        }
+        if (msgData.ciphertext && msgData.header_blob) {
+          const channelId = msgData.channel_id || "";
+          const channelEntry = this._persisted?.a2aChannels?.[channelId];
+          if (channelEntry?.session?.ratchetState) {
+            try {
+              const headerJson = Buffer.from(msgData.header_blob, "hex").toString("utf-8");
+              const headerObj = JSON.parse(headerJson);
+              const encryptedMessage = {
+                header: {
+                  dhPublicKey: hexToBytes(headerObj.dhPublicKey),
+                  previousChainLength: headerObj.previousChainLength,
+                  messageNumber: headerObj.messageNumber
+                },
+                headerSignature: msgData.header_signature ? hexToBytes(msgData.header_signature) : new Uint8Array(64),
+                ciphertext: hexToBytes(msgData.ciphertext),
+                nonce: hexToBytes(msgData.nonce)
+              };
+              const ratchet = DoubleRatchet.deserialize(channelEntry.session.ratchetState);
+              const ratchetSnapshot = channelEntry.session.ratchetState;
+              let a2aPlaintext;
+              try {
+                a2aPlaintext = ratchet.decrypt(encryptedMessage);
+              } catch (decryptErr) {
+                console.error(`[SecureChannel] A2A decrypt failed \u2014 restoring ratchet state:`, decryptErr);
+                channelEntry.session.ratchetState = ratchetSnapshot;
+                return;
+              }
+              channelEntry.session.ratchetState = ratchet.serialize();
+              if (channelEntry.role === "responder" && !channelEntry.session.activated) {
+                channelEntry.session.activated = true;
+                console.log(
+                  `[SecureChannel] A2A responder ratchet activated for ${channelId.slice(0, 8)}...`
+                );
+                const queued = this._a2aPendingQueue[channelId];
+                if (queued && queued.length > 0) {
+                  delete this._a2aPendingQueue[channelId];
+                  console.log(`[SecureChannel] Flushing ${queued.length} queued A2A message(s)`);
+                  await this._persistState();
+                  for (const pending of queued) {
+                    try {
+                      await this.sendToAgent(channelEntry.hubAddress, pending.text, pending.opts);
+                    } catch (flushErr) {
+                      console.error("[SecureChannel] Failed to flush queued A2A message:", flushErr);
+                    }
+                  }
+                }
+              }
+              await this._persistState();
+              const a2aMsg = {
+                text: a2aPlaintext,
+                fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
+                channelId,
+                conversationId: msgData.conversation_id || "",
+                parentSpanId: msgData.parent_span_id,
+                timestamp: msgData.timestamp || (/* @__PURE__ */ new Date()).toISOString()
+              };
+              this.emit("a2a_message", a2aMsg);
+              if (this.config.onA2AMessage) {
+                this.config.onA2AMessage(a2aMsg);
+              }
+            } catch (decryptErr) {
+              console.error(`[SecureChannel] A2A decrypt failed for channel ${channelId.slice(0, 8)}...:`, decryptErr);
+              this.emit("error", decryptErr);
+            }
+          } else {
+            console.warn(
+              `[SecureChannel] Received encrypted A2A but no session for ${channelId.slice(0, 8)} \u2014 triggering key exchange`
+            );
+            const entry = this._persisted?.a2aChannels?.[channelId];
+            if (entry && !entry.pendingEphemeralPrivateKey && !entry.session) {
+              try {
+                const a2aEphemeral = await generateEphemeralKeypair();
+                const ephPubHex = bytesToHex(a2aEphemeral.publicKey);
+                entry.pendingEphemeralPrivateKey = bytesToHex(a2aEphemeral.privateKey);
+                this._ws?.send(JSON.stringify({
+                  event: "a2a_key_exchange",
+                  data: { channel_id: channelId, ephemeral_key: ephPubHex }
+                }));
+                await this._persistState();
+                console.log(`[SecureChannel] On-demand A2A key exchange for ${channelId.slice(0, 8)}`);
+              } catch (kxErr) {
+                console.warn(`[SecureChannel] On-demand key exchange failed:`, kxErr);
+              }
+            }
+          }
+        } else {
+          const a2aMsg = {
+            text: msgData.plaintext || msgData.text,
+            fromHubAddress: msgData.from_hub_address || msgData.hub_address || "",
+            channelId: msgData.channel_id || "",
+            conversationId: msgData.conversation_id || "",
+            parentSpanId: msgData.parent_span_id,
+            timestamp: msgData.timestamp || (/* @__PURE__ */ new Date()).toISOString()
+          };
+          this.emit("a2a_message", a2aMsg);
+          if (this.config.onA2AMessage) {
+            this.config.onA2AMessage(a2aMsg);
+          }
+        }
+      }
       /**
        * Paginated sync: fetch missed messages in pages of 200, up to 5 pages (1000 messages).
        * Tracks message IDs in _syncMessageIds to prevent duplicate processing from concurrent WS messages.