@agentvault/agentvault 0.19.34 → 0.19.35

package/dist/cli.js

@@ -44744,7 +44744,7 @@ var init_ratchet = __esm({
   async "../crypto/dist/ratchet.js"() {
     "use strict";
     await init_libsodium_wrappers();
-    MAX_SKIP = 100;
+    MAX_SKIP = 1e3;
     CHAIN_KEY_SEED = new Uint8Array([1]);
     MSG_KEY_SEED = new Uint8Array([2]);
     HEADER_KEY_SEED = new Uint8Array([3]);
@@ -47175,6 +47175,12 @@ var init_channel = __esm({
           this._primaryConversationId = this._persisted.primaryConversationId;
           this._fingerprint = this._persisted.fingerprint;
           this._lastInboundRoomId = this._persisted.lastInboundRoomId;
+          if (this._persisted.seenMessageIds) {
+            this._seenMessageIds = new Set(this._persisted.seenMessageIds.slice(-_SecureChannel.SEEN_MSG_MAX));
+          }
+          if (this._persisted.seenA2AMessageIds) {
+            this._a2aSeenMessageIds = new Set(this._persisted.seenA2AMessageIds.slice(-_SecureChannel.A2A_SEEN_MAX));
+          }
           for (const [convId, sessionData] of Object.entries(
             this._persisted.sessions
           )) {
@@ -47321,6 +47327,7 @@ var init_channel = __esm({
         }
         const messageGroupId = randomUUID2();
         let sentCount = 0;
+        const pendingWsSends = [];
         for (const [convId, session] of this._sessions) {
           if (!session.activated) continue;
           if (roomConvIds.has(convId)) continue;
@@ -47353,7 +47360,7 @@ var init_channel = __esm({
               if (this._persisted?.hubId) {
                 payload.sender_hub_id = this._persisted.hubId;
               }
-              this._ws.send(
+              pendingWsSends.push(
                 JSON.stringify({
                   event: "message",
                   data: payload
@@ -47379,6 +47386,9 @@ var init_channel = __esm({
           console.warn("[SecureChannel] send() delivered to 0 sessions (all skipped or failed)");
         }
         await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       /**
        * Send a typing indicator to all owner devices.
@@ -47657,6 +47667,7 @@ var init_channel = __esm({
         if (recipients.length === 0) {
           throw new Error("No active sessions in room");
         }
+        await this._persistState();
         if (this._state === "ready" && this._ws) {
           this._ws.send(
             JSON.stringify({
@@ -47696,7 +47707,6 @@ var init_channel = __esm({
             throw new Error(`Failed to send room message: ${err}`);
           }
         }
-        await this._persistState();
       }
       /**
        * Leave a room: remove sessions and persisted room state.
@@ -47795,11 +47805,12 @@ var init_channel = __esm({
           attachment: attachMeta
         });
         const messageGroupId = randomUUID2();
+        const pendingWsSends = [];
         for (const [convId, session] of this._sessions) {
           if (!session.activated) continue;
           const encrypted = session.ratchet.encrypt(envelope);
           const transport = encryptedMessageToTransport(encrypted);
-          this._ws.send(
+          pendingWsSends.push(
             JSON.stringify({
               event: "message",
               data: {
@@ -47813,6 +47824,9 @@ var init_channel = __esm({
           );
         }
         await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       async sendActionConfirmation(confirmation) {
         const envelope = {
@@ -49629,11 +49643,12 @@ ${messageText}`;
         });
         this._appendHistory("agent", plaintext, topicId);
         const messageGroupId = randomUUID2();
+        const pendingWsSends = [];
         for (const [convId, session] of this._sessions) {
           if (!session.activated) continue;
           const encrypted = session.ratchet.encrypt(envelope);
           const transport = encryptedMessageToTransport(encrypted);
-          this._ws.send(
+          pendingWsSends.push(
             JSON.stringify({
               event: "message",
               data: {
@@ -49647,6 +49662,9 @@ ${messageText}`;
           );
         }
         await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       /**
        * Relay an owner's message to all sibling sessions as encrypted sync messages.
@@ -49669,13 +49687,14 @@ ${messageText}`;
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           topicId
         });
+        const pendingWsSends = [];
         for (const [siblingConvId, siblingSession] of this._sessions) {
           if (siblingConvId === sourceConvId) continue;
           if (!siblingSession.activated) continue;
           if (roomConvIds.has(siblingConvId)) continue;
           const syncEncrypted = siblingSession.ratchet.encrypt(syncPayload);
           const syncTransport = encryptedMessageToTransport(syncEncrypted);
-          this._ws.send(
+          pendingWsSends.push(
             JSON.stringify({
               event: "message",
               data: {
@@ -49686,6 +49705,10 @@ ${messageText}`;
             })
           );
         }
+        await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       /**
        * Resolve the agent's workspace directory.
@@ -49729,6 +49752,7 @@ ${messageText}`;
         const plaintext = JSON.stringify(payload);
         const encrypted = session.ratchet.encrypt(plaintext);
         const transport = encryptedMessageToTransport(encrypted);
+        await this._persistState();
         this._ws.send(
           JSON.stringify({
             event: "message",
@@ -49739,7 +49763,6 @@ ${messageText}`;
             }
           })
         );
-        await this._persistState();
       }
       /**
        * Send stored message history to a newly-activated session.
@@ -49762,6 +49785,7 @@ ${messageText}`;
         });
         const encrypted = session.ratchet.encrypt(replayPayload);
         const transport = encryptedMessageToTransport(encrypted);
+        await this._persistState();
         this._ws.send(
           JSON.stringify({
             event: "message",
@@ -50014,15 +50038,31 @@ ${messageText}`;
             console.log(
               `[SecureChannel] Room ratchet re-initialized for conv ${convId.slice(0, 8)}...`
             );
-            plaintext = session.ratchet.decrypt(encrypted);
-            session.activated = true;
-            if (this._persisted.sessions[convId]) {
-              this._persisted.sessions[convId].activated = true;
+            const incomingMsgNum = encrypted.header.messageNumber;
+            if (incomingMsgNum <= 5) {
+              try {
+                plaintext = session.ratchet.decrypt(encrypted);
+                session.activated = true;
+                if (this._persisted.sessions[convId]) {
+                  this._persisted.sessions[convId].activated = true;
+                }
+                await this._persistState();
+                console.log(
+                  `[SecureChannel] Room session ${convId.slice(0, 8)}... re-activated after ratchet re-init`
+                );
+              } catch (retryErr) {
+                console.warn(
+                  `[SecureChannel] Room re-init retry failed for conv ${convId.slice(0, 8)} (msgNum=${incomingMsgNum}):`,
+                  retryErr
+                );
+                return;
+              }
+            } else {
+              console.log(
+                `[SecureChannel] Room re-init: skipping message with msgNum=${incomingMsgNum} for conv ${convId.slice(0, 8)} (too far ahead for fresh ratchet)`
+              );
+              return;
             }
-            await this._persistState();
-            console.log(
-              `[SecureChannel] Room session ${convId.slice(0, 8)}... re-activated after ratchet re-init`
-            );
           } catch (reinitErr) {
             console.error(
               `[SecureChannel] Room ratchet re-init failed for conv ${convId.slice(0, 8)}...:`,
@@ -50201,13 +50241,14 @@ ${messageText}`;
         const dist = chain.getDistribution(this._deviceId);
         const distJson = JSON.stringify(dist);
         const alreadyDistributed = new Set(room.distributedTo ?? []);
+        const pendingWsSends = [];
         for (const convId of room.conversationIds) {
           const session = this._sessions.get(convId);
           if (!session || alreadyDistributed.has(session.ownerDeviceId)) continue;
           const encrypted = session.ratchet.encrypt(distJson);
           const transport = encryptedMessageToTransport(encrypted);
           if (this._state === "ready" && this._ws) {
-            this._ws.send(
+            pendingWsSends.push(
               JSON.stringify({
                 event: "sender_key_distribution",
                 data: {
@@ -50223,6 +50264,9 @@ ${messageText}`;
         }
         room.distributedTo = [...alreadyDistributed];
         await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       /**
        * Handle an incoming sender_key_distribution event.
@@ -50420,8 +50464,10 @@ ${messageText}`;
               try {
                 a2aPlaintext = ratchet.decrypt(encryptedMessage);
               } catch (decryptErr) {
-                console.error(`[SecureChannel] A2A decrypt failed \u2014 restoring ratchet state:`, decryptErr);
+                console.error(`[SecureChannel] A2A decrypt failed \u2014 restoring ratchet, initiating rekey:`, decryptErr);
                 channelEntry.session.ratchetState = ratchetSnapshot;
+                await this._persistState();
+                await this._initiateA2ARekey(channelId);
                 return;
               }
               channelEntry.session.ratchetState = ratchet.serialize();
@@ -50463,24 +50509,9 @@ ${messageText}`;
             }
           } else {
             console.warn(
-              `[SecureChannel] Received encrypted A2A but no session for ${channelId.slice(0, 8)} \u2014 triggering key exchange`
+              `[SecureChannel] Received encrypted A2A but no session for ${channelId.slice(0, 8)} \u2014 initiating rekey`
             );
-            const entry = this._persisted?.a2aChannels?.[channelId];
-            if (entry && !entry.pendingEphemeralPrivateKey && !entry.session) {
-              try {
-                const a2aEphemeral = await generateEphemeralKeypair();
-                const ephPubHex = bytesToHex(a2aEphemeral.publicKey);
-                entry.pendingEphemeralPrivateKey = bytesToHex(a2aEphemeral.privateKey);
-                this._ws?.send(JSON.stringify({
-                  event: "a2a_key_exchange",
-                  data: { channel_id: channelId, ephemeral_key: ephPubHex }
-                }));
-                await this._persistState();
-                console.log(`[SecureChannel] On-demand A2A key exchange for ${channelId.slice(0, 8)}`);
-              } catch (kxErr) {
-                console.warn(`[SecureChannel] On-demand key exchange failed:`, kxErr);
-              }
-            }
+            await this._initiateA2ARekey(channelId);
           }
         } else {
           const a2aMsg = {
@@ -50497,6 +50528,51 @@ ${messageText}`;
           }
         }
       }
+      /**
+       * Initiate A2A channel rekey after decrypt failure.
+       * Calls the backend to reset channel to approved, clears local session,
+       * and submits a fresh ephemeral key for key exchange.
+       */
+      async _initiateA2ARekey(channelId) {
+        const entry = this._persisted?.a2aChannels?.[channelId];
+        if (!entry || !this._deviceJwt || !this._ws) return;
+        const now = Date.now();
+        const lastRekey = entry._lastRekeyAttempt ?? 0;
+        if (now - lastRekey < 3e4) return;
+        entry._lastRekeyAttempt = now;
+        console.log(`[SecureChannel] Initiating A2A rekey for ${channelId.slice(0, 8)}...`);
+        try {
+          const res = await fetch(
+            `${this.config.apiUrl}/api/v1/a2a/channels/${channelId}/rekey`,
+            {
+              method: "POST",
+              headers: { Authorization: `Bearer ${this._deviceJwt}` }
+            }
+          );
+          if (!res.ok) {
+            const detail = await res.text();
+            console.warn(`[SecureChannel] A2A rekey API failed (${res.status}): ${detail}`);
+            return;
+          }
+          delete entry.session;
+          delete entry.observerSession;
+          delete entry.pendingEphemeralPrivateKey;
+          delete entry.pendingObserverEphemeralPrivateKey;
+          const a2aEphemeral = await generateEphemeralKeypair();
+          entry.pendingEphemeralPrivateKey = bytesToHex(a2aEphemeral.privateKey);
+          this._ws.send(JSON.stringify({
+            event: "a2a_key_exchange",
+            data: {
+              channel_id: channelId,
+              ephemeral_key: bytesToHex(a2aEphemeral.publicKey)
+            }
+          }));
+          await this._persistState();
+          console.log(`[SecureChannel] A2A rekey submitted for ${channelId.slice(0, 8)}`);
+        } catch (err) {
+          console.warn(`[SecureChannel] A2A rekey failed:`, err);
+        }
+      }
       /**
        * Paginated sync: fetch missed messages in pages of 200, up to 5 pages (1000 messages).
        * Tracks message IDs in _syncMessageIds to prevent duplicate processing from concurrent WS messages.
@@ -50917,6 +50993,8 @@ ${messageText}`;
         const hasA2AChannels = !!this._persisted.a2aChannels && Object.keys(this._persisted.a2aChannels).length > 0;
         if (!hasOwnerSessions && !hasA2AChannels) return;
         this._persisted.lastInboundRoomId = this._lastInboundRoomId;
+        this._persisted.seenMessageIds = [...this._seenMessageIds].slice(-_SecureChannel.SEEN_MSG_MAX);
+        this._persisted.seenA2AMessageIds = [...this._a2aSeenMessageIds].slice(-_SecureChannel.A2A_SEEN_MAX);
         for (const [convId, session] of this._sessions) {
           this._persisted.sessions[convId] = {
             ownerDeviceId: session.ownerDeviceId,