@agentvault/agentvault 0.19.34 → 0.19.36

package/dist/cli.js

@@ -44744,7 +44744,7 @@ var init_ratchet = __esm({
   async "../crypto/dist/ratchet.js"() {
     "use strict";
     await init_libsodium_wrappers();
-    MAX_SKIP = 100;
+    MAX_SKIP = 1e3;
     CHAIN_KEY_SEED = new Uint8Array([1]);
     MSG_KEY_SEED = new Uint8Array([2]);
     HEADER_KEY_SEED = new Uint8Array([3]);
@@ -47175,6 +47175,12 @@ var init_channel = __esm({
           this._primaryConversationId = this._persisted.primaryConversationId;
           this._fingerprint = this._persisted.fingerprint;
           this._lastInboundRoomId = this._persisted.lastInboundRoomId;
+          if (this._persisted.seenMessageIds) {
+            this._seenMessageIds = new Set(this._persisted.seenMessageIds.slice(-_SecureChannel.SEEN_MSG_MAX));
+          }
+          if (this._persisted.seenA2AMessageIds) {
+            this._a2aSeenMessageIds = new Set(this._persisted.seenA2AMessageIds.slice(-_SecureChannel.A2A_SEEN_MAX));
+          }
           for (const [convId, sessionData] of Object.entries(
             this._persisted.sessions
           )) {
@@ -47183,7 +47189,8 @@ var init_channel = __esm({
               this._sessions.set(convId, {
                 ownerDeviceId: sessionData.ownerDeviceId,
                 ratchet,
-                activated: sessionData.activated ?? false
+                activated: sessionData.activated ?? false,
+                epoch: sessionData.epoch
               });
             }
           }
@@ -47222,7 +47229,8 @@ var init_channel = __esm({
                 this._sessions.set(convId, {
                   ownerDeviceId: sd.ownerDeviceId,
                   ratchet: DoubleRatchet.deserialize(sd.ratchetState),
-                  activated: sd.activated ?? false
+                  activated: sd.activated ?? false,
+                  epoch: sd.epoch
                 });
               }
             }
@@ -47321,6 +47329,7 @@ var init_channel = __esm({
         }
         const messageGroupId = randomUUID2();
         let sentCount = 0;
+        const pendingWsSends = [];
         for (const [convId, session] of this._sessions) {
           if (!session.activated) continue;
           if (roomConvIds.has(convId)) continue;
@@ -47353,7 +47362,7 @@ var init_channel = __esm({
               if (this._persisted?.hubId) {
                 payload.sender_hub_id = this._persisted.hubId;
               }
-              this._ws.send(
+              pendingWsSends.push(
                 JSON.stringify({
                   event: "message",
                   data: payload
@@ -47379,6 +47388,9 @@ var init_channel = __esm({
           console.warn("[SecureChannel] send() delivered to 0 sessions (all skipped or failed)");
         }
         await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       /**
        * Send a typing indicator to all owner devices.
@@ -47558,13 +47570,15 @@ var init_channel = __esm({
           this._sessions.set(conv.id, {
             ownerDeviceId: otherDeviceId,
             ratchet,
-            activated: isInitiator
+            activated: isInitiator,
             // initiator can send immediately
+            epoch: 1
           });
           this._persisted.sessions[conv.id] = {
             ownerDeviceId: otherDeviceId,
             ratchetState: ratchet.serialize(),
-            activated: isInitiator
+            activated: isInitiator,
+            epoch: 1
           };
           conversationIds.push(conv.id);
           console.log(
@@ -47657,6 +47671,7 @@ var init_channel = __esm({
         if (recipients.length === 0) {
           throw new Error("No active sessions in room");
         }
+        await this._persistState();
         if (this._state === "ready" && this._ws) {
           this._ws.send(
             JSON.stringify({
@@ -47696,7 +47711,6 @@ var init_channel = __esm({
             throw new Error(`Failed to send room message: ${err}`);
           }
         }
-        await this._persistState();
       }
       /**
        * Leave a room: remove sessions and persisted room state.
@@ -47795,11 +47809,12 @@ var init_channel = __esm({
           attachment: attachMeta
         });
         const messageGroupId = randomUUID2();
+        const pendingWsSends = [];
         for (const [convId, session] of this._sessions) {
           if (!session.activated) continue;
           const encrypted = session.ratchet.encrypt(envelope);
           const transport = encryptedMessageToTransport(encrypted);
-          this._ws.send(
+          pendingWsSends.push(
             JSON.stringify({
               event: "message",
               data: {
@@ -47813,6 +47828,9 @@ var init_channel = __esm({
           );
         }
         await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       async sendActionConfirmation(confirmation) {
         const envelope = {
@@ -48655,12 +48673,14 @@ var init_channel = __esm({
             this._sessions.set(conv.conversation_id, {
               ownerDeviceId: conv.owner_device_id,
               ratchet,
-              activated: false
+              activated: false,
               // Wait for owner's first message before sending to this session
+              epoch: 1
             });
             sessions[conv.conversation_id] = {
               ownerDeviceId: conv.owner_device_id,
-              ratchetState: ratchet.serialize()
+              ratchetState: ratchet.serialize(),
+              epoch: 1
             };
             console.log(
               `[SecureChannel] Session initialized for conv ${conv.conversation_id.slice(0, 8)}... (owner ${conv.owner_device_id.slice(0, 8)}..., primary=${conv.is_primary})`
@@ -49159,8 +49179,9 @@ var init_channel = __esm({
                     ownerDeviceId: "",
                     // A2A sessions don't have an owner device
                     ratchetState: ratchet.serialize(),
-                    activated: activatedRole === "initiator"
+                    activated: activatedRole === "initiator",
                     // initiator can send immediately
+                    epoch: 1
                   };
                   channelEntry.role = activatedRole;
                   if (convId) channelEntry.conversationId = convId;
@@ -49345,7 +49366,8 @@ var init_channel = __esm({
                   conversation_id: convId,
                   reason: "no_session",
                   identity_public_key: this._persisted.identityKeypair.publicKey,
-                  ephemeral_public_key: this._persisted.ephemeralKeypair.publicKey
+                  ephemeral_public_key: this._persisted.ephemeralKeypair.publicKey,
+                  epoch: this._persisted.sessions[convId]?.epoch
                 }
               })
             );
@@ -49384,7 +49406,8 @@ var init_channel = __esm({
                   conversation_id: convId,
                   reason: "decrypt_failure",
                   identity_public_key: idPubHex,
-                  ephemeral_public_key: ephPubHex
+                  ephemeral_public_key: ephPubHex,
+                  epoch: this._persisted?.sessions[convId]?.epoch
                 }
               })
             );
@@ -49629,11 +49652,12 @@ ${messageText}`;
         });
         this._appendHistory("agent", plaintext, topicId);
         const messageGroupId = randomUUID2();
+        const pendingWsSends = [];
         for (const [convId, session] of this._sessions) {
           if (!session.activated) continue;
           const encrypted = session.ratchet.encrypt(envelope);
           const transport = encryptedMessageToTransport(encrypted);
-          this._ws.send(
+          pendingWsSends.push(
             JSON.stringify({
               event: "message",
               data: {
@@ -49647,6 +49671,9 @@ ${messageText}`;
           );
         }
         await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       /**
        * Relay an owner's message to all sibling sessions as encrypted sync messages.
@@ -49669,13 +49696,14 @@ ${messageText}`;
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           topicId
         });
+        const pendingWsSends = [];
         for (const [siblingConvId, siblingSession] of this._sessions) {
           if (siblingConvId === sourceConvId) continue;
           if (!siblingSession.activated) continue;
           if (roomConvIds.has(siblingConvId)) continue;
           const syncEncrypted = siblingSession.ratchet.encrypt(syncPayload);
           const syncTransport = encryptedMessageToTransport(syncEncrypted);
-          this._ws.send(
+          pendingWsSends.push(
             JSON.stringify({
               event: "message",
               data: {
@@ -49686,6 +49714,10 @@ ${messageText}`;
             })
           );
         }
+        await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       /**
        * Resolve the agent's workspace directory.
@@ -49729,6 +49761,7 @@ ${messageText}`;
         const plaintext = JSON.stringify(payload);
         const encrypted = session.ratchet.encrypt(plaintext);
         const transport = encryptedMessageToTransport(encrypted);
+        await this._persistState();
         this._ws.send(
           JSON.stringify({
             event: "message",
@@ -49739,7 +49772,6 @@ ${messageText}`;
             }
           })
         );
-        await this._persistState();
       }
       /**
        * Send stored message history to a newly-activated session.
@@ -49762,6 +49794,7 @@ ${messageText}`;
         });
         const encrypted = session.ratchet.encrypt(replayPayload);
         const transport = encryptedMessageToTransport(encrypted);
+        await this._persistState();
         this._ws.send(
           JSON.stringify({
             event: "message",
@@ -49808,13 +49841,15 @@ ${messageText}`;
           this._sessions.set(event.conversation_id, {
             ownerDeviceId: event.owner_device_id,
             ratchet,
-            activated: false
+            activated: false,
             // Wait for owner's first message
+            epoch: 1
           });
           this._persisted.sessions[event.conversation_id] = {
             ownerDeviceId: event.owner_device_id,
             ratchetState: ratchet.serialize(),
-            activated: false
+            activated: false,
+            epoch: 1
           };
           if (event.owner_hub_id) {
             this._persisted.ownerHubId = event.owner_hub_id;
@@ -49861,17 +49896,21 @@ ${messageText}`;
             keyType: "ed25519"
           }, hexToBytes(data.identity_public_key));
           const existingSession = this._sessions.get(convId);
+          const existingPersisted = this._persisted.sessions[convId];
           const ownerDeviceId = data.sender_device_id ?? existingSession?.ownerDeviceId ?? "";
+          const newEpoch = (existingPersisted?.epoch ?? existingSession?.epoch ?? 0) + 1;
           this._sessions.set(convId, {
             ownerDeviceId,
             ratchet,
-            activated: false
+            activated: false,
             // Wait for owner's encrypted session_init
+            epoch: newEpoch
           });
           this._persisted.sessions[convId] = {
             ownerDeviceId,
             ratchetState: ratchet.serialize(),
-            activated: false
+            activated: false,
+            epoch: newEpoch
           };
           await this._persistState();
           if (this._ws) {
@@ -49881,7 +49920,8 @@ ${messageText}`;
                 data: {
                   conversation_id: convId,
                   identity_public_key: identity.publicKey,
-                  ephemeral_public_key: ephemeral.publicKey
+                  ephemeral_public_key: ephemeral.publicKey,
+                  epoch: newEpoch
                 }
               })
             );
@@ -49895,6 +49935,32 @@ ${messageText}`;
           this.emit("error", err);
         }
       }
+      /**
+       * Send a resync_request for a room conversation if the cooldown has elapsed.
+       * Shared by all room ratchet failure paths to avoid code duplication.
+       */
+      _sendRoomResyncIfCooled(convId, reason, session) {
+        const RESYNC_COOLDOWN_MS = 5 * 60 * 1e3;
+        const lastResync = this._lastResyncRequest.get(convId) ?? 0;
+        if (Date.now() - lastResync > RESYNC_COOLDOWN_MS && this._ws && this._persisted) {
+          this._lastResyncRequest.set(convId, Date.now());
+          this._ws.send(
+            JSON.stringify({
+              event: "resync_request",
+              data: {
+                conversation_id: convId,
+                reason,
+                identity_public_key: this._persisted.identityKeypair.publicKey,
+                ephemeral_public_key: this._persisted.ephemeralKeypair.publicKey,
+                epoch: session?.epoch
+              }
+            })
+          );
+          console.log(
+            `[SecureChannel] Room resync requested for conv ${convId.slice(0, 8)} (${reason})`
+          );
+        }
+      }
       /**
        * Handle an incoming room message. Finds the pairwise conversation
        * for the sender, decrypts, and emits a room_message event.
@@ -50014,20 +50080,39 @@ ${messageText}`;
             console.log(
               `[SecureChannel] Room ratchet re-initialized for conv ${convId.slice(0, 8)}...`
             );
-            plaintext = session.ratchet.decrypt(encrypted);
-            session.activated = true;
-            if (this._persisted.sessions[convId]) {
-              this._persisted.sessions[convId].activated = true;
+            const incomingMsgNum = encrypted.header.messageNumber;
+            if (incomingMsgNum <= 5) {
+              try {
+                plaintext = session.ratchet.decrypt(encrypted);
+                session.activated = true;
+                if (this._persisted.sessions[convId]) {
+                  this._persisted.sessions[convId].activated = true;
+                }
+                await this._persistState();
+                console.log(
+                  `[SecureChannel] Room session ${convId.slice(0, 8)}... re-activated after ratchet re-init`
+                );
+              } catch (retryErr) {
+                console.warn(
+                  `[SecureChannel] Room re-init retry failed for conv ${convId.slice(0, 8)} (msgNum=${incomingMsgNum}):`,
+                  retryErr
+                );
+                this._sendRoomResyncIfCooled(convId, "room_reinit_retry_failed", session);
+                return;
+              }
+            } else {
+              console.log(
+                `[SecureChannel] Room re-init: skipping message with msgNum=${incomingMsgNum} for conv ${convId.slice(0, 8)} (too far ahead for fresh ratchet)`
+              );
+              this._sendRoomResyncIfCooled(convId, "room_message_skip");
+              return;
             }
-            await this._persistState();
-            console.log(
-              `[SecureChannel] Room session ${convId.slice(0, 8)}... re-activated after ratchet re-init`
-            );
           } catch (reinitErr) {
             console.error(
               `[SecureChannel] Room ratchet re-init failed for conv ${convId.slice(0, 8)}...:`,
               reinitErr
             );
+            this._sendRoomResyncIfCooled(convId, "room_reinit_failed");
             return;
           }
         }
@@ -50201,13 +50286,14 @@ ${messageText}`;
         const dist = chain.getDistribution(this._deviceId);
         const distJson = JSON.stringify(dist);
         const alreadyDistributed = new Set(room.distributedTo ?? []);
+        const pendingWsSends = [];
         for (const convId of room.conversationIds) {
           const session = this._sessions.get(convId);
           if (!session || alreadyDistributed.has(session.ownerDeviceId)) continue;
           const encrypted = session.ratchet.encrypt(distJson);
           const transport = encryptedMessageToTransport(encrypted);
           if (this._state === "ready" && this._ws) {
-            this._ws.send(
+            pendingWsSends.push(
               JSON.stringify({
                 event: "sender_key_distribution",
                 data: {
@@ -50223,6 +50309,9 @@ ${messageText}`;
         }
         room.distributedTo = [...alreadyDistributed];
         await this._persistState();
+        for (const frame of pendingWsSends) {
+          this._ws.send(frame);
+        }
       }
       /**
        * Handle an incoming sender_key_distribution event.
@@ -50420,8 +50509,10 @@ ${messageText}`;
               try {
                 a2aPlaintext = ratchet.decrypt(encryptedMessage);
               } catch (decryptErr) {
-                console.error(`[SecureChannel] A2A decrypt failed \u2014 restoring ratchet state:`, decryptErr);
+                console.error(`[SecureChannel] A2A decrypt failed \u2014 restoring ratchet, initiating rekey:`, decryptErr);
                 channelEntry.session.ratchetState = ratchetSnapshot;
+                await this._persistState();
+                await this._initiateA2ARekey(channelId);
                 return;
               }
               channelEntry.session.ratchetState = ratchet.serialize();
@@ -50463,24 +50554,9 @@ ${messageText}`;
             }
           } else {
             console.warn(
-              `[SecureChannel] Received encrypted A2A but no session for ${channelId.slice(0, 8)} \u2014 triggering key exchange`
+              `[SecureChannel] Received encrypted A2A but no session for ${channelId.slice(0, 8)} \u2014 initiating rekey`
             );
-            const entry = this._persisted?.a2aChannels?.[channelId];
-            if (entry && !entry.pendingEphemeralPrivateKey && !entry.session) {
-              try {
-                const a2aEphemeral = await generateEphemeralKeypair();
-                const ephPubHex = bytesToHex(a2aEphemeral.publicKey);
-                entry.pendingEphemeralPrivateKey = bytesToHex(a2aEphemeral.privateKey);
-                this._ws?.send(JSON.stringify({
-                  event: "a2a_key_exchange",
-                  data: { channel_id: channelId, ephemeral_key: ephPubHex }
-                }));
-                await this._persistState();
-                console.log(`[SecureChannel] On-demand A2A key exchange for ${channelId.slice(0, 8)}`);
-              } catch (kxErr) {
-                console.warn(`[SecureChannel] On-demand key exchange failed:`, kxErr);
-              }
-            }
+            await this._initiateA2ARekey(channelId);
           }
         } else {
           const a2aMsg = {
@@ -50497,6 +50573,51 @@ ${messageText}`;
           }
         }
       }
+      /**
+       * Initiate A2A channel rekey after decrypt failure.
+       * Calls the backend to reset channel to approved, clears local session,
+       * and submits a fresh ephemeral key for key exchange.
+       */
+      async _initiateA2ARekey(channelId) {
+        const entry = this._persisted?.a2aChannels?.[channelId];
+        if (!entry || !this._deviceJwt || !this._ws) return;
+        const now = Date.now();
+        const lastRekey = entry._lastRekeyAttempt ?? 0;
+        if (now - lastRekey < 3e4) return;
+        entry._lastRekeyAttempt = now;
+        console.log(`[SecureChannel] Initiating A2A rekey for ${channelId.slice(0, 8)}...`);
+        try {
+          const res = await fetch(
+            `${this.config.apiUrl}/api/v1/a2a/channels/${channelId}/rekey`,
+            {
+              method: "POST",
+              headers: { Authorization: `Bearer ${this._deviceJwt}` }
+            }
+          );
+          if (!res.ok) {
+            const detail = await res.text();
+            console.warn(`[SecureChannel] A2A rekey API failed (${res.status}): ${detail}`);
+            return;
+          }
+          delete entry.session;
+          delete entry.observerSession;
+          delete entry.pendingEphemeralPrivateKey;
+          delete entry.pendingObserverEphemeralPrivateKey;
+          const a2aEphemeral = await generateEphemeralKeypair();
+          entry.pendingEphemeralPrivateKey = bytesToHex(a2aEphemeral.privateKey);
+          this._ws.send(JSON.stringify({
+            event: "a2a_key_exchange",
+            data: {
+              channel_id: channelId,
+              ephemeral_key: bytesToHex(a2aEphemeral.publicKey)
+            }
+          }));
+          await this._persistState();
+          console.log(`[SecureChannel] A2A rekey submitted for ${channelId.slice(0, 8)}`);
+        } catch (err) {
+          console.warn(`[SecureChannel] A2A rekey failed:`, err);
+        }
+      }
       /**
        * Paginated sync: fetch missed messages in pages of 200, up to 5 pages (1000 messages).
        * Tracks message IDs in _syncMessageIds to prevent duplicate processing from concurrent WS messages.
@@ -50917,6 +51038,8 @@ ${messageText}`;
         const hasA2AChannels = !!this._persisted.a2aChannels && Object.keys(this._persisted.a2aChannels).length > 0;
         if (!hasOwnerSessions && !hasA2AChannels) return;
         this._persisted.lastInboundRoomId = this._lastInboundRoomId;
+        this._persisted.seenMessageIds = [...this._seenMessageIds].slice(-_SecureChannel.SEEN_MSG_MAX);
+        this._persisted.seenA2AMessageIds = [...this._a2aSeenMessageIds].slice(-_SecureChannel.A2A_SEEN_MAX);
         for (const [convId, session] of this._sessions) {
           this._persisted.sessions[convId] = {
             ownerDeviceId: session.ownerDeviceId,