@agentvault/agentvault 0.20.26 → 0.20.28

package/dist/index.js

@@ -62722,6 +62722,43 @@ var init_dist = __esm({
 // src/mls-state.ts
 import { mkdir, readFile, writeFile, rm } from "node:fs/promises";
 import { join } from "node:path";
+function syncLockPath(dataDir, channelId) {
+  const safe = channelId.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return join(dataDir, `mls-a2a-sync-${safe}.lock`);
+}
+async function acquireA2ASyncLock(dataDir, channelId) {
+  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  const lockFile = syncLockPath(dataDir, channelId);
+  const content = JSON.stringify({ pid: process.pid, timestamp: Date.now() });
+  try {
+    await writeFile(lockFile, content, { encoding: "utf-8", mode: FILE_MODE, flag: "wx" });
+    return true;
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+    try {
+      const raw = await readFile(lockFile, "utf-8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.timestamp === "number" && Date.now() - parsed.timestamp > SYNC_LOCK_STALE_MS) {
+        await rm(lockFile).catch(() => {
+        });
+        try {
+          await writeFile(lockFile, content, { encoding: "utf-8", mode: FILE_MODE, flag: "wx" });
+          return true;
+        } catch {
+          return false;
+        }
+      }
+    } catch {
+    }
+    return false;
+  }
+}
+async function releaseA2ASyncLock(dataDir, channelId) {
+  try {
+    await rm(syncLockPath(dataDir, channelId));
+  } catch {
+  }
+}
 function mlsFileName(groupId) {
   const safe = groupId.replace(/[^a-zA-Z0-9_-]/g, "_");
   return `mls-${safe}.json`;
@@ -62734,10 +62771,10 @@ async function hasPendingWelcome(dataDir, groupId) {
     return false;
   }
 }
-async function savePendingKpBundle(dataDir, groupId, kp) {
+async function savePendingKpBundle(dataDir, groupId, kp, serializePublicFn) {
   await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
   const serialized = {
-    publicPackage: Buffer.from(kp.publicPackage).toString("base64"),
+    publicPackageBytes: Buffer.from(serializePublicFn(kp.publicPackage)).toString("base64"),
     privatePackage: {
       initPrivateKey: Buffer.from(kp.privatePackage.initPrivateKey).toString("base64"),
       hpkePrivateKey: Buffer.from(kp.privatePackage.hpkePrivateKey).toString("base64"),
@@ -62751,7 +62788,7 @@ async function loadPendingKpBundle(dataDir, groupId) {
     const raw = await readFile(pendingKpPath(dataDir, groupId), "utf-8");
     const parsed = JSON.parse(raw);
     return {
-      publicPackage: new Uint8Array(Buffer.from(parsed.publicPackage, "base64")),
+      publicPackageBytes: new Uint8Array(Buffer.from(parsed.publicPackageBytes, "base64")),
       privatePackage: {
         initPrivateKey: new Uint8Array(Buffer.from(parsed.privatePackage.initPrivateKey, "base64")),
         hpkePrivateKey: new Uint8Array(Buffer.from(parsed.privatePackage.hpkePrivateKey, "base64")),
@@ -62788,12 +62825,13 @@ async function deleteMlsState(dataDir, groupId) {
   } catch {
   }
 }
-var FILE_MODE, DIR_MODE, pendingKpPath;
+var FILE_MODE, DIR_MODE, SYNC_LOCK_STALE_MS, pendingKpPath;
 var init_mls_state = __esm({
   "src/mls-state.ts"() {
     "use strict";
     FILE_MODE = 384;
     DIR_MODE = 448;
+    SYNC_LOCK_STALE_MS = 5 * 60 * 1e3;
     pendingKpPath = (dataDir, groupId) => join(dataDir, `mls-kp-pending-${groupId.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
   }
 });
@@ -65243,6 +65281,10 @@ var init_channel = __esm({
             }
             const memberMlsGroup = chState.mlsGroupId ? this._mlsGroups.get(`a2a:${chId}`) : void 0;
             if (chState.role === "member" && !memberMlsGroup?.isInitialized) {
+              if (!await acquireA2ASyncLock(this.config.dataDir, chId)) {
+                console.log(`[SecureChannel] A2A ${chId.slice(0, 8)} sync: skipping \u2014 another instance holds the lock`);
+                continue;
+              }
               try {
                 let groupId = chState.mlsGroupId;
                 let memberIds = [];
@@ -65252,11 +65294,15 @@ var init_channel = __esm({
                     { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
                   );
                   if (!groupRes.ok) {
+                    await releaseA2ASyncLock(this.config.dataDir, chId);
                     continue;
                   }
                   const groupData = await groupRes.json();
                   groupId = groupData.group_id;
-                  if (!groupId) continue;
+                  if (!groupId) {
+                    await releaseA2ASyncLock(this.config.dataDir, chId);
+                    continue;
+                  }
                   memberIds = groupData.member_device_ids || [];
                   chState.mlsGroupId = groupId;
                   await this._persistState();
@@ -65284,7 +65330,7 @@ var init_channel = __esm({
                 const identity = new TextEncoder().encode(this._persisted.deviceId);
                 const kp = await mgr.generateKeyPackage(identity);
                 this._pendingMlsKpBundle = kp;
-                await savePendingKpBundle(this.config.dataDir, groupId, kp);
+                await savePendingKpBundle(this.config.dataDir, groupId, kp, MLSGroupManager.serializeKeyPackage);
                 const kpBytes = MLSGroupManager.serializeKeyPackage(kp.publicPackage);
                 await fetch(`${this.config.apiUrl}/api/v1/mls/key-packages`, {
                   method: "POST",
@@ -65309,6 +65355,8 @@ var init_channel = __esm({
                   `[SecureChannel] A2A ${chId.slice(0, 8)} member sync fallback: published KeyPackage + requested Welcome (group=${groupId.slice(0, 8)})`
                 );
               } catch (err) {
+                await releaseA2ASyncLock(this.config.dataDir, chId).catch(() => {
+                });
                 console.warn(`[AgentVault] Sync fallback member MLS join failed for ${chId.slice(0, 8)}:`, err);
               }
             }
@@ -67148,17 +67196,26 @@ ${messageText}`;
       async _handleMlsWelcome(data) {
         const groupId = data.group_id;
         const conversationId = data.conversation_id;
-        const persistedKpAvailable = await hasPendingWelcome(this.config.dataDir, groupId);
-        const kpSource = this._pendingMlsKpBundle ? "pending" : persistedKpAvailable ? "persisted" : this._mlsKeyPackage ? "connect" : "generated";
+        const kpSource = this._pendingMlsKpBundle ? "pending" : this._mlsKeyPackage ? "connect" : await hasPendingWelcome(this.config.dataDir, groupId) ? "persisted" : "generated";
         console.log(`[SecureChannel] Received MLS welcome for group ${groupId?.slice(0, 8)}${conversationId ? ` conv=${conversationId.slice(0, 8)}` : ""} kpSource=${kpSource}`);
         try {
           const welcomeBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
           const mgr = new MLSGroupManager();
-          const persistedKp = await loadPendingKpBundle(this.config.dataDir, groupId);
-          const kp = this._pendingMlsKpBundle ?? persistedKp ?? this._mlsKeyPackage ?? await (async () => {
+          let kp = this._pendingMlsKpBundle ?? this._mlsKeyPackage;
+          if (!kp) {
+            const persisted = await loadPendingKpBundle(this.config.dataDir, groupId);
+            if (persisted) {
+              kp = {
+                publicPackage: MLSGroupManager.deserializeKeyPackage(persisted.publicPackageBytes),
+                privatePackage: persisted.privatePackage
+              };
+              console.log(`[SecureChannel] Loaded persisted KP bundle for group ${groupId?.slice(0, 8)}`);
+            }
+          }
+          if (!kp) {
             const identity = new TextEncoder().encode(this._deviceId);
-            return mgr.generateKeyPackage(identity);
-          })();
+            kp = await mgr.generateKeyPackage(identity);
+          }
           console.log(`[SecureChannel] Welcome joinFromWelcome: group=${groupId?.slice(0, 8)} kpSource=${kpSource} welcomeLen=${welcomeBytes.length}`);
           await mgr.joinFromWelcome(welcomeBytes, kp);
           if (conversationId) {
@@ -67194,6 +67251,8 @@ ${messageText}`;
               await this._persistState();
               await clearPendingWelcome(this.config.dataDir, groupId).catch(() => {
               });
+              await releaseA2ASyncLock(this.config.dataDir, channelId).catch(() => {
+              });
               this._pendingMlsKpBundle = void 0;
               console.log(`[SecureChannel] Joined MLS group for A2A ${channelId.slice(0, 8)} via Welcome (epoch=${mgr.epoch})`);
               if (this.config.onA2AChannelReady && entry.conversationId) {
@@ -67224,11 +67283,16 @@ ${messageText}`;
             this._mlsGroups.set(`a2a:${a2aChannelId}`, mgr);
             await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
             await this._persistState();
+            await releaseA2ASyncLock(this.config.dataDir, a2aChannelId).catch(() => {
+            });
             console.log(`[SecureChannel] Joined MLS group for A2A ${a2aChannelId.slice(0, 8)} via Welcome (new channel, epoch=${mgr.epoch})`);
             return;
           }
           console.warn(`[SecureChannel] MLS welcome for unmatched group ${groupId?.slice(0, 8)} (no room/A2A/conv match)`);
         } catch (err) {
+          const failedA2aId = data.a2a_channel_id;
+          if (failedA2aId) await releaseA2ASyncLock(this.config.dataDir, failedA2aId).catch(() => {
+          });
           console.error(`[SecureChannel] MLS welcome processing failed (kpSource=${kpSource}):`, err);
           throw err;
         }
@@ -94860,7 +94924,7 @@ var init_index = __esm({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.20.26" : "0.0.0-dev";
+    VERSION = true ? "0.20.28" : "0.0.0-dev";
   }
 });
 await init_index();