@agentvault/agentvault 0.20.31 → 0.20.33

package/dist/cli.js

@@ -63715,12 +63715,15 @@ var init_channel = __esm({
       _syncMessageIds = null;
       _deliveryHeartbeat = null;
       _deliveryPulling = false;
+      _drDeliveryPulling = false;
       /** MLS group managers per room/conversation (roomId or conv:conversationId -> MLSGroupManager) */
       _mlsGroups = /* @__PURE__ */ new Map();
       /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
       _mlsKeyPackage = null;
       /** Pending KeyPackage bundle from request-Welcome flow (used by _handleMlsWelcome). */
       _pendingMlsKpBundle;
+      /** Buffer for MLS commits received before Welcome (keyed by groupId, sorted by epoch). */
+      _pendingMlsCommits = /* @__PURE__ */ new Map();
       /** In-memory credential store for renter-provided credentials (never persisted). */
       _credentialStore = new CredentialStore();
       /** Dedup buffer for A2A message IDs (prevents double-delivery via direct + Redis) */
@@ -65596,6 +65599,7 @@ var init_channel = __esm({
             this._startWakeDetector();
             this._startPendingPoll();
             await this._syncMissedMessages();
+            await this._pullDrDeliveryQueue();
             await this._flushOutboundQueue();
             this._setState("ready");
             if (this.config.enableScanning) {
@@ -65825,6 +65829,11 @@ var init_channel = __esm({
                 console.warn("[SecureChannel] Delivery pull on ping failed:", err);
               });
             }
+            if (data.event === "dr_delivery") {
+              this._pullDrDeliveryQueue().catch((err) => {
+                console.warn("[SecureChannel] DR delivery pull on ping failed:", err);
+              });
+            }
             if (data.event === "mls_welcome_requested") {
               console.log(`[SecureChannel] mls_welcome_requested for group ${(data.data?.group_id || "").slice(0, 8)} \u2014 pulling deliveries`);
               this._pullDeliveryQueue().catch((err) => {
@@ -67030,6 +67039,11 @@ ${messageText}`;
         console.log(`[SecureChannel] MLS decrypt attempt room=${resolvedRoomId.slice(0, 8)} group=${groupId?.slice(0, 8)} loaded=${!!mlsGroup} init=${mlsGroup?.isInitialized} mlsGroupsKeys=[${Array.from(this._mlsGroups.keys()).join(",")}]`);
         if (!mlsGroup?.isInitialized) {
           console.warn(`[SecureChannel] MLS group not loaded for room ${resolvedRoomId.slice(0, 8)}, requesting Welcome`);
+          const roomLockId = `room-kp-${groupId}`;
+          if (!await acquireA2ASyncLock(this.config.dataDir, roomLockId)) {
+            console.log(`[SecureChannel] Room KP publish locked for group ${groupId?.slice(0, 8)}, skipping`);
+            return;
+          }
           try {
             const { MLSGroupManager: MLS } = await init_dist().then(() => dist_exports);
             const mgr = new MLS();
@@ -67042,6 +67056,7 @@ ${messageText}`;
               body: JSON.stringify({ key_package: kpHex, device_id: this._deviceId })
             });
             this._pendingMlsKpBundle = kp;
+            await savePendingKpBundle(this.config.dataDir, groupId, kp);
             await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${groupId}/request-welcome`, {
               method: "POST",
               headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
@@ -67050,6 +67065,8 @@ ${messageText}`;
             console.log(`[SecureChannel] Welcome requested for room ${resolvedRoomId.slice(0, 8)} group ${groupId?.slice(0, 8)}`);
           } catch (reqErr) {
             console.warn(`[SecureChannel] Welcome request failed for room ${resolvedRoomId.slice(0, 8)}:`, reqErr);
+            await releaseA2ASyncLock(this.config.dataDir, roomLockId).catch(() => {
+            });
           }
           return;
         }
@@ -67182,6 +67199,7 @@ ${messageText}`;
       }
       async _handleMlsCommit(data) {
         const groupId = data.group_id;
+        const epoch = typeof data.epoch === "number" ? data.epoch : 0;
         for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
           if (room.mlsGroupId === groupId) {
             const mlsGroup = this._mlsGroups.get(roomId);
@@ -67200,6 +67218,9 @@ ${messageText}`;
                   throw err;
                 }
               }
+            } else {
+              this._bufferMlsCommit(groupId, epoch, data);
+              console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
             }
             return;
           }
@@ -67222,11 +67243,50 @@ ${messageText}`;
                   throw err;
                 }
               }
+            } else {
+              this._bufferMlsCommit(groupId, epoch, data);
+              console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
             }
             return;
           }
         }
       }
+      /** Buffer an MLS commit for replay after Welcome join. Max 50 per group. */
+      _bufferMlsCommit(groupId, epoch, data) {
+        let buf = this._pendingMlsCommits.get(groupId);
+        if (!buf) {
+          buf = [];
+          this._pendingMlsCommits.set(groupId, buf);
+        }
+        if (!buf.some((c2) => c2.epoch === epoch)) {
+          buf.push({ epoch, data });
+          buf.sort((a2, b2) => a2.epoch - b2.epoch);
+          if (buf.length > 50) buf.splice(0, buf.length - 50);
+        }
+      }
+      /** Apply buffered MLS commits after Welcome join. */
+      async _applyBufferedMlsCommits(groupId, mgr) {
+        const buf = this._pendingMlsCommits.get(groupId);
+        if (!buf || buf.length === 0) return;
+        console.log(`[SecureChannel] Applying ${buf.length} buffered MLS commits for group ${groupId.slice(0, 8)}`);
+        let applied = 0;
+        for (const entry of buf) {
+          if (entry.epoch <= mgr.epoch) continue;
+          try {
+            const commitBytes = new Uint8Array(Buffer.from(entry.data.payload, "hex"));
+            await mgr.processCommit(commitBytes);
+            applied++;
+          } catch (err) {
+            console.warn(`[SecureChannel] Buffered commit epoch=${entry.epoch} failed: ${err?.message}`);
+            break;
+          }
+        }
+        this._pendingMlsCommits.delete(groupId);
+        if (applied > 0) {
+          await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
+          console.log(`[SecureChannel] Applied ${applied} buffered commits, now epoch=${mgr.epoch}`);
+        }
+      }
       async _handleMlsWelcome(data) {
         const groupId = data.group_id;
         const conversationId = data.conversation_id;
@@ -67247,8 +67307,8 @@ ${messageText}`;
             }
           }
           if (!kp) {
-            const identity = new TextEncoder().encode(this._deviceId);
-            kp = await mgr.generateKeyPackage(identity);
+            console.error(`[SecureChannel] No matching KeyPackage found for Welcome \u2014 cannot join group ${groupId?.slice(0, 8)}. A fresh KP would fail because the Welcome is encrypted to the published KP's public key. The existing Welcome recovery mechanism will re-request.`);
+            return;
           }
           console.log(`[SecureChannel] Welcome joinFromWelcome: group=${groupId?.slice(0, 8)} kpSource=${kpSource} welcomeLen=${welcomeBytes.length}`);
           await mgr.joinFromWelcome(welcomeBytes, kp);
@@ -67256,6 +67316,7 @@ ${messageText}`;
             const key = `conv:${conversationId}`;
             this._mlsGroups.set(key, mgr);
             await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
+            await this._applyBufferedMlsCommits(groupId, mgr);
             if (this._persisted) {
               if (!this._persisted.mlsConversations) this._persisted.mlsConversations = {};
               this._persisted.mlsConversations[conversationId] = { mlsGroupId: groupId };
@@ -67271,8 +67332,11 @@ ${messageText}`;
               this._mlsGroups.set(roomId, mgr);
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
               await this._persistState();
+              await this._applyBufferedMlsCommits(groupId, mgr);
               console.log(`[SecureChannel] Joined MLS group for room ${roomId.slice(0, 8)} via Welcome (epoch=${mgr.epoch})`);
               this._pendingMlsKpBundle = void 0;
+              await releaseA2ASyncLock(this.config.dataDir, `room-kp-${groupId}`).catch(() => {
+              });
               return;
             }
           }
@@ -67283,6 +67347,7 @@ ${messageText}`;
               this._mlsGroups.set(`a2a:${channelId}`, mgr);
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
               await this._persistState();
+              await this._applyBufferedMlsCommits(groupId, mgr);
               await clearPendingWelcome(this.config.dataDir, groupId).catch(() => {
               });
               await releaseA2ASyncLock(this.config.dataDir, channelId).catch(() => {
@@ -67706,6 +67771,165 @@ ${messageText}`;
           this._deliveryPulling = false;
         }
       }
+      /**
+       * Pull pending DR (Double Ratchet) messages from the delivery queue.
+       * Signal-model queue-first: called on WS connect and on dr_delivery ping.
+       */
+      async _pullDrDeliveryQueue() {
+        if (!this._deviceId || !this._deviceJwt || this._drDeliveryPulling) return;
+        this._drDeliveryPulling = true;
+        try {
+          const res = await fetch(
+            `${this.config.apiUrl}/api/v1/dr/delivery?device_id=${this._deviceId}`,
+            { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+          );
+          if (!res.ok) {
+            console.warn(`[SecureChannel] DR delivery pull failed: ${res.status}`);
+            return;
+          }
+          const { messages } = await res.json();
+          if (!messages || messages.length === 0) return;
+          const ackedIds = [];
+          const nackedIds = [];
+          for (const msg of messages) {
+            try {
+              if (msg.sender_device_id === this._deviceId) {
+                ackedIds.push(msg.queue_id);
+                continue;
+              }
+              if (msg.message_id && this._seenMessageIds.has(msg.message_id)) {
+                ackedIds.push(msg.queue_id);
+                continue;
+              }
+              let isRoom = false;
+              if (this._persisted?.rooms) {
+                for (const room of Object.values(this._persisted.rooms)) {
+                  if (room.conversationIds?.includes(msg.conversation_id)) {
+                    isRoom = true;
+                    break;
+                  }
+                }
+              }
+              if (isRoom) {
+                ackedIds.push(msg.queue_id);
+                continue;
+              }
+              if (!msg.header_blob || !msg.ciphertext) {
+                ackedIds.push(msg.queue_id);
+                continue;
+              }
+              const session = this._sessions.get(msg.conversation_id);
+              if (!session) {
+                console.warn(`[SecureChannel] DR delivery: no session for conv ${msg.conversation_id.slice(0, 8)}, skipping`);
+                continue;
+              }
+              const encrypted = transportToEncryptedMessage({
+                header_blob: msg.header_blob,
+                ciphertext: msg.ciphertext
+              });
+              const ratchetSnapshot = session.ratchet.serialize();
+              let plaintext;
+              try {
+                plaintext = session.ratchet.decrypt(encrypted);
+              } catch (decryptErr) {
+                console.error(`[SecureChannel] DR delivery decrypt failed for conv ${msg.conversation_id.slice(0, 8)} \u2014 restoring ratchet:`, decryptErr);
+                try {
+                  session.ratchet = DoubleRatchet.deserialize(ratchetSnapshot);
+                } catch {
+                }
+                nackedIds.push(msg.queue_id);
+                continue;
+              }
+              if (msg.message_id) {
+                this._seenMessageIds.add(msg.message_id);
+                if (this._seenMessageIds.size > _SecureChannel.SEEN_MSG_MAX) {
+                  const first = this._seenMessageIds.values().next().value;
+                  if (first) this._seenMessageIds.delete(first);
+                }
+              }
+              this._sendAck(msg.message_id);
+              if (!session.activated) {
+                session.activated = true;
+                console.log(`[SecureChannel] Session ${msg.conversation_id.slice(0, 8)}... activated via DR delivery`);
+                if (this._persisted?.sessions[msg.conversation_id]) {
+                  this._persisted.sessions[msg.conversation_id].activated = true;
+                }
+                this._activateSiblings(msg.conversation_id);
+                await this._persistState();
+              }
+              let messageText;
+              let messageType;
+              try {
+                const parsed = JSON.parse(plaintext);
+                messageType = parsed.type || "message";
+                messageText = parsed.text || plaintext;
+              } catch {
+                messageType = "message";
+                messageText = plaintext;
+              }
+              if (messageType === "session_init") {
+                console.log(`[SecureChannel] session_init received via DR delivery for ${msg.conversation_id.slice(0, 8)}...`);
+                await this._replayHistoryToSession(msg.conversation_id);
+                await this._persistState();
+                ackedIds.push(msg.queue_id);
+                continue;
+              }
+              if (messageType === "message") {
+                const topicId = msg.topic_id;
+                this._appendHistory("owner", messageText, topicId);
+                const metadata = {
+                  messageId: msg.message_id,
+                  conversationId: msg.conversation_id,
+                  timestamp: msg.created_at,
+                  topicId
+                };
+                this.emit("message", messageText, metadata);
+                Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
+                  console.error("[SecureChannel] onMessage callback error:", err);
+                });
+              }
+              this._persisted.lastMessageTimestamp = msg.created_at;
+              ackedIds.push(msg.queue_id);
+            } catch (err) {
+              console.warn(`[SecureChannel] DR delivery processing failed for ${msg.message_id?.slice(0, 8)}:`, err);
+              nackedIds.push(msg.queue_id);
+            }
+          }
+          await this._persistState();
+          if (nackedIds.length > 0) {
+            try {
+              await fetch(`${this.config.apiUrl}/api/v1/dr/delivery/nack`, {
+                method: "POST",
+                headers: {
+                  Authorization: `Bearer ${this._deviceJwt}`,
+                  "Content-Type": "application/json"
+                },
+                body: JSON.stringify({ queue_ids: nackedIds })
+              });
+            } catch {
+            }
+          }
+          if (ackedIds.length > 0) {
+            try {
+              await fetch(`${this.config.apiUrl}/api/v1/dr/delivery/ack`, {
+                method: "POST",
+                headers: {
+                  Authorization: `Bearer ${this._deviceJwt}`,
+                  "Content-Type": "application/json"
+                },
+                body: JSON.stringify({ queue_ids: ackedIds, device_id: this._deviceId })
+              });
+              console.log(`[SecureChannel] DR delivery acked ${ackedIds.length}/${messages.length}`);
+            } catch (ackErr) {
+              console.warn("[SecureChannel] DR delivery ack failed:", ackErr);
+            }
+          }
+        } catch (err) {
+          console.warn("[SecureChannel] DR delivery pull error:", err);
+        } finally {
+          this._drDeliveryPulling = false;
+        }
+      }
       async _handleMlsSyncResponse(data) {
         const action = data.action;
         const groupId = data.group_id;
@@ -89065,7 +89289,7 @@ var init_index = __esm({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.20.31" : "0.0.0-dev";
+    VERSION = true ? "0.20.33" : "0.0.0-dev";
   }
 });