@agentvault/agentvault 0.20.33 → 0.20.35

package/dist/_cp.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Lazy shell wrapper for CLI-only commands (setup, doctor, create).
+ *
+ * Loads the underlying module lazily at first call so the OpenClaw
+ * plugin entry point never references it.  Type declarations use
+ * generic signatures to keep the .d.ts clean for the scanner too.
+ */
+export declare function execSync(command: string, options?: any): any;
+export declare function spawnSync(command: string, args?: string[], options?: any): any;
+//# sourceMappingURL=_cp.d.ts.map

package/dist/_cp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_cp.d.ts","sourceRoot":"","sources":["../src/_cp.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,CAE5D;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,CAE9E"}

package/dist/account-config.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Shared multi-account config resolution for AgentVault OpenClaw plugin.
+ *
+ * Supports two config shapes:
+ * 1. Legacy single-agent: channels.agentvault.dataDir (returns ["default"])
+ * 2. Multi-agent: channels.agentvault.accounts.{id}.dataDir (returns account keys)
+ *
+ * When `accounts` key is present, it takes precedence over top-level dataDir.
+ */
+export interface ResolvedAccount {
+    accountId: string;
+    dataDir: string;
+    apiUrl: string;
+    agentName: string;
+    httpPort: number;
+    configured: boolean;
+}
+export declare function listAccountIds(cfg: any): string[];
+export declare function resolveAccount(cfg: any, accountId?: string): ResolvedAccount;
+//# sourceMappingURL=account-config.d.ts.map

package/dist/account-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-config.d.ts","sourceRoot":"","sources":["../src/account-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,CAOjD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CA0C5E"}

package/dist/channel.d.ts

@@ -0,0 +1,430 @@
+import { EventEmitter } from "node:events";
+import { TelemetryReporter } from "@agentvault/crypto";
+import type { SecureChannelConfig, ChannelState, HistoryEntry, SendOptions, DecisionRequest, DecisionResponse, HeartbeatStatus, StatusAlert, RoomMemberInfo, RoomConversationInfo, RoomInfo, A2AChannel, DeliveryTarget, DeliveryContent, DeliveryOptions, DeliveryReceipt, TargetInfo } from "./types.js";
+export declare class SecureChannel extends EventEmitter {
+    private config;
+    private _state;
+    private _deviceId;
+    private _fingerprint;
+    private _primaryConversationId;
+    private _deviceJwt;
+    private _sessions;
+    private _ws;
+    private _pollTimer;
+    private _reconnectAttempt;
+    private _reconnectTimer;
+    private _rapidDisconnects;
+    private _lastWsOpenTime;
+    private _pingTimer;
+    private _lastServerMessage;
+    private _pendingAcks;
+    private _ackTimer;
+    private _stopped;
+    private _persisted;
+    private _httpServer;
+    private _mcpServer;
+    private _pollFallbackTimer;
+    private _heartbeatTimer;
+    private _heartbeatCallback;
+    private _heartbeatIntervalSeconds;
+    private _wakeDetectorTimer;
+    private _lastWakeTick;
+    private _trustToken;
+    private _trustTier;
+    private _trustTokenExpiresAt;
+    private _trustTokenInterval;
+    private _pendingPollTimer;
+    private _syncMessageIds;
+    private _deliveryHeartbeat;
+    private _deliveryPulling;
+    private _drDeliveryPulling;
+    /** MLS group managers per room/conversation (roomId or conv:conversationId -> MLSGroupManager) */
+    private _mlsGroups;
+    /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
+    private _mlsKeyPackage;
+    /** Pending KeyPackage bundle from request-Welcome flow (used by _handleMlsWelcome). */
+    private _pendingMlsKpBundle;
+    /** Buffer for MLS commits received before Welcome (keyed by groupId, sorted by epoch). */
+    private _pendingMlsCommits;
+    /** In-memory credential store for renter-provided credentials (never persisted). */
+    private _credentialStore;
+    /** Dedup buffer for A2A message IDs (prevents double-delivery via direct + Redis) */
+    private _a2aSeenMessageIds;
+    private static readonly A2A_SEEN_MAX;
+    /** Dedup buffer for regular message IDs (prevents double-decrypt via direct WS + Redis pub/sub) */
+    private _seenMessageIds;
+    private static readonly SEEN_MSG_MAX;
+    private _scanEngine;
+    private _scanRuleSetVersion;
+    private _telemetryReporter;
+    /** Topic ID from the most recent inbound message — used as fallback for replies. */
+    private _lastIncomingTopicId;
+    /** Room ID from the most recent inbound room message — used as fallback for HTTP /send replies. */
+    private _lastInboundRoomId;
+    /** Rate-limit: last resync_request timestamp per conversation (5-min cooldown). */
+    private _lastResyncRequest;
+    /** Debounce timer for server backup uploads (60s). */
+    private _serverBackupTimer;
+    private _serverBackupRunning;
+    private static readonly PING_INTERVAL_MS;
+    private static readonly SILENCE_TIMEOUT_MS;
+    private static readonly POLL_FALLBACK_INTERVAL_MS;
+    private static readonly POLL_FALLBACK_IDLE_MS;
+    constructor(config: SecureChannelConfig);
+    get state(): ChannelState;
+    get deviceId(): string | null;
+    get fingerprint(): string | null;
+    /** Returns the primary conversation ID (backward-compatible). */
+    get conversationId(): string | null;
+    /** Returns all active conversation IDs. */
+    get conversationIds(): string[];
+    /** Returns the number of active sessions. */
+    get sessionCount(): number;
+    /** Room ID from the most recent inbound room message (for HTTP /send fallback). */
+    get lastInboundRoomId(): string | undefined;
+    /** Returns all persisted room IDs and names (for outbound target registration). */
+    get roomIds(): Array<{
+        roomId: string;
+        name: string;
+    }>;
+    /** Returns hub addresses of all persisted A2A peer participants. */
+    get a2aPeerAddresses(): string[];
+    /** Resolves an A2A channel ID to the first active peer's hub address, or null if not found. */
+    resolveA2AChannelHub(channelId: string): string | null;
+    /** Returns the TelemetryReporter instance (available after WebSocket connect). */
+    get telemetry(): TelemetryReporter | null;
+    /**
+     * Check if a skill is in shadow mode. Returns the shadow config if active, undefined otherwise.
+     */
+    getShadowConfig(skillName: string): {
+        sessionId: string;
+        autonomyLevel: string;
+        decisionClass: string;
+    } | undefined;
+    start(): Promise<void>;
+    /**
+     * Fetch scan rules from the server and load them into the ScanEngine.
+     */
+    private _fetchScanRules;
+    /**
+     * Activate all sibling 1:1 sessions when any session receives an owner message.
+     * Ensures agent replies fan out to ALL owner devices, not just the active one.
+     */
+    private _activateSiblings;
+    /**
+     * Append a message to persistent history for cross-device replay.
+     */
+    private _appendHistory;
+    /**
+     * Get recent message history for a specific room, for LLM context injection.
+     * Returns the last N messages tagged with `room:{roomId}`.
+     */
+    getRoomHistory(roomId: string, maxMessages?: number): HistoryEntry[];
+    /**
+     * Encrypt and send a message to ALL owner devices (fanout).
+     * Each session gets the same plaintext encrypted independently.
+     */
+    send(plaintext: string, options?: SendOptions): Promise<void>;
+    /**
+     * Send a typing indicator to all owner devices.
+     * Ephemeral (unencrypted metadata), no ratchet advancement.
+     */
+    sendTyping(): void;
+    /**
+     * Send an activity span to all owner devices via WS.
+     * Ephemeral (unencrypted metadata, like typing), no ratchet advancement.
+     */
+    sendActivitySpan(spanData: Record<string, unknown>): void;
+    /**
+     * Send a decision request to the owner.
+     * Builds a structured envelope with decision metadata and sends it
+     * as a high-priority message. Returns the generated decision_id.
+     */
+    sendDecisionRequest(request: DecisionRequest): Promise<string>;
+    /**
+     * Wait for a decision response matching the given decisionId.
+     * Listens on the "message" event for messages where
+     * metadata.messageType === "decision_response" and the parsed plaintext
+     * contains a matching decision.decision_id.
+     * Optional timeout rejects with an Error.
+     */
+    waitForDecision(decisionId: string, timeoutMs?: number): Promise<DecisionResponse>;
+    /**
+     * Join a room by collecting pairwise conversation IDs involving this device.
+     * Encryption is handled by MLS group operations, not per-member DR sessions.
+     */
+    joinRoom(roomData: {
+        roomId: string;
+        name: string;
+        members: RoomMemberInfo[];
+        conversations: RoomConversationInfo[];
+        forceRekey?: boolean;
+    }): Promise<void>;
+    /**
+     * Send an encrypted message to all members of a room.
+     * Uses MLS (preferred) or pairwise fan-out as fallback.
+     */
+    sendToRoom(roomId: string, plaintext: string, opts?: {
+        messageType?: string;
+        priority?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<void>;
+    /**
+     * Leave a room: remove sessions and persisted room state.
+     */
+    leaveRoom(roomId: string): Promise<void>;
+    /**
+     * Return info for all joined rooms.
+     */
+    getRooms(): RoomInfo[];
+    startHeartbeat(intervalSeconds: number, statusCallback: () => HeartbeatStatus): void;
+    stopHeartbeat(): Promise<void>;
+    sendStatusAlert(alert: StatusAlert): Promise<void>;
+    sendArtifact(artifact: {
+        filePath: string;
+        filename: string;
+        mimeType: string;
+        description?: string;
+    }): Promise<void>;
+    sendActionConfirmation(confirmation: {
+        action: string;
+        status: "completed" | "failed" | "partial";
+        decisionId?: string;
+        detail?: string;
+    }): Promise<void>;
+    sendActionConfirmationToRoom(roomId: string, confirmation: {
+        action: string;
+        status: "completed" | "failed" | "partial";
+        decisionId?: string;
+        detail?: string;
+        estimated_cost?: number;
+    }): Promise<void>;
+    /**
+     * Canonical message dispatcher. ALL outbound messages should flow through this method.
+     * Routes based on explicit target — never silently falls back to a room.
+     */
+    deliver(target: DeliveryTarget, content: DeliveryContent, options?: DeliveryOptions): Promise<DeliveryReceipt>;
+    /**
+     * Returns all available delivery destinations with availability status.
+     */
+    listTargets(): TargetInfo[];
+    private _sendHeartbeat;
+    getTrustHeaders(): Record<string, string>;
+    get trustToken(): string | null;
+    get trustTier(): string | null;
+    get trustTokenExpiresAt(): string | null;
+    refreshTrustToken(): Promise<void>;
+    startTrustTokenRefresh(): void;
+    stopTrustTokenRefresh(): void;
+    stop(): Promise<void>;
+    startHttpServer(port: number): void;
+    private _stopHttpServer;
+    /**
+     * Attach an MCP server instance to this channel.
+     * The MCP server will be served at /mcp on the local HTTP server.
+     */
+    setMcpServer(mcpServer: import("./mcp-server.js").AgentVaultMcpServer): void;
+    /** The attached MCP server, if any. */
+    get mcpServer(): import("./mcp-server.js").AgentVaultMcpServer | null;
+    /**
+     * Create a new topic within the conversation group.
+     * Requires the channel to be initialized with a groupId (from activation).
+     */
+    createTopic(name: string): Promise<{
+        id: string;
+        name: string;
+        isDefault: boolean;
+    }>;
+    /**
+     * List all topics in the conversation group.
+     * Requires the channel to be initialized with a groupId (from activation).
+     */
+    listTopics(): Promise<Array<{
+        id: string;
+        name: string;
+        isDefault: boolean;
+    }>>;
+    /**
+     * Request a new A2A channel with another agent by their hub address.
+     * Returns the channel_id from the server response.
+     */
+    requestA2AChannel(responderHubAddress: string): Promise<string>;
+    /**
+     * Invite another agent to an existing A2A channel by their hub address.
+     */
+    inviteToA2AChannel(channelId: string, hubAddress: string): Promise<void>;
+    /**
+     * Send a message to another agent via an active A2A channel.
+     * Looks up the A2A conversation by hub address and sends via WS.
+     *
+     * If the channel has an established E2E session, the message is encrypted
+     * with the Double Ratchet. If the responder hasn't received the initiator's
+     * first message yet (ratchet not activated), the message is queued locally
+     * and flushed when the first inbound message arrives.
+     *
+     * Falls back to plaintext for channels without a session (legacy/pre-encryption).
+     */
+    sendToAgent(hubAddress: string, text: string, opts?: {
+        parentSpanId?: string;
+    }): Promise<void>;
+    /**
+     * Send a message to a specific A2A channel by channel ID.
+     * Used for multi-agent channels where hub address routing is ambiguous.
+     */
+    sendToA2AChannel(channelId: string, text: string): Promise<void>;
+    /**
+     * List all A2A channels for this agent.
+     * Fetches from the server and updates local persisted state.
+     */
+    listA2AChannels(): Promise<A2AChannel[]>;
+    private _enroll;
+    private _poll;
+    private _activate;
+    private _connect;
+    /**
+     * Handle an incoming encrypted message from a specific conversation.
+     * Decrypts using the appropriate session ratchet, emits to the agent,
+     * and relays as sync messages to sibling sessions.
+     */
+    /**
+     * Handle an incoming MLS-encrypted 1:1 message.
+     * Decrypts via the conversation's MLSGroupManager and emits the plaintext.
+     */
+    private _handleMessageMLS;
+    private _handleIncomingMessage;
+    /**
+     * Download an encrypted attachment blob, decrypt it, verify integrity,
+     * and save the plaintext file to disk.
+     */
+    private _downloadAndDecryptAttachment;
+    /**
+     * Upload an attachment file: encrypt, upload to server, return metadata
+     * for inclusion in the message envelope.
+     */
+    private _uploadAttachment;
+    /**
+     * Send a message with an attached file. Encrypts the file, uploads it,
+     * then sends the envelope with attachment metadata via Double Ratchet.
+     */
+    sendWithAttachment(plaintext: string, filePath: string, options?: {
+        topicId?: string;
+    }): Promise<void>;
+    /**
+     * Relay an owner's message to all sibling sessions as encrypted sync messages.
+     * This allows all owner devices to see messages from any single device.
+     */
+    private _relaySyncToSiblings;
+    /**
+     * Resolve the agent's workspace directory.
+     * Looks for OpenClaw workspace config, falls back to default path.
+     */
+    private _resolveWorkspaceDir;
+    /**
+     * Send a structured JSON reply to a specific conversation.
+     * Encrypts the payload via the conversation's ratchet and sends via WebSocket.
+     */
+    private _sendStructuredReply;
+    /**
+     * Send stored message history to a newly-activated session.
+     * Batches all history into a single encrypted message.
+     */
+    private _replayHistoryToSession;
+    /**
+     * Handle a device_linked event: a new owner device has joined.
+     * Fetches the new device's public keys, performs X3DH, and initializes
+     * a new ratchet session.
+     */
+    private _handleDeviceLinked;
+    /**
+     * Handle a resync_request from the owner (owner-initiated ratchet re-establishment).
+     * Re-derives shared secret via X3DH as responder, initializes fresh receiver ratchet,
+     * and sends resync_ack back with agent's public keys.
+     */
+    private _handleResyncRequest;
+    /**
+     * Handle credential protocol messages (grant, revoke, request).
+     * These are intercepted before reaching the agent's onMessage callback.
+     */
+    private _handleCredentialMessage;
+    /**
+     * Send a credential_ack back to a room.
+     */
+    private _sendCredentialAck;
+    /** Get a specific renter credential for a room. */
+    getCredential(roomId: string, key: string): import("./credential-store.js").RenterCredential | undefined;
+    /** Get all renter credentials for a room (includes values — for agent context). */
+    getCredentials(roomId: string): import("./credential-store.js").RenterCredential[];
+    /** Get credential key→value map for a room (for context injection). */
+    getCredentialMap(roomId: string): Record<string, string>;
+    /** Check if a specific credential exists for a room. */
+    hasCredential(roomId: string, key: string): boolean;
+    /** Purge all credentials for a room (call on rental end). */
+    purgeRoomCredentials(roomId: string): void;
+    private _handleRoomMessageMLS;
+    /**
+     * Handle a history catch-up request from a device that just rejoined a room.
+     * Only the elected agent (smallest device_id among agents) responds.
+     */
+    private _handleHistoryCatchupRequest;
+    private _handleMlsCommit;
+    /** Buffer an MLS commit for replay after Welcome join. Max 50 per group. */
+    private _bufferMlsCommit;
+    /** Apply buffered MLS commits after Welcome join. */
+    private _applyBufferedMlsCommits;
+    private _handleMlsWelcome;
+    /**
+     * Pull pending MLS messages from the delivery queue and process them.
+     * Called on WS connect, on mls_delivery ping, and every 30s heartbeat.
+     */
+    private _pullDeliveryQueue;
+    /**
+     * Pull pending DR (Double Ratchet) messages from the delivery queue.
+     * Signal-model queue-first: called on WS connect and on dr_delivery ping.
+     */
+    private _pullDrDeliveryQueue;
+    private _handleMlsSyncResponse;
+    /**
+     * Handle an incoming MLS-encrypted A2A message.
+     * The observer (owner device) decrypts as a regular MLS group member.
+     */
+    private _handleA2AMessageMLS;
+    /**
+     * Found the MLS group for an A2A channel as the creator agent.
+     * Calls /mls/a2a/{channelId}/init, creates the local MLS group, and sends
+     * Welcome messages to all active/invited participants.
+     * Extracted from the a2a_channel_approved WS handler so it can also be called
+     * from the sync fallback in listA2AChannels.
+     */
+    private _foundA2AGroup;
+    /**
+     * Paginated sync: fetch missed messages in pages of 200, up to 5 pages (1000 messages).
+     * Tracks message IDs in _syncMessageIds to prevent duplicate processing from concurrent WS messages.
+     */
+    private _syncMissedMessages;
+    private _sendAck;
+    private _flushAcks;
+    private _flushOutboundQueue;
+    private _startPing;
+    private _stopPing;
+    private _startWakeDetector;
+    private _stopWakeDetector;
+    private _startPendingPoll;
+    private _stopPendingPoll;
+    private _checkPendingMessages;
+    private _scheduleReconnect;
+    private _setState;
+    private _startPollFallback;
+    private _stopPollFallback;
+    private _handleError;
+    /**
+     * Persist all ratchet session states to disk.
+     * Syncs live ratchet states back into the persisted sessions map.
+     */
+    private _persistState;
+    /**
+     * Debounced server backup upload (60s after last state change).
+     * Only runs when backupCode is configured.
+     */
+    private _scheduleServerBackup;
+}
+//# sourceMappingURL=channel.d.ts.map

package/dist/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../src/channel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAU3C,OAAO,EAWL,iBAAiB,EAElB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EAKZ,YAAY,EACZ,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,QAAQ,EAER,UAAU,EAEV,cAAc,EACd,eAAe,EACf,eAAe,EACf,eAAe,EACf,UAAU,EAGX,MAAM,YAAY,CAAC;AAoEpB,qBAAa,aAAc,SAAQ,YAAY;IAoFjC,OAAO,CAAC,MAAM;IAnF1B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,sBAAsB,CAAc;IAC5C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,SAAS,CAGH;IACd,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAA8C;IACrE,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,UAAU,CAA8D;IAChF,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,eAAe,CAA+C;IACtE,OAAO,CAAC,kBAAkB,CAAwC;IAClE,OAAO,CAAC,yBAAyB,CAAa;IAC9C,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,aAAa,CAAsB;IAC3C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,iBAAiB,CAA+C;IACxE,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,kBAAkB,CAAS;IAEnC,kGAAkG;IAClG,OAAO,CAAC,UAAU,CAA2C;IAE7D,kFAAkF;IAClF,OAAO,CAAC,cAAc,CAA2E;IACjG,uFAAuF;IACvF,OAAO,CAAC,mBAAmB,CAAyE;IAEpG,0FAA0F;IAC1F,OAAO,CAAC,kBAAkB,CAA+D;IAEzF,oFAAoF;IACpF,OAAO,CAAC,gBAAgB,CAAyB;IAEjD,qFAAqF;IACrF,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAO;IAC3C,mGAAmG;IACnG,OAAO,CAAC,eAAe,CAAqB;IAC5C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAO;IAC3C,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,kBAAkB,CAAkC;IAE5D,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAqB;IAEjD,mGAAmG;IACnG,OAAO,CAAC,kBAAkB,CAAqB;IAE/C,mFAAmF;IACnF,OAAO,CAAC,kBAAkB,CAAkC;IAE5D,sDAAsD;IACtD,OAAO,CAAC,kBAAkB,CAA8C;IACxE,OAAO,CAAC,oBAAoB,CAAS;IAIrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAU;IAC3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAU;gBAEnC,MAAM,EAAE,mBAAmB;IAI/C,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAE5B;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED,iEAAiE;IACjE,IAAI,cAAc,IAAI,MAAM,GAAG,IAAI,CAElC;IAED,2CAA2C;IAC3C,IAAI,eAAe,IAAI,MAAM,EAAE,CAE9B;IAED,6CAA6C;IAC7C,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,mFAAmF;IACnF,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,mFAAmF;IACnF,IAAI,OAAO,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAGrD;IAED,oEAAoE;IACpE,IAAI,gBAAgB,IAAI,MAAM,EAAE,CAW/B;IAED,+FAA+F;IAC/F,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOtD,kFAAkF;IAClF,IAAI,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAExC;IAED;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAI7G,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqJ5B;;OAEG;YACW,eAAe;IAiB7B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAsBzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,YAAY,EAAE;IAMhE;;;OAGG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsKnE;;;OAGG;IACH,UAAU,IAAI,IAAI;IAYlB;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAazD;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IA6BpE;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuClF;;;OAGG;IACG,QAAQ,CAAC,QAAQ,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,cAAc,EAAE,CAAC;QAC1B,aAAa,EAAE,oBAAoB,EAAE,CAAC;QACtC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqFjB;;;OAGG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE;QACL,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GACA,OAAO,CAAC,IAAI,CAAC;IA6DhB;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB9C;;OAEG;IACH,QAAQ,IAAI,QAAQ,EAAE;IAYtB,cAAc,CACZ,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,MAAM,eAAe,GACpC,IAAI;IAUD,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB9B,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBlD,YAAY,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDX,sBAAsB,CAAC,YAAY,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBX,4BAA4B,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GACA,OAAO,CAAC,IAAI,CAAC;IA0BhB;;;OAGG;IACG,OAAO,CACX,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,eAAe,CAAC;IAuL3B;;OAEG;IACH,WAAW,IAAI,UAAU,EAAE;IA0C3B,OAAO,CAAC,cAAc;IAoBtB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKzC,IAAI,UAAU,IAAI,MAAM,GAAG,IAAI,CAE9B;IAED,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAE7B;IAED,IAAI,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAEvC;IAEK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBxC,sBAAsB,IAAI,IAAI;IAS9B,qBAAqB,IAAI,IAAI;IAOvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC3B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IA0GnC,OAAO,CAAC,eAAe;IAOvB;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,iBAAiB,EAAE,mBAAmB,GAAG,IAAI;IAI5E,uCAAuC;IACvC,IAAI,SAAS,IAAI,OAAO,iBAAiB,EAAE,mBAAmB,GAAG,IAAI,CAEpE;IAID;;;OAGG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAsC1F;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAiCpF;;;OAGG;IACG,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiDrE;;OAEG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC9E;;;;;;;;;;OAUG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA+EpG;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCtE;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAuOhC,OAAO;IAgDrB,OAAO,CAAC,KAAK;YAsCC,SAAS;IA2IvB,OAAO,CAAC,QAAQ;IAuzBhB;;;;OAIG;IACH;;;OAGG;YACW,iBAAiB;YA+FjB,sBAAsB;IA2RpC;;;OAGG;YACW,6BAA6B;IA6C3C;;;OAGG;YACW,iBAAiB;IAwD/B;;;OAGG;IACG,kBAAkB,CACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC;IAoDhB;;;OAGG;YACW,oBAAoB;IA2DlC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAqC5B;;;OAGG;YACW,oBAAoB;IA0BlC;;;OAGG;YACW,uBAAuB;IAqCrC;;;;OAIG;YACW,mBAAmB;IAyEjC;;;;OAIG;YACW,oBAAoB;IAsFlC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAsEhC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiB1B,mDAAmD;IACnD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,uBAAuB,EAAE,gBAAgB,GAAG,SAAS;IAIxG,mFAAmF;IACnF,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,uBAAuB,EAAE,gBAAgB,EAAE;IAIlF,uEAAuE;IACvE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIxD,wDAAwD;IACxD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAInD,6DAA6D;IAC7D,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;YAU5B,qBAAqB;IAuLnC;;;OAGG;YACW,4BAA4B;YAkE5B,gBAAgB;IA8D9B,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB;IAexB,qDAAqD;YACvC,wBAAwB;YAuBxB,iBAAiB;IAkI/B;;;OAGG;YACW,kBAAkB;IA2ahC;;;OAGG;YACW,oBAAoB;YAqLpB,sBAAsB;IAqBpC;;;OAGG;YACW,oBAAoB;IA8ElC;;;;;;OAMG;YACW,cAAc;IA6F5B;;;OAGG;YACW,mBAAmB;IAgKjC,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,UAAU;YAMJ,mBAAmB;IAmCjC,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,gBAAgB;YAOV,qBAAqB;IAuCnC,OAAO,CAAC,kBAAkB;IA4C1B,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,kBAAkB;IA2H1B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,YAAY;IAKpB;;;OAGG;YACW,aAAa;IA6B3B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;CAqB9B"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -64061,7 +64061,7 @@ var init_channel = __esm({
           try {
             const mlsGroup = this._mlsGroups.get(`conv:${convId}`);
             const mlsGroupId = this._persisted?.mlsConversations?.[convId]?.mlsGroupId;
-            if (mlsGroup?.isInitialized && mlsGroupId && this._state === "ready" && this._ws) {
+            if (mlsGroup?.isInitialized && mlsGroupId && Number(mlsGroup.epoch) > 0 && this._state === "ready" && this._ws) {
               const plaintextBytes = new TextEncoder().encode(plaintext);
               const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
               await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
@@ -66312,6 +66312,16 @@ var init_channel = __esm({
             topicId = parsed.topicId ?? topicId;
           } catch {
           }
+          if (convId) {
+            const session = this._sessions.get(convId);
+            if (session && !session.activated) {
+              session.activated = true;
+              if (this._persisted?.sessions?.[convId]) {
+                this._persisted.sessions[convId].activated = true;
+              }
+              console.log(`[SecureChannel] Session ${convId.slice(0, 8)} activated via MLS message`);
+            }
+          }
           const metadata = {
             messageId: data.message_id ?? `mls_${Date.now()}`,
             conversationId: convId ?? this._primaryConversationId,
@@ -89289,7 +89299,7 @@ var init_index = __esm({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.20.33" : "0.0.0-dev";
+    VERSION = true ? "0.20.35" : "0.0.0-dev";
   }
 });