@agentvault/agentvault 0.20.41 → 0.20.42

package/dist/index.js

@@ -63719,6 +63719,9 @@ var init_channel = __esm({
       _mlsGroups = /* @__PURE__ */ new Map();
       /** Maps conversationId -> conversation_group_id for shared 1:1 MLS groups */
       _sessionGroupIds = /* @__PURE__ */ new Map();
+      /** Consecutive MLS decrypt failure count per group key for epoch recovery. */
+      _mlsDecryptFailCounts = /* @__PURE__ */ new Map();
+      static MAX_MLS_DECRYPT_FAILS = 3;
       /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
       _mlsKeyPackage = null;
       /** Pending KeyPackage bundle from request-Welcome flow (used by _handleMlsWelcome). */
@@ -66434,6 +66437,50 @@ var init_channel = __esm({
             topicId = parsed.topicId ?? topicId;
           } catch {
           }
+          if (messageType === "history_catchup_request") {
+            try {
+              const request = JSON.parse(plaintext);
+              const history = this._persisted?.messageHistory ?? [];
+              let filtered = history;
+              if (request.since_ts) {
+                const sinceTime = new Date(request.since_ts).getTime();
+                filtered = history.filter((e) => new Date(e.ts).getTime() > sinceTime);
+              }
+              if (filtered.length > 100) filtered = filtered.slice(-100);
+              const responsePayload = JSON.stringify({
+                type: "history_catchup_response",
+                target_device_id: request.requesting_device_id,
+                messages: filtered.map((e) => ({
+                  sender: e.sender,
+                  sender_name: e.sender === "agent" ? this.config.agentName ?? "Agent" : "Owner",
+                  text: e.text,
+                  ts: e.ts
+                })),
+                no_history: filtered.length === 0
+              });
+              if (mgr && mlsGroupId) {
+                const responseBytes = new TextEncoder().encode(responsePayload);
+                const cipher = await mgr.encrypt(responseBytes);
+                await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
+                if (this._ws) {
+                  this._ws.send(JSON.stringify({
+                    event: "message_mls",
+                    data: {
+                      group_id: mlsGroupId,
+                      epoch: Number(mgr.epoch),
+                      payload: Buffer.from(cipher).toString("hex"),
+                      message_type: "history_catchup_response"
+                    }
+                  }));
+                }
+                console.log(`[SecureChannel] Sent 1:1 history catchup: ${filtered.length} messages to ${request.requesting_device_id?.slice(0, 8)}`);
+              }
+            } catch (catchupErr) {
+              console.warn("[SecureChannel] 1:1 history catchup failed:", catchupErr);
+            }
+            return;
+          }
+          if (messageType === "history_catchup_response") return;
           if (convId) {
             const session = this._sessions.get(convId);
             if (session && !session.activated) {
@@ -66456,7 +66503,16 @@ var init_channel = __esm({
             this.config.onMessage(text, metadata);
           }
         } catch (decryptErr) {
-          console.error(`[SecureChannel] MLS 1:1 decrypt failed for conv ${convId?.slice(0, 8)}:`, decryptErr);
+          const failKey = mgrKey || `unknown:${groupId}`;
+          const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
+          this._mlsDecryptFailCounts.set(failKey, count);
+          console.error(`[SecureChannel] MLS 1:1 decrypt failed (${count}/${_SecureChannel.MAX_MLS_DECRYPT_FAILS}) for ${failKey}:`, decryptErr);
+          if (count >= _SecureChannel.MAX_MLS_DECRYPT_FAILS) {
+            const recoveryGroupId = (convGroupId ? this._persisted?.mlsGroups?.[convGroupId]?.mlsGroupId : null) ?? this._persisted?.mlsConversations?.[convId]?.mlsGroupId ?? groupId;
+            if (recoveryGroupId && failKey) {
+              await this._triggerMlsEpochRecovery(failKey, recoveryGroupId);
+            }
+          }
         }
       }
       async _handleIncomingMessage(msgData) {
@@ -67419,6 +67475,44 @@ ${messageText}`;
           console.log(`[SecureChannel] Applied ${applied} buffered commits, now epoch=${mgr.epoch}`);
         }
       }
+      /**
+       * MLS epoch recovery for shared 1:1 groups.
+       * Clears local state, publishes fresh KeyPackage, and requests Welcome.
+       */
+      async _triggerMlsEpochRecovery(groupKey, mlsGroupId) {
+        console.warn(`[SecureChannel] MLS epoch recovery for ${groupKey} (${mlsGroupId.slice(0, 8)})`);
+        this._mlsGroups.delete(groupKey);
+        this._mlsDecryptFailCounts.delete(groupKey);
+        try {
+          const { unlink: unlink2 } = await import("fs/promises");
+          const path = `${this.config.dataDir}/.mls-state/${mlsGroupId}.json`;
+          await unlink2(path).catch(() => {
+          });
+        } catch {
+        }
+        try {
+          const mgr = new MLSGroupManager();
+          const identity = new TextEncoder().encode(this._deviceId);
+          const kp = await mgr.generateKeyPackage(identity);
+          const kpBytes = MLSGroupManager.serializeKeyPackage(kp.publicPackage);
+          const kpHex = Buffer.from(kpBytes).toString("hex");
+          await fetch(`${this.config.apiUrl}/api/v1/mls/key-packages`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ key_package: kpHex, device_id: this._deviceId })
+          });
+          this._pendingMlsKpBundle = kp;
+          await savePendingKpBundle(this.config.dataDir, mlsGroupId, kp, MLSGroupManager.serializeKeyPackage);
+          await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${mlsGroupId}/request-welcome`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ device_id: this._deviceId })
+          });
+          console.log(`[SecureChannel] Epoch recovery: Welcome requested for group ${mlsGroupId.slice(0, 8)}`);
+        } catch (err) {
+          console.error(`[SecureChannel] Epoch recovery failed for ${mlsGroupId.slice(0, 8)}:`, err);
+        }
+      }
       async _handleMlsWelcome(data) {
         const groupId = data.group_id;
         const conversationId = data.conversation_id;
@@ -67634,6 +67728,14 @@ ${messageText}`;
               } catch (err) {
                 console.warn(`[SecureChannel] Delivery ${msg.message_type} processing failed:`, err);
                 nackedIds.push(msg.queue_id);
+                if (msg.group_id && (msg.message_type === "commit" || msg.message_type === "application")) {
+                  const failKey = msg.conversation_group_id ? `1to1-group:${msg.conversation_group_id}` : `group:${msg.group_id}`;
+                  const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
+                  this._mlsDecryptFailCounts.set(failKey, count);
+                  if (count >= _SecureChannel.MAX_MLS_DECRYPT_FAILS) {
+                    await this._triggerMlsEpochRecovery(failKey, msg.group_id);
+                  }
+                }
               }
             }
             if (nackedIds.length > 0) {
@@ -95498,7 +95600,7 @@ var init_index = __esm({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.20.41" : "0.0.0-dev";
+    VERSION = true ? "0.20.42" : "0.0.0-dev";
   }
 });
 await init_index();