@agentvault/agentvault 0.23.1 → 0.23.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/channel.d.ts +29 -12
- package/dist/channel.d.ts.map +1 -1
- package/dist/cli.js +176 -129
- package/dist/cli.js.map +2 -2
- package/dist/index.js +177 -130
- package/dist/index.js.map +2 -2
- package/openclaw.plugin.json +1 -1
- package/package.json +1 -1
package/dist/channel.d.ts
CHANGED
|
@@ -213,6 +213,14 @@ export declare class SecureChannel extends EventEmitter {
|
|
|
213
213
|
decisionClass: string;
|
|
214
214
|
} | undefined;
|
|
215
215
|
start(): Promise<void>;
|
|
216
|
+
/**
|
|
217
|
+
* Hydrate all in-memory state from persisted creds. The single source of
|
|
218
|
+
* truth for both the primary boot and the .bak-restore boot, so the two can
|
|
219
|
+
* never drift (the drift is what caused #416: the backup branch used to skip
|
|
220
|
+
* MLS group loading and dropped owner MLS DMs). Callers invoke _connect()
|
|
221
|
+
* after this resolves.
|
|
222
|
+
*/
|
|
223
|
+
private _hydrateFromPersisted;
|
|
216
224
|
/**
|
|
217
225
|
* Fetch scan rules from the server and load them into the ScanEngine.
|
|
218
226
|
*/
|
|
@@ -659,20 +667,29 @@ export declare class SecureChannel extends EventEmitter {
|
|
|
659
667
|
private _startPollFallback;
|
|
660
668
|
private _stopPollFallback;
|
|
661
669
|
private _handleError;
|
|
670
|
+
private _revokeRecoveries;
|
|
671
|
+
private static readonly REVOKE_RECOVERY_MAX;
|
|
672
|
+
private static readonly REVOKE_RECOVERY_WINDOW_MS;
|
|
662
673
|
/**
|
|
663
|
-
* Handle a WS `device_revoked` event.
|
|
664
|
-
*
|
|
674
|
+
* Handle a WS `device_revoked` event.
|
|
675
|
+
*
|
|
676
|
+
* The signal is ambiguous: the server sends it both for a genuine owner revoke
|
|
677
|
+
* AND for a transient/racy session-takeover of a device that is still ACTIVE
|
|
678
|
+
* (the error text even reads "or another session has taken over" — loopita's
|
|
679
|
+
* case, where the device stayed ACTIVE on the server). So we do NOT terminate
|
|
680
|
+
* blindly. We ask the PUBLIC /devices/{id}/status endpoint (no JWT needed, so
|
|
681
|
+
* it answers even when our device JWT is being rejected):
|
|
682
|
+
* - ACTIVE -> reconnect in place (transient); stay online.
|
|
683
|
+
* - non-ACTIVE -> terminal (genuinely revoked; operator must re-enroll).
|
|
684
|
+
* - unreachable/429 -> reconnect (inconclusive; a network blip shouldn't
|
|
685
|
+
* permanently kill a healthy agent — the WS is down too,
|
|
686
|
+
* so normal backoff handles it, and the war cap bounds
|
|
687
|
+
* thrash if the device really is dead).
|
|
665
688
|
*
|
|
666
|
-
*
|
|
667
|
-
*
|
|
668
|
-
*
|
|
669
|
-
*
|
|
670
|
-
* still-valid identity: the primary creds vanish, only the .bak survives, and
|
|
671
|
-
* the bridge's token-gate then demands a fresh invite token to restart.
|
|
672
|
-
* Keeping the creds means a restart reconnects via restoreState() when the
|
|
673
|
-
* device is still valid, and fails cleanly (device_revoked again, no data
|
|
674
|
-
* lost) when it isn't. Re-enrollment, which SHOULD wipe creds, goes through
|
|
675
|
-
* the explicit setup --force / _forceReEnroll path in start().
|
|
689
|
+
* A rolling-window cap (REVOKE_RECOVERY_MAX self-heals per WINDOW_MS) gives up
|
|
690
|
+
* (terminal) on a repeating loop. Never clears credentials in any branch —
|
|
691
|
+
* re-enrollment, which SHOULD wipe creds, goes through setup --force /
|
|
692
|
+
* _forceReEnroll in start().
|
|
676
693
|
*/
|
|
677
694
|
private _handleDeviceRevoked;
|
|
678
695
|
/**
|
package/dist/channel.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../src/channel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAU3C,OAAO,EAWL,iBAAiB,EAElB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EAKZ,YAAY,EACZ,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,QAAQ,EAER,UAAU,EAEV,cAAc,EACd,eAAe,EACf,eAAe,EACf,eAAe,EACf,UAAU,EAGX,MAAM,YAAY,CAAC;AA+HpB;;;;;;4DAM4D;AAC5D,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhF;AAED,qBAAa,aAAc,SAAQ,YAAY;IA4JjC,OAAO,CAAC,MAAM;IA3J1B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,sBAAsB,CAAc;IAC5C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,SAAS,CAGH;IACd,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAA8C;IACrE,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAA+B;IAMjD,OAAO,CAAC,eAAe,CAAM;IAG7B,OAAO,CAAC,wBAAwB,CAA8B;IAC9D,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,UAAU,CAA8D;IAChF,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,eAAe,CAA+C;IACtE,OAAO,CAAC,kBAAkB,CAAwC;IAClE,OAAO,CAAC,yBAAyB,CAAa;IAC9C,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,aAAa,CAAsB;IAC3C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,iBAAiB,CAA+C;IACxE,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,kBAAkB,CAAS;IAEnC,wHAAwH;IACxH,OAAO,CAAC,UAAU,CAA2C;IAE7D,6EAA6E;IAC7E,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,qBAAqB,CAAkC;IAC/D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAK;IAElD,kFAAkF;IAClF,OAAO,CAAC,cAAc,CAA2E;IACjG,uFAAuF;IACvF,OAAO,CAAC,mBAAmB,CAAyE;IACpG;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB,CAAkB;IAC3C,2FAA2F;IAC3F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAM;IAC7C,oFAAoF;IACpF,OAAO,CAAC,cAAc,CAAS;IAE/B,0FAA0F;IAC1F,OAAO,CAAC,kBAAkB,CAA+D;IAEzF,oFAAoF;IACpF,OAAO,CAAC,gBAAgB,CAAyB;IAEjD;;mFAE+E;IAC/E,OAAO,CAAC,oBAAoB,CAAqB;IACjD,iFAAiF;IACjF,OAAO,CAAC,0BAA0B,CAAoC;IAEtE,qFAAqF;IACrF,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAO;IAC3C,mGAAmG;IACnG,OAAO,CAAC,eAAe,CAAqB;IAC5C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAO;IAC3C;;;;OAIG;IACH,OAAO,CAAC,iBAAiB,CAA0C;IACnE,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,kBAAkB,CAAkC;IAE5D,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAqB;IAEjD,mGAAmG;IACnG,OAAO,CAAC,kBAAkB,CAAqB;IAE/C,mFAAmF;IACnF,OAAO,CAAC,kBAAkB,CAAkC;IAE5D,yFAAyF;IACzF,OAAO,CAAC,wBAAwB,CAAkC;IAElE,sDAAsD;IACtD,OAAO,CAAC,kBAAkB,CAA8C;IACxE,OAAO,CAAC,oBAAoB,CAAS;IAKrC,OAAO,CAAC,iBAAiB,CAAkB;IAQ3C,OAAO,CAAC,sBAAsB,CAAkB;IAKhD,OAAO,CAAC,cAAc,CAAuB;IAI7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAU;IAC3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAEvD;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAU;gBAEZ,MAAM,EAAE,mBAAmB;IAK/C;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;;;;;;;OAUG;YACW,wBAAwB;IAsBtC;;;;;;;;;OASG;YACW,sBAAsB;IAsDpC;;;;;;;;;;;OAWG;YACW,YAAY;IA2D1B,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAE5B;IAED,0EAA0E;IAC1E,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,sEAAsE;IACtE,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;+EAG2E;IAC3E,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;yEAIqE;IACrE,OAAO,CAAC,sBAAsB;IA0B9B,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED,iEAAiE;IACjE,IAAI,cAAc,IAAI,MAAM,GAAG,IAAI,CAElC;IAED,2CAA2C;IAC3C,IAAI,eAAe,IAAI,MAAM,EAAE,CAE9B;IAED,6CAA6C;IAC7C,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,mFAAmF;IACnF,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,mFAAmF;IACnF,IAAI,OAAO,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAGrD;IAED,oEAAoE;IACpE,IAAI,gBAAgB,IAAI,MAAM,EAAE,CAW/B;IAED,+FAA+F;IAC/F,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOtD,kFAAkF;IAClF,IAAI,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAExC;IAED;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAI7G,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../src/channel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAU3C,OAAO,EAWL,iBAAiB,EAElB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EAKZ,YAAY,EACZ,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,QAAQ,EAER,UAAU,EAEV,cAAc,EACd,eAAe,EACf,eAAe,EACf,eAAe,EACf,UAAU,EAGX,MAAM,YAAY,CAAC;AA+HpB;;;;;;4DAM4D;AAC5D,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhF;AAED,qBAAa,aAAc,SAAQ,YAAY;IA4JjC,OAAO,CAAC,MAAM;IA3J1B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,sBAAsB,CAAc;IAC5C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,SAAS,CAGH;IACd,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAA8C;IACrE,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAA+B;IAMjD,OAAO,CAAC,eAAe,CAAM;IAG7B,OAAO,CAAC,wBAAwB,CAA8B;IAC9D,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,UAAU,CAA8D;IAChF,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,eAAe,CAA+C;IACtE,OAAO,CAAC,kBAAkB,CAAwC;IAClE,OAAO,CAAC,yBAAyB,CAAa;IAC9C,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,aAAa,CAAsB;IAC3C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,iBAAiB,CAA+C;IACxE,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,kBAAkB,CAA+C;IACzE,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,kBAAkB,CAAS;IAEnC,wHAAwH;IACxH,OAAO,CAAC,UAAU,CAA2C;IAE7D,6EAA6E;IAC7E,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,qBAAqB,CAAkC;IAC/D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAK;IAElD,kFAAkF;IAClF,OAAO,CAAC,cAAc,CAA2E;IACjG,uFAAuF;IACvF,OAAO,CAAC,mBAAmB,CAAyE;IACpG;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB,CAAkB;IAC3C,2FAA2F;IAC3F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAM;IAC7C,oFAAoF;IACpF,OAAO,CAAC,cAAc,CAAS;IAE/B,0FAA0F;IAC1F,OAAO,CAAC,kBAAkB,CAA+D;IAEzF,oFAAoF;IACpF,OAAO,CAAC,gBAAgB,CAAyB;IAEjD;;mFAE+E;IAC/E,OAAO,CAAC,oBAAoB,CAAqB;IACjD,iFAAiF;IACjF,OAAO,CAAC,0BAA0B,CAAoC;IAEtE,qFAAqF;IACrF,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAO;IAC3C,mGAAmG;IACnG,OAAO,CAAC,eAAe,CAAqB;IAC5C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAO;IAC3C;;;;OAIG;IACH,OAAO,CAAC,iBAAiB,CAA0C;IACnE,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,kBAAkB,CAAkC;IAE5D,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAqB;IAEjD,mGAAmG;IACnG,OAAO,CAAC,kBAAkB,CAAqB;IAE/C,mFAAmF;IACnF,OAAO,CAAC,kBAAkB,CAAkC;IAE5D,yFAAyF;IACzF,OAAO,CAAC,wBAAwB,CAAkC;IAElE,sDAAsD;IACtD,OAAO,CAAC,kBAAkB,CAA8C;IACxE,OAAO,CAAC,oBAAoB,CAAS;IAKrC,OAAO,CAAC,iBAAiB,CAAkB;IAQ3C,OAAO,CAAC,sBAAsB,CAAkB;IAKhD,OAAO,CAAC,cAAc,CAAuB;IAI7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAU;IAC3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAEvD;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAU;gBAEZ,MAAM,EAAE,mBAAmB;IAK/C;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;;;;;;;OAUG;YACW,wBAAwB;IAsBtC;;;;;;;;;OASG;YACW,sBAAsB;IAsDpC;;;;;;;;;;;OAWG;YACW,YAAY;IA2D1B,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAE5B;IAED,0EAA0E;IAC1E,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,sEAAsE;IACtE,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;+EAG2E;IAC3E,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;yEAIqE;IACrE,OAAO,CAAC,sBAAsB;IA0B9B,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED,iEAAiE;IACjE,IAAI,cAAc,IAAI,MAAM,GAAG,IAAI,CAElC;IAED,2CAA2C;IAC3C,IAAI,eAAe,IAAI,MAAM,EAAE,CAE9B;IAED,6CAA6C;IAC7C,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,mFAAmF;IACnF,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,mFAAmF;IACnF,IAAI,OAAO,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAGrD;IAED,oEAAoE;IACpE,IAAI,gBAAgB,IAAI,MAAM,EAAE,CAW/B;IAED,+FAA+F;IAC/F,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOtD,kFAAkF;IAClF,IAAI,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAExC;IAED;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAI7G,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA2C5B;;;;;;OAMG;YACW,qBAAqB;IAmInC;;OAEG;YACW,eAAe;IAiB7B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAsBzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,YAAY,EAAE;IAMhE;;;OAGG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA8QnE;;;OAGG;IACH,UAAU,IAAI,IAAI;IAYlB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IA2BzD;;;;;OAKG;IACH,mBAAmB,CAAC,CAAC,EAAE;QAAE,aAAa,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IAU9E;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IA6BpE;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuClF;;;OAGG;IACG,QAAQ,CAAC,QAAQ,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,cAAc,EAAE,CAAC;QAC1B,aAAa,EAAE,oBAAoB,EAAE,CAAC;QACtC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyFjB;;;OAGG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE;QACL,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GACA,OAAO,CAAC,IAAI,CAAC;IA6DhB;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB9C;;OAEG;IACH,QAAQ,IAAI,QAAQ,EAAE;IAUtB;;;;;;;;;;;;;OAaG;YACW,kBAAkB;IAkDhC,cAAc,CACZ,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,MAAM,eAAe,GACpC,IAAI;IAUD,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB9B,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBlD,YAAY,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDX,sBAAsB,CAAC,YAAY,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBX,4BAA4B,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GACA,OAAO,CAAC,IAAI,CAAC;IA0BhB;;;OAGG;IACG,OAAO,CACX,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,eAAe,CAAC;IAgP3B;;OAEG;IACH,WAAW,IAAI,UAAU,EAAE;IA0C3B,OAAO,CAAC,cAAc;IAoBtB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKzC,IAAI,UAAU,IAAI,MAAM,GAAG,IAAI,CAE9B;IAED,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAE7B;IAED,IAAI,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAEvC;IAEK,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBxC,sBAAsB,IAAI,IAAI;IAS9B,qBAAqB,IAAI,IAAI;IAOvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyC3B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IA0GnC,OAAO,CAAC,eAAe;IAOvB;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,iBAAiB,EAAE,mBAAmB,GAAG,IAAI;IAI5E,uCAAuC;IACvC,IAAI,SAAS,IAAI,OAAO,iBAAiB,EAAE,mBAAmB,GAAG,IAAI,CAEpE;IAID;;;OAGG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAsC1F;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAiCpF;;;OAGG;IACG,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6DrE;;OAEG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC9E;;;;;;;;;;OAUG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsFpG;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCtE;;;;;;;;;OASG;IACH,OAAO,CAAC,uBAAuB;IAO/B,0DAA0D;IAC1D,OAAO,CAAC,sBAAsB;IAO9B;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YA2OhC,OAAO;IAgDrB,OAAO,CAAC,KAAK;YAsCC,SAAS;YAoJT,QAAQ;IA23BtB;;;;OAIG;IACH;;;OAGG;YACW,iBAAiB;YAuLjB,sBAAsB;IAmRpC;;;OAGG;YACW,6BAA6B;IA6C3C;;;OAGG;YACW,iBAAiB;IAwD/B;;;OAGG;IACG,kBAAkB,CACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC;IAoDhB;;;OAGG;YACW,oBAAoB;IA2DlC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAqC5B;;;OAGG;YACW,oBAAoB;IA0BlC;;;OAGG;YACW,uBAAuB;IAqCrC;;;;OAIG;YACW,mBAAmB;IAyEjC;;;;OAIG;YACW,oBAAoB;IAsFlC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAsEhC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiB1B,mDAAmD;IACnD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,uBAAuB,EAAE,gBAAgB,GAAG,SAAS;IAIxG,mFAAmF;IACnF,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,uBAAuB,EAAE,gBAAgB,EAAE;IAIlF,uEAAuE;IACvE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIxD,wDAAwD;IACxD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAInD,6DAA6D;IAC7D,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;YAU5B,qBAAqB;IAgNnC;;;OAGG;YACW,4BAA4B;YAkE5B,gBAAgB;IA8D9B,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB;IAexB,qDAAqD;YACvC,wBAAwB;IAuBtC;;;OAGG;IACH;;;;;;;OAOG;YACW,uBAAuB;YAiCvB,wBAAwB;IAwCtC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,mBAAmB;IA+CjC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAa1B,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;;;;;;;OAaG;YACW,sBAAsB;YA6CtB,iBAAiB;IA4L/B;;;;;;;;;OASG;YACW,wBAAwB;IAuBtC;;;OAGG;YACW,kBAAkB;IAinBhC;;;OAGG;YACW,oBAAoB;YAsLpB,sBAAsB;IAqBpC;;;OAGG;YACW,oBAAoB;IA+FlC;;;;;;OAMG;YACW,cAAc;IAgH5B;;;OAGG;YACW,mBAAmB;IAgKjC,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,UAAU;YAMJ,mBAAmB;IAmCjC,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,gBAAgB;YAOV,qBAAqB;IAuCnC,OAAO,CAAC,kBAAkB;IA0E1B,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,kBAAkB;IAwI1B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,iBAAiB,CAAgB;IACzC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAW;IAE5D;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,oBAAoB;IAkDlC;;;OAGG;YACW,aAAa;IA6B3B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;CAqB9B"}
|
package/dist/cli.js
CHANGED
|
@@ -64268,145 +64268,140 @@ var init_channel = __esm({
|
|
|
64268
64268
|
}
|
|
64269
64269
|
const raw = await loadState(this.config.dataDir);
|
|
64270
64270
|
if (raw) {
|
|
64271
|
-
await
|
|
64272
|
-
this.
|
|
64273
|
-
|
|
64274
|
-
|
|
64275
|
-
|
|
64276
|
-
|
|
64277
|
-
|
|
64278
|
-
|
|
64279
|
-
|
|
64280
|
-
|
|
64281
|
-
|
|
64282
|
-
|
|
64283
|
-
}
|
|
64284
|
-
if (this._persisted.seenA2AMessageIds) {
|
|
64285
|
-
this._a2aSeenMessageIds = new Set(this._persisted.seenA2AMessageIds.slice(-_SecureChannel.A2A_SEEN_MAX));
|
|
64271
|
+
await this._hydrateFromPersisted(raw);
|
|
64272
|
+
this._connect();
|
|
64273
|
+
return;
|
|
64274
|
+
}
|
|
64275
|
+
const restored = await restoreState(this.config.dataDir);
|
|
64276
|
+
if (restored) {
|
|
64277
|
+
console.log("[SecureChannel] Restored state from backup");
|
|
64278
|
+
const restoredRaw = await loadState(this.config.dataDir);
|
|
64279
|
+
if (restoredRaw) {
|
|
64280
|
+
await this._hydrateFromPersisted(restoredRaw);
|
|
64281
|
+
this._connect();
|
|
64282
|
+
return;
|
|
64286
64283
|
}
|
|
64287
|
-
|
|
64288
|
-
|
|
64289
|
-
|
|
64290
|
-
|
|
64291
|
-
|
|
64292
|
-
|
|
64293
|
-
|
|
64294
|
-
|
|
64295
|
-
|
|
64296
|
-
|
|
64297
|
-
|
|
64298
|
-
|
|
64299
|
-
|
|
64300
|
-
|
|
64301
|
-
|
|
64302
|
-
|
|
64284
|
+
}
|
|
64285
|
+
await this._enroll();
|
|
64286
|
+
}
|
|
64287
|
+
/**
|
|
64288
|
+
* Hydrate all in-memory state from persisted creds. The single source of
|
|
64289
|
+
* truth for both the primary boot and the .bak-restore boot, so the two can
|
|
64290
|
+
* never drift (the drift is what caused #416: the backup branch used to skip
|
|
64291
|
+
* MLS group loading and dropped owner MLS DMs). Callers invoke _connect()
|
|
64292
|
+
* after this resolves.
|
|
64293
|
+
*/
|
|
64294
|
+
async _hydrateFromPersisted(raw) {
|
|
64295
|
+
await backupState(this.config.dataDir);
|
|
64296
|
+
this._persisted = migratePersistedState(raw);
|
|
64297
|
+
if (!this._persisted.messageHistory) {
|
|
64298
|
+
this._persisted.messageHistory = [];
|
|
64299
|
+
}
|
|
64300
|
+
this._deviceId = this._persisted.deviceId;
|
|
64301
|
+
this._deviceJwt = this._persisted.deviceJwt;
|
|
64302
|
+
this._primaryConversationId = this._persisted.primaryConversationId;
|
|
64303
|
+
this._fingerprint = this._persisted.fingerprint;
|
|
64304
|
+
this._lastInboundRoomId = this._persisted.lastInboundRoomId;
|
|
64305
|
+
if (this._persisted.seenMessageIds) {
|
|
64306
|
+
this._seenMessageIds = new Set(this._persisted.seenMessageIds.slice(-_SecureChannel.SEEN_MSG_MAX));
|
|
64307
|
+
}
|
|
64308
|
+
if (this._persisted.seenA2AMessageIds) {
|
|
64309
|
+
this._a2aSeenMessageIds = new Set(this._persisted.seenA2AMessageIds.slice(-_SecureChannel.A2A_SEEN_MAX));
|
|
64310
|
+
}
|
|
64311
|
+
if (this._persisted?.rooms) {
|
|
64312
|
+
const roomConvIds = /* @__PURE__ */ new Set();
|
|
64313
|
+
for (const room of Object.values(this._persisted.rooms)) {
|
|
64314
|
+
for (const cid of room.conversationIds || []) {
|
|
64315
|
+
roomConvIds.add(cid);
|
|
64303
64316
|
}
|
|
64304
64317
|
}
|
|
64305
|
-
|
|
64306
|
-
|
|
64307
|
-
|
|
64308
|
-
|
|
64309
|
-
|
|
64310
|
-
this._sessions.set(convId, {
|
|
64311
|
-
ownerDeviceId: sessionData.ownerDeviceId,
|
|
64312
|
-
ratchet,
|
|
64313
|
-
activated: sessionData.activated ?? false,
|
|
64314
|
-
epoch: sessionData.epoch
|
|
64315
|
-
});
|
|
64318
|
+
let cleanedCount = 0;
|
|
64319
|
+
for (const cid of roomConvIds) {
|
|
64320
|
+
if (this._persisted.sessions[cid]) {
|
|
64321
|
+
delete this._persisted.sessions[cid];
|
|
64322
|
+
cleanedCount++;
|
|
64316
64323
|
}
|
|
64317
64324
|
}
|
|
64318
|
-
if (
|
|
64319
|
-
|
|
64320
|
-
console.log(`[SecureChannel] Restored ${this._sessionGroupIds.size} conversation\u2192group mappings`);
|
|
64325
|
+
if (cleanedCount > 0) {
|
|
64326
|
+
console.log(`[SecureChannel] Cleaned ${cleanedCount} stale DR room sessions`);
|
|
64321
64327
|
}
|
|
64322
|
-
|
|
64323
|
-
|
|
64324
|
-
|
|
64325
|
-
|
|
64326
|
-
|
|
64327
|
-
|
|
64328
|
-
|
|
64329
|
-
|
|
64330
|
-
|
|
64331
|
-
|
|
64332
|
-
|
|
64333
|
-
|
|
64334
|
-
console.warn(`[SecureChannel] Failed to restore MLS state for room ${roomId.slice(0, 8)}:`, mlsErr);
|
|
64335
|
-
}
|
|
64336
|
-
}
|
|
64337
|
-
}
|
|
64328
|
+
}
|
|
64329
|
+
for (const [convId, sessionData] of Object.entries(
|
|
64330
|
+
this._persisted.sessions
|
|
64331
|
+
)) {
|
|
64332
|
+
if (sessionData.ratchetState) {
|
|
64333
|
+
const ratchet = DoubleRatchet.deserialize(sessionData.ratchetState);
|
|
64334
|
+
this._sessions.set(convId, {
|
|
64335
|
+
ownerDeviceId: sessionData.ownerDeviceId,
|
|
64336
|
+
ratchet,
|
|
64337
|
+
activated: sessionData.activated ?? false,
|
|
64338
|
+
epoch: sessionData.epoch
|
|
64339
|
+
});
|
|
64338
64340
|
}
|
|
64339
|
-
|
|
64340
|
-
|
|
64341
|
+
}
|
|
64342
|
+
if (this._persisted.conversationGroupIds) {
|
|
64343
|
+
this._sessionGroupIds = new Map(Object.entries(this._persisted.conversationGroupIds));
|
|
64344
|
+
console.log(`[SecureChannel] Restored ${this._sessionGroupIds.size} conversation\u2192group mappings`);
|
|
64345
|
+
}
|
|
64346
|
+
if (this._persisted.rooms) {
|
|
64347
|
+
for (const [roomId, room] of Object.entries(this._persisted.rooms)) {
|
|
64348
|
+
const mlsGroupId = room.mlsGroupId;
|
|
64349
|
+
if (mlsGroupId) {
|
|
64341
64350
|
try {
|
|
64342
|
-
const mlsState = await loadMlsState(this.config.dataDir,
|
|
64351
|
+
const mlsState = await loadMlsState(this.config.dataDir, mlsGroupId);
|
|
64343
64352
|
if (mlsState) {
|
|
64344
64353
|
const mgr = new MLSGroupManager();
|
|
64345
64354
|
mgr.importState(JSON.parse(mlsState));
|
|
64346
|
-
this._mlsGroups.set(
|
|
64355
|
+
this._mlsGroups.set(roomId, mgr);
|
|
64347
64356
|
}
|
|
64348
64357
|
} catch (mlsErr) {
|
|
64349
|
-
console.warn(`[SecureChannel] Failed to restore MLS state for
|
|
64358
|
+
console.warn(`[SecureChannel] Failed to restore MLS state for room ${roomId.slice(0, 8)}:`, mlsErr);
|
|
64350
64359
|
}
|
|
64351
64360
|
}
|
|
64352
64361
|
}
|
|
64353
|
-
|
|
64354
|
-
|
|
64362
|
+
}
|
|
64363
|
+
for (const [convId, entry] of Object.entries(this._persisted.mlsConversations ?? {})) {
|
|
64364
|
+
if (entry.mlsGroupId) {
|
|
64355
64365
|
try {
|
|
64356
|
-
const
|
|
64357
|
-
if (
|
|
64366
|
+
const mlsState = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
|
|
64367
|
+
if (mlsState) {
|
|
64358
64368
|
const mgr = new MLSGroupManager();
|
|
64359
|
-
mgr.importState(JSON.parse(
|
|
64360
|
-
this._mlsGroups.set(`
|
|
64361
|
-
console.log(`[SecureChannel] Loaded shared MLS group for ${gid.slice(0, 8)} (epoch=${mgr.epoch})`);
|
|
64369
|
+
mgr.importState(JSON.parse(mlsState));
|
|
64370
|
+
this._mlsGroups.set(`conv:${convId}`, mgr);
|
|
64362
64371
|
}
|
|
64363
|
-
} catch (
|
|
64364
|
-
console.warn(`[SecureChannel] Failed to
|
|
64372
|
+
} catch (mlsErr) {
|
|
64373
|
+
console.warn(`[SecureChannel] Failed to restore MLS state for conv ${convId.slice(0, 8)}:`, mlsErr);
|
|
64365
64374
|
}
|
|
64366
64375
|
}
|
|
64367
|
-
|
|
64368
|
-
|
|
64369
|
-
|
|
64370
|
-
|
|
64371
|
-
|
|
64372
|
-
|
|
64373
|
-
|
|
64374
|
-
|
|
64375
|
-
|
|
64376
|
-
|
|
64377
|
-
console.warn(`[SecureChannel] Failed to restore MLS state for A2A ${channelId.slice(0, 8)}:`, mlsErr);
|
|
64378
|
-
}
|
|
64376
|
+
}
|
|
64377
|
+
for (const [gid, entry] of Object.entries(this._persisted.mlsGroups ?? {})) {
|
|
64378
|
+
if (!entry.mlsGroupId) continue;
|
|
64379
|
+
try {
|
|
64380
|
+
const stateJson = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
|
|
64381
|
+
if (stateJson) {
|
|
64382
|
+
const mgr = new MLSGroupManager();
|
|
64383
|
+
mgr.importState(JSON.parse(stateJson));
|
|
64384
|
+
this._mlsGroups.set(`1to1-group:${gid}`, mgr);
|
|
64385
|
+
console.log(`[SecureChannel] Loaded shared MLS group for ${gid.slice(0, 8)} (epoch=${mgr.epoch})`);
|
|
64379
64386
|
}
|
|
64387
|
+
} catch (loadErr) {
|
|
64388
|
+
console.warn(`[SecureChannel] Failed to load shared MLS group ${gid.slice(0, 8)}:`, loadErr);
|
|
64380
64389
|
}
|
|
64381
|
-
this._connect();
|
|
64382
|
-
return;
|
|
64383
64390
|
}
|
|
64384
|
-
const
|
|
64385
|
-
|
|
64386
|
-
|
|
64387
|
-
|
|
64388
|
-
|
|
64389
|
-
|
|
64390
|
-
|
|
64391
|
-
|
|
64392
|
-
this._deviceJwt = this._persisted.deviceJwt;
|
|
64393
|
-
this._primaryConversationId = this._persisted.primaryConversationId;
|
|
64394
|
-
this._fingerprint = this._persisted.fingerprint;
|
|
64395
|
-
for (const [convId, sd] of Object.entries(this._persisted.sessions)) {
|
|
64396
|
-
if (sd.ratchetState) {
|
|
64397
|
-
this._sessions.set(convId, {
|
|
64398
|
-
ownerDeviceId: sd.ownerDeviceId,
|
|
64399
|
-
ratchet: DoubleRatchet.deserialize(sd.ratchetState),
|
|
64400
|
-
activated: sd.activated ?? false,
|
|
64401
|
-
epoch: sd.epoch
|
|
64402
|
-
});
|
|
64391
|
+
for (const [channelId, entry] of Object.entries(this._persisted.a2aChannels ?? {})) {
|
|
64392
|
+
if (entry.mlsGroupId) {
|
|
64393
|
+
try {
|
|
64394
|
+
const mlsState = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
|
|
64395
|
+
if (mlsState) {
|
|
64396
|
+
const mgr = new MLSGroupManager();
|
|
64397
|
+
mgr.importState(JSON.parse(mlsState));
|
|
64398
|
+
this._mlsGroups.set(`a2a:${channelId}`, mgr);
|
|
64403
64399
|
}
|
|
64400
|
+
} catch (mlsErr) {
|
|
64401
|
+
console.warn(`[SecureChannel] Failed to restore MLS state for A2A ${channelId.slice(0, 8)}:`, mlsErr);
|
|
64404
64402
|
}
|
|
64405
|
-
this._connect();
|
|
64406
|
-
return;
|
|
64407
64403
|
}
|
|
64408
64404
|
}
|
|
64409
|
-
await this._enroll();
|
|
64410
64405
|
}
|
|
64411
64406
|
/**
|
|
64412
64407
|
* Fetch scan rules from the server and load them into the ScanEngine.
|
|
@@ -64746,7 +64741,7 @@ var init_channel = __esm({
|
|
|
64746
64741
|
*/
|
|
64747
64742
|
sendActivitySpan(spanData) {
|
|
64748
64743
|
if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
|
|
64749
|
-
const pluginVersion = true ? "0.23.
|
|
64744
|
+
const pluginVersion = true ? "0.23.3" : "0.0.0-dev";
|
|
64750
64745
|
const agentName = this.config.agentName ?? "Agent";
|
|
64751
64746
|
const resource = {
|
|
64752
64747
|
"service.name": "agentvault-agent",
|
|
@@ -66363,7 +66358,7 @@ var init_channel = __esm({
|
|
|
66363
66358
|
agentVersion: this.config.agentVersion ?? "0.0.0",
|
|
66364
66359
|
// __AV_VERSION__ is injected by esbuild from package.json at build time.
|
|
66365
66360
|
// Falls back to "0.0.0-dev" in non-bundled contexts (tests).
|
|
66366
|
-
pluginVersion: true ? "0.23.
|
|
66361
|
+
pluginVersion: true ? "0.23.3" : "0.0.0-dev"
|
|
66367
66362
|
});
|
|
66368
66363
|
this._telemetryReporter.startAutoFlush(3e4);
|
|
66369
66364
|
}
|
|
@@ -66439,7 +66434,7 @@ var init_channel = __esm({
|
|
|
66439
66434
|
return;
|
|
66440
66435
|
}
|
|
66441
66436
|
if (data.event === "device_revoked") {
|
|
66442
|
-
this._handleDeviceRevoked();
|
|
66437
|
+
await this._handleDeviceRevoked();
|
|
66443
66438
|
return;
|
|
66444
66439
|
}
|
|
66445
66440
|
if (data.event === "device_linked") {
|
|
@@ -66673,7 +66668,7 @@ var init_channel = __esm({
|
|
|
66673
66668
|
agentVersion: this.config.agentVersion ?? "0.0.0",
|
|
66674
66669
|
// __AV_VERSION__ is injected by esbuild from package.json at build time.
|
|
66675
66670
|
// Falls back to "0.0.0-dev" in non-bundled contexts (tests).
|
|
66676
|
-
pluginVersion: true ? "0.23.
|
|
66671
|
+
pluginVersion: true ? "0.23.3" : "0.0.0-dev"
|
|
66677
66672
|
});
|
|
66678
66673
|
this._telemetryReporter.startAutoFlush(3e4);
|
|
66679
66674
|
}
|
|
@@ -69838,22 +69833,74 @@ ${messageText}`;
|
|
|
69838
69833
|
this._setState("error");
|
|
69839
69834
|
this.emit("error", err);
|
|
69840
69835
|
}
|
|
69836
|
+
// Phase 2 — rolling-window timestamps of device_revoked self-heal reconnects,
|
|
69837
|
+
// used as a war cap so a takeover war or a server status/WS inconsistency can't
|
|
69838
|
+
// thrash forever.
|
|
69839
|
+
_revokeRecoveries = [];
|
|
69840
|
+
static REVOKE_RECOVERY_MAX = 3;
|
|
69841
|
+
static REVOKE_RECOVERY_WINDOW_MS = 12e4;
|
|
69841
69842
|
/**
|
|
69842
|
-
* Handle a WS `device_revoked` event.
|
|
69843
|
-
*
|
|
69843
|
+
* Handle a WS `device_revoked` event.
|
|
69844
|
+
*
|
|
69845
|
+
* The signal is ambiguous: the server sends it both for a genuine owner revoke
|
|
69846
|
+
* AND for a transient/racy session-takeover of a device that is still ACTIVE
|
|
69847
|
+
* (the error text even reads "or another session has taken over" — loopita's
|
|
69848
|
+
* case, where the device stayed ACTIVE on the server). So we do NOT terminate
|
|
69849
|
+
* blindly. We ask the PUBLIC /devices/{id}/status endpoint (no JWT needed, so
|
|
69850
|
+
* it answers even when our device JWT is being rejected):
|
|
69851
|
+
* - ACTIVE -> reconnect in place (transient); stay online.
|
|
69852
|
+
* - non-ACTIVE -> terminal (genuinely revoked; operator must re-enroll).
|
|
69853
|
+
* - unreachable/429 -> reconnect (inconclusive; a network blip shouldn't
|
|
69854
|
+
* permanently kill a healthy agent — the WS is down too,
|
|
69855
|
+
* so normal backoff handles it, and the war cap bounds
|
|
69856
|
+
* thrash if the device really is dead).
|
|
69844
69857
|
*
|
|
69845
|
-
*
|
|
69846
|
-
*
|
|
69847
|
-
*
|
|
69848
|
-
*
|
|
69849
|
-
* still-valid identity: the primary creds vanish, only the .bak survives, and
|
|
69850
|
-
* the bridge's token-gate then demands a fresh invite token to restart.
|
|
69851
|
-
* Keeping the creds means a restart reconnects via restoreState() when the
|
|
69852
|
-
* device is still valid, and fails cleanly (device_revoked again, no data
|
|
69853
|
-
* lost) when it isn't. Re-enrollment, which SHOULD wipe creds, goes through
|
|
69854
|
-
* the explicit setup --force / _forceReEnroll path in start().
|
|
69858
|
+
* A rolling-window cap (REVOKE_RECOVERY_MAX self-heals per WINDOW_MS) gives up
|
|
69859
|
+
* (terminal) on a repeating loop. Never clears credentials in any branch —
|
|
69860
|
+
* re-enrollment, which SHOULD wipe creds, goes through setup --force /
|
|
69861
|
+
* _forceReEnroll in start().
|
|
69855
69862
|
*/
|
|
69856
|
-
_handleDeviceRevoked() {
|
|
69863
|
+
async _handleDeviceRevoked() {
|
|
69864
|
+
const now = Date.now();
|
|
69865
|
+
this._revokeRecoveries = this._revokeRecoveries.filter(
|
|
69866
|
+
(t2) => now - t2 < _SecureChannel.REVOKE_RECOVERY_WINDOW_MS
|
|
69867
|
+
);
|
|
69868
|
+
if (this._revokeRecoveries.length >= _SecureChannel.REVOKE_RECOVERY_MAX) {
|
|
69869
|
+
console.warn(
|
|
69870
|
+
"[SecureChannel] device_revoked self-healed too many times in a short window \u2014 giving up (terminal)"
|
|
69871
|
+
);
|
|
69872
|
+
this._handleError(new Error("Device was revoked"));
|
|
69873
|
+
return;
|
|
69874
|
+
}
|
|
69875
|
+
const deviceId = this._deviceId ?? this._persisted?.deviceId;
|
|
69876
|
+
if (!deviceId) {
|
|
69877
|
+
this._handleError(new Error("Device was revoked"));
|
|
69878
|
+
return;
|
|
69879
|
+
}
|
|
69880
|
+
let reconnect;
|
|
69881
|
+
try {
|
|
69882
|
+
const status = await pollDeviceStatus(this.config.apiUrl, deviceId);
|
|
69883
|
+
reconnect = status.rateLimited === true || status.status === "ACTIVE";
|
|
69884
|
+
if (!reconnect) {
|
|
69885
|
+
console.warn(
|
|
69886
|
+
`[SecureChannel] device_revoked confirmed by server (status=${status.status}) \u2014 terminal`
|
|
69887
|
+
);
|
|
69888
|
+
}
|
|
69889
|
+
} catch (err) {
|
|
69890
|
+
console.warn(
|
|
69891
|
+
"[SecureChannel] device_revoked status check failed; reconnecting (inconclusive):",
|
|
69892
|
+
err
|
|
69893
|
+
);
|
|
69894
|
+
reconnect = true;
|
|
69895
|
+
}
|
|
69896
|
+
if (reconnect) {
|
|
69897
|
+
this._revokeRecoveries.push(now);
|
|
69898
|
+
console.log(
|
|
69899
|
+
"[SecureChannel] device_revoked but device not confirmed dead \u2014 reconnecting (self-heal)"
|
|
69900
|
+
);
|
|
69901
|
+
this._scheduleReconnect();
|
|
69902
|
+
return;
|
|
69903
|
+
}
|
|
69857
69904
|
this._handleError(new Error("Device was revoked"));
|
|
69858
69905
|
}
|
|
69859
69906
|
/**
|
|
@@ -90716,7 +90763,7 @@ var init_index = __esm({
|
|
|
90716
90763
|
init_skill_invoker();
|
|
90717
90764
|
await init_skill_telemetry();
|
|
90718
90765
|
await init_policy_enforcer();
|
|
90719
|
-
VERSION = true ? "0.23.
|
|
90766
|
+
VERSION = true ? "0.23.3" : "0.0.0-dev";
|
|
90720
90767
|
}
|
|
90721
90768
|
});
|
|
90722
90769
|
|