@agentvault/agentvault 0.23.1 → 0.23.3

package/dist/index.js

@@ -64267,145 +64267,140 @@ var init_channel = __esm({
         }
         const raw = await loadState(this.config.dataDir);
         if (raw) {
-          await backupState(this.config.dataDir);
-          this._persisted = migratePersistedState(raw);
-          if (!this._persisted.messageHistory) {
-            this._persisted.messageHistory = [];
-          }
-          this._deviceId = this._persisted.deviceId;
-          this._deviceJwt = this._persisted.deviceJwt;
-          this._primaryConversationId = this._persisted.primaryConversationId;
-          this._fingerprint = this._persisted.fingerprint;
-          this._lastInboundRoomId = this._persisted.lastInboundRoomId;
-          if (this._persisted.seenMessageIds) {
-            this._seenMessageIds = new Set(this._persisted.seenMessageIds.slice(-_SecureChannel.SEEN_MSG_MAX));
-          }
-          if (this._persisted.seenA2AMessageIds) {
-            this._a2aSeenMessageIds = new Set(this._persisted.seenA2AMessageIds.slice(-_SecureChannel.A2A_SEEN_MAX));
-          }
-          if (this._persisted?.rooms) {
-            const roomConvIds = /* @__PURE__ */ new Set();
-            for (const room of Object.values(this._persisted.rooms)) {
-              for (const cid of room.conversationIds || []) {
-                roomConvIds.add(cid);
-              }
-            }
-            let cleanedCount = 0;
-            for (const cid of roomConvIds) {
-              if (this._persisted.sessions[cid]) {
-                delete this._persisted.sessions[cid];
-                cleanedCount++;
-              }
-            }
-            if (cleanedCount > 0) {
-              console.log(`[SecureChannel] Cleaned ${cleanedCount} stale DR room sessions`);
+          await this._hydrateFromPersisted(raw);
+          this._connect();
+          return;
+        }
+        const restored = await restoreState(this.config.dataDir);
+        if (restored) {
+          console.log("[SecureChannel] Restored state from backup");
+          const restoredRaw = await loadState(this.config.dataDir);
+          if (restoredRaw) {
+            await this._hydrateFromPersisted(restoredRaw);
+            this._connect();
+            return;
+          }
+        }
+        await this._enroll();
+      }
+      /**
+       * Hydrate all in-memory state from persisted creds. The single source of
+       * truth for both the primary boot and the .bak-restore boot, so the two can
+       * never drift (the drift is what caused #416: the backup branch used to skip
+       * MLS group loading and dropped owner MLS DMs). Callers invoke _connect()
+       * after this resolves.
+       */
+      async _hydrateFromPersisted(raw) {
+        await backupState(this.config.dataDir);
+        this._persisted = migratePersistedState(raw);
+        if (!this._persisted.messageHistory) {
+          this._persisted.messageHistory = [];
+        }
+        this._deviceId = this._persisted.deviceId;
+        this._deviceJwt = this._persisted.deviceJwt;
+        this._primaryConversationId = this._persisted.primaryConversationId;
+        this._fingerprint = this._persisted.fingerprint;
+        this._lastInboundRoomId = this._persisted.lastInboundRoomId;
+        if (this._persisted.seenMessageIds) {
+          this._seenMessageIds = new Set(this._persisted.seenMessageIds.slice(-_SecureChannel.SEEN_MSG_MAX));
+        }
+        if (this._persisted.seenA2AMessageIds) {
+          this._a2aSeenMessageIds = new Set(this._persisted.seenA2AMessageIds.slice(-_SecureChannel.A2A_SEEN_MAX));
+        }
+        if (this._persisted?.rooms) {
+          const roomConvIds = /* @__PURE__ */ new Set();
+          for (const room of Object.values(this._persisted.rooms)) {
+            for (const cid of room.conversationIds || []) {
+              roomConvIds.add(cid);
             }
           }
-          for (const [convId, sessionData] of Object.entries(
-            this._persisted.sessions
-          )) {
-            if (sessionData.ratchetState) {
-              const ratchet = DoubleRatchet.deserialize(sessionData.ratchetState);
-              this._sessions.set(convId, {
-                ownerDeviceId: sessionData.ownerDeviceId,
-                ratchet,
-                activated: sessionData.activated ?? false,
-                epoch: sessionData.epoch
-              });
+          let cleanedCount = 0;
+          for (const cid of roomConvIds) {
+            if (this._persisted.sessions[cid]) {
+              delete this._persisted.sessions[cid];
+              cleanedCount++;
             }
           }
-          if (this._persisted.conversationGroupIds) {
-            this._sessionGroupIds = new Map(Object.entries(this._persisted.conversationGroupIds));
-            console.log(`[SecureChannel] Restored ${this._sessionGroupIds.size} conversation\u2192group mappings`);
+          if (cleanedCount > 0) {
+            console.log(`[SecureChannel] Cleaned ${cleanedCount} stale DR room sessions`);
           }
-          if (this._persisted.rooms) {
-            for (const [roomId, room] of Object.entries(this._persisted.rooms)) {
-              const mlsGroupId = room.mlsGroupId;
-              if (mlsGroupId) {
-                try {
-                  const mlsState = await loadMlsState(this.config.dataDir, mlsGroupId);
-                  if (mlsState) {
-                    const mgr = new MLSGroupManager();
-                    mgr.importState(JSON.parse(mlsState));
-                    this._mlsGroups.set(roomId, mgr);
-                  }
-                } catch (mlsErr) {
-                  console.warn(`[SecureChannel] Failed to restore MLS state for room ${roomId.slice(0, 8)}:`, mlsErr);
-                }
-              }
-            }
+        }
+        for (const [convId, sessionData] of Object.entries(
+          this._persisted.sessions
+        )) {
+          if (sessionData.ratchetState) {
+            const ratchet = DoubleRatchet.deserialize(sessionData.ratchetState);
+            this._sessions.set(convId, {
+              ownerDeviceId: sessionData.ownerDeviceId,
+              ratchet,
+              activated: sessionData.activated ?? false,
+              epoch: sessionData.epoch
+            });
           }
-          for (const [convId, entry] of Object.entries(this._persisted.mlsConversations ?? {})) {
-            if (entry.mlsGroupId) {
+        }
+        if (this._persisted.conversationGroupIds) {
+          this._sessionGroupIds = new Map(Object.entries(this._persisted.conversationGroupIds));
+          console.log(`[SecureChannel] Restored ${this._sessionGroupIds.size} conversation\u2192group mappings`);
+        }
+        if (this._persisted.rooms) {
+          for (const [roomId, room] of Object.entries(this._persisted.rooms)) {
+            const mlsGroupId = room.mlsGroupId;
+            if (mlsGroupId) {
               try {
-                const mlsState = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
+                const mlsState = await loadMlsState(this.config.dataDir, mlsGroupId);
                 if (mlsState) {
                   const mgr = new MLSGroupManager();
                   mgr.importState(JSON.parse(mlsState));
-                  this._mlsGroups.set(`conv:${convId}`, mgr);
+                  this._mlsGroups.set(roomId, mgr);
                 }
               } catch (mlsErr) {
-                console.warn(`[SecureChannel] Failed to restore MLS state for conv ${convId.slice(0, 8)}:`, mlsErr);
+                console.warn(`[SecureChannel] Failed to restore MLS state for room ${roomId.slice(0, 8)}:`, mlsErr);
               }
             }
           }
-          for (const [gid, entry] of Object.entries(this._persisted.mlsGroups ?? {})) {
-            if (!entry.mlsGroupId) continue;
+        }
+        for (const [convId, entry] of Object.entries(this._persisted.mlsConversations ?? {})) {
+          if (entry.mlsGroupId) {
             try {
-              const stateJson = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
-              if (stateJson) {
+              const mlsState = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
+              if (mlsState) {
                 const mgr = new MLSGroupManager();
-                mgr.importState(JSON.parse(stateJson));
-                this._mlsGroups.set(`1to1-group:${gid}`, mgr);
-                console.log(`[SecureChannel] Loaded shared MLS group for ${gid.slice(0, 8)} (epoch=${mgr.epoch})`);
+                mgr.importState(JSON.parse(mlsState));
+                this._mlsGroups.set(`conv:${convId}`, mgr);
               }
-            } catch (loadErr) {
-              console.warn(`[SecureChannel] Failed to load shared MLS group ${gid.slice(0, 8)}:`, loadErr);
+            } catch (mlsErr) {
+              console.warn(`[SecureChannel] Failed to restore MLS state for conv ${convId.slice(0, 8)}:`, mlsErr);
             }
           }
-          for (const [channelId, entry] of Object.entries(this._persisted.a2aChannels ?? {})) {
-            if (entry.mlsGroupId) {
-              try {
-                const mlsState = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
-                if (mlsState) {
-                  const mgr = new MLSGroupManager();
-                  mgr.importState(JSON.parse(mlsState));
-                  this._mlsGroups.set(`a2a:${channelId}`, mgr);
-                }
-              } catch (mlsErr) {
-                console.warn(`[SecureChannel] Failed to restore MLS state for A2A ${channelId.slice(0, 8)}:`, mlsErr);
-              }
+        }
+        for (const [gid, entry] of Object.entries(this._persisted.mlsGroups ?? {})) {
+          if (!entry.mlsGroupId) continue;
+          try {
+            const stateJson = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
+            if (stateJson) {
+              const mgr = new MLSGroupManager();
+              mgr.importState(JSON.parse(stateJson));
+              this._mlsGroups.set(`1to1-group:${gid}`, mgr);
+              console.log(`[SecureChannel] Loaded shared MLS group for ${gid.slice(0, 8)} (epoch=${mgr.epoch})`);
             }
+          } catch (loadErr) {
+            console.warn(`[SecureChannel] Failed to load shared MLS group ${gid.slice(0, 8)}:`, loadErr);
           }
-          this._connect();
-          return;
         }
-        const restored = await restoreState(this.config.dataDir);
-        if (restored) {
-          console.log("[SecureChannel] Restored state from backup");
-          const restoredRaw = await loadState(this.config.dataDir);
-          if (restoredRaw) {
-            this._persisted = migratePersistedState(restoredRaw);
-            if (!this._persisted.messageHistory) this._persisted.messageHistory = [];
-            this._deviceId = this._persisted.deviceId;
-            this._deviceJwt = this._persisted.deviceJwt;
-            this._primaryConversationId = this._persisted.primaryConversationId;
-            this._fingerprint = this._persisted.fingerprint;
-            for (const [convId, sd] of Object.entries(this._persisted.sessions)) {
-              if (sd.ratchetState) {
-                this._sessions.set(convId, {
-                  ownerDeviceId: sd.ownerDeviceId,
-                  ratchet: DoubleRatchet.deserialize(sd.ratchetState),
-                  activated: sd.activated ?? false,
-                  epoch: sd.epoch
-                });
+        for (const [channelId, entry] of Object.entries(this._persisted.a2aChannels ?? {})) {
+          if (entry.mlsGroupId) {
+            try {
+              const mlsState = await loadMlsState(this.config.dataDir, entry.mlsGroupId);
+              if (mlsState) {
+                const mgr = new MLSGroupManager();
+                mgr.importState(JSON.parse(mlsState));
+                this._mlsGroups.set(`a2a:${channelId}`, mgr);
               }
+            } catch (mlsErr) {
+              console.warn(`[SecureChannel] Failed to restore MLS state for A2A ${channelId.slice(0, 8)}:`, mlsErr);
             }
-            this._connect();
-            return;
           }
         }
-        await this._enroll();
       }
       /**
        * Fetch scan rules from the server and load them into the ScanEngine.
@@ -64745,7 +64740,7 @@ var init_channel = __esm({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.1" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.3" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -66362,7 +66357,7 @@ var init_channel = __esm({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.1" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.3" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -66438,7 +66433,7 @@ var init_channel = __esm({
               return;
             }
             if (data.event === "device_revoked") {
-              this._handleDeviceRevoked();
+              await this._handleDeviceRevoked();
               return;
             }
             if (data.event === "device_linked") {
@@ -66672,7 +66667,7 @@ var init_channel = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.1" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.3" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69837,22 +69832,74 @@ ${messageText}`;
         this._setState("error");
         this.emit("error", err);
       }
+      // Phase 2 — rolling-window timestamps of device_revoked self-heal reconnects,
+      // used as a war cap so a takeover war or a server status/WS inconsistency can't
+      // thrash forever.
+      _revokeRecoveries = [];
+      static REVOKE_RECOVERY_MAX = 3;
+      static REVOKE_RECOVERY_WINDOW_MS = 12e4;
       /**
-       * Handle a WS `device_revoked` event. Surfaces a terminal error so
-       * attachLifecycle stops the channel — but does NOT delete credentials.
+       * Handle a WS `device_revoked` event.
        *
-       * This signal fires both for a genuine owner revoke AND for a transient
-       * session-takeover of a device that is still ACTIVE on the server (the error
-       * text even reads "or another session has taken over"). Deleting
-       * agentvault.json here — as this path used to via clearState() — strands a
-       * still-valid identity: the primary creds vanish, only the .bak survives, and
-       * the bridge's token-gate then demands a fresh invite token to restart.
-       * Keeping the creds means a restart reconnects via restoreState() when the
-       * device is still valid, and fails cleanly (device_revoked again, no data
-       * lost) when it isn't. Re-enrollment, which SHOULD wipe creds, goes through
-       * the explicit setup --force / _forceReEnroll path in start().
+       * The signal is ambiguous: the server sends it both for a genuine owner revoke
+       * AND for a transient/racy session-takeover of a device that is still ACTIVE
+       * (the error text even reads "or another session has taken over" — loopita's
+       * case, where the device stayed ACTIVE on the server). So we do NOT terminate
+       * blindly. We ask the PUBLIC /devices/{id}/status endpoint (no JWT needed, so
+       * it answers even when our device JWT is being rejected):
+       *   - ACTIVE          -> reconnect in place (transient); stay online.
+       *   - non-ACTIVE      -> terminal (genuinely revoked; operator must re-enroll).
+       *   - unreachable/429  -> reconnect (inconclusive; a network blip shouldn't
+       *                         permanently kill a healthy agent — the WS is down too,
+       *                         so normal backoff handles it, and the war cap bounds
+       *                         thrash if the device really is dead).
+       *
+       * A rolling-window cap (REVOKE_RECOVERY_MAX self-heals per WINDOW_MS) gives up
+       * (terminal) on a repeating loop. Never clears credentials in any branch —
+       * re-enrollment, which SHOULD wipe creds, goes through setup --force /
+       * _forceReEnroll in start().
        */
-      _handleDeviceRevoked() {
+      async _handleDeviceRevoked() {
+        const now = Date.now();
+        this._revokeRecoveries = this._revokeRecoveries.filter(
+          (t2) => now - t2 < _SecureChannel.REVOKE_RECOVERY_WINDOW_MS
+        );
+        if (this._revokeRecoveries.length >= _SecureChannel.REVOKE_RECOVERY_MAX) {
+          console.warn(
+            "[SecureChannel] device_revoked self-healed too many times in a short window \u2014 giving up (terminal)"
+          );
+          this._handleError(new Error("Device was revoked"));
+          return;
+        }
+        const deviceId = this._deviceId ?? this._persisted?.deviceId;
+        if (!deviceId) {
+          this._handleError(new Error("Device was revoked"));
+          return;
+        }
+        let reconnect;
+        try {
+          const status = await pollDeviceStatus(this.config.apiUrl, deviceId);
+          reconnect = status.rateLimited === true || status.status === "ACTIVE";
+          if (!reconnect) {
+            console.warn(
+              `[SecureChannel] device_revoked confirmed by server (status=${status.status}) \u2014 terminal`
+            );
+          }
+        } catch (err) {
+          console.warn(
+            "[SecureChannel] device_revoked status check failed; reconnecting (inconclusive):",
+            err
+          );
+          reconnect = true;
+        }
+        if (reconnect) {
+          this._revokeRecoveries.push(now);
+          console.log(
+            "[SecureChannel] device_revoked but device not confirmed dead \u2014 reconnecting (self-heal)"
+          );
+          this._scheduleReconnect();
+          return;
+        }
         this._handleError(new Error("Device was revoked"));
       }
       /**
@@ -96803,7 +96850,7 @@ var init_index = __esm({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.1" : "0.0.0-dev";
+    VERSION = true ? "0.23.3" : "0.0.0-dev";
   }
 });
 await init_index();