@agentvault/agentvault 0.23.10 → 0.23.12

package/dist/index.js

@@ -63912,6 +63912,10 @@ var init_channel = __esm({
       _sessionGroupIds = /* @__PURE__ */ new Map();
       /** Consecutive MLS decrypt failure count per group key for epoch recovery. */
       _mlsDecryptFailCounts = /* @__PURE__ */ new Map();
+      /** #474: per-group consecutive processCommit failures. Mirrors the decrypt
+       *  counter above — a commit that fails is divergence, and divergence must
+       *  self-heal rather than be logged and dropped. */
+      _mlsCommitFailCounts = /* @__PURE__ */ new Map();
       static MAX_MLS_DECRYPT_FAILS = 3;
       /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
       _mlsKeyPackage = null;
@@ -64792,7 +64796,7 @@ var init_channel = __esm({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.10" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.12" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -64826,7 +64830,16 @@ var init_channel = __esm({
         this._ws.send(
           JSON.stringify({
             event: "worker_heartbeat",
-            data: { worker_capable: h2.workerCapable, armed_rooms: h2.armedRooms }
+            data: {
+              worker_capable: h2.workerCapable,
+              armed_rooms: h2.armedRooms,
+              // #20: OPTIONAL on the way in so an older bridge against a newer
+              // plugin still emits a shape the backend can read. `=== true` means
+              // absent/malformed becomes false — the fail-closed direction, and it
+              // never emits `undefined` (which would drop the key entirely).
+              host_trusted: h2.hostTrusted === true,
+              gates_effective: h2.gatesEffective === true
+            }
           })
         );
       }
@@ -66522,7 +66535,7 @@ var init_channel = __esm({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.10" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.12" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -66840,7 +66853,7 @@ var init_channel = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.10" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.12" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68236,14 +68249,9 @@ ${messageText}`;
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
               } catch (err) {
-                const isOldEpoch = err?.message?.includes("epoch") || err?.message?.includes("old") || err?.message?.includes("Validation");
-                if (isOldEpoch) {
-                  console.log(`[SecureChannel] Discarding old-epoch commit for room ${roomId.slice(0, 8)}`);
-                } else {
-                  console.error(`[SecureChannel] MLS commit failed for room ${roomId.slice(0, 8)}:`, err);
-                  throw err;
-                }
+                await this._onCommitFailure(roomId, groupId, err, `room ${roomId.slice(0, 8)}`);
               }
+              this._mlsCommitFailCounts.delete(roomId);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -68261,14 +68269,9 @@ ${messageText}`;
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
               } catch (err) {
-                const isOldEpoch = err?.message?.includes("epoch") || err?.message?.includes("old") || err?.message?.includes("Validation");
-                if (isOldEpoch) {
-                  console.log(`[SecureChannel] Discarding old-epoch commit for A2A ${chId.slice(0, 8)}`);
-                } else {
-                  console.error(`[SecureChannel] MLS commit failed for A2A ${chId.slice(0, 8)}:`, err);
-                  throw err;
-                }
+                await this._onCommitFailure(`a2a:${chId}`, groupId, err, `A2A ${chId.slice(0, 8)}`);
               }
+              this._mlsCommitFailCounts.delete(`a2a:${chId}`);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -68325,6 +68328,52 @@ ${messageText}`;
        * sends us one. Deduped to a 30s window per group so a burst of undecryptable
        * rows doesn't spam request-welcome. Fire-and-forget.
        */
+      /**
+       * #474 — a failed `processCommit` is DIVERGENCE, and divergence must
+       * self-heal. It previously did neither: the room stayed broken forever.
+       *
+       * Two swallow paths existed, and only the second was ever reported:
+       *
+       *   1. `isOldEpoch` substring-matched the error text for "epoch" / "old" /
+       *      "Validation" and discarded deliberately. `ValidationError: Desired gen
+       *      in the past` contains "Validation", so the LOUDEST production failure
+       *      was filed as benign — 1,439 occurrences on one agent, all thrown away
+       *      by a string match.
+       *   2. Everything else re-threw to the WS dispatcher, which logs and drops.
+       *
+       * Result: ~1,600 commit failures across 13 rooms and ZERO resyncs. Classifying
+       * divergence by grepping an error message is the root of it — error text is
+       * not a protocol, and the one case that must never be silent was the one that
+       * happened to contain the magic word.
+       *
+       * So: no classification. COUNT, and after MAX_MLS_DECRYPT_FAILS consecutive
+       * failures run the same ladder the decrypt path has used since #440 — replay
+       * the missed commits via /sync, and fall back to re-join only if that cannot
+       * catch up. Counting rather than resyncing on first failure matters: a
+       * genuinely stale commit is normal, and resyncing on each one would have
+       * fired ~1,600 Welcome requests.
+       *
+       * Never re-throws. The caller's only handler logs and drops, so throwing here
+       * is indistinguishable from swallowing — it just moves the swallow one frame up.
+       */
+      async _onCommitFailure(groupKey, mlsGroupId, err, label) {
+        const count = (this._mlsCommitFailCounts.get(groupKey) ?? 0) + 1;
+        this._mlsCommitFailCounts.set(groupKey, count);
+        console.error(
+          `[SecureChannel] MLS commit failed (${count}/${_SecureChannel.MAX_MLS_DECRYPT_FAILS}) for ${label}:`,
+          err
+        );
+        if (count < _SecureChannel.MAX_MLS_DECRYPT_FAILS) return;
+        console.warn(`[SecureChannel] MLS commit resync triggered for ${label} \u2014 ${count} consecutive failures`);
+        try {
+          if (!await this._resyncOnDivergence(groupKey, mlsGroupId)) {
+            await this._triggerMlsEpochRecovery(groupKey, mlsGroupId);
+          }
+          this._mlsCommitFailCounts.delete(groupKey);
+        } catch (recoverErr) {
+          console.error(`[SecureChannel] MLS commit resync FAILED for ${label}:`, recoverErr);
+        }
+      }
       async _requestWelcomeSelfHeal(groupId) {
         const now = Date.now();
         const last = this._welcomeSelfHealInflight.get(groupId) ?? 0;
@@ -69126,9 +69175,43 @@ ${messageText}`;
                     const errMsg = addErr instanceof Error ? addErr.message : String(addErr);
                     if (errMsg.includes("already in the group")) {
                       console.log(`[SecureChannel] A2A member already in group \u2014 removing and re-adding ${req.requesting_device_id.slice(0, 8)}`);
+                      const preRemoveState = JSON.stringify(mlsGroup.exportState());
+                      let removeCommitPublished = false;
                       try {
                         const identityBytes = new TextEncoder().encode(req.requesting_device_id);
-                        await mlsGroup.removeMember(identityBytes);
+                        const leafIndex = mlsGroup.memberLeafIndex(identityBytes);
+                        if (leafIndex === null) {
+                          console.log(`[SecureChannel] A2A re-add: no leaf index for ${req.requesting_device_id.slice(0, 8)} \u2014 cannot remove`);
+                          continue;
+                        }
+                        const removeResult = await mlsGroup.removeMember(leafIndex);
+                        try {
+                          const removeResp = await fetch(
+                            `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
+                            {
+                              method: "POST",
+                              headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                              body: JSON.stringify({
+                                group_id: chState.mlsGroupId,
+                                device_id: this._deviceId,
+                                commit: Buffer.from(removeResult.commit).toString("hex"),
+                                commit_epoch: Number(mlsGroup.epoch)
+                              })
+                            }
+                          );
+                          if (removeResp.ok) {
+                            removeCommitPublished = true;
+                          } else {
+                            const detail = await removeResp.text().catch(() => "");
+                            console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
+                          }
+                        } catch (distErr) {
+                          console.warn(`[SecureChannel] A2A remove-commit distribute network error:`, distErr);
+                        }
+                        if (!removeCommitPublished) {
+                          mlsGroup.importState(JSON.parse(preRemoveState));
+                          continue;
+                        }
                         const kpRes2 = await fetch(
                           `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
                           { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
@@ -69152,6 +69235,12 @@ ${messageText}`;
                         }
                       } catch (readdErr) {
                         console.log(`[SecureChannel] A2A remove+re-add FAILED: ${readdErr instanceof Error ? readdErr.message : String(readdErr)}`);
+                        if (!removeCommitPublished) {
+                          try {
+                            mlsGroup.importState(JSON.parse(preRemoveState));
+                          } catch {
+                          }
+                        }
                         continue;
                       }
                     } else {
@@ -97055,7 +97144,7 @@ var init_index = __esm({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.10" : "0.0.0-dev";
+    VERSION = true ? "0.23.12" : "0.0.0-dev";
   }
 });
 await init_index();