@agentvault/agentvault 0.23.16 → 0.23.17

package/dist/index.js

@@ -64122,13 +64122,21 @@ var init_channel = __esm({
        * Non-fatal: a transient network error or 5xx keeps the current JWT and
        * relies on the next reconnect. Terminal failures (401/403) surface via
        * the `auth_failed` event so callers can prompt the user to recover.
+       *
+       * Returns TRUE when the credentials are terminally dead. #743: the caller
+       * MUST NOT go on to open a WebSocket in that case — the server has already
+       * told us this credential can never be served, and connecting anyway is what
+       * produced `ws_guard action=denylist` on repeat in prod (device 0e87ff50, a
+       * hard-deleted device, ~12/hour). The verdict is returned explicitly rather
+       * than read back off `_authFailedThisSession`, whose lifetime is reset per
+       * connect and is easy to get subtly wrong.
        */
       async _maybeReissueDeviceJwt() {
         const jwt2 = this._persisted?.deviceJwt ?? this._deviceJwt;
-        if (!jwt2) return;
+        if (!jwt2) return false;
         const exp = this._decodeJwtExp(jwt2);
         const nowSec = Math.floor(Date.now() / 1e3);
-        if (exp - nowSec >= 30 * 86400) return;
+        if (exp - nowSec >= 30 * 86400) return false;
         try {
           const resp = await fetch(`${this.config.apiUrl}/api/v1/auth/reissue`, {
             method: "POST",
@@ -64148,7 +64156,7 @@ var init_channel = __esm({
             } else {
               console.warn("[SecureChannel] reissue returned 200 but no device_jwt in response");
             }
-            return;
+            return false;
           }
           if (resp.status === 401 || resp.status === 403) {
             console.warn(`[SecureChannel] reissue rejected (${resp.status}); credentials need attention`);
@@ -64156,12 +64164,13 @@ var init_channel = __esm({
             const reason = resp.status === 401 ? "device_jwt_expired" : "device_revoked";
             await this._postAuthFailedToBackend(reason);
             this.emit("auth_failed", { reason });
-            return;
+            return true;
           }
           console.warn(`[SecureChannel] reissue ${resp.status}; keeping current jwt`);
         } catch (err) {
           console.warn("[SecureChannel] reissue network error; keeping current jwt:", err);
         }
+        return false;
       }
       /**
        * Wraps `fetch` for authenticated AV REST endpoints with reactive device-JWT
@@ -64893,7 +64902,7 @@ var init_channel = __esm({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.16" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.17" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -66711,7 +66720,13 @@ var init_channel = __esm({
           this._ws = null;
         }
         this._setState("connecting");
-        await this._maybeReissueDeviceJwt();
+        if (await this._maybeReissueDeviceJwt()) {
+          console.warn(
+            "[SecureChannel] credentials are terminally dead \u2014 aborting connect (no WS attempt)"
+          );
+          this._setState("error");
+          return;
+        }
         const wsUrl = this.config.apiUrl.replace(/^http/, "ws");
         const url2 = `${wsUrl}/api/v1/ws?token=${encodeURIComponent(this._deviceJwt)}&device_id=${this._deviceId}`;
         const ws = new WebSocket(url2);
@@ -66752,7 +66767,7 @@ var init_channel = __esm({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.16" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.17" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67075,7 +67090,7 @@ var init_channel = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.16" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.17" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68474,10 +68489,10 @@ ${messageText}`;
                 await mlsGroup.processCommit(commitBytes);
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
+                this._mlsCommitFailCounts.delete(roomId);
               } catch (err) {
                 await this._onCommitFailure(roomId, groupId, err, `room ${roomId.slice(0, 8)}`);
               }
-              this._mlsCommitFailCounts.delete(roomId);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -68494,10 +68509,10 @@ ${messageText}`;
                 await mlsGroup.processCommit(commitBytes);
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
+                this._mlsCommitFailCounts.delete(`a2a:${chId}`);
               } catch (err) {
                 await this._onCommitFailure(`a2a:${chId}`, groupId, err, `A2A ${chId.slice(0, 8)}`);
               }
-              this._mlsCommitFailCounts.delete(`a2a:${chId}`);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -70367,7 +70382,7 @@ ${messageText}`;
           return;
         }
         this._authFailedThisSession = true;
-        const authReason = data?.reason === "device_jwt_expired" ? "device_jwt_expired" : "device_revoked";
+        const authReason = data?.reason ?? "device_revoked";
         console.warn(
           `[SecureChannel] connection_rejected (reason=${data?.reason ?? "unknown"}, retryable=false) \u2014 terminal; surfacing auth_failed`
         );
@@ -97372,7 +97387,7 @@ var init_index = __esm({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.16" : "0.0.0-dev";
+    VERSION = true ? "0.23.17" : "0.0.0-dev";
   }
 });
 await init_index();