@agentvault/agentvault 0.23.22 → 0.23.24

package/dist/index.js

@@ -31,6 +31,27 @@ var __toESM = (mod4, isNodeMode, target) => (target = mod4 != null ? __create(__
   mod4
 ));
 
+// src/mls-commit-classify.ts
+function toEpoch(v2) {
+  if (typeof v2 === "bigint") return v2;
+  if (typeof v2 === "number") {
+    return Number.isFinite(v2) ? BigInt(Math.trunc(v2)) : null;
+  }
+  if (typeof v2 === "string" && /^\d+$/.test(v2)) return BigInt(v2);
+  return null;
+}
+function classifyCommitFailure(messageEpoch, groupEpoch) {
+  const msg = toEpoch(messageEpoch);
+  const grp = toEpoch(groupEpoch);
+  if (msg === null || grp === null) return "count";
+  return msg < grp ? "already-applied" : "count";
+}
+var init_mls_commit_classify = __esm({
+  "src/mls-commit-classify.ts"() {
+    "use strict";
+  }
+});
+
 // ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
 var __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default;
 var init_libsodium_sumo = __esm({
@@ -63078,7 +63099,7 @@ var init_mls_kp_pool = __esm({
 
 // src/client-version.ts
 function ownIdentity() {
-  const v2 = true ? "0.23.22" : FALLBACK;
+  const v2 = true ? "0.23.24" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildClientVersion(override) {
@@ -64004,6 +64025,7 @@ var ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTE
 var init_channel = __esm({
   async "src/channel.ts"() {
     "use strict";
+    init_mls_commit_classify();
     await init_libsodium_wrappers();
     await init_dist();
     await init_dist();
@@ -65070,7 +65092,7 @@ var init_channel = __esm({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.22" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.24" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -65535,7 +65557,7 @@ var init_channel = __esm({
         this._persisted.groupId = primary.group_id;
         this._persisted.primaryConversationId = primary.id;
         const liveGroupIds = new Set(mine.map((r2) => r2.group_id));
-        if (!liveGroupIds.has(staleGid)) {
+        if (staleGid && staleMlsGroupId && !liveGroupIds.has(staleGid)) {
           try {
             await deleteMlsState(this.config.dataDir, staleMlsGroupId);
           } catch {
@@ -65549,9 +65571,9 @@ var init_channel = __esm({
         }
         await this._persistState();
         console.log(
-          `[SecureChannel] Re-resolved conversation groups after 'unknown group' ${staleMlsGroupId.slice(0, 8)}: primary group ${String(before).slice(0, 8)} \u2192 ${this._persisted.groupId.slice(0, 8)} (${mine.length} active conversation(s))`
+          `[SecureChannel] Re-resolved conversation groups ${staleMlsGroupId ? `after 'unknown group' ${staleMlsGroupId.slice(0, 8)}` : "on connect (#1034)"}: primary group ${String(before).slice(0, 8)} \u2192 ${this._persisted.groupId.slice(0, 8)} (${mine.length} active conversation(s))`
         );
-        return this._persisted.groupId !== before && before === staleGid;
+        return staleGid !== void 0 && this._persisted.groupId !== before && before === staleGid;
       }
       /**
        * Resend the message that a now-reconciled `unknown group` refusal killed (#732).
@@ -66953,6 +66975,9 @@ var init_channel = __esm({
             await this._pullDrDeliveryQueue();
             await this._flushOutboundQueue();
             this._setState("ready");
+            void this._reconcileConversationGroups().catch((err) => {
+              console.warn("[SecureChannel] Conversation-group reconcile failed:", err);
+            });
             void this._reconcileRoomsWithServer().catch(
               (err) => console.warn(`[SecureChannel] room reconcile failed (ignored): ${err instanceof Error ? err.message : String(err)}`)
             ).then(() => this._quarantineOrphanedMlsGroups()).catch(
@@ -66980,7 +67005,7 @@ var init_channel = __esm({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.22" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.24" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67304,7 +67329,7 @@ var init_channel = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.22" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.24" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68710,7 +68735,14 @@ ${messageText}`;
                 console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                 this._mlsCommitFailCounts.delete(roomId);
               } catch (err) {
-                await this._onCommitFailure(roomId, groupId, err, `room ${roomId.slice(0, 8)}`);
+                await this._onCommitFailure(
+                  roomId,
+                  groupId,
+                  err,
+                  `room ${roomId.slice(0, 8)}`,
+                  data.epoch,
+                  mlsGroup.epoch
+                );
               }
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
@@ -68730,7 +68762,14 @@ ${messageText}`;
                 console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                 this._mlsCommitFailCounts.delete(`a2a:${chId}`);
               } catch (err) {
-                await this._onCommitFailure(`a2a:${chId}`, groupId, err, `A2A ${chId.slice(0, 8)}`);
+                await this._onCommitFailure(
+                  `a2a:${chId}`,
+                  groupId,
+                  err,
+                  `A2A ${chId.slice(0, 8)}`,
+                  data.epoch,
+                  mlsGroup.epoch
+                );
               }
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
@@ -68816,7 +68855,13 @@ ${messageText}`;
        * Never re-throws. The caller's only handler logs and drops, so throwing here
        * is indistinguishable from swallowing — it just moves the swallow one frame up.
        */
-      async _onCommitFailure(groupKey, mlsGroupId, err, label) {
+      async _onCommitFailure(groupKey, mlsGroupId, err, label, messageEpoch, groupEpoch) {
+        if (classifyCommitFailure(messageEpoch, groupEpoch) === "already-applied") {
+          console.debug(
+            `[SecureChannel] Skipping already-applied MLS commit for ${label} (commit epoch ${String(messageEpoch)} is behind group epoch ${String(groupEpoch)})`
+          );
+          return;
+        }
         const count = (this._mlsCommitFailCounts.get(groupKey) ?? 0) + 1;
         this._mlsCommitFailCounts.set(groupKey, count);
         console.error(
@@ -69164,7 +69209,8 @@ ${messageText}`;
           const candidateCount = candidates.filter(Boolean).length;
           const joined = await joinWithFirstMatchingKp(welcomeBytes, candidates);
           if (!joined) {
-            console.error(`[SecureChannel] No matching KeyPackage found for Welcome \u2014 cannot join group ${groupId?.slice(0, 8)}. The Welcome is encrypted to a published KP's public key; none of our ${candidateCount} candidate bundle(s) decrypted it. The existing Welcome recovery mechanism will re-request.`);
+            console.error(`[SecureChannel] No matching KeyPackage found for Welcome \u2014 cannot join group ${groupId?.slice(0, 8)}. The Welcome is encrypted to a published KP's public key; none of our ${candidateCount} candidate bundle(s) decrypted it. Requesting a re-Welcome with a fresh KeyPackage.`);
+            if (groupId) void this._requestWelcomeSelfHeal(groupId);
             return;
           }
           const mgr = joined.mgr;
@@ -70713,7 +70759,7 @@ ${messageText}`;
           return;
         }
         this._authFailedThisSession = true;
-        const authReason = data?.reason ?? "device_revoked";
+        const authReason = data?.reason ?? "unknown";
         console.warn(
           `[SecureChannel] connection_rejected (reason=${data?.reason ?? "unknown"}, retryable=false) \u2014 terminal; surfacing auth_failed`
         );
@@ -97734,7 +97780,7 @@ var init_index = __esm({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.22" : "0.0.0-dev";
+    VERSION = true ? "0.23.24" : "0.0.0-dev";
   }
 });
 await init_index();