@agentvault/agentvault 0.23.30 → 0.23.31

package/dist/doctor.d.ts

@@ -36,6 +36,31 @@ export declare function checkPluginsAllow(config: any): CheckResult;
 export declare function checkPlist(): CheckResult;
 export declare function checkGatewayPort(): CheckResult;
 export declare function checkAgentDataDirs(config: any): CheckResult;
+/**
+ * State the key-material exposure plainly (#622).
+ *
+ * An agent with Work on runs as the SAME UID as the bridge, so it can read
+ * `agentvault.json` and every `mls-*.json` in its data dir — MLS group state
+ * including private keys. Measured on a live agent 2026-08-14, permission
+ * hygiene is already correct (700 on the directories, 600 on the files), which
+ * is exactly why no file mode addresses this and why encrypting those files
+ * under the device secret would be theatre: the secret sits in the same
+ * directory under the same uid.
+ *
+ * DECIDED 2026-08-31 (Chris): an agent with Work on is a TRUSTED principal, and
+ * the answer is cheap rotation rather than prevention. That is already what the
+ * product says — "keys are generated locally and never leave this machine",
+ * "only you and your agent hold the keys" — both true, with the agent holding
+ * the keys being the design. Unlike #547 there is no overstated claim here;
+ * what was missing was anywhere that told an OPERATOR so.
+ *
+ * ⚠️ Accepted-and-working reports `pass`, never a standing `warn`. A warning
+ * that is always on is noise, and noise is how a real signal gets ignored. The
+ * check earns its place by being able to genuinely fail: the decision assumes
+ * 600/700, and if that is not true then the reasoning behind accepting the
+ * exposure does not hold either.
+ */
+export declare function checkKeyMaterialExposure(config: any): CheckResult;
 export declare function checkPm2Status(): CheckResult;
 export declare function plistPath(): string;
 export declare function parsePlist(plistFile: string): PlistInfo | null;

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiCH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAKD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAQpD;AAID,wBAAgB,sBAAsB,IAAI,WAAW,CAYpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAmB3D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,GAAG,WAAW,CAgB/D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,GAAG,WAAW,CAoB1D;AAED,wBAAgB,UAAU,IAAI,WAAW,CAyBxC;AAED,wBAAgB,gBAAgB,IAAI,WAAW,CAW9C;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,GAAG,GAAG,WAAW,CAsC3D;AAED,wBAAgB,cAAc,IAAI,WAAW,CAoB5C;AAID,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CA2B9D;AAED,wBAAgB,aAAa,IAAI,qBAAqB,CA2BrD;AAID,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAsEtD;AAID,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwIjF"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiCH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAKD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAQpD;AAID,wBAAgB,sBAAsB,IAAI,WAAW,CAYpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAmB3D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,GAAG,WAAW,CAgB/D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,GAAG,WAAW,CAoB1D;AAED,wBAAgB,UAAU,IAAI,WAAW,CAyBxC;AAED,wBAAgB,gBAAgB,IAAI,WAAW,CAW9C;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,GAAG,GAAG,WAAW,CAsC3D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,GAAG,GAAG,WAAW,CAuDjE;AAmBD,wBAAgB,cAAc,IAAI,WAAW,CAoB5C;AAID,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CA2B9D;AAED,wBAAgB,aAAa,IAAI,qBAAqB,CA2BrD;AAID,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAsEtD;AAID,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IjF"}

package/dist/index.js

@@ -63250,11 +63250,11 @@ var init_mls_kp_pool = __esm({
 
 // src/client-version.ts
 function ownIdentity() {
-  const v2 = true ? "0.23.30" : FALLBACK;
+  const v2 = true ? "0.23.31" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "1fff5d6" : "";
+  const raw = true ? "3e1243a-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -65016,6 +65016,118 @@ var init_channel = __esm({
        * Encrypt and send a message to ALL owner devices (fanout).
        * Each session gets the same plaintext encrypted independently.
        */
+      /**
+       * #952 — sends held because MLS is expected for this conversation but the
+       * group is not joined yet.
+       *
+       * ⚠️ IN MEMORY ONLY. These entries hold PLAINTEXT. `_persisted` is written to
+       * disk, and the product's entire premise is that plaintext does not rest
+       * where it does not have to; a crash losing a held greeting is the correct
+       * trade. This is why the existing `outboundQueue` could not be reused — that
+       * one is persisted, and holds already-DR-encrypted bytes, which is exactly
+       * the encryption we are trying not to perform yet.
+       */
+      _mlsHold = /* @__PURE__ */ new Map();
+      /** How long a send waits for the Welcome. The two measured bursts were each
+       *  confined to a single minute, with the group already existing server-side
+       *  in the same second, so this is generous rather than tight. */
+      static MLS_HOLD_MS = 3e4;
+      /** Bound on held sends per group — see `_holdForMls`. */
+      static MLS_HOLD_MAX = 50;
+      /**
+       * Should this 1:1 send wait for MLS rather than go out over Double Ratchet?
+       *
+       * The discriminator exists at the moment of the bug: `_sessionGroupIds`
+       * already carries the conversation's group id — the server told us the group
+       * exists — while `_mlsGroups` has no usable manager for it. Group expected,
+       * group not ready.
+       *
+       * The negative case is load-bearing. A conversation with NO group id is
+       * legitimately Double Ratchet, and holding it would break owner-to-agent
+       * messaging outright, which is far worse than the bug this fixes. "Present"
+       * is also not "ready": a manager parked at epoch 0 has not joined (#1092),
+       * and reading presence as readiness is how #991 shipped.
+       */
+      _shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId) {
+        if (!convGroupId) return false;
+        const ready = Boolean(mlsGroup?.isInitialized) && Boolean(mlsGroupId) && Number(mlsGroup?.epoch) > 0;
+        return !ready;
+      }
+      /** Park a send until the Welcome lands, or until the hold expires. */
+      _holdForMls(convGroupId, convId, plaintext, options) {
+        let entry = this._mlsHold.get(convGroupId);
+        if (!entry) {
+          const timer = setTimeout(() => {
+            void this._releaseHeldOverDr(convGroupId);
+          }, _SecureChannel.MLS_HOLD_MS);
+          timer.unref?.();
+          entry = { items: [], timer };
+          this._mlsHold.set(convGroupId, entry);
+        }
+        if (entry.items.length >= _SecureChannel.MLS_HOLD_MAX) {
+          entry.items.shift();
+          console.warn(
+            `[SecureChannel] MLS hold full for group ${convGroupId.slice(0, 8)} \u2014 dropped the oldest held message`
+          );
+        }
+        entry.items.push({ convId, plaintext, options });
+        console.log(
+          `[SecureChannel] Holding send for group ${convGroupId.slice(0, 8)} until its Welcome lands (held=${entry.items.length})`
+        );
+      }
+      _takeHold(convGroupId) {
+        const entry = this._mlsHold.get(convGroupId);
+        if (!entry) return null;
+        clearTimeout(entry.timer);
+        this._mlsHold.delete(convGroupId);
+        return entry;
+      }
+      /** Re-drive one held send through the normal path, now that MLS is ready. */
+      async _resendHeld(item) {
+        await this.send(item.plaintext, {
+          ...item.options ?? {},
+          conversationId: item.convId,
+          bypassMlsHold: true
+        });
+      }
+      /** The Welcome landed — release everything held for this group, in order. */
+      async _flushMlsHold(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.log(
+          `[SecureChannel] Welcome landed for group ${convGroupId.slice(0, 8)} \u2014 releasing ${entry.items.length} held message(s) over MLS`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed to send after Welcome:", err);
+          }
+        }
+      }
+      /**
+       * The hold expired. Send over Double Ratchet exactly as before.
+       *
+       * This is deliberately NOT a drop. #853 and #831 are Welcomes that never
+       * arrive; under those an unbounded hold turns a lost minute into an agent
+       * that never speaks again. The hold removes the race — it must not invent a
+       * new failure mode. The warning is the part that is new: today the loss is
+       * silent.
+       */
+      async _releaseHeldOverDr(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.warn(
+          `[SecureChannel] No Welcome for group ${convGroupId.slice(0, 8)} within ${_SecureChannel.MLS_HOLD_MS}ms \u2014 releasing ${entry.items.length} message(s) over Double Ratchet. The recipient may not hold a ratchet with this device, in which case they are undeliverable (#952).`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed on Double Ratchet release:", err);
+          }
+        }
+      }
       async send(plaintext, options) {
         if (isAbstention(plaintext)) return;
         if (this._state === "error" || this._state === "idle") {
@@ -65177,6 +65289,10 @@ var init_channel = __esm({
               );
               addressedMlsGroupIds.push(mlsGroupId);
               if (convGroupId) sentSharedGroupIds.add(convGroupId);
+            } else if (!options?.bypassMlsHold && this._shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId)) {
+              this._holdForMls(convGroupId, convId, plaintext, options);
+              sentCount++;
+              continue;
             } else {
               const encrypted = session.ratchet.encrypt(plaintext);
               const transport = encryptedMessageToTransport(encrypted);
@@ -65346,7 +65462,7 @@ var init_channel = __esm({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.30" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.31" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67284,7 +67400,7 @@ var init_channel = __esm({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.31" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67608,7 +67724,7 @@ var init_channel = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.31" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68024,11 +68140,13 @@ var init_channel = __esm({
           let text = plaintext;
           let messageType = "text";
           let topicId = data.topic_id;
+          let mlsAttachment = null;
           try {
             const parsed = JSON.parse(plaintext);
             text = parsed.text ?? plaintext;
             messageType = parsed.type ?? "text";
             topicId = parsed.topicId ?? topicId;
+            if (parsed.attachment) mlsAttachment = parsed.attachment;
           } catch {
           }
           if (messageType === "history_catchup_request") {
@@ -68095,6 +68213,9 @@ var init_channel = __esm({
               console.log(`[SecureChannel] Session ${convId.slice(0, 8)} activated via MLS message`);
             }
           }
+          if (mlsAttachment) {
+            text = await this._augmentWithAttachment(mlsAttachment, text);
+          }
           const metadata = {
             messageId: data.message_id ?? `mls_${Date.now()}`,
             conversationId: convId ?? this._primaryConversationId,
@@ -68344,6 +68465,65 @@ ${messageText}`;
        * Download an encrypted attachment blob, decrypt it, verify integrity,
        * and save the plaintext file to disk.
        */
+      /** Where an attachment may be written — always directly inside `attachDir` (#1143).
+       *
+       * The filename arrives INSIDE the envelope and is chosen by whoever sent the
+       * message. `join(attachDir, info.filename)` resolves `..` normally, so
+       * `../../agentvault.json` wrote over the device credential store. Only the
+       * final path component is honoured, and anything that is not a usable name
+       * falls back to a fixed one.
+       */
+      _safeAttachmentPath(attachDir, filename) {
+        const raw = String(filename ?? "");
+        const last = raw.split(/[\\/]/).pop() ?? "";
+        const cleaned = last.replace(/\0/g, "").trim();
+        const safe = cleaned === "" || cleaned === "." || cleaned === ".." ? "attachment.bin" : cleaned;
+        return join4(attachDir, safe);
+      }
+      /** Download an attachment and fold it into the text the agent sees (#1139).
+       *
+       * Extracted so the MLS receive path can use it too. It used to live inline in
+       * `_handleIncomingMessage`, which meant attachments worked on the Double
+       * Ratchet path ONLY — and hermes drops DR by design (`secure_channel.py:594`,
+       * "DR fallback is logged-and-dropped"), so no single transport could serve
+       * both client families. That is why an attachment reached ohtani and never
+       * reached smartcoder2 on 2026-08-31.
+       *
+       * Returns the text unchanged when there is no attachment or the fetch fails —
+       * but a failure is LOGGED and announced in the text, never silent.
+       */
+      async _augmentWithAttachment(attachmentInfo, baseText) {
+        if (!attachmentInfo) return baseText;
+        try {
+          const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
+          const mime = String(attachmentInfo.mime ?? "application/octet-stream");
+          const name = String(attachmentInfo.filename ?? "attachment");
+          const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
+          if (textMimes.some((m2) => mime.startsWith(m2))) {
+            const content = new TextDecoder().decode(decrypted);
+            return `[Attachment: ${name} (${mime}) saved to ${filePath}]
+---
+${content}
+---
+
+${baseText}`;
+          }
+          if (mime.startsWith("image/")) {
+            return `[Image attachment: ${name} saved to ${filePath}]
+Use your Read tool to view this image file.
+
+${baseText}`;
+          }
+          return `[Attachment: ${name} saved to ${filePath}]
+
+${baseText}`;
+        } catch (err) {
+          console.error("[SecureChannel] Failed to download attachment:", err);
+          return `[Attachment: ${String(attachmentInfo.filename ?? "file")} was sent but could not be retrieved: ${err}]
+
+${baseText}`;
+        }
+      }
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
         await mkdir3(attachDir, { recursive: true });
@@ -68363,7 +68543,7 @@ ${messageText}`;
         const fileKey = base64ToBytes(info.fileKey);
         const fileNonce = base64ToBytes(info.fileNonce);
         const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
-        const filePath = join4(attachDir, info.filename);
+        const filePath = this._safeAttachmentPath(attachDir, info.filename);
         await writeFile3(filePath, decrypted);
         console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
         return { filePath, decrypted };
@@ -69784,6 +69964,7 @@ ${messageText}`;
               await this._persistState();
             }
             console.log(`[SecureChannel] Joined shared 1:1 MLS group for group ${conversationGroupId.slice(0, 8)} via Welcome (epoch=${mgr.epoch})`);
+            await this._flushMlsHold(conversationGroupId);
             return;
           }
           if (conversationId) {
@@ -98347,7 +98528,7 @@ var init_index = __esm({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.30" : "0.0.0-dev";
+    VERSION = true ? "0.23.31" : "0.0.0-dev";
   }
 });
 await init_index();