@agentvault/agentvault 0.23.32 → 0.23.34

package/dist/index.js

@@ -63266,11 +63266,11 @@ var init_mls_kp_pool = __esm({
 
 // src/client-version.ts
 function ownIdentity() {
-  const v2 = true ? "0.23.32" : FALLBACK;
+  const v2 = true ? "0.23.34" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "9d4a053-dirty" : "";
+  const raw = true ? "6b305ca-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -64199,7 +64199,7 @@ function _isSelfHubAddress(ownHubAddress, target) {
   const tgt = (target ?? "").trim().toLowerCase();
   return own.length > 0 && own === tgt;
 }
-var ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTERVAL_MS, RECONNECT_BASE_MS, RECONNECT_MAX_MS, PENDING_POLL_INTERVAL_MS, OUTBOUND_DEDUPE_WINDOW_MS, OUTBOUND_DEDUPE_MAX_SUPPRESS_MS, OUTBOUND_DEDUPE_MAX, OUTBOUND_DEDUPE_TYPES, RETRY_CANDIDATE_TTL_MS, RETRY_CANDIDATE_MAX, SecureChannel;
+var ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTERVAL_MS, RECONNECT_BASE_MS, RECONNECT_MAX_MS, PENDING_POLL_INTERVAL_MS, OUTBOUND_DEDUPE_WINDOW_MS, OUTBOUND_DEDUPE_MAX_SUPPRESS_MS, OUTBOUND_DEDUPE_MAX, OUTBOUND_DEDUPE_TYPES, RETRY_CANDIDATE_TTL_MS, RETRY_CANDIDATE_MAX, ROOM_FULFIL_COOLDOWN_MS, SecureChannel;
 var init_channel = __esm({
   async "src/channel.ts"() {
     "use strict";
@@ -64244,6 +64244,7 @@ var init_channel = __esm({
     OUTBOUND_DEDUPE_TYPES = /* @__PURE__ */ new Set(["text", "status_alert", "artifact", "attachment"]);
     RETRY_CANDIDATE_TTL_MS = 6e4;
     RETRY_CANDIDATE_MAX = 32;
+    ROOM_FULFIL_COOLDOWN_MS = 6e4;
     SecureChannel = class _SecureChannel extends EventEmitter {
       constructor(config2) {
         super();
@@ -64313,6 +64314,8 @@ var init_channel = __esm({
       _drDeliveryPulling = false;
       /** MLS group managers per room/conversation (roomId or conv:conversationId or 1to1-group:groupId -> MLSGroupManager) */
       _mlsGroups = /* @__PURE__ */ new Map();
+      /** `${mlsGroupId}:${deviceId}` -> last re-admit ms (#1171). */
+      _roomFulfilCooldown = /* @__PURE__ */ new Map();
       /** Maps conversationId -> conversation_group_id for shared 1:1 MLS groups */
       _sessionGroupIds = /* @__PURE__ */ new Map();
       /** Consecutive MLS decrypt failure count per group key for epoch recovery. */
@@ -65478,7 +65481,7 @@ var init_channel = __esm({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.32" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.34" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67416,7 +67419,7 @@ var init_channel = __esm({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.32" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.34" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67740,7 +67743,7 @@ var init_channel = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.32" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.34" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68144,6 +68147,7 @@ var init_channel = __esm({
         try {
           const cipherBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
           const result = await mgr.decrypt(cipherBytes);
+          if (mgrKey) this._mlsDecryptFailCounts.delete(mgrKey);
           const mlsGroupId = (convGroupId ? this._persisted?.mlsGroups?.[convGroupId]?.mlsGroupId : null) ?? this._persisted?.mlsConversations?.[convId]?.mlsGroupId ?? groupId;
           if (mlsGroupId) {
             await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
@@ -68248,6 +68252,10 @@ var init_channel = __esm({
             this.config.onMessage(text, metadata);
           }
         } catch (decryptErr) {
+          if (classifyCommitFailure(data.epoch, mgr?.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS 1:1 message at epoch ${String(data.epoch)} predates our epoch ${String(mgr?.epoch)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = mgrKey || `unknown:${groupId}`;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -69089,6 +69097,7 @@ ${baseText}`;
         try {
           const ciphertext = Buffer.from(data.payload, "hex");
           const result = await mlsGroup.decrypt(new Uint8Array(ciphertext));
+          this._mlsDecryptFailCounts.delete(resolvedRoomId);
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
           if (result.isHandshake || !result.plaintext) {
             return;
@@ -69178,6 +69187,10 @@ ${baseText}`;
             console.error("[SecureChannel] onMessage callback error (MLS):", err);
           });
         } catch (err) {
+          if (classifyCommitFailure(data.epoch, mlsGroup.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS room message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup.epoch)} for ${resolvedRoomId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = resolvedRoomId;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -69429,13 +69442,7 @@ ${baseText}`;
         console.warn(`[SecureChannel] MLS epoch recovery for ${groupKey} (${mlsGroupId.slice(0, 8)})`);
         this._mlsGroups.delete(groupKey);
         this._mlsDecryptFailCounts.delete(groupKey);
-        try {
-          const { unlink: unlink2 } = await import("fs/promises");
-          const path = `${this.config.dataDir}/.mls-state/${mlsGroupId}.json`;
-          await unlink2(path).catch(() => {
-          });
-        } catch {
-        }
+        await deleteMlsState(this.config.dataDir, mlsGroupId);
         try {
           const mgr = new MLSGroupManager();
           const identity = new TextEncoder().encode(this._deviceId);
@@ -69510,19 +69517,26 @@ ${baseText}`;
           return 0;
         }
         const snapshot = mlsGroup.exportState();
-        const { commit, welcome } = await mlsGroup.addMembers(targets.map((t2) => t2.keyPackage));
-        const commitSent = await this._sendFrameConfirmed(
-          {
-            event: "mls_commit",
-            data: {
-              group_id: mlsGroupId,
-              epoch: Number(mlsGroup.epoch),
-              payload: Buffer.from(commit).toString("hex")
-            }
-          },
-          `${label} commit`
-        );
-        if (!commitSent) {
+        const { commits, welcome } = await mlsGroup.reAdmitMembers(targets.map((t2) => t2.keyPackage));
+        let sentCommits = 0;
+        for (const c2 of commits) {
+          const ok = await this._sendFrameConfirmed(
+            {
+              event: "mls_commit",
+              data: {
+                group_id: mlsGroupId,
+                // The epoch this commit PRODUCED. After two commits the manager
+                // only knows the last one, which is why the result carries them.
+                epoch: Number(c2.epoch),
+                payload: Buffer.from(c2.commit).toString("hex")
+              }
+            },
+            `${label} commit ${sentCommits + 1}/${commits.length}`
+          );
+          if (!ok) break;
+          sentCommits++;
+        }
+        if (sentCommits === 0) {
           mlsGroup.importState(snapshot);
           console.warn(
             `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
@@ -69530,6 +69544,12 @@ ${baseText}`;
           return 0;
         }
         await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+        if (sentCommits < commits.length) {
+          console.warn(
+            `[SecureChannel] ${label}: only ${sentCommits}/${commits.length} commits reached the wire \u2014 requests stay PENDING for the next pull`
+          );
+          return 0;
+        }
         if (!welcome) {
           console.warn(
             `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
@@ -70210,6 +70230,11 @@ ${baseText}`;
                 nackedIds.push(msg.queue_id);
                 if (msg.group_id && (msg.message_type === "commit" || msg.message_type === "application")) {
                   const failKey = msg.conversation_group_id ? `1to1-group:${msg.conversation_group_id}` : `group:${msg.group_id}`;
+                  const localMgr = msg.room_id && this._mlsGroups.get(msg.room_id) || this._mlsGroups.get(failKey);
+                  if (classifyCommitFailure(msg.epoch, localMgr?.epoch) === "already-applied") {
+                    console.debug(`[SecureChannel] Delivery ${msg.message_type} at epoch ${String(msg.epoch)} predates our epoch ${String(localMgr?.epoch)} \u2014 not counting toward recovery`);
+                    continue;
+                  }
                   const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
                   this._mlsDecryptFailCounts.set(failKey, count);
                   if (count >= _SecureChannel.MAX_MLS_DECRYPT_FAILS) {
@@ -70258,38 +70283,63 @@ ${baseText}`;
                 { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
               );
               if (!pendingRes.ok) continue;
-              const pending = await pendingRes.json();
+              let pending = await pendingRes.json();
               if (pending.length === 0) continue;
               console.log(`[SecureChannel] ${pending.length} pending Welcome requests for room ${roomId.slice(0, 8)}`);
+              const nowMs = Date.now();
+              const fresh = pending.filter((r2) => {
+                const key = `${roomState.mlsGroupId}:${r2.requesting_device_id}`;
+                const last = this._roomFulfilCooldown.get(key) ?? 0;
+                if (nowMs - last < ROOM_FULFIL_COOLDOWN_MS) {
+                  console.log(
+                    `[SecureChannel] skipping ${r2.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)} \u2014 re-admitted ${Math.round((nowMs - last) / 1e3)}s ago`
+                  );
+                  return false;
+                }
+                return true;
+              });
+              if (fresh.length === 0) continue;
+              for (const r2 of fresh) {
+                this._roomFulfilCooldown.set(`${roomState.mlsGroupId}:${r2.requesting_device_id}`, nowMs);
+              }
+              pending = fresh;
+              const deviceIds = pending.map((r2) => r2.requesting_device_id);
+              const kpRes = await fetch(
+                `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${deviceIds.join(",")}`,
+                { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+              );
+              if (!kpRes.ok) continue;
+              const kpData = await kpRes.json();
+              const roomTargets = [];
               for (const req of pending) {
-                try {
-                  const kpRes = await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
-                    { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                const kpHex = kpData[req.requesting_device_id];
+                if (!kpHex) {
+                  console.warn(`[SecureChannel] No KeyPackage for ${req.requesting_device_id.slice(0, 8)}, skipping`);
+                  continue;
+                }
+                const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
+                roomTargets.push({
+                  requestId: req.id,
+                  deviceId: req.requesting_device_id,
+                  keyPackage: MLSGroupManager.deserializeKeyPackage(kpBytes)
+                });
+              }
+              if (roomTargets.length === 0) continue;
+              try {
+                const done = await this._fulfilWelcomeRequests({
+                  mlsGroup,
+                  mlsGroupId: roomState.mlsGroupId,
+                  label: `room ${roomId.slice(0, 8)}`,
+                  welcomeFields: { room_id: roomId },
+                  targets: roomTargets
+                });
+                if (done > 0) {
+                  console.log(
+                    `[SecureChannel] Batched Welcome for ${done}/${roomTargets.length} device(s) in room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`
                   );
-                  if (!kpRes.ok) continue;
-                  const kpData = await kpRes.json();
-                  const kpHex = kpData[req.requesting_device_id];
-                  if (!kpHex) continue;
-                  const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
-                  const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const done = await this._fulfilWelcomeRequests({
-                    mlsGroup,
-                    mlsGroupId: roomState.mlsGroupId,
-                    label: `room ${roomId.slice(0, 8)}`,
-                    welcomeFields: { room_id: roomId },
-                    targets: [{
-                      requestId: req.id,
-                      deviceId: req.requesting_device_id,
-                      keyPackage: memberKp
-                    }]
-                  });
-                  if (done > 0) {
-                    console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
-                  }
-                } catch (fulfillErr) {
-                  console.warn(`[SecureChannel] Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                 }
+              } catch (fulfillErr) {
+                console.warn(`[SecureChannel] Batched Welcome failed for room ${roomId.slice(0, 8)}:`, fulfillErr);
               }
             } catch {
             }
@@ -70862,6 +70912,7 @@ ${baseText}`;
         try {
           const ciphertext = new Uint8Array(Buffer.from(data.payload, "hex"));
           const result = await mlsGroup.decrypt(ciphertext);
+          this._mlsDecryptFailCounts.delete(`a2a:${a2aChannelId}`);
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
           if (result.isHandshake || !result.plaintext) {
             return;
@@ -70882,6 +70933,10 @@ ${baseText}`;
             this.config.onA2AMessage(a2aMsg);
           }
         } catch (err) {
+          if (classifyCommitFailure(data.epoch, mlsGroup?.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS A2A message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup?.epoch)} for ${a2aChannelId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = `a2a:${a2aChannelId}`;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -98550,7 +98605,7 @@ var init_index = __esm({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.32" : "0.0.0-dev";
+    VERSION = true ? "0.23.34" : "0.0.0-dev";
   }
 });
 await init_index();