@agentvault/agentvault 0.23.33 → 0.23.35

package/dist/index.js

@@ -50505,11 +50505,6 @@ var init_clientConfig = __esm({
 });
 
 // ../crypto/node_modules/ts-mls/dist/src/util/array.js
-function arraysEqual(a2, b2) {
-  if (a2.length !== b2.length)
-    return false;
-  return a2.every((val, index) => val === b2[index]);
-}
 var init_array = __esm({
   "../crypto/node_modules/ts-mls/dist/src/util/array.js"() {
   }
@@ -50698,7 +50693,7 @@ async function validateRatchetTree(tree, groupContext, config2, authService, tre
           if (dpNode !== void 0) {
             if (dpNode.nodeType !== "parent")
               return new InternalError("Expected parent node");
-            if (!arraysEqual(dpNode.parent.unmergedLeaves, n2.parent.unmergedLeaves))
+            if (!dpNode.parent.unmergedLeaves.includes(unmergedLeaf))
               return new ValidationError("non-blank intermediate node must list leaf node in its unmerged_leaves");
           }
         }
@@ -63266,11 +63261,11 @@ var init_mls_kp_pool = __esm({
 
 // src/client-version.ts
 function ownIdentity() {
-  const v2 = true ? "0.23.33" : FALLBACK;
+  const v2 = true ? "0.23.35" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "7b91f2f-dirty" : "";
+  const raw = true ? "0160bbb-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -65481,7 +65476,7 @@ var init_channel = __esm({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.33" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.35" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67419,7 +67414,7 @@ var init_channel = __esm({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.33" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.35" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67743,7 +67738,7 @@ var init_channel = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.33" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.35" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68147,6 +68142,7 @@ var init_channel = __esm({
         try {
           const cipherBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
           const result = await mgr.decrypt(cipherBytes);
+          if (mgrKey) this._mlsDecryptFailCounts.delete(mgrKey);
           const mlsGroupId = (convGroupId ? this._persisted?.mlsGroups?.[convGroupId]?.mlsGroupId : null) ?? this._persisted?.mlsConversations?.[convId]?.mlsGroupId ?? groupId;
           if (mlsGroupId) {
             await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
@@ -68251,6 +68247,10 @@ var init_channel = __esm({
             this.config.onMessage(text, metadata);
           }
         } catch (decryptErr) {
+          if (classifyCommitFailure(data.epoch, mgr?.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS 1:1 message at epoch ${String(data.epoch)} predates our epoch ${String(mgr?.epoch)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = mgrKey || `unknown:${groupId}`;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -69092,6 +69092,7 @@ ${baseText}`;
         try {
           const ciphertext = Buffer.from(data.payload, "hex");
           const result = await mlsGroup.decrypt(new Uint8Array(ciphertext));
+          this._mlsDecryptFailCounts.delete(resolvedRoomId);
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
           if (result.isHandshake || !result.plaintext) {
             return;
@@ -69181,6 +69182,10 @@ ${baseText}`;
             console.error("[SecureChannel] onMessage callback error (MLS):", err);
           });
         } catch (err) {
+          if (classifyCommitFailure(data.epoch, mlsGroup.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS room message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup.epoch)} for ${resolvedRoomId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = resolvedRoomId;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -70220,6 +70225,11 @@ ${baseText}`;
                 nackedIds.push(msg.queue_id);
                 if (msg.group_id && (msg.message_type === "commit" || msg.message_type === "application")) {
                   const failKey = msg.conversation_group_id ? `1to1-group:${msg.conversation_group_id}` : `group:${msg.group_id}`;
+                  const localMgr = msg.room_id && this._mlsGroups.get(msg.room_id) || this._mlsGroups.get(failKey);
+                  if (classifyCommitFailure(msg.epoch, localMgr?.epoch) === "already-applied") {
+                    console.debug(`[SecureChannel] Delivery ${msg.message_type} at epoch ${String(msg.epoch)} predates our epoch ${String(localMgr?.epoch)} \u2014 not counting toward recovery`);
+                    continue;
+                  }
                   const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
                   this._mlsDecryptFailCounts.set(failKey, count);
                   if (count >= _SecureChannel.MAX_MLS_DECRYPT_FAILS) {
@@ -70897,6 +70907,7 @@ ${baseText}`;
         try {
           const ciphertext = new Uint8Array(Buffer.from(data.payload, "hex"));
           const result = await mlsGroup.decrypt(ciphertext);
+          this._mlsDecryptFailCounts.delete(`a2a:${a2aChannelId}`);
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
           if (result.isHandshake || !result.plaintext) {
             return;
@@ -70917,6 +70928,10 @@ ${baseText}`;
             this.config.onA2AMessage(a2aMsg);
           }
         } catch (err) {
+          if (classifyCommitFailure(data.epoch, mlsGroup?.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS A2A message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup?.epoch)} for ${a2aChannelId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = `a2a:${a2aChannelId}`;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -98585,7 +98600,7 @@ var init_index = __esm({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.33" : "0.0.0-dev";
+    VERSION = true ? "0.23.35" : "0.0.0-dev";
   }
 });
 await init_index();