@agentvault/claude-bridge 0.6.0 → 0.6.1

package/dist/index.js

@@ -65555,7 +65555,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.7" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.8" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67172,7 +67172,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.7" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.8" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67251,6 +67251,10 @@ var init_channel = __esm2({
               await this._handleDeviceRevoked();
               return;
             }
+            if (data.event === "connection_rejected") {
+              await this._handleConnectionRejected(data);
+              return;
+            }
             if (data.event === "device_linked") {
               await this._handleDeviceLinked(data.data);
               return;
@@ -67486,7 +67490,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.7" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.8" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -70678,6 +70682,37 @@ ${messageText}`;
        * re-enrollment, which SHOULD wipe creds, goes through setup --force /
        * _forceReEnroll in start().
        */
+      /**
+       * Handle a WS `connection_rejected` event.
+       *
+       * The server accepts the WS upgrade, then — for a device it will not serve —
+       * emits `{event:"connection_rejected", reason, retryable}` and closes with
+       * code 4403. `retryable:false` (e.g. `device_revoked`) is a TERMINAL
+       * credential failure: retrying can only reconnect, get rejected, and close
+       * again. Left unhandled, that generic close drove the reconnect classifier
+       * into "reconnect loop detected", which the bridge treats as a restartable
+       * exit — so launchd/systemd relaunched us every ~30s to hammer the backend
+       * with the same rejected handshake (empirically ~1150 rejects / 2h).
+       *
+       * So we route a non-retryable rejection to the SAME `auth_failed` surface the
+       * proactive/reactive reissue paths use (see channel.ts emit sites). The
+       * bridge wires `auth_failed` to a clean exit(0) (packages/claude-room-bridge
+       * /src/bridge.ts), so launchd stops relaunching. Mirrors those emitters:
+       * emit only + mark the session; the consumer decides how to stop. A
+       * `retryable` rejection is transient — fall through to a normal reconnect.
+       */
+      async _handleConnectionRejected(data) {
+        if (data?.retryable === true) {
+          this._scheduleReconnect();
+          return;
+        }
+        this._authFailedThisSession = true;
+        const authReason = data?.reason === "device_jwt_expired" ? "device_jwt_expired" : "device_revoked";
+        console.warn(
+          `[SecureChannel] connection_rejected (reason=${data?.reason ?? "unknown"}, retryable=false) \u2014 terminal; surfacing auth_failed`
+        );
+        this.emit("auth_failed", { reason: authReason });
+      }
       async _handleDeviceRevoked() {
         const now = Date.now();
         this._revokeRecoveries = this._revokeRecoveries.filter(
@@ -97233,7 +97268,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.7" : "0.0.0-dev";
+    VERSION = true ? "0.23.8" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -133246,7 +133281,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.6.0" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.6.1" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",