@agentvault/claude-bridge 0.6.2 → 0.6.4

package/dist/index.js

@@ -446,6 +446,10 @@ var init_subcommand = __esm({
   }
 });
 
+// src/index.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5 } from "node:fs";
+import { join as join10 } from "node:path";
+
 // ../plugin/dist/index.js
 import * as nc from "node:crypto";
 import { mkdir, readFile, writeFile, rm } from "node:fs/promises";
@@ -65555,7 +65559,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.8" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.10" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -65796,10 +65800,120 @@ var init_channel = __esm2({
           this._sessions.delete(convId);
           delete this._persisted.sessions[convId];
         }
+        if (room.mlsGroupId) {
+          try {
+            await deleteMlsState(this.config.dataDir, room.mlsGroupId);
+          } catch {
+          }
+        }
+        this._mlsGroups.delete(roomId);
         delete this._persisted.rooms[roomId];
         await this._persistState();
         this.emit("room_left", { roomId });
       }
+      /**
+       * #629 recurrence fix — reconcile local room state against the server on
+       * connect.
+       *
+       * On disband the server marks each member ``"left"`` and sets
+       * ``room.status="disbanded"`` but sends NO WS event to the agent's bridge, so a
+       * disbanded/left room lingers in local state and replays dead MLS commit
+       * history on every reconnect ("Desired gen in the past" / "invalid ghash tag").
+       * ``GET /rooms`` returns ONLY active rooms the caller is a member of, so any
+       * locally-persisted room ABSENT from it is terminal — prune its MLS state
+       * (file + in-memory group, keyed by roomId), its sessions, and the room entry.
+       *
+       * Fail-safe: a failed fetch / non-ok / non-array response prunes NOTHING, so a
+       * transient error can never over-prune a live room.
+       */
+      async _reconcileRoomsWithServer() {
+        const local = this._persisted?.rooms;
+        if (!local || Object.keys(local).length === 0) return;
+        if (!this._deviceJwt) return;
+        let activeIds;
+        try {
+          const res = await fetch(`${this.config.apiUrl}/api/v1/rooms`, {
+            headers: { Authorization: `Bearer ${this._deviceJwt}` }
+          });
+          if (!res.ok) return;
+          const list = await res.json();
+          if (!Array.isArray(list)) return;
+          activeIds = new Set(
+            list.map((r22) => r22?.id).filter((id) => !!id)
+          );
+        } catch (err) {
+          console.warn(
+            `[SecureChannel] room reconcile skipped (fetch failed, pruning nothing): ${err instanceof Error ? err.message : String(err)}`
+          );
+          return;
+        }
+        const stale = Object.keys(local).filter((rid) => !activeIds.has(rid));
+        if (stale.length === 0) return;
+        for (const rid of stale) {
+          const room = local[rid];
+          if (room?.mlsGroupId) {
+            try {
+              await deleteMlsState(this.config.dataDir, room.mlsGroupId);
+            } catch {
+            }
+          }
+          this._mlsGroups.delete(rid);
+          for (const convId of room?.conversationIds ?? []) {
+            this._sessions.delete(convId);
+            if (this._persisted?.sessions) delete this._persisted.sessions[convId];
+          }
+          delete local[rid];
+        }
+        await this._persistState();
+        console.log(
+          `[SecureChannel] Room reconcile: pruned ${stale.length} disbanded/left room(s) from local state (${stale.map((r22) => r22.slice(0, 8)).join(", ")})`
+        );
+        this.emit("rooms_reconciled", { pruned: stale });
+      }
+      /**
+       * Handle an in-band `{event:"error"}` frame from the server.
+       *
+       * This is an APPLICATION-level error about one resource — it is NOT a
+       * transport fault, and must never be treated as one. When the error names a
+       * dead resource, the correct response is to PRUNE that resource; recycling
+       * the connection would just replay the same doomed write.
+       *
+       * `conversation deleted` (#460/#481) is the server refusing a write to a
+       * shared 1:1 MLS group whose conversations are all closed/deleted. It carries
+       * `group_id` for exactly this purpose. Without the prune, `_persisted.mlsGroups`
+       * is append-only and the 1:1 send path fans out to every entry, so the dead
+       * group takes a rejected write on every message for the life of the agent
+       * (loopita: group c1b1e11a, closed 2026-07-22, still bouncing 3 days later).
+       *
+       * Deliberately NARROW — it prunes only on this exact detail AND only when
+       * `group_id` matches a persisted shared 1:1 group. Unknown ids and other
+       * details prune nothing, so a server-side wording change or a room/A2A group
+       * can never cost us live MLS state. Safe because `closed`/`deleted` are
+       * terminal server-side, and a genuinely new group re-arrives via Welcome.
+       *
+       * Mirrors the #629 room prune: MLS state file, in-memory group, persisted
+       * entry, then persist.
+       */
+      async _handleServerError(payload) {
+        if (payload?.detail !== "conversation deleted") return;
+        const mlsGroupId = payload.group_id;
+        if (!mlsGroupId) return;
+        const groups = this._persisted?.mlsGroups;
+        if (!groups) return;
+        const gid = Object.keys(groups).find((k2) => groups[k2]?.mlsGroupId === mlsGroupId);
+        if (!gid) return;
+        try {
+          await deleteMlsState(this.config.dataDir, mlsGroupId);
+        } catch {
+        }
+        this._mlsGroups.delete(`1to1-group:${gid}`);
+        delete groups[gid];
+        await this._persistState();
+        console.log(
+          `[SecureChannel] Pruned dead shared 1:1 group ${gid.slice(0, 8)} (${mlsGroupId.slice(0, 8)}) \u2014 server reports its conversation deleted`
+        );
+        this.emit("dm_group_pruned", { conversationGroupId: gid, mlsGroupId });
+      }
       /**
        * Return info for all joined rooms.
        */
@@ -67150,6 +67264,9 @@ var init_channel = __esm2({
             await this._pullDrDeliveryQueue();
             await this._flushOutboundQueue();
             this._setState("ready");
+            void this._reconcileRoomsWithServer().catch(
+              (err) => console.warn(`[SecureChannel] room reconcile failed (ignored): ${err instanceof Error ? err.message : String(err)}`)
+            );
             if (this.config.enableScanning) {
               this._scanEngine = new ScanEngine();
               await this._fetchScanRules();
@@ -67172,7 +67289,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.8" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.10" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67490,7 +67607,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.8" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.10" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -67800,6 +67917,7 @@ var init_channel = __esm2({
             if (data.event === "error") {
               const detail = data.data?.detail || data.detail || "Unknown server error";
               console.error(`[SecureChannel] Server error: ${detail}`);
+              await this._handleServerError(data.data || data);
               this.emit("error", new Error(`Server: ${detail}`));
             }
             if (data.event === "a2a_message_mls") {
@@ -97268,7 +97386,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.8" : "0.0.0-dev";
+    VERSION = true ? "0.23.10" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -132601,6 +132719,23 @@ var PersistentClaudeSession = class {
   abort() {
     this._abort?.abort();
   }
+  /**
+   * Forensic snapshot of the CURRENT turn, for the worker-queue trap.
+   *
+   * Read by `WorkerQueue` when a task times out or errors, BEFORE `abort()` tears
+   * the worker down. It is the difference between two hangs that look identical
+   * from outside (a five-minute silence) but have opposite causes:
+   *   composedChars > 0, sawResult false -> the model streamed then stalled
+   *   composedChars = 0                  -> the turn never produced anything
+   * Read-only; it must never mutate turn state.
+   */
+  snapshot() {
+    return {
+      composedChars: this.turnText.length,
+      sawResult: this.sawResultThisTurn,
+      said: this.saidThisTurn
+    };
+  }
   async *input() {
     while (true) {
       let item;
@@ -132783,7 +132918,11 @@ var WorkerQueue = class {
   loop = Promise.resolve();
   running = false;
   enqueue(task) {
-    this.q.push(task);
+    this.q.push({
+      task,
+      enqueuedAt: Date.now(),
+      queueDepthAtEnqueue: this.q.length + (this.running ? 1 : 0)
+    });
     if (!this.running) {
       this.running = true;
       this.loop = this.drain();
@@ -132796,16 +132935,28 @@ var WorkerQueue = class {
   async drain() {
     try {
       while (this.q.length > 0) {
-        const task = this.q.shift();
-        await this.runOne(task);
+        const entry = this.q.shift();
+        await this.runOne(entry);
       }
     } finally {
       this.running = false;
     }
   }
-  async runOne(task) {
+  /** Best-effort trap emit. A broken sink must never break the queue. */
+  emitIncident(rec) {
+    try {
+      this.deps.onIncident?.(rec);
+    } catch {
+    }
+  }
+  async runOne(entry) {
+    const { task } = entry;
+    const startedAt = Date.now();
+    const waitedMs = startedAt - entry.enqueuedAt;
+    const queueDepthAtStart = this.q.length;
     let session;
     let timer;
+    let timedOut = false;
     try {
       session = this.deps.makeSession(task);
       session.push(task.instruction, task.reply, {
@@ -132816,13 +132967,28 @@ var WorkerQueue = class {
       const currentSession = session;
       const timeout = new Promise((_resolve, reject) => {
         timer = setTimeout(() => {
+          timedOut = true;
           currentSession.abort();
           reject(new Error("worker task timeout"));
         }, this.deps.timeoutMs);
       });
       await Promise.race([session.start(), timeout]);
     } catch (e7) {
-      this.deps.log(`[worker-queue] task failed: ${e7.message}`);
+      const err = e7;
+      this.deps.log(`[worker-queue] task failed: ${err.message}`);
+      const snap = session?.snapshot?.();
+      this.emitIncident({
+        at: new Date(startedAt).toISOString(),
+        outcome: timedOut ? "timeout" : "error",
+        error: err.message,
+        waitedMs,
+        ranMs: Date.now() - startedAt,
+        timeoutMs: this.deps.timeoutMs,
+        queueDepthAtEnqueue: entry.queueDepthAtEnqueue,
+        queueDepthAtStart,
+        instructionChars: task.instruction.length,
+        ...snap ? { session: snap } : {}
+      });
       session?.abort();
       try {
         await task.reply(GENERIC_ERROR);
@@ -133303,7 +133469,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.6.2" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.6.4" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -133377,7 +133543,25 @@ async function main() {
       deviceJwt
     }),
     timeoutMs: WORKER_TIMEOUT_MS,
-    log: (m6) => console.error(m6)
+    log: (m6) => console.error(m6),
+    // TRAP (2026-07-25). The 07-24 five-minute silence was diagnosable only by
+    // luck — the drop-trap happened to record a reply landing 300.016s after the
+    // ack, and 300s is WORKER_TIMEOUT_MS exactly. Nothing recorded WHY the worker
+    // hung, and these logs carry no timestamps, so the evidence was already gone.
+    // Append-only JSONL beside the logs, plus one stamped console line so the
+    // incident is visible in bridge.error.log at the moment it happens.
+    onIncident: (rec) => {
+      console.error(
+        `[worker-trap] ${rec.at} ${rec.outcome} after ${rec.ranMs}ms (waited ${rec.waitedMs}ms behind ${rec.queueDepthAtEnqueue}, ${rec.queueDepthAtStart} still queued)` + (rec.session ? ` composed=${rec.session.composedChars} result=${rec.session.sawResult} said=${rec.session.said}` : "")
+      );
+      try {
+        const dir = join10(cfg.dataDir, "logs");
+        mkdirSync5(dir, { recursive: true });
+        appendFileSync2(join10(dir, "worker-incidents.jsonl"), JSON.stringify(rec) + "\n");
+      } catch (err) {
+        console.error(`[worker-trap] could not persist incident: ${err.message}`);
+      }
+    }
   });
   const router = makeRouter({ workAllowed, listener, queue: workerQueue });
   wireBridge(

package/dist/session.d.ts

@@ -171,6 +171,21 @@ export declare class PersistentClaudeSession {
     deliver(text: string): Promise<void>;
     /** Abort the in-flight query() — used by the worker queue on a per-task timeout. */
     abort(): void;
+    /**
+     * Forensic snapshot of the CURRENT turn, for the worker-queue trap.
+     *
+     * Read by `WorkerQueue` when a task times out or errors, BEFORE `abort()` tears
+     * the worker down. It is the difference between two hangs that look identical
+     * from outside (a five-minute silence) but have opposite causes:
+     *   composedChars > 0, sawResult false -> the model streamed then stalled
+     *   composedChars = 0                  -> the turn never produced anything
+     * Read-only; it must never mutate turn state.
+     */
+    snapshot(): {
+        composedChars: number;
+        sawResult: boolean;
+        said: boolean;
+    };
     private input;
     /**
      * Build the SDK options for this session. Locked mode (default) is safe for

package/dist/worker-queue.d.ts

@@ -16,20 +16,70 @@ export type WorkerTask = {
      *  disarm denies the next call). Absent for owner DMs. */
     armed?: () => boolean;
 };
+/**
+ * Forensic record of a task that did NOT complete cleanly.
+ *
+ * Exists because the 2026-07-24 "loopita went quiet for 5 minutes" incident was
+ * diagnosable only by coincidence: the drop-trap happened to capture that the
+ * reply landed 300.016s after the ack, and 300s is `WORKER_TIMEOUT_MS` exactly.
+ * Nothing in the bridge recorded WHY the worker hung, and the logs carry no
+ * timestamps at all, so the evidence was gone by the time we looked.
+ */
+export type WorkerIncident = {
+    /** ISO timestamp — the bridge's own logs are unstamped, so this is the anchor. */
+    at: string;
+    outcome: "timeout" | "error";
+    error: string;
+    /**
+     * enqueue -> start. THE load-bearing field: it separates "this task hung" from
+     * "this task was stuck behind one that hung". Both look identical to the owner
+     * (a long silence) and have completely different fixes.
+     */
+    waitedMs: number;
+    /** start -> failure. Approaches timeoutMs for a true hang. */
+    ranMs: number;
+    timeoutMs: number;
+    /** Depth when this task was enqueued — >0 means it was already behind someone. */
+    queueDepthAtEnqueue: number;
+    /** Depth still waiting when this task began — the blast radius of this hang. */
+    queueDepthAtStart: number;
+    instructionChars: number;
+    /** What the worker had produced when it died, when the session can report it. */
+    session?: {
+        composedChars: number;
+        sawResult: boolean;
+        said: boolean;
+    };
+};
 export interface WorkerQueueDeps {
     /** Build a fresh ephemeral worker session for this task (not yet started). */
     makeSession: (task: WorkerTask) => PersistentClaudeSession;
     /** Per-task wall-clock cap; on breach the worker is aborted and the queue advances. */
     timeoutMs: number;
     log: (m: string) => void;
+    /**
+     * Trap sink for non-clean outcomes. Optional, best-effort, and never allowed to
+     * affect the queue: a trap that can break the thing it observes is worse than
+     * no trap.
+     */
+    onIncident?: (rec: WorkerIncident) => void;
 }
 /**
  * Serial FIFO of tool-eligible turns. One worker runs at a time (concurrent tool
  * calls against one device/workspace can interleave destructively; the owner is a
  * single actor). Each task runs in a fresh ephemeral worker seeded with only its
  * instruction; on error or timeout the worker is torn down, a generic message is
- * sent to the task's reply, and the queue advances — a task can never wedge the
- * queue (which would starve the owner's DM lane).
+ * sent to the task's reply, and the queue advances.
+ *
+ * ⚠️ A task cannot wedge the queue PERMANENTLY, but it absolutely can wedge it for
+ * up to `timeoutMs`. Serial + a 5-minute cap means ONE hung worker delays every
+ * message behind it by up to five minutes, and the owner gets the generic error
+ * for the FIRST message while a LATER one answers normally. That is not
+ * hypothetical: it is the 2026-07-24 loopita incident, where the reply landed
+ * 300.016s after the ack. The timeout is the amplifier, not the trigger — see
+ * `WorkerIncident` and the `waitedMs` field, which is what tells a hung task
+ * apart from its victims. (This comment previously claimed a task "can never
+ * wedge the queue"; it could, and did.)
  */
 export declare class WorkerQueue {
     private deps;
@@ -41,6 +91,8 @@ export declare class WorkerQueue {
     /** Resolves when the queue has processed everything enqueued so far. */
     whenDrained(): Promise<void>;
     private drain;
+    /** Best-effort trap emit. A broken sink must never break the queue. */
+    private emitIncident;
     private runOne;
 }
 //# sourceMappingURL=worker-queue.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",