@agentvault/claude-bridge 0.7.0 → 0.7.2

package/dist/host-trust.d.ts

@@ -19,8 +19,30 @@ export declare function trustDir(root?: string): string;
  */
 export declare function isTrusted(deviceId: string, root?: string): boolean;
 export declare function grant(deviceId: string, root?: string): void;
-/** Returns true only if a marker was actually removed. */
+/**
+ * Returns true only if a real marker was actually removed.
+ *
+ * M1. This used `existsSync` + `rmSync(p, { force: true, recursive: true })`.
+ * `existsSync` is true for a DIRECTORY, so a directory squatting at a marker
+ * path was recursively deleted — contents and all — and reported as a
+ * successful revoke. Reached in practice through `untrust-host --all`
+ * (approve-cli.ts:131), which revokes everything `listTrusted()` returns.
+ *
+ * Only a regular file is a marker, which is already `isTrusted`'s rule; `lstat`
+ * so a symlink is never followed or counted. Anything else was never a grant,
+ * so removing it is not this function's job — and refusing keeps `recursive`
+ * out of this file entirely.
+ *
+ * The invariant callers actually depend on is preserved: after `revoke()`,
+ * `isTrusted()` is false, because it rejects non-files too.
+ */
 export declare function revoke(deviceId: string, root?: string): boolean;
+/**
+ * Filtered through `isTrusted` rather than the filename alone, so the listing
+ * cannot disagree with the decision. A name-only filter reported directories
+ * and symlinks as trusted devices, which both over-stated trust to an operator
+ * reading the list and fed non-markers to `revoke()` in the `--all` path.
+ */
 export declare function listTrusted(root?: string): string[];
 /**
  * Resolve this agent's device-id from its persisted identity. `trust-host` runs

package/dist/index.js

@@ -349,7 +349,7 @@ var init_systemd = __esm({
 
 // src/service/backend.ts
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync4, existsSync as existsSync5, chmodSync as chmodSync2 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync4, existsSync as existsSync4, chmodSync as chmodSync3 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -362,9 +362,9 @@ function defaultDeps() {
     },
     writeFile: (p2, d10) => writeFileSync3(p2, d10),
     mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
-    chmod: (p2, m6) => chmodSync2(p2, m6),
+    chmod: (p2, m6) => chmodSync3(p2, m6),
     rm: (p2) => rmSync4(p2, { force: true }),
-    exists: (p2) => existsSync5(p2)
+    exists: (p2) => existsSync4(p2)
   };
 }
 function selectBackend(platform, deps) {
@@ -64679,6 +64679,10 @@ var init_channel = __esm2({
       _sessionGroupIds = /* @__PURE__ */ new Map();
       /** Consecutive MLS decrypt failure count per group key for epoch recovery. */
       _mlsDecryptFailCounts = /* @__PURE__ */ new Map();
+      /** #474: per-group consecutive processCommit failures. Mirrors the decrypt
+       *  counter above — a commit that fails is divergence, and divergence must
+       *  self-heal rather than be logged and dropped. */
+      _mlsCommitFailCounts = /* @__PURE__ */ new Map();
       static MAX_MLS_DECRYPT_FAILS = 3;
       /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
       _mlsKeyPackage = null;
@@ -65559,7 +65563,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.11" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.12" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67298,7 +67302,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.11" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.12" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67616,7 +67620,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.11" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.12" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69012,14 +69016,9 @@ ${messageText}`;
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
               } catch (err) {
-                const isOldEpoch = err?.message?.includes("epoch") || err?.message?.includes("old") || err?.message?.includes("Validation");
-                if (isOldEpoch) {
-                  console.log(`[SecureChannel] Discarding old-epoch commit for room ${roomId.slice(0, 8)}`);
-                } else {
-                  console.error(`[SecureChannel] MLS commit failed for room ${roomId.slice(0, 8)}:`, err);
-                  throw err;
-                }
+                await this._onCommitFailure(roomId, groupId, err, `room ${roomId.slice(0, 8)}`);
               }
+              this._mlsCommitFailCounts.delete(roomId);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -69037,14 +69036,9 @@ ${messageText}`;
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
               } catch (err) {
-                const isOldEpoch = err?.message?.includes("epoch") || err?.message?.includes("old") || err?.message?.includes("Validation");
-                if (isOldEpoch) {
-                  console.log(`[SecureChannel] Discarding old-epoch commit for A2A ${chId.slice(0, 8)}`);
-                } else {
-                  console.error(`[SecureChannel] MLS commit failed for A2A ${chId.slice(0, 8)}:`, err);
-                  throw err;
-                }
+                await this._onCommitFailure(`a2a:${chId}`, groupId, err, `A2A ${chId.slice(0, 8)}`);
               }
+              this._mlsCommitFailCounts.delete(`a2a:${chId}`);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -69101,6 +69095,52 @@ ${messageText}`;
        * sends us one. Deduped to a 30s window per group so a burst of undecryptable
        * rows doesn't spam request-welcome. Fire-and-forget.
        */
+      /**
+       * #474 — a failed `processCommit` is DIVERGENCE, and divergence must
+       * self-heal. It previously did neither: the room stayed broken forever.
+       *
+       * Two swallow paths existed, and only the second was ever reported:
+       *
+       *   1. `isOldEpoch` substring-matched the error text for "epoch" / "old" /
+       *      "Validation" and discarded deliberately. `ValidationError: Desired gen
+       *      in the past` contains "Validation", so the LOUDEST production failure
+       *      was filed as benign — 1,439 occurrences on one agent, all thrown away
+       *      by a string match.
+       *   2. Everything else re-threw to the WS dispatcher, which logs and drops.
+       *
+       * Result: ~1,600 commit failures across 13 rooms and ZERO resyncs. Classifying
+       * divergence by grepping an error message is the root of it — error text is
+       * not a protocol, and the one case that must never be silent was the one that
+       * happened to contain the magic word.
+       *
+       * So: no classification. COUNT, and after MAX_MLS_DECRYPT_FAILS consecutive
+       * failures run the same ladder the decrypt path has used since #440 — replay
+       * the missed commits via /sync, and fall back to re-join only if that cannot
+       * catch up. Counting rather than resyncing on first failure matters: a
+       * genuinely stale commit is normal, and resyncing on each one would have
+       * fired ~1,600 Welcome requests.
+       *
+       * Never re-throws. The caller's only handler logs and drops, so throwing here
+       * is indistinguishable from swallowing — it just moves the swallow one frame up.
+       */
+      async _onCommitFailure(groupKey, mlsGroupId, err, label) {
+        const count = (this._mlsCommitFailCounts.get(groupKey) ?? 0) + 1;
+        this._mlsCommitFailCounts.set(groupKey, count);
+        console.error(
+          `[SecureChannel] MLS commit failed (${count}/${_SecureChannel.MAX_MLS_DECRYPT_FAILS}) for ${label}:`,
+          err
+        );
+        if (count < _SecureChannel.MAX_MLS_DECRYPT_FAILS) return;
+        console.warn(`[SecureChannel] MLS commit resync triggered for ${label} \u2014 ${count} consecutive failures`);
+        try {
+          if (!await this._resyncOnDivergence(groupKey, mlsGroupId)) {
+            await this._triggerMlsEpochRecovery(groupKey, mlsGroupId);
+          }
+          this._mlsCommitFailCounts.delete(groupKey);
+        } catch (recoverErr) {
+          console.error(`[SecureChannel] MLS commit resync FAILED for ${label}:`, recoverErr);
+        }
+      }
       async _requestWelcomeSelfHeal(groupId) {
         const now = Date.now();
         const last = this._welcomeSelfHealInflight.get(groupId) ?? 0;
@@ -69902,9 +69942,43 @@ ${messageText}`;
                     const errMsg = addErr instanceof Error ? addErr.message : String(addErr);
                     if (errMsg.includes("already in the group")) {
                       console.log(`[SecureChannel] A2A member already in group \u2014 removing and re-adding ${req.requesting_device_id.slice(0, 8)}`);
+                      const preRemoveState = JSON.stringify(mlsGroup.exportState());
+                      let removeCommitPublished = false;
                       try {
                         const identityBytes = new TextEncoder().encode(req.requesting_device_id);
-                        await mlsGroup.removeMember(identityBytes);
+                        const leafIndex = mlsGroup.memberLeafIndex(identityBytes);
+                        if (leafIndex === null) {
+                          console.log(`[SecureChannel] A2A re-add: no leaf index for ${req.requesting_device_id.slice(0, 8)} \u2014 cannot remove`);
+                          continue;
+                        }
+                        const removeResult = await mlsGroup.removeMember(leafIndex);
+                        try {
+                          const removeResp = await fetch(
+                            `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
+                            {
+                              method: "POST",
+                              headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                              body: JSON.stringify({
+                                group_id: chState.mlsGroupId,
+                                device_id: this._deviceId,
+                                commit: Buffer.from(removeResult.commit).toString("hex"),
+                                commit_epoch: Number(mlsGroup.epoch)
+                              })
+                            }
+                          );
+                          if (removeResp.ok) {
+                            removeCommitPublished = true;
+                          } else {
+                            const detail = await removeResp.text().catch(() => "");
+                            console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
+                          }
+                        } catch (distErr) {
+                          console.warn(`[SecureChannel] A2A remove-commit distribute network error:`, distErr);
+                        }
+                        if (!removeCommitPublished) {
+                          mlsGroup.importState(JSON.parse(preRemoveState));
+                          continue;
+                        }
                         const kpRes2 = await fetch(
                           `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
                           { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
@@ -69928,6 +70002,12 @@ ${messageText}`;
                         }
                       } catch (readdErr) {
                         console.log(`[SecureChannel] A2A remove+re-add FAILED: ${readdErr instanceof Error ? readdErr.message : String(readdErr)}`);
+                        if (!removeCommitPublished) {
+                          try {
+                            mlsGroup.importState(JSON.parse(preRemoveState));
+                          } catch {
+                          }
+                        }
                         continue;
                       }
                     } else {
@@ -97395,7 +97475,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.11" : "0.0.0-dev";
+    VERSION = true ? "0.23.12" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -118702,10 +118782,12 @@ import { realpathSync as realpathSync2 } from "node:fs";
 import { resolve as resolve3, dirname as dirname2, basename, sep as sep2, isAbsolute } from "node:path";
 
 // src/host-trust.ts
-import { mkdirSync as mkdirSync3, writeFileSync, rmSync as rmSync2, existsSync as existsSync3, readdirSync as readdirSync2, lstatSync as lstatSync2, readFileSync as readFileSync4 } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync, rmSync as rmSync2, readdirSync as readdirSync2, lstatSync as lstatSync2, readFileSync as readFileSync4, chmodSync as chmodSync2 } from "node:fs";
 import { join as join6 } from "node:path";
 import { homedir, hostname as hostname3 } from "node:os";
 var TRUST_SUBDIR = "host-trust";
+var DIR_MODE3 = 448;
+var FILE_MODE3 = 384;
 var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 var IDENTITY_FILES = ["agentvault.json", "secure-channel.json", "agentvault.json.bak"];
 var HostTrustError = class extends Error {
@@ -118731,23 +118813,33 @@ function isTrusted(deviceId, root3) {
 function grant(deviceId, root3) {
   const id = sanitize(deviceId);
   const dir = trustDir(root3);
-  mkdirSync3(dir, { recursive: true });
+  const p2 = join6(dir, id);
+  mkdirSync3(dir, { recursive: true, mode: DIR_MODE3 });
   writeFileSync(
-    join6(dir, id),
+    p2,
     `granted_at=${(/* @__PURE__ */ new Date()).toISOString()} host=${hostname3()}
-`
+`,
+    { mode: FILE_MODE3 }
   );
+  chmodSync2(dir, DIR_MODE3);
+  chmodSync2(p2, FILE_MODE3);
 }
 function revoke(deviceId, root3) {
   const id = sanitize(deviceId);
   const p2 = join6(trustDir(root3), id);
-  if (!existsSync3(p2)) return false;
-  rmSync2(p2, { force: true, recursive: true });
+  try {
+    if (!lstatSync2(p2).isFile()) return false;
+  } catch {
+    return false;
+  }
+  rmSync2(p2, { force: true });
   return true;
 }
 function listTrusted(root3) {
   try {
-    return readdirSync2(trustDir(root3)).filter((n10) => ID_RE.test(n10));
+    return readdirSync2(trustDir(root3)).filter(
+      (n10) => ID_RE.test(n10) && isTrusted(n10, root3)
+    );
   } catch {
     return [];
   }
@@ -133227,7 +133319,7 @@ var ArmingState = class {
 };
 
 // src/approve-cli.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, readFileSync as readFileSync5, readdirSync as readdirSync3, rmSync as rmSync3, existsSync as existsSync4 } from "node:fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, readFileSync as readFileSync5, readdirSync as readdirSync3, rmSync as rmSync3, existsSync as existsSync3 } from "node:fs";
 import { join as join7 } from "node:path";
 var APPROVALS_SUBDIR = "arm-approvals";
 var ID_RE2 = /^[A-Za-z0-9_-]{1,128}$/;
@@ -133254,7 +133346,7 @@ function writeApproval(dataDir, requestId, roomId) {
 }
 function drainApprovals(dataDir) {
   const dir = join7(dataDir, APPROVALS_SUBDIR);
-  if (!existsSync4(dir)) return [];
+  if (!existsSync3(dir)) return [];
   const out = [];
   for (const name of readdirSync3(dir)) {
     if (!ID_RE2.test(name)) continue;
@@ -133473,7 +133565,14 @@ function wireBridge(channel, session, target, opts = {}) {
       e7.hushedUntil ? `room ${e7.roomId.slice(0, 8)} hushed until ${e7.hushedUntil} \u2014 holding` : `room ${e7.roomId.slice(0, 8)} hush cleared`
     );
   });
+  let warnedMissingSenderIsAgent = false;
   channel.on("room_message", (e7) => {
+    if (typeof e7.senderIsAgent !== "boolean" && !warnedMissingSenderIsAgent) {
+      warnedMissingSenderIsAgent = true;
+      log(
+        "WARNING: inbound room_message has no `senderIsAgent` \u2014 replies to humans in rooms will be DROPPED whenever the model answers in plain text instead of calling say (#630). Most likely cause: a stale bundled plugin dist. Rebuild the bridge (npm run build in packages/claude-room-bridge) and reinstall."
+      );
+    }
     if (opts.roomFilter && e7.roomId !== opts.roomFilter) return;
     if (hush.isHushed(e7.roomId)) {
       log(`inbound from ${e7.senderName} in ${e7.roomId.slice(0, 8)} \u2014 room hushed, holding (not replying)`);
@@ -133632,7 +133731,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.7.0" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.7.2" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",