@agentvault/claude-bridge 0.7.1 → 0.7.3

package/dist/bridge.d.ts

@@ -43,6 +43,10 @@ export interface RoomHushed {
 }
 export interface RoomChannel {
     on(ev: "room_message", cb: (e: RoomMessage) => void): unknown;
+    on(ev: "room_joined", cb: (e: {
+        roomId: string;
+        name?: string;
+    }) => void): unknown;
     on(ev: "message", cb: (text: string, metadata: MessageMeta) => void): unknown;
     on(ev: "room_hushed", cb: (e: RoomHushed) => void): unknown;
     on(ev: "error", cb: (err: unknown) => void): unknown;
@@ -175,6 +179,26 @@ export declare function attachLifecycle(channel: LifecycleChannel, opts?: {
  * dropped (it usually means a mis-timed or duplicate approval).
  */
 export declare function pollApprovalsOnce(arming: ArmingState, dataDir: string, onArmed: () => void, log?: (msg: string) => void): void;
+/**
+ * How a ROOM turn is announced to the model (#366 / #499 Facet A).
+ *
+ * Reproduced live 2026-07-29: asked "what room are you in?" *in* a room, the
+ * agent answered "This is our 1:1 DM, so no room name to report." Everything
+ * beneath the model was correct — the bridge logged `inbound from chris in
+ * c6a2734d` then `said to room c6a2734d`, and the message is recorded against
+ * room "New Test" in the database. The turn was simply pushed as
+ * `[chris]: <text>`, which carries no channel context whatsoever, so the model
+ * had nothing to distinguish a room from a DM and defaulted to DM.
+ *
+ * The room NAME is best-effort (learned from `room_joined`), but the fact that
+ * this is a room is not: when the name is unknown we still say "room" and fall
+ * back to a short id. Getting "which room" wrong is a cosmetic answer; getting
+ * "am I in a room" wrong changes how the agent addresses everyone in it.
+ *
+ * A 1:1 DM is deliberately left unlabelled — that path is not broken, and an
+ * unmarked turn already reads as a DM, which is what the model assumes.
+ */
+export declare function roomTurnPrefix(roomId: string, senderName: string, roomName?: string): string;
 export declare function wireBridge(channel: RoomChannel, session: RoomSession, target: ActiveTarget, opts?: {
     roomFilter?: string;
     armRoom?: boolean;

package/dist/index.js

@@ -63525,6 +63525,34 @@ var init_owner_sync = __esm2({
     NONCE_BYTES2 = 24;
   }
 });
+function seqOf(m22) {
+  if (m22.seq === void 0 || m22.seq === null || m22.seq === "")
+    return null;
+  const n22 = Number(m22.seq);
+  return Number.isFinite(n22) ? n22 : null;
+}
+function createdAtOf(m22) {
+  const t22 = new Date(m22.created_at ?? 0).getTime();
+  return Number.isFinite(t22) ? t22 : 0;
+}
+function orderDeliveryBatch(messages) {
+  return [...messages].sort((a2, b22) => {
+    const aWelcome = a2.message_type === "welcome";
+    const bWelcome = b22.message_type === "welcome";
+    if (aWelcome !== bWelcome)
+      return aWelcome ? -1 : 1;
+    const as2 = seqOf(a2);
+    const bs2 = seqOf(b22);
+    if (as2 !== null && bs2 !== null && as2 !== bs2)
+      return as2 - bs2;
+    return createdAtOf(a2) - createdAtOf(b22);
+  });
+}
+var init_mls_delivery_order = __esm2({
+  "../crypto/dist/mls-delivery-order.js"() {
+    "use strict";
+  }
+});
 var dist_exports = {};
 __export2(dist_exports, {
   AV_CREDENTIAL_CONTEXT: () => AV_CREDENTIAL_CONTEXT,
@@ -63595,6 +63623,7 @@ __export2(dist_exports, {
   issueCredential: () => issueCredential,
   multibaseToPublicKey: () => multibaseToPublicKey,
   normalizeBackupCode: () => normalizeBackupCode,
+  orderDeliveryBatch: () => orderDeliveryBatch,
   parseTraceparent: () => parseTraceparent,
   performX3DH: () => performX3DH,
   presentCredentials: () => presentCredentials,
@@ -63632,6 +63661,7 @@ var init_dist = __esm2({
     await init_approval();
     init_mls_group();
     await init_owner_sync();
+    init_mls_delivery_order();
   }
 });
 function syncLockPath(dataDir, channelId) {
@@ -64592,6 +64622,7 @@ var init_channel = __esm2({
     "use strict";
     await init_libsodium_wrappers();
     await init_dist();
+    await init_dist();
     init_mls_state();
     await init_mls_kp_pool();
     init_credential_store();
@@ -64679,6 +64710,10 @@ var init_channel = __esm2({
       _sessionGroupIds = /* @__PURE__ */ new Map();
       /** Consecutive MLS decrypt failure count per group key for epoch recovery. */
       _mlsDecryptFailCounts = /* @__PURE__ */ new Map();
+      /** #474: per-group consecutive processCommit failures. Mirrors the decrypt
+       *  counter above — a commit that fails is divergence, and divergence must
+       *  self-heal rather than be logged and dropped. */
+      _mlsCommitFailCounts = /* @__PURE__ */ new Map();
       static MAX_MLS_DECRYPT_FAILS = 3;
       /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
       _mlsKeyPackage = null;
@@ -65559,7 +65594,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.11" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.13" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67298,7 +67333,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.11" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.13" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67616,7 +67651,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.11" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.13" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69012,14 +69047,9 @@ ${messageText}`;
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
               } catch (err) {
-                const isOldEpoch = err?.message?.includes("epoch") || err?.message?.includes("old") || err?.message?.includes("Validation");
-                if (isOldEpoch) {
-                  console.log(`[SecureChannel] Discarding old-epoch commit for room ${roomId.slice(0, 8)}`);
-                } else {
-                  console.error(`[SecureChannel] MLS commit failed for room ${roomId.slice(0, 8)}:`, err);
-                  throw err;
-                }
+                await this._onCommitFailure(roomId, groupId, err, `room ${roomId.slice(0, 8)}`);
               }
+              this._mlsCommitFailCounts.delete(roomId);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -69037,14 +69067,9 @@ ${messageText}`;
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
               } catch (err) {
-                const isOldEpoch = err?.message?.includes("epoch") || err?.message?.includes("old") || err?.message?.includes("Validation");
-                if (isOldEpoch) {
-                  console.log(`[SecureChannel] Discarding old-epoch commit for A2A ${chId.slice(0, 8)}`);
-                } else {
-                  console.error(`[SecureChannel] MLS commit failed for A2A ${chId.slice(0, 8)}:`, err);
-                  throw err;
-                }
+                await this._onCommitFailure(`a2a:${chId}`, groupId, err, `A2A ${chId.slice(0, 8)}`);
               }
+              this._mlsCommitFailCounts.delete(`a2a:${chId}`);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -69101,6 +69126,52 @@ ${messageText}`;
        * sends us one. Deduped to a 30s window per group so a burst of undecryptable
        * rows doesn't spam request-welcome. Fire-and-forget.
        */
+      /**
+       * #474 — a failed `processCommit` is DIVERGENCE, and divergence must
+       * self-heal. It previously did neither: the room stayed broken forever.
+       *
+       * Two swallow paths existed, and only the second was ever reported:
+       *
+       *   1. `isOldEpoch` substring-matched the error text for "epoch" / "old" /
+       *      "Validation" and discarded deliberately. `ValidationError: Desired gen
+       *      in the past` contains "Validation", so the LOUDEST production failure
+       *      was filed as benign — 1,439 occurrences on one agent, all thrown away
+       *      by a string match.
+       *   2. Everything else re-threw to the WS dispatcher, which logs and drops.
+       *
+       * Result: ~1,600 commit failures across 13 rooms and ZERO resyncs. Classifying
+       * divergence by grepping an error message is the root of it — error text is
+       * not a protocol, and the one case that must never be silent was the one that
+       * happened to contain the magic word.
+       *
+       * So: no classification. COUNT, and after MAX_MLS_DECRYPT_FAILS consecutive
+       * failures run the same ladder the decrypt path has used since #440 — replay
+       * the missed commits via /sync, and fall back to re-join only if that cannot
+       * catch up. Counting rather than resyncing on first failure matters: a
+       * genuinely stale commit is normal, and resyncing on each one would have
+       * fired ~1,600 Welcome requests.
+       *
+       * Never re-throws. The caller's only handler logs and drops, so throwing here
+       * is indistinguishable from swallowing — it just moves the swallow one frame up.
+       */
+      async _onCommitFailure(groupKey, mlsGroupId, err, label) {
+        const count = (this._mlsCommitFailCounts.get(groupKey) ?? 0) + 1;
+        this._mlsCommitFailCounts.set(groupKey, count);
+        console.error(
+          `[SecureChannel] MLS commit failed (${count}/${_SecureChannel.MAX_MLS_DECRYPT_FAILS}) for ${label}:`,
+          err
+        );
+        if (count < _SecureChannel.MAX_MLS_DECRYPT_FAILS) return;
+        console.warn(`[SecureChannel] MLS commit resync triggered for ${label} \u2014 ${count} consecutive failures`);
+        try {
+          if (!await this._resyncOnDivergence(groupKey, mlsGroupId)) {
+            await this._triggerMlsEpochRecovery(groupKey, mlsGroupId);
+          }
+          this._mlsCommitFailCounts.delete(groupKey);
+        } catch (recoverErr) {
+          console.error(`[SecureChannel] MLS commit resync FAILED for ${label}:`, recoverErr);
+        }
+      }
       async _requestWelcomeSelfHeal(groupId) {
         const now = Date.now();
         const last = this._welcomeSelfHealInflight.get(groupId) ?? 0;
@@ -69498,16 +69569,10 @@ ${messageText}`;
             console.warn(`[SecureChannel] Delivery pull failed: ${res.status}`);
             return;
           }
-          const { messages } = await res.json();
+          let { messages } = await res.json();
           const hasMessages = messages && messages.length > 0;
           if (hasMessages) {
-            const order = { welcome: 0, commit: 1, application: 2 };
-            messages.sort((a2, b22) => {
-              const ao = order[a2.message_type] ?? 2;
-              const bo = order[b22.message_type] ?? 2;
-              if (ao !== bo) return ao - bo;
-              return new Date(a2.created_at).getTime() - new Date(b22.created_at).getTime();
-            });
+            messages = orderDeliveryBatch(messages);
             const ackedIds = [];
             const nackedIds = [];
             for (const msg of messages) {
@@ -69902,9 +69967,43 @@ ${messageText}`;
                     const errMsg = addErr instanceof Error ? addErr.message : String(addErr);
                     if (errMsg.includes("already in the group")) {
                       console.log(`[SecureChannel] A2A member already in group \u2014 removing and re-adding ${req.requesting_device_id.slice(0, 8)}`);
+                      const preRemoveState = JSON.stringify(mlsGroup.exportState());
+                      let removeCommitPublished = false;
                       try {
                         const identityBytes = new TextEncoder().encode(req.requesting_device_id);
-                        await mlsGroup.removeMember(identityBytes);
+                        const leafIndex = mlsGroup.memberLeafIndex(identityBytes);
+                        if (leafIndex === null) {
+                          console.log(`[SecureChannel] A2A re-add: no leaf index for ${req.requesting_device_id.slice(0, 8)} \u2014 cannot remove`);
+                          continue;
+                        }
+                        const removeResult = await mlsGroup.removeMember(leafIndex);
+                        try {
+                          const removeResp = await fetch(
+                            `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
+                            {
+                              method: "POST",
+                              headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                              body: JSON.stringify({
+                                group_id: chState.mlsGroupId,
+                                device_id: this._deviceId,
+                                commit: Buffer.from(removeResult.commit).toString("hex"),
+                                commit_epoch: Number(mlsGroup.epoch)
+                              })
+                            }
+                          );
+                          if (removeResp.ok) {
+                            removeCommitPublished = true;
+                          } else {
+                            const detail = await removeResp.text().catch(() => "");
+                            console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
+                          }
+                        } catch (distErr) {
+                          console.warn(`[SecureChannel] A2A remove-commit distribute network error:`, distErr);
+                        }
+                        if (!removeCommitPublished) {
+                          mlsGroup.importState(JSON.parse(preRemoveState));
+                          continue;
+                        }
                         const kpRes2 = await fetch(
                           `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
                           { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
@@ -69928,6 +70027,12 @@ ${messageText}`;
                         }
                       } catch (readdErr) {
                         console.log(`[SecureChannel] A2A remove+re-add FAILED: ${readdErr instanceof Error ? readdErr.message : String(readdErr)}`);
+                        if (!removeCommitPublished) {
+                          try {
+                            mlsGroup.importState(JSON.parse(preRemoveState));
+                          } catch {
+                          }
+                        }
                         continue;
                       }
                     } else {
@@ -97395,7 +97500,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.11" : "0.0.0-dev";
+    VERSION = true ? "0.23.13" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -133452,6 +133557,10 @@ function pollApprovalsOnce(arming, dataDir, onArmed, log = () => {
     }
   }
 }
+function roomTurnPrefix(roomId, senderName, roomName) {
+  const room = roomName ? `"${roomName}"` : roomId.slice(0, 8);
+  return `[room ${room} | ${senderName}]`;
+}
 function wireBridge(channel, session, target, opts = {}) {
   const log = opts.log ?? (() => {
   });
@@ -133486,6 +133595,10 @@ function wireBridge(channel, session, target, opts = {}) {
     );
   });
   let warnedMissingSenderIsAgent = false;
+  const roomNames = /* @__PURE__ */ new Map();
+  channel.on("room_joined", (e7) => {
+    if (e7?.roomId && e7.name) roomNames.set(e7.roomId, e7.name);
+  });
   channel.on("room_message", (e7) => {
     if (typeof e7.senderIsAgent !== "boolean" && !warnedMissingSenderIsAgent) {
       warnedMissingSenderIsAgent = true;
@@ -133500,7 +133613,7 @@ function wireBridge(channel, session, target, opts = {}) {
     }
     log(`inbound from ${e7.senderName} in ${e7.roomId.slice(0, 8)}`);
     target.setRoom(e7.roomId);
-    session.push(`[${e7.senderName}]: ${e7.plaintext}`, target.snapshotReply(channel, log), {
+    session.push(`${roomTurnPrefix(e7.roomId, e7.senderName, roomNames.get(e7.roomId))}: ${e7.plaintext}`, target.snapshotReply(channel, log), {
       autoReplyOnText: false,
       replyExpected: e7.senderIsAgent === false,
       armed: () => arming.isArmed(e7.roomId)
@@ -133651,7 +133764,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.7.1" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.7.3" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",