@agentvault/claude-bridge 0.7.14 → 0.7.16

package/dist/index.js

@@ -399,11 +399,20 @@ var subcommand_exports = {};
 __export(subcommand_exports, {
   maybeRunServiceSubcommand: () => maybeRunServiceSubcommand
 });
+function requireAgentName(env) {
+  const name = env.AV_AGENT_NAME?.trim();
+  if (!name) {
+    throw new Error(
+      "AV_AGENT_NAME is required \u2014 it names WHICH agent's service to act on. Re-run as: AV_AGENT_NAME=<agent-name> agentvault-claude-bridge <subcommand>"
+    );
+  }
+  return name;
+}
 function labelFor(env) {
-  return `dev.agentvault.bridge-${slugify2(env.AV_AGENT_NAME ?? "claude")}`;
+  return `dev.agentvault.bridge-${slugify2(requireAgentName(env))}`;
 }
 function legacyLabelFor(env) {
-  return `com.agentvault.claude-bridge.${slugify2(env.AV_AGENT_NAME ?? "claude")}`;
+  return `com.agentvault.claude-bridge.${slugify2(requireAgentName(env))}`;
 }
 function resolveLabel(backend, env) {
   const current = labelFor(env);
@@ -414,12 +423,23 @@ function resolveLabel(backend, env) {
 }
 function maybeRunServiceSubcommand(argv, env, deps) {
   const cmd = argv[2];
-  if (!cmd || !SERVICE_CMDS.has(cmd)) return false;
+  if (!cmd) return false;
+  if (!SERVICE_CMDS.has(cmd)) {
+    const looksLikeToken = cmd.startsWith("av_tok_");
+    const looksLikeFlag = cmd.startsWith("-");
+    if (!looksLikeToken && !looksLikeFlag) {
+      throw new Error(
+        `unknown subcommand: ${cmd} \u2014 expected one of ${[...SERVICE_CMDS].join(", ")}, an invite token, or no argument at all`
+      );
+    }
+    return false;
+  }
   const backend = deps?.backend ?? selectBackend(process.platform);
   const entrypoint = deps?.entrypoint ?? process.argv[1];
   const log = deps?.log ?? ((m6) => console.error("[bridge] " + m6));
   try {
     if (cmd === "install") {
+      requireAgentName(env);
       const cfg = loadConfig(env, []);
       if (!hasPersistedCreds(cfg.dataDir)) {
         throw new Error(
@@ -436,7 +456,9 @@ function maybeRunServiceSubcommand(argv, env, deps) {
       });
       backend.install(spec);
       log(`installed service ${spec.label} \u2014 logs: ${spec.logOut}`);
-      log(`check it with: agentvault-claude-bridge status`);
+      log(
+        `check it with: AV_AGENT_NAME=${cfg.agentName} agentvault-claude-bridge status`
+      );
     } else if (cmd === "uninstall") {
       const label = resolveLabel(backend, env);
       backend.uninstall(label);
@@ -532,6 +554,25 @@ var __toESM = (mod4, isNodeMode, target) => (target = mod4 != null ? __create(__
   isNodeMode || !mod4 || !mod4.__esModule ? __defProp2(target, "default", { value: mod4, enumerable: true }) : target,
   mod4
 ));
+function toEpoch(v22) {
+  if (typeof v22 === "bigint") return v22;
+  if (typeof v22 === "number") {
+    return Number.isFinite(v22) ? BigInt(Math.trunc(v22)) : null;
+  }
+  if (typeof v22 === "string" && /^\d+$/.test(v22)) return BigInt(v22);
+  return null;
+}
+function classifyCommitFailure(messageEpoch, groupEpoch) {
+  const msg = toEpoch(messageEpoch);
+  const grp = toEpoch(groupEpoch);
+  if (msg === null || grp === null) return "count";
+  return msg < grp ? "already-applied" : "count";
+}
+var init_mls_commit_classify = __esm2({
+  "src/mls-commit-classify.ts"() {
+    "use strict";
+  }
+});
 var __filename;
 var __dirname;
 var url2;
@@ -63879,7 +63920,7 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v22 = true ? "0.23.22" : FALLBACK;
+  const v22 = true ? "0.23.23" : FALLBACK;
   return `${PACKAGE}@${v22}`;
 }
 function buildClientVersion(override) {
@@ -64791,6 +64832,7 @@ var SecureChannel;
 var init_channel = __esm2({
   async "src/channel.ts"() {
     "use strict";
+    init_mls_commit_classify();
     await init_libsodium_wrappers();
     await init_dist();
     await init_dist();
@@ -65857,7 +65899,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.22" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.23" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67767,7 +67809,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.22" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.23" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -68091,7 +68133,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.22" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.23" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69497,7 +69539,14 @@ ${messageText}`;
                 console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                 this._mlsCommitFailCounts.delete(roomId);
               } catch (err) {
-                await this._onCommitFailure(roomId, groupId, err, `room ${roomId.slice(0, 8)}`);
+                await this._onCommitFailure(
+                  roomId,
+                  groupId,
+                  err,
+                  `room ${roomId.slice(0, 8)}`,
+                  data.epoch,
+                  mlsGroup.epoch
+                );
               }
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
@@ -69517,7 +69566,14 @@ ${messageText}`;
                 console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                 this._mlsCommitFailCounts.delete(`a2a:${chId}`);
               } catch (err) {
-                await this._onCommitFailure(`a2a:${chId}`, groupId, err, `A2A ${chId.slice(0, 8)}`);
+                await this._onCommitFailure(
+                  `a2a:${chId}`,
+                  groupId,
+                  err,
+                  `A2A ${chId.slice(0, 8)}`,
+                  data.epoch,
+                  mlsGroup.epoch
+                );
               }
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
@@ -69603,7 +69659,13 @@ ${messageText}`;
        * Never re-throws. The caller's only handler logs and drops, so throwing here
        * is indistinguishable from swallowing — it just moves the swallow one frame up.
        */
-      async _onCommitFailure(groupKey, mlsGroupId, err, label) {
+      async _onCommitFailure(groupKey, mlsGroupId, err, label, messageEpoch, groupEpoch) {
+        if (classifyCommitFailure(messageEpoch, groupEpoch) === "already-applied") {
+          console.debug(
+            `[SecureChannel] Skipping already-applied MLS commit for ${label} (commit epoch ${String(messageEpoch)} is behind group epoch ${String(groupEpoch)})`
+          );
+          return;
+        }
         const count = (this._mlsCommitFailCounts.get(groupKey) ?? 0) + 1;
         this._mlsCommitFailCounts.set(groupKey, count);
         console.error(
@@ -69951,7 +70013,8 @@ ${messageText}`;
           const candidateCount = candidates.filter(Boolean).length;
           const joined = await joinWithFirstMatchingKp(welcomeBytes, candidates);
           if (!joined) {
-            console.error(`[SecureChannel] No matching KeyPackage found for Welcome \u2014 cannot join group ${groupId?.slice(0, 8)}. The Welcome is encrypted to a published KP's public key; none of our ${candidateCount} candidate bundle(s) decrypted it. The existing Welcome recovery mechanism will re-request.`);
+            console.error(`[SecureChannel] No matching KeyPackage found for Welcome \u2014 cannot join group ${groupId?.slice(0, 8)}. The Welcome is encrypted to a published KP's public key; none of our ${candidateCount} candidate bundle(s) decrypted it. Requesting a re-Welcome with a fresh KeyPackage.`);
+            if (groupId) void this._requestWelcomeSelfHeal(groupId);
             return;
           }
           const mgr = joined.mgr;
@@ -71500,7 +71563,7 @@ ${messageText}`;
           return;
         }
         this._authFailedThisSession = true;
-        const authReason = data?.reason ?? "device_revoked";
+        const authReason = data?.reason ?? "unknown";
         console.warn(
           `[SecureChannel] connection_rejected (reason=${data?.reason ?? "unknown"}, retryable=false) \u2014 terminal; surfacing auth_failed`
         );
@@ -98081,7 +98144,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.22" : "0.0.0-dev";
+    VERSION = true ? "0.23.23" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -134435,7 +134498,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  logLine(`[bridge] version: ${true ? "0.7.14" : "dev"}`);
+  logLine(`[bridge] version: ${true ? "0.7.16" : "dev"}`);
   logLine(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   logLine(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -134467,7 +134530,7 @@ async function main() {
     // its default would render "@agentvault/agentvault@0.7.x" — the wrong
     // package name attached to the bridge's version number, which is worse
     // than either alone.
-    clientVersion: `@agentvault/claude-bridge@${true ? "0.7.14" : "dev"}`
+    clientVersion: `@agentvault/claude-bridge@${true ? "0.7.16" : "dev"}`
   });
   const agentSystemPrompt = cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`;
   const deviceJwt = () => {

package/dist/service/subcommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAiCD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CA4DT"}
+{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAuDD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CA0FT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.7.14",
+  "version": "0.7.16",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",
@@ -26,6 +26,7 @@
     "build": "npm --prefix ../plugin run build && tsc --emitDeclarationOnly && node build.mjs",
     "start": "node dist/index.js",
     "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.test.json",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {