@agentvault/claude-bridge 0.7.4 → 0.7.6

package/dist/bridge.d.ts

@@ -34,6 +34,9 @@ export interface ArmingSnapshot {
  *  its ABSENCE is how we identify a true owner↔agent 1:1 DM. */
 export interface MessageMeta {
     roomId?: string;
+    /** #621 — set by SecureChannel when the message decrypted under the owner's
+     *  1:1 material. Gates the full-access DM lane; see the `message` handler. */
+    ownerDm1to1?: boolean;
 }
 /** #392 room hush (advisory) — emitted by SecureChannel from the backend's
  *  `room_hushed` event. ``hushedUntil`` is an ISO string, or null when cleared. */

package/dist/index.js

@@ -452,12 +452,13 @@ import { join as join11 } from "node:path";
 
 // ../plugin/dist/index.js
 import * as nc from "node:crypto";
-import { mkdir, readFile, writeFile, rm } from "node:fs/promises";
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { readFile, rm } from "node:fs/promises";
 import { join } from "node:path";
-import { mkdir as mkdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { readFile as readFile2, rename, rm as rm2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { Readable } from "node:stream";
-import { readdir, readFile as readFile3, writeFile as writeFile3, rename as rename2, stat, unlink, mkdir as mkdir3 } from "node:fs/promises";
+import { readdir, readFile as readFile3, writeFile as writeFile2, rename as rename2, stat, unlink, mkdir as mkdir2 } from "node:fs/promises";
 import { join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
@@ -465,7 +466,7 @@ import { createServer } from "node:http";
 import { randomUUID as randomUUID2, createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { homedir as osHomedir } from "node:os";
-import { writeFile as writeFile4, mkdir as mkdir4 } from "node:fs/promises";
+import { writeFile as writeFile3, mkdir as mkdir3 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 import { readFile as readFile4 } from "node:fs/promises";
 import WebSocket2 from "ws";
@@ -63664,16 +63665,39 @@ var init_dist = __esm2({
     init_mls_delivery_order();
   }
 });
+async function ensureSecureDir(dir) {
+  await mkdir(dir, { recursive: true, mode: DIR_MODE });
+  try {
+    await chmod(dir, DIR_MODE);
+  } catch {
+  }
+}
+async function writeSecureFile(filePath, data, flag) {
+  await writeFile(filePath, data, { encoding: "utf-8", mode: FILE_MODE, ...flag ? { flag } : {} });
+  try {
+    await chmod(filePath, FILE_MODE);
+  } catch {
+  }
+}
+var DIR_MODE;
+var FILE_MODE;
+var init_secure_file = __esm2({
+  "src/secure-file.ts"() {
+    "use strict";
+    DIR_MODE = 448;
+    FILE_MODE = 384;
+  }
+});
 function syncLockPath(dataDir, channelId) {
   const safe = channelId.replace(/[^a-zA-Z0-9_-]/g, "_");
   return join(dataDir, `mls-a2a-sync-${safe}.lock`);
 }
 async function acquireA2ASyncLock(dataDir, channelId) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const lockFile = syncLockPath(dataDir, channelId);
   const content = JSON.stringify({ pid: process.pid, timestamp: Date.now() });
   try {
-    await writeFile(lockFile, content, { encoding: "utf-8", mode: FILE_MODE, flag: "wx" });
+    await writeSecureFile(lockFile, content, "wx");
     return true;
   } catch (err) {
     if (err.code !== "EEXIST") throw err;
@@ -63684,7 +63708,7 @@ async function acquireA2ASyncLock(dataDir, channelId) {
         await rm(lockFile).catch(() => {
         });
         try {
-          await writeFile(lockFile, content, { encoding: "utf-8", mode: FILE_MODE, flag: "wx" });
+          await writeSecureFile(lockFile, content, "wx");
           return true;
         } catch {
           return false;
@@ -63714,7 +63738,7 @@ async function hasPendingWelcome(dataDir, groupId) {
   }
 }
 async function savePendingKpBundle(dataDir, groupId, kp, serializePublicFn) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const serialized = {
     publicPackageBytes: Buffer.from(serializePublicFn(kp.publicPackage)).toString("base64"),
     privatePackage: {
@@ -63723,7 +63747,7 @@ async function savePendingKpBundle(dataDir, groupId, kp, serializePublicFn) {
       signaturePrivateKey: Buffer.from(kp.privatePackage.signaturePrivateKey).toString("base64")
     }
   };
-  await writeFile(pendingKpPath(dataDir, groupId), JSON.stringify(serialized), { encoding: "utf-8", mode: FILE_MODE });
+  await writeSecureFile(pendingKpPath(dataDir, groupId), JSON.stringify(serialized));
 }
 async function loadPendingKpBundle(dataDir, groupId) {
   try {
@@ -63748,9 +63772,9 @@ async function clearPendingWelcome(dataDir, groupId) {
   }
 }
 async function saveMlsState(dataDir, groupId, state) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const filePath = join(dataDir, mlsFileName(groupId));
-  await writeFile(filePath, state, { encoding: "utf-8", mode: FILE_MODE });
+  await writeSecureFile(filePath, state);
 }
 async function loadMlsState(dataDir, groupId) {
   try {
@@ -63767,15 +63791,12 @@ async function deleteMlsState(dataDir, groupId) {
   } catch {
   }
 }
-var FILE_MODE;
-var DIR_MODE;
 var SYNC_LOCK_STALE_MS;
 var pendingKpPath;
 var init_mls_state = __esm2({
   "src/mls-state.ts"() {
     "use strict";
-    FILE_MODE = 384;
-    DIR_MODE = 448;
+    init_secure_file();
     SYNC_LOCK_STALE_MS = 5 * 60 * 1e3;
     pendingKpPath = (dataDir, groupId) => join(dataDir, `mls-kp-pending-${groupId.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
   }
@@ -63926,9 +63947,9 @@ var init_crypto_helpers = __esm2({
   }
 });
 async function saveState(dataDir, state) {
-  await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
+  await ensureSecureDir(dataDir);
   const filePath = join2(dataDir, STATE_FILE);
-  await writeFile2(filePath, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: FILE_MODE2 });
+  await writeSecureFile(filePath, JSON.stringify(state, null, 2));
   try {
     await rm2(join2(dataDir, LEGACY_STATE_FILE));
   } catch {
@@ -63945,8 +63966,8 @@ async function loadState(dataDir) {
   try {
     const raw = await readFile2(legacyPath, "utf-8");
     const parsed = JSON.parse(raw);
-    await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
-    await writeFile2(filePath, JSON.stringify(parsed, null, 2), { encoding: "utf-8", mode: FILE_MODE2 });
+    await ensureSecureDir(dataDir);
+    await writeSecureFile(filePath, JSON.stringify(parsed, null, 2));
     await rm2(legacyPath);
     return parsed;
   } catch {
@@ -63969,7 +63990,7 @@ async function backupState(dataDir) {
   const tmp = join2(dataDir, `${STATE_FILE}.bak.tmp`);
   try {
     const data = await readFile2(src, "utf-8");
-    await writeFile2(tmp, data, { encoding: "utf-8", mode: FILE_MODE2 });
+    await writeSecureFile(tmp, data);
     await rename(tmp, bak);
   } catch {
   }
@@ -63984,8 +64005,8 @@ async function restoreState(dataDir) {
     if (!parsed || !parsed.deviceId || !parsed.deviceJwt || !parsed.sessions || Object.keys(parsed.sessions).length === 0) {
       return false;
     }
-    await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
-    await writeFile2(join2(dataDir, STATE_FILE), data, { encoding: "utf-8", mode: FILE_MODE2 });
+    await ensureSecureDir(dataDir);
+    await writeSecureFile(join2(dataDir, STATE_FILE), data);
     return true;
   } catch {
     return false;
@@ -64048,16 +64069,13 @@ async function clearState(dataDir) {
 }
 var STATE_FILE;
 var LEGACY_STATE_FILE;
-var DIR_MODE2;
-var FILE_MODE2;
 var init_state = __esm2({
   async "src/state.ts"() {
     "use strict";
     await init_dist();
+    init_secure_file();
     STATE_FILE = "agentvault.json";
     LEGACY_STATE_FILE = "secure-channel.json";
-    DIR_MODE2 = 448;
-    FILE_MODE2 = 384;
   }
 });
 async function enrollDevice(apiUrl, inviteToken, identityPkHex, ephemeralPkHex, proofHex, platform) {
@@ -64486,11 +64504,11 @@ async function handleWorkspaceUpload(data, workspaceDir) {
   if (!verified) {
     return { status: "error", error: "Invalid signature \u2014 file may have been tampered with" };
   }
-  await mkdir3(workspaceDir, { recursive: true });
+  await mkdir2(workspaceDir, { recursive: true });
   const targetPath = join3(workspaceDir, data.filename);
   const tempPath = join3(workspaceDir, `.tmp_${randomUUID()}_${data.filename}`);
   try {
-    await writeFile3(tempPath, data.content, "utf-8");
+    await writeFile2(tempPath, data.content, "utf-8");
     await rename2(tempPath, targetPath);
   } catch (err) {
     try {
@@ -64616,6 +64634,8 @@ var OUTBOUND_DEDUPE_WINDOW_MS;
 var OUTBOUND_DEDUPE_MAX_SUPPRESS_MS;
 var OUTBOUND_DEDUPE_MAX;
 var OUTBOUND_DEDUPE_TYPES;
+var RETRY_CANDIDATE_TTL_MS;
+var RETRY_CANDIDATE_MAX;
 var SecureChannel;
 var init_channel = __esm2({
   async "src/channel.ts"() {
@@ -64653,6 +64673,8 @@ var init_channel = __esm2({
     OUTBOUND_DEDUPE_MAX_SUPPRESS_MS = 15e3;
     OUTBOUND_DEDUPE_MAX = 256;
     OUTBOUND_DEDUPE_TYPES = /* @__PURE__ */ new Set(["text", "status_alert", "artifact", "attachment"]);
+    RETRY_CANDIDATE_TTL_MS = 6e4;
+    RETRY_CANDIDATE_MAX = 32;
     SecureChannel = class _SecureChannel extends EventEmitter {
       constructor(config22) {
         super();
@@ -64772,6 +64794,20 @@ var init_channel = __esm2({
        * single delivery. In-memory only (short window; no cross-restart persistence needed).
        */
       _recentDeliveries = /* @__PURE__ */ new Map();
+      /**
+       * Last outbound plaintext per MLS group id (#732), so a message refused with
+       * `unknown group` can be resent once the map is reconciled.
+       *
+       * PLAINTEXT, not the frame: the refused frame's `payload` is ciphertext
+       * encrypted to a group that no longer exists, so replaying those bytes into
+       * the replacement group would store something nobody can decrypt. The retry
+       * has to encrypt again, which means keeping what was encrypted.
+       *
+       * In-memory only, TTL-bounded, and consumed on first use — this exists for
+       * the ~50ms between a frame reaching the socket and the server refusing it,
+       * not as a durable outbox (that is #688's dead-letter).
+       */
+      _retryCandidates = /* @__PURE__ */ new Map();
       _scanEngine = null;
       _scanRuleSetVersion = 0;
       _telemetryReporter = null;
@@ -64871,13 +64907,21 @@ var init_channel = __esm2({
        * Non-fatal: a transient network error or 5xx keeps the current JWT and
        * relies on the next reconnect. Terminal failures (401/403) surface via
        * the `auth_failed` event so callers can prompt the user to recover.
+       *
+       * Returns TRUE when the credentials are terminally dead. #743: the caller
+       * MUST NOT go on to open a WebSocket in that case — the server has already
+       * told us this credential can never be served, and connecting anyway is what
+       * produced `ws_guard action=denylist` on repeat in prod (device 0e87ff50, a
+       * hard-deleted device, ~12/hour). The verdict is returned explicitly rather
+       * than read back off `_authFailedThisSession`, whose lifetime is reset per
+       * connect and is easy to get subtly wrong.
        */
       async _maybeReissueDeviceJwt() {
         const jwt22 = this._persisted?.deviceJwt ?? this._deviceJwt;
-        if (!jwt22) return;
+        if (!jwt22) return false;
         const exp = this._decodeJwtExp(jwt22);
         const nowSec = Math.floor(Date.now() / 1e3);
-        if (exp - nowSec >= 30 * 86400) return;
+        if (exp - nowSec >= 30 * 86400) return false;
         try {
           const resp = await fetch(`${this.config.apiUrl}/api/v1/auth/reissue`, {
             method: "POST",
@@ -64897,7 +64941,7 @@ var init_channel = __esm2({
             } else {
               console.warn("[SecureChannel] reissue returned 200 but no device_jwt in response");
             }
-            return;
+            return false;
           }
           if (resp.status === 401 || resp.status === 403) {
             console.warn(`[SecureChannel] reissue rejected (${resp.status}); credentials need attention`);
@@ -64905,12 +64949,13 @@ var init_channel = __esm2({
             const reason = resp.status === 401 ? "device_jwt_expired" : "device_revoked";
             await this._postAuthFailedToBackend(reason);
             this.emit("auth_failed", { reason });
-            return;
+            return true;
           }
           console.warn(`[SecureChannel] reissue ${resp.status}; keeping current jwt`);
         } catch (err) {
           console.warn("[SecureChannel] reissue network error; keeping current jwt:", err);
         }
+        return false;
       }
       /**
        * Wraps `fetch` for authenticated AV REST endpoints with reactive device-JWT
@@ -65396,7 +65441,9 @@ var init_channel = __esm2({
           }
           scanStatus = scanResult.status;
         }
-        this._appendHistory("agent", plaintext, topicId);
+        if (!options?.isResend) {
+          this._appendHistory("agent", plaintext, topicId);
+        }
         const roomConvIds = /* @__PURE__ */ new Set();
         if (this._persisted?.rooms) {
           for (const room of Object.values(this._persisted.rooms)) {
@@ -65410,6 +65457,7 @@ var init_channel = __esm2({
         let sentCount = 0;
         const pendingWsSends = [];
         const sentSharedGroupIds = /* @__PURE__ */ new Set();
+        const addressedMlsGroupIds = [];
         if (this._persisted?.mlsGroups && this._state === "ready" && this._ws) {
           const targetSharedGid = targetConvId ? this._sessionGroupIds?.get(targetConvId) : void 0;
           for (const [gid, entry] of Object.entries(this._persisted.mlsGroups)) {
@@ -65435,6 +65483,7 @@ var init_channel = __esm2({
               if (this._persisted?.hubAddress) payload.hub_address = this._persisted.hubAddress;
               if (this._persisted?.hubId) payload.sender_hub_id = this._persisted.hubId;
               pendingWsSends.push(JSON.stringify({ event: "message_mls", data: payload }));
+              addressedMlsGroupIds.push(entry.mlsGroupId);
               sentSharedGroupIds.add(gid);
               sentCount++;
               console.log(`[SecureChannel] Shared MLS group send for group ${gid.slice(0, 8)} (${entry.mlsGroupId.slice(0, 8)})`);
@@ -65487,6 +65536,7 @@ var init_channel = __esm2({
                   data: payload
                 })
               );
+              addressedMlsGroupIds.push(mlsGroupId);
               if (convGroupId) sentSharedGroupIds.add(convGroupId);
             } else {
               const encrypted = session.ratchet.encrypt(plaintext);
@@ -65572,6 +65622,7 @@ var init_channel = __esm2({
               if (this._persisted?.hubAddress) payload.hub_address = this._persisted.hubAddress;
               if (this._persisted?.hubId) payload.sender_hub_id = this._persisted.hubId;
               pendingWsSends.push(JSON.stringify({ event: "message_mls", data: payload }));
+              addressedMlsGroupIds.push(resolvedMlsGroupId);
               sentCount++;
               if (mlsOnlyConvGroupId) sentSharedGroupIds.add(mlsOnlyConvGroupId);
               console.log(`[SecureChannel] MLS-only send for conv ${mlsConvId.slice(0, 8)} (no DR session)`);
@@ -65587,6 +65638,28 @@ var init_channel = __esm2({
         for (const frame of pendingWsSends) {
           this._ws.send(frame);
         }
+        if (!options?.isResend) {
+          for (const mlsGroupId of addressedMlsGroupIds) {
+            this._rememberRetryCandidate(mlsGroupId, plaintext, options);
+          }
+        }
+      }
+      /**
+       * Retain one outbound plaintext against the MLS group it was sent to (#732).
+       * Evicts expired entries, then the oldest, so the map cannot grow unbounded
+       * on an agent that sends steadily and is never refused.
+       */
+      _rememberRetryCandidate(mlsGroupId, plaintext, options) {
+        const now = Date.now();
+        for (const [k2, v22] of this._retryCandidates) {
+          if (now - v22.ts > RETRY_CANDIDATE_TTL_MS) this._retryCandidates.delete(k2);
+        }
+        this._retryCandidates.set(mlsGroupId, { plaintext, options, ts: now });
+        while (this._retryCandidates.size > RETRY_CANDIDATE_MAX) {
+          const oldest = this._retryCandidates.keys().next().value;
+          if (!oldest) break;
+          this._retryCandidates.delete(oldest);
+        }
       }
       /**
        * Send a typing indicator to all owner devices.
@@ -65614,7 +65687,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.14" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.18" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -65959,13 +66032,20 @@ var init_channel = __esm2({
        * entry, then persist.
        */
       async _handleServerError(payload) {
-        if (payload?.detail !== "conversation deleted") return;
+        const detail = payload?.detail;
+        if (detail !== "conversation deleted" && detail !== "unknown group") return;
         const mlsGroupId = payload.group_id;
         if (!mlsGroupId) return;
         const groups = this._persisted?.mlsGroups;
         if (!groups) return;
         const gid = Object.keys(groups).find((k2) => groups[k2]?.mlsGroupId === mlsGroupId);
         if (!gid) return;
+        if (detail === "unknown group") {
+          const changed = await this._reconcileConversationGroups(gid, mlsGroupId);
+          if (changed) await this._retryAfterReconcile(mlsGroupId);
+          return;
+        }
+        this._retryCandidates.delete(mlsGroupId);
         try {
           await deleteMlsState(this.config.dataDir, mlsGroupId);
         } catch {
@@ -65978,6 +66058,120 @@ var init_channel = __esm2({
         );
         this.emit("dm_group_pruned", { conversationGroupId: gid, mlsGroupId });
       }
+      /**
+       * Re-resolve the conversation→group map from the server (#719).
+       *
+       * `_persisted.conversationGroupIds` and `_persisted.groupId` are built ONCE,
+       * in `_activate()`, from the activation response. `_activate` runs at
+       * enrollment and never again, so when the owner deletes a conversation and a
+       * new one is created the agent keeps addressing the OLD group forever.
+       * Nothing reconciled it — not restart (the stale map is reloaded from disk),
+       * not reconnect, not the heartbeat.
+       *
+       * wren, 2026-07-31: `groupId` 53798dd2 had no `mls_groups` row while three
+       * ACTIVE conversations sat on 99faf707. Inbound worked, every reply was
+       * refused `unknown group` and dropped. Silent since 2026-07-02 — the #460
+       * fan-out was spraying all 12 known groups, so a live one always got hit.
+       *
+       * Best-effort and conservative, mirroring `_refreshRoomRoster`: on any
+       * failure the existing map is kept. The prune is NARROW — only the group the
+       * server named, and only once the server has positively reported an active
+       * conversation on some other group. Absence of data is never treated as
+       * evidence of deletion.
+       *
+       * Returns TRUE only when the PRIMARY group pointer actually moved, which is
+       * the signal #732's resend is gated on. Deliberately narrower than "anything
+       * in the map changed": if some other group went stale we cannot tell which
+       * conversation replaced it, and delivering a reply to the wrong counterparty
+       * is strictly worse than losing it.
+       */
+      async _reconcileConversationGroups(staleGid, staleMlsGroupId) {
+        const jwt22 = this._deviceJwt ?? this._persisted?.deviceJwt;
+        if (!jwt22 || !this._persisted) return false;
+        let rows;
+        try {
+          const res = await fetch(`${this.config.apiUrl}/api/v1/conversations`, {
+            headers: { Authorization: `Bearer ${jwt22}` }
+          });
+          if (!res.ok) return false;
+          rows = await res.json();
+        } catch (err) {
+          console.warn("[SecureChannel] Conversation re-resolve failed:", err);
+          return false;
+        }
+        if (!Array.isArray(rows)) return false;
+        const mine = rows.filter(
+          (r22) => r22?.agent_device_id === this._deviceId && r22?.status === "active" && typeof r22?.group_id === "string" && typeof r22?.id === "string"
+        );
+        if (mine.length === 0) return false;
+        const before = this._persisted.groupId;
+        this._sessionGroupIds = new Map(mine.map((r22) => [r22.id, r22.group_id]));
+        this._persisted.conversationGroupIds = Object.fromEntries(this._sessionGroupIds);
+        const primary = mine.find((r22) => r22.id === this._persisted.primaryConversationId) ?? mine[0];
+        this._persisted.groupId = primary.group_id;
+        this._persisted.primaryConversationId = primary.id;
+        const liveGroupIds = new Set(mine.map((r22) => r22.group_id));
+        if (!liveGroupIds.has(staleGid)) {
+          try {
+            await deleteMlsState(this.config.dataDir, staleMlsGroupId);
+          } catch {
+          }
+          this._mlsGroups.delete(`1to1-group:${staleGid}`);
+          delete this._persisted.mlsGroups?.[staleGid];
+          this.emit("dm_group_pruned", {
+            conversationGroupId: staleGid,
+            mlsGroupId: staleMlsGroupId
+          });
+        }
+        await this._persistState();
+        console.log(
+          `[SecureChannel] Re-resolved conversation groups after 'unknown group' ${staleMlsGroupId.slice(0, 8)}: primary group ${String(before).slice(0, 8)} \u2192 ${this._persisted.groupId.slice(0, 8)} (${mine.length} active conversation(s))`
+        );
+        return this._persisted.groupId !== before && before === staleGid;
+      }
+      /**
+       * Resend the message that a now-reconciled `unknown group` refusal killed (#732).
+       *
+       * Called ONLY after `_reconcileConversationGroups` reported that the primary
+       * group pointer moved off the refused group, so there is exactly one sensible
+       * destination: the conversation the reconcile settled on.
+       *
+       * The candidate is consumed BEFORE the resend, not after — one attempt is the
+       * bound, and that must hold even if the resend itself throws. A retry that
+       * re-armed on failure would turn a persistent refusal into an infinite loop,
+       * which is a worse failure than the dropped message it set out to fix.
+       *
+       * The resend is always TARGETED, never a broadcast: the original send may
+       * have fanned out to several groups of which only one was refused, and
+       * re-broadcasting would duplicate the message in all the others.
+       */
+      async _retryAfterReconcile(staleMlsGroupId) {
+        const candidate = this._retryCandidates.get(staleMlsGroupId);
+        this._retryCandidates.delete(staleMlsGroupId);
+        if (!candidate) return;
+        if (Date.now() - candidate.ts > RETRY_CANDIDATE_TTL_MS) {
+          console.warn(
+            `[deliver] delivery_result=LOST group=${staleMlsGroupId.slice(0, 8)} reason=retry-window-expired`
+          );
+          return;
+        }
+        const conversationId = this._persisted?.primaryConversationId;
+        if (!conversationId) return;
+        try {
+          await this.send(candidate.plaintext, {
+            ...candidate.options,
+            conversationId,
+            isResend: true
+          });
+          console.log(
+            `[deliver] delivery_result=RESENT group=${staleMlsGroupId.slice(0, 8)} \u2192 ${String(this._persisted?.groupId).slice(0, 8)} conv=${conversationId.slice(0, 8)}`
+          );
+        } catch (err) {
+          console.error(
+            `[deliver] delivery_result=LOST group=${staleMlsGroupId.slice(0, 8)} reason=resend-failed detail=${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      }
       /**
        * Return info for all joined rooms.
        */
@@ -66350,7 +66544,7 @@ var init_channel = __esm2({
             });
           }
           const targetLabel = resolved.kind === "owner" ? "owner" : `${resolved.kind}:${resolved.id?.slice(0, 8)}...`;
-          console.log(`[deliver] target=${targetLabel} content=${content.type} result=ok`);
+          console.log(`[deliver] target=${targetLabel} content=${content.type} result=sent`);
           if (dedupeKey) {
             try {
               const now = Date.now();
@@ -67244,13 +67438,12 @@ var init_channel = __esm2({
             sessions,
             messageHistory: this._persisted.messageHistory ?? []
           };
-          if (conversations.length > 0) {
-            const firstConv = conversations[0];
-            if (firstConv.group_id) {
-              this._persisted.groupId = firstConv.group_id;
+          if (primary) {
+            if (primary.group_id) {
+              this._persisted.groupId = primary.group_id;
             }
-            if (firstConv.default_topic_id) {
-              this._persisted.defaultTopicId = firstConv.default_topic_id;
+            if (primary.default_topic_id) {
+              this._persisted.defaultTopicId = primary.default_topic_id;
             }
           }
           this._sessionGroupIds = /* @__PURE__ */ new Map();
@@ -67312,7 +67505,13 @@ var init_channel = __esm2({
           this._ws = null;
         }
         this._setState("connecting");
-        await this._maybeReissueDeviceJwt();
+        if (await this._maybeReissueDeviceJwt()) {
+          console.warn(
+            "[SecureChannel] credentials are terminally dead \u2014 aborting connect (no WS attempt)"
+          );
+          this._setState("error");
+          return;
+        }
         const wsUrl = this.config.apiUrl.replace(/^http/, "ws");
         const url22 = `${wsUrl}/api/v1/ws?token=${encodeURIComponent(this._deviceJwt)}&device_id=${this._deviceId}`;
         const ws = new WebSocket2(url22);
@@ -67353,7 +67552,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.14" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.18" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67422,7 +67621,12 @@ var init_channel = __esm2({
           try {
             const data = JSON.parse(raw.toString());
             if (data.event && data.event !== "ping" && data.event !== "typing") {
-              console.log(`[SecureChannel] WS event: ${data.event} conv=${(data.conversation_id || data.data?.conversation_id || "").toString().slice(0, 8)}`);
+              const d22 = data.data ?? {};
+              const conv = (data.conversation_id || d22.conversation_id || "").toString();
+              const parts = [`conv=${conv.slice(0, 8)}`];
+              if (d22.group_id) parts.push(`group=${String(d22.group_id).slice(0, 8)}`);
+              if (d22.detail) parts.push(`detail=${d22.detail}`);
+              console.log(`[SecureChannel] WS event: ${data.event} ${parts.join(" ")}`);
             }
             if (data.event === "ping") {
               ws.send(JSON.stringify({ event: "pong" }));
@@ -67671,7 +67875,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.14" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.18" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -67980,6 +68184,10 @@ var init_channel = __esm2({
             }
             if (data.event === "error") {
               const detail = data.data?.detail || data.detail || "Unknown server error";
+              const rejectedGroup = String(data.data?.group_id ?? "").slice(0, 8);
+              console.error(
+                `[deliver] delivery_result=REJECTED group=${rejectedGroup || "unknown"} detail=${detail}`
+              );
               console.error(`[SecureChannel] Server error: ${detail}`);
               await this._handleServerError(data.data || data);
               this.emit("error", new Error(`Server: ${detail}`));
@@ -68151,6 +68359,10 @@ var init_channel = __esm2({
             conversationId: convId ?? this._primaryConversationId,
             timestamp: data.created_at ?? (/* @__PURE__ */ new Date()).toISOString(),
             topicId,
+            // #621: positive attestation that this decrypted under the OWNER'S 1:1
+            // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+            // that a roomId was absent. The bridge's full-access DM lane requires it.
+            ownerDm1to1: true,
             messageType
           };
           this.emit("message", text, metadata);
@@ -68393,7 +68605,7 @@ ${messageText}`;
        */
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
-        await mkdir4(attachDir, { recursive: true });
+        await mkdir3(attachDir, { recursive: true });
         const url22 = `${this.config.apiUrl}${info.blobUrl}`;
         const res = await fetch(url22, {
           headers: { Authorization: `Bearer ${this._deviceJwt}` }
@@ -68411,7 +68623,7 @@ ${messageText}`;
         const fileNonce = base64ToBytes(info.fileNonce);
         const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
         const filePath = join4(attachDir, info.filename);
-        await writeFile4(filePath, decrypted);
+        await writeFile3(filePath, decrypted);
         console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
         return { filePath, decrypted };
       }
@@ -69066,10 +69278,10 @@ ${messageText}`;
                 await mlsGroup.processCommit(commitBytes);
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
+                this._mlsCommitFailCounts.delete(roomId);
               } catch (err) {
                 await this._onCommitFailure(roomId, groupId, err, `room ${roomId.slice(0, 8)}`);
               }
-              this._mlsCommitFailCounts.delete(roomId);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -69086,10 +69298,10 @@ ${messageText}`;
                 await mlsGroup.processCommit(commitBytes);
                 await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
                 console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
+                this._mlsCommitFailCounts.delete(`a2a:${chId}`);
               } catch (err) {
                 await this._onCommitFailure(`a2a:${chId}`, groupId, err, `A2A ${chId.slice(0, 8)}`);
               }
-              this._mlsCommitFailCounts.delete(`a2a:${chId}`);
             } else {
               this._bufferMlsCommit(groupId, epoch, data);
               console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
@@ -69431,7 +69643,7 @@ ${messageText}`;
             console.warn("[SecureChannel] KeyPackage pool replenish after join failed:", err);
           });
           console.log(`[SecureChannel] Welcome joined: group=${groupId?.slice(0, 8)} kpSource=${kpSource} welcomeLen=${welcomeBytes.length} candidates=${candidateCount} poolRemaining=${this._pendingKpBundles.length}`);
-          if (conversationGroupId) {
+          if (conversationGroupId && !data.room_id) {
             const key = `1to1-group:${conversationGroupId}`;
             this._mlsGroups.set(key, mgr);
             await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
@@ -70252,7 +70464,11 @@ ${messageText}`;
                   messageId: msg.message_id,
                   conversationId: msg.conversation_id,
                   timestamp: msg.created_at,
-                  topicId
+                  topicId,
+                  // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                  // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                  // that a roomId was absent. The bridge's full-access DM lane requires it.
+                  ownerDm1to1: true
                 };
                 this.emit("message", messageText, metadata);
                 Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -70584,7 +70800,11 @@ ${messageText}`;
                     messageId: msg.id,
                     conversationId: msg.conversation_id,
                     timestamp: msg.created_at,
-                    topicId
+                    topicId,
+                    // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                    // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                    // that a roomId was absent. The bridge's full-access DM lane requires it.
+                    ownerDm1to1: true
                   };
                   this.emit("message", messageText, metadata);
                   Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -70865,7 +71085,11 @@ ${messageText}`;
                     messageId: msg.id,
                     conversationId: msg.conversation_id,
                     timestamp: msg.created_at,
-                    topicId
+                    topicId,
+                    // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                    // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                    // that a roomId was absent. The bridge's full-access DM lane requires it.
+                    ownerDm1to1: true
                   };
                   this.emit("message", messageText, metadata);
                   Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -70959,7 +71183,7 @@ ${messageText}`;
           return;
         }
         this._authFailedThisSession = true;
-        const authReason = data?.reason === "device_jwt_expired" ? "device_jwt_expired" : "device_revoked";
+        const authReason = data?.reason ?? "device_revoked";
         console.warn(
           `[SecureChannel] connection_rejected (reason=${data?.reason ?? "unknown"}, retryable=false) \u2014 terminal; surfacing auth_failed`
         );
@@ -71123,6 +71347,14 @@ function terminalReenrollMessage(agentName, reason) {
   const who = agentName ? `[${agentName}] ` : "";
   return `${who}device is no longer valid (${reason}) \u2014 it was revoked or replaced. Re-enroll with a fresh token from AgentVault; the old credentials are dead. This agent will stop reconnecting.`;
 }
+function formatChannelError(err) {
+  const msg = String(err);
+  const rejection = /Server: (.+)$/.exec(msg);
+  if (rejection) {
+    return `[AgentVault] DELIVERY FAILED \u2014 the server refused this frame: ${rejection[1]}. The connection survives; this message was dropped and nothing retries it.`;
+  }
+  return `[AgentVault] channel error (non-fatal to the connection): ${msg}`;
+}
 function attachLifecycle(channel, opts = {}) {
   const log = opts.log ?? (() => {
   });
@@ -71323,7 +71555,7 @@ var init_openclaw_plugin = __esm2({
             });
             _channels.set(account.accountId, channel);
             channel.on("error", (err) => {
-              _log?.(`[AgentVault] channel error (non-fatal): ${String(err)}`);
+              _log?.(formatChannelError(err));
             });
             attachLifecycle(channel, {
               agentName: account.agentName,
@@ -71460,6 +71692,11 @@ var init_fetch_interceptor = __esm2({
     traceStore = new AsyncLocalStorage();
   }
 });
+var init_tool_audit = __esm2({
+  "src/tool-audit.ts"() {
+    "use strict";
+  }
+});
 var isUsingManagedRoutes;
 var init_openclaw_entry = __esm2({
   "src/openclaw-entry.ts"() {
@@ -71469,6 +71706,7 @@ var init_openclaw_entry = __esm2({
     init_http_handlers();
     init_openclaw_compat();
     init_lifecycle();
+    init_tool_audit();
     init_types();
     isUsingManagedRoutes = false;
   }
@@ -97520,7 +97758,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.14" : "0.0.0-dev";
+    VERSION = true ? "0.23.18" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -118831,8 +119069,8 @@ import { mkdirSync as mkdirSync3, writeFileSync, rmSync as rmSync2, readdirSync
 import { join as join6 } from "node:path";
 import { homedir, hostname as hostname3 } from "node:os";
 var TRUST_SUBDIR = "host-trust";
-var DIR_MODE3 = 448;
-var FILE_MODE3 = 384;
+var DIR_MODE2 = 448;
+var FILE_MODE2 = 384;
 var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 var IDENTITY_FILES = ["agentvault.json", "secure-channel.json", "agentvault.json.bak"];
 var HostTrustError = class extends Error {
@@ -118859,15 +119097,15 @@ function grant(deviceId, root3) {
   const id = sanitize(deviceId);
   const dir = trustDir(root3);
   const p2 = join6(dir, id);
-  mkdirSync3(dir, { recursive: true, mode: DIR_MODE3 });
+  mkdirSync3(dir, { recursive: true, mode: DIR_MODE2 });
   writeFileSync(
     p2,
     `granted_at=${(/* @__PURE__ */ new Date()).toISOString()} host=${hostname3()}
 `,
-    { mode: FILE_MODE3 }
+    { mode: FILE_MODE2 }
   );
-  chmodSync2(dir, DIR_MODE3);
-  chmodSync2(p2, FILE_MODE3);
+  chmodSync2(dir, DIR_MODE2);
+  chmodSync2(p2, FILE_MODE2);
 }
 function revoke(deviceId, root3) {
   const id = sanitize(deviceId);
@@ -133641,9 +133879,14 @@ function wireBridge(channel, session, target, opts = {}) {
   });
   channel.on("message", (text, metadata) => {
     if (metadata?.roomId) return;
-    log("inbound 1:1 DM from owner");
+    const ownerAttested = metadata?.ownerDm1to1 === true;
+    if (!ownerAttested) {
+      log("inbound 1:1 DM WITHOUT owner attestation \u2014 delivering to the locked listener (no tools)");
+    } else {
+      log("inbound 1:1 DM from owner");
+    }
     target.setDm();
-    session.push(text, target.snapshotReply(channel, log), { autoReplyOnText: true });
+    session.push(text, target.snapshotReply(channel, log), { autoReplyOnText: ownerAttested });
   });
   const workerCapable = !!opts.workspaceDir;
   const osIsolated = opts.osIsolated !== void 0 ? opts.osIsolated : process.env.AV_WORKER_OS_ISOLATED === "1" || process.env.AV_WORKER_OS_ISOLATED === "true";
@@ -133784,7 +134027,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.7.4" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.7.6" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "type": "module",
-  "description": "AgentVault Claude Bridge \u2014 daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
+  "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {