@agentvault/claude-bridge 0.8.11 → 0.8.12

package/dist/index.js

@@ -64612,11 +64612,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v22 = true ? "0.23.38" : FALLBACK;
+  const v22 = true ? "0.23.39" : FALLBACK;
   return `${PACKAGE}@${v22}`;
 }
 function buildSha() {
-  const raw = true ? "a6ce360-dirty" : "";
+  const raw = true ? "9982fc8-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -65719,6 +65719,27 @@ var init_channel = __esm2({
        * this process (GH #366). Cleared on (re)join so the next first message
        * re-fetches the authoritative roster. Prevents per-message refetch storms. */
       _roomRosterRefreshed = /* @__PURE__ */ new Set();
+      /**
+       * #1181: the last attachment saved per room, so the NEXT room turn can name
+       * it. wren saved an un-mentioned file (no reply, #1107), was asked "@wren can
+       * you read this file?" 14 s later, and answered "I don't see a file
+       * attached" — the note lived only in the prior history line. Hermes defers
+       * un-mentioned attachments and fetches on the next addressed turn (#1162);
+       * this is the plugin's equivalent surface. In-memory: a restart forgets it,
+       * which is the right default for "this file".
+       */
+      _recentRoomAttachments = /* @__PURE__ */ new Map();
+      static RECENT_ROOM_ATTACHMENT_MS = 10 * 60 * 1e3;
+      /** #1181: prefix a room turn that carries no attachment with the one saved in this room recently. */
+      _withRecentRoomAttachmentNote(roomId, text) {
+        const recent = this._recentRoomAttachments.get(roomId);
+        if (!recent) return text;
+        const ageMs = Date.now() - recent.at;
+        if (ageMs > _SecureChannel.RECENT_ROOM_ATTACHMENT_MS) return text;
+        return `[Most recent file in this room: ${recent.filePath} (${recent.name}, received ${Math.round(ageMs / 1e3)}s ago). If this message refers to "the file" or "this file", it means that one \u2014 use your Read tool on it.]
+
+${text}`;
+      }
       /** In-flight roster-refresh promises (per room) — dedup concurrent refreshes. */
       _roomRosterRefreshInFlight = /* @__PURE__ */ new Map();
       /** Dedup buffer for A2A message IDs (prevents double-delivery via direct + Redis) */
@@ -66814,7 +66835,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.38" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.39" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68752,7 +68773,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.38" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.39" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -69076,7 +69097,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.38" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.39" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69849,12 +69870,13 @@ ${messageText}`;
        * Returns the text unchanged when there is no attachment or the fetch fails —
        * but a failure is LOGGED and announced in the text, never silent.
        */
-      async _augmentWithAttachment(attachmentInfo, baseText) {
+      async _augmentWithAttachment(attachmentInfo, baseText, roomId) {
         if (!attachmentInfo) return baseText;
         try {
           const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
           const mime = String(attachmentInfo.mime ?? "application/octet-stream");
           const name = String(attachmentInfo.filename ?? "attachment");
+          if (roomId) this._recentRoomAttachments.set(roomId, { filePath, name, at: Date.now() });
           const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
           if (textMimes.some((m22) => mime.startsWith(m22))) {
             const content = new TextDecoder().decode(decrypted);
@@ -70484,7 +70506,9 @@ ${baseText}`;
             }
           }
           if (roomAttachment) {
-            messageText = await this._augmentWithAttachment(roomAttachment, messageText);
+            messageText = await this._augmentWithAttachment(roomAttachment, messageText, resolvedRoomId);
+          } else {
+            messageText = this._withRecentRoomAttachmentNote(resolvedRoomId, messageText);
           }
           const roomMembers = this._persisted?.rooms?.[resolvedRoomId]?.members ?? [];
           const senderMember = roomMembers.find((m22) => m22.deviceId === senderDeviceId);
@@ -99526,7 +99550,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.38" : "0.0.0-dev";
+    VERSION = true ? "0.23.39" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -134888,6 +134912,11 @@ var PersistentClaudeSession = class {
    *  which also prevents agent↔agent reply loops. Tool access is unaffected: it
    *  stays gated on currentAutoReply (owner DM) OR currentArmedGetter (armed room). */
   currentReplyExpected = false;
+  /** #1180: whether the say tool may deliver on this turn. Rooms pass an explicit
+   *  `replyExpected` (#1107: no @ → nobody replies) and that decides it; a 1:1 DM
+   *  passes none and say stays allowed there. Distinct from `currentReplyExpected`,
+   *  which drives only the #416 prose fallback and is false for un-attested DMs. */
+  currentSayAllowed = true;
   saidThisTurn = false;
   turnText = "";
   /** #630 drop-probe: did a `result` event arrive for the CURRENT turn? Reset per
@@ -134960,6 +134989,12 @@ var PersistentClaudeSession = class {
    *  back to opts.onSay. This is what closes the DM→room leak: the destination is
    *  the one captured for the message being answered, not a live global target. */
   async deliver(text) {
+    if (!this.currentSayAllowed) {
+      logLine(
+        `[session] say during a turn this agent does not owe (no @mention) \u2014 SUPPRESSED: ${JSON.stringify(text.slice(0, 80))}`
+      );
+      return;
+    }
     this.saidThisTurn = true;
     if (this.activeReply) await this.activeReply(text);
     else if (this.opts.onSay) await this.opts.onSay(text);
@@ -135001,6 +135036,7 @@ var PersistentClaudeSession = class {
       this.activeReply = item.reply;
       this.currentAutoReply = item.autoReplyOnText ?? false;
       this.currentReplyExpected = item.replyExpected ?? item.autoReplyOnText ?? false;
+      this.currentSayAllowed = item.replyExpected ?? true;
       this.currentArmedGetter = item.armed ?? (() => false);
       this.saidThisTurn = false;
       this.turnText = "";
@@ -135930,7 +135966,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  logLine(`[bridge] version: ${true ? "0.8.11" : "dev"}`);
+  logLine(`[bridge] version: ${true ? "0.8.12" : "dev"}`);
   logLine(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   logLine(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -135962,7 +135998,7 @@ async function main() {
     // its default would render "@agentvault/agentvault@0.7.x" — the wrong
     // package name attached to the bridge's version number, which is worse
     // than either alone.
-    clientVersion: `@agentvault/claude-bridge@${true ? "0.8.11" : "dev"}`
+    clientVersion: `@agentvault/claude-bridge@${true ? "0.8.12" : "dev"}`
   });
   const agentSystemPrompt = cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`;
   const deviceJwt = () => {

package/dist/session.d.ts

@@ -135,6 +135,11 @@ export declare class PersistentClaudeSession {
      *  which also prevents agent↔agent reply loops. Tool access is unaffected: it
      *  stays gated on currentAutoReply (owner DM) OR currentArmedGetter (armed room). */
     private currentReplyExpected;
+    /** #1180: whether the say tool may deliver on this turn. Rooms pass an explicit
+     *  `replyExpected` (#1107: no @ → nobody replies) and that decides it; a 1:1 DM
+     *  passes none and say stays allowed there. Distinct from `currentReplyExpected`,
+     *  which drives only the #416 prose fallback and is false for un-attested DMs. */
+    private currentSayAllowed;
     private saidThisTurn;
     private turnText;
     /** #630 drop-probe: did a `result` event arrive for the CURRENT turn? Reset per

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",