@agentvault/claude-bridge 0.8.3 → 0.8.4

package/dist/index.js

@@ -64596,11 +64596,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v22 = true ? "0.23.30" : FALLBACK;
+  const v22 = true ? "0.23.31" : FALLBACK;
   return `${PACKAGE}@${v22}`;
 }
 function buildSha() {
-  const raw = true ? "1fff5d6" : "";
+  const raw = true ? "3e1243a-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -66348,6 +66348,118 @@ var init_channel = __esm2({
        * Encrypt and send a message to ALL owner devices (fanout).
        * Each session gets the same plaintext encrypted independently.
        */
+      /**
+       * #952 — sends held because MLS is expected for this conversation but the
+       * group is not joined yet.
+       *
+       * ⚠️ IN MEMORY ONLY. These entries hold PLAINTEXT. `_persisted` is written to
+       * disk, and the product's entire premise is that plaintext does not rest
+       * where it does not have to; a crash losing a held greeting is the correct
+       * trade. This is why the existing `outboundQueue` could not be reused — that
+       * one is persisted, and holds already-DR-encrypted bytes, which is exactly
+       * the encryption we are trying not to perform yet.
+       */
+      _mlsHold = /* @__PURE__ */ new Map();
+      /** How long a send waits for the Welcome. The two measured bursts were each
+       *  confined to a single minute, with the group already existing server-side
+       *  in the same second, so this is generous rather than tight. */
+      static MLS_HOLD_MS = 3e4;
+      /** Bound on held sends per group — see `_holdForMls`. */
+      static MLS_HOLD_MAX = 50;
+      /**
+       * Should this 1:1 send wait for MLS rather than go out over Double Ratchet?
+       *
+       * The discriminator exists at the moment of the bug: `_sessionGroupIds`
+       * already carries the conversation's group id — the server told us the group
+       * exists — while `_mlsGroups` has no usable manager for it. Group expected,
+       * group not ready.
+       *
+       * The negative case is load-bearing. A conversation with NO group id is
+       * legitimately Double Ratchet, and holding it would break owner-to-agent
+       * messaging outright, which is far worse than the bug this fixes. "Present"
+       * is also not "ready": a manager parked at epoch 0 has not joined (#1092),
+       * and reading presence as readiness is how #991 shipped.
+       */
+      _shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId) {
+        if (!convGroupId) return false;
+        const ready = Boolean(mlsGroup?.isInitialized) && Boolean(mlsGroupId) && Number(mlsGroup?.epoch) > 0;
+        return !ready;
+      }
+      /** Park a send until the Welcome lands, or until the hold expires. */
+      _holdForMls(convGroupId, convId, plaintext, options) {
+        let entry = this._mlsHold.get(convGroupId);
+        if (!entry) {
+          const timer = setTimeout(() => {
+            void this._releaseHeldOverDr(convGroupId);
+          }, _SecureChannel.MLS_HOLD_MS);
+          timer.unref?.();
+          entry = { items: [], timer };
+          this._mlsHold.set(convGroupId, entry);
+        }
+        if (entry.items.length >= _SecureChannel.MLS_HOLD_MAX) {
+          entry.items.shift();
+          console.warn(
+            `[SecureChannel] MLS hold full for group ${convGroupId.slice(0, 8)} \u2014 dropped the oldest held message`
+          );
+        }
+        entry.items.push({ convId, plaintext, options });
+        console.log(
+          `[SecureChannel] Holding send for group ${convGroupId.slice(0, 8)} until its Welcome lands (held=${entry.items.length})`
+        );
+      }
+      _takeHold(convGroupId) {
+        const entry = this._mlsHold.get(convGroupId);
+        if (!entry) return null;
+        clearTimeout(entry.timer);
+        this._mlsHold.delete(convGroupId);
+        return entry;
+      }
+      /** Re-drive one held send through the normal path, now that MLS is ready. */
+      async _resendHeld(item) {
+        await this.send(item.plaintext, {
+          ...item.options ?? {},
+          conversationId: item.convId,
+          bypassMlsHold: true
+        });
+      }
+      /** The Welcome landed — release everything held for this group, in order. */
+      async _flushMlsHold(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.log(
+          `[SecureChannel] Welcome landed for group ${convGroupId.slice(0, 8)} \u2014 releasing ${entry.items.length} held message(s) over MLS`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed to send after Welcome:", err);
+          }
+        }
+      }
+      /**
+       * The hold expired. Send over Double Ratchet exactly as before.
+       *
+       * This is deliberately NOT a drop. #853 and #831 are Welcomes that never
+       * arrive; under those an unbounded hold turns a lost minute into an agent
+       * that never speaks again. The hold removes the race — it must not invent a
+       * new failure mode. The warning is the part that is new: today the loss is
+       * silent.
+       */
+      async _releaseHeldOverDr(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.warn(
+          `[SecureChannel] No Welcome for group ${convGroupId.slice(0, 8)} within ${_SecureChannel.MLS_HOLD_MS}ms \u2014 releasing ${entry.items.length} message(s) over Double Ratchet. The recipient may not hold a ratchet with this device, in which case they are undeliverable (#952).`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed on Double Ratchet release:", err);
+          }
+        }
+      }
       async send(plaintext, options) {
         if (isAbstention(plaintext)) return;
         if (this._state === "error" || this._state === "idle") {
@@ -66509,6 +66621,10 @@ var init_channel = __esm2({
               );
               addressedMlsGroupIds.push(mlsGroupId);
               if (convGroupId) sentSharedGroupIds.add(convGroupId);
+            } else if (!options?.bypassMlsHold && this._shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId)) {
+              this._holdForMls(convGroupId, convId, plaintext, options);
+              sentCount++;
+              continue;
             } else {
               const encrypted = session.ratchet.encrypt(plaintext);
               const transport = encryptedMessageToTransport(encrypted);
@@ -66678,7 +66794,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.30" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.31" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68616,7 +68732,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.31" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -68940,7 +69056,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.31" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69356,11 +69472,13 @@ var init_channel = __esm2({
           let text = plaintext;
           let messageType = "text";
           let topicId = data.topic_id;
+          let mlsAttachment = null;
           try {
             const parsed = JSON.parse(plaintext);
             text = parsed.text ?? plaintext;
             messageType = parsed.type ?? "text";
             topicId = parsed.topicId ?? topicId;
+            if (parsed.attachment) mlsAttachment = parsed.attachment;
           } catch {
           }
           if (messageType === "history_catchup_request") {
@@ -69427,6 +69545,9 @@ var init_channel = __esm2({
               console.log(`[SecureChannel] Session ${convId.slice(0, 8)} activated via MLS message`);
             }
           }
+          if (mlsAttachment) {
+            text = await this._augmentWithAttachment(mlsAttachment, text);
+          }
           const metadata = {
             messageId: data.message_id ?? `mls_${Date.now()}`,
             conversationId: convId ?? this._primaryConversationId,
@@ -69676,6 +69797,65 @@ ${messageText}`;
        * Download an encrypted attachment blob, decrypt it, verify integrity,
        * and save the plaintext file to disk.
        */
+      /** Where an attachment may be written — always directly inside `attachDir` (#1143).
+       *
+       * The filename arrives INSIDE the envelope and is chosen by whoever sent the
+       * message. `join(attachDir, info.filename)` resolves `..` normally, so
+       * `../../agentvault.json` wrote over the device credential store. Only the
+       * final path component is honoured, and anything that is not a usable name
+       * falls back to a fixed one.
+       */
+      _safeAttachmentPath(attachDir, filename) {
+        const raw = String(filename ?? "");
+        const last = raw.split(/[\\/]/).pop() ?? "";
+        const cleaned = last.replace(/\0/g, "").trim();
+        const safe = cleaned === "" || cleaned === "." || cleaned === ".." ? "attachment.bin" : cleaned;
+        return join4(attachDir, safe);
+      }
+      /** Download an attachment and fold it into the text the agent sees (#1139).
+       *
+       * Extracted so the MLS receive path can use it too. It used to live inline in
+       * `_handleIncomingMessage`, which meant attachments worked on the Double
+       * Ratchet path ONLY — and hermes drops DR by design (`secure_channel.py:594`,
+       * "DR fallback is logged-and-dropped"), so no single transport could serve
+       * both client families. That is why an attachment reached ohtani and never
+       * reached smartcoder2 on 2026-08-31.
+       *
+       * Returns the text unchanged when there is no attachment or the fetch fails —
+       * but a failure is LOGGED and announced in the text, never silent.
+       */
+      async _augmentWithAttachment(attachmentInfo, baseText) {
+        if (!attachmentInfo) return baseText;
+        try {
+          const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
+          const mime = String(attachmentInfo.mime ?? "application/octet-stream");
+          const name = String(attachmentInfo.filename ?? "attachment");
+          const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
+          if (textMimes.some((m22) => mime.startsWith(m22))) {
+            const content = new TextDecoder().decode(decrypted);
+            return `[Attachment: ${name} (${mime}) saved to ${filePath}]
+---
+${content}
+---
+
+${baseText}`;
+          }
+          if (mime.startsWith("image/")) {
+            return `[Image attachment: ${name} saved to ${filePath}]
+Use your Read tool to view this image file.
+
+${baseText}`;
+          }
+          return `[Attachment: ${name} saved to ${filePath}]
+
+${baseText}`;
+        } catch (err) {
+          console.error("[SecureChannel] Failed to download attachment:", err);
+          return `[Attachment: ${String(attachmentInfo.filename ?? "file")} was sent but could not be retrieved: ${err}]
+
+${baseText}`;
+        }
+      }
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
         await mkdir3(attachDir, { recursive: true });
@@ -69695,7 +69875,7 @@ ${messageText}`;
         const fileKey = base64ToBytes(info.fileKey);
         const fileNonce = base64ToBytes(info.fileNonce);
         const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
-        const filePath = join4(attachDir, info.filename);
+        const filePath = this._safeAttachmentPath(attachDir, info.filename);
         await writeFile3(filePath, decrypted);
         console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
         return { filePath, decrypted };
@@ -71116,6 +71296,7 @@ ${messageText}`;
               await this._persistState();
             }
             console.log(`[SecureChannel] Joined shared 1:1 MLS group for group ${conversationGroupId.slice(0, 8)} via Welcome (epoch=${mgr.epoch})`);
+            await this._flushMlsHold(conversationGroupId);
             return;
           }
           if (conversationId) {
@@ -99229,7 +99410,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.30" : "0.0.0-dev";
+    VERSION = true ? "0.23.31" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -135633,7 +135814,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  logLine(`[bridge] version: ${true ? "0.8.3" : "dev"}`);
+  logLine(`[bridge] version: ${true ? "0.8.4" : "dev"}`);
   logLine(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   logLine(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -135665,7 +135846,7 @@ async function main() {
     // its default would render "@agentvault/agentvault@0.7.x" — the wrong
     // package name attached to the bridge's version number, which is worse
     // than either alone.
-    clientVersion: `@agentvault/claude-bridge@${true ? "0.8.3" : "dev"}`
+    clientVersion: `@agentvault/claude-bridge@${true ? "0.8.4" : "dev"}`
   });
   const agentSystemPrompt = cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`;
   const deviceJwt = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",