@agentvault/claude-bridge 0.8.5 → 0.8.7

package/dist/index.js

@@ -64612,11 +64612,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v22 = true ? "0.23.32" : FALLBACK;
+  const v22 = true ? "0.23.34" : FALLBACK;
   return `${PACKAGE}@${v22}`;
 }
 function buildSha() {
-  const raw = true ? "564f8b1-dirty" : "";
+  const raw = true ? "6b305ca-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -65531,6 +65531,7 @@ var OUTBOUND_DEDUPE_MAX;
 var OUTBOUND_DEDUPE_TYPES;
 var RETRY_CANDIDATE_TTL_MS;
 var RETRY_CANDIDATE_MAX;
+var ROOM_FULFIL_COOLDOWN_MS;
 var SecureChannel;
 var init_channel = __esm2({
   async "src/channel.ts"() {
@@ -65576,6 +65577,7 @@ var init_channel = __esm2({
     OUTBOUND_DEDUPE_TYPES = /* @__PURE__ */ new Set(["text", "status_alert", "artifact", "attachment"]);
     RETRY_CANDIDATE_TTL_MS = 6e4;
     RETRY_CANDIDATE_MAX = 32;
+    ROOM_FULFIL_COOLDOWN_MS = 6e4;
     SecureChannel = class _SecureChannel extends EventEmitter {
       constructor(config22) {
         super();
@@ -65645,6 +65647,8 @@ var init_channel = __esm2({
       _drDeliveryPulling = false;
       /** MLS group managers per room/conversation (roomId or conv:conversationId or 1to1-group:groupId -> MLSGroupManager) */
       _mlsGroups = /* @__PURE__ */ new Map();
+      /** `${mlsGroupId}:${deviceId}` -> last re-admit ms (#1171). */
+      _roomFulfilCooldown = /* @__PURE__ */ new Map();
       /** Maps conversationId -> conversation_group_id for shared 1:1 MLS groups */
       _sessionGroupIds = /* @__PURE__ */ new Map();
       /** Consecutive MLS decrypt failure count per group key for epoch recovery. */
@@ -66810,7 +66814,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.32" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.34" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68748,7 +68752,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.32" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.34" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -69072,7 +69076,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.32" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.34" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69476,6 +69480,7 @@ var init_channel = __esm2({
         try {
           const cipherBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
           const result = await mgr.decrypt(cipherBytes);
+          if (mgrKey) this._mlsDecryptFailCounts.delete(mgrKey);
           const mlsGroupId = (convGroupId ? this._persisted?.mlsGroups?.[convGroupId]?.mlsGroupId : null) ?? this._persisted?.mlsConversations?.[convId]?.mlsGroupId ?? groupId;
           if (mlsGroupId) {
             await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
@@ -69580,6 +69585,10 @@ var init_channel = __esm2({
             this.config.onMessage(text, metadata);
           }
         } catch (decryptErr) {
+          if (classifyCommitFailure(data.epoch, mgr?.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS 1:1 message at epoch ${String(data.epoch)} predates our epoch ${String(mgr?.epoch)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = mgrKey || `unknown:${groupId}`;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -70421,6 +70430,7 @@ ${baseText}`;
         try {
           const ciphertext = Buffer.from(data.payload, "hex");
           const result = await mlsGroup.decrypt(new Uint8Array(ciphertext));
+          this._mlsDecryptFailCounts.delete(resolvedRoomId);
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
           if (result.isHandshake || !result.plaintext) {
             return;
@@ -70510,6 +70520,10 @@ ${baseText}`;
             console.error("[SecureChannel] onMessage callback error (MLS):", err);
           });
         } catch (err) {
+          if (classifyCommitFailure(data.epoch, mlsGroup.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS room message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup.epoch)} for ${resolvedRoomId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = resolvedRoomId;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -70761,13 +70775,7 @@ ${baseText}`;
         console.warn(`[SecureChannel] MLS epoch recovery for ${groupKey} (${mlsGroupId.slice(0, 8)})`);
         this._mlsGroups.delete(groupKey);
         this._mlsDecryptFailCounts.delete(groupKey);
-        try {
-          const { unlink: unlink2 } = await import("fs/promises");
-          const path2 = `${this.config.dataDir}/.mls-state/${mlsGroupId}.json`;
-          await unlink2(path2).catch(() => {
-          });
-        } catch {
-        }
+        await deleteMlsState(this.config.dataDir, mlsGroupId);
         try {
           const mgr = new MLSGroupManager();
           const identity = new TextEncoder().encode(this._deviceId);
@@ -70842,19 +70850,26 @@ ${baseText}`;
           return 0;
         }
         const snapshot = mlsGroup.exportState();
-        const { commit, welcome } = await mlsGroup.addMembers(targets.map((t22) => t22.keyPackage));
-        const commitSent = await this._sendFrameConfirmed(
-          {
-            event: "mls_commit",
-            data: {
-              group_id: mlsGroupId,
-              epoch: Number(mlsGroup.epoch),
-              payload: Buffer.from(commit).toString("hex")
-            }
-          },
-          `${label} commit`
-        );
-        if (!commitSent) {
+        const { commits, welcome } = await mlsGroup.reAdmitMembers(targets.map((t22) => t22.keyPackage));
+        let sentCommits = 0;
+        for (const c22 of commits) {
+          const ok2 = await this._sendFrameConfirmed(
+            {
+              event: "mls_commit",
+              data: {
+                group_id: mlsGroupId,
+                // The epoch this commit PRODUCED. After two commits the manager
+                // only knows the last one, which is why the result carries them.
+                epoch: Number(c22.epoch),
+                payload: Buffer.from(c22.commit).toString("hex")
+              }
+            },
+            `${label} commit ${sentCommits + 1}/${commits.length}`
+          );
+          if (!ok2) break;
+          sentCommits++;
+        }
+        if (sentCommits === 0) {
           mlsGroup.importState(snapshot);
           console.warn(
             `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
@@ -70862,6 +70877,12 @@ ${baseText}`;
           return 0;
         }
         await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+        if (sentCommits < commits.length) {
+          console.warn(
+            `[SecureChannel] ${label}: only ${sentCommits}/${commits.length} commits reached the wire \u2014 requests stay PENDING for the next pull`
+          );
+          return 0;
+        }
         if (!welcome) {
           console.warn(
             `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
@@ -71542,6 +71563,11 @@ ${baseText}`;
                 nackedIds.push(msg.queue_id);
                 if (msg.group_id && (msg.message_type === "commit" || msg.message_type === "application")) {
                   const failKey = msg.conversation_group_id ? `1to1-group:${msg.conversation_group_id}` : `group:${msg.group_id}`;
+                  const localMgr = msg.room_id && this._mlsGroups.get(msg.room_id) || this._mlsGroups.get(failKey);
+                  if (classifyCommitFailure(msg.epoch, localMgr?.epoch) === "already-applied") {
+                    console.debug(`[SecureChannel] Delivery ${msg.message_type} at epoch ${String(msg.epoch)} predates our epoch ${String(localMgr?.epoch)} \u2014 not counting toward recovery`);
+                    continue;
+                  }
                   const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
                   this._mlsDecryptFailCounts.set(failKey, count);
                   if (count >= _SecureChannel.MAX_MLS_DECRYPT_FAILS) {
@@ -71590,38 +71616,63 @@ ${baseText}`;
                 { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
               );
               if (!pendingRes.ok) continue;
-              const pending = await pendingRes.json();
+              let pending = await pendingRes.json();
               if (pending.length === 0) continue;
               console.log(`[SecureChannel] ${pending.length} pending Welcome requests for room ${roomId.slice(0, 8)}`);
+              const nowMs = Date.now();
+              const fresh = pending.filter((r22) => {
+                const key = `${roomState.mlsGroupId}:${r22.requesting_device_id}`;
+                const last = this._roomFulfilCooldown.get(key) ?? 0;
+                if (nowMs - last < ROOM_FULFIL_COOLDOWN_MS) {
+                  console.log(
+                    `[SecureChannel] skipping ${r22.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)} \u2014 re-admitted ${Math.round((nowMs - last) / 1e3)}s ago`
+                  );
+                  return false;
+                }
+                return true;
+              });
+              if (fresh.length === 0) continue;
+              for (const r22 of fresh) {
+                this._roomFulfilCooldown.set(`${roomState.mlsGroupId}:${r22.requesting_device_id}`, nowMs);
+              }
+              pending = fresh;
+              const deviceIds = pending.map((r22) => r22.requesting_device_id);
+              const kpRes = await fetch(
+                `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${deviceIds.join(",")}`,
+                { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+              );
+              if (!kpRes.ok) continue;
+              const kpData = await kpRes.json();
+              const roomTargets = [];
               for (const req of pending) {
-                try {
-                  const kpRes = await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
-                    { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                const kpHex = kpData[req.requesting_device_id];
+                if (!kpHex) {
+                  console.warn(`[SecureChannel] No KeyPackage for ${req.requesting_device_id.slice(0, 8)}, skipping`);
+                  continue;
+                }
+                const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
+                roomTargets.push({
+                  requestId: req.id,
+                  deviceId: req.requesting_device_id,
+                  keyPackage: MLSGroupManager.deserializeKeyPackage(kpBytes)
+                });
+              }
+              if (roomTargets.length === 0) continue;
+              try {
+                const done = await this._fulfilWelcomeRequests({
+                  mlsGroup,
+                  mlsGroupId: roomState.mlsGroupId,
+                  label: `room ${roomId.slice(0, 8)}`,
+                  welcomeFields: { room_id: roomId },
+                  targets: roomTargets
+                });
+                if (done > 0) {
+                  console.log(
+                    `[SecureChannel] Batched Welcome for ${done}/${roomTargets.length} device(s) in room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`
                   );
-                  if (!kpRes.ok) continue;
-                  const kpData = await kpRes.json();
-                  const kpHex = kpData[req.requesting_device_id];
-                  if (!kpHex) continue;
-                  const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
-                  const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const done = await this._fulfilWelcomeRequests({
-                    mlsGroup,
-                    mlsGroupId: roomState.mlsGroupId,
-                    label: `room ${roomId.slice(0, 8)}`,
-                    welcomeFields: { room_id: roomId },
-                    targets: [{
-                      requestId: req.id,
-                      deviceId: req.requesting_device_id,
-                      keyPackage: memberKp
-                    }]
-                  });
-                  if (done > 0) {
-                    console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
-                  }
-                } catch (fulfillErr) {
-                  console.warn(`[SecureChannel] Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                 }
+              } catch (fulfillErr) {
+                console.warn(`[SecureChannel] Batched Welcome failed for room ${roomId.slice(0, 8)}:`, fulfillErr);
               }
             } catch {
             }
@@ -72194,6 +72245,7 @@ ${baseText}`;
         try {
           const ciphertext = new Uint8Array(Buffer.from(data.payload, "hex"));
           const result = await mlsGroup.decrypt(ciphertext);
+          this._mlsDecryptFailCounts.delete(`a2a:${a2aChannelId}`);
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
           if (result.isHandshake || !result.plaintext) {
             return;
@@ -72214,6 +72266,10 @@ ${baseText}`;
             this.config.onA2AMessage(a2aMsg);
           }
         } catch (err) {
+          if (classifyCommitFailure(data.epoch, mlsGroup?.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS A2A message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup?.epoch)} for ${a2aChannelId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = `a2a:${a2aChannelId}`;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -99432,7 +99488,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.32" : "0.0.0-dev";
+    VERSION = true ? "0.23.34" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -135836,7 +135892,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  logLine(`[bridge] version: ${true ? "0.8.5" : "dev"}`);
+  logLine(`[bridge] version: ${true ? "0.8.7" : "dev"}`);
   logLine(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   logLine(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -135868,7 +135924,7 @@ async function main() {
     // its default would render "@agentvault/agentvault@0.7.x" — the wrong
     // package name attached to the bridge's version number, which is worse
     // than either alone.
-    clientVersion: `@agentvault/claude-bridge@${true ? "0.8.5" : "dev"}`
+    clientVersion: `@agentvault/claude-bridge@${true ? "0.8.7" : "dev"}`
   });
   const agentSystemPrompt = cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`;
   const deviceJwt = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",