@agentvault/claude-bridge 0.8.8 → 0.8.10

package/dist/index.js

@@ -52059,7 +52059,10 @@ async function applyProposals(state, proposals, committerLeafIndex, pskSearch, s
     const [mutatedTree, addedLeafNodes] = await applyTreeMutations(state.ratchetTree, grouped, state.groupContext, sentByClient, state.clientConfig.authService, state.clientConfig.lifetimeConfig, cs.signature);
     const [updatedPskSecret, pskIds] = await accumulatePskSecret(grouped.psk.map((p2) => p2.proposal.psk.preSharedKeyId), pskSearch, cs, zeroes);
     const selfRemoved = mutatedTree[leafToNodeIndex(toLeafIndex(state.privatePath.leafIndex))] === void 0;
-    const needsUpdatePath = allProposals.length === 0 || Object.values(grouped.update).length > 1 || Object.values(grouped.remove).length > 1;
+    const needsUpdatePath = allProposals.length === 0 || allProposals.some(({ proposal }) => {
+      const t22 = proposal.proposalType;
+      return t22 !== "add" && t22 !== "psk" && t22 !== "reinit";
+    });
     return {
       tree: mutatedTree,
       pskSecret: updatedPskSecret,
@@ -64607,11 +64610,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v22 = true ? "0.23.35" : FALLBACK;
+  const v22 = true ? "0.23.37" : FALLBACK;
   return `${PACKAGE}@${v22}`;
 }
 function buildSha() {
-  const raw = true ? "bcb9297-dirty" : "";
+  const raw = true ? "58c552f-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -66809,7 +66812,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.35" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.37" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68747,7 +68750,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.35" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.37" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -69071,7 +69074,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.35" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.37" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -70845,6 +70848,7 @@ ${baseText}`;
           return 0;
         }
         const snapshot = mlsGroup.exportState();
+        let parent2 = await this._readGroupHeadDigest(mlsGroupId);
         const { commits, welcome } = await mlsGroup.reAdmitMembers(targets.map((t22) => t22.keyPackage));
         let sentCommits = 0;
         for (const c22 of commits) {
@@ -70856,12 +70860,14 @@ ${baseText}`;
                 // The epoch this commit PRODUCED. After two commits the manager
                 // only knows the last one, which is why the result carries them.
                 epoch: Number(c22.epoch),
-                payload: Buffer.from(c22.commit).toString("hex")
+                payload: Buffer.from(c22.commit).toString("hex"),
+                ...parent2 ? { parent_digest: parent2 } : {}
               }
             },
             `${label} commit ${sentCommits + 1}/${commits.length}`
           );
           if (!ok2) break;
+          parent2 = this._commitDigest(c22.commit);
           sentCommits++;
         }
         if (sentCommits === 0) {
@@ -70948,6 +70954,32 @@ ${baseText}`;
       _wsIsOpen() {
         return this._ws?.readyState === 1;
       }
+      /** SHA-256 hex of a commit's bytes — its identity on the server (#1175/#1177). */
+      _commitDigest(bytes) {
+        return createHash("sha256").update(bytes).digest("hex");
+      }
+      /**
+       * #1177: the digest of the commit at the server's head, or undefined.
+       *
+       * Undefined covers "no head yet", "older backend", AND "could not read" —
+       * deliberately the same value. The commit is sent either way: the server
+       * skips the parent check for an ABSENT field and refuses a MALFORMED one,
+       * so a read failure must degrade to "unchecked", never to "blocked" (a
+       * rescue that cannot run is the 2026-09-04 lockout) and never to `null`.
+       */
+      async _readGroupHeadDigest(groupId) {
+        try {
+          const res = await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${groupId}`, {
+            headers: { Authorization: `Bearer ${this._deviceJwt}` }
+          });
+          if (!res.ok) return void 0;
+          const head = await res.json();
+          const d22 = head?.last_commit_digest;
+          return typeof d22 === "string" && /^[0-9a-f]{64}$/.test(d22) ? d22 : void 0;
+        } catch {
+          return void 0;
+        }
+      }
       /**
        * #1015: write one frame and report whether the socket took it.
        *
@@ -71844,6 +71876,7 @@ ${baseText}`;
                   const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                   const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
                   console.log(`[SecureChannel] A2A addMembers for ${req.requesting_device_id.slice(0, 8)} group=${chState.mlsGroupId.slice(0, 8)} epoch=${mlsGroup.epoch}`);
+                  let parentDigest = await this._readGroupHeadDigest(chState.mlsGroupId);
                   let commit;
                   let welcome;
                   try {
@@ -71874,12 +71907,14 @@ ${baseText}`;
                                 group_id: chState.mlsGroupId,
                                 device_id: this._deviceId,
                                 commit: Buffer.from(removeResult.commit).toString("hex"),
-                                commit_epoch: Number(mlsGroup.epoch)
+                                commit_epoch: Number(mlsGroup.epoch),
+                                ...parentDigest ? { parent_digest: parentDigest } : {}
                               })
                             }
                           );
                           if (removeResp.ok) {
                             removeCommitPublished = true;
+                            parentDigest = this._commitDigest(removeResult.commit);
                           } else {
                             const detail = await removeResp.text().catch(() => "");
                             console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
@@ -71947,7 +71982,8 @@ ${baseText}`;
                           commit: commitHex,
                           commit_epoch: Number(mlsGroup.epoch),
                           welcomes: [{ target_device_id: req.requesting_device_id, payload: welcomeHex }],
-                          member_device_ids: updatedMembers
+                          member_device_ids: updatedMembers,
+                          ...parentDigest ? { parent_digest: parentDigest } : {}
                         })
                       }
                     );
@@ -71964,7 +72000,12 @@ ${baseText}`;
                     const a2aLabel = `A2A ${chId.slice(0, 8)}`;
                     const commitSent = await this._sendFrameConfirmed({
                       event: "mls_commit",
-                      data: { group_id: chState.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: commitHex }
+                      data: {
+                        group_id: chState.mlsGroupId,
+                        epoch: Number(mlsGroup.epoch),
+                        payload: commitHex,
+                        ...parentDigest ? { parent_digest: parentDigest } : {}
+                      }
                     }, `${a2aLabel} commit`);
                     const welcomeSent = commitSent && await this._sendFrameConfirmed({
                       event: "mls_welcome",
@@ -99483,7 +99524,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.35" : "0.0.0-dev";
+    VERSION = true ? "0.23.37" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -135887,7 +135928,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  logLine(`[bridge] version: ${true ? "0.8.8" : "dev"}`);
+  logLine(`[bridge] version: ${true ? "0.8.10" : "dev"}`);
   logLine(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   logLine(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -135919,7 +135960,7 @@ async function main() {
     // its default would render "@agentvault/agentvault@0.7.x" — the wrong
     // package name attached to the bridge's version number, which is worse
     // than either alone.
-    clientVersion: `@agentvault/claude-bridge@${true ? "0.8.8" : "dev"}`
+    clientVersion: `@agentvault/claude-bridge@${true ? "0.8.10" : "dev"}`
   });
   const agentSystemPrompt = cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`;
   const deviceJwt = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",