@agentvault/grok-bridge 0.2.0 → 0.3.0

package/dist/config.d.ts

@@ -11,6 +11,17 @@
  * flag can never be mistaken for an invite token.
  */
 export declare const INSTALL_FLAG = "--install";
+/** Informational flags. Handled BEFORE loadConfig in index.ts, because asking
+ *  "what version is this?" must not require an invite token. Listed here too so
+ *  the strict unknown-flag check does not reject them. */
+export declare const VERSION_FLAGS: readonly ["--version", "-v"];
+export declare const HELP_FLAGS: readonly ["--help", "-h"];
+/** Pure argv read for the informational flags. Deliberately independent of
+ *  loadConfig: that throws without a token, and `--version` must answer anyway. */
+export declare function parseInfoFlags(argv: string[]): {
+    showVersion: boolean;
+    showHelp: boolean;
+};
 /**
  * Package-manager scratch caches. `service/subcommand.ts` bakes `process.argv[1]`
  * into the launcher script, so a service installed from one of these points at a
@@ -68,6 +79,10 @@ export interface BridgeConfig {
      *  then EXIT so the customer's terminal returns. False leaves a bare run
      *  byte-for-byte as it behaves today. */
     installAfterEnroll: boolean;
+    /** --version / -v. index.ts answers these before loadConfig runs. */
+    showVersion: boolean;
+    /** --help / -h. Same. */
+    showHelp: boolean;
 }
 export declare function loadConfig(env: NodeJS.ProcessEnv, argv?: string[]): BridgeConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/index.js

@@ -9,10 +9,61 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/pending-invite.ts
+import { existsSync, mkdirSync, chmodSync, readFileSync as readFileSync2, writeFileSync, rmSync } from "node:fs";
+import { join as join5 } from "node:path";
+function pendingInvitePath(dataDir) {
+  return join5(dataDir, PENDING_INVITE_FILE);
+}
+function writePendingInvite(dataDir, token) {
+  mkdirSync(dataDir, { recursive: true, mode: DIR_MODE2 });
+  chmodSync(dataDir, DIR_MODE2);
+  const p2 = pendingInvitePath(dataDir);
+  writeFileSync(p2, token, { mode: FILE_MODE2 });
+  chmodSync(p2, FILE_MODE2);
+}
+function readPendingInvite(dataDir) {
+  const p2 = pendingInvitePath(dataDir);
+  if (!existsSync(p2)) return void 0;
+  try {
+    const raw = readFileSync2(p2, "utf-8").trim();
+    return raw.length > 0 ? raw : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function clearPendingInvite(dataDir) {
+  try {
+    rmSync(pendingInvitePath(dataDir), { force: true });
+  } catch {
+  }
+}
+function clearPendingInviteIfConsumed(dataDir, credsExist) {
+  if (!existsSync(pendingInvitePath(dataDir))) return false;
+  if (!credsExist(dataDir)) return false;
+  clearPendingInvite(dataDir);
+  return true;
+}
+var DIR_MODE2, FILE_MODE2, PENDING_INVITE_FILE;
+var init_pending_invite = __esm({
+  "src/pending-invite.ts"() {
+    "use strict";
+    DIR_MODE2 = 448;
+    FILE_MODE2 = 384;
+    PENDING_INVITE_FILE = "pending-invite";
+  }
+});
+
 // src/config.ts
-import { existsSync, readFileSync as readFileSync2, mkdirSync, chmodSync } from "node:fs";
-import { join as join5, resolve as resolve2, sep, dirname } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3, mkdirSync as mkdirSync2, chmodSync as chmodSync2 } from "node:fs";
+import { join as join6, resolve as resolve2, sep, dirname } from "node:path";
 import { tmpdir } from "node:os";
+function parseInfoFlags(argv) {
+  return {
+    showVersion: argv.some((a2) => VERSION_FLAGS.includes(a2)),
+    showHelp: argv.some((a2) => HELP_FLAGS.includes(a2))
+  };
+}
 function isEphemeralEntrypoint(entrypoint) {
   return entrypoint.includes("/_npx/") || entrypoint.includes("/dlx-") || entrypoint.includes("/.bun/install/cache/") || entrypoint.startsWith(tmpdir() + sep);
 }
@@ -26,14 +77,14 @@ function assertInstallableEntrypoint(entrypoint) {
 }
 function hasRecoverableBackup(dataDir) {
   try {
-    const parsed = JSON.parse(readFileSync2(join5(dataDir, BACKUP_FILE), "utf-8"));
+    const parsed = JSON.parse(readFileSync3(join6(dataDir, BACKUP_FILE), "utf-8"));
     return !!(parsed && parsed.deviceId && parsed.deviceJwt && parsed.sessions && Object.keys(parsed.sessions).length > 0);
   } catch {
     return false;
   }
 }
 function hasPersistedCreds(dataDir) {
-  if (CRED_FILES.some((f2) => existsSync(join5(dataDir, f2)))) return true;
+  if (CRED_FILES.some((f2) => existsSync2(join6(dataDir, f2)))) return true;
   return hasRecoverableBackup(dataDir);
 }
 function slugify2(name) {
@@ -41,19 +92,19 @@ function slugify2(name) {
 }
 function resolveDataDir(env) {
   if (env.AV_DATA_DIR) return { dataDir: env.AV_DATA_DIR, source: "explicit" };
-  const base = join5(env.HOME ?? "", ".agentvault", "grok-room-bridge");
-  return { dataDir: join5(base, slugify2(env.AV_AGENT_NAME ?? "grok")), source: "per-agent" };
+  const base = join6(env.HOME ?? "", ".agentvault", "grok-room-bridge");
+  return { dataDir: join6(base, slugify2(env.AV_AGENT_NAME ?? "grok")), source: "per-agent" };
 }
 function loadConfig(env, argv = []) {
   const { dataDir, source: dataDirSource } = resolveDataDir(env);
-  const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || "";
+  const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || readPendingInvite(dataDir) || "";
   const unknownFlags = argv.filter((a2) => a2.startsWith("-") && !KNOWN_FLAGS.has(a2));
   if (unknownFlags.length) {
     throw new Error(
-      `unknown option(s): ${unknownFlags.join(", ")} \u2014 the only supported flag is ${INSTALL_FLAG}`
+      `unknown option(s): ${unknownFlags.join(", ")} \u2014 supported flags are ${[...KNOWN_FLAGS].join(", ")}`
     );
   }
-  const workspaceDir = env.AV_WORKSPACE_DIR || join5(dirname(dataDir), "workspaces", slugify2(env.AV_AGENT_NAME ?? "grok"));
+  const workspaceDir = env.AV_WORKSPACE_DIR || join6(dirname(dataDir), "workspaces", slugify2(env.AV_AGENT_NAME ?? "grok"));
   const wsReal = resolve2(workspaceDir);
   const ddReal = resolve2(dataDir);
   if (wsReal === ddReal || wsReal.startsWith(ddReal + sep) || ddReal.startsWith(wsReal + sep)) {
@@ -62,8 +113,8 @@ function loadConfig(env, argv = []) {
     );
   }
   try {
-    mkdirSync(workspaceDir, { recursive: true, mode: 448 });
-    chmodSync(workspaceDir, 448);
+    mkdirSync2(workspaceDir, { recursive: true, mode: 448 });
+    chmodSync2(workspaceDir, 448);
   } catch (e) {
     throw new Error(
       `Failed to create/secure the agent workspace at ${workspaceDir} (override with AV_WORKSPACE_DIR): ${e.message}`
@@ -81,6 +132,7 @@ function loadConfig(env, argv = []) {
     // One-paste install (--install): enrol, hand off to the supervisor, exit.
     // Default false keeps a bare `npx @agentvault/grok-bridge` run identical.
     installAfterEnroll: argv.includes(INSTALL_FLAG),
+    ...parseInfoFlags(argv),
     apiUrl: env.AV_API_URL ?? "https://api.agentvault.chat",
     // Identity shown to the agent's own session. Set this to the agent's
     // AgentVault name via AV_AGENT_NAME (the native connect command passes it).
@@ -92,17 +144,20 @@ function loadConfig(env, argv = []) {
     workspaceDir,
     grokPath: env.AV_GROK_PATH || void 0,
     sandboxProfile: env.GROK_SANDBOX ?? "workspace",
-    fenceHome: env.AV_FENCE_HOME || join5(dataDir, "fence"),
+    fenceHome: env.AV_FENCE_HOME || join6(dataDir, "fence"),
     apiKey: env.XAI_API_KEY || void 0,
     systemPrompt: env.AV_SYSTEM_PROMPT || void 0
   };
 }
-var INSTALL_FLAG, KNOWN_FLAGS, CRED_FILES, BACKUP_FILE;
+var INSTALL_FLAG, VERSION_FLAGS, HELP_FLAGS, KNOWN_FLAGS, CRED_FILES, BACKUP_FILE;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
+    init_pending_invite();
     INSTALL_FLAG = "--install";
-    KNOWN_FLAGS = /* @__PURE__ */ new Set([INSTALL_FLAG]);
+    VERSION_FLAGS = ["--version", "-v"];
+    HELP_FLAGS = ["--help", "-h"];
+    KNOWN_FLAGS = /* @__PURE__ */ new Set([INSTALL_FLAG, ...VERSION_FLAGS, ...HELP_FLAGS]);
     CRED_FILES = ["agentvault.json", "secure-channel.json"];
     BACKUP_FILE = "agentvault.json.bak";
   }
@@ -117,6 +172,9 @@ function stamp(message) {
 function logLine(...args) {
   console.error(stamp(format(...args)));
 }
+function printLine(text) {
+  console.log(text);
+}
 var init_log = __esm({
   "src/log.ts"() {
     "use strict";
@@ -185,7 +243,7 @@ var init_launcher = __esm({
 });
 
 // src/service/spec.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function buildServiceSpec(cfg, opts) {
   const env = {
     AV_AGENT_NAME: cfg.agentName,
@@ -197,7 +255,7 @@ function buildServiceSpec(cfg, opts) {
   if (cfg.workspaceDir) env.AV_WORKSPACE_DIR = cfg.workspaceDir;
   if (cfg.roomFilter) env.AV_ROOM_ID = cfg.roomFilter;
   if (cfg.grokPath) env.AV_GROK_PATH = cfg.grokPath;
-  const launcherPath = join9(cfg.dataDir, "launch-grok-bridge.sh");
+  const launcherPath = join10(cfg.dataDir, "launch-grok-bridge.sh");
   return {
     label: `dev.agentvault.grok-${slugify2(cfg.agentName)}`,
     programArgs: [launcherPath],
@@ -205,8 +263,8 @@ function buildServiceSpec(cfg, opts) {
     launcherScript: renderLauncher({ installPath: opts.path, entrypoint: opts.entrypoint }),
     env,
     workingDir: cfg.workspaceDir ? cfg.workspaceDir : opts.home,
-    logOut: join9(cfg.dataDir, "logs", "grok-bridge.log"),
-    logErr: join9(cfg.dataDir, "logs", "grok-bridge.error.log"),
+    logOut: join10(cfg.dataDir, "logs", "grok-bridge.log"),
+    logErr: join10(cfg.dataDir, "logs", "grok-bridge.error.log"),
     keepAliveUnlessCleanExit: true,
     runAtLoad: true
   };
@@ -220,7 +278,7 @@ var init_spec = __esm({
 });
 
 // src/service/launchd.ts
-import { dirname as dirname3, join as join10 } from "node:path";
+import { dirname as dirname3, join as join11 } from "node:path";
 function esc2(s2) {
   return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -265,8 +323,9 @@ var init_launchd = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       plistPath(label) {
-        return join10(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
+        return join11(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
       }
       domain() {
         return `gui/${this.deps.uid}`;
@@ -314,7 +373,7 @@ var init_launchd = __esm({
 });
 
 // src/service/systemd.ts
-import { dirname as dirname4, join as join11 } from "node:path";
+import { dirname as dirname4, join as join12 } from "node:path";
 function q2(s2) {
   const esc3 = s2.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/%/g, "%%");
   return `"${esc3}"`;
@@ -349,8 +408,9 @@ var init_systemd = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       unitPath(label) {
-        return join11(this.deps.home, ".config", "systemd", "user", `${label}.service`);
+        return join12(this.deps.home, ".config", "systemd", "user", `${label}.service`);
       }
       install(spec) {
         const path2 = this.unitPath(spec.label);
@@ -390,7 +450,7 @@ __export(backend_exports, {
   selectBackend: () => selectBackend
 });
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync3, chmodSync as chmodSync4 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync2, existsSync as existsSync4, chmodSync as chmodSync5 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -401,11 +461,11 @@ function defaultDeps() {
       const r2 = spawnSync(cmd, args, { encoding: "utf8" });
       return { code: r2.status ?? 1, stdout: r2.stdout ?? "" };
     },
-    writeFile: (p2, d2) => writeFileSync2(p2, d2),
-    mkdir: (p2) => mkdirSync4(p2, { recursive: true }),
-    chmod: (p2, m2) => chmodSync4(p2, m2),
-    rm: (p2) => rmSync(p2, { force: true }),
-    exists: (p2) => existsSync3(p2)
+    writeFile: (p2, d2) => writeFileSync3(p2, d2),
+    mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
+    chmod: (p2, m2) => chmodSync5(p2, m2),
+    rm: (p2) => rmSync2(p2, { force: true }),
+    exists: (p2) => existsSync4(p2)
   };
 }
 function selectBackend(platform, deps) {
@@ -435,17 +495,26 @@ function labelFor(env) {
 }
 function maybeRunServiceSubcommand(argv, env, deps) {
   const cmd = argv[2];
-  if (!cmd || !SERVICE_CMDS.has(cmd)) return false;
+  if (!cmd) return false;
+  if (!SERVICE_CMDS.has(cmd)) {
+    const looksLikeToken = cmd.startsWith("av_tok_");
+    const looksLikeFlag = cmd.startsWith("-");
+    if (!looksLikeToken && !looksLikeFlag) {
+      throw new Error(
+        `unknown subcommand: ${cmd} \u2014 expected one of ${[...SERVICE_CMDS].join(", ")}, an invite token, or no argument at all`
+      );
+    }
+    return false;
+  }
   const backend = deps?.backend ?? selectBackend(process.platform);
   const entrypoint = deps?.entrypoint ?? process.argv[1];
   const log = deps?.log ?? ((m2) => logLine("[grok-bridge] " + m2));
   try {
     if (cmd === "install") {
       const cfg = loadConfig(env, []);
-      if (!hasPersistedCreds(cfg.dataDir)) {
-        throw new Error(
-          "no credentials found \u2014 enroll first by running the bridge once (AV_INVITE_TOKEN=\u2026 npx @agentvault/grok-bridge), then re-run install"
-        );
+      const firstBoot = !hasPersistedCreds(cfg.dataDir) && !!cfg.inviteToken;
+      if (firstBoot) {
+        writePendingInvite(cfg.dataDir, cfg.inviteToken);
       }
       const spec = buildServiceSpec(cfg, {
         entrypoint,
@@ -456,7 +525,11 @@ function maybeRunServiceSubcommand(argv, env, deps) {
         path: env.PATH ?? ""
       });
       backend.install(spec);
-      log(`installed service ${spec.label} \u2014 logs: ${spec.logOut}`);
+      log(`installed service ${spec.label} \u2014 logs: ${spec.logErr}`);
+      if (firstBoot) {
+        log("now APPROVE the device in AgentVault \u2014 the service is waiting to enrol");
+        log("if it does not connect within a minute, the log above says why");
+      }
       log(`check it with: agentvault-grok-bridge status`);
     } else if (cmd === "uninstall") {
       const label = labelFor(env);
@@ -485,6 +558,7 @@ var init_subcommand = __esm({
   "src/service/subcommand.ts"() {
     "use strict";
     init_config();
+    init_pending_invite();
     init_log();
     init_spec();
     init_backend();
@@ -497,12 +571,12 @@ var install_on_ready_exports = {};
 __export(install_on_ready_exports, {
   installOnReady: () => installOnReady
 });
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
+import { join as join13 } from "node:path";
 function installOnReady(channel, cfg, deps) {
   const hasCreds = deps.hasCreds ?? hasPersistedCreds;
-  const readLauncher = deps.readLauncher ?? ((p2) => existsSync4(p2) ? readFileSync3(p2, "utf8") : void 0);
-  const fenceAuthExists = deps.fenceAuthExists ?? ((home) => existsSync4(join12(home, ".grok", "auth.json")));
+  const readLauncher = deps.readLauncher ?? ((p2) => existsSync5(p2) ? readFileSync4(p2, "utf8") : void 0);
+  const fenceAuthExists = deps.fenceAuthExists ?? ((home) => existsSync5(join13(home, ".grok", "auth.json")));
   let fired = false;
   channel.on("ready", () => {
     if (fired) return;
@@ -587,10 +661,10 @@ var init_install_on_ready = __esm({
 
 // src/index.ts
 import { spawn } from "node:child_process";
-import { mkdirSync as mkdirSync5 } from "node:fs";
-import { join as join13 } from "node:path";
+import { mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join14 } from "node:path";
 
-// ../../../../packages/plugin/dist/index.js
+// ../plugin/dist/index.js
 import * as nc from "node:crypto";
 import { chmod, mkdir, writeFile } from "node:fs/promises";
 import { readdir, readFile, rename, rm } from "node:fs/promises";
@@ -861,7 +935,7 @@ var init_libsodium_sumo = __esm2({
           }, Module: function(binary) {
           }, Instance: function(module2, info) {
             this.exports = // EMSCRIPTEN_START_ASM
-            function instantiate(ea2) {
+            (function instantiate(ea2) {
               var a2;
               var b2 = new Uint8Array(123);
               for (var c2 = 25; c2 >= 0; --c2) {
@@ -40656,7 +40730,7 @@ var init_libsodium_sumo = __esm2({
                 } } }), f: yi, g: ma2, h: Ba2, i: ma2, j: ka2, k: Le2, l: Je2, m: zg, n: yg, o: xg, p: wg, q: ka2, r: Ba2, s: ka2, t: ka2, u: Le2, v: ra2, w: vg, x: ug, y: tg, z: sg, A: Ba2, B: rg, C: qg, D: pg, E: ng, F: mg, G: lg, H: kg, I: jg, J: ka2, K: Ce2, L: Ba2, M: ma2, N: Ta2, O: ra2, P: ka2, Q: Oa2, R: Ba2, S: ma2, T: Ta2, U: ra2, V: ig, W: hg, X: gg, Y: fg, Z: ka2, _: Ma2, $: Ba2, aa: ma2, ba: Ta2, ca: ra2, da: ka2, ea: ka2, fa: Kg, ga: wd, ha: vd, ia: ra2, ja: ka2, ka: ka2, la: Cb, ma: ra2, na: Xa2, oa: eg, pa: qb, qa: dg, ra: cg, sa: ua2, ta: ka2, ua: Dc, va: ra2, wa: Va2, xa: ud, ya: Ya2, za: bg, Aa: ag, Ba: ka2, Ca: ka2, Da: Dc, Ea: ra2, Fa: ze2, Ga: ud, Ha: Ng, Ia: wd, Ja: vd, Ka: ka2, La: ka2, Ma: ka2, Na: ka2, Oa: Ma2, Pa: ka2, Qa: ma2, Ra: ma2, Sa: Ta2, Ta: dh2, Ua: ch, Va: bh, Wa: ah, Xa: Lb, Ya: Kb, Za: td, _a: sd, $a: rd, ab: $f, bb: _f, cb: Zf, db: qd, eb: Yf, fb: pd, gb: Xf, hb: Wf, ib: Uf, jb: Md, kb: tc, lb: nb, mb, nb: Lb, ob: Kb, pb: td, qb: sd, rb: ka2, sb: ka2, tb: ka2, ub: ka2, vb: Ma2, wb: ka2, xb: ma2, yb: ma2, zb: Ta2, Ab: Aa2, Bb: ka2, Cb: ma2, Db: ka2, Eb: ma2, Fb: Sa2, Gb: ka2, Hb: ma2, Ib: ka2, Jb: ma2, Kb: vb, Lb: ua2, Mb: ma2, Nb: ka2, Ob: ma2, Pb: ub, Qb: ua2, Rb: ma2, Sb: ka2, Tb: ma2, Ub: tb, Vb: ua2, Wb: ma2, Xb: ka2, Yb: ma2, Zb: ma2, _b: ua2, $b: ka2, ac: ma2, bc: ua2, cc: ka2, dc: Nd, ec: pe2, fc: od, gc: fh, hc: nd, ic: eh, jc: ra2, kc: ma2, lc: ua2, mc: ka2, nc: ma2, oc: ua2, pc: ka2, qc: ma2, rc: ma2, sc: pe2, tc: ra2, uc: od, vc: Tf, wc: Ja2, xc: xh, yc: nd, zc: Ia2, Ac: ua2, Bc: md, Cc: Lg, Dc: ka2, Ec: Ag, Fc: Ub, Gc: Sf, Hc: Ua2, Ic: Rf, Jc: ua2, Kc: Cb, Lc: Za2, Mc: ic, Nc: Ca2, Oc: md, Pc: ma2, Qc: ua2, Rc: Oa2, Sc: ka2, Tc: ld, Uc: Nd, Vc: ma2, Wc: ua2, Xc: Oa2, Yc: ka2, Zc: ld, _c: ra2, $c: Gh, ad: Fh, bd: Eh, cd: Dh, dd: ra2, ed: Ch, fd: ka2, gd: Ba2, hd: Bh, id: Cb, jd: ze2, kd: hi, ld: gi, md: fi, nd: ei, od: di, pd: ua2, qd: Ba2, rd: ci, sd: Dc, td: Gg, ud: nb, vd: Fg, wd: Eg, xd: ka2, yd: ka2, zd: ka2, Ad: ka2, Bd: Dg, Cd: Rc, Dd: ma2, Ed: ka2, Fd: kd, Gd: jd, Hd: Sg, Id: id, Jd: Rg, Kd: Qg, Ld: ra2, Md: kd, Nd: jd, Od: Ga2, Pd: id, Qd: Fa2, Rd: ma2, Sd: ka2, Td: Rc, Ud: ra2, Vd: Db, Wd: ma2, Xd: wa2, Yd: Ba2, Zd: wa2, _d: ma2, $d: yc, ae: wh, be: Vb, ce: wa2, de: xc, ee: wc, fe: vc, ge: me2, he: vh, ie: uh, je: Oa2, ke: th, le: Pf, me: Of, ne: Nf, oe: Mf, pe: Lf, qe: fb, re: ma2, se: wa2, te: Ba2, ue: wa2, ve: ma2, we: yc, xe: fe2, ye: Db, ze: wa2, Ae: xc, Be: wc, Ce: fb, De: ee2, Ee: Vb, Fe: de2, Ge: vc, He: uc, Ie: Kf, Je: hd, Ke: Jf, Le: Db, Me: fb, Ne: fb, Oe: ma2, Pe: wa2, Qe: Ba2, Re: wa2, Se: ma2, Te: yc, Ue: fe2, Ve: Db, We: wa2, Xe: xc, Ye: wc, Ze: fb, _e: ee2, $e: Vb, af: de2, bf: vc, cf: uc, df: Hf, ef: hd, ff: Gf, gf: Ff, hf: Ef, jf: sh, kf: Jg, lf: Ig, mf: Hg, nf: ka2, of: ka2, pf: Ea2, qf: wb, rf: ka2, sf: ka2, tf: ka2, uf: Ma2, vf: ka2, wf: ma2, xf: ma2, yf: Ta2, zf: Mg, Af: Lb, Bf: Kb, Cf: ra2, Df: rd, Ef: Df, Ff: qd, Gf: pd, Hf: Lb, If: Kb, Jf: ka2, Kf: Ma2, Lf: ka2, Mf: ma2, Nf: ma2, Of: Ta2, Pf: ra2, Qf: ra2, Rf: Mh, Sf: Lh, Tf: Kh, Uf: Cf, Vf: Bf, Wf: Jh, Xf: Ih, Yf: Ma2, Zf: ka2, _f: Hh, $f: Ba2, ag: Db, bg: fb, cg: Vb, dg: Oa2, eg: ma2, fg: Tg, gg: gd, hg: Je2, ig: Oa2, jg: ma2, kg: gd, lg: Cb, mg: ua2, ng: ka2, og: ka2, pg: ua2, qg: Wd, rg: lh, sg: kh, tg: jh, ug: fd, vg: ed, wg: dd, xg: cd, yg: ih, zg: ic, Ag: hh, Bg: gh, Cg: Cb, Dg: ua2, Eg: ka2, Fg: ka2, Gg: ua2, Hg: Wd, Ig: nh, Jg: mh, Kg: Vd, Lg: ic, Mg: Ud, Ng: Td, Og: Yd, Pg: Xd, Qg: ph, Rg: oh, Sg: cd, Tg: ed, Ug: dd, Vg: fd, Wg: ka2, Xg: Oa2, Yg: wa2, Zg: ka2, _g: Ce2, $g: wa2, ah: zf, bh: yf, ch: xf, dh: wf, eh: vf, fh: uf, gh: ra2, hh: ra2, ih: ka2, jh: Ma2, kh: wa2, lh: qh, mh: bd, nh: ad, oh: ra2, ph: ka2, qh: Oa2, rh: wa2, sh: tf, th: sf, uh: rf, vh: ra2, wh: bd, xh: qf, yh: ad, zh: ka2, Ah: Ma2, Bh: wa2, Ch: ra2, Dh: ma2, Eh: ka2, Fh: ua2, Gh: db, Hh: kb, Ih: xd, Jh: oi, Kh: ni, Lh: Ae2, Mh: mi, Nh: za2, Oh: li, Ph: ka2, Qh: ki, Rh: pf, Sh: Ah, Th: zh, Uh: yh, Vh: Bc, Wh: Ac, Xh: ti, Yh: ji, Zh: ii, _h: Cg, $h: Bg, ai: fb, bi: Ba2, ci: tc, di: nb, ei: rh, fi: $c, gi: of, hi: nf, ii: mf, ji: _c, ki: lf, li: Yc, mi: kf, ni: ka2, oi: ka2, pi: ka2, qi: ka2, ri: Ma2, si: ma2, ti: Ta2, ui: jf, vi: hf, wi: Md, xi: bi, yi: ai, zi: $h, Ai: _h, Bi: Zh, Ci: ye2, Di: xe2, Ei: we2, Fi: ve2, Gi: ue2, Hi: te2, Ii: se2, Ji: re2, Ki: ka2, Li: ua2, Mi: ka2, Ni: ua2, Oi: ka2, Pi: Yh, Qi: Xh, Ri: Wh, Si: Vh, Ti: Uh, Ui: Th, Vi: Sh, Wi: Rh, Xi: Qh, Yi: Ph, Zi: Oh, _i: re2, $i: Nh, aj: ka2, bj: ua2, cj: ua2, dj: ka2, ej: gf, fj: ma2, gj: wa2, hj: Ba2, ij: wa2, jj: ka2, kj: $g, lj: _g, mj: Zg, nj: wa2, oj: Ed, pj: wa2, qj: Yg, rj: Ed, sj: me2, tj: uc, uj: ff, vj: ef, wj: df, xj: cf, yj: Xg, zj: Wg, Aj: Vg, Bj: Ug, Cj: ka2, Dj: ka2, Ej: Pg, Fj: Og, Gj: ka2, Hj: ka2, Ij: $c, Jj: bf, Kj: _c, Lj: Yc, Mj: ka2, Nj: Ma2, Oj: ma2, Pj: Ta2, Qj: ma2, Rj: ma2, Sj: af, Tj: $e2, Uj: _e2, Vj: ka2, Wj: Oa2, Xj: wa2, Yj: ra2, Zj: Ze2, _j: Ye2, $j: ka2, ak: Oa2, bk: wa2, ck: ra2, dk: ka2, ek: Ma2, fk: wa2, gk: Xe2, hk: We2, ik: Ve2, jk: ra2, kk: Da2, lk: ta2 };
               }
               return da2(ea2);
-            }(info);
+            })(info);
           }, instantiate: function(binary, info) {
             return { then: function(ok) {
               var module2 = new WebAssembly2.Module(binary);
@@ -70067,7 +70141,8 @@ ${messageText}`;
           const candidateCount = candidates.filter(Boolean).length;
           const joined = await joinWithFirstMatchingKp(welcomeBytes, candidates);
           if (!joined) {
-            console.error(`[SecureChannel] No matching KeyPackage found for Welcome \u2014 cannot join group ${groupId?.slice(0, 8)}. The Welcome is encrypted to a published KP's public key; none of our ${candidateCount} candidate bundle(s) decrypted it. The existing Welcome recovery mechanism will re-request.`);
+            console.error(`[SecureChannel] No matching KeyPackage found for Welcome \u2014 cannot join group ${groupId?.slice(0, 8)}. The Welcome is encrypted to a published KP's public key; none of our ${candidateCount} candidate bundle(s) decrypted it. Requesting a re-Welcome with a fresh KeyPackage.`);
+            if (groupId) void this._requestWelcomeSelfHeal(groupId);
             return;
           }
           const mgr = joined.mgr;
@@ -81231,7 +81306,7 @@ function _stringbool(Classes, _params) {
     type: "pipe",
     in: stringSchema,
     out: booleanSchema,
-    transform: (input, payload) => {
+    transform: ((input, payload) => {
       let data = input;
       if (params.case !== "sensitive")
         data = data.toLowerCase();
@@ -81250,14 +81325,14 @@ function _stringbool(Classes, _params) {
         });
         return {};
       }
-    },
-    reverseTransform: (input, _payload) => {
+    }),
+    reverseTransform: ((input, _payload) => {
       if (input === true) {
         return truthyArray[0] || "true";
       } else {
         return falsyArray[0] || "false";
       }
-    },
+    }),
     error: params.error
   });
   return codec2;
@@ -82313,10 +82388,10 @@ var init_schemas2 = __esm2({
       inst.with = inst.check;
       inst.clone = (_def, params) => clone(inst, _def, params);
       inst.brand = () => inst;
-      inst.register = (reg, meta3) => {
+      inst.register = ((reg, meta3) => {
         reg.add(inst, meta3);
         return inst;
-      };
+      });
       inst.apply = (fn) => fn(inst);
     });
     ZodMiniObject = /* @__PURE__ */ $constructor("ZodMiniObject", (inst, def) => {
@@ -83402,10 +83477,10 @@ var init_schemas3 = __esm2({
       inst.with = inst.check;
       inst.clone = (def2, params) => clone(inst, def2, params);
       inst.brand = () => inst;
-      inst.register = (reg, meta3) => {
+      inst.register = ((reg, meta3) => {
         reg.add(inst, meta3);
         return inst;
-      };
+      });
       inst.parse = (data, params) => parse2(inst, data, params, { callee: inst.parse });
       inst.safeParse = (data, params) => safeParse3(inst, data, params);
       inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
@@ -84067,11 +84142,13 @@ function assertCompleteRequestPrompt(request) {
   if (request.params.ref.type !== "ref/prompt") {
     throw new TypeError(`Expected CompleteRequestPrompt, but got ${request.params.ref.type}`);
   }
+  void request;
 }
 function assertCompleteRequestResourceTemplate(request) {
   if (request.params.ref.type !== "ref/resource") {
     throw new TypeError(`Expected CompleteRequestResourceTemplate, but got ${request.params.ref.type}`);
   }
+  void request;
 }
 var LATEST_PROTOCOL_VERSION;
 var DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
@@ -98202,28 +98279,29 @@ await init_index();
 
 // src/index.ts
 init_config();
+init_pending_invite();
 init_log();
 
 // src/fence-auth.ts
-import { copyFileSync, chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { copyFileSync, chmodSync as chmodSync3, existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
+import { join as join7 } from "node:path";
 function seedFenceCredential(opts) {
   const log = opts.log ?? (() => {
   });
-  const fenceGrok = join6(opts.fenceHome, ".grok");
-  const fenceAuth = join6(fenceGrok, "auth.json");
-  if (existsSync2(fenceAuth)) {
+  const fenceGrok = join7(opts.fenceHome, ".grok");
+  const fenceAuth = join7(fenceGrok, "auth.json");
+  if (existsSync3(fenceAuth)) {
     log("[grok-bridge] fence credential already present; leaving it untouched");
     return "already-present";
   }
-  const hostAuth = join6(opts.hostHome, ".grok", "auth.json");
-  if (!existsSync2(hostAuth)) {
+  const hostAuth = join7(opts.hostHome, ".grok", "auth.json");
+  if (!existsSync3(hostAuth)) {
     log("[grok-bridge] no host credential to seed (run `grok login`, or set XAI_API_KEY)");
     return "no-host-credential";
   }
-  mkdirSync2(fenceGrok, { recursive: true });
+  mkdirSync3(fenceGrok, { recursive: true });
   copyFileSync(hostAuth, fenceAuth);
-  chmodSync2(fenceAuth, 384);
+  chmodSync3(fenceAuth, 384);
   log("[grok-bridge] seeded fence credential from the host grok login");
   return "seeded";
 }
@@ -98234,6 +98312,8 @@ var GrokSession = class {
     this.driver = driver2;
     this.opts = opts;
   }
+  driver;
+  opts;
   queue = [];
   running = false;
   /** The message whose turn is in flight, or null between turns. Null is a
@@ -98346,6 +98426,9 @@ var AcpChildDied = class extends Error {
     this.signal = signal;
     this.name = "AcpChildDied";
   }
+  method;
+  code;
+  signal;
 };
 var AcpTimeout = class extends Error {
   constructor(method, ms) {
@@ -98354,6 +98437,8 @@ var AcpTimeout = class extends Error {
     this.ms = ms;
     this.name = "AcpTimeout";
   }
+  method;
+  ms;
 };
 var AcpConnection = class {
   constructor(child, opts) {
@@ -98371,6 +98456,7 @@ var AcpConnection = class {
       this.stdinErrors++;
     });
   }
+  child;
   nextId = 1;
   pending = /* @__PURE__ */ new Map();
   /** Undecoded leftover. Decode UTF-8 only on complete lines so a 4-byte
@@ -98516,14 +98602,14 @@ var AcpConnection = class {
 };
 
 // src/grok-room-plugin.ts
-import { mkdirSync as mkdirSync3, writeFileSync, chmodSync as chmodSync3 } from "node:fs";
-import { join as join7 } from "node:path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, chmodSync as chmodSync4 } from "node:fs";
+import { join as join8 } from "node:path";
 var SERVER_KEY = "room";
 var GROK_ROOM_SAY_TOOL_NAME = `${SERVER_KEY}__say`;
 function writeRoomPluginHttp(dir, url3) {
-  mkdirSync3(join7(dir, ".claude-plugin"), { recursive: true });
-  writeFileSync(
-    join7(dir, ".claude-plugin", "plugin.json"),
+  mkdirSync4(join8(dir, ".claude-plugin"), { recursive: true });
+  writeFileSync2(
+    join8(dir, ".claude-plugin", "plugin.json"),
     JSON.stringify(
       {
         name: "avroom",
@@ -98535,12 +98621,12 @@ function writeRoomPluginHttp(dir, url3) {
       2
     ) + "\n"
   );
-  writeFileSync(
-    join7(dir, ".mcp.json"),
+  writeFileSync2(
+    join8(dir, ".mcp.json"),
     JSON.stringify({ mcpServers: { [SERVER_KEY]: { type: "http", url: url3 } } }, null, 2) + "\n",
     { mode: 384 }
   );
-  chmodSync3(join7(dir, ".mcp.json"), 384);
+  chmodSync4(join8(dir, ".mcp.json"), 384);
 }
 
 // src/grok-driver.ts
@@ -98553,6 +98639,8 @@ var GrokDriver = class {
     this.acp.onNotification((method, params) => this.onNotification(method, params));
     this.acp.onRequest((method, params) => this.onAgentRequest(method, params));
   }
+  child;
+  opts;
   acp;
   session = null;
   /** State for the turn currently in flight. Null between turns, so a late
@@ -98673,7 +98761,7 @@ var GrokDriver = class {
 };
 
 // src/grok-spawn.ts
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function grokSpawnArgs(opts) {
   const args = ["agent", "--no-leader"];
   if (opts.model) args.push("--model", opts.model);
@@ -98682,7 +98770,7 @@ function grokSpawnArgs(opts) {
   const env = {
     PATH: process.env.PATH,
     HOME: opts.fenceHome,
-    GROK_HOME: join8(opts.fenceHome, ".grok")
+    GROK_HOME: join9(opts.fenceHome, ".grok")
   };
   if (opts.apiKey) env.XAI_API_KEY = opts.apiKey;
   return { command: opts.grokPath ?? "grok", args, env, cwd: opts.workspaceDir };
@@ -99044,14 +99132,55 @@ async function main() {
   })) {
     process.exit(process.exitCode ?? 0);
   }
+  const info = parseInfoFlags(process.argv.slice(2));
+  if (info.showVersion || info.showHelp) {
+    const version2 = buildClientVersion2(
+      true ? "0.3.0" : void 0
+    );
+    if (info.showVersion) printLine(version2);
+    if (info.showHelp) {
+      printLine(
+        [
+          "",
+          `${version2}`,
+          "",
+          "  Bridges a Grok agent into E2E-encrypted AgentVault DMs and rooms.",
+          "",
+          "USAGE",
+          "  agentvault-grok-bridge [<invite-token>] [--install]",
+          "  agentvault-grok-bridge <install|uninstall|restart|status|logs>",
+          "",
+          "FLAGS",
+          "  --install        Enrol, install a supervised OS service, then EXIT so",
+          "                   your terminal returns. Requires a global install:",
+          "                   npm i -g @agentvault/grok-bridge",
+          "  --version, -v    Print the version.",
+          "  --help, -h       Print this.",
+          "",
+          "ENV",
+          "  AV_AGENT_NAME    The agent's AgentVault name. Required.",
+          "  AV_INVITE_TOKEN  First enrolment only; a saved data dir reconnects without it.",
+          "  AV_DATA_DIR      Credential/state dir. Defaults per agent.",
+          "",
+          "NOTES",
+          "  Run `grok login` first. XAI_API_KEY from your shell is NOT inherited by a",
+          "  supervised service, so --install refuses rather than run mute.",
+          "  To restart later use `restart`, never `install` \u2014 install re-bakes the",
+          "  service from your current shell and drops env from the original install.",
+          ""
+        ].join("\n")
+      );
+    }
+    process.exit(0);
+  }
   const cfg = loadConfig(process.env, process.argv.slice(2));
   if (cfg.installAfterEnroll) {
     assertInstallableEntrypoint(process.argv[1]);
     const { selectBackend: selectBackend2 } = await Promise.resolve().then(() => (init_backend(), backend_exports));
     selectBackend2(process.platform);
   }
-  mkdirSync5(cfg.workspaceDir, { recursive: true });
-  mkdirSync5(cfg.fenceHome, { recursive: true });
+  mkdirSync6(cfg.workspaceDir, { recursive: true });
+  mkdirSync6(cfg.fenceHome, { recursive: true });
   seedFenceCredential({
     fenceHome: cfg.fenceHome,
     hostHome: process.env.HOME ?? "",
@@ -99064,7 +99193,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.2.0" : void 0
+      true ? "0.3.0" : void 0
     )
   });
   channelRef = channel;
@@ -99085,7 +99214,7 @@ async function main() {
     },
     log: (m2) => logLine(m2)
   });
-  const pluginDir = join13(cfg.fenceHome, "av-room-plugin");
+  const pluginDir = join14(cfg.fenceHome, "av-room-plugin");
   writeRoomPluginHttp(pluginDir, mcp.url);
   const spawnSpec = grokSpawnArgs({
     grokPath: cfg.grokPath,
@@ -99150,6 +99279,11 @@ async function main() {
     log: (m2) => logLine("[grok-bridge] " + m2),
     onTerminal: (_reason, o2) => void shutdown(o2.restart ? 1 : 0)
   });
+  channel.on("ready", () => {
+    if (clearPendingInviteIfConsumed(cfg.dataDir, hasPersistedCreds)) {
+      logLine("[grok-bridge] enrolled \u2014 pending invite consumed and removed");
+    }
+  });
   if (cfg.installAfterEnroll) {
     const { installOnReady: installOnReady2 } = await Promise.resolve().then(() => (init_install_on_ready(), install_on_ready_exports));
     installOnReady2(channel, cfg, {

package/dist/log.d.ts

@@ -19,4 +19,16 @@ export declare function stamp(message: string): string;
  * just anchored to a clock.
  */
 export declare function logLine(...args: unknown[]): void;
+/**
+ * Plain stdout, no timestamp. For CLI answers a human or a script reads —
+ * `--version` and `--help` — not for daemon logging.
+ *
+ * `logLine` stamps every line and writes to stderr, which is right for a daemon
+ * and wrong here: `agentvault-grok-bridge --version` must print a version, not a
+ * version wearing a date. Anything a script would parse belongs on stdout.
+ *
+ * This lives in log.ts because the "no bare console sinks" guard test excludes
+ * only this file — the sink belongs here, and nowhere else.
+ */
+export declare function printLine(text: string): void;
 //# sourceMappingURL=log.d.ts.map

package/dist/pending-invite.d.ts

@@ -0,0 +1,24 @@
+export declare function pendingInvitePath(dataDir: string): string;
+/** Persist the token for the service's first boot. Owner-only, unconditionally. */
+export declare function writePendingInvite(dataDir: string, token: string): void;
+/** The pending token, or undefined when there is none to consume. */
+export declare function readPendingInvite(dataDir: string): string | undefined;
+/** Remove it. Idempotent: nothing to remove is a success, not an error. */
+export declare function clearPendingInvite(dataDir: string): void;
+/**
+ * Delete the pending invite once there is EVIDENCE it was consumed — i.e.
+ * credentials have actually persisted to the data dir.
+ *
+ * Timing is the whole design here. Deleting on READ (inside loadConfig) would
+ * throw the token away before enrolment finished, so a process that died in
+ * between would leave a service that can never enrol and a customer whose
+ * single-use invite is gone. Never deleting leaves a credential on disk long
+ * after it is useless.
+ *
+ * `credsExist` is injected so the caller supplies `hasPersistedCreds` and this
+ * module stays free of a config import cycle.
+ *
+ * @returns true when a file was actually removed.
+ */
+export declare function clearPendingInviteIfConsumed(dataDir: string, credsExist: (dataDir: string) => boolean): boolean;
+//# sourceMappingURL=pending-invite.d.ts.map

package/dist/service/subcommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAQD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CA4DT"}
+{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAQD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CA6GT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",