@agentvault/grok-bridge 0.3.2 → 0.4.1

package/dist/index.js

@@ -54,6 +54,24 @@ var init_pending_invite = __esm({
   }
 });
 
+// src/log.ts
+import { format } from "node:util";
+function stamp(message) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  return message.split("\n").map((line) => `${ts} ${line}`).join("\n");
+}
+function logLine(...args) {
+  console.error(stamp(format(...args)));
+}
+function printLine(text) {
+  console.log(text);
+}
+var init_log = __esm({
+  "src/log.ts"() {
+    "use strict";
+  }
+});
+
 // src/config.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, mkdirSync as mkdirSync2, chmodSync as chmodSync2 } from "node:fs";
 import { join as join6, resolve as resolve2, sep, dirname } from "node:path";
@@ -71,7 +89,7 @@ function assertInstallableEntrypoint(entrypoint) {
   if (isEphemeralEntrypoint(entrypoint)) {
     throw new Error(
       `cannot install a background service from an ephemeral package cache (${entrypoint}) \u2014 it is deleted on cleanup and the service would silently die later. Install globally first:
-  npm i -g @agentvault/grok-bridge && agentvault-grok-bridge ` + INSTALL_FLAG
+  npm i -g @agentvault/grok-bridge && agentvault-grok-bridge install`
     );
   }
 }
@@ -83,6 +101,17 @@ function hasRecoverableBackup(dataDir) {
     return false;
   }
 }
+function readPersistedDeviceId(dataDir) {
+  for (const f2 of [...CRED_FILES, BACKUP_FILE]) {
+    try {
+      const parsed = JSON.parse(readFileSync3(join6(dataDir, f2), "utf-8"));
+      const id = parsed?.deviceId;
+      if (typeof id === "string" && id) return id;
+    } catch {
+    }
+  }
+  return null;
+}
 function hasPersistedCreds(dataDir) {
   if (CRED_FILES.some((f2) => existsSync2(join6(dataDir, f2)))) return true;
   return hasRecoverableBackup(dataDir);
@@ -91,20 +120,41 @@ function slugify2(name) {
   return name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
 }
 function resolveDataDir(env) {
-  if (env.AV_DATA_DIR) return { dataDir: env.AV_DATA_DIR, source: "explicit" };
+  const supplied = env.AV_AGENT_NAME?.trim();
+  const agentName = supplied || LEGACY_DEFAULT_AGENT_NAME;
+  const agentNameSource = supplied ? "supplied" : "defaulted";
+  if (env.AV_DATA_DIR)
+    return { dataDir: env.AV_DATA_DIR, source: "explicit", agentName, agentNameSource };
   const base = join6(env.HOME ?? "", ".agentvault", "grok-room-bridge");
-  return { dataDir: join6(base, slugify2(env.AV_AGENT_NAME ?? "grok")), source: "per-agent" };
+  const perAgent = join6(base, slugify2(agentName));
+  if (!supplied && !hasPersistedCreds(perAgent)) {
+    throw new Error(
+      `AV_AGENT_NAME is required \u2014 it names WHICH agent this bridge runs as, and therefore where its credentials live. No credentials were found at ${perAgent}, so there is no existing install to infer a name from. Re-run with AV_AGENT_NAME=<agent-name> set.`
+    );
+  }
+  return { dataDir: perAgent, source: "per-agent", agentName, agentNameSource };
 }
 function loadConfig(env, argv = []) {
-  const { dataDir, source: dataDirSource } = resolveDataDir(env);
+  const { dataDir, source: dataDirSource, agentName, agentNameSource } = resolveDataDir(env);
+  if (agentNameSource === "defaulted") {
+    logLine(
+      `[config] AV_AGENT_NAME was not set \u2014 running as "${agentName}" from the existing credentials at ${dataDir}. Set AV_AGENT_NAME to name this agent explicitly; a future install will require it.`
+    );
+  }
   const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || readPendingInvite(dataDir) || "";
+  if (argv.includes(REMOVED_INSTALL_FLAG)) {
+    throw new Error(
+      `${REMOVED_INSTALL_FLAG} was removed \u2014 it handed the agent over from a foreground process that could be reaped before the encrypted group finished forming, leaving an agent that was connected and mute (#909). Use the subcommand instead, which lets the service enrol itself:
+  npm i -g @agentvault/grok-bridge && AV_AGENT_NAME=<agent-name> AV_INVITE_TOKEN=<token> agentvault-grok-bridge install`
+    );
+  }
   const unknownFlags = argv.filter((a2) => a2.startsWith("-") && !KNOWN_FLAGS.has(a2));
   if (unknownFlags.length) {
     throw new Error(
       `unknown option(s): ${unknownFlags.join(", ")} \u2014 supported flags are ${[...KNOWN_FLAGS].join(", ")}`
     );
   }
-  const workspaceDir = env.AV_WORKSPACE_DIR || join6(dirname(dataDir), "workspaces", slugify2(env.AV_AGENT_NAME ?? "grok"));
+  const workspaceDir = env.AV_WORKSPACE_DIR || join6(dirname(dataDir), "workspaces", slugify2(agentName));
   const wsReal = resolve2(workspaceDir);
   const ddReal = resolve2(dataDir);
   if (wsReal === ddReal || wsReal.startsWith(ddReal + sep) || ddReal.startsWith(wsReal + sep)) {
@@ -129,17 +179,14 @@ function loadConfig(env, argv = []) {
     inviteToken,
     dataDir,
     dataDirSource,
-    // One-paste install (--install): enrol, hand off to the supervisor, exit.
-    // Default false keeps a bare `npx @agentvault/grok-bridge` run identical.
-    installAfterEnroll: argv.includes(INSTALL_FLAG),
     ...parseInfoFlags(argv),
     apiUrl: env.AV_API_URL ?? "https://api.agentvault.chat",
     // Identity shown to the agent's own session. Set this to the agent's
     // AgentVault name via AV_AGENT_NAME (the native connect command passes it).
-    // Defaults to "Grok" — this package IS the Grok bridge, so an unset
-    // AV_AGENT_NAME still names the actual model running the session, not a
-    // placeholder impersonating some other agent.
-    agentName: env.AV_AGENT_NAME ?? "Grok",
+    // Resolved in resolveDataDir so the name, the data dir and the workspace dir
+    // can never disagree about who this agent is (#921/#927).
+    agentName,
+    agentNameSource,
     roomFilter: env.AV_ROOM_ID || void 0,
     workspaceDir,
     grokPath: env.AV_GROK_PATH || void 0,
@@ -149,35 +196,19 @@ function loadConfig(env, argv = []) {
     systemPrompt: env.AV_SYSTEM_PROMPT || void 0
   };
 }
-var INSTALL_FLAG, VERSION_FLAGS, HELP_FLAGS, KNOWN_FLAGS, CRED_FILES, BACKUP_FILE;
+var REMOVED_INSTALL_FLAG, VERSION_FLAGS, HELP_FLAGS, KNOWN_FLAGS, CRED_FILES, BACKUP_FILE, LEGACY_DEFAULT_AGENT_NAME;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_pending_invite();
-    INSTALL_FLAG = "--install";
+    init_log();
+    REMOVED_INSTALL_FLAG = "--install";
     VERSION_FLAGS = ["--version", "-v"];
     HELP_FLAGS = ["--help", "-h"];
-    KNOWN_FLAGS = /* @__PURE__ */ new Set([INSTALL_FLAG, ...VERSION_FLAGS, ...HELP_FLAGS]);
+    KNOWN_FLAGS = /* @__PURE__ */ new Set([...VERSION_FLAGS, ...HELP_FLAGS]);
     CRED_FILES = ["agentvault.json", "secure-channel.json"];
     BACKUP_FILE = "agentvault.json.bak";
-  }
-});
-
-// src/log.ts
-import { format } from "node:util";
-function stamp(message) {
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  return message.split("\n").map((line) => `${ts} ${line}`).join("\n");
-}
-function logLine(...args) {
-  console.error(stamp(format(...args)));
-}
-function printLine(text) {
-  console.log(text);
-}
-var init_log = __esm({
-  "src/log.ts"() {
-    "use strict";
+    LEGACY_DEFAULT_AGENT_NAME = "Grok";
   }
 });
 
@@ -211,16 +242,6 @@ function writeLauncher(deps, spec) {
   deps.writeFile(spec.launcherPath, spec.launcherScript);
   deps.chmod(spec.launcherPath, 493);
 }
-function parseLauncherEntrypoint(script) {
-  if (!script) return void 0;
-  const m2 = /^if n=\$\(command -v .+\); then exec "\$n" (.+) "\$@"; fi$/m.exec(script);
-  if (!m2) return void 0;
-  return unSq(m2[1]);
-}
-function unSq(quoted) {
-  if (quoted.length < 2 || !quoted.startsWith("'") || !quoted.endsWith("'")) return void 0;
-  return quoted.slice(1, -1).replace(/'\\''/g, "'");
-}
 var FALLBACK_NODES;
 var init_launcher = __esm({
   "src/service/launcher.ts"() {
@@ -314,6 +335,37 @@ ${envEntries}
 </plist>
 `;
 }
+function parsePlistEnv(xml) {
+  const out = {};
+  const keyIdx = xml.indexOf("<key>EnvironmentVariables</key>");
+  if (keyIdx < 0) return out;
+  const open = xml.indexOf("<dict>", keyIdx);
+  if (open < 0) return out;
+  let depth = 0;
+  let i2 = open;
+  let close = -1;
+  const tag = /<(\/?)dict>/g;
+  tag.lastIndex = open;
+  let m2;
+  while (m2 = tag.exec(xml)) {
+    depth += m2[1] ? -1 : 1;
+    if (depth === 0) {
+      close = m2.index;
+      break;
+    }
+    i2 = m2.index;
+  }
+  void i2;
+  if (close < 0) return out;
+  const body = xml.slice(open, close);
+  const pair = /<key>([\s\S]*?)<\/key>\s*<string>([\s\S]*?)<\/string>/g;
+  let p2;
+  while (p2 = pair.exec(body)) out[unesc(p2[1])] = unesc(p2[2]);
+  return out;
+}
+function unesc(s2) {
+  return s2.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
 var LaunchdBackend;
 var init_launchd = __esm({
   "src/service/launchd.ts"() {
@@ -368,6 +420,26 @@ var init_launchd = __esm({
         const r2 = this.deps.exec("launchctl", ["print", `${this.domain()}/${label}`]);
         return { loaded: r2.code === 0, detail: r2.stdout };
       }
+      /** #913 item 3 — every installed service whose label starts with `prefix`.
+       *
+       *  Reads the plist directory rather than `launchctl list`, because an ORPHAN
+       *  is typically installed-but-not-loaded: the revoked device exits 0 and
+       *  KeepAlive leaves it down. `launchctl list` would not show the very thing
+       *  doctor exists to find. */
+      list(prefix) {
+        const dir = join11(this.deps.home, "Library", "LaunchAgents");
+        const out = [];
+        for (const name of this.deps.readdir(dir)) {
+          if (!name.startsWith(prefix) || !name.endsWith(".plist")) continue;
+          const path2 = join11(dir, name);
+          out.push({
+            label: name.slice(0, -".plist".length),
+            path: path2,
+            env: parsePlistEnv(this.deps.readFile(path2))
+          });
+        }
+        return out.sort((a2, b2) => a2.label.localeCompare(b2.label));
+      }
     };
   }
 });
@@ -399,6 +471,24 @@ StandardError=append:${spec.logErr}
 WantedBy=default.target
 `;
 }
+function parseUnitEnv(text) {
+  const out = {};
+  for (const line of text.split("\n")) {
+    const m2 = /^Environment="([\s\S]*)"\s*$/.exec(line.trim());
+    if (!m2) continue;
+    const eq = unq(m2[1]);
+    const at = eq.indexOf("=");
+    if (at <= 0) continue;
+    out[eq.slice(0, at)] = eq.slice(at + 1);
+  }
+  return out;
+}
+function unq(s2) {
+  return s2.replace(/%%/g, "%").replace(
+    /\\([\s\S])/g,
+    (_2, c2) => c2 === "n" ? "\n" : c2 === "r" ? "\r" : c2 === "t" ? "	" : c2
+  );
+}
 var SystemdBackend;
 var init_systemd = __esm({
   "src/service/systemd.ts"() {
@@ -439,18 +529,33 @@ var init_systemd = __esm({
         const active = this.deps.exec("systemctl", ["--user", "is-active", `${label}.service`]);
         return { loaded: enabled.code === 0, detail: `${enabled.stdout.trim() || "?"} / ${active.stdout.trim() || "?"}` };
       }
+      /** #913 item 3 — every installed unit whose label starts with `prefix`.
+       *
+       *  Reads the unit directory rather than `systemctl list-units`, because an
+       *  ORPHAN is installed-but-inactive: the revoked device exits 0, which
+       *  SuccessExitStatus=0 treats as success, so it is never restarted. A
+       *  running-units listing would not show the thing doctor exists to find. */
+      list(prefix) {
+        const dir = join12(this.deps.home, ".config", "systemd", "user");
+        const out = [];
+        for (const name of this.deps.readdir(dir)) {
+          if (!name.startsWith(prefix) || !name.endsWith(".service")) continue;
+          const path2 = join12(dir, name);
+          out.push({
+            label: name.slice(0, -".service".length),
+            path: path2,
+            env: parseUnitEnv(this.deps.readFile(path2))
+          });
+        }
+        return out.sort((a2, b2) => a2.label.localeCompare(b2.label));
+      }
     };
   }
 });
 
 // src/service/backend.ts
-var backend_exports = {};
-__export(backend_exports, {
-  defaultDeps: () => defaultDeps,
-  selectBackend: () => selectBackend
-});
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync2, existsSync as existsSync4, chmodSync as chmodSync5 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync2, existsSync as existsSync4, chmodSync as chmodSync5, readdirSync, readFileSync as readFileSync4 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -465,7 +570,21 @@ function defaultDeps() {
     mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
     chmod: (p2, m2) => chmodSync5(p2, m2),
     rm: (p2) => rmSync2(p2, { force: true }),
-    exists: (p2) => existsSync4(p2)
+    exists: (p2) => existsSync4(p2),
+    readdir: (p2) => {
+      try {
+        return readdirSync(p2);
+      } catch {
+        return [];
+      }
+    },
+    readFile: (p2) => {
+      try {
+        return readFileSync4(p2, "utf8");
+      } catch {
+        return "";
+      }
+    }
   };
 }
 function selectBackend(platform, deps) {
@@ -488,6 +607,7 @@ var init_backend = __esm({
 // src/service/subcommand.ts
 var subcommand_exports = {};
 __export(subcommand_exports, {
+  labelFor: () => labelFor,
   maybeRunServiceSubcommand: () => maybeRunServiceSubcommand
 });
 function requireAgentName(env) {
@@ -510,7 +630,9 @@ function maybeRunServiceSubcommand(argv, env, deps) {
     const looksLikeFlag = cmd.startsWith("-");
     if (!looksLikeToken && !looksLikeFlag) {
       throw new Error(
-        `unknown subcommand: ${cmd} \u2014 expected one of ${[...SERVICE_CMDS].join(", ")}, an invite token, or no argument at all`
+        // "doctor" is dispatched earlier, in index.ts, so it never reaches here.
+        // Named anyway: a customer who typed `doctr` should see it offered.
+        `unknown subcommand: ${cmd} \u2014 expected one of ${[...SERVICE_CMDS, "doctor"].join(", ")}, an invite token, or no argument at all`
       );
     }
     return false;
@@ -521,6 +643,7 @@ function maybeRunServiceSubcommand(argv, env, deps) {
   try {
     if (cmd === "install") {
       requireAgentName(env);
+      assertInstallableEntrypoint(entrypoint);
       const cfg = loadConfig(env, []);
       const firstBoot = !hasPersistedCreds(cfg.dataDir) && !!cfg.inviteToken;
       if (firstBoot) {
@@ -578,96 +701,313 @@ var init_subcommand = __esm({
   }
 });
 
-// src/service/install-on-ready.ts
-var install_on_ready_exports = {};
-__export(install_on_ready_exports, {
-  installOnReady: () => installOnReady
+// src/service/doctor.ts
+import { basename } from "node:path";
+async function buildDoctorReport(d2) {
+  const installed = d2.labelPrefixes.flatMap((p2) => d2.backend.list(p2));
+  const services = [];
+  for (const s2 of installed) services.push(await inspect(s2, d2));
+  const claimed = new Set(installed.map((s2) => s2.env.AV_DATA_DIR).filter(Boolean));
+  const unsupervised = [];
+  for (const dataDir of d2.credDirs()) {
+    if (claimed.has(dataDir)) continue;
+    unsupervised.push(await inspectUnsupervised(dataDir, d2));
+  }
+  return {
+    labelPrefixes: d2.labelPrefixes,
+    services,
+    unsupervised,
+    notChecked: d2.otherLabels()
+  };
+}
+async function inspect(s2, d2) {
+  const agentName = s2.env.AV_AGENT_NAME ?? "";
+  const dataDir = s2.env.AV_DATA_DIR ?? "";
+  let loaded = false;
+  try {
+    loaded = d2.backend.status(s2.label).loaded;
+  } catch {
+  }
+  const base = { label: s2.label, agentName, dataDir, loaded, deviceId: "" };
+  if (!dataDir) {
+    return {
+      ...base,
+      verdict: "WARN",
+      detail: "the service definition bakes no AV_DATA_DIR, so doctor cannot find its credentials and cannot check its device"
+    };
+  }
+  const creds = d2.readCreds(dataDir);
+  if (!creds?.deviceId) {
+    return {
+      ...base,
+      verdict: "WARN",
+      detail: `no credentials at ${dataDir} \u2014 installed, but this agent never enrolled`
+    };
+  }
+  const deviceId = creds.deviceId;
+  let probe;
+  try {
+    probe = await d2.fetchStatus(d2.apiUrl, deviceId);
+  } catch (e) {
+    return { ...base, deviceId, verdict: "SKIP", detail: `could not check the device: ${e.message}` };
+  }
+  if (probe.inconclusive) {
+    return { ...base, deviceId, verdict: "SKIP", detail: `could not check the device: ${probe.inconclusive}` };
+  }
+  if (probe.gone) {
+    return {
+      ...base,
+      deviceId,
+      verdict: "FAIL",
+      detail: "the device no longer exists \u2014 this service is an orphan",
+      fix: d2.uninstallCommand(agentName)
+    };
+  }
+  switch (probe.status) {
+    case "ACTIVE":
+      return { ...base, deviceId, verdict: "PASS", detail: "device ACTIVE" };
+    case "PENDING":
+      return {
+        ...base,
+        deviceId,
+        verdict: "WARN",
+        detail: "device PENDING \u2014 enrolled, but never approved in AgentVault"
+      };
+    case "REVOKED":
+      return {
+        ...base,
+        deviceId,
+        verdict: "FAIL",
+        detail: "the device was REVOKED \u2014 this service is an orphan",
+        fix: d2.uninstallCommand(agentName)
+      };
+    default:
+      return {
+        ...base,
+        deviceId,
+        verdict: "SKIP",
+        detail: `the server reported a status this build does not recognise (${probe.status || "none"})`
+      };
+  }
+}
+async function inspectUnsupervised(dataDir, d2) {
+  const agentName = basename(dataDir);
+  const base = { dataDir, agentName, deviceId: "" };
+  const deviceId = d2.readCreds(dataDir)?.deviceId;
+  if (!deviceId) {
+    return { ...base, verdict: "WARN", detail: "credentials present but they hold no device id" };
+  }
+  let probe;
+  try {
+    probe = await d2.fetchStatus(d2.apiUrl, deviceId);
+  } catch (e) {
+    return { ...base, deviceId, verdict: "SKIP", detail: `could not check the device: ${e.message}` };
+  }
+  if (probe.inconclusive) {
+    return { ...base, deviceId, verdict: "SKIP", detail: `could not check the device: ${probe.inconclusive}` };
+  }
+  if (probe.gone) {
+    return {
+      ...base,
+      deviceId,
+      verdict: "WARN",
+      detail: "the device no longer exists \u2014 these are leftover credentials for a deleted agent"
+    };
+  }
+  if (probe.status === "ACTIVE") {
+    return {
+      ...base,
+      deviceId,
+      verdict: "WARN",
+      detail: "the device is ACTIVE but nothing supervises it \u2014 this agent is not running",
+      fix: d2.installCommand(agentName)
+    };
+  }
+  if (probe.status === "PENDING") {
+    return {
+      ...base,
+      deviceId,
+      verdict: "WARN",
+      detail: "device PENDING \u2014 enrolled, but never approved in AgentVault"
+    };
+  }
+  if (probe.status === "REVOKED") {
+    return {
+      ...base,
+      deviceId,
+      verdict: "WARN",
+      detail: "the device was REVOKED \u2014 these are leftover credentials"
+    };
+  }
+  return {
+    ...base,
+    deviceId,
+    verdict: "SKIP",
+    detail: `the server reported a status this build does not recognise (${probe.status || "none"})`
+  };
+}
+function formatDoctorReport(r2) {
+  const out = [];
+  out.push(`Services installed for this bridge (${r2.labelPrefixes.map((p2) => p2 + "*").join(", ")})`);
+  if (r2.services.length === 0) {
+    out.push(`  No services installed for this bridge on this machine.`);
+  }
+  for (const s2 of r2.services) {
+    out.push(
+      `  ${s2.verdict.padEnd(PAD)}${s2.label}  [${s2.agentName || "unnamed"}]  ${s2.loaded ? "loaded" : "not loaded"}  \u2014  ${s2.detail}`
+    );
+    if (s2.fix) out.push(`  ${"".padEnd(PAD)}fix: ${s2.fix}`);
+  }
+  if (r2.unsupervised.length) {
+    out.push("");
+    out.push("Credentials on disk that no installed service points at");
+    for (const u2 of r2.unsupervised) {
+      out.push(`  ${u2.verdict.padEnd(PAD)}${u2.agentName}  \u2014  ${u2.detail}`);
+      out.push(`  ${"".padEnd(PAD)}${u2.dataDir}`);
+      if (u2.fix) out.push(`  ${"".padEnd(PAD)}fix: ${u2.fix}`);
+    }
+  }
+  if (r2.notChecked.length) {
+    out.push("");
+    out.push("Found on this machine, NOT checked by this command");
+    for (const l2 of r2.notChecked) out.push(`  ${l2}`);
+    out.push(
+      "  These belong to other AgentVault agent families. This command can only read the credentials of its own, so it says nothing about their health."
+    );
+  }
+  const counts = { PASS: 0, WARN: 0, FAIL: 0, SKIP: 0 };
+  for (const s2 of r2.services) counts[s2.verdict]++;
+  for (const u2 of r2.unsupervised) counts[u2.verdict]++;
+  out.push("");
+  out.push(
+    `Summary: ${counts.PASS} PASS, ${counts.WARN} WARN, ${counts.FAIL} FAIL, ${counts.SKIP} SKIP` + (counts.SKIP ? " (SKIP = could not check, NOT a problem found)" : "")
+  );
+  if (counts.FAIL) {
+    out.push(
+      "`uninstall` removes the SERVICE only \u2014 your credentials stay on disk, so a mistake here costs a re-install, not an identity."
+    );
+  }
+  return out;
+}
+var PAD;
+var init_doctor = __esm({
+  "src/service/doctor.ts"() {
+    "use strict";
+    PAD = 6;
+  }
+});
+
+// src/service/doctor-cli.ts
+var doctor_cli_exports = {};
+__export(doctor_cli_exports, {
+  fetchDeviceStatus: () => fetchDeviceStatus,
+  maybeRunDoctorSubcommand: () => maybeRunDoctorSubcommand,
+  realDoctorDeps: () => realDoctorDeps
 });
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
 import { join as join13 } from "node:path";
-function installOnReady(channel, cfg, deps) {
-  const hasCreds = deps.hasCreds ?? hasPersistedCreds;
-  const readLauncher = deps.readLauncher ?? ((p2) => existsSync5(p2) ? readFileSync4(p2, "utf8") : void 0);
-  const fenceAuthExists = deps.fenceAuthExists ?? ((home) => existsSync5(join13(home, ".grok", "auth.json")));
-  let fired = false;
-  channel.on("ready", () => {
-    if (fired) return;
-    fired = true;
-    void (async () => {
-      try {
-        if (!hasCreds(cfg.dataDir)) {
-          throw new Error(
-            `enrolment did not persist credentials to ${cfg.dataDir} \u2014 refusing to install a service that would crash-loop`
-          );
-        }
-        if (!fenceAuthExists(cfg.fenceHome)) {
-          throw new Error(
-            "no grok credential in the fence \u2014 run `grok login`, then paste the same command again (your enrolment is already saved, so the token is not needed). Note that XAI_API_KEY from your shell is NOT inherited by the background service."
-          );
-        }
-        if (deps.waitForIdle) {
-          const timeoutMs = deps.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
-          let timer;
-          const timedOut = await Promise.race([
-            deps.waitForIdle().then(() => false),
-            new Promise((r2) => {
-              timer = setTimeout(() => r2(true), timeoutMs);
-            })
-          ]);
-          if (timer) clearTimeout(timer);
-          if (timedOut) {
-            deps.log(
-              `agent still busy after ${timeoutMs}ms \u2014 handing off anyway; that reply may be lost`
-            );
-          }
-        }
-        const reaped = await deps.reap();
-        if (!reaped.ok) {
-          throw new Error(
-            `teardown did not complete (${reaped.failures.join("; ")}) \u2014 refusing to install over a session that may still be open`
-          );
-        }
-        const backend = deps.backend ?? selectBackend(process.platform);
-        const spec = buildServiceSpec(cfg, {
-          entrypoint: deps.entrypoint,
-          home: deps.env.HOME ?? "",
-          path: deps.env.PATH ?? ""
-        });
-        const installedEntrypoint = parseLauncherEntrypoint(readLauncher(spec.launcherPath));
-        const entrypointIsCurrent = installedEntrypoint !== void 0 && !isEphemeralEntrypoint(installedEntrypoint) && installedEntrypoint === deps.entrypoint;
-        if (backend.status(spec.label).loaded && entrypointIsCurrent) {
-          backend.restart(spec.label);
-          deps.log(`service ${spec.label} already installed and current \u2014 restarted`);
-        } else {
-          backend.install(spec);
-          deps.log(
-            installedEntrypoint && !entrypointIsCurrent ? `service ${spec.label} pointed at a stale entrypoint (${installedEntrypoint}) \u2014 re-installed` : `installed service ${spec.label}`
-          );
-        }
-        const after = backend.status(spec.label);
-        if (!after.loaded) {
-          throw new Error(`service did not load: ${after.detail}`);
-        }
-        deps.log(`it is running now. logs: ${spec.logErr}`);
-        deps.log(`check it:   agentvault-grok-bridge status`);
-        deps.log(`restart it: agentvault-grok-bridge restart   (never 'install')`);
-        deps.exit(0);
-      } catch (e) {
-        deps.log(`--install failed: ${e instanceof Error ? e.message : String(e)}`);
-        deps.exit(1);
-      }
-    })();
+import { readdirSync as readdirSync2 } from "node:fs";
+async function fetchDeviceStatus(apiUrl, deviceId, doFetch = fetch) {
+  const res = await doFetch(`${apiUrl}/api/v1/devices/${deviceId}/status`, {
+    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
   });
+  if (res.status === 404) {
+    try {
+      await res.json();
+    } catch {
+      return {
+        inconclusive: `${apiUrl} answered 404 with a non-JSON body \u2014 check AV_API_URL points at the API`
+      };
+    }
+    return { gone: true };
+  }
+  if (res.status === 429) return { inconclusive: "rate limited by the API (429)" };
+  if (!res.ok) return { inconclusive: `the API answered ${res.status}` };
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return { inconclusive: `${apiUrl} answered 200 with a non-JSON body \u2014 check AV_API_URL` };
+  }
+  return { status: body?.status };
+}
+function listCredDirs(base) {
+  const out = [];
+  if (hasPersistedCreds(base)) out.push(base);
+  let names;
+  try {
+    names = readdirSync2(base);
+  } catch {
+    return out;
+  }
+  for (const name of names) {
+    const dir = join13(base, name);
+    if (hasPersistedCreds(dir)) out.push(dir);
+  }
+  return out;
+}
+function otherFamilyLabels(backend) {
+  const out = [];
+  for (const p2 of OTHER_FAMILY_PREFIXES) {
+    try {
+      for (const s2 of backend.list(p2)) out.push(s2.label);
+    } catch {
+    }
+  }
+  return out.sort();
+}
+function realDoctorDeps(env) {
+  const backend = selectBackend(process.platform);
+  const base = join13(env.HOME ?? "", ".agentvault", "grok-room-bridge");
+  return {
+    backend,
+    labelPrefixes: [LABEL_PREFIX],
+    base,
+    // Same default as config.ts. Read from the env directly rather than through
+    // loadConfig, which now REFUSES without AV_AGENT_NAME (#921) — and doctor's
+    // whole job is to run when you do not know which agents exist.
+    apiUrl: env.AV_API_URL ?? "https://api.agentvault.chat",
+    uninstallCommand: (n2) => `AV_AGENT_NAME=${n2 || "<agent-name>"} agentvault-grok-bridge uninstall`,
+    installCommand: (n2) => `AV_AGENT_NAME=${n2 || "<agent-name>"} agentvault-grok-bridge install`,
+    readCreds: (dir) => {
+      const deviceId = readPersistedDeviceId(dir);
+      return deviceId ? { deviceId } : null;
+    },
+    credDirs: () => listCredDirs(base),
+    fetchStatus: (apiUrl, deviceId) => fetchDeviceStatus(apiUrl, deviceId),
+    otherLabels: () => otherFamilyLabels(backend)
+  };
 }
-var DEFAULT_IDLE_TIMEOUT_MS;
-var init_install_on_ready = __esm({
-  "src/service/install-on-ready.ts"() {
+async function maybeRunDoctorSubcommand(argv, opts = {}) {
+  if (argv[2] !== "doctor") return false;
+  const log = opts.log ?? printLine;
+  try {
+    const report = await buildDoctorReport(opts.deps ?? realDoctorDeps(opts.env ?? process.env));
+    for (const line of formatDoctorReport(report)) log(line);
+    if (report.services.some((s2) => s2.verdict === "FAIL")) process.exitCode = 1;
+  } catch (e) {
+    log(`doctor could not run: ${e.message}`);
+    process.exitCode = 1;
+  }
+  return true;
+}
+var LABEL_PREFIX, OTHER_FAMILY_PREFIXES, PROBE_TIMEOUT_MS;
+var init_doctor_cli = __esm({
+  "src/service/doctor-cli.ts"() {
     "use strict";
-    init_config();
-    init_spec();
-    init_launcher();
     init_backend();
-    DEFAULT_IDLE_TIMEOUT_MS = 3e4;
+    init_config();
+    init_log();
+    init_doctor();
+    LABEL_PREFIX = "dev.agentvault.grok-";
+    OTHER_FAMILY_PREFIXES = [
+      "dev.agentvault.bridge-",
+      // claude bridge, current label
+      "com.agentvault.claude-bridge.",
+      // claude bridge, pre-rename label (#837)
+      "ai.hermes.gateway"
+      // hermes, one service per profile
+    ];
+    PROBE_TIMEOUT_MS = 8e3;
   }
 });
 
@@ -45559,6 +45899,11 @@ var init_ratchet = __esm2({
         return { header, headerSignature, ciphertext, nonce };
       }
       decrypt(message) {
+        if (this.state.peerIdentityPublicKey) {
+          if (!verifyHeaderSignature(message.header, message.headerSignature, this.state.peerIdentityPublicKey)) {
+            throw new Error("Header signature verification failed");
+          }
+        }
         const isV2 = message.envelopeVersion === "2.0.0" && message.encryptedHeader != null && message.headerNonce != null;
         const skippedResult = this.trySkippedKeys(message, isV2);
         if (skippedResult !== null) {
@@ -45572,14 +45917,14 @@ var init_ratchet = __esm2({
           if (message.header.messageNumber === 0) {
             try {
               const { messageKey: testKey, headerKey: testHeaderKey, nextChainKey: nextChainKey2 } = kdfChainKey(this.state.rootKey);
-              let ad2;
+              let ad;
               if (isV2) {
                 libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.encryptedHeader, null, message.headerNonce, testHeaderKey);
-                ad2 = message.encryptedHeader;
+                ad = message.encryptedHeader;
               } else {
-                ad2 = serializeHeader(message.header);
+                ad = serializeHeader(message.header);
               }
-              const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad2, message.nonce, testKey);
+              const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, testKey);
               this.state.dhReceivingPublicKey = message.header.dhPublicKey;
               this.state.receivingChain = {
                 chainKey: nextChainKey2,
@@ -45599,13 +45944,7 @@ var init_ratchet = __esm2({
         this.skipMessages(this.state.receivingChain, message.header.messageNumber, message.header.dhPublicKey, isV2);
         const chain = this.state.receivingChain;
         const { nextChainKey, messageKey, headerKey } = kdfChainKey(chain.chainKey);
-        chain.chainKey = nextChainKey;
-        chain.messageNumber++;
-        if (this.state.peerIdentityPublicKey) {
-          if (!verifyHeaderSignature(message.header, message.headerSignature, this.state.peerIdentityPublicKey)) {
-            throw new Error("Header signature verification failed");
-          }
-        }
+        let plaintextBytes;
         if (isV2) {
           try {
             libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.encryptedHeader, null, message.headerNonce, headerKey);
@@ -45613,19 +45952,21 @@ var init_ratchet = __esm2({
             throw new Error("V2 header decryption failed");
           }
           try {
-            const plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, message.encryptedHeader, message.nonce, messageKey);
-            return libsodium_wrappers_default.to_string(plaintextBytes);
+            plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, message.encryptedHeader, message.nonce, messageKey);
           } catch {
             throw new Error("V2 decryption failed: ciphertext tampered or wrong key");
           }
+        } else {
+          const ad = serializeHeader(message.header);
+          try {
+            plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, messageKey);
+          } catch {
+            throw new Error("Decryption failed: ciphertext tampered or wrong key");
+          }
         }
-        const ad = serializeHeader(message.header);
-        try {
-          const plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, messageKey);
-          return libsodium_wrappers_default.to_string(plaintextBytes);
-        } catch {
-          throw new Error("Decryption failed: ciphertext tampered or wrong key");
-        }
+        chain.chainKey = nextChainKey;
+        chain.messageNumber++;
+        return libsodium_wrappers_default.to_string(plaintextBytes);
       }
       dhRatchetReceive(theirDhPublic) {
         this.state.previousSendingChainLength = this.state.sendingChain?.messageNumber ?? 0;
@@ -63799,6 +64140,23 @@ var init_mls_delivery_order = __esm2({
     "use strict";
   }
 });
+function noteObservedEpoch(current, seen) {
+  const n2 = Number(seen);
+  if (!Number.isInteger(n2) || n2 < 0)
+    return current;
+  return n2 > current ? n2 : current;
+}
+function needsPreSendResync(localEpoch, observedEpoch) {
+  if (!Number.isInteger(localEpoch) || !Number.isInteger(observedEpoch)) {
+    return false;
+  }
+  return observedEpoch > localEpoch;
+}
+var init_mls_presend_epoch = __esm2({
+  "../crypto/dist/mls-presend-epoch.js"() {
+    "use strict";
+  }
+});
 var dist_exports = {};
 __export2(dist_exports, {
   AV_CREDENTIAL_CONTEXT: () => AV_CREDENTIAL_CONTEXT,
@@ -63868,7 +64226,9 @@ __export2(dist_exports, {
   hexTransportToEncryptedMessage: () => hexTransportToEncryptedMessage,
   issueCredential: () => issueCredential,
   multibaseToPublicKey: () => multibaseToPublicKey,
+  needsPreSendResync: () => needsPreSendResync,
   normalizeBackupCode: () => normalizeBackupCode,
+  noteObservedEpoch: () => noteObservedEpoch,
   orderDeliveryBatch: () => orderDeliveryBatch,
   parseTraceparent: () => parseTraceparent,
   performX3DH: () => performX3DH,
@@ -63908,6 +64268,7 @@ var init_dist = __esm2({
     init_mls_group();
     await init_owner_sync();
     init_mls_delivery_order();
+    init_mls_presend_epoch();
   }
 });
 async function ensureSecureDir(dir) {
@@ -64100,7 +64461,7 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.23" : FALLBACK;
+  const v2 = true ? "0.23.27" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildClientVersion(override) {
@@ -65016,6 +65377,7 @@ var init_channel = __esm2({
     await init_libsodium_wrappers();
     await init_dist();
     await init_dist();
+    init_mls_presend_epoch();
     init_mls_state();
     await init_mls_kp_pool();
     init_client_version();
@@ -65129,6 +65491,17 @@ var init_channel = __esm2({
        *  self-heal rather than be logged and dropped. */
       _mlsCommitFailCounts = /* @__PURE__ */ new Map();
       static MAX_MLS_DECRYPT_FAILS = 3;
+      /**
+       * #1084: consecutive resyncs that found NOTHING to apply, per group.
+       *
+       * "No new commits" means the server holds no commit past our epoch — we are
+       * NOT BEHIND. Treating that as corruption and re-keying is what drove the
+       * epoch churn (see `_resyncOnDivergence`). But a state that is genuinely
+       * broken while its epoch counter happens to match must still recover, so the
+       * suppression is bounded rather than absolute.
+       */
+      _resyncNoOpStrikes = /* @__PURE__ */ new Map();
+      static MAX_RESYNC_NOOPS = 3;
       /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
       _mlsKeyPackage = null;
       /** Pending KeyPackage bundle from request-Welcome flow (used by _handleMlsWelcome). */
@@ -65166,6 +65539,13 @@ var init_channel = __esm2({
       _kpPoolFilling = false;
       /** Buffer for MLS commits received before Welcome (keyed by groupId, sorted by epoch). */
       _pendingMlsCommits = /* @__PURE__ */ new Map();
+      /**
+       * #1013: the highest group epoch any inbound frame has reported, per MLS
+       * group id. Every inbound frame carries the epoch the group was at when it
+       * was produced, so each is a LOWER BOUND on the group's current epoch — the
+       * hint is monotonic and only ever rises.
+       */
+      _observedGroupEpochs = /* @__PURE__ */ new Map();
       /** In-memory credential store for renter-provided credentials (never persisted). */
       _credentialStore = new CredentialStore();
       /** Rooms whose roster has been refreshed from the backend at least once in
@@ -65850,16 +66230,44 @@ var init_channel = __esm2({
         const pendingWsSends = [];
         const sentSharedGroupIds = /* @__PURE__ */ new Set();
         const addressedMlsGroupIds = [];
+        if (!(this._persisted?.mlsGroups && this._state === "ready" && this._ws)) {
+          console.warn(
+            `[SecureChannel] send(): shared-MLS block SKIPPED \u2014 mlsGroups=${this._persisted?.mlsGroups ? Object.keys(this._persisted.mlsGroups).length : "none"} state=${this._state} ws=${this._ws ? "open" : "null"}`
+          );
+        }
         if (this._persisted?.mlsGroups && this._state === "ready" && this._ws) {
           const targetSharedGid = targetConvId ? this._sessionGroupIds?.get(targetConvId) : void 0;
+          console.log(
+            `[SecureChannel] send(): considering ${Object.keys(this._persisted.mlsGroups).length} shared group(s); targetConvId=${targetConvId ? targetConvId.slice(0, 8) : "(none \u2014 broadcast)"} targetSharedGid=${targetSharedGid ? targetSharedGid.slice(0, 8) : "(none)"}`
+          );
+          const skipped = [];
           for (const [gid, entry] of Object.entries(this._persisted.mlsGroups)) {
-            if (targetConvId && gid !== targetSharedGid) continue;
-            if (!entry.mlsGroupId) continue;
+            if (targetConvId && gid !== targetSharedGid) {
+              skipped.push(`${gid.slice(0, 8)}:not-target`);
+              continue;
+            }
+            if (!entry.mlsGroupId) {
+              skipped.push(`${gid.slice(0, 8)}:no-mlsGroupId`);
+              continue;
+            }
             const mlsGroup = this._mlsGroups.get(`1to1-group:${gid}`);
-            if (!mlsGroup?.isInitialized || Number(mlsGroup.epoch) <= 0) continue;
+            if (!mlsGroup?.isInitialized) {
+              skipped.push(`${gid.slice(0, 8)}:not-in-memory`);
+              continue;
+            }
+            if (Number(mlsGroup.epoch) <= 0) {
+              skipped.push(`${gid.slice(0, 8)}:epoch<=0`);
+              continue;
+            }
             try {
               const plaintextBytes = new TextEncoder().encode(plaintext);
-              const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+              const cipherBytes = await this._encryptWithCatchUp(
+                mlsGroup,
+                `1to1-group:${gid}`,
+                entry.mlsGroupId,
+                `1:1 group ${gid.slice(0, 8)}`,
+                plaintextBytes
+              );
               await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
               const payload = {
                 group_id: entry.mlsGroupId,
@@ -65881,8 +66289,12 @@ var init_channel = __esm2({
               console.log(`[SecureChannel] Shared MLS group send for group ${gid.slice(0, 8)} (${entry.mlsGroupId.slice(0, 8)})`);
             } catch (err) {
               console.error(`[SecureChannel] Shared MLS group send failed for ${gid.slice(0, 8)}:`, err);
+              skipped.push(`${gid.slice(0, 8)}:encrypt-threw`);
             }
           }
+          if (skipped.length > 0) {
+            console.log(`[SecureChannel] send(): skipped ${skipped.length} group(s) \u2014 ${skipped.join(", ")}`);
+          }
         }
         for (const [convId, session] of this._sessions) {
           if (!session.activated) continue;
@@ -65902,7 +66314,14 @@ var init_channel = __esm2({
             }
             if (mlsGroup?.isInitialized && mlsGroupId && Number(mlsGroup.epoch) > 0 && this._state === "ready" && this._ws) {
               const plaintextBytes = new TextEncoder().encode(plaintext);
-              const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+              const sessionGroupKey = convGroupId && this._mlsGroups.has(`1to1-group:${convGroupId}`) ? `1to1-group:${convGroupId}` : `conv:${convId}`;
+              const cipherBytes = await this._encryptWithCatchUp(
+                mlsGroup,
+                sessionGroupKey,
+                mlsGroupId,
+                `conversation ${convId.slice(0, 8)}`,
+                plaintextBytes
+              );
               await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
               const payload = {
                 conversation_id: convId,
@@ -65997,7 +66416,14 @@ var init_channel = __esm2({
             }
             try {
               const plaintextBytes = new TextEncoder().encode(plaintext);
-              const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+              const mlsOnlyGroupKey = mlsOnlyConvGroupId && this._mlsGroups.has(`1to1-group:${mlsOnlyConvGroupId}`) ? `1to1-group:${mlsOnlyConvGroupId}` : `conv:${mlsConvId}`;
+              const cipherBytes = await this._encryptWithCatchUp(
+                mlsGroup,
+                mlsOnlyGroupKey,
+                resolvedMlsGroupId,
+                `conversation ${mlsConvId.slice(0, 8)}`,
+                plaintextBytes
+              );
               await saveMlsState(this.config.dataDir, resolvedMlsGroupId, JSON.stringify(mlsGroup.exportState()));
               const payload = {
                 conversation_id: mlsConvId,
@@ -66023,13 +66449,26 @@ var init_channel = __esm2({
             }
           }
         }
-        if (sentCount === 0 && this._sessions.size > 0) {
-          console.warn("[SecureChannel] send() delivered to 0 sessions (all skipped or failed)");
+        if (sentCount === 0) {
+          console.warn(
+            `[SecureChannel] send() delivered to 0 destinations \u2014 nothing was encrypted or queued (sessions=${this._sessions.size}, sharedGroups=${this._persisted?.mlsGroups ? Object.keys(this._persisted.mlsGroups).length : 0})`
+          );
         }
         await this._persistState();
+        const wsReady = this._ws?.readyState === 1;
+        if (pendingWsSends.length > 0 && !wsReady) {
+          console.warn(
+            `[SecureChannel] send(): ${pendingWsSends.length} frame(s) NOT written \u2014 socket readyState=${this._ws?.readyState ?? "null"} (1=OPEN)`
+          );
+        }
         for (const frame of pendingWsSends) {
           this._ws.send(frame);
         }
+        if (pendingWsSends.length > 0) {
+          console.log(
+            `[SecureChannel] send(): wrote ${pendingWsSends.length} frame(s) to the socket (sentCount=${sentCount}, readyState=${this._ws?.readyState ?? "null"})`
+          );
+        }
         if (!options?.isResend) {
           for (const mlsGroupId of addressedMlsGroupIds) {
             this._rememberRetryCandidate(mlsGroupId, plaintext, options);
@@ -66079,7 +66518,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.23" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.27" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -66289,7 +66728,13 @@ var init_channel = __esm2({
           if (mlsGroup?.isInitialized) {
             try {
               const plaintextBytes = new TextEncoder().encode(plaintext);
-              const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+              const ciphertext = await this._encryptWithCatchUp(
+                mlsGroup,
+                roomId,
+                room.mlsGroupId,
+                `room ${roomId.slice(0, 8)}`,
+                plaintextBytes
+              );
               await saveMlsState(this.config.dataDir, room.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
               if (this._state === "ready" && this._ws) {
                 this._ws.send(JSON.stringify({
@@ -66540,11 +66985,17 @@ var init_channel = __esm2({
         const before = this._persisted.groupId;
         this._sessionGroupIds = new Map(mine.map((r2) => [r2.id, r2.group_id]));
         this._persisted.conversationGroupIds = Object.fromEntries(this._sessionGroupIds);
-        const primary = mine.find((r2) => r2.id === this._persisted.primaryConversationId) ?? mine[0];
+        const joined = mine.find((r2) => this._persisted.mlsGroups?.[r2.group_id]);
+        const primary = mine.find((r2) => r2.id === this._persisted.primaryConversationId) ?? joined ?? mine[0];
+        if (!mine.some((r2) => r2.id === this._persisted.primaryConversationId)) {
+          console.log(
+            `[SecureChannel] Adopting new primary conversation ${primary.id.slice(0, 8)} (group ${primary.group_id.slice(0, 8)}) \u2014 ${joined ? "we hold MLS state for it" : "no joined conversation found, first active row"}`
+          );
+        }
         this._persisted.groupId = primary.group_id;
         this._persisted.primaryConversationId = primary.id;
         const liveGroupIds = new Set(mine.map((r2) => r2.group_id));
-        if (!liveGroupIds.has(staleGid)) {
+        if (staleGid && staleMlsGroupId && !liveGroupIds.has(staleGid)) {
           try {
             await deleteMlsState(this.config.dataDir, staleMlsGroupId);
           } catch {
@@ -66558,9 +67009,9 @@ var init_channel = __esm2({
         }
         await this._persistState();
         console.log(
-          `[SecureChannel] Re-resolved conversation groups after 'unknown group' ${staleMlsGroupId.slice(0, 8)}: primary group ${String(before).slice(0, 8)} \u2192 ${this._persisted.groupId.slice(0, 8)} (${mine.length} active conversation(s))`
+          `[SecureChannel] Re-resolved conversation groups ${staleMlsGroupId ? `after 'unknown group' ${staleMlsGroupId.slice(0, 8)}` : "on connect (#1034)"}: primary group ${String(before).slice(0, 8)} \u2192 ${this._persisted.groupId.slice(0, 8)} (${mine.length} active conversation(s))`
         );
-        return this._persisted.groupId !== before && before === staleGid;
+        return staleGid !== void 0 && this._persisted.groupId !== before && before === staleGid;
       }
       /**
        * Resend the message that a now-reconciled `unknown group` refusal killed (#732).
@@ -67468,7 +67919,13 @@ var init_channel = __esm2({
           const mlsGroup = this._mlsGroups.get(`a2a:${channelEntry.channelId}`);
           if (mlsGroup?.isInitialized) {
             const plaintextBytes = new TextEncoder().encode(text);
-            const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+            const ciphertext = await this._encryptWithCatchUp(
+              mlsGroup,
+              `a2a:${channelEntry.channelId}`,
+              channelEntry.mlsGroupId,
+              `A2A ${channelEntry.channelId.slice(0, 8)}`,
+              plaintextBytes
+            );
             await saveMlsState(
               this.config.dataDir,
               channelEntry.mlsGroupId,
@@ -67516,7 +67973,13 @@ var init_channel = __esm2({
           const mlsGroup = this._mlsGroups.get(`a2a:${channelId}`);
           if (mlsGroup?.isInitialized) {
             const plaintextBytes = new TextEncoder().encode(text);
-            const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+            const ciphertext = await this._encryptWithCatchUp(
+              mlsGroup,
+              `a2a:${channelId}`,
+              entry.mlsGroupId,
+              `A2A ${channelId.slice(0, 8)}`,
+              plaintextBytes
+            );
             await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
             this._ws.send(JSON.stringify({
               event: "a2a_message_mls",
@@ -67962,6 +68425,9 @@ var init_channel = __esm2({
             await this._pullDrDeliveryQueue();
             await this._flushOutboundQueue();
             this._setState("ready");
+            void this._reconcileConversationGroups().catch((err) => {
+              console.warn("[SecureChannel] Conversation-group reconcile failed:", err);
+            });
             void this._reconcileRoomsWithServer().catch(
               (err) => console.warn(`[SecureChannel] room reconcile failed (ignored): ${err instanceof Error ? err.message : String(err)}`)
             ).then(() => this._quarantineOrphanedMlsGroups()).catch(
@@ -67989,7 +68455,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.23" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.27" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -68313,7 +68779,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.23" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.27" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68679,6 +69145,7 @@ var init_channel = __esm2({
         const convGroupId = data.conversation_group_id;
         const groupId = data.group_id;
         const senderDeviceId = data.sender_device_id;
+        this._noteGroupEpoch(groupId, data.epoch);
         if (senderDeviceId === this._deviceId) return;
         let mgr;
         let mgrKey;
@@ -68756,9 +69223,15 @@ var init_channel = __esm2({
                 })),
                 no_history: filtered.length === 0
               });
-              if (mgr && mlsGroupId) {
+              if (mgr && mgrKey && mlsGroupId) {
                 const responseBytes = new TextEncoder().encode(responsePayload);
-                const cipher = await mgr.encrypt(responseBytes);
+                const cipher = await this._encryptWithCatchUp(
+                  mgr,
+                  mgrKey,
+                  mlsGroupId,
+                  `history catch-up ${mlsGroupId.slice(0, 8)}`,
+                  responseBytes
+                );
                 await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
                 if (this._ws) {
                   this._ws.send(JSON.stringify({
@@ -69501,9 +69974,36 @@ ${messageText}`;
       // ---------------------------------------------------------------------------
       // MLS room message handlers
       // ---------------------------------------------------------------------------
+      /**
+       * #1014: hand a room-framed frame to the handler that owns its group family.
+       *
+       * Returns true when the frame was routed. Routing means "give it to the right
+       * handler" — NOT "decrypt it as a room message". Decrypting under the wrong
+       * group is how MLS state gets corrupted, so an unplaceable group is left for
+       * the caller to self-heal rather than guessed at.
+       */
+      async _routeNonRoomGroupMessage(data, groupId) {
+        const target = this._resolveGroupFamily(groupId);
+        if (!target || target.family === "room") return false;
+        console.log(
+          `[SecureChannel] Room-framed message belongs to ${target.label} \u2014 routing to the handler that owns it (#1014)`
+        );
+        switch (target.family) {
+          case "shared1to1":
+            await this._handleMessageMLS({ ...data, conversation_group_id: target.id });
+            return true;
+          case "conversation":
+            await this._handleMessageMLS({ ...data, conversation_id: target.id });
+            return true;
+          case "a2a":
+            await this._handleA2AMessageMLS({ ...data, a2a_channel_id: target.id });
+            return true;
+        }
+      }
       async _handleRoomMessageMLS(data) {
         const groupId = data.group_id;
         const senderDeviceId = data.sender_device_id;
+        this._noteGroupEpoch(groupId, data.epoch);
         if (senderDeviceId === this._deviceId) return;
         let roomId;
         for (const [rid, room] of Object.entries(this._persisted?.rooms ?? {})) {
@@ -69517,7 +70017,9 @@ ${messageText}`;
             roomId = data.room_id;
             console.log(`[SecureChannel] Room ${roomId.slice(0, 8)} matched by room_id (group_id ${groupId?.slice(0, 8)} mismatch)`);
           } else {
+            if (await this._routeNonRoomGroupMessage(data, groupId)) return;
             console.warn(`[SecureChannel] No room found for MLS group ${groupId?.slice(0, 8)}`);
+            if (groupId) void this._requestWelcomeSelfHeal(groupId);
             return;
           }
         }
@@ -69705,63 +70207,63 @@ ${messageText}`;
           console.warn(`[SecureChannel] Failed to send history catchup response:`, sendErr);
         }
       }
+      /**
+       * Apply an inbound MLS commit to whichever group it addresses.
+       *
+       * Returns TRUE when the commit was applied, buffered, or handed to the
+       * failure ladder — i.e. when this agent has taken responsibility for it and
+       * the delivery-queue row may safely be acked. Returns FALSE when the commit
+       * names a group we hold no state for at all, so the caller must NACK and let
+       * the row survive.
+       *
+       * #1012: this used to loop `rooms` then `a2aChannels` and then END. A shared
+       * 1:1 commit (`mlsGroups`) and a legacy per-conversation commit
+       * (`mlsConversations`) matched neither. The call fell off the bottom with no
+       * log, no buffer and no error — and because it did not THROW,
+       * `_pullDeliveryQueue` acked the row and the server deleted it. An MLS commit
+       * cannot be regenerated, so the agent stayed at epoch N while the group moved
+       * to N+1 and every later send() encrypted at an epoch nobody could decrypt.
+       *
+       * The families are enumerated in ONE list resolved by ONE loop, because two
+       * hand-copied loops are exactly how the 1:1 path fell two families behind.
+       */
       async _handleMlsCommit(data) {
         const groupId = data.group_id;
         const epoch = typeof data.epoch === "number" ? data.epoch : 0;
-        for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
-          if (room.mlsGroupId === groupId) {
-            const mlsGroup = this._mlsGroups.get(roomId);
-            if (mlsGroup?.isInitialized) {
-              try {
-                const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
-                await mlsGroup.processCommit(commitBytes);
-                await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
-                console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
-                this._mlsCommitFailCounts.delete(roomId);
-              } catch (err) {
-                await this._onCommitFailure(
-                  roomId,
-                  groupId,
-                  err,
-                  `room ${roomId.slice(0, 8)}`,
-                  data.epoch,
-                  mlsGroup.epoch
-                );
-              }
-            } else {
-              this._bufferMlsCommit(groupId, epoch, data);
-              console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
-            }
-            return;
+        this._noteGroupEpoch(groupId, data.epoch);
+        const target = this._resolveGroupFamily(groupId);
+        if (target) {
+          const { managerKey: groupKey, label } = target;
+          const mlsGroup = this._mlsGroups.get(groupKey);
+          if (!mlsGroup?.isInitialized) {
+            this._bufferMlsCommit(groupId, epoch, data);
+            console.log(`[SecureChannel] Buffered MLS commit for ${label} (epoch=${epoch}, group not initialized)`);
+            return true;
           }
-        }
-        for (const [chId, chState] of Object.entries(this._persisted?.a2aChannels ?? {})) {
-          if (chState.mlsGroupId === groupId) {
-            const mlsGroup = this._mlsGroups.get(`a2a:${chId}`);
-            if (mlsGroup?.isInitialized) {
-              try {
-                const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
-                await mlsGroup.processCommit(commitBytes);
-                await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
-                console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
-                this._mlsCommitFailCounts.delete(`a2a:${chId}`);
-              } catch (err) {
-                await this._onCommitFailure(
-                  `a2a:${chId}`,
-                  groupId,
-                  err,
-                  `A2A ${chId.slice(0, 8)}`,
-                  data.epoch,
-                  mlsGroup.epoch
-                );
-              }
-            } else {
-              this._bufferMlsCommit(groupId, epoch, data);
-              console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
-            }
-            return;
+          try {
+            const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
+            await mlsGroup.processCommit(commitBytes);
+            await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
+            console.log(`[SecureChannel] MLS commit processed for ${label} (epoch=${mlsGroup.epoch})`);
+            this._mlsCommitFailCounts.delete(groupKey);
+          } catch (err) {
+            await this._onCommitFailure(
+              groupKey,
+              groupId,
+              err,
+              label,
+              data.epoch,
+              mlsGroup.epoch
+            );
           }
+          return true;
         }
+        this._bufferMlsCommit(groupId, epoch, data);
+        console.warn(
+          `[SecureChannel] MLS commit for UNKNOWN group ${String(groupId).slice(0, 8)} (epoch=${epoch}) \u2014 buffered, requesting a Welcome, NOT acked`
+        );
+        if (groupId) void this._requestWelcomeSelfHeal(groupId);
+        return false;
       }
       /** Buffer an MLS commit for replay after Welcome join. Max 50 per group. */
       _bufferMlsCommit(groupId, epoch, data) {
@@ -69951,6 +70453,229 @@ ${messageText}`;
        *   `1to1-group:<gid>`, `a2a:<channelId>`, …) — also the decrypt-fail-count key.
        * @param groupId  the server-side MLS group id used in the /sync URL.
        */
+      /**
+       * #1015 — the ONLY place this package fulfils a Welcome request.
+       *
+       * Add the members, transmit, and record `fulfilled` **only for the targets
+       * whose frames actually went out**. Every one of the five sites that used to
+       * do this by hand followed the same sequence and had the same three holes:
+       * `this._ws` null (both sends skipped by an `if`), a CLOSING socket (`send`
+       * returns without throwing), and a fulfil POST wrapped in `.catch(() => {})`.
+       *
+       * A fulfilled request is never re-requested. So a Welcome that evaporated
+       * left the requester locked out, the fulfiller at epoch N+1, everyone else at
+       * N, and the bridging commit untransmitted and impossible to regenerate — a
+       * permanently wedged group in which every signal read success.
+       *
+       * Returns the number of requests actually fulfilled.
+       */
+      async _fulfilWelcomeRequests(opts) {
+        const { mlsGroup, mlsGroupId, label, welcomeFields, targets } = opts;
+        if (targets.length === 0) return 0;
+        if (!this._wsIsOpen()) {
+          console.warn(
+            `[SecureChannel] ${label}: socket is not OPEN \u2014 NOT advancing the group; ${targets.length} request(s) stay pending for the next pull`
+          );
+          return 0;
+        }
+        const snapshot = mlsGroup.exportState();
+        const { commit, welcome } = await mlsGroup.addMembers(targets.map((t2) => t2.keyPackage));
+        const commitSent = await this._sendFrameConfirmed(
+          {
+            event: "mls_commit",
+            data: {
+              group_id: mlsGroupId,
+              epoch: Number(mlsGroup.epoch),
+              payload: Buffer.from(commit).toString("hex")
+            }
+          },
+          `${label} commit`
+        );
+        if (!commitSent) {
+          mlsGroup.importState(snapshot);
+          console.warn(
+            `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
+          );
+          return 0;
+        }
+        await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+        if (!welcome) {
+          console.warn(
+            `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
+          );
+          return 0;
+        }
+        let fulfilled = 0;
+        for (const t2 of targets) {
+          const sent = await this._sendFrameConfirmed(
+            {
+              event: "mls_welcome",
+              data: {
+                target_device_id: t2.deviceId,
+                group_id: mlsGroupId,
+                ...welcomeFields,
+                payload: Buffer.from(welcome).toString("hex")
+              }
+            },
+            `${label} welcome\u2192${t2.deviceId.slice(0, 8)}`
+          );
+          if (!sent) {
+            console.warn(
+              `[SecureChannel] ${label}: Welcome for ${t2.deviceId.slice(0, 8)} was NOT written \u2014 leaving the request PENDING so the next pull retries it`
+            );
+            continue;
+          }
+          if (await this._postFulfilWelcome(mlsGroupId, t2.requestId, `${label} ${t2.deviceId.slice(0, 8)}`)) {
+            fulfilled++;
+          }
+        }
+        return fulfilled;
+      }
+      /**
+       * Resolve an MLS group id to the family that owns it.
+       *
+       * There are four: rooms, A2A channels, shared 1:1 groups, and the legacy
+       * per-conversation groups. They all store the MLS group id under
+       * `mlsGroupId`; they differ only in the key their live `MLSGroupManager` sits
+       * under in `_mlsGroups`.
+       *
+       * ONE resolver, because hand-copying this enumeration is what produced
+       * #1012 (`_handleMlsCommit` handled two families of four), #1014 (a
+       * room-framed 1:1 replay matched nothing) and #1016 (a rejoin dropped only
+       * the room manager). Three bugs, one missing abstraction.
+       */
+      _resolveGroupFamily(mlsGroupId) {
+        if (!mlsGroupId) return null;
+        const families = [
+          { family: "room", entries: this._persisted?.rooms, managerKey: (id) => id, label: "room" },
+          { family: "a2a", entries: this._persisted?.a2aChannels, managerKey: (id) => `a2a:${id}`, label: "A2A" },
+          { family: "shared1to1", entries: this._persisted?.mlsGroups, managerKey: (id) => `1to1-group:${id}`, label: "1:1 group" },
+          { family: "conversation", entries: this._persisted?.mlsConversations, managerKey: (id) => `conv:${id}`, label: "conversation" }
+        ];
+        for (const f2 of families) {
+          for (const [id, entry] of Object.entries(f2.entries ?? {})) {
+            if (entry?.mlsGroupId !== mlsGroupId) continue;
+            return {
+              family: f2.family,
+              id,
+              managerKey: f2.managerKey(id),
+              label: `${f2.label} ${id.slice(0, 8)}`
+            };
+          }
+        }
+        return null;
+      }
+      /** #1015: is the socket in a state that can actually take a write? */
+      _wsIsOpen() {
+        return this._ws?.readyState === 1;
+      }
+      /**
+       * #1015: write one frame and report whether the socket took it.
+       *
+       * `ws.send()` on a CLOSING or CLOSED socket returns WITHOUT throwing — the
+       * error surfaces only through the callback, and every fulfilment site passed
+       * none. So a Welcome could be "sent" into a dead socket and the requester
+       * still marked `fulfilled`, which it never re-requests.
+       */
+      _sendFrameConfirmed(frame, label) {
+        const ws = this._ws;
+        if (!ws || ws.readyState !== 1) {
+          console.warn(
+            `[SecureChannel] ${label}: socket is not OPEN (readyState=${ws?.readyState ?? "null"}) \u2014 frame NOT written`
+          );
+          return Promise.resolve(false);
+        }
+        return new Promise((resolve3) => {
+          try {
+            ws.send(JSON.stringify(frame), (err) => {
+              if (err) {
+                console.error(`[SecureChannel] ${label}: socket refused the frame:`, err);
+                resolve3(false);
+              } else {
+                resolve3(true);
+              }
+            });
+          } catch (err) {
+            console.error(`[SecureChannel] ${label}: send threw:`, err);
+            resolve3(false);
+          }
+        });
+      }
+      /**
+       * #1015: record a Welcome as fulfilled — and say so when it fails.
+       *
+       * The batched shared-1:1 site posted this with `.catch(() => {})`, so an HTTP
+       * failure here was invisible on top of the sends being invisible.
+       */
+      async _postFulfilWelcome(mlsGroupId, requestId, label) {
+        try {
+          const res = await fetch(
+            `${this.config.apiUrl}/api/v1/mls/groups/${mlsGroupId}/fulfill-welcome`,
+            {
+              method: "POST",
+              headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+              body: JSON.stringify({ request_id: requestId })
+            }
+          );
+          if (!res.ok) {
+            console.warn(`[SecureChannel] ${label}: fulfill-welcome returned ${res.status}`);
+            return false;
+          }
+          return true;
+        } catch (err) {
+          console.warn(`[SecureChannel] ${label}: fulfill-welcome failed:`, err);
+          return false;
+        }
+      }
+      /**
+       * #1013: fold an epoch seen on an inbound frame into the running hint.
+       *
+       * Anything unusable (missing, non-numeric, negative, fractional) is ignored
+       * rather than defaulted. A defaulted epoch here would be a guess, and a guess
+       * that reads LOW silently disables the check it exists to drive.
+       */
+      _noteGroupEpoch(mlsGroupId, epoch) {
+        if (typeof mlsGroupId !== "string" || !mlsGroupId) return;
+        const current = this._observedGroupEpochs.get(mlsGroupId) ?? 0;
+        const next = noteObservedEpoch(current, epoch);
+        if (next > current) this._observedGroupEpochs.set(mlsGroupId, next);
+      }
+      /**
+       * #1013 — the ONLY place this package encrypts an MLS application message.
+       *
+       * Catch up first when the group is known to have moved past us, then encrypt.
+       * Hermes has done this since #440 and the browser since #996; the plugin —
+       * the implementation that actually ships to customers — did not, so an agent
+       * that missed one commit encrypted every later message at an epoch nobody
+       * could read, while the server stored and relayed it and every signal read
+       * 200.
+       *
+       * Funnelling every sender through one method is the point. A guard applied at
+       * seven call sites decays to a guard applied at six: that is exactly how
+       * `_handleMlsCommit` ended up handling two group families out of four (#1012).
+       *
+       * Best-effort by design. A catch-up that cannot replay — or that throws — must
+       * NOT block the send; we fall through and encrypt at the local epoch, which is
+       * precisely today's behaviour, so the worst case is no regression.
+       */
+      async _encryptWithCatchUp(mlsGroup, groupKey, mlsGroupId, label, plaintextBytes) {
+        const observed = this._observedGroupEpochs.get(mlsGroupId);
+        if (observed !== void 0 && needsPreSendResync(Number(mlsGroup.epoch), observed)) {
+          console.warn(
+            `[SecureChannel] ${label}: local epoch ${Number(mlsGroup.epoch)} is behind the observed group epoch ${observed} \u2014 catching up before encrypt (#1013)`
+          );
+          try {
+            if (!await this._resyncOnDivergence(groupKey, mlsGroupId)) {
+              console.warn(
+                `[SecureChannel] ${label}: catch-up could not replay \u2014 sending at epoch ${Number(mlsGroup.epoch)}. Peers past this epoch will not read it.`
+              );
+            }
+          } catch (err) {
+            console.warn(`[SecureChannel] ${label}: catch-up failed:`, err);
+          }
+        }
+        return await mlsGroup.encrypt(plaintextBytes);
+      }
       async _resyncOnDivergence(groupKey, groupId) {
         const mgr = this._mlsGroups.get(groupKey);
         if (!mgr?.isInitialized) return false;
@@ -69977,11 +70702,24 @@ ${messageText}`;
             applied++;
           }
           if (applied === 0) {
-            console.log(`[SecureChannel] Resync for ${groupId.slice(0, 8)}: no new commits to apply (epoch=${mgr.epoch})`);
+            const strikes = (this._resyncNoOpStrikes.get(groupKey) ?? 0) + 1;
+            this._resyncNoOpStrikes.set(groupKey, strikes);
+            if (strikes < _SecureChannel.MAX_RESYNC_NOOPS) {
+              this._mlsDecryptFailCounts.delete(groupKey);
+              console.log(
+                `[SecureChannel] Resync for ${groupId.slice(0, 8)}: already current at epoch=${mgr.epoch} (strike ${strikes}/${_SecureChannel.MAX_RESYNC_NOOPS}) \u2014 NOT re-keying (#1084)`
+              );
+              return true;
+            }
+            this._resyncNoOpStrikes.delete(groupKey);
+            console.warn(
+              `[SecureChannel] Resync for ${groupId.slice(0, 8)}: still failing at epoch=${mgr.epoch} after ${_SecureChannel.MAX_RESYNC_NOOPS} no-op resyncs \u2014 escalating to re-key`
+            );
             return false;
           }
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
           this._mlsDecryptFailCounts.delete(groupKey);
+          this._resyncNoOpStrikes.delete(groupKey);
           console.log(
             `[SecureChannel] Resync-on-divergence: applied ${applied} missed commit(s) for ${groupId.slice(0, 8)}, now epoch=${mgr.epoch}`
           );
@@ -70368,6 +71106,7 @@ ${messageText}`;
             const ackedIds = [];
             const nackedIds = [];
             for (const msg of messages) {
+              let handled = true;
               try {
                 if (msg.sender_device_id === this._deviceId) {
                   ackedIds.push(msg.queue_id);
@@ -70384,7 +71123,7 @@ ${messageText}`;
                     a2a_channel_id: msg.a2a_channel_id
                   });
                 } else if (msg.message_type === "commit") {
-                  await this._handleMlsCommit({
+                  handled = await this._handleMlsCommit({
                     group_id: msg.group_id,
                     sender_device_id: msg.sender_device_id,
                     epoch: msg.epoch,
@@ -70422,9 +71161,18 @@ ${messageText}`;
                       conversation_group_id: msg.conversation_group_id,
                       created_at: msg.created_at
                     });
+                  } else {
+                    handled = false;
+                    console.warn(
+                      `[SecureChannel] Delivery application row ${String(msg.message_id).slice(0, 8)} names no room, A2A channel or conversation \u2014 NOT acked`
+                    );
                   }
                 }
-                ackedIds.push(msg.queue_id);
+                if (handled) {
+                  ackedIds.push(msg.queue_id);
+                } else {
+                  nackedIds.push(msg.queue_id);
+                }
               } catch (err) {
                 console.warn(`[SecureChannel] Delivery ${msg.message_type} processing failed:`, err);
                 nackedIds.push(msg.queue_id);
@@ -70493,38 +71241,20 @@ ${messageText}`;
                   if (!kpHex) continue;
                   const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                   const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                  if (this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_commit",
-                      data: {
-                        group_id: roomState.mlsGroupId,
-                        epoch: Number(mlsGroup.epoch),
-                        payload: Buffer.from(commit).toString("hex")
-                      }
-                    }));
-                  }
-                  if (welcome && this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_welcome",
-                      data: {
-                        target_device_id: req.requesting_device_id,
-                        group_id: roomState.mlsGroupId,
-                        room_id: roomId,
-                        payload: Buffer.from(welcome).toString("hex")
-                      }
-                    }));
+                  const done = await this._fulfilWelcomeRequests({
+                    mlsGroup,
+                    mlsGroupId: roomState.mlsGroupId,
+                    label: `room ${roomId.slice(0, 8)}`,
+                    welcomeFields: { room_id: roomId },
+                    targets: [{
+                      requestId: req.id,
+                      deviceId: req.requesting_device_id,
+                      keyPackage: memberKp
+                    }]
+                  });
+                  if (done > 0) {
+                    console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
                   }
-                  await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/groups/${roomState.mlsGroupId}/fulfill-welcome`,
-                    {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }
-                  );
-                  await saveMlsState(this.config.dataDir, roomState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                  console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
                 } catch (fulfillErr) {
                   console.warn(`[SecureChannel] Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                 }
@@ -70563,65 +71293,38 @@ ${messageText}`;
                 validReqs.push({ req, kp: MLSGroupManager.deserializeKeyPackage(kpBytes) });
               }
               if (validReqs.length === 0) continue;
+              const sharedTargets = validReqs.map((v2) => ({
+                requestId: v2.req.id,
+                deviceId: v2.req.requesting_device_id,
+                keyPackage: v2.kp
+              }));
               try {
-                const { commit, welcome } = await mlsGroup.addMembers(validReqs.map((v2) => v2.kp));
-                if (this._ws) {
-                  this._ws.send(JSON.stringify({
-                    event: "mls_commit",
-                    data: {
-                      group_id: entry.mlsGroupId,
-                      epoch: Number(mlsGroup.epoch),
-                      payload: Buffer.from(commit).toString("hex")
-                    }
-                  }));
-                }
-                if (welcome && this._ws) {
-                  for (const { req } of validReqs) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_welcome",
-                      data: {
-                        target_device_id: req.requesting_device_id,
-                        group_id: entry.mlsGroupId,
-                        conversation_group_id: gid,
-                        payload: Buffer.from(welcome).toString("hex")
-                      }
-                    }));
-                  }
-                }
-                for (const { req } of validReqs) {
-                  await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/groups/${entry.mlsGroupId}/fulfill-welcome`,
-                    {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }
-                  ).catch(() => {
-                  });
+                const done = await this._fulfilWelcomeRequests({
+                  mlsGroup,
+                  mlsGroupId: entry.mlsGroupId,
+                  label: `shared group ${gid.slice(0, 8)}`,
+                  welcomeFields: { conversation_group_id: gid },
+                  targets: sharedTargets
+                });
+                if (done > 0) {
+                  console.log(`[SecureChannel] Batched Welcome for ${done}/${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                 }
-                await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                console.log(`[SecureChannel] Batched Welcome for ${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
               } catch (batchErr) {
                 console.warn(`[SecureChannel] Batched Welcome failed for shared group ${gid.slice(0, 8)}, falling back to individual:`, batchErr);
-                for (const { req, kp } of validReqs) {
+                for (const target of sharedTargets) {
                   try {
-                    const { commit, welcome } = await mlsGroup.addMembers([kp]);
-                    if (this._ws) {
-                      this._ws.send(JSON.stringify({ event: "mls_commit", data: { group_id: entry.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: Buffer.from(commit).toString("hex") } }));
-                    }
-                    if (welcome && this._ws) {
-                      this._ws.send(JSON.stringify({ event: "mls_welcome", data: { target_device_id: req.requesting_device_id, group_id: entry.mlsGroupId, conversation_group_id: gid, payload: Buffer.from(welcome).toString("hex") } }));
-                    }
-                    await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${entry.mlsGroupId}/fulfill-welcome`, {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }).catch(() => {
+                    const done = await this._fulfilWelcomeRequests({
+                      mlsGroup,
+                      mlsGroupId: entry.mlsGroupId,
+                      label: `shared group ${gid.slice(0, 8)}`,
+                      welcomeFields: { conversation_group_id: gid },
+                      targets: [target]
                     });
-                    await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                    console.log(`[SecureChannel] Individual Welcome for ${req.requesting_device_id.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
+                    if (done > 0) {
+                      console.log(`[SecureChannel] Individual Welcome for ${target.deviceId.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
+                    }
                   } catch (indivErr) {
-                    console.warn(`[SecureChannel] Individual Welcome failed for ${req.requesting_device_id.slice(0, 8)}:`, indivErr);
+                    console.warn(`[SecureChannel] Individual Welcome failed for ${target.deviceId.slice(0, 8)}:`, indivErr);
                   }
                 }
               }
@@ -70653,38 +71356,20 @@ ${messageText}`;
                   if (!kpHex) continue;
                   const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                   const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                  if (this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_commit",
-                      data: {
-                        group_id: convEntry.mlsGroupId,
-                        epoch: Number(mlsGroup.epoch),
-                        payload: Buffer.from(commit).toString("hex")
-                      }
-                    }));
-                  }
-                  if (welcome && this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_welcome",
-                      data: {
-                        target_device_id: req.requesting_device_id,
-                        group_id: convEntry.mlsGroupId,
-                        conversation_id: convId,
-                        payload: Buffer.from(welcome).toString("hex")
-                      }
-                    }));
+                  const done = await this._fulfilWelcomeRequests({
+                    mlsGroup,
+                    mlsGroupId: convEntry.mlsGroupId,
+                    label: `conv ${convId.slice(0, 8)}`,
+                    welcomeFields: { conversation_id: convId },
+                    targets: [{
+                      requestId: req.id,
+                      deviceId: req.requesting_device_id,
+                      keyPackage: memberKp
+                    }]
+                  });
+                  if (done > 0) {
+                    console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
                   }
-                  await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/groups/${convEntry.mlsGroupId}/fulfill-welcome`,
-                    {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }
-                  );
-                  await saveMlsState(this.config.dataDir, convEntry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                  console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
                 } catch (fulfillErr) {
                   console.warn(`[SecureChannel] Conv Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                 }
@@ -70865,12 +71550,13 @@ ${messageText}`;
                   } catch (distErr) {
                     console.warn(`[SecureChannel] A2A distribute network error:`, distErr);
                   }
-                  if (!distributed && this._ws) {
-                    this._ws.send(JSON.stringify({
+                  if (!distributed && this._wsIsOpen()) {
+                    const a2aLabel = `A2A ${chId.slice(0, 8)}`;
+                    const commitSent = await this._sendFrameConfirmed({
                       event: "mls_commit",
                       data: { group_id: chState.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: commitHex }
-                    }));
-                    this._ws.send(JSON.stringify({
+                    }, `${a2aLabel} commit`);
+                    const welcomeSent = commitSent && await this._sendFrameConfirmed({
                       event: "mls_welcome",
                       data: {
                         target_device_id: req.requesting_device_id,
@@ -70878,7 +71564,11 @@ ${messageText}`;
                         a2a_channel_id: chId,
                         payload: welcomeHex
                       }
-                    }));
+                    }, `${a2aLabel} welcome`);
+                    if (!welcomeSent) {
+                      console.warn(`[SecureChannel] ${a2aLabel}: Welcome frames were NOT written \u2014 leaving the request pending`);
+                      continue;
+                    }
                     try {
                       await fetch(
                         `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
@@ -70901,16 +71591,15 @@ ${messageText}`;
                     console.warn(`[SecureChannel] Cannot deliver Welcome \u2014 HTTP distribute and WS both unavailable`);
                     continue;
                   }
-                  await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/fulfill-welcome`,
-                    {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }
+                  const a2aFulfilled = await this._postFulfilWelcome(
+                    chState.mlsGroupId,
+                    req.id,
+                    `A2A ${chId.slice(0, 8)}`
                   );
                   await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                  console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+                  if (a2aFulfilled) {
+                    console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+                  }
                 } catch (fulfillErr) {
                   console.log(`[SecureChannel] A2A Welcome fulfill failed: ${fulfillErr instanceof Error ? fulfillErr.message : String(fulfillErr)}`);
                 }
@@ -71084,12 +71773,12 @@ ${messageText}`;
           console.log(`[SecureChannel] MLS sync: re-join needed for group ${groupId?.slice(0, 8)}`);
           if (groupId) {
             await deleteMlsState(this.config.dataDir, groupId);
-            for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
-              if (room.mlsGroupId === groupId) {
-                this._mlsGroups.delete(roomId);
-                break;
-              }
+            const target = this._resolveGroupFamily(groupId);
+            if (target) {
+              this._mlsGroups.delete(target.managerKey);
+              console.log(`[SecureChannel] MLS sync rejoin: dropped local state for ${target.label}`);
             }
+            void this._requestWelcomeSelfHeal(groupId);
           }
         } else if (action === "replay_complete") {
           console.log(`[SecureChannel] MLS sync complete for group ${groupId?.slice(0, 8)} (${data.count} messages replayed)`);
@@ -71101,6 +71790,7 @@ ${messageText}`;
        */
       async _handleA2AMessageMLS(data) {
         const groupId = data.group_id;
+        this._noteGroupEpoch(groupId, data.epoch);
         const channelId = data.channel_id ?? data.a2a_channel_id;
         let a2aChannelId = channelId;
         if (!a2aChannelId) {
@@ -98324,7 +99014,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.23" : "0.0.0-dev";
+    VERSION = true ? "0.23.27" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -98965,6 +99655,40 @@ async function startRoomMcpServer(opts) {
   };
 }
 
+// src/service/self-uninstall.ts
+init_subcommand();
+init_backend();
+init_log();
+var DEVICE_IS_GONE = "device_revoked";
+function selfUninstallOnTerminal(reason, env, deps = {}) {
+  if (reason !== DEVICE_IS_GONE) return false;
+  const log = deps.log ?? ((m2) => logLine("[grok-bridge] " + m2));
+  let label;
+  try {
+    label = labelFor(env);
+  } catch (e) {
+    log(
+      `device was revoked, but ${e.message} \u2014 cannot tell which service to remove. Remove it by hand with: AV_AGENT_NAME=<agent-name> agentvault-grok-bridge uninstall`
+    );
+    return false;
+  }
+  try {
+    if (!deps.backend && process.platform !== "darwin" && process.platform !== "linux") return false;
+    const backend = deps.backend ?? selectBackend(process.platform);
+    if (!backend.status(label).loaded) return false;
+    backend.uninstall(label);
+    log(
+      `device was revoked \u2014 removed the supervised service ${label} so it does not sit installed on this machine pointing at an agent that no longer exists. Your credentials are still on disk and were NOT touched; re-install with a fresh invite token from AgentVault to reconnect.`
+    );
+    return true;
+  } catch (e) {
+    log(
+      `device was revoked, but removing the service ${label} failed: ${e.message}. Remove it by hand with: AV_AGENT_NAME=<agent-name> agentvault-grok-bridge uninstall`
+    );
+    return false;
+  }
+}
+
 // src/bridge.ts
 var RoomHushState = class {
   until = /* @__PURE__ */ new Map();
@@ -99020,11 +99744,13 @@ var ActiveTarget = class {
 function attachLifecycle2(channel, opts = {}) {
   const log = opts.log ?? (() => {
   });
+  const selfUninstall = opts.selfUninstall ?? selfUninstallOnTerminal;
   const onTerminal = opts.onTerminal ?? ((_reason, o2) => process.exit(o2.restart ? 1 : 0));
   const terminal = (reason, restart) => {
     log(
       `terminal condition (${reason}) \u2014 ${restart ? "gave up reconnecting; supervisor may respawn" : "this device must re-enroll or another session has taken over"}. Re-run/re-install with a fresh invite token from AgentVault if this persists.`
     );
+    selfUninstall(reason, process.env);
     onTerminal(reason, { restart });
   };
   channel.on("auth_failed", (e) => terminal(e.reason, false));
@@ -99178,6 +99904,10 @@ var shutdown = async (code = 0) => {
   }
 };
 async function main() {
+  const { maybeRunDoctorSubcommand: maybeRunDoctorSubcommand2 } = await Promise.resolve().then(() => (init_doctor_cli(), doctor_cli_exports));
+  if (await maybeRunDoctorSubcommand2(process.argv)) {
+    process.exit(process.exitCode ?? 0);
+  }
   const { maybeRunServiceSubcommand: maybeRunServiceSubcommand2 } = await Promise.resolve().then(() => (init_subcommand(), subcommand_exports));
   if (maybeRunServiceSubcommand2(process.argv, process.env, {
     log: (m2) => logLine("[grok-bridge] " + m2)
@@ -99187,7 +99917,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.3.2" : void 0
+      true ? "0.4.1" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -99226,11 +99956,6 @@ async function main() {
     process.exit(0);
   }
   const cfg = loadConfig(process.env, process.argv.slice(2));
-  if (cfg.installAfterEnroll) {
-    assertInstallableEntrypoint(process.argv[1]);
-    const { selectBackend: selectBackend2 } = await Promise.resolve().then(() => (init_backend(), backend_exports));
-    selectBackend2(process.platform);
-  }
   mkdirSync6(cfg.workspaceDir, { recursive: true });
   mkdirSync6(cfg.fenceHome, { recursive: true });
   seedFenceCredential({
@@ -99245,7 +99970,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.3.2" : void 0
+      true ? "0.4.1" : void 0
     )
   });
   channelRef = channel;
@@ -99336,23 +100061,6 @@ async function main() {
       logLine("[grok-bridge] enrolled \u2014 pending invite consumed and removed");
     }
   });
-  if (cfg.installAfterEnroll) {
-    const { installOnReady: installOnReady2 } = await Promise.resolve().then(() => (init_install_on_ready(), install_on_ready_exports));
-    installOnReady2(channel, cfg, {
-      entrypoint: process.argv[1],
-      env: process.env,
-      // FOUND LIVE 2026-08-16: the owner's activation greeting is usually already
-      // being answered when `ready` fires, and reaping mid-turn killed the reply
-      // for good — the message was acked, so the service never saw it again.
-      // GrokSession.idle() resolves when the queue drains.
-      waitForIdle: () => session.idle(),
-      // The one shared teardown. `exiting` is deliberately NOT set here: Ctrl-C
-      // must keep working for the whole multi-second launchctl window.
-      reap: reapAll,
-      exit: (code) => process.exit(code),
-      log: (m2) => logLine("[grok-bridge] " + m2)
-    });
-  }
   await channel.start();
 }
 main().catch(async (err) => {