@agentvault/grok-bridge 0.4.13 → 0.4.14

package/dist/index.js

@@ -64657,11 +64657,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.40" : FALLBACK;
+  const v2 = true ? "0.23.41" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "dbac15d-dirty" : "";
+  const raw = true ? "916d6c5-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -65568,6 +65568,7 @@ var CREDENTIAL_MESSAGE_TYPES;
 var CATCHUP_MESSAGE_TYPES;
 var POLL_INTERVAL_MS;
 var RECONNECT_BASE_MS;
+var UUID_RE;
 var RECONNECT_MAX_MS;
 var PENDING_POLL_INTERVAL_MS;
 var OUTBOUND_DEDUPE_WINDOW_MS;
@@ -65615,6 +65616,7 @@ var init_channel = __esm2({
     ]);
     POLL_INTERVAL_MS = 6e3;
     RECONNECT_BASE_MS = 1e3;
+    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     RECONNECT_MAX_MS = 3e4;
     PENDING_POLL_INTERVAL_MS = 15e3;
     OUTBOUND_DEDUPE_WINDOW_MS = 3e3;
@@ -66910,7 +66912,7 @@ ${text}`;
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.40" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.41" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68848,7 +68850,7 @@ ${text}`;
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.40" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.41" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -69172,7 +69174,7 @@ ${text}`;
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.40" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.41" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69387,45 +69389,78 @@ ${text}`;
                   const mlsGroup = this._mlsGroups.get(`a2a:${channelId}`);
                   if (mlsGroup?.isInitialized) {
                     try {
-                      const kpRes = await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/key-packages?hub_id=${encodeURIComponent(participant.hub_id)}`,
-                        { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-                      );
-                      if (kpRes.ok) {
-                        const kpData = await kpRes.json();
-                        if (kpData.key_package) {
-                          const kpBytes = new Uint8Array(Buffer.from(kpData.key_package, "hex"));
-                          const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                          const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                          if (welcome && this._ws) {
-                            this._ws.send(JSON.stringify({
-                              event: "mls_commit",
-                              data: {
-                                group_id: entry.mlsGroupId,
-                                epoch: Number(mlsGroup.epoch),
-                                payload: Buffer.from(commit).toString("hex")
-                              }
-                            }));
-                            const newDeviceId = participant.device_id || null;
-                            if (!newDeviceId) {
-                              console.warn(
-                                `[SecureChannel] Skipping MLS Welcome to new participant ${participant.hub_address} for A2A ${channelId.slice(0, 8)}: no device_id on participant_joined payload.`
-                              );
-                            } else {
-                              this._ws.send(JSON.stringify({
-                                event: "mls_welcome",
-                                data: {
-                                  group_id: entry.mlsGroupId,
-                                  payload: Buffer.from(welcome).toString("hex"),
-                                  target_device_id: newDeviceId,
-                                  a2a_channel_id: channelId,
-                                  target_hub_id: participant.hub_id
-                                  // observability only
+                      const newDeviceId = participant.device_id || null;
+                      const a2aLabel = `A2A ${channelId.slice(0, 8)} participant_joined`;
+                      if (!newDeviceId) {
+                        console.warn(
+                          `[SecureChannel] ${a2aLabel}: no device_id on the payload for ${participant.hub_address} \u2014 NOT adding (a Welcome could not be addressed)`
+                        );
+                      } else if (!this._wsIsOpen()) {
+                        console.warn(`[SecureChannel] ${a2aLabel}: socket is not OPEN \u2014 NOT advancing the group`);
+                      } else {
+                        const preHead = await this._readGroupHead(entry.mlsGroupId);
+                        const inFlight = preHead.ok && preHead.epoch !== Number(mlsGroup.epoch) ? null : this._reserveCommit(entry.mlsGroupId, a2aLabel);
+                        if (preHead.ok && preHead.epoch !== Number(mlsGroup.epoch)) {
+                          console.warn(
+                            `[SecureChannel] ${a2aLabel}: server head is at epoch ${preHead.epoch}, we are at ${Number(mlsGroup.epoch)} \u2014 NOT committing (it would be refused); resync catches up first`
+                          );
+                          await this._catchUpAfterPreflightSkip(entry.mlsGroupId, preHead.epoch, Number(mlsGroup.epoch), a2aLabel);
+                        } else if (inFlight) {
+                          try {
+                            const kpRes = await fetch(
+                              `${this.config.apiUrl}/api/v1/mls/key-packages?hub_id=${encodeURIComponent(participant.hub_id)}`,
+                              { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                            );
+                            if (kpRes.ok) {
+                              const kpData = await kpRes.json();
+                              if (kpData.key_package) {
+                                const kpBytes = new Uint8Array(Buffer.from(kpData.key_package, "hex"));
+                                const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
+                                const stateBefore = mlsGroup.exportState();
+                                const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
+                                const committedEpoch = Number(mlsGroup.epoch);
+                                if (!welcome) {
+                                  mlsGroup.importState(stateBefore);
+                                  console.warn(`[SecureChannel] ${a2aLabel}: addMembers produced no Welcome \u2014 rolled back`);
+                                } else {
+                                  const verdict = await this._sendCommitConfirmed({
+                                    mlsGroup,
+                                    mlsGroupId: entry.mlsGroupId,
+                                    label: a2aLabel,
+                                    commit,
+                                    epoch: committedEpoch,
+                                    parent: preHead.ok ? preHead.digest : void 0,
+                                    memberDeviceIds: this._commitRoster(
+                                      (entry.participants ?? []).map((p2) => p2.deviceId),
+                                      [newDeviceId]
+                                    ),
+                                    stateBefore,
+                                    inFlight
+                                  });
+                                  if (verdict === "confirmed") {
+                                    const sent = await this._sendFrameConfirmed({
+                                      event: "mls_welcome",
+                                      data: {
+                                        group_id: entry.mlsGroupId,
+                                        payload: Buffer.from(welcome).toString("hex"),
+                                        target_device_id: newDeviceId,
+                                        a2a_channel_id: channelId,
+                                        target_hub_id: participant.hub_id
+                                        // observability only
+                                      }
+                                    }, `${a2aLabel} welcome`);
+                                    await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+                                    if (sent) {
+                                      console.log(`[SecureChannel] Sent MLS Welcome to new participant ${participant.hub_address} (device ${String(newDeviceId).slice(0, 8)})`);
+                                    } else {
+                                      console.warn(`[SecureChannel] ${a2aLabel}: Welcome to ${String(newDeviceId).slice(0, 8)} was NOT written \u2014 the participant will request one`);
+                                    }
+                                  }
                                 }
-                              }));
-                              await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                              console.log(`[SecureChannel] Sent MLS Welcome to new participant ${participant.hub_address} (device ${String(newDeviceId).slice(0, 8)})`);
+                              }
                             }
+                          } finally {
+                            await this._releaseCommit(entry.mlsGroupId, inFlight, a2aLabel);
                           }
                         }
                       }
@@ -70955,9 +70990,34 @@ ${baseText}`;
        *
        * Returns the number of requests actually fulfilled.
        */
+      /**
+       * #1226: the roster to submit on a commit frame — the caller's known members,
+       * the devices being admitted, and ALWAYS ourselves — deduplicated, UUIDs
+       * only. Self is non-negotiable: once a roster is non-empty the server
+       * requires the committer in it (#469), and our own head read
+       * (`assert_group_member`) requires it too. So with no device id of our own
+       * this returns `[]` and the frame carries NO roster (the pre-#1226 shape)
+       * rather than a roster that locks us out. Non-UUID entries are dropped:
+       * `known` can come off an inbound Welcome frame, and a malformed id in the
+       * outbound frame is refused by the server (`MEMBER_DEVICE_IDS_MALFORMED`).
+       * @internal exposed for tests
+       */
+      _commitRoster(known, targets) {
+        if (!this._deviceId) return [];
+        const out = [];
+        const seen = /* @__PURE__ */ new Set();
+        for (const id of [...known ?? [], ...targets, this._deviceId]) {
+          if (typeof id !== "string" || !UUID_RE.test(id) || seen.has(id)) continue;
+          seen.add(id);
+          out.push(id);
+        }
+        return out;
+      }
       async _fulfilWelcomeRequests(opts) {
         const { mlsGroup, mlsGroupId, label, welcomeFields, targets } = opts;
         if (targets.length === 0) return 0;
+        const rosterBefore = this._commitRoster(opts.memberDeviceIds, []);
+        const rosterAfter = this._commitRoster(opts.memberDeviceIds, targets.map((t2) => t2.deviceId));
         if (!this._wsIsOpen()) {
           console.warn(
             `[SecureChannel] ${label}: socket is not OPEN \u2014 NOT advancing the group; ${targets.length} request(s) stay pending for the next pull`
@@ -70970,9 +71030,16 @@ ${baseText}`;
           console.warn(
             `[SecureChannel] ${label}: server head is at epoch ${preHead.epoch}, we are at ${Number(mlsGroup.epoch)} \u2014 NOT committing (it would be refused, #1184); ${targets.length} request(s) stay pending`
           );
+          await this._catchUpAfterPreflightSkip(mlsGroupId, preHead.epoch, Number(mlsGroup.epoch), label);
           return 0;
         }
         let parent2 = preHead.ok ? preHead.digest : void 0;
+        if (this._commitInFlight.has(mlsGroupId)) {
+          console.warn(
+            `[SecureChannel] ${label}: another commit for this group is in flight \u2014 NOT advancing; ${targets.length} request(s) stay pending for the next pull`
+          );
+          return 0;
+        }
         const inFlight = { frames: [], sent: [] };
         this._commitInFlight.set(mlsGroupId, inFlight);
         try {
@@ -70997,7 +71064,8 @@ ${baseText}`;
                   // only knows the last one, which is why the result carries them.
                   epoch: Number(c2.epoch),
                   payload: Buffer.from(c2.commit).toString("hex"),
-                  ...parent2 ? { parent_digest: parent2 } : {}
+                  ...parent2 ? { parent_digest: parent2 } : {},
+                  ...(sentCommits === commits.length - 1 ? rosterAfter : rosterBefore).length > 0 ? { member_device_ids: sentCommits === commits.length - 1 ? rosterAfter : rosterBefore } : {}
                 }
               },
               `${label} commit ${sentCommits + 1}/${commits.length}`
@@ -71145,6 +71213,126 @@ ${baseText}`;
         return this._ws?.readyState === 1;
       }
       /** SHA-256 hex of a commit's bytes — its identity on the server (#1175/#1177). */
+      /**
+       * #1225: send ONE commit over the socket and wait for the server's verdict,
+       * with the #1184 machinery — an in-flight record (so a `… commit rejected`
+       * frame is correlated to it and a concurrent commit for the group is held
+       * and replayed), the head poll, and rollback. The three A2A commit sites
+       * (`a2a_participant_joined`, the `/distribute` WS fallback, `_foundA2AGroup`)
+       * used a raw `ws.send` and treated "the socket took it" as "the server
+       * stored it" — two of them then PERSISTED a state the server never saw.
+       *
+       * Returns the verdict. On `refused` / `unsent` the manager has been restored
+       * to `stateBefore` and nothing must be persisted or minted from it.
+       * `unverifiable` (head unreadable on every try AND no refusal) proceeds
+       * UNCHECKED, the same deliberate choice as the fulfil site.
+       */
+      /**
+       * #1225 (review F1): reserve the single in-flight slot for a group. The
+       * record is what `_noteCommitRefusal` correlates a refusal to and what
+       * `_handleMlsCommit` holds concurrent socket commits behind; a second run on
+       * the same group would clobber both (measured: two overlapping joins → two
+       * commits claiming one epoch, one Welcome instead of two, the manager AHEAD
+       * of the server). Taken BEFORE the commit is generated; released by
+       * `_releaseCommit` after the last step that depends on it.
+       */
+      /**
+       * A pre-flight skip must not be a dead end. The skip happens because the
+       * server's head is somewhere else; before this the group "caught up through
+       * the normal divergence path", which only runs when a message for the group
+       * arrives — so a group nobody writes to stayed diverged and its pending
+       * Welcome requests were never fulfilled (named in PR #1227). When the server
+       * is AHEAD, replay the missing commits now so the next pull can commit; when
+       * WE are ahead there is nothing to replay (the fork-ahead direction, #972).
+       */
+      async _catchUpAfterPreflightSkip(mlsGroupId, serverEpoch, localEpoch, label) {
+        if (serverEpoch < localEpoch) {
+          console.warn(`[SecureChannel] ${label}: we are AHEAD of the server (${localEpoch} > ${serverEpoch}) \u2014 nothing to replay`);
+          return;
+        }
+        const fam = this._resolveGroupFamily(mlsGroupId);
+        if (!fam) return;
+        try {
+          const caughtUp = await this._resyncOnDivergence(fam.managerKey, mlsGroupId);
+          console.log(`[SecureChannel] ${label}: catch-up after pre-flight skip ${caughtUp ? "replayed the missing commits" : "could not replay"}`);
+        } catch (err) {
+          console.warn(`[SecureChannel] ${label}: catch-up after pre-flight skip failed:`, err);
+        }
+      }
+      _reserveCommit(groupId, label) {
+        if (this._commitInFlight.has(groupId)) {
+          console.warn(
+            `[SecureChannel] ${label}: another commit for group ${groupId.slice(0, 8)} is in flight \u2014 NOT advancing the group (a Welcome can be requested again)`
+          );
+          return null;
+        }
+        const rec = { frames: [], sent: [] };
+        this._commitInFlight.set(groupId, rec);
+        return rec;
+      }
+      /** Release the slot taken by `_reserveCommit` and replay the socket commits held meanwhile. */
+      async _releaseCommit(groupId, rec, label) {
+        if (this._commitInFlight.get(groupId) === rec) this._commitInFlight.delete(groupId);
+        for (const frame of rec.frames) {
+          try {
+            await this._handleMlsCommit(frame);
+          } catch (err) {
+            console.error(`[SecureChannel] ${label}: replaying a held MLS commit failed:`, err);
+          }
+        }
+      }
+      /**
+       * #1225: send ONE commit over the socket and wait for the server's verdict
+       * with the #1184 machinery (refusal frame correlated through the reserved
+       * in-flight record, head poll). The three A2A commit sites
+       * (`a2a_participant_joined`, the `/distribute` WS fallback, `_foundA2AGroup`)
+       * used a raw `ws.send` and treated "the socket took it" as "the server
+       * stored it" — two of them then PERSISTED a state the server never saw.
+       *
+       * Only `confirmed` proceeds. `unverifiable` (head unreadable on every try,
+       * no refusal) is a ROLLBACK here, unlike the fulfil site: that site proceeds
+       * UNCHECKED because 79 of 80 production rooms 403 the head read on an empty
+       * roster; an A2A head read admits any active participant (observer
+       * fallback), so five failed reads there mean an outage, not a routine 403.
+       * On anything but `confirmed` the manager is back at `stateBefore`.
+       */
+      async _sendCommitConfirmed(opts) {
+        const { mlsGroup, mlsGroupId, label, commit, epoch, parent: parent2, memberDeviceIds, stateBefore, inFlight } = opts;
+        const ours = this._commitDigest(commit);
+        inFlight.sent.push({ epoch, digest: ours, verified: false, stateBefore });
+        const ok = await this._sendFrameConfirmed(
+          {
+            event: "mls_commit",
+            data: {
+              group_id: mlsGroupId,
+              epoch,
+              payload: Buffer.from(commit).toString("hex"),
+              ...parent2 ? { parent_digest: parent2 } : {},
+              ...memberDeviceIds && memberDeviceIds.length > 0 ? { member_device_ids: memberDeviceIds } : {}
+            }
+          },
+          `${label} commit`
+        );
+        if (!ok) {
+          inFlight.sent.pop();
+          mlsGroup.importState(stateBefore);
+          console.warn(
+            `[SecureChannel] ${label}: commit at epoch ${epoch} was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}`
+          );
+          return "unsent";
+        }
+        const verdict = await this._confirmCommitAtHead(mlsGroupId, epoch, ours, inFlight, label);
+        if (inFlight.refusal === void 0 && verdict === "confirmed") {
+          inFlight.sent[inFlight.sent.length - 1].verified = true;
+          return "confirmed";
+        }
+        const why = inFlight.refusal?.detail ?? verdict.toUpperCase();
+        mlsGroup.importState(stateBefore);
+        console.warn(
+          `[SecureChannel] ${label}: commit at epoch ${epoch} was ${verdict === "unverifiable" ? "not verified (head unreadable)" : "refused by the server"} \u2014 "${why}" \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing persisted`
+        );
+        return "refused";
+      }
       _commitDigest(bytes) {
         return createHash("sha256").update(bytes).digest("hex");
       }
@@ -72098,7 +72286,9 @@ ${baseText}`;
                   mlsGroupId: roomState.mlsGroupId,
                   label: `room ${roomId.slice(0, 8)}`,
                   welcomeFields: { room_id: roomId },
-                  targets: roomTargets
+                  targets: roomTargets,
+                  memberDeviceIds: (roomState.members ?? []).map((m2) => m2.deviceId)
+                  // #1226
                 });
                 if (done > 0) {
                   console.log(
@@ -72153,7 +72343,9 @@ ${baseText}`;
                   mlsGroupId: entry.mlsGroupId,
                   label: `shared group ${gid.slice(0, 8)}`,
                   welcomeFields: { conversation_group_id: gid },
-                  targets: sharedTargets
+                  targets: sharedTargets,
+                  memberDeviceIds: entry.memberDeviceIds ?? []
+                  // #1226
                 });
                 if (done > 0) {
                   console.log(`[SecureChannel] Batched Welcome for ${done}/${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
@@ -72167,7 +72359,9 @@ ${baseText}`;
                       mlsGroupId: entry.mlsGroupId,
                       label: `shared group ${gid.slice(0, 8)}`,
                       welcomeFields: { conversation_group_id: gid },
-                      targets: [target]
+                      targets: [target],
+                      memberDeviceIds: entry.memberDeviceIds ?? []
+                      // #1226
                     });
                     if (done > 0) {
                       console.log(`[SecureChannel] Individual Welcome for ${target.deviceId.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
@@ -72214,7 +72408,11 @@ ${baseText}`;
                       requestId: req.id,
                       deviceId: req.requesting_device_id,
                       keyPackage: memberKp
-                    }]
+                    }],
+                    // #1226: a 1:1 roster is [self, owner] — the web's shape too.
+                    memberDeviceIds: [this._persisted?.sessions?.[convId]?.ownerDeviceId].filter(
+                      (d2) => typeof d2 === "string"
+                    )
                   });
                   if (done > 0) {
                     console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
@@ -72272,192 +72470,8 @@ ${baseText}`;
               console.log(`[SecureChannel] ${pending.length} pending A2A Welcome requests for channel ${chId.slice(0, 8)}`);
               for (const req of pending) {
                 try {
-                  const kpRes = await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
-                    { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-                  );
-                  if (!kpRes.ok) continue;
-                  const kpData = await kpRes.json();
-                  const kpHex = kpData[req.requesting_device_id];
-                  if (!kpHex) continue;
-                  const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
-                  const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  console.log(`[SecureChannel] A2A addMembers for ${req.requesting_device_id.slice(0, 8)} group=${chState.mlsGroupId.slice(0, 8)} epoch=${mlsGroup.epoch}`);
-                  let parentDigest = await this._readGroupHeadDigest(chState.mlsGroupId);
-                  let commit;
-                  let welcome;
-                  try {
-                    const result = await mlsGroup.addMembers([memberKp]);
-                    commit = result.commit;
-                    welcome = result.welcome;
-                  } catch (addErr) {
-                    const errMsg = addErr instanceof Error ? addErr.message : String(addErr);
-                    if (errMsg.includes("already in the group")) {
-                      console.log(`[SecureChannel] A2A member already in group \u2014 removing and re-adding ${req.requesting_device_id.slice(0, 8)}`);
-                      const preRemoveState = JSON.stringify(mlsGroup.exportState());
-                      let removeCommitPublished = false;
-                      try {
-                        const identityBytes = new TextEncoder().encode(req.requesting_device_id);
-                        const leafIndex = mlsGroup.memberLeafIndex(identityBytes);
-                        if (leafIndex === null) {
-                          console.log(`[SecureChannel] A2A re-add: no leaf index for ${req.requesting_device_id.slice(0, 8)} \u2014 cannot remove`);
-                          continue;
-                        }
-                        const removeResult = await mlsGroup.removeMember(leafIndex);
-                        try {
-                          const removeResp = await fetch(
-                            `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
-                            {
-                              method: "POST",
-                              headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                              body: JSON.stringify({
-                                group_id: chState.mlsGroupId,
-                                device_id: this._deviceId,
-                                commit: Buffer.from(removeResult.commit).toString("hex"),
-                                commit_epoch: Number(mlsGroup.epoch),
-                                ...parentDigest ? { parent_digest: parentDigest } : {}
-                              })
-                            }
-                          );
-                          if (removeResp.ok) {
-                            removeCommitPublished = true;
-                            parentDigest = this._commitDigest(removeResult.commit);
-                          } else {
-                            const detail = await removeResp.text().catch(() => "");
-                            console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
-                          }
-                        } catch (distErr) {
-                          console.warn(`[SecureChannel] A2A remove-commit distribute network error:`, distErr);
-                        }
-                        if (!removeCommitPublished) {
-                          mlsGroup.importState(JSON.parse(preRemoveState));
-                          continue;
-                        }
-                        const kpRes2 = await fetch(
-                          `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
-                          { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-                        );
-                        if (kpRes2.ok) {
-                          const kpData2 = await kpRes2.json();
-                          const kpHex2 = kpData2[req.requesting_device_id];
-                          if (kpHex2) {
-                            const kpBytes2 = new Uint8Array(Buffer.from(kpHex2, "hex"));
-                            const memberKp2 = MLSGroupManager.deserializeKeyPackage(kpBytes2);
-                            const result2 = await mlsGroup.addMembers([memberKp2]);
-                            commit = result2.commit;
-                            welcome = result2.welcome;
-                          } else {
-                            console.log(`[SecureChannel] A2A re-add: no fresh KeyPackage for ${req.requesting_device_id.slice(0, 8)}`);
-                            continue;
-                          }
-                        } else {
-                          console.log(`[SecureChannel] A2A re-add: KeyPackage fetch failed (${kpRes2.status})`);
-                          continue;
-                        }
-                      } catch (readdErr) {
-                        console.log(`[SecureChannel] A2A remove+re-add FAILED: ${readdErr instanceof Error ? readdErr.message : String(readdErr)}`);
-                        if (!removeCommitPublished) {
-                          try {
-                            mlsGroup.importState(JSON.parse(preRemoveState));
-                          } catch {
-                          }
-                        }
-                        continue;
-                      }
-                    } else {
-                      console.log(`[SecureChannel] A2A addMembers FAILED: ${errMsg}`);
-                      continue;
-                    }
-                  }
-                  if (!welcome) {
-                    console.warn(`[SecureChannel] A2A addMembers produced no Welcome for ${req.requesting_device_id.slice(0, 8)}`);
-                    continue;
-                  }
-                  const commitHex = Buffer.from(commit).toString("hex");
-                  const welcomeHex = Buffer.from(welcome).toString("hex");
-                  let distributed = false;
-                  const updatedMembers = [this._deviceId, req.requesting_device_id];
-                  try {
-                    const distResp = await fetch(
-                      `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
-                      {
-                        method: "POST",
-                        headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                        body: JSON.stringify({
-                          group_id: chState.mlsGroupId,
-                          device_id: this._deviceId,
-                          commit: commitHex,
-                          commit_epoch: Number(mlsGroup.epoch),
-                          welcomes: [{ target_device_id: req.requesting_device_id, payload: welcomeHex }],
-                          member_device_ids: updatedMembers,
-                          ...parentDigest ? { parent_digest: parentDigest } : {}
-                        })
-                      }
-                    );
-                    if (distResp.ok) {
-                      distributed = true;
-                    } else {
-                      const detail = await distResp.text().catch(() => "");
-                      console.warn(`[SecureChannel] A2A distribute failed (${distResp.status}): ${detail}`);
-                    }
-                  } catch (distErr) {
-                    console.warn(`[SecureChannel] A2A distribute network error:`, distErr);
-                  }
-                  if (!distributed && this._wsIsOpen()) {
-                    const a2aLabel = `A2A ${chId.slice(0, 8)}`;
-                    const commitSent = await this._sendFrameConfirmed({
-                      event: "mls_commit",
-                      data: {
-                        group_id: chState.mlsGroupId,
-                        epoch: Number(mlsGroup.epoch),
-                        payload: commitHex,
-                        ...parentDigest ? { parent_digest: parentDigest } : {}
-                      }
-                    }, `${a2aLabel} commit`);
-                    const welcomeSent = commitSent && await this._sendFrameConfirmed({
-                      event: "mls_welcome",
-                      data: {
-                        target_device_id: req.requesting_device_id,
-                        group_id: chState.mlsGroupId,
-                        a2a_channel_id: chId,
-                        payload: welcomeHex
-                      }
-                    }, `${a2aLabel} welcome`);
-                    if (!welcomeSent) {
-                      console.warn(`[SecureChannel] ${a2aLabel}: Welcome frames were NOT written \u2014 leaving the request pending`);
-                      continue;
-                    }
-                    try {
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({
-                            group_id: chState.mlsGroupId,
-                            device_id: this._deviceId,
-                            commit_epoch: Number(mlsGroup.epoch),
-                            member_device_ids: updatedMembers
-                          })
-                        }
-                      );
-                    } catch {
-                    }
-                    distributed = true;
-                  }
-                  if (!distributed) {
-                    console.warn(`[SecureChannel] Cannot deliver Welcome \u2014 HTTP distribute and WS both unavailable`);
-                    continue;
-                  }
-                  const a2aFulfilled = await this._postFulfilWelcome(
-                    chState.mlsGroupId,
-                    req.id,
-                    `A2A ${chId.slice(0, 8)}`
-                  );
-                  await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                  if (a2aFulfilled) {
-                    console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
-                  }
+                  const next = await this._fulfilA2AWelcome(chId, chState, mlsGroup, req);
+                  if (next === "stop") break;
                 } catch (fulfillErr) {
                   console.log(`[SecureChannel] A2A Welcome fulfill failed: ${fulfillErr instanceof Error ? fulfillErr.message : String(fulfillErr)}`);
                 }
@@ -72728,6 +72742,227 @@ ${baseText}`;
           }
         }
       }
+      /**
+       * #1225: fulfil ONE pending A2A Welcome request — the `/distribute` path.
+       * Extracted from the delivery pull so the in-flight slot (review F1) is held
+       * for exactly this request and released on every exit. Returns "stop" when
+       * nothing else on this channel can succeed this pull (review F2).
+       */
+      async _fulfilA2AWelcome(chId, chState, mlsGroup, req) {
+        const a2aLabel = `A2A ${chId.slice(0, 8)}`;
+        const preHead = await this._readGroupHead(chState.mlsGroupId);
+        if (preHead.ok && preHead.epoch !== Number(mlsGroup.epoch)) {
+          console.warn(
+            `[SecureChannel] ${a2aLabel}: server head is at epoch ${preHead.epoch}, we are at ${Number(mlsGroup.epoch)} \u2014 NOT committing (it would be refused); resync catches up first`
+          );
+          await this._catchUpAfterPreflightSkip(chState.mlsGroupId, preHead.epoch, Number(mlsGroup.epoch), a2aLabel);
+          return "stop";
+        }
+        const inFlight = this._reserveCommit(chState.mlsGroupId, a2aLabel);
+        if (!inFlight) return "stop";
+        try {
+          const kpRes = await fetch(
+            `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
+            { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+          );
+          if (!kpRes.ok) return "next";
+          const kpData = await kpRes.json();
+          const kpHex = kpData[req.requesting_device_id];
+          if (!kpHex) return "next";
+          const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
+          const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
+          console.log(`[SecureChannel] A2A addMembers for ${req.requesting_device_id.slice(0, 8)} group=${chState.mlsGroupId.slice(0, 8)} epoch=${mlsGroup.epoch}`);
+          let parentDigest = preHead.ok ? preHead.digest : void 0;
+          let commit;
+          let welcome;
+          let preAddState = mlsGroup.exportState();
+          try {
+            const result = await mlsGroup.addMembers([memberKp]);
+            commit = result.commit;
+            welcome = result.welcome;
+          } catch (addErr) {
+            const errMsg = addErr instanceof Error ? addErr.message : String(addErr);
+            if (errMsg.includes("already in the group")) {
+              console.log(`[SecureChannel] A2A member already in group \u2014 removing and re-adding ${req.requesting_device_id.slice(0, 8)}`);
+              const preRemoveState = JSON.stringify(mlsGroup.exportState());
+              let removeCommitPublished = false;
+              try {
+                const identityBytes = new TextEncoder().encode(req.requesting_device_id);
+                const leafIndex = mlsGroup.memberLeafIndex(identityBytes);
+                if (leafIndex === null) {
+                  console.log(`[SecureChannel] A2A re-add: no leaf index for ${req.requesting_device_id.slice(0, 8)} \u2014 cannot remove`);
+                  return "next";
+                }
+                const removeResult = await mlsGroup.removeMember(leafIndex);
+                try {
+                  const removeResp = await fetch(
+                    `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
+                    {
+                      method: "POST",
+                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                      body: JSON.stringify({
+                        group_id: chState.mlsGroupId,
+                        device_id: this._deviceId,
+                        commit: Buffer.from(removeResult.commit).toString("hex"),
+                        commit_epoch: Number(mlsGroup.epoch),
+                        expected_epoch: Number(mlsGroup.epoch) - 1,
+                        // #1225: exact-step, like the WS path
+                        ...parentDigest ? { parent_digest: parentDigest } : {}
+                      })
+                    }
+                  );
+                  if (removeResp.ok) {
+                    removeCommitPublished = true;
+                    await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+                    parentDigest = this._commitDigest(removeResult.commit);
+                  } else {
+                    const detail = await removeResp.text().catch(() => "");
+                    console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
+                  }
+                } catch (distErr) {
+                  console.warn(`[SecureChannel] A2A remove-commit distribute network error:`, distErr);
+                }
+                if (!removeCommitPublished) {
+                  mlsGroup.importState(JSON.parse(preRemoveState));
+                  return "next";
+                }
+                const kpRes2 = await fetch(
+                  `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
+                  { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                );
+                if (kpRes2.ok) {
+                  const kpData2 = await kpRes2.json();
+                  const kpHex2 = kpData2[req.requesting_device_id];
+                  if (kpHex2) {
+                    const kpBytes2 = new Uint8Array(Buffer.from(kpHex2, "hex"));
+                    const memberKp2 = MLSGroupManager.deserializeKeyPackage(kpBytes2);
+                    preAddState = mlsGroup.exportState();
+                    const result2 = await mlsGroup.addMembers([memberKp2]);
+                    commit = result2.commit;
+                    welcome = result2.welcome;
+                  } else {
+                    console.log(`[SecureChannel] A2A re-add: no fresh KeyPackage for ${req.requesting_device_id.slice(0, 8)}`);
+                    return "next";
+                  }
+                } else {
+                  console.log(`[SecureChannel] A2A re-add: KeyPackage fetch failed (${kpRes2.status})`);
+                  return "next";
+                }
+              } catch (readdErr) {
+                console.log(`[SecureChannel] A2A remove+re-add FAILED: ${readdErr instanceof Error ? readdErr.message : String(readdErr)}`);
+                if (!removeCommitPublished) {
+                  try {
+                    mlsGroup.importState(JSON.parse(preRemoveState));
+                  } catch {
+                  }
+                }
+                return "next";
+              }
+            } else {
+              console.log(`[SecureChannel] A2A addMembers FAILED: ${errMsg}`);
+              return "next";
+            }
+          }
+          if (!welcome) {
+            console.warn(`[SecureChannel] A2A addMembers produced no Welcome for ${req.requesting_device_id.slice(0, 8)}`);
+            return "next";
+          }
+          const commitHex = Buffer.from(commit).toString("hex");
+          const welcomeHex = Buffer.from(welcome).toString("hex");
+          let distributed = false;
+          let transportFailed = false;
+          const updatedMembers = this._commitRoster([this._deviceId], [req.requesting_device_id]);
+          try {
+            const distResp = await fetch(
+              `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
+              {
+                method: "POST",
+                headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                body: JSON.stringify({
+                  group_id: chState.mlsGroupId,
+                  device_id: this._deviceId,
+                  commit: commitHex,
+                  commit_epoch: Number(mlsGroup.epoch),
+                  welcomes: [{ target_device_id: req.requesting_device_id, payload: welcomeHex }],
+                  member_device_ids: updatedMembers,
+                  expected_epoch: Number(mlsGroup.epoch) - 1,
+                  // #1225: exact-step, like the WS path
+                  ...parentDigest ? { parent_digest: parentDigest } : {}
+                })
+              }
+            );
+            if (distResp.ok) {
+              distributed = true;
+            } else {
+              const detail = await distResp.text().catch(() => "");
+              console.warn(`[SecureChannel] A2A distribute failed (${distResp.status}): ${detail}`);
+              if (distResp.status >= 500) {
+                transportFailed = true;
+              } else if (distResp.status === 409) {
+                mlsGroup.importState(preAddState);
+                console.warn(
+                  `[SecureChannel] ${a2aLabel}: add commit lost the race (409) \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, request stays pending`
+                );
+                return "next";
+              } else {
+                mlsGroup.importState(preAddState);
+                console.error(
+                  `[SecureChannel] ${a2aLabel}: add commit refused with ${distResp.status} \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}; not retrying this channel this pull`
+                );
+                return "stop";
+              }
+            }
+          } catch (distErr) {
+            console.warn(`[SecureChannel] A2A distribute network error:`, distErr);
+            transportFailed = true;
+          }
+          if (!distributed && transportFailed && this._wsIsOpen()) {
+            const verdict = await this._sendCommitConfirmed({
+              mlsGroup,
+              mlsGroupId: chState.mlsGroupId,
+              label: a2aLabel,
+              commit,
+              epoch: Number(mlsGroup.epoch),
+              parent: parentDigest,
+              memberDeviceIds: updatedMembers,
+              stateBefore: preAddState,
+              inFlight
+            });
+            if (verdict !== "confirmed") return "next";
+            const welcomeSent = await this._sendFrameConfirmed({
+              event: "mls_welcome",
+              data: {
+                target_device_id: req.requesting_device_id,
+                group_id: chState.mlsGroupId,
+                a2a_channel_id: chId,
+                payload: welcomeHex
+              }
+            }, `${a2aLabel} welcome`);
+            if (!welcomeSent) {
+              await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+              console.warn(`[SecureChannel] ${a2aLabel}: Welcome frame was NOT written \u2014 leaving the request pending`);
+              return "next";
+            }
+            distributed = true;
+          }
+          if (!distributed) {
+            console.warn(`[SecureChannel] Cannot deliver Welcome \u2014 HTTP distribute and WS both unavailable`);
+            return "next";
+          }
+          const a2aFulfilled = await this._postFulfilWelcome(
+            chState.mlsGroupId,
+            req.id,
+            `A2A ${chId.slice(0, 8)}`
+          );
+          await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+          if (a2aFulfilled) {
+            console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+          }
+          return "next";
+        } finally {
+          await this._releaseCommit(chState.mlsGroupId, inFlight, a2aLabel);
+        }
+      }
       /**
        * Found the MLS group for an A2A channel as the creator agent.
        * Calls /mls/a2a/{channelId}/init, creates the local MLS group, and sends
@@ -72770,48 +73005,77 @@ ${baseText}`;
           await saveMlsState(this.config.dataDir, mlsData.group_id, JSON.stringify(mgr.exportState()));
           for (const p2 of participants) {
             if (p2.status !== "active" && p2.status !== "invited") continue;
+            const a2aLabel = `A2A ${channelId.slice(0, 8)} found\u2192${p2.hubAddress}`;
             try {
-              const kpRes = await fetch(
-                `${this.config.apiUrl}/api/v1/mls/key-packages?hub_id=${encodeURIComponent(p2.hubId)}`,
-                { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-              );
-              if (kpRes.ok) {
-                const kpData = await kpRes.json();
-                if (kpData.key_package) {
-                  const kpBytes = new Uint8Array(Buffer.from(kpData.key_package, "hex"));
-                  const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const { commit, welcome } = await mgr.addMembers([memberKp]);
-                  if (welcome && this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_commit",
+              if (!p2.deviceId) {
+                console.warn(
+                  `[SecureChannel] ${a2aLabel}: no deviceId \u2014 NOT adding (a Welcome could not be addressed). Backend a2a_channel_approved payload may be missing device_id for this participant.`
+                );
+                continue;
+              }
+              if (!this._wsIsOpen()) {
+                console.warn(`[SecureChannel] ${a2aLabel}: socket is not OPEN \u2014 NOT advancing the group`);
+                continue;
+              }
+              const head = await this._readGroupHead(mlsData.group_id);
+              if (head.ok && head.epoch !== Number(mgr.epoch)) {
+                console.warn(`[SecureChannel] ${a2aLabel}: server head is at epoch ${head.epoch}, we are at ${Number(mgr.epoch)} \u2014 NOT committing`);
+                await this._catchUpAfterPreflightSkip(mlsData.group_id, head.epoch, Number(mgr.epoch), a2aLabel);
+                continue;
+              }
+              const inFlight = this._reserveCommit(mlsData.group_id, a2aLabel);
+              if (!inFlight) continue;
+              try {
+                const kpRes = await fetch(
+                  `${this.config.apiUrl}/api/v1/mls/key-packages?hub_id=${encodeURIComponent(p2.hubId)}`,
+                  { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                );
+                if (kpRes.ok) {
+                  const kpData = await kpRes.json();
+                  if (kpData.key_package) {
+                    const kpBytes = new Uint8Array(Buffer.from(kpData.key_package, "hex"));
+                    const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
+                    const stateBefore = mgr.exportState();
+                    const { commit, welcome } = await mgr.addMembers([memberKp]);
+                    const committedEpoch = Number(mgr.epoch);
+                    if (!welcome) {
+                      mgr.importState(stateBefore);
+                      console.warn(`[SecureChannel] ${a2aLabel}: addMembers produced no Welcome \u2014 rolled back`);
+                      continue;
+                    }
+                    const verdict = await this._sendCommitConfirmed({
+                      mlsGroup: mgr,
+                      mlsGroupId: mlsData.group_id,
+                      label: a2aLabel,
+                      commit,
+                      epoch: committedEpoch,
+                      parent: head.ok ? head.digest : void 0,
+                      memberDeviceIds: this._commitRoster(participants.map((q22) => q22.deviceId), [p2.deviceId]),
+                      stateBefore,
+                      inFlight
+                    });
+                    if (verdict !== "confirmed") continue;
+                    const sent = await this._sendFrameConfirmed({
+                      event: "mls_welcome",
                       data: {
                         group_id: mlsData.group_id,
-                        epoch: Number(mgr.epoch),
-                        payload: Buffer.from(commit).toString("hex")
+                        payload: Buffer.from(welcome).toString("hex"),
+                        target_device_id: p2.deviceId,
+                        a2a_channel_id: channelId,
+                        target_hub_id: p2.hubId
+                        // observability only — the backend ignores it
                       }
-                    }));
-                    if (!p2.deviceId) {
-                      console.warn(
-                        `[SecureChannel] Skipping MLS Welcome to ${p2.hubAddress} for A2A ${channelId.slice(0, 8)}: no deviceId. Backend a2a_channel_approved payload may be missing device_id for this participant.`
-                      );
-                    } else {
-                      this._ws.send(JSON.stringify({
-                        event: "mls_welcome",
-                        data: {
-                          group_id: mlsData.group_id,
-                          payload: Buffer.from(welcome).toString("hex"),
-                          target_device_id: p2.deviceId,
-                          a2a_channel_id: channelId,
-                          // Kept for observability — backend ignores but it's
-                          // useful in logs/wire captures to correlate to a hub.
-                          target_hub_id: p2.hubId
-                        }
-                      }));
+                    }, `${a2aLabel} welcome`);
+                    await saveMlsState(this.config.dataDir, mlsData.group_id, JSON.stringify(mgr.exportState()));
+                    if (sent) {
                       console.log(`[SecureChannel] Sent MLS Welcome to ${p2.hubAddress} (device ${p2.deviceId.slice(0, 8)}) for A2A ${channelId.slice(0, 8)}`);
+                    } else {
+                      console.warn(`[SecureChannel] ${a2aLabel}: Welcome was NOT written \u2014 the participant will request one`);
                     }
                   }
-                  await saveMlsState(this.config.dataDir, mlsData.group_id, JSON.stringify(mgr.exportState()));
                 }
+              } finally {
+                await this._releaseCommit(mlsData.group_id, inFlight, a2aLabel);
               }
             } catch (kpErr) {
               console.warn(`[SecureChannel] Failed to Welcome participant ${p2.hubAddress}:`, kpErr);
@@ -99883,7 +100147,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.40" : "0.0.0-dev";
+    VERSION = true ? "0.23.41" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -100820,7 +101084,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.13" : void 0
+      true ? "0.4.14" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -100873,7 +101137,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.13" : void 0
+      true ? "0.4.14" : void 0
     )
   });
   channelRef = channel;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.13",
+  "version": "0.4.14",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",