@agentvault/grok-bridge 0.4.2 → 0.4.4

package/dist/index.js

@@ -64589,17 +64589,28 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.29" : FALLBACK;
+  const v2 = true ? "0.23.31" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
+function buildSha() {
+  const raw = true ? "3e1243a-dirty" : "";
+  const cleaned = (raw ?? "").trim();
+  return !cleaned || cleaned === "unknown" ? null : cleaned;
+}
+function withBuildSha(identity) {
+  const sha = buildSha();
+  if (!sha || identity.includes("+")) return identity;
+  const stamped = `${identity}+${sha}`;
+  return stamped.length <= MAX_LEN ? stamped : identity;
+}
 function buildClientVersion(override) {
   try {
     const candidate = (override ?? "").trim();
     if (candidate) {
-      const cleaned = candidate.replace(DISALLOWED, "").slice(0, MAX_LEN);
+      const cleaned = withBuildSha(candidate.replace(DISALLOWED, "").slice(0, MAX_LEN));
       if (cleaned && !cleaned.includes("..")) return cleaned;
     }
-    return ownIdentity().replace(DISALLOWED, "").slice(0, MAX_LEN);
+    return withBuildSha(ownIdentity().replace(DISALLOWED, "").slice(0, MAX_LEN));
   } catch {
     return FALLBACK;
   }
@@ -66330,6 +66341,118 @@ var init_channel = __esm2({
        * Encrypt and send a message to ALL owner devices (fanout).
        * Each session gets the same plaintext encrypted independently.
        */
+      /**
+       * #952 — sends held because MLS is expected for this conversation but the
+       * group is not joined yet.
+       *
+       * ⚠️ IN MEMORY ONLY. These entries hold PLAINTEXT. `_persisted` is written to
+       * disk, and the product's entire premise is that plaintext does not rest
+       * where it does not have to; a crash losing a held greeting is the correct
+       * trade. This is why the existing `outboundQueue` could not be reused — that
+       * one is persisted, and holds already-DR-encrypted bytes, which is exactly
+       * the encryption we are trying not to perform yet.
+       */
+      _mlsHold = /* @__PURE__ */ new Map();
+      /** How long a send waits for the Welcome. The two measured bursts were each
+       *  confined to a single minute, with the group already existing server-side
+       *  in the same second, so this is generous rather than tight. */
+      static MLS_HOLD_MS = 3e4;
+      /** Bound on held sends per group — see `_holdForMls`. */
+      static MLS_HOLD_MAX = 50;
+      /**
+       * Should this 1:1 send wait for MLS rather than go out over Double Ratchet?
+       *
+       * The discriminator exists at the moment of the bug: `_sessionGroupIds`
+       * already carries the conversation's group id — the server told us the group
+       * exists — while `_mlsGroups` has no usable manager for it. Group expected,
+       * group not ready.
+       *
+       * The negative case is load-bearing. A conversation with NO group id is
+       * legitimately Double Ratchet, and holding it would break owner-to-agent
+       * messaging outright, which is far worse than the bug this fixes. "Present"
+       * is also not "ready": a manager parked at epoch 0 has not joined (#1092),
+       * and reading presence as readiness is how #991 shipped.
+       */
+      _shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId) {
+        if (!convGroupId) return false;
+        const ready = Boolean(mlsGroup?.isInitialized) && Boolean(mlsGroupId) && Number(mlsGroup?.epoch) > 0;
+        return !ready;
+      }
+      /** Park a send until the Welcome lands, or until the hold expires. */
+      _holdForMls(convGroupId, convId, plaintext, options) {
+        let entry = this._mlsHold.get(convGroupId);
+        if (!entry) {
+          const timer = setTimeout(() => {
+            void this._releaseHeldOverDr(convGroupId);
+          }, _SecureChannel.MLS_HOLD_MS);
+          timer.unref?.();
+          entry = { items: [], timer };
+          this._mlsHold.set(convGroupId, entry);
+        }
+        if (entry.items.length >= _SecureChannel.MLS_HOLD_MAX) {
+          entry.items.shift();
+          console.warn(
+            `[SecureChannel] MLS hold full for group ${convGroupId.slice(0, 8)} \u2014 dropped the oldest held message`
+          );
+        }
+        entry.items.push({ convId, plaintext, options });
+        console.log(
+          `[SecureChannel] Holding send for group ${convGroupId.slice(0, 8)} until its Welcome lands (held=${entry.items.length})`
+        );
+      }
+      _takeHold(convGroupId) {
+        const entry = this._mlsHold.get(convGroupId);
+        if (!entry) return null;
+        clearTimeout(entry.timer);
+        this._mlsHold.delete(convGroupId);
+        return entry;
+      }
+      /** Re-drive one held send through the normal path, now that MLS is ready. */
+      async _resendHeld(item) {
+        await this.send(item.plaintext, {
+          ...item.options ?? {},
+          conversationId: item.convId,
+          bypassMlsHold: true
+        });
+      }
+      /** The Welcome landed — release everything held for this group, in order. */
+      async _flushMlsHold(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.log(
+          `[SecureChannel] Welcome landed for group ${convGroupId.slice(0, 8)} \u2014 releasing ${entry.items.length} held message(s) over MLS`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed to send after Welcome:", err);
+          }
+        }
+      }
+      /**
+       * The hold expired. Send over Double Ratchet exactly as before.
+       *
+       * This is deliberately NOT a drop. #853 and #831 are Welcomes that never
+       * arrive; under those an unbounded hold turns a lost minute into an agent
+       * that never speaks again. The hold removes the race — it must not invent a
+       * new failure mode. The warning is the part that is new: today the loss is
+       * silent.
+       */
+      async _releaseHeldOverDr(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.warn(
+          `[SecureChannel] No Welcome for group ${convGroupId.slice(0, 8)} within ${_SecureChannel.MLS_HOLD_MS}ms \u2014 releasing ${entry.items.length} message(s) over Double Ratchet. The recipient may not hold a ratchet with this device, in which case they are undeliverable (#952).`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed on Double Ratchet release:", err);
+          }
+        }
+      }
       async send(plaintext, options) {
         if (isAbstention(plaintext)) return;
         if (this._state === "error" || this._state === "idle") {
@@ -66491,6 +66614,10 @@ var init_channel = __esm2({
               );
               addressedMlsGroupIds.push(mlsGroupId);
               if (convGroupId) sentSharedGroupIds.add(convGroupId);
+            } else if (!options?.bypassMlsHold && this._shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId)) {
+              this._holdForMls(convGroupId, convId, plaintext, options);
+              sentCount++;
+              continue;
             } else {
               const encrypted = session.ratchet.encrypt(plaintext);
               const transport = encryptedMessageToTransport(encrypted);
@@ -66660,7 +66787,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.29" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.31" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68598,7 +68725,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.29" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.31" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -68922,7 +69049,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.29" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.31" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69338,11 +69465,13 @@ var init_channel = __esm2({
           let text = plaintext;
           let messageType = "text";
           let topicId = data.topic_id;
+          let mlsAttachment = null;
           try {
             const parsed = JSON.parse(plaintext);
             text = parsed.text ?? plaintext;
             messageType = parsed.type ?? "text";
             topicId = parsed.topicId ?? topicId;
+            if (parsed.attachment) mlsAttachment = parsed.attachment;
           } catch {
           }
           if (messageType === "history_catchup_request") {
@@ -69409,6 +69538,9 @@ var init_channel = __esm2({
               console.log(`[SecureChannel] Session ${convId.slice(0, 8)} activated via MLS message`);
             }
           }
+          if (mlsAttachment) {
+            text = await this._augmentWithAttachment(mlsAttachment, text);
+          }
           const metadata = {
             messageId: data.message_id ?? `mls_${Date.now()}`,
             conversationId: convId ?? this._primaryConversationId,
@@ -69658,6 +69790,65 @@ ${messageText}`;
        * Download an encrypted attachment blob, decrypt it, verify integrity,
        * and save the plaintext file to disk.
        */
+      /** Where an attachment may be written — always directly inside `attachDir` (#1143).
+       *
+       * The filename arrives INSIDE the envelope and is chosen by whoever sent the
+       * message. `join(attachDir, info.filename)` resolves `..` normally, so
+       * `../../agentvault.json` wrote over the device credential store. Only the
+       * final path component is honoured, and anything that is not a usable name
+       * falls back to a fixed one.
+       */
+      _safeAttachmentPath(attachDir, filename) {
+        const raw = String(filename ?? "");
+        const last = raw.split(/[\\/]/).pop() ?? "";
+        const cleaned = last.replace(/\0/g, "").trim();
+        const safe = cleaned === "" || cleaned === "." || cleaned === ".." ? "attachment.bin" : cleaned;
+        return join4(attachDir, safe);
+      }
+      /** Download an attachment and fold it into the text the agent sees (#1139).
+       *
+       * Extracted so the MLS receive path can use it too. It used to live inline in
+       * `_handleIncomingMessage`, which meant attachments worked on the Double
+       * Ratchet path ONLY — and hermes drops DR by design (`secure_channel.py:594`,
+       * "DR fallback is logged-and-dropped"), so no single transport could serve
+       * both client families. That is why an attachment reached ohtani and never
+       * reached smartcoder2 on 2026-08-31.
+       *
+       * Returns the text unchanged when there is no attachment or the fetch fails —
+       * but a failure is LOGGED and announced in the text, never silent.
+       */
+      async _augmentWithAttachment(attachmentInfo, baseText) {
+        if (!attachmentInfo) return baseText;
+        try {
+          const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
+          const mime = String(attachmentInfo.mime ?? "application/octet-stream");
+          const name = String(attachmentInfo.filename ?? "attachment");
+          const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
+          if (textMimes.some((m2) => mime.startsWith(m2))) {
+            const content = new TextDecoder().decode(decrypted);
+            return `[Attachment: ${name} (${mime}) saved to ${filePath}]
+---
+${content}
+---
+
+${baseText}`;
+          }
+          if (mime.startsWith("image/")) {
+            return `[Image attachment: ${name} saved to ${filePath}]
+Use your Read tool to view this image file.
+
+${baseText}`;
+          }
+          return `[Attachment: ${name} saved to ${filePath}]
+
+${baseText}`;
+        } catch (err) {
+          console.error("[SecureChannel] Failed to download attachment:", err);
+          return `[Attachment: ${String(attachmentInfo.filename ?? "file")} was sent but could not be retrieved: ${err}]
+
+${baseText}`;
+        }
+      }
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
         await mkdir3(attachDir, { recursive: true });
@@ -69677,7 +69868,7 @@ ${messageText}`;
         const fileKey = base64ToBytes(info.fileKey);
         const fileNonce = base64ToBytes(info.fileNonce);
         const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
-        const filePath = join4(attachDir, info.filename);
+        const filePath = this._safeAttachmentPath(attachDir, info.filename);
         await writeFile3(filePath, decrypted);
         console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
         return { filePath, decrypted };
@@ -71098,6 +71289,7 @@ ${messageText}`;
               await this._persistState();
             }
             console.log(`[SecureChannel] Joined shared 1:1 MLS group for group ${conversationGroupId.slice(0, 8)} via Welcome (epoch=${mgr.epoch})`);
+            await this._flushMlsHold(conversationGroupId);
             return;
           }
           if (conversationId) {
@@ -73068,21 +73260,30 @@ var init_gateway_send = __esm2({
 });
 function parseMentions(text) {
   const mentions = [];
-  const re2 = /@(\w[\w]*)/gi;
+  const re2 = new RegExp(MENTION_RE.source, MENTION_RE.flags);
   let match;
   while ((match = re2.exec(text)) !== null) {
     mentions.push(match[1].toLowerCase());
   }
   return mentions;
 }
+function resolveOwn(mention, names) {
+  if (names.has(mention)) return mention;
+  const parts = mention.split("-");
+  for (let i2 = parts.length - 1; i2 > 0; i2--) {
+    const candidate = parts.slice(0, i2).join("-");
+    if (names.has(candidate)) return candidate;
+  }
+  return null;
+}
 function owesRoomReply(plaintext, agentName, accountId, senderIsAgent, roomDisplayName, ownDisplayName, selfResolved = true) {
   const mentions = parseMentions(plaintext);
   if (mentions.length === 0) return false;
-  if (mentions.includes("all") || mentions.includes("everyone")) {
+  const ownNames = ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName);
+  if (mentions.some((m2) => resolveOwn(m2, ownNames) !== null)) return true;
+  if (mentions.some((m2) => resolveOwn(m2, BROADCAST_NAMES) !== null)) {
     return senderIsAgent !== true;
   }
-  const ownNames = ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName);
-  if (mentions.some((m2) => ownNames.has(m2))) return true;
   if (!selfResolved) return true;
   return false;
 }
@@ -73100,9 +73301,13 @@ function ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName) {
   add4(ownDisplayName);
   return names;
 }
+var MENTION_RE;
+var BROADCAST_NAMES;
 var init_room_protocol = __esm2({
   "src/room-protocol.ts"() {
     "use strict";
+    MENTION_RE = /@([\w-]+)/gi;
+    BROADCAST_NAMES = /* @__PURE__ */ new Set(["all", "everyone"]);
   }
 });
 var init_llm_response_parser = __esm2({
@@ -99198,7 +99403,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.29" : "0.0.0-dev";
+    VERSION = true ? "0.23.31" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -100124,7 +100329,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.2" : void 0
+      true ? "0.4.4" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -100177,7 +100382,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.2" : void 0
+      true ? "0.4.4" : void 0
     )
   });
   channelRef = channel;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",

package/dist/service/install-on-ready.d.ts

@@ -1,57 +0,0 @@
-import { type BridgeConfig } from "../config.js";
-import type { ReapResult } from "../reap.js";
-import { type ServiceBackend } from "./backend.js";
-export interface InstallOnReadyDeps {
-    entrypoint: string;
-    env: NodeJS.ProcessEnv;
-    backend?: ServiceBackend;
-    hasCreds?: (dataDir: string) => boolean;
-    /** Contents of the installed launcher, or undefined when none is installed. */
-    readLauncher?: (path: string) => string | undefined;
-    fenceAuthExists?: (fenceHome: string) => boolean;
-    /** Resolves when no turn is in flight (GrokSession.idle). See rule 2. */
-    waitForIdle?: () => Promise<void>;
-    /** Bound on that wait. The terminal coming back is the product promise, so a
-     *  wedged turn must never hold the customer's shell open. */
-    idleTimeoutMs?: number;
-    /** The ONE teardown (src/reap.ts). Must complete before launchctl runs. */
-    reap: () => Promise<ReapResult>;
-    exit: (code: number) => void;
-    log: (msg: string) => void;
-}
-interface ReadyChannel {
-    on(ev: "ready", cb: () => void): unknown;
-}
-/**
- * One-paste install: enrol in the foreground, hand off to the supervisor, exit —
- * so the customer's terminal comes back and the agent survives a reboot.
- *
- * Four rules this module exists to enforce.
- *
- * 1. REFUSE BEFORE REAPING. Everything that can say no does so before anything is
- *    torn down. Refusing afterwards leaves the customer with an approved device,
- *    a spent invite token, and no running process — strictly worse than never
- *    having guarded at all.
- *
- * 2. REAP COMPLETELY, THEN BOOTSTRAP. `LaunchdBackend.install` runs bootout →
- *    poll-until-gone → bootstrap → kickstart synchronously, so the service is
- *    live the instant install returns. A partial teardown means two ACP sessions
- *    and two WebSockets on one device. `reap()` reports failure rather than
- *    swallowing it, and a failed reap is a refusal.
- *
- * 3. COMPARE, DON'T DETECT. `status().loaded` means only that a plist with this
- *    label exists. The old `install` subcommand never guarded its entrypoint
- *    (subcommand.ts), so a customer can hold a LOADED plist baked against a
- *    pruned npx cache; restarting that repairs nothing and reports success.
- *    Restart only when a service is loaded AND its baked entrypoint is the one we
- *    would install. Compare the ENTRYPOINT, never the whole launcher script —
- *    that embeds the install-time PATH and is volatile across shells.
- *
- * 4. VERIFY BEFORE CLAIMING. `backend.install` returns void, and launchd's
- *    implementation runs `kickstart` regardless of every `bootstrap` exit code.
- *    This log line is the customer's only feedback, so it comes after a
- *    `status()` that returned loaded:true.
- */
-export declare function installOnReady(channel: ReadyChannel, cfg: BridgeConfig, deps: InstallOnReadyDeps): void;
-export {};
-//# sourceMappingURL=install-on-ready.d.ts.map

package/dist/service/install-on-ready.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"install-on-ready.d.ts","sourceRoot":"","sources":["../../src/service/install-on-ready.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAMD,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,kBAAkB,GACvB,IAAI,CAgHN"}