@agentvault/grok-bridge 0.4.20 → 0.4.21

package/dist/index.js

@@ -11712,11 +11712,11 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.49" : FALLBACK;
+  const v2 = true ? "0.23.50" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "c98737d" : "";
+  const raw = true ? "c8f1371" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -69611,6 +69611,34 @@ var init_dist = __esm({
             }
             return null;
           }
+          /**
+           * Every occupied leaf of the ratchet tree, with its basic-credential
+           * identity — READ-ONLY (#470 phase 1).
+           *
+           * Stale-leaf detection compares the tree with the server's eligible set, so
+           * it must see EVERY leaf. `memberLeafIndex` cannot: it stops at the first
+           * match, so a device holding two leaves (the duplicate-add shape observed
+           * live 2026-06-18) would show one. Blank leaves (removed members) are
+           * skipped; duplicates are returned once per leaf. Leaves whose credential is
+           * not `basic` carry no comparable identity and are skipped too — the web
+           * client only ever mints basic credentials.
+           *
+           * Identities are COPIES: a caller mutating one cannot reach the tree.
+           */
+          leafIdentities() {
+            const tree = this._requireState().ratchetTree;
+            const out = [];
+            for (let nodeIndex = 0; nodeIndex < tree.length; nodeIndex += 2) {
+              const node2 = tree[nodeIndex];
+              if (node2 && node2.nodeType === "leaf") {
+                const cred = node2.leaf.credential;
+                if (cred.credentialType === "basic") {
+                  out.push({ leafIndex: nodeIndex / 2, identity: new Uint8Array(cred.identity) });
+                }
+              }
+            }
+            return out;
+          }
           // -------------------------------------------------------------------------
           // Encrypt / Decrypt
           // -------------------------------------------------------------------------
@@ -70617,6 +70645,7 @@ var init_dist = __esm({
           _trustTier = null;
           _trustTokenExpiresAt = null;
           _trustTokenInterval = null;
+          _trustTokenUnavailableUntil = 0;
           _pendingPollTimer = null;
           _syncMessageIds = null;
           _deliveryHeartbeat = null;
@@ -70832,6 +70861,7 @@ ${text}`;
           static SILENCE_TIMEOUT_MS = 9e4;
           static POLL_FALLBACK_INTERVAL_MS = 3e4;
           // 30s when messages found
+          static TRUST_TOKEN_UNAVAILABLE_BACKOFF_MS = 6 * 60 * 60 * 1e3;
           static POLL_FALLBACK_IDLE_MS = 6e4;
           // 60s when idle
           /**
@@ -72229,7 +72259,7 @@ ${text}`;
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.49" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.50" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -73262,6 +73292,7 @@ ${text}`;
             return this._trustTokenExpiresAt;
           }
           async refreshTrustToken() {
+            if (Date.now() < this._trustTokenUnavailableUntil) return;
             try {
               const res = await fetch(`${this.config.apiUrl}/api/v1/gate/token`, {
                 method: "POST",
@@ -73275,12 +73306,15 @@ ${text}`;
                 this._trustToken = data.token;
                 this._trustTier = data.tier;
                 this._trustTokenExpiresAt = data.expires_at;
+              } else if (res.status === 503 || res.status === 404 || res.status === 403) {
+                this._trustTokenUnavailableUntil = Date.now() + _SecureChannel.TRUST_TOKEN_UNAVAILABLE_BACKOFF_MS;
               }
             } catch (err) {
               console.warn("[AgentVault] Trust token refresh failed:", err);
             }
           }
           startTrustTokenRefresh() {
+            this.stopTrustTokenRefresh();
             this.refreshTrustToken();
             this._trustTokenInterval = setInterval(
               () => this.refreshTrustToken(),
@@ -74225,7 +74259,7 @@ ${text}`;
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.49" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.50" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -74553,7 +74587,7 @@ ${text}`;
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.49" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.50" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -100709,7 +100743,7 @@ data:
         await init_skill_telemetry();
         await init_policy_enforcer();
         init_room_protocol();
-        VERSION = true ? "0.23.49" : "0.0.0-dev";
+        VERSION = true ? "0.23.50" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -102810,7 +102844,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.20" : void 0
+      true ? "0.4.21" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -102849,7 +102883,7 @@ async function main() {
     process.exit(0);
   }
   const cfg = loadConfig(process.env, process.argv.slice(2));
-  logLine(`[grok-bridge] version: ${true ? "0.4.20" : "dev"}`);
+  logLine(`[grok-bridge] version: ${true ? "0.4.21" : "dev"}`);
   mkdirSync7(cfg.workspaceDir, { recursive: true });
   mkdirSync7(cfg.fenceHome, { recursive: true });
   seedFenceCredential({
@@ -102864,7 +102898,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.20" : void 0
+      true ? "0.4.21" : void 0
     )
   });
   channelRef = channel;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.20",
+  "version": "0.4.21",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",