@agentvault/grok-bridge 0.4.23 → 0.4.25

package/dist/service/self-uninstall.d.ts

@@ -1,10 +1,38 @@
 import { type ServiceBackend } from "./backend.js";
+/**
+ * #913 item 2 / 2026-10-25 — what it takes to remove this agent's service.
+ *
+ * `attachLifecycle` routes every terminal signal here, and most of them mean
+ * the device is ALIVE:
+ *
+ *   session_replaced    another session took over — the device still exists
+ *   device_jwt_expired  the JWT aged out — the device still exists
+ *   reconnect_loop      gave up reconnecting — the device still exists
+ *
+ * This used to key on the reason string `device_revoked`. That was not proof:
+ * on 2026-10-25 a PAUSED (suspended) device's reissue 403 was mapped to
+ * "device_revoked" and this function removed loopita's launchd service — the
+ * owner switched the agent back on and nothing was installed to resume.
+ *
+ * So it now keys on the channel's CONFIRMED verdict only. SecureChannel sets
+ * `deviceGone: true` on `auth_failed` exclusively after the public status
+ * endpoint answered REVOKED or the device row is gone (404). Any reason string
+ * without that verdict — including `device_revoked` — leaves the service alone.
+ * An older channel that never sets the flag therefore never uninstalls: the
+ * safe direction.
+ */
+export interface TerminalVerdict {
+    reason: string;
+    /** Set by SecureChannel only when the status endpoint CONFIRMED revoked/deleted. */
+    deviceGone?: boolean;
+}
 export interface SelfUninstallDeps {
     backend?: ServiceBackend;
     log?: (msg: string) => void;
 }
 /**
- * Remove this agent's supervised service after its device was revoked.
+ * Remove this agent's supervised service after its device was CONFIRMED
+ * revoked or deleted.
  *
  * Returns whether a service was actually removed. NEVER throws: this runs on
  * the shutdown path, and a cleanup that cannot happen must not stop the bridge
@@ -15,5 +43,5 @@ export interface SelfUninstallDeps {
  * and LEAVES the credentials on disk. A false positive therefore costs the
  * customer a re-install, not their identity.
  */
-export declare function selfUninstallOnTerminal(reason: string, env: NodeJS.ProcessEnv, deps?: SelfUninstallDeps): boolean;
+export declare function selfUninstallOnTerminal(verdict: TerminalVerdict, env: NodeJS.ProcessEnv, deps?: SelfUninstallDeps): boolean;
 //# sourceMappingURL=self-uninstall.d.ts.map

package/dist/service/self-uninstall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self-uninstall.d.ts","sourceRoot":"","sources":["../../src/service/self-uninstall.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAuBlE,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAyCT"}
+{"version":3,"file":"self-uninstall.d.ts","sourceRoot":"","sources":["../../src/service/self-uninstall.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAyCT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.23",
+  "version": "0.4.25",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",