@agentvault/grok-bridge 0.4.3 → 0.4.4

package/dist/index.js

@@ -64589,11 +64589,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.30" : FALLBACK;
+  const v2 = true ? "0.23.31" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "1fff5d6" : "";
+  const raw = true ? "3e1243a-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -66341,6 +66341,118 @@ var init_channel = __esm2({
        * Encrypt and send a message to ALL owner devices (fanout).
        * Each session gets the same plaintext encrypted independently.
        */
+      /**
+       * #952 — sends held because MLS is expected for this conversation but the
+       * group is not joined yet.
+       *
+       * ⚠️ IN MEMORY ONLY. These entries hold PLAINTEXT. `_persisted` is written to
+       * disk, and the product's entire premise is that plaintext does not rest
+       * where it does not have to; a crash losing a held greeting is the correct
+       * trade. This is why the existing `outboundQueue` could not be reused — that
+       * one is persisted, and holds already-DR-encrypted bytes, which is exactly
+       * the encryption we are trying not to perform yet.
+       */
+      _mlsHold = /* @__PURE__ */ new Map();
+      /** How long a send waits for the Welcome. The two measured bursts were each
+       *  confined to a single minute, with the group already existing server-side
+       *  in the same second, so this is generous rather than tight. */
+      static MLS_HOLD_MS = 3e4;
+      /** Bound on held sends per group — see `_holdForMls`. */
+      static MLS_HOLD_MAX = 50;
+      /**
+       * Should this 1:1 send wait for MLS rather than go out over Double Ratchet?
+       *
+       * The discriminator exists at the moment of the bug: `_sessionGroupIds`
+       * already carries the conversation's group id — the server told us the group
+       * exists — while `_mlsGroups` has no usable manager for it. Group expected,
+       * group not ready.
+       *
+       * The negative case is load-bearing. A conversation with NO group id is
+       * legitimately Double Ratchet, and holding it would break owner-to-agent
+       * messaging outright, which is far worse than the bug this fixes. "Present"
+       * is also not "ready": a manager parked at epoch 0 has not joined (#1092),
+       * and reading presence as readiness is how #991 shipped.
+       */
+      _shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId) {
+        if (!convGroupId) return false;
+        const ready = Boolean(mlsGroup?.isInitialized) && Boolean(mlsGroupId) && Number(mlsGroup?.epoch) > 0;
+        return !ready;
+      }
+      /** Park a send until the Welcome lands, or until the hold expires. */
+      _holdForMls(convGroupId, convId, plaintext, options) {
+        let entry = this._mlsHold.get(convGroupId);
+        if (!entry) {
+          const timer = setTimeout(() => {
+            void this._releaseHeldOverDr(convGroupId);
+          }, _SecureChannel.MLS_HOLD_MS);
+          timer.unref?.();
+          entry = { items: [], timer };
+          this._mlsHold.set(convGroupId, entry);
+        }
+        if (entry.items.length >= _SecureChannel.MLS_HOLD_MAX) {
+          entry.items.shift();
+          console.warn(
+            `[SecureChannel] MLS hold full for group ${convGroupId.slice(0, 8)} \u2014 dropped the oldest held message`
+          );
+        }
+        entry.items.push({ convId, plaintext, options });
+        console.log(
+          `[SecureChannel] Holding send for group ${convGroupId.slice(0, 8)} until its Welcome lands (held=${entry.items.length})`
+        );
+      }
+      _takeHold(convGroupId) {
+        const entry = this._mlsHold.get(convGroupId);
+        if (!entry) return null;
+        clearTimeout(entry.timer);
+        this._mlsHold.delete(convGroupId);
+        return entry;
+      }
+      /** Re-drive one held send through the normal path, now that MLS is ready. */
+      async _resendHeld(item) {
+        await this.send(item.plaintext, {
+          ...item.options ?? {},
+          conversationId: item.convId,
+          bypassMlsHold: true
+        });
+      }
+      /** The Welcome landed — release everything held for this group, in order. */
+      async _flushMlsHold(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.log(
+          `[SecureChannel] Welcome landed for group ${convGroupId.slice(0, 8)} \u2014 releasing ${entry.items.length} held message(s) over MLS`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed to send after Welcome:", err);
+          }
+        }
+      }
+      /**
+       * The hold expired. Send over Double Ratchet exactly as before.
+       *
+       * This is deliberately NOT a drop. #853 and #831 are Welcomes that never
+       * arrive; under those an unbounded hold turns a lost minute into an agent
+       * that never speaks again. The hold removes the race — it must not invent a
+       * new failure mode. The warning is the part that is new: today the loss is
+       * silent.
+       */
+      async _releaseHeldOverDr(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.warn(
+          `[SecureChannel] No Welcome for group ${convGroupId.slice(0, 8)} within ${_SecureChannel.MLS_HOLD_MS}ms \u2014 releasing ${entry.items.length} message(s) over Double Ratchet. The recipient may not hold a ratchet with this device, in which case they are undeliverable (#952).`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed on Double Ratchet release:", err);
+          }
+        }
+      }
       async send(plaintext, options) {
         if (isAbstention(plaintext)) return;
         if (this._state === "error" || this._state === "idle") {
@@ -66502,6 +66614,10 @@ var init_channel = __esm2({
               );
               addressedMlsGroupIds.push(mlsGroupId);
               if (convGroupId) sentSharedGroupIds.add(convGroupId);
+            } else if (!options?.bypassMlsHold && this._shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId)) {
+              this._holdForMls(convGroupId, convId, plaintext, options);
+              sentCount++;
+              continue;
             } else {
               const encrypted = session.ratchet.encrypt(plaintext);
               const transport = encryptedMessageToTransport(encrypted);
@@ -66671,7 +66787,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.30" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.31" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68609,7 +68725,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.31" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -68933,7 +69049,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.31" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69349,11 +69465,13 @@ var init_channel = __esm2({
           let text = plaintext;
           let messageType = "text";
           let topicId = data.topic_id;
+          let mlsAttachment = null;
           try {
             const parsed = JSON.parse(plaintext);
             text = parsed.text ?? plaintext;
             messageType = parsed.type ?? "text";
             topicId = parsed.topicId ?? topicId;
+            if (parsed.attachment) mlsAttachment = parsed.attachment;
           } catch {
           }
           if (messageType === "history_catchup_request") {
@@ -69420,6 +69538,9 @@ var init_channel = __esm2({
               console.log(`[SecureChannel] Session ${convId.slice(0, 8)} activated via MLS message`);
             }
           }
+          if (mlsAttachment) {
+            text = await this._augmentWithAttachment(mlsAttachment, text);
+          }
           const metadata = {
             messageId: data.message_id ?? `mls_${Date.now()}`,
             conversationId: convId ?? this._primaryConversationId,
@@ -69669,6 +69790,65 @@ ${messageText}`;
        * Download an encrypted attachment blob, decrypt it, verify integrity,
        * and save the plaintext file to disk.
        */
+      /** Where an attachment may be written — always directly inside `attachDir` (#1143).
+       *
+       * The filename arrives INSIDE the envelope and is chosen by whoever sent the
+       * message. `join(attachDir, info.filename)` resolves `..` normally, so
+       * `../../agentvault.json` wrote over the device credential store. Only the
+       * final path component is honoured, and anything that is not a usable name
+       * falls back to a fixed one.
+       */
+      _safeAttachmentPath(attachDir, filename) {
+        const raw = String(filename ?? "");
+        const last = raw.split(/[\\/]/).pop() ?? "";
+        const cleaned = last.replace(/\0/g, "").trim();
+        const safe = cleaned === "" || cleaned === "." || cleaned === ".." ? "attachment.bin" : cleaned;
+        return join4(attachDir, safe);
+      }
+      /** Download an attachment and fold it into the text the agent sees (#1139).
+       *
+       * Extracted so the MLS receive path can use it too. It used to live inline in
+       * `_handleIncomingMessage`, which meant attachments worked on the Double
+       * Ratchet path ONLY — and hermes drops DR by design (`secure_channel.py:594`,
+       * "DR fallback is logged-and-dropped"), so no single transport could serve
+       * both client families. That is why an attachment reached ohtani and never
+       * reached smartcoder2 on 2026-08-31.
+       *
+       * Returns the text unchanged when there is no attachment or the fetch fails —
+       * but a failure is LOGGED and announced in the text, never silent.
+       */
+      async _augmentWithAttachment(attachmentInfo, baseText) {
+        if (!attachmentInfo) return baseText;
+        try {
+          const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
+          const mime = String(attachmentInfo.mime ?? "application/octet-stream");
+          const name = String(attachmentInfo.filename ?? "attachment");
+          const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
+          if (textMimes.some((m2) => mime.startsWith(m2))) {
+            const content = new TextDecoder().decode(decrypted);
+            return `[Attachment: ${name} (${mime}) saved to ${filePath}]
+---
+${content}
+---
+
+${baseText}`;
+          }
+          if (mime.startsWith("image/")) {
+            return `[Image attachment: ${name} saved to ${filePath}]
+Use your Read tool to view this image file.
+
+${baseText}`;
+          }
+          return `[Attachment: ${name} saved to ${filePath}]
+
+${baseText}`;
+        } catch (err) {
+          console.error("[SecureChannel] Failed to download attachment:", err);
+          return `[Attachment: ${String(attachmentInfo.filename ?? "file")} was sent but could not be retrieved: ${err}]
+
+${baseText}`;
+        }
+      }
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
         await mkdir3(attachDir, { recursive: true });
@@ -69688,7 +69868,7 @@ ${messageText}`;
         const fileKey = base64ToBytes(info.fileKey);
         const fileNonce = base64ToBytes(info.fileNonce);
         const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
-        const filePath = join4(attachDir, info.filename);
+        const filePath = this._safeAttachmentPath(attachDir, info.filename);
         await writeFile3(filePath, decrypted);
         console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
         return { filePath, decrypted };
@@ -71109,6 +71289,7 @@ ${messageText}`;
               await this._persistState();
             }
             console.log(`[SecureChannel] Joined shared 1:1 MLS group for group ${conversationGroupId.slice(0, 8)} via Welcome (epoch=${mgr.epoch})`);
+            await this._flushMlsHold(conversationGroupId);
             return;
           }
           if (conversationId) {
@@ -99222,7 +99403,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.30" : "0.0.0-dev";
+    VERSION = true ? "0.23.31" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -100148,7 +100329,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.3" : void 0
+      true ? "0.4.4" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -100201,7 +100382,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.3" : void 0
+      true ? "0.4.4" : void 0
     )
   });
   channelRef = channel;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",