@agentvault/grok-bridge 0.4.3 → 0.4.5

package/dist/index.js

@@ -64004,6 +64004,8 @@ var init_mls_group = __esm2({
               continue;
             seenIdentities.push(identity);
             const leaf = this.memberLeafIndex(identity);
+            if (leaf !== null && leaf === this.ownLeafIndex())
+              continue;
             if (leaf !== null)
               leavesToRemove.push(leaf);
           }
@@ -64059,6 +64061,20 @@ var init_mls_group = __esm2({
        * then re-adds it with a fresh KeyPackage so it gets a Welcome at the
        * current epoch it can actually apply.
        */
+      /**
+       * The leaf index THIS manager occupies — the leaf whose private key it holds.
+       *
+       * Read from `privatePath.leafIndex`, which is the same value ts-mls uses to
+       * decide whether a commit removes its own committer, so a caller checking
+       * against this cannot disagree with the library about who "we" are.
+       *
+       * Exists so a fulfiller can tell a request from ANOTHER device apart from one
+       * from itself (#1147) without any "who am I" plumbing: the manager already
+       * knows, and a guard that reads it here cannot be forgotten by a call site.
+       */
+      ownLeafIndex() {
+        return this._requireState().privatePath.leafIndex;
+      }
       memberLeafIndex(identity) {
         const s2 = this._requireState();
         const tree = s2.ratchetTree;
@@ -64589,11 +64605,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.30" : FALLBACK;
+  const v2 = true ? "0.23.32" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "1fff5d6" : "";
+  const raw = true ? "564f8b1-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -66341,6 +66357,118 @@ var init_channel = __esm2({
        * Encrypt and send a message to ALL owner devices (fanout).
        * Each session gets the same plaintext encrypted independently.
        */
+      /**
+       * #952 — sends held because MLS is expected for this conversation but the
+       * group is not joined yet.
+       *
+       * ⚠️ IN MEMORY ONLY. These entries hold PLAINTEXT. `_persisted` is written to
+       * disk, and the product's entire premise is that plaintext does not rest
+       * where it does not have to; a crash losing a held greeting is the correct
+       * trade. This is why the existing `outboundQueue` could not be reused — that
+       * one is persisted, and holds already-DR-encrypted bytes, which is exactly
+       * the encryption we are trying not to perform yet.
+       */
+      _mlsHold = /* @__PURE__ */ new Map();
+      /** How long a send waits for the Welcome. The two measured bursts were each
+       *  confined to a single minute, with the group already existing server-side
+       *  in the same second, so this is generous rather than tight. */
+      static MLS_HOLD_MS = 3e4;
+      /** Bound on held sends per group — see `_holdForMls`. */
+      static MLS_HOLD_MAX = 50;
+      /**
+       * Should this 1:1 send wait for MLS rather than go out over Double Ratchet?
+       *
+       * The discriminator exists at the moment of the bug: `_sessionGroupIds`
+       * already carries the conversation's group id — the server told us the group
+       * exists — while `_mlsGroups` has no usable manager for it. Group expected,
+       * group not ready.
+       *
+       * The negative case is load-bearing. A conversation with NO group id is
+       * legitimately Double Ratchet, and holding it would break owner-to-agent
+       * messaging outright, which is far worse than the bug this fixes. "Present"
+       * is also not "ready": a manager parked at epoch 0 has not joined (#1092),
+       * and reading presence as readiness is how #991 shipped.
+       */
+      _shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId) {
+        if (!convGroupId) return false;
+        const ready = Boolean(mlsGroup?.isInitialized) && Boolean(mlsGroupId) && Number(mlsGroup?.epoch) > 0;
+        return !ready;
+      }
+      /** Park a send until the Welcome lands, or until the hold expires. */
+      _holdForMls(convGroupId, convId, plaintext, options) {
+        let entry = this._mlsHold.get(convGroupId);
+        if (!entry) {
+          const timer = setTimeout(() => {
+            void this._releaseHeldOverDr(convGroupId);
+          }, _SecureChannel.MLS_HOLD_MS);
+          timer.unref?.();
+          entry = { items: [], timer };
+          this._mlsHold.set(convGroupId, entry);
+        }
+        if (entry.items.length >= _SecureChannel.MLS_HOLD_MAX) {
+          entry.items.shift();
+          console.warn(
+            `[SecureChannel] MLS hold full for group ${convGroupId.slice(0, 8)} \u2014 dropped the oldest held message`
+          );
+        }
+        entry.items.push({ convId, plaintext, options });
+        console.log(
+          `[SecureChannel] Holding send for group ${convGroupId.slice(0, 8)} until its Welcome lands (held=${entry.items.length})`
+        );
+      }
+      _takeHold(convGroupId) {
+        const entry = this._mlsHold.get(convGroupId);
+        if (!entry) return null;
+        clearTimeout(entry.timer);
+        this._mlsHold.delete(convGroupId);
+        return entry;
+      }
+      /** Re-drive one held send through the normal path, now that MLS is ready. */
+      async _resendHeld(item) {
+        await this.send(item.plaintext, {
+          ...item.options ?? {},
+          conversationId: item.convId,
+          bypassMlsHold: true
+        });
+      }
+      /** The Welcome landed — release everything held for this group, in order. */
+      async _flushMlsHold(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.log(
+          `[SecureChannel] Welcome landed for group ${convGroupId.slice(0, 8)} \u2014 releasing ${entry.items.length} held message(s) over MLS`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed to send after Welcome:", err);
+          }
+        }
+      }
+      /**
+       * The hold expired. Send over Double Ratchet exactly as before.
+       *
+       * This is deliberately NOT a drop. #853 and #831 are Welcomes that never
+       * arrive; under those an unbounded hold turns a lost minute into an agent
+       * that never speaks again. The hold removes the race — it must not invent a
+       * new failure mode. The warning is the part that is new: today the loss is
+       * silent.
+       */
+      async _releaseHeldOverDr(convGroupId) {
+        const entry = this._takeHold(convGroupId);
+        if (!entry) return;
+        console.warn(
+          `[SecureChannel] No Welcome for group ${convGroupId.slice(0, 8)} within ${_SecureChannel.MLS_HOLD_MS}ms \u2014 releasing ${entry.items.length} message(s) over Double Ratchet. The recipient may not hold a ratchet with this device, in which case they are undeliverable (#952).`
+        );
+        for (const item of entry.items) {
+          try {
+            await this._resendHeld(item);
+          } catch (err) {
+            console.warn("[SecureChannel] Held message failed on Double Ratchet release:", err);
+          }
+        }
+      }
       async send(plaintext, options) {
         if (isAbstention(plaintext)) return;
         if (this._state === "error" || this._state === "idle") {
@@ -66502,6 +66630,10 @@ var init_channel = __esm2({
               );
               addressedMlsGroupIds.push(mlsGroupId);
               if (convGroupId) sentSharedGroupIds.add(convGroupId);
+            } else if (!options?.bypassMlsHold && this._shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId)) {
+              this._holdForMls(convGroupId, convId, plaintext, options);
+              sentCount++;
+              continue;
             } else {
               const encrypted = session.ratchet.encrypt(plaintext);
               const transport = encryptedMessageToTransport(encrypted);
@@ -66671,7 +66803,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.30" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.32" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68609,7 +68741,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.32" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -68933,7 +69065,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.32" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69349,11 +69481,13 @@ var init_channel = __esm2({
           let text = plaintext;
           let messageType = "text";
           let topicId = data.topic_id;
+          let mlsAttachment = null;
           try {
             const parsed = JSON.parse(plaintext);
             text = parsed.text ?? plaintext;
             messageType = parsed.type ?? "text";
             topicId = parsed.topicId ?? topicId;
+            if (parsed.attachment) mlsAttachment = parsed.attachment;
           } catch {
           }
           if (messageType === "history_catchup_request") {
@@ -69420,6 +69554,9 @@ var init_channel = __esm2({
               console.log(`[SecureChannel] Session ${convId.slice(0, 8)} activated via MLS message`);
             }
           }
+          if (mlsAttachment) {
+            text = await this._augmentWithAttachment(mlsAttachment, text);
+          }
           const metadata = {
             messageId: data.message_id ?? `mls_${Date.now()}`,
             conversationId: convId ?? this._primaryConversationId,
@@ -69669,10 +69806,70 @@ ${messageText}`;
        * Download an encrypted attachment blob, decrypt it, verify integrity,
        * and save the plaintext file to disk.
        */
+      /** Where an attachment may be written — always directly inside `attachDir` (#1143).
+       *
+       * The filename arrives INSIDE the envelope and is chosen by whoever sent the
+       * message. `join(attachDir, info.filename)` resolves `..` normally, so
+       * `../../agentvault.json` wrote over the device credential store. Only the
+       * final path component is honoured, and anything that is not a usable name
+       * falls back to a fixed one.
+       */
+      _safeAttachmentPath(attachDir, filename) {
+        const raw = String(filename ?? "");
+        const last = raw.split(/[\\/]/).pop() ?? "";
+        const cleaned = last.replace(/\0/g, "").trim();
+        const safe = cleaned === "" || cleaned === "." || cleaned === ".." ? "attachment.bin" : cleaned;
+        return join4(attachDir, safe);
+      }
+      /** Download an attachment and fold it into the text the agent sees (#1139).
+       *
+       * Extracted so the MLS receive path can use it too. It used to live inline in
+       * `_handleIncomingMessage`, which meant attachments worked on the Double
+       * Ratchet path ONLY — and hermes drops DR by design (`secure_channel.py:594`,
+       * "DR fallback is logged-and-dropped"), so no single transport could serve
+       * both client families. That is why an attachment reached ohtani and never
+       * reached smartcoder2 on 2026-08-31.
+       *
+       * Returns the text unchanged when there is no attachment or the fetch fails —
+       * but a failure is LOGGED and announced in the text, never silent.
+       */
+      async _augmentWithAttachment(attachmentInfo, baseText) {
+        if (!attachmentInfo) return baseText;
+        try {
+          const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
+          const mime = String(attachmentInfo.mime ?? "application/octet-stream");
+          const name = String(attachmentInfo.filename ?? "attachment");
+          const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
+          if (textMimes.some((m2) => mime.startsWith(m2))) {
+            const content = new TextDecoder().decode(decrypted);
+            return `[Attachment: ${name} (${mime}) saved to ${filePath}]
+---
+${content}
+---
+
+${baseText}`;
+          }
+          if (mime.startsWith("image/")) {
+            return `[Image attachment: ${name} saved to ${filePath}]
+Use your Read tool to view this image file.
+
+${baseText}`;
+          }
+          return `[Attachment: ${name} saved to ${filePath}]
+
+${baseText}`;
+        } catch (err) {
+          console.error("[SecureChannel] Failed to download attachment:", err);
+          return `[Attachment: ${String(attachmentInfo.filename ?? "file")} was sent but could not be retrieved: ${err}]
+
+${baseText}`;
+        }
+      }
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
         await mkdir3(attachDir, { recursive: true });
-        const url22 = `${this.config.apiUrl}${info.blobUrl}`;
+        const sep2 = info.blobUrl.includes("?") ? "&" : "?";
+        const url22 = `${this.config.apiUrl}${info.blobUrl}${sep2}device_id=${encodeURIComponent(this._deviceId ?? "")}`;
         const res = await fetch(url22, {
           headers: { Authorization: `Bearer ${this._deviceJwt}` }
         });
@@ -69688,7 +69885,7 @@ ${messageText}`;
         const fileKey = base64ToBytes(info.fileKey);
         const fileNonce = base64ToBytes(info.fileNonce);
         const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
-        const filePath = join4(attachDir, info.filename);
+        const filePath = this._safeAttachmentPath(attachDir, info.filename);
         await writeFile3(filePath, decrypted);
         console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
         return { filePath, decrypted };
@@ -70224,10 +70421,12 @@ ${messageText}`;
           const rawPlaintext = new TextDecoder().decode(result.plaintext);
           let messageText;
           let messageType;
+          let roomAttachment = null;
           try {
             const parsed = JSON.parse(rawPlaintext);
             messageType = parsed.type || "message";
             messageText = parsed.text || rawPlaintext;
+            if (parsed.attachment) roomAttachment = parsed.attachment;
           } catch {
             messageType = "message";
             messageText = rawPlaintext;
@@ -70267,6 +70466,9 @@ ${messageText}`;
               await this._refreshRoomRoster(resolvedRoomId);
             }
           }
+          if (roomAttachment) {
+            messageText = await this._augmentWithAttachment(roomAttachment, messageText);
+          }
           const roomMembers = this._persisted?.rooms?.[resolvedRoomId]?.members ?? [];
           const senderMember = roomMembers.find((m2) => m2.deviceId === senderDeviceId);
           const senderIsAgent = senderMember?.entityType === "agent";
@@ -71109,6 +71311,7 @@ ${messageText}`;
               await this._persistState();
             }
             console.log(`[SecureChannel] Joined shared 1:1 MLS group for group ${conversationGroupId.slice(0, 8)} via Welcome (epoch=${mgr.epoch})`);
+            await this._flushMlsHold(conversationGroupId);
             return;
           }
           if (conversationId) {
@@ -99222,7 +99425,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.30" : "0.0.0-dev";
+    VERSION = true ? "0.23.32" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -100148,7 +100351,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.3" : void 0
+      true ? "0.4.5" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -100201,7 +100404,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.3" : void 0
+      true ? "0.4.5" : void 0
     )
   });
   channelRef = channel;

package/dist/service/install-on-ready.d.ts

@@ -0,0 +1,57 @@
+import { type BridgeConfig } from "../config.js";
+import type { ReapResult } from "../reap.js";
+import { type ServiceBackend } from "./backend.js";
+export interface InstallOnReadyDeps {
+    entrypoint: string;
+    env: NodeJS.ProcessEnv;
+    backend?: ServiceBackend;
+    hasCreds?: (dataDir: string) => boolean;
+    /** Contents of the installed launcher, or undefined when none is installed. */
+    readLauncher?: (path: string) => string | undefined;
+    fenceAuthExists?: (fenceHome: string) => boolean;
+    /** Resolves when no turn is in flight (GrokSession.idle). See rule 2. */
+    waitForIdle?: () => Promise<void>;
+    /** Bound on that wait. The terminal coming back is the product promise, so a
+     *  wedged turn must never hold the customer's shell open. */
+    idleTimeoutMs?: number;
+    /** The ONE teardown (src/reap.ts). Must complete before launchctl runs. */
+    reap: () => Promise<ReapResult>;
+    exit: (code: number) => void;
+    log: (msg: string) => void;
+}
+interface ReadyChannel {
+    on(ev: "ready", cb: () => void): unknown;
+}
+/**
+ * One-paste install: enrol in the foreground, hand off to the supervisor, exit —
+ * so the customer's terminal comes back and the agent survives a reboot.
+ *
+ * Four rules this module exists to enforce.
+ *
+ * 1. REFUSE BEFORE REAPING. Everything that can say no does so before anything is
+ *    torn down. Refusing afterwards leaves the customer with an approved device,
+ *    a spent invite token, and no running process — strictly worse than never
+ *    having guarded at all.
+ *
+ * 2. REAP COMPLETELY, THEN BOOTSTRAP. `LaunchdBackend.install` runs bootout →
+ *    poll-until-gone → bootstrap → kickstart synchronously, so the service is
+ *    live the instant install returns. A partial teardown means two ACP sessions
+ *    and two WebSockets on one device. `reap()` reports failure rather than
+ *    swallowing it, and a failed reap is a refusal.
+ *
+ * 3. COMPARE, DON'T DETECT. `status().loaded` means only that a plist with this
+ *    label exists. The old `install` subcommand never guarded its entrypoint
+ *    (subcommand.ts), so a customer can hold a LOADED plist baked against a
+ *    pruned npx cache; restarting that repairs nothing and reports success.
+ *    Restart only when a service is loaded AND its baked entrypoint is the one we
+ *    would install. Compare the ENTRYPOINT, never the whole launcher script —
+ *    that embeds the install-time PATH and is volatile across shells.
+ *
+ * 4. VERIFY BEFORE CLAIMING. `backend.install` returns void, and launchd's
+ *    implementation runs `kickstart` regardless of every `bootstrap` exit code.
+ *    This log line is the customer's only feedback, so it comes after a
+ *    `status()` that returned loaded:true.
+ */
+export declare function installOnReady(channel: ReadyChannel, cfg: BridgeConfig, deps: InstallOnReadyDeps): void;
+export {};
+//# sourceMappingURL=install-on-ready.d.ts.map

package/dist/service/install-on-ready.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-on-ready.d.ts","sourceRoot":"","sources":["../../src/service/install-on-ready.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAMD,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,kBAAkB,GACvB,IAAI,CAgHN"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",