@agentvault/grok-bridge 0.4.4 → 0.4.6

package/dist/index.js

@@ -64004,6 +64004,8 @@ var init_mls_group = __esm2({
               continue;
             seenIdentities.push(identity);
             const leaf = this.memberLeafIndex(identity);
+            if (leaf !== null && leaf === this.ownLeafIndex())
+              continue;
             if (leaf !== null)
               leavesToRemove.push(leaf);
           }
@@ -64059,6 +64061,20 @@ var init_mls_group = __esm2({
        * then re-adds it with a fresh KeyPackage so it gets a Welcome at the
        * current epoch it can actually apply.
        */
+      /**
+       * The leaf index THIS manager occupies — the leaf whose private key it holds.
+       *
+       * Read from `privatePath.leafIndex`, which is the same value ts-mls uses to
+       * decide whether a commit removes its own committer, so a caller checking
+       * against this cannot disagree with the library about who "we" are.
+       *
+       * Exists so a fulfiller can tell a request from ANOTHER device apart from one
+       * from itself (#1147) without any "who am I" plumbing: the manager already
+       * knows, and a guard that reads it here cannot be forgotten by a call site.
+       */
+      ownLeafIndex() {
+        return this._requireState().privatePath.leafIndex;
+      }
       memberLeafIndex(identity) {
         const s2 = this._requireState();
         const tree = s2.ratchetTree;
@@ -64589,11 +64605,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.31" : FALLBACK;
+  const v2 = true ? "0.23.33" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "3e1243a-dirty" : "";
+  const raw = true ? "7b91f2f-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -65508,6 +65524,7 @@ var OUTBOUND_DEDUPE_MAX;
 var OUTBOUND_DEDUPE_TYPES;
 var RETRY_CANDIDATE_TTL_MS;
 var RETRY_CANDIDATE_MAX;
+var ROOM_FULFIL_COOLDOWN_MS;
 var SecureChannel;
 var init_channel = __esm2({
   async "src/channel.ts"() {
@@ -65553,6 +65570,7 @@ var init_channel = __esm2({
     OUTBOUND_DEDUPE_TYPES = /* @__PURE__ */ new Set(["text", "status_alert", "artifact", "attachment"]);
     RETRY_CANDIDATE_TTL_MS = 6e4;
     RETRY_CANDIDATE_MAX = 32;
+    ROOM_FULFIL_COOLDOWN_MS = 6e4;
     SecureChannel = class _SecureChannel extends EventEmitter {
       constructor(config2) {
         super();
@@ -65622,6 +65640,8 @@ var init_channel = __esm2({
       _drDeliveryPulling = false;
       /** MLS group managers per room/conversation (roomId or conv:conversationId or 1to1-group:groupId -> MLSGroupManager) */
       _mlsGroups = /* @__PURE__ */ new Map();
+      /** `${mlsGroupId}:${deviceId}` -> last re-admit ms (#1171). */
+      _roomFulfilCooldown = /* @__PURE__ */ new Map();
       /** Maps conversationId -> conversation_group_id for shared 1:1 MLS groups */
       _sessionGroupIds = /* @__PURE__ */ new Map();
       /** Consecutive MLS decrypt failure count per group key for epoch recovery. */
@@ -66787,7 +66807,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.31" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.33" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68725,7 +68745,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.31" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.33" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -69049,7 +69069,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.31" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.33" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69852,7 +69872,8 @@ ${baseText}`;
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
         await mkdir3(attachDir, { recursive: true });
-        const url22 = `${this.config.apiUrl}${info.blobUrl}`;
+        const sep2 = info.blobUrl.includes("?") ? "&" : "?";
+        const url22 = `${this.config.apiUrl}${info.blobUrl}${sep2}device_id=${encodeURIComponent(this._deviceId ?? "")}`;
         const res = await fetch(url22, {
           headers: { Authorization: `Bearer ${this._deviceJwt}` }
         });
@@ -70404,10 +70425,12 @@ ${baseText}`;
           const rawPlaintext = new TextDecoder().decode(result.plaintext);
           let messageText;
           let messageType;
+          let roomAttachment = null;
           try {
             const parsed = JSON.parse(rawPlaintext);
             messageType = parsed.type || "message";
             messageText = parsed.text || rawPlaintext;
+            if (parsed.attachment) roomAttachment = parsed.attachment;
           } catch {
             messageType = "message";
             messageText = rawPlaintext;
@@ -70447,6 +70470,9 @@ ${baseText}`;
               await this._refreshRoomRoster(resolvedRoomId);
             }
           }
+          if (roomAttachment) {
+            messageText = await this._augmentWithAttachment(roomAttachment, messageText);
+          }
           const roomMembers = this._persisted?.rooms?.[resolvedRoomId]?.members ?? [];
           const senderMember = roomMembers.find((m2) => m2.deviceId === senderDeviceId);
           const senderIsAgent = senderMember?.entityType === "agent";
@@ -70732,13 +70758,7 @@ ${baseText}`;
         console.warn(`[SecureChannel] MLS epoch recovery for ${groupKey} (${mlsGroupId.slice(0, 8)})`);
         this._mlsGroups.delete(groupKey);
         this._mlsDecryptFailCounts.delete(groupKey);
-        try {
-          const { unlink: unlink2 } = await import("fs/promises");
-          const path2 = `${this.config.dataDir}/.mls-state/${mlsGroupId}.json`;
-          await unlink2(path2).catch(() => {
-          });
-        } catch {
-        }
+        await deleteMlsState(this.config.dataDir, mlsGroupId);
         try {
           const mgr = new MLSGroupManager();
           const identity = new TextEncoder().encode(this._deviceId);
@@ -70813,19 +70833,26 @@ ${baseText}`;
           return 0;
         }
         const snapshot = mlsGroup.exportState();
-        const { commit, welcome } = await mlsGroup.addMembers(targets.map((t2) => t2.keyPackage));
-        const commitSent = await this._sendFrameConfirmed(
-          {
-            event: "mls_commit",
-            data: {
-              group_id: mlsGroupId,
-              epoch: Number(mlsGroup.epoch),
-              payload: Buffer.from(commit).toString("hex")
-            }
-          },
-          `${label} commit`
-        );
-        if (!commitSent) {
+        const { commits, welcome } = await mlsGroup.reAdmitMembers(targets.map((t2) => t2.keyPackage));
+        let sentCommits = 0;
+        for (const c2 of commits) {
+          const ok = await this._sendFrameConfirmed(
+            {
+              event: "mls_commit",
+              data: {
+                group_id: mlsGroupId,
+                // The epoch this commit PRODUCED. After two commits the manager
+                // only knows the last one, which is why the result carries them.
+                epoch: Number(c2.epoch),
+                payload: Buffer.from(c2.commit).toString("hex")
+              }
+            },
+            `${label} commit ${sentCommits + 1}/${commits.length}`
+          );
+          if (!ok) break;
+          sentCommits++;
+        }
+        if (sentCommits === 0) {
           mlsGroup.importState(snapshot);
           console.warn(
             `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
@@ -70833,6 +70860,12 @@ ${baseText}`;
           return 0;
         }
         await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+        if (sentCommits < commits.length) {
+          console.warn(
+            `[SecureChannel] ${label}: only ${sentCommits}/${commits.length} commits reached the wire \u2014 requests stay PENDING for the next pull`
+          );
+          return 0;
+        }
         if (!welcome) {
           console.warn(
             `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
@@ -71561,38 +71594,63 @@ ${baseText}`;
                 { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
               );
               if (!pendingRes.ok) continue;
-              const pending = await pendingRes.json();
+              let pending = await pendingRes.json();
               if (pending.length === 0) continue;
               console.log(`[SecureChannel] ${pending.length} pending Welcome requests for room ${roomId.slice(0, 8)}`);
+              const nowMs = Date.now();
+              const fresh = pending.filter((r2) => {
+                const key = `${roomState.mlsGroupId}:${r2.requesting_device_id}`;
+                const last = this._roomFulfilCooldown.get(key) ?? 0;
+                if (nowMs - last < ROOM_FULFIL_COOLDOWN_MS) {
+                  console.log(
+                    `[SecureChannel] skipping ${r2.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)} \u2014 re-admitted ${Math.round((nowMs - last) / 1e3)}s ago`
+                  );
+                  return false;
+                }
+                return true;
+              });
+              if (fresh.length === 0) continue;
+              for (const r2 of fresh) {
+                this._roomFulfilCooldown.set(`${roomState.mlsGroupId}:${r2.requesting_device_id}`, nowMs);
+              }
+              pending = fresh;
+              const deviceIds = pending.map((r2) => r2.requesting_device_id);
+              const kpRes = await fetch(
+                `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${deviceIds.join(",")}`,
+                { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+              );
+              if (!kpRes.ok) continue;
+              const kpData = await kpRes.json();
+              const roomTargets = [];
               for (const req of pending) {
-                try {
-                  const kpRes = await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/key-packages/batch?device_ids=${req.requesting_device_id}`,
-                    { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                const kpHex = kpData[req.requesting_device_id];
+                if (!kpHex) {
+                  console.warn(`[SecureChannel] No KeyPackage for ${req.requesting_device_id.slice(0, 8)}, skipping`);
+                  continue;
+                }
+                const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
+                roomTargets.push({
+                  requestId: req.id,
+                  deviceId: req.requesting_device_id,
+                  keyPackage: MLSGroupManager.deserializeKeyPackage(kpBytes)
+                });
+              }
+              if (roomTargets.length === 0) continue;
+              try {
+                const done = await this._fulfilWelcomeRequests({
+                  mlsGroup,
+                  mlsGroupId: roomState.mlsGroupId,
+                  label: `room ${roomId.slice(0, 8)}`,
+                  welcomeFields: { room_id: roomId },
+                  targets: roomTargets
+                });
+                if (done > 0) {
+                  console.log(
+                    `[SecureChannel] Batched Welcome for ${done}/${roomTargets.length} device(s) in room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`
                   );
-                  if (!kpRes.ok) continue;
-                  const kpData = await kpRes.json();
-                  const kpHex = kpData[req.requesting_device_id];
-                  if (!kpHex) continue;
-                  const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
-                  const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const done = await this._fulfilWelcomeRequests({
-                    mlsGroup,
-                    mlsGroupId: roomState.mlsGroupId,
-                    label: `room ${roomId.slice(0, 8)}`,
-                    welcomeFields: { room_id: roomId },
-                    targets: [{
-                      requestId: req.id,
-                      deviceId: req.requesting_device_id,
-                      keyPackage: memberKp
-                    }]
-                  });
-                  if (done > 0) {
-                    console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
-                  }
-                } catch (fulfillErr) {
-                  console.warn(`[SecureChannel] Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                 }
+              } catch (fulfillErr) {
+                console.warn(`[SecureChannel] Batched Welcome failed for room ${roomId.slice(0, 8)}:`, fulfillErr);
               }
             } catch {
             }
@@ -99403,7 +99461,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.31" : "0.0.0-dev";
+    VERSION = true ? "0.23.33" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -100329,7 +100387,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.4" : void 0
+      true ? "0.4.6" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -100382,7 +100440,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.4" : void 0
+      true ? "0.4.6" : void 0
     )
   });
   channelRef = channel;

package/dist/service/install-on-ready.d.ts

@@ -0,0 +1,57 @@
+import { type BridgeConfig } from "../config.js";
+import type { ReapResult } from "../reap.js";
+import { type ServiceBackend } from "./backend.js";
+export interface InstallOnReadyDeps {
+    entrypoint: string;
+    env: NodeJS.ProcessEnv;
+    backend?: ServiceBackend;
+    hasCreds?: (dataDir: string) => boolean;
+    /** Contents of the installed launcher, or undefined when none is installed. */
+    readLauncher?: (path: string) => string | undefined;
+    fenceAuthExists?: (fenceHome: string) => boolean;
+    /** Resolves when no turn is in flight (GrokSession.idle). See rule 2. */
+    waitForIdle?: () => Promise<void>;
+    /** Bound on that wait. The terminal coming back is the product promise, so a
+     *  wedged turn must never hold the customer's shell open. */
+    idleTimeoutMs?: number;
+    /** The ONE teardown (src/reap.ts). Must complete before launchctl runs. */
+    reap: () => Promise<ReapResult>;
+    exit: (code: number) => void;
+    log: (msg: string) => void;
+}
+interface ReadyChannel {
+    on(ev: "ready", cb: () => void): unknown;
+}
+/**
+ * One-paste install: enrol in the foreground, hand off to the supervisor, exit —
+ * so the customer's terminal comes back and the agent survives a reboot.
+ *
+ * Four rules this module exists to enforce.
+ *
+ * 1. REFUSE BEFORE REAPING. Everything that can say no does so before anything is
+ *    torn down. Refusing afterwards leaves the customer with an approved device,
+ *    a spent invite token, and no running process — strictly worse than never
+ *    having guarded at all.
+ *
+ * 2. REAP COMPLETELY, THEN BOOTSTRAP. `LaunchdBackend.install` runs bootout →
+ *    poll-until-gone → bootstrap → kickstart synchronously, so the service is
+ *    live the instant install returns. A partial teardown means two ACP sessions
+ *    and two WebSockets on one device. `reap()` reports failure rather than
+ *    swallowing it, and a failed reap is a refusal.
+ *
+ * 3. COMPARE, DON'T DETECT. `status().loaded` means only that a plist with this
+ *    label exists. The old `install` subcommand never guarded its entrypoint
+ *    (subcommand.ts), so a customer can hold a LOADED plist baked against a
+ *    pruned npx cache; restarting that repairs nothing and reports success.
+ *    Restart only when a service is loaded AND its baked entrypoint is the one we
+ *    would install. Compare the ENTRYPOINT, never the whole launcher script —
+ *    that embeds the install-time PATH and is volatile across shells.
+ *
+ * 4. VERIFY BEFORE CLAIMING. `backend.install` returns void, and launchd's
+ *    implementation runs `kickstart` regardless of every `bootstrap` exit code.
+ *    This log line is the customer's only feedback, so it comes after a
+ *    `status()` that returned loaded:true.
+ */
+export declare function installOnReady(channel: ReadyChannel, cfg: BridgeConfig, deps: InstallOnReadyDeps): void;
+export {};
+//# sourceMappingURL=install-on-ready.d.ts.map

package/dist/service/install-on-ready.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-on-ready.d.ts","sourceRoot":"","sources":["../../src/service/install-on-ready.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAMD,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,kBAAkB,GACvB,IAAI,CAgHN"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",