@agentvault/grok-bridge 0.4.6 → 0.4.7

package/dist/index.js

@@ -64605,11 +64605,11 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.33" : FALLBACK;
+  const v2 = true ? "0.23.34" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "7b91f2f-dirty" : "";
+  const raw = true ? "6b305ca-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -66807,7 +66807,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.33" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.34" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -68745,7 +68745,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.33" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.34" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -69069,7 +69069,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.33" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.34" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69473,6 +69473,7 @@ var init_channel = __esm2({
         try {
           const cipherBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
           const result = await mgr.decrypt(cipherBytes);
+          if (mgrKey) this._mlsDecryptFailCounts.delete(mgrKey);
           const mlsGroupId = (convGroupId ? this._persisted?.mlsGroups?.[convGroupId]?.mlsGroupId : null) ?? this._persisted?.mlsConversations?.[convId]?.mlsGroupId ?? groupId;
           if (mlsGroupId) {
             await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
@@ -69577,6 +69578,10 @@ var init_channel = __esm2({
             this.config.onMessage(text, metadata);
           }
         } catch (decryptErr) {
+          if (classifyCommitFailure(data.epoch, mgr?.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS 1:1 message at epoch ${String(data.epoch)} predates our epoch ${String(mgr?.epoch)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = mgrKey || `unknown:${groupId}`;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -70418,6 +70423,7 @@ ${baseText}`;
         try {
           const ciphertext = Buffer.from(data.payload, "hex");
           const result = await mlsGroup.decrypt(new Uint8Array(ciphertext));
+          this._mlsDecryptFailCounts.delete(resolvedRoomId);
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
           if (result.isHandshake || !result.plaintext) {
             return;
@@ -70507,6 +70513,10 @@ ${baseText}`;
             console.error("[SecureChannel] onMessage callback error (MLS):", err);
           });
         } catch (err) {
+          if (classifyCommitFailure(data.epoch, mlsGroup.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS room message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup.epoch)} for ${resolvedRoomId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = resolvedRoomId;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -71546,6 +71556,11 @@ ${baseText}`;
                 nackedIds.push(msg.queue_id);
                 if (msg.group_id && (msg.message_type === "commit" || msg.message_type === "application")) {
                   const failKey = msg.conversation_group_id ? `1to1-group:${msg.conversation_group_id}` : `group:${msg.group_id}`;
+                  const localMgr = msg.room_id && this._mlsGroups.get(msg.room_id) || this._mlsGroups.get(failKey);
+                  if (classifyCommitFailure(msg.epoch, localMgr?.epoch) === "already-applied") {
+                    console.debug(`[SecureChannel] Delivery ${msg.message_type} at epoch ${String(msg.epoch)} predates our epoch ${String(localMgr?.epoch)} \u2014 not counting toward recovery`);
+                    continue;
+                  }
                   const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
                   this._mlsDecryptFailCounts.set(failKey, count);
                   if (count >= _SecureChannel.MAX_MLS_DECRYPT_FAILS) {
@@ -72223,6 +72238,7 @@ ${baseText}`;
         try {
           const ciphertext = new Uint8Array(Buffer.from(data.payload, "hex"));
           const result = await mlsGroup.decrypt(ciphertext);
+          this._mlsDecryptFailCounts.delete(`a2a:${a2aChannelId}`);
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
           if (result.isHandshake || !result.plaintext) {
             return;
@@ -72243,6 +72259,10 @@ ${baseText}`;
             this.config.onA2AMessage(a2aMsg);
           }
         } catch (err) {
+          if (classifyCommitFailure(data.epoch, mlsGroup?.epoch) === "already-applied") {
+            console.debug(`[SecureChannel] MLS A2A message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup?.epoch)} for ${a2aChannelId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+            return;
+          }
           const failKey = `a2a:${a2aChannelId}`;
           const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
           this._mlsDecryptFailCounts.set(failKey, count);
@@ -99461,7 +99481,7 @@ var init_index = __esm2({
     await init_skill_telemetry();
     await init_policy_enforcer();
     init_room_protocol();
-    VERSION = true ? "0.23.33" : "0.0.0-dev";
+    VERSION = true ? "0.23.34" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -100387,7 +100407,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.6" : void 0
+      true ? "0.4.7" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -100440,7 +100460,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.6" : void 0
+      true ? "0.4.7" : void 0
     )
   });
   channelRef = channel;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",