@agentvault/muse-bridge 0.1.10 → 0.1.12

package/dist/index.js

@@ -6149,7 +6149,10 @@ async function applyProposals(state, proposals, committerLeafIndex, pskSearch, s
     const [mutatedTree, addedLeafNodes] = await applyTreeMutations(state.ratchetTree, grouped, state.groupContext, sentByClient, state.clientConfig.authService, state.clientConfig.lifetimeConfig, cs.signature);
     const [updatedPskSecret, pskIds] = await accumulatePskSecret(grouped.psk.map((p2) => p2.proposal.psk.preSharedKeyId), pskSearch, cs, zeroes);
     const selfRemoved = mutatedTree[leafToNodeIndex(toLeafIndex(state.privatePath.leafIndex))] === void 0;
-    const needsUpdatePath = allProposals.length === 0 || Object.values(grouped.update).length > 1 || Object.values(grouped.remove).length > 1;
+    const needsUpdatePath = allProposals.length === 0 || allProposals.some(({ proposal }) => {
+      const t2 = proposal.proposalType;
+      return t2 !== "add" && t2 !== "psk" && t2 !== "reinit";
+    });
     return {
       tree: mutatedTree,
       pskSecret: updatedPskSecret,
@@ -11460,11 +11463,11 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.35" : FALLBACK;
+  const v2 = true ? "0.23.37" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "bcb9297-dirty" : "";
+  const raw = true ? "58c552f-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -70162,7 +70165,7 @@ var init_dist = __esm({
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.35" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.37" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -72100,7 +72103,7 @@ var init_dist = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.35" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.37" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -72424,7 +72427,7 @@ var init_dist = __esm({
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.35" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.37" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -74198,6 +74201,7 @@ ${baseText}`;
               return 0;
             }
             const snapshot = mlsGroup.exportState();
+            let parent2 = await this._readGroupHeadDigest(mlsGroupId);
             const { commits, welcome } = await mlsGroup.reAdmitMembers(targets.map((t2) => t2.keyPackage));
             let sentCommits = 0;
             for (const c2 of commits) {
@@ -74209,12 +74213,14 @@ ${baseText}`;
                     // The epoch this commit PRODUCED. After two commits the manager
                     // only knows the last one, which is why the result carries them.
                     epoch: Number(c2.epoch),
-                    payload: Buffer.from(c2.commit).toString("hex")
+                    payload: Buffer.from(c2.commit).toString("hex"),
+                    ...parent2 ? { parent_digest: parent2 } : {}
                   }
                 },
                 `${label} commit ${sentCommits + 1}/${commits.length}`
               );
               if (!ok) break;
+              parent2 = this._commitDigest(c2.commit);
               sentCommits++;
             }
             if (sentCommits === 0) {
@@ -74301,6 +74307,32 @@ ${baseText}`;
           _wsIsOpen() {
             return this._ws?.readyState === 1;
           }
+          /** SHA-256 hex of a commit's bytes — its identity on the server (#1175/#1177). */
+          _commitDigest(bytes) {
+            return createHash("sha256").update(bytes).digest("hex");
+          }
+          /**
+           * #1177: the digest of the commit at the server's head, or undefined.
+           *
+           * Undefined covers "no head yet", "older backend", AND "could not read" —
+           * deliberately the same value. The commit is sent either way: the server
+           * skips the parent check for an ABSENT field and refuses a MALFORMED one,
+           * so a read failure must degrade to "unchecked", never to "blocked" (a
+           * rescue that cannot run is the 2026-09-04 lockout) and never to `null`.
+           */
+          async _readGroupHeadDigest(groupId) {
+            try {
+              const res = await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${groupId}`, {
+                headers: { Authorization: `Bearer ${this._deviceJwt}` }
+              });
+              if (!res.ok) return void 0;
+              const head = await res.json();
+              const d2 = head?.last_commit_digest;
+              return typeof d2 === "string" && /^[0-9a-f]{64}$/.test(d2) ? d2 : void 0;
+            } catch {
+              return void 0;
+            }
+          }
           /**
            * #1015: write one frame and report whether the socket took it.
            *
@@ -75197,6 +75229,7 @@ ${baseText}`;
                       const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                       const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
                       console.log(`[SecureChannel] A2A addMembers for ${req.requesting_device_id.slice(0, 8)} group=${chState.mlsGroupId.slice(0, 8)} epoch=${mlsGroup.epoch}`);
+                      let parentDigest = await this._readGroupHeadDigest(chState.mlsGroupId);
                       let commit;
                       let welcome;
                       try {
@@ -75227,12 +75260,14 @@ ${baseText}`;
                                     group_id: chState.mlsGroupId,
                                     device_id: this._deviceId,
                                     commit: Buffer.from(removeResult.commit).toString("hex"),
-                                    commit_epoch: Number(mlsGroup.epoch)
+                                    commit_epoch: Number(mlsGroup.epoch),
+                                    ...parentDigest ? { parent_digest: parentDigest } : {}
                                   })
                                 }
                               );
                               if (removeResp.ok) {
                                 removeCommitPublished = true;
+                                parentDigest = this._commitDigest(removeResult.commit);
                               } else {
                                 const detail = await removeResp.text().catch(() => "");
                                 console.warn(`[SecureChannel] A2A remove-commit distribute failed (${removeResp.status}): ${detail}`);
@@ -75300,7 +75335,8 @@ ${baseText}`;
                               commit: commitHex,
                               commit_epoch: Number(mlsGroup.epoch),
                               welcomes: [{ target_device_id: req.requesting_device_id, payload: welcomeHex }],
-                              member_device_ids: updatedMembers
+                              member_device_ids: updatedMembers,
+                              ...parentDigest ? { parent_digest: parentDigest } : {}
                             })
                           }
                         );
@@ -75317,7 +75353,12 @@ ${baseText}`;
                         const a2aLabel = `A2A ${chId.slice(0, 8)}`;
                         const commitSent = await this._sendFrameConfirmed({
                           event: "mls_commit",
-                          data: { group_id: chState.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: commitHex }
+                          data: {
+                            group_id: chState.mlsGroupId,
+                            epoch: Number(mlsGroup.epoch),
+                            payload: commitHex,
+                            ...parentDigest ? { parent_digest: parentDigest } : {}
+                          }
                         }, `${a2aLabel} commit`);
                         const welcomeSent = commitSent && await this._sendFrameConfirmed({
                           event: "mls_welcome",
@@ -97789,7 +97830,7 @@ data:
         await init_skill_telemetry();
         await init_policy_enforcer();
         init_room_protocol();
-        VERSION = true ? "0.23.35" : "0.0.0-dev";
+        VERSION = true ? "0.23.37" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -99165,7 +99206,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.10" : void 0;
+  return true ? "0.1.12" : void 0;
 }
 function helpText(version2) {
   return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/muse-bridge",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "type": "module",
   "description": "AgentVault Muse Bridge — daemon bridging a Muse agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",