@agentvault/muse-bridge 0.1.32 → 0.1.34

package/dist/bridge.d.ts

@@ -92,6 +92,22 @@ export interface ReplyChannel {
         groupId?: string;
     }): Promise<T>;
 }
+/**
+ * "Recent problems" (2026-10-26): every say delivery is one
+ * `ai.agent.tool.invoke` span (tool `say`) on the channel's existing telemetry
+ * pipe. Only the outcome, a machine error code, the duration and the
+ * conversation it answers — never the text or the error message. Never throws.
+ */
+/**
+ * #1467: a Muse turn failed. One `ai.agent.tool.invoke` error span (tool
+ * `model_turn`): `model_rate_limited` when Meta answered 429, else
+ * `model_error`. No conversation and no text. Never throws.
+ */
+export declare function reportTurnFailure(channel: {
+    telemetry?: ToolSpanSink | null;
+} | undefined, failure: {
+    upstreamStatus?: number;
+}): void;
 export declare class ActiveTarget {
     private target;
     setRoom(roomId: string): void;

package/dist/index.js

@@ -11799,11 +11799,11 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.60" : FALLBACK;
+  const v2 = true ? "0.23.61" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "9599d8e" : "";
+  const raw = true ? "129e537" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -12658,6 +12658,10 @@ function buildToolInvokeSpan(report) {
     "tool.duration_ms": durationMs
   };
   if (isError) attributes["tool.error_kind"] = safeErrorKind(report.errorKind);
+  const resets = report.limitResetsAt;
+  if (attributes["tool.error_kind"] === "plan_limit_reached" && typeof resets === "number" && Number.isInteger(resets) && resets > 0 && resets < 1e11) {
+    attributes["av.limit_resets_at"] = resets;
+  }
   if (kind !== "unknown" && typeof conv.id === "string" && conv.id) {
     attributes["av.conversation_id"] = conv.id.slice(0, 64);
   }
@@ -71487,6 +71491,11 @@ var init_dist = __esm({
           "ambiguous_target",
           "no_receipt",
           "invalid_request",
+          // #1467: the owner's own AI plan refused the turn (a bridge on a subscription).
+          "plan_limit_reached",
+          // #1467: a Muse turn failed — Meta answered 429, or anything else.
+          "model_rate_limited",
+          "model_error",
           UNCLASSIFIED_ERROR
         ];
         KNOWN_CODES = new Set(KNOWN_TOOL_ERROR_CODES);
@@ -71698,6 +71707,17 @@ var init_dist = __esm({
            *  self-heal rather than be logged and dropped. */
           _mlsCommitFailCounts = /* @__PURE__ */ new Map();
           static MAX_MLS_DECRYPT_FAILS = 3;
+          /**
+           * #1518: ids of MLS application frames this process has already decrypted
+           * (server-assigned `mls_messages.id`, the same on the live delivery pull and
+           * on a `/sync` / reconnect replay). A replayed frame cannot be decrypted a
+           * second time — forward secrecy deleted its key — so without this every
+           * reconnect after a backend deploy fed already-read messages into the
+           * decrypt-failure counter and re-admitted the agent (+2 epochs). Insertion
+           * ordered; the oldest ids fall out past DECRYPTED_ID_CAP.
+           */
+          _decryptedMessageIds = /* @__PURE__ */ new Map();
+          static DECRYPTED_ID_CAP = 5e3;
           /**
            * #1084: consecutive resyncs that found NOTHING to apply, per group.
            *
@@ -73903,7 +73923,7 @@ ${text}`,
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.60" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.61" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -76113,7 +76133,7 @@ ${text}`,
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.60" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.61" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -76445,7 +76465,7 @@ ${text}`,
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.60" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.61" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -76881,9 +76901,14 @@ ${text}`,
               if (groupId) void this._requestWelcomeSelfHeal(groupId);
               return;
             }
+            if (this._alreadyDecrypted(data.message_id)) {
+              console.debug(`[SecureChannel] MLS 1:1 frame ${String(data.message_id).slice(0, 8)} already read \u2014 replay skipped`);
+              return;
+            }
             try {
               const cipherBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
               const result = await mgr.decrypt(cipherBytes);
+              this._rememberDecrypted(data.message_id);
               if (mgrKey) this._mlsDecryptFailCounts.delete(mgrKey);
               const mlsGroupId = (convGroupId ? this._persisted?.mlsGroups?.[convGroupId]?.mlsGroupId : null) ?? this._persisted?.mlsConversations?.[convId]?.mlsGroupId ?? groupId;
               if (mlsGroupId) {
@@ -77906,9 +77931,14 @@ ${baseText}`;
               }
               return;
             }
+            if (this._alreadyDecrypted(data.message_id)) {
+              console.debug(`[SecureChannel] MLS room frame ${String(data.message_id).slice(0, 8)} already read \u2014 replay skipped`);
+              return;
+            }
             try {
               const ciphertext = Buffer.from(data.payload, "hex");
               const result = await mlsGroup.decrypt(new Uint8Array(ciphertext));
+              this._rememberDecrypted(data.message_id);
               this._mlsDecryptFailCounts.delete(resolvedRoomId);
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
               if (result.isHandshake || !result.plaintext) {
@@ -79086,16 +79116,57 @@ ${baseText}`;
             }
             return await mlsGroup.encrypt(plaintextBytes);
           }
+          /** #1518: is the server answering at all? Bounded; any failure is "no". */
+          async _serverReachable() {
+            try {
+              const res = await fetch(`${this.config.apiUrl}/health`, { signal: AbortSignal.timeout(5e3) });
+              return res.ok;
+            } catch {
+              return false;
+            }
+          }
+          /** #1518: the server is down — don't re-key (that needs the same server).
+           *  Clear the run so the next failures ask again. Reported as handled. */
+          _deferResync(groupKey, groupId, why) {
+            this._mlsDecryptFailCounts.delete(groupKey);
+            console.warn(
+              `[SecureChannel] Resync for ${groupId.slice(0, 8)}: server unreachable (${why}) \u2014 NOT re-keying; will retry (#1518)`
+            );
+            return true;
+          }
+          /** #1518: has this process already decrypted the frame with this id? */
+          _alreadyDecrypted(messageId) {
+            return typeof messageId === "string" && messageId !== "" && this._decryptedMessageIds.has(messageId);
+          }
+          /** #1518: remember a decrypted frame's id (bounded; oldest dropped). */
+          _rememberDecrypted(messageId) {
+            if (typeof messageId !== "string" || messageId === "") return;
+            this._decryptedMessageIds.set(messageId, true);
+            if (this._decryptedMessageIds.size > _SecureChannel.DECRYPTED_ID_CAP) {
+              const oldest = this._decryptedMessageIds.keys().next().value;
+              if (oldest !== void 0) this._decryptedMessageIds.delete(oldest);
+            }
+          }
           async _resyncOnDivergence(groupKey, groupId) {
             const mgr = this._mlsGroups.get(groupKey);
             if (!mgr?.isInitialized) return false;
             const fromEpoch = Number(mgr.epoch);
             try {
-              const res = await fetch(
-                `${this.config.apiUrl}/api/v1/mls/groups/${groupId}/sync?last_epoch=${fromEpoch}`,
-                { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-              );
+              let res;
+              try {
+                res = await fetch(
+                  `${this.config.apiUrl}/api/v1/mls/groups/${groupId}/sync?last_epoch=${fromEpoch}`,
+                  { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                );
+              } catch (netErr) {
+                if (!await this._serverReachable()) return this._deferResync(groupKey, groupId, String(netErr));
+                console.warn(`[SecureChannel] Resync-on-divergence failed for ${groupId.slice(0, 8)}:`, netErr);
+                return false;
+              }
               if (!res.ok) {
+                if ((res.status >= 500 || res.status === 429) && !await this._serverReachable()) {
+                  return this._deferResync(groupKey, groupId, `HTTP ${res.status}`);
+                }
                 console.warn(`[SecureChannel] Resync /sync failed for ${groupId.slice(0, 8)}: ${res.status}`);
                 return false;
               }
@@ -80210,9 +80281,14 @@ ${baseText}`;
               console.warn(`[SecureChannel] MLS group not loaded for A2A ${a2aChannelId.slice(0, 8)}`);
               return;
             }
+            if (this._alreadyDecrypted(data.message_id)) {
+              console.debug(`[SecureChannel] MLS A2A frame ${String(data.message_id).slice(0, 8)} already read \u2014 replay skipped`);
+              return;
+            }
             try {
               const ciphertext = new Uint8Array(Buffer.from(data.payload, "hex"));
               const result = await mlsGroup.decrypt(ciphertext);
+              this._rememberDecrypted(data.message_id);
               this._mlsDecryptFailCounts.delete(`a2a:${a2aChannelId}`);
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
               if (result.isHandshake || !result.plaintext) {
@@ -102863,7 +102939,7 @@ data:
         await init_policy_enforcer();
         init_room_protocol();
         init_tool_telemetry();
-        VERSION = true ? "0.23.60" : "0.0.0-dev";
+        VERSION = true ? "0.23.61" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -103567,6 +103643,17 @@ import { chmodSync as chmodSync5, mkdirSync as mkdirSync6 } from "node:fs";
 import { join as join17 } from "node:path";
 
 // src/muse-session.ts
+var ERROR_TYPE = /\(([a-z][a-z_]{2,40})\)\s*$/;
+function describeTurnFailure(err) {
+  const message = err instanceof Error ? err.message : "";
+  if (message === "muse turn stopped") return null;
+  const status = err?.upstreamStatus;
+  const type = ERROR_TYPE.exec(message.slice(-200))?.[1];
+  return {
+    ...typeof status === "number" && Number.isInteger(status) && status >= 400 && status <= 599 ? { upstreamStatus: status } : {},
+    ...type ? { errorType: type } : {}
+  };
+}
 var MuseSession = class {
   constructor(driver, opts = {}) {
     this.driver = driver;
@@ -103638,8 +103725,17 @@ var MuseSession = class {
 ${item.text}` : item.text;
           const result = await this.driver.runTurn(prompt, { ownerTurn: item.ownerTurn });
           await this.maybeFallback(item, result);
-        } catch {
-          this.log("turn failed reason=driver");
+        } catch (err) {
+          const failure2 = describeTurnFailure(err);
+          if (failure2) {
+            this.log(`turn failed reason=driver${failure2.upstreamStatus ? ` upstream_status=${failure2.upstreamStatus}` : ""}${failure2.errorType ? ` error_type=${failure2.errorType}` : ""}`);
+            try {
+              this.opts.onTurnFailed?.(failure2);
+            } catch {
+            }
+          } else {
+            this.log("turn failed reason=stopped");
+          }
           await this.failureNotice(item);
         } finally {
           this.current = null;
@@ -103767,6 +103863,16 @@ var META_RESPONSES_URL = "https://api.meta.ai/v1/responses";
 var BODY_LIMIT = 16 * 1024 * 1024;
 var ERROR_LIMIT = 64 * 1024;
 var HOP_HEADERS = ["connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade"];
+var LIMIT_HEADER = /^(?:retry-after|x-ratelimit-[a-z0-9-]{1,40}|ratelimit(?:-[a-z0-9-]{1,40})?)$/;
+var LIMIT_VALUE = /^[0-9][0-9.smh]{0,15}$/;
+function limitHeaderNote(headers) {
+  const parts = [];
+  headers.forEach((value, name) => {
+    if (parts.length >= 8 || !LIMIT_HEADER.test(name)) return;
+    parts.push(`${name}=${LIMIT_VALUE.test(value.trim()) ? value.trim() : "present"}`);
+  });
+  return parts.length ? ` ${parts.join(" ")}` : "";
+}
 function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -103885,6 +103991,7 @@ async function createMuseProviderAdapter(opts) {
     } catch {
     }
   };
+  let lastStatus;
   const server = createServer2((req, res) => {
     const abort = new AbortController();
     const stop = () => abort.abort();
@@ -103963,6 +104070,10 @@ async function createMuseProviderAdapter(opts) {
           }
         }
       }
+      if (!response.ok) {
+        lastStatus = response.status;
+        log(`upstream_error status=${response.status}${limitHeaderNote(response.headers)}`);
+      }
       await forward(response, res, abort.signal, inspected);
     })().catch(() => {
       log("request_failed reason=transport");
@@ -104004,7 +104115,11 @@ async function createMuseProviderAdapter(opts) {
     await close();
     throw new Error("provider adapter unavailable");
   }
-  return { baseUrl: `http://127.0.0.1:${address.port}${route.slice(0, -"/responses".length)}`, close };
+  return {
+    baseUrl: `http://127.0.0.1:${address.port}${route.slice(0, -"/responses".length)}`,
+    close,
+    upstreamStatus: () => lastStatus
+  };
 }
 
 // src/muse-driver.ts
@@ -104101,6 +104216,12 @@ var MuseDriver = class {
       if (this.current?.cancelled) throw new Error("muse turn stopped");
       spawn2.args.splice(2, 0, "--base-url", adapter.baseUrl);
       return await this.execJsonl(spawn2);
+    } catch (err) {
+      const status = adapter.upstreamStatus?.();
+      if (typeof status === "number" && err instanceof Error) {
+        err.upstreamStatus = status;
+      }
+      throw err;
     } finally {
       await adapter.close();
       if (this.adapter === adapter) this.adapter = null;
@@ -104724,6 +104845,18 @@ var RoomHushState = class {
     return t2 !== void 0 && now < t2;
   }
 };
+function reportTurnFailure(channel, failure2) {
+  try {
+    reportToolInvoke(channel?.telemetry, {
+      toolName: "model_turn",
+      outcome: "error",
+      errorKind: failure2.upstreamStatus === 429 ? "model_rate_limited" : "model_error",
+      durationMs: 0,
+      conversation: { kind: "unknown" }
+    });
+  } catch {
+  }
+}
 function reportSay(channel, t2, startedAt, failure2) {
   try {
     reportToolInvoke(channel.telemetry, {
@@ -105004,7 +105137,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.32" : void 0;
+  return true ? "0.1.34" : void 0;
 }
 function helpText(version2) {
   return [
@@ -105129,7 +105262,13 @@ async function main(opts = {}) {
     spawnFn: opts.spawnFn
   });
   const identity = identityPrompt(cfg.agentName, SAY_TOOL_NAME);
-  session = new MuseSession(driver, { log: (m2) => logLine(m2), identity });
+  session = new MuseSession(driver, {
+    log: (m2) => logLine(m2),
+    identity,
+    // #1467: every failed turn reaches Recent problems (and Admin) — `channel`
+    // is read when the failure happens, after it is connected.
+    onTurnFailed: (failure2) => reportTurnFailure(channel, failure2)
+  });
   try {
     await driver.start();
   } catch (err) {

package/dist/muse-provider.d.ts

@@ -1,7 +1,10 @@
 export interface MuseProviderAdapter {
     baseUrl: string;
     close(): Promise<void>;
+    /** #1467: the last error status Meta returned this turn; undefined if none. */
+    upstreamStatus?(): number | undefined;
 }
+export declare function limitHeaderNote(headers: Headers): string;
 export interface MuseProviderAdapterOptions {
     timeoutMs: number;
     log?: (message: string) => void;

package/dist/muse-session.d.ts

@@ -20,6 +20,16 @@ export interface DriverLike {
  * cannot redirect a private 1:1 reply, because the newer message only becomes
  * current when its own turn starts.
  */
+/** #1467: what is safe to keep about a failed turn — never its message text. */
+export interface TurnFailure {
+    /** The error status Meta's API returned this turn, when it returned one. */
+    upstreamStatus?: number;
+    /** The provider's error type, e.g. "invalid_request_error" — only a short
+     *  lower-case token in parentheses at the end of Muse's reason. */
+    errorType?: string;
+}
+/** A failed turn → what to report, or null when the turn was stopped on purpose. */
+export declare function describeTurnFailure(err: unknown): TurnFailure | null;
 export declare class MuseSession implements RoomSession {
     private readonly driver;
     private readonly opts;
@@ -32,6 +42,8 @@ export declare class MuseSession implements RoomSession {
         onSay?: (text: string) => Promise<void>;
         log?: (m: string) => void;
         identity?: string;
+        /** #1467: a turn failed (not stopped). Fire-and-forget; a throw is swallowed. */
+        onTurnFailed?: (failure: TurnFailure) => void;
     });
     push(text: string, reply?: (text: string) => Promise<void>, opts?: {
         autoReplyOnText?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/muse-bridge",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "type": "module",
   "description": "AgentVault Muse Bridge — daemon bridging a Muse agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",