@agentvault/muse-bridge 0.1.33 → 0.1.34

package/dist/index.js

@@ -11799,11 +11799,11 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.60" : FALLBACK;
+  const v2 = true ? "0.23.61" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "628e3ba" : "";
+  const raw = true ? "129e537" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -71707,6 +71707,17 @@ var init_dist = __esm({
            *  self-heal rather than be logged and dropped. */
           _mlsCommitFailCounts = /* @__PURE__ */ new Map();
           static MAX_MLS_DECRYPT_FAILS = 3;
+          /**
+           * #1518: ids of MLS application frames this process has already decrypted
+           * (server-assigned `mls_messages.id`, the same on the live delivery pull and
+           * on a `/sync` / reconnect replay). A replayed frame cannot be decrypted a
+           * second time — forward secrecy deleted its key — so without this every
+           * reconnect after a backend deploy fed already-read messages into the
+           * decrypt-failure counter and re-admitted the agent (+2 epochs). Insertion
+           * ordered; the oldest ids fall out past DECRYPTED_ID_CAP.
+           */
+          _decryptedMessageIds = /* @__PURE__ */ new Map();
+          static DECRYPTED_ID_CAP = 5e3;
           /**
            * #1084: consecutive resyncs that found NOTHING to apply, per group.
            *
@@ -73912,7 +73923,7 @@ ${text}`,
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.60" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.61" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -76122,7 +76133,7 @@ ${text}`,
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.60" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.61" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -76454,7 +76465,7 @@ ${text}`,
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.60" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.61" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -76890,9 +76901,14 @@ ${text}`,
               if (groupId) void this._requestWelcomeSelfHeal(groupId);
               return;
             }
+            if (this._alreadyDecrypted(data.message_id)) {
+              console.debug(`[SecureChannel] MLS 1:1 frame ${String(data.message_id).slice(0, 8)} already read \u2014 replay skipped`);
+              return;
+            }
             try {
               const cipherBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
               const result = await mgr.decrypt(cipherBytes);
+              this._rememberDecrypted(data.message_id);
               if (mgrKey) this._mlsDecryptFailCounts.delete(mgrKey);
               const mlsGroupId = (convGroupId ? this._persisted?.mlsGroups?.[convGroupId]?.mlsGroupId : null) ?? this._persisted?.mlsConversations?.[convId]?.mlsGroupId ?? groupId;
               if (mlsGroupId) {
@@ -77915,9 +77931,14 @@ ${baseText}`;
               }
               return;
             }
+            if (this._alreadyDecrypted(data.message_id)) {
+              console.debug(`[SecureChannel] MLS room frame ${String(data.message_id).slice(0, 8)} already read \u2014 replay skipped`);
+              return;
+            }
             try {
               const ciphertext = Buffer.from(data.payload, "hex");
               const result = await mlsGroup.decrypt(new Uint8Array(ciphertext));
+              this._rememberDecrypted(data.message_id);
               this._mlsDecryptFailCounts.delete(resolvedRoomId);
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
               if (result.isHandshake || !result.plaintext) {
@@ -79095,16 +79116,57 @@ ${baseText}`;
             }
             return await mlsGroup.encrypt(plaintextBytes);
           }
+          /** #1518: is the server answering at all? Bounded; any failure is "no". */
+          async _serverReachable() {
+            try {
+              const res = await fetch(`${this.config.apiUrl}/health`, { signal: AbortSignal.timeout(5e3) });
+              return res.ok;
+            } catch {
+              return false;
+            }
+          }
+          /** #1518: the server is down — don't re-key (that needs the same server).
+           *  Clear the run so the next failures ask again. Reported as handled. */
+          _deferResync(groupKey, groupId, why) {
+            this._mlsDecryptFailCounts.delete(groupKey);
+            console.warn(
+              `[SecureChannel] Resync for ${groupId.slice(0, 8)}: server unreachable (${why}) \u2014 NOT re-keying; will retry (#1518)`
+            );
+            return true;
+          }
+          /** #1518: has this process already decrypted the frame with this id? */
+          _alreadyDecrypted(messageId) {
+            return typeof messageId === "string" && messageId !== "" && this._decryptedMessageIds.has(messageId);
+          }
+          /** #1518: remember a decrypted frame's id (bounded; oldest dropped). */
+          _rememberDecrypted(messageId) {
+            if (typeof messageId !== "string" || messageId === "") return;
+            this._decryptedMessageIds.set(messageId, true);
+            if (this._decryptedMessageIds.size > _SecureChannel.DECRYPTED_ID_CAP) {
+              const oldest = this._decryptedMessageIds.keys().next().value;
+              if (oldest !== void 0) this._decryptedMessageIds.delete(oldest);
+            }
+          }
           async _resyncOnDivergence(groupKey, groupId) {
             const mgr = this._mlsGroups.get(groupKey);
             if (!mgr?.isInitialized) return false;
             const fromEpoch = Number(mgr.epoch);
             try {
-              const res = await fetch(
-                `${this.config.apiUrl}/api/v1/mls/groups/${groupId}/sync?last_epoch=${fromEpoch}`,
-                { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
-              );
+              let res;
+              try {
+                res = await fetch(
+                  `${this.config.apiUrl}/api/v1/mls/groups/${groupId}/sync?last_epoch=${fromEpoch}`,
+                  { headers: { Authorization: `Bearer ${this._deviceJwt}` } }
+                );
+              } catch (netErr) {
+                if (!await this._serverReachable()) return this._deferResync(groupKey, groupId, String(netErr));
+                console.warn(`[SecureChannel] Resync-on-divergence failed for ${groupId.slice(0, 8)}:`, netErr);
+                return false;
+              }
               if (!res.ok) {
+                if ((res.status >= 500 || res.status === 429) && !await this._serverReachable()) {
+                  return this._deferResync(groupKey, groupId, `HTTP ${res.status}`);
+                }
                 console.warn(`[SecureChannel] Resync /sync failed for ${groupId.slice(0, 8)}: ${res.status}`);
                 return false;
               }
@@ -80219,9 +80281,14 @@ ${baseText}`;
               console.warn(`[SecureChannel] MLS group not loaded for A2A ${a2aChannelId.slice(0, 8)}`);
               return;
             }
+            if (this._alreadyDecrypted(data.message_id)) {
+              console.debug(`[SecureChannel] MLS A2A frame ${String(data.message_id).slice(0, 8)} already read \u2014 replay skipped`);
+              return;
+            }
             try {
               const ciphertext = new Uint8Array(Buffer.from(data.payload, "hex"));
               const result = await mlsGroup.decrypt(ciphertext);
+              this._rememberDecrypted(data.message_id);
               this._mlsDecryptFailCounts.delete(`a2a:${a2aChannelId}`);
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
               if (result.isHandshake || !result.plaintext) {
@@ -102872,7 +102939,7 @@ data:
         await init_policy_enforcer();
         init_room_protocol();
         init_tool_telemetry();
-        VERSION = true ? "0.23.60" : "0.0.0-dev";
+        VERSION = true ? "0.23.61" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -105070,7 +105137,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.33" : void 0;
+  return true ? "0.1.34" : void 0;
 }
 function helpText(version2) {
   return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/muse-bridge",
-  "version": "0.1.33",
+  "version": "0.1.34",
   "type": "module",
   "description": "AgentVault Muse Bridge — daemon bridging a Muse agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",