@agentvault/muse-bridge 0.1.35 → 0.1.36

package/dist/index.js

@@ -11812,11 +11812,11 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.62" : FALLBACK;
+  const v2 = true ? "0.23.63" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "4db8d51" : "";
+  const raw = true ? "52249f2" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -71703,6 +71703,16 @@ var init_dist = __esm({
            */
           static _KP_REPLENISH_INTERVAL_MS = 6 * 60 * 60 * 1e3;
           _kpReplenishTimer = null;
+          /**
+           * #1094: how often each live group's key proof is re-reported — the web
+           * reporter's cadence (`use-key-proof-reporter.ts`), against the server's 24h
+           * staleness window. Re-reading the CURRENT epoch on a timer is self-correcting
+           * whatever moved it, which is why no commit site is hooked.
+           */
+          static _KEY_PROOF_INTERVAL_MS = 10 * 60 * 1e3;
+          /** #1094: never let one slow report hold up the rest. */
+          static _KEY_PROOF_FETCH_TIMEOUT_MS = 1e4;
+          _keyProofTimer = null;
           _a2aReconcileTimer = null;
           _deliveryPulling = false;
           _drDeliveryPulling = false;
@@ -73944,7 +73954,7 @@ ${text}`,
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.62" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.63" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -75148,6 +75158,7 @@ ${text}`,
               this._telemetryReporter = null;
             }
             this._stopA2aReconcileTimer();
+            this._stopKeyProofTimer();
             if (this._ws) {
               this._ws.removeAllListeners();
               this._ws.close();
@@ -76154,7 +76165,7 @@ ${text}`,
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.62" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.63" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -76165,6 +76176,7 @@ ${text}`,
                 if (aborted2()) return;
                 await this._ensureKpPoolPublished();
                 this._startKpReplenishTimer();
+                this._startKeyProofTimer();
                 this._pullDeliveryQueue().catch((err) => {
                   console.warn("[SecureChannel] Initial delivery pull failed:", err);
                 });
@@ -76486,7 +76498,7 @@ ${text}`,
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.62" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.63" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -76865,6 +76877,7 @@ ${text}`,
               }
               this._stopA2aReconcileTimer();
               this._stopKpReplenishTimer();
+              this._stopKeyProofTimer();
               if (this._stopped) return;
               this._setState("disconnected");
               this._scheduleReconnect();
@@ -79355,6 +79368,82 @@ ${baseText}`;
               this._kpReplenishTimer = null;
             }
           }
+          /** #1094: start reporting key proofs (now, then every interval). Idempotent. */
+          _startKeyProofTimer() {
+            this._stopKeyProofTimer();
+            void this._reportKeyProofs();
+            this._keyProofTimer = setInterval(() => {
+              void this._reportKeyProofs();
+            }, _SecureChannel._KEY_PROOF_INTERVAL_MS);
+          }
+          _stopKeyProofTimer() {
+            if (this._keyProofTimer) {
+              clearInterval(this._keyProofTimer);
+              this._keyProofTimer = null;
+            }
+          }
+          /**
+           * #1094: prove, per live MLS group, that this agent can read it.
+           *
+           * `mls_key_proofs` answers "can this roster member actually decrypt?" — the
+           * question nothing else can — but until now only browsers ever wrote one, so
+           * a stuck agent (smartcode sat at epoch 1 in a group at 71 for two days,
+           * #991) was invisible to the server. Same payload as the web reporter: the
+           * epoch and RFC 9420 §8.2's `epoch_authenticator`, which only a holder of
+           * the group's current state can compute and every member computes alike.
+           *
+           * A manager with no usable state reports nothing: the server reads that
+           * absence as "cannot be shown to read", which is the honest signal. Each
+           * group is reported once even when several keys share one manager. Never
+           * throws; a failed report is logged at debug and changes nothing.
+           */
+          async _reportKeyProofs() {
+            const deviceId = this._deviceId;
+            const jwt = this._deviceJwt;
+            if (!deviceId || !jwt) return;
+            const best = /* @__PURE__ */ new Map();
+            for (const mgr of this._mlsGroups.values()) {
+              try {
+                if (!mgr.isInitialized) continue;
+                const epoch = Number(mgr.epoch);
+                if (epoch <= 0) continue;
+                const groupId = _SecureChannel._mlsGroupIdString(mgr.groupId);
+                if (!groupId) continue;
+                const prev = best.get(groupId);
+                if (prev && epoch <= prev.epoch) continue;
+                best.set(groupId, { epoch, authenticator: Buffer.from(mgr.epochAuthenticator).toString("hex") });
+              } catch {
+                continue;
+              }
+            }
+            for (const [groupId, { epoch, authenticator }] of best) {
+              try {
+                const res = await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${groupId}/key-proof`, {
+                  method: "POST",
+                  headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+                  body: JSON.stringify({ device_id: deviceId, epoch, authenticator }),
+                  signal: AbortSignal.timeout(_SecureChannel._KEY_PROOF_FETCH_TIMEOUT_MS)
+                });
+                if (!res.ok) console.debug(`[key-proof] ${groupId.slice(0, 8)}: HTTP ${res.status}`);
+              } catch (err) {
+                console.debug(`[key-proof] ${groupId.slice(0, 8)}: report failed (non-critical):`, err);
+              }
+            }
+          }
+          /**
+           * The wire MLS group id as a UUID string, or null. Every founder today —
+           * ts-mls and Hermes alike — uses the server's UUID string as UTF-8 (36
+           * bytes). A 16-byte id (the UUID's raw bytes) is mapped too, defensively:
+           * dropping one would leave this agent "never proved" in that group.
+           */
+          static _mlsGroupIdString(raw) {
+            if (raw.length === 16) {
+              const h2 = Buffer.from(raw).toString("hex");
+              return `${h2.slice(0, 8)}-${h2.slice(8, 12)}-${h2.slice(12, 16)}-${h2.slice(16, 20)}-${h2.slice(20)}`;
+            }
+            const s2 = new TextDecoder().decode(raw).toLowerCase();
+            return UUID_RE4.test(s2) ? s2 : null;
+          }
           /**
            * The server's EXPIRY-AWARE usable KeyPackage count, or null when unknown.
            *
@@ -102993,7 +103082,7 @@ data:
         await init_policy_enforcer();
         init_room_protocol();
         init_tool_telemetry();
-        VERSION = true ? "0.23.62" : "0.0.0-dev";
+        VERSION = true ? "0.23.63" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -105191,7 +105280,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.35" : void 0;
+  return true ? "0.1.36" : void 0;
 }
 function helpText(version2) {
   return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/muse-bridge",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "type": "module",
   "description": "AgentVault Muse Bridge — daemon bridging a Muse agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",