@agentvault/muse-bridge 0.1.5 → 0.1.7

package/dist/index.js

@@ -11465,11 +11465,11 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.30" : FALLBACK;
+  const v2 = true ? "0.23.32" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "1fff5d6" : "";
+  const raw = true ? "564f8b1-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -68283,6 +68283,8 @@ var init_dist = __esm({
                   continue;
                 seenIdentities.push(identity);
                 const leaf = this.memberLeafIndex(identity);
+                if (leaf !== null && leaf === this.ownLeafIndex())
+                  continue;
                 if (leaf !== null)
                   leavesToRemove.push(leaf);
               }
@@ -68338,6 +68340,20 @@ var init_dist = __esm({
            * then re-adds it with a fresh KeyPackage so it gets a Welcome at the
            * current epoch it can actually apply.
            */
+          /**
+           * The leaf index THIS manager occupies — the leaf whose private key it holds.
+           *
+           * Read from `privatePath.leafIndex`, which is the same value ts-mls uses to
+           * decide whether a commit removes its own committer, so a caller checking
+           * against this cannot disagree with the library about who "we" are.
+           *
+           * Exists so a fulfiller can tell a request from ANOTHER device apart from one
+           * from itself (#1147) without any "who am I" plumbing: the manager already
+           * knows, and a guard that reads it here cannot be forgotten by a call site.
+           */
+          ownLeafIndex() {
+            return this._requireState().privatePath.leafIndex;
+          }
           memberLeafIndex(identity) {
             const s2 = this._requireState();
             const tree = s2.ratchetTree;
@@ -69702,6 +69718,118 @@ var init_dist = __esm({
            * Encrypt and send a message to ALL owner devices (fanout).
            * Each session gets the same plaintext encrypted independently.
            */
+          /**
+           * #952 — sends held because MLS is expected for this conversation but the
+           * group is not joined yet.
+           *
+           * ⚠️ IN MEMORY ONLY. These entries hold PLAINTEXT. `_persisted` is written to
+           * disk, and the product's entire premise is that plaintext does not rest
+           * where it does not have to; a crash losing a held greeting is the correct
+           * trade. This is why the existing `outboundQueue` could not be reused — that
+           * one is persisted, and holds already-DR-encrypted bytes, which is exactly
+           * the encryption we are trying not to perform yet.
+           */
+          _mlsHold = /* @__PURE__ */ new Map();
+          /** How long a send waits for the Welcome. The two measured bursts were each
+           *  confined to a single minute, with the group already existing server-side
+           *  in the same second, so this is generous rather than tight. */
+          static MLS_HOLD_MS = 3e4;
+          /** Bound on held sends per group — see `_holdForMls`. */
+          static MLS_HOLD_MAX = 50;
+          /**
+           * Should this 1:1 send wait for MLS rather than go out over Double Ratchet?
+           *
+           * The discriminator exists at the moment of the bug: `_sessionGroupIds`
+           * already carries the conversation's group id — the server told us the group
+           * exists — while `_mlsGroups` has no usable manager for it. Group expected,
+           * group not ready.
+           *
+           * The negative case is load-bearing. A conversation with NO group id is
+           * legitimately Double Ratchet, and holding it would break owner-to-agent
+           * messaging outright, which is far worse than the bug this fixes. "Present"
+           * is also not "ready": a manager parked at epoch 0 has not joined (#1092),
+           * and reading presence as readiness is how #991 shipped.
+           */
+          _shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId) {
+            if (!convGroupId) return false;
+            const ready = Boolean(mlsGroup?.isInitialized) && Boolean(mlsGroupId) && Number(mlsGroup?.epoch) > 0;
+            return !ready;
+          }
+          /** Park a send until the Welcome lands, or until the hold expires. */
+          _holdForMls(convGroupId, convId, plaintext, options) {
+            let entry = this._mlsHold.get(convGroupId);
+            if (!entry) {
+              const timer = setTimeout(() => {
+                void this._releaseHeldOverDr(convGroupId);
+              }, _SecureChannel.MLS_HOLD_MS);
+              timer.unref?.();
+              entry = { items: [], timer };
+              this._mlsHold.set(convGroupId, entry);
+            }
+            if (entry.items.length >= _SecureChannel.MLS_HOLD_MAX) {
+              entry.items.shift();
+              console.warn(
+                `[SecureChannel] MLS hold full for group ${convGroupId.slice(0, 8)} \u2014 dropped the oldest held message`
+              );
+            }
+            entry.items.push({ convId, plaintext, options });
+            console.log(
+              `[SecureChannel] Holding send for group ${convGroupId.slice(0, 8)} until its Welcome lands (held=${entry.items.length})`
+            );
+          }
+          _takeHold(convGroupId) {
+            const entry = this._mlsHold.get(convGroupId);
+            if (!entry) return null;
+            clearTimeout(entry.timer);
+            this._mlsHold.delete(convGroupId);
+            return entry;
+          }
+          /** Re-drive one held send through the normal path, now that MLS is ready. */
+          async _resendHeld(item) {
+            await this.send(item.plaintext, {
+              ...item.options ?? {},
+              conversationId: item.convId,
+              bypassMlsHold: true
+            });
+          }
+          /** The Welcome landed — release everything held for this group, in order. */
+          async _flushMlsHold(convGroupId) {
+            const entry = this._takeHold(convGroupId);
+            if (!entry) return;
+            console.log(
+              `[SecureChannel] Welcome landed for group ${convGroupId.slice(0, 8)} \u2014 releasing ${entry.items.length} held message(s) over MLS`
+            );
+            for (const item of entry.items) {
+              try {
+                await this._resendHeld(item);
+              } catch (err) {
+                console.warn("[SecureChannel] Held message failed to send after Welcome:", err);
+              }
+            }
+          }
+          /**
+           * The hold expired. Send over Double Ratchet exactly as before.
+           *
+           * This is deliberately NOT a drop. #853 and #831 are Welcomes that never
+           * arrive; under those an unbounded hold turns a lost minute into an agent
+           * that never speaks again. The hold removes the race — it must not invent a
+           * new failure mode. The warning is the part that is new: today the loss is
+           * silent.
+           */
+          async _releaseHeldOverDr(convGroupId) {
+            const entry = this._takeHold(convGroupId);
+            if (!entry) return;
+            console.warn(
+              `[SecureChannel] No Welcome for group ${convGroupId.slice(0, 8)} within ${_SecureChannel.MLS_HOLD_MS}ms \u2014 releasing ${entry.items.length} message(s) over Double Ratchet. The recipient may not hold a ratchet with this device, in which case they are undeliverable (#952).`
+            );
+            for (const item of entry.items) {
+              try {
+                await this._resendHeld(item);
+              } catch (err) {
+                console.warn("[SecureChannel] Held message failed on Double Ratchet release:", err);
+              }
+            }
+          }
           async send(plaintext, options) {
             if (isAbstention(plaintext)) return;
             if (this._state === "error" || this._state === "idle") {
@@ -69863,6 +69991,10 @@ var init_dist = __esm({
                   );
                   addressedMlsGroupIds.push(mlsGroupId);
                   if (convGroupId) sentSharedGroupIds.add(convGroupId);
+                } else if (!options?.bypassMlsHold && this._shouldHoldForMls(convGroupId, mlsGroup, mlsGroupId)) {
+                  this._holdForMls(convGroupId, convId, plaintext, options);
+                  sentCount++;
+                  continue;
                 } else {
                   const encrypted = session.ratchet.encrypt(plaintext);
                   const transport = encryptedMessageToTransport(encrypted);
@@ -70032,7 +70164,7 @@ var init_dist = __esm({
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.30" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.32" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -71970,7 +72102,7 @@ var init_dist = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.32" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -72294,7 +72426,7 @@ var init_dist = __esm({
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.30" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.32" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -72710,11 +72842,13 @@ var init_dist = __esm({
               let text = plaintext;
               let messageType = "text";
               let topicId = data.topic_id;
+              let mlsAttachment = null;
               try {
                 const parsed = JSON.parse(plaintext);
                 text = parsed.text ?? plaintext;
                 messageType = parsed.type ?? "text";
                 topicId = parsed.topicId ?? topicId;
+                if (parsed.attachment) mlsAttachment = parsed.attachment;
               } catch {
               }
               if (messageType === "history_catchup_request") {
@@ -72781,6 +72915,9 @@ var init_dist = __esm({
                   console.log(`[SecureChannel] Session ${convId.slice(0, 8)} activated via MLS message`);
                 }
               }
+              if (mlsAttachment) {
+                text = await this._augmentWithAttachment(mlsAttachment, text);
+              }
               const metadata = {
                 messageId: data.message_id ?? `mls_${Date.now()}`,
                 conversationId: convId ?? this._primaryConversationId,
@@ -73030,10 +73167,70 @@ ${messageText}`;
            * Download an encrypted attachment blob, decrypt it, verify integrity,
            * and save the plaintext file to disk.
            */
+          /** Where an attachment may be written — always directly inside `attachDir` (#1143).
+           *
+           * The filename arrives INSIDE the envelope and is chosen by whoever sent the
+           * message. `join(attachDir, info.filename)` resolves `..` normally, so
+           * `../../agentvault.json` wrote over the device credential store. Only the
+           * final path component is honoured, and anything that is not a usable name
+           * falls back to a fixed one.
+           */
+          _safeAttachmentPath(attachDir, filename) {
+            const raw = String(filename ?? "");
+            const last = raw.split(/[\\/]/).pop() ?? "";
+            const cleaned = last.replace(/\0/g, "").trim();
+            const safe = cleaned === "" || cleaned === "." || cleaned === ".." ? "attachment.bin" : cleaned;
+            return join42(attachDir, safe);
+          }
+          /** Download an attachment and fold it into the text the agent sees (#1139).
+           *
+           * Extracted so the MLS receive path can use it too. It used to live inline in
+           * `_handleIncomingMessage`, which meant attachments worked on the Double
+           * Ratchet path ONLY — and hermes drops DR by design (`secure_channel.py:594`,
+           * "DR fallback is logged-and-dropped"), so no single transport could serve
+           * both client families. That is why an attachment reached ohtani and never
+           * reached smartcoder2 on 2026-08-31.
+           *
+           * Returns the text unchanged when there is no attachment or the fetch fails —
+           * but a failure is LOGGED and announced in the text, never silent.
+           */
+          async _augmentWithAttachment(attachmentInfo, baseText) {
+            if (!attachmentInfo) return baseText;
+            try {
+              const { filePath, decrypted } = await this._downloadAndDecryptAttachment(attachmentInfo);
+              const mime = String(attachmentInfo.mime ?? "application/octet-stream");
+              const name = String(attachmentInfo.filename ?? "attachment");
+              const textMimes = ["text/", "application/json", "application/xml", "application/csv"];
+              if (textMimes.some((m2) => mime.startsWith(m2))) {
+                const content = new TextDecoder().decode(decrypted);
+                return `[Attachment: ${name} (${mime}) saved to ${filePath}]
+---
+${content}
+---
+
+${baseText}`;
+              }
+              if (mime.startsWith("image/")) {
+                return `[Image attachment: ${name} saved to ${filePath}]
+Use your Read tool to view this image file.
+
+${baseText}`;
+              }
+              return `[Attachment: ${name} saved to ${filePath}]
+
+${baseText}`;
+            } catch (err) {
+              console.error("[SecureChannel] Failed to download attachment:", err);
+              return `[Attachment: ${String(attachmentInfo.filename ?? "file")} was sent but could not be retrieved: ${err}]
+
+${baseText}`;
+            }
+          }
           async _downloadAndDecryptAttachment(info) {
             const attachDir = join42(this.config.dataDir, "attachments");
             await mkdir3(attachDir, { recursive: true });
-            const url22 = `${this.config.apiUrl}${info.blobUrl}`;
+            const sep2 = info.blobUrl.includes("?") ? "&" : "?";
+            const url22 = `${this.config.apiUrl}${info.blobUrl}${sep2}device_id=${encodeURIComponent(this._deviceId ?? "")}`;
             const res = await fetch(url22, {
               headers: { Authorization: `Bearer ${this._deviceJwt}` }
             });
@@ -73049,7 +73246,7 @@ ${messageText}`;
             const fileKey = base64ToBytes(info.fileKey);
             const fileNonce = base64ToBytes(info.fileNonce);
             const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
-            const filePath = join42(attachDir, info.filename);
+            const filePath = this._safeAttachmentPath(attachDir, info.filename);
             await writeFile3(filePath, decrypted);
             console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
             return { filePath, decrypted };
@@ -73585,10 +73782,12 @@ ${messageText}`;
               const rawPlaintext = new TextDecoder().decode(result.plaintext);
               let messageText;
               let messageType;
+              let roomAttachment = null;
               try {
                 const parsed = JSON.parse(rawPlaintext);
                 messageType = parsed.type || "message";
                 messageText = parsed.text || rawPlaintext;
+                if (parsed.attachment) roomAttachment = parsed.attachment;
               } catch {
                 messageType = "message";
                 messageText = rawPlaintext;
@@ -73628,6 +73827,9 @@ ${messageText}`;
                   await this._refreshRoomRoster(resolvedRoomId);
                 }
               }
+              if (roomAttachment) {
+                messageText = await this._augmentWithAttachment(roomAttachment, messageText);
+              }
               const roomMembers = this._persisted?.rooms?.[resolvedRoomId]?.members ?? [];
               const senderMember = roomMembers.find((m2) => m2.deviceId === senderDeviceId);
               const senderIsAgent = senderMember?.entityType === "agent";
@@ -74470,6 +74672,7 @@ ${messageText}`;
                   await this._persistState();
                 }
                 console.log(`[SecureChannel] Joined shared 1:1 MLS group for group ${conversationGroupId.slice(0, 8)} via Welcome (epoch=${mgr.epoch})`);
+                await this._flushMlsHold(conversationGroupId);
                 return;
               }
               if (conversationId) {
@@ -97536,7 +97739,7 @@ data:
         await init_skill_telemetry();
         await init_policy_enforcer();
         init_room_protocol();
-        VERSION = true ? "0.23.30" : "0.0.0-dev";
+        VERSION = true ? "0.23.32" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -98912,7 +99115,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.5" : void 0;
+  return true ? "0.1.7" : void 0;
 }
 function helpText(version2) {
   return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/muse-bridge",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "type": "module",
   "description": "AgentVault Muse Bridge — daemon bridging a Muse agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",