@agentvault/muse-bridge 0.1.8 → 0.1.9

package/dist/index.js

@@ -11465,11 +11465,11 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.33" : FALLBACK;
+  const v2 = true ? "0.23.34" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildSha() {
-  const raw = true ? "7b91f2f-dirty" : "";
+  const raw = true ? "6b305ca-dirty" : "";
   const cleaned = (raw ?? "").trim();
   return !cleaned || cleaned === "unknown" ? null : cleaned;
 }
@@ -70167,7 +70167,7 @@ var init_dist = __esm({
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.33" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.34" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -72105,7 +72105,7 @@ var init_dist = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.33" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.34" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -72429,7 +72429,7 @@ var init_dist = __esm({
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.33" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.34" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -72833,6 +72833,7 @@ var init_dist = __esm({
             try {
               const cipherBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
               const result = await mgr.decrypt(cipherBytes);
+              if (mgrKey) this._mlsDecryptFailCounts.delete(mgrKey);
               const mlsGroupId = (convGroupId ? this._persisted?.mlsGroups?.[convGroupId]?.mlsGroupId : null) ?? this._persisted?.mlsConversations?.[convId]?.mlsGroupId ?? groupId;
               if (mlsGroupId) {
                 await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
@@ -72937,6 +72938,10 @@ var init_dist = __esm({
                 this.config.onMessage(text, metadata);
               }
             } catch (decryptErr) {
+              if (classifyCommitFailure(data.epoch, mgr?.epoch) === "already-applied") {
+                console.debug(`[SecureChannel] MLS 1:1 message at epoch ${String(data.epoch)} predates our epoch ${String(mgr?.epoch)} \u2014 cannot decrypt, ignoring`);
+                return;
+              }
               const failKey = mgrKey || `unknown:${groupId}`;
               const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
               this._mlsDecryptFailCounts.set(failKey, count);
@@ -73778,6 +73783,7 @@ ${baseText}`;
             try {
               const ciphertext = Buffer.from(data.payload, "hex");
               const result = await mlsGroup.decrypt(new Uint8Array(ciphertext));
+              this._mlsDecryptFailCounts.delete(resolvedRoomId);
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
               if (result.isHandshake || !result.plaintext) {
                 return;
@@ -73867,6 +73873,10 @@ ${baseText}`;
                 console.error("[SecureChannel] onMessage callback error (MLS):", err);
               });
             } catch (err) {
+              if (classifyCommitFailure(data.epoch, mlsGroup.epoch) === "already-applied") {
+                console.debug(`[SecureChannel] MLS room message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup.epoch)} for ${resolvedRoomId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+                return;
+              }
               const failKey = resolvedRoomId;
               const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
               this._mlsDecryptFailCounts.set(failKey, count);
@@ -74906,6 +74916,11 @@ ${baseText}`;
                     nackedIds.push(msg.queue_id);
                     if (msg.group_id && (msg.message_type === "commit" || msg.message_type === "application")) {
                       const failKey = msg.conversation_group_id ? `1to1-group:${msg.conversation_group_id}` : `group:${msg.group_id}`;
+                      const localMgr = msg.room_id && this._mlsGroups.get(msg.room_id) || this._mlsGroups.get(failKey);
+                      if (classifyCommitFailure(msg.epoch, localMgr?.epoch) === "already-applied") {
+                        console.debug(`[SecureChannel] Delivery ${msg.message_type} at epoch ${String(msg.epoch)} predates our epoch ${String(localMgr?.epoch)} \u2014 not counting toward recovery`);
+                        continue;
+                      }
                       const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
                       this._mlsDecryptFailCounts.set(failKey, count);
                       if (count >= _SecureChannel.MAX_MLS_DECRYPT_FAILS) {
@@ -75583,6 +75598,7 @@ ${baseText}`;
             try {
               const ciphertext = new Uint8Array(Buffer.from(data.payload, "hex"));
               const result = await mlsGroup.decrypt(ciphertext);
+              this._mlsDecryptFailCounts.delete(`a2a:${a2aChannelId}`);
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
               if (result.isHandshake || !result.plaintext) {
                 return;
@@ -75603,6 +75619,10 @@ ${baseText}`;
                 this.config.onA2AMessage(a2aMsg);
               }
             } catch (err) {
+              if (classifyCommitFailure(data.epoch, mlsGroup?.epoch) === "already-applied") {
+                console.debug(`[SecureChannel] MLS A2A message at epoch ${String(data.epoch)} predates our epoch ${String(mlsGroup?.epoch)} for ${a2aChannelId.slice(0, 8)} \u2014 cannot decrypt, ignoring`);
+                return;
+              }
               const failKey = `a2a:${a2aChannelId}`;
               const count = (this._mlsDecryptFailCounts.get(failKey) ?? 0) + 1;
               this._mlsDecryptFailCounts.set(failKey, count);
@@ -97774,7 +97794,7 @@ data:
         await init_skill_telemetry();
         await init_policy_enforcer();
         init_room_protocol();
-        VERSION = true ? "0.23.33" : "0.0.0-dev";
+        VERSION = true ? "0.23.34" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -99150,7 +99170,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.8" : void 0;
+  return true ? "0.1.9" : void 0;
 }
 function helpText(version2) {
   return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/muse-bridge",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "type": "module",
   "description": "AgentVault Muse Bridge — daemon bridging a Muse agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",