@nopeek/agent-bridge 0.5.5 → 0.5.6

package/dist/bot.d.ts

@@ -24,6 +24,8 @@ export declare class BotRunner {
     private allowed;
     private accessLoaded;
     private declined;
+    private chains;
+    private cantPost;
     private log;
     private logErr;
     constructor(info: BotInfo, cfg: BridgeConfig);
@@ -50,4 +52,7 @@ export declare class BotRunner {
     /** Bounded dedupe so a redelivered frame is never answered twice. */
     private remember;
     private handleMessage;
+    /** A FORBIDDEN post (broadcast channel, bot not an operator) fails for every
+     *  future message too — mute the channel so the brain stops running there. */
+    private notePostFailure;
 }

package/dist/bot.js

@@ -28,6 +28,13 @@ export class BotRunner {
     allowed = new Set();
     accessLoaded = false;
     declined = new Set(); // (senderId) already told "not authorized" once
+    // Per-channel serialization: two messages in one channel must be answered in
+    // order, one at a time — concurrent brain runs against the same agent session
+    // (e.g. one Hermes session per channel) deadlock or reply out of order.
+    chains = new Map();
+    // Channels the bot can't post to (e.g. broadcast, non-operator): after the
+    // first FORBIDDEN, skip the brain entirely — replies there can never land.
+    cantPost = new Set();
     log;
     logErr;
     constructor(info, cfg) {
@@ -153,8 +160,15 @@ export class BotRunner {
             this.log(`received channel key for ${p.channelId} (welcome ceremony completed)`);
         }));
         np.on("message", ((m) => {
-            void this.handleMessage(m).catch((err) => {
+            const prev = this.chains.get(m.channelId) ?? Promise.resolve();
+            const next = prev.then(() => this.handleMessage(m).catch((err) => {
+                this.notePostFailure(m.channelId, err);
                 this.logErr(`handler error for ${m.messageId}: ${err.message}`);
+            }));
+            this.chains.set(m.channelId, next);
+            void next.finally(() => {
+                if (this.chains.get(m.channelId) === next)
+                    this.chains.delete(m.channelId);
             });
         }));
         await this.refreshAccess(); // load the allow list before we answer anyone
@@ -216,6 +230,8 @@ export class BotRunner {
         this.remember(m.messageId);
         if (m.senderUserId === this.info.userId)
             return; // never answer ourselves
+        if (this.cantPost.has(m.channelId))
+            return; // replies can't land here — don't burn a brain run
         if (m.decryptionFailed) {
             // Likely a missed welcome (message arrived before our key). Sync the key
             // so the NEXT message decrypts; this frame's plaintext is unrecoverable.
@@ -278,6 +294,7 @@ export class BotRunner {
                 }
                 streamRef.p = ch.stream();
                 streamRef.p.catch((err) => {
+                    this.notePostFailure(m.channelId, err);
                     this.logErr(`stream open failed (falling back to a single send): ${err.message}`);
                 });
             }
@@ -323,4 +340,14 @@ export class BotRunner {
         this.handled++;
         this.log(`${m.channelId} -> replied (${reply.trim().length} chars, handled=${this.handled})`);
     }
+    /** A FORBIDDEN post (broadcast channel, bot not an operator) fails for every
+     *  future message too — mute the channel so the brain stops running there. */
+    notePostFailure(channelId, err) {
+        if (!/only operators can post|FORBIDDEN/i.test(err.message))
+            return;
+        if (this.cantPost.has(channelId))
+            return;
+        this.cantPost.add(channelId);
+        this.log(`muting ${channelId} — bot cannot post here (${err.message.slice(0, 80)})`);
+    }
 }

package/dist/bridge.d.ts

@@ -1,5 +1,5 @@
 import type { BridgeConfig, BrainSpec } from "./config.js";
-export declare const VERSION = "0.5.5";
+export declare const VERSION = "0.5.6";
 export interface PairRequest {
     pairingSecret: string;
     appId: string;

package/dist/bridge.js

@@ -14,7 +14,7 @@ import { resolveBrain } from "./brain.js";
 import { provisionSoul, provisionHermesProfile } from "./backends.js";
 import { reportCapabilities } from "./capabilities.js";
 import { isBrainBackend } from "./config.js";
-export const VERSION = "0.5.5";
+export const VERSION = "0.5.6";
 /** How often to re-probe + report brain availability to the server. */
 const CAPABILITIES_INTERVAL_MS = 5 * 60_000;
 export class PairError extends Error {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nopeek/agent-bridge",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Run your own agents as E2EE NoPeek bots. Pairs with a one-time code, runs every bot you own, and pipes messages to any command or webhook.",
   "type": "module",
   "license": "MIT",