@happyvertical/smrt-chat 0.42.6 → 0.43.0

package/AGENTS.md

@@ -44,6 +44,13 @@ Facade: `sendMessage()` (authors as the actor with `role: 'user'`; room-membersh
 
 `allowedTools` is a JSON array controlled by the consuming app. Fail-closed: an empty/unparseable whitelist permits NO tools. The internal `sendAgentReply(service, params)` function enforces the whitelist before emitting any `tool`/`tool_call` message; a caller cannot supply a `senderProfileId`/`role` to post as the agent, and the function is not reachable from the package index.
 
+Principal-bound data discovery and reads are available as `PrincipalTool[]` via
+`createDataSurfaceTools()` (re-exported by the chat package). Pass the tools as
+`extraTools` to the persona conversation/tool loop. They use the same
+fail-closed `allowedTools` offer/execution gates; RBAC, tenant, redaction,
+bounded query results, and audit authority remain in the authenticated
+`PrincipalRun` supplied by `@happyvertical/smrt-agents`.
+
 ## Conversational Harness (L3, #1891)
 
 The "chat with your learning agent" surface — the real agentic runtime for `AgentSession` (the only shipping chat runtime before this was a single-shot completion). This is the new **acyclic `chat → personas` / `chat → agents` / `chat → users` edge**; keep it that way (personas/agents/users never depend back on chat).

package/README.md

@@ -8,6 +8,25 @@ Chat rooms, DMs, threads, and agent conversations for the s-m-r-t framework. Sup
 pnpm add @happyvertical/smrt-chat
 ```
 
+## Data-surface bridge security
+
+The `./data-surface-bridge` entry point is the server half of the browser data-
+surface protocol. Supply a transport adapter whose `subscribe` callback
+provides peer metadata derived from authenticated connection state (such as a
+bound WebSocket session or origin-checked `postMessage` peer). Never copy
+`sessionId` or `source` from an untrusted message into that metadata, and route
+`send` only to the authenticated peer.
+
+The bridge validates and bounds every command, acknowledgement, and event
+before it crosses the server boundary, using the shared identifier limit from
+`@happyvertical/smrt-ui/data-surface`. `authorize` remains the application’s
+responsibility and must fail closed. Commands are scoped to the configured
+session/source, expire by TTL, and are idempotent by command ID plus command
+signature; replay retention is bounded and capacity exhaustion returns an
+explicit `replay_capacity_exceeded` outcome. Invalid, stale, disconnected, or
+transport-failed work resolves with a protocol failure reason rather than
+trusting browser data or throwing raw transport errors.
+
 ## Usage
 
 ### Local dev server