@ours.network/fleet 0.13.1 → 0.13.2

package/dist/owner-channel/attachments.js

@@ -88,6 +88,16 @@ function parseTranscription(value, wireId) {
             fileWireId: wireId,
         } };
 }
+// Voice notes ride "<base>; x-ours-kind=voice-message" verbatim end to end
+// (the recorder's real container varies: audio/webm Chrome/Android, audio/mp4
+// iOS Safari, audio/ogg fallback), so policy for voice messages applies to the
+// base container type. Ordinary files keep exact allowlist matching.
+function baseMime(mime) {
+    return mime.split(';')[0].trim();
+}
+function policyMime(file) {
+    return file.kind === 'voice_message' ? baseMime(file.mime) : file.mime;
+}
 export function validateAttachmentSelection(files, config) {
     if (!config.enabled)
         return 'attachments are disabled for this owner channel';
@@ -95,7 +105,10 @@ export function validateAttachmentSelection(files, config) {
         return `the request exceeds the ${config.max_files_per_request}-file limit`;
     let total = 0;
     for (const file of files) {
-        if (!config.allowed_mime.includes(file.mime))
+        const mime = policyMime(file);
+        if (file.kind === 'voice_message' && !mime.startsWith('audio/'))
+            return `voice-message MIME type ${file.mime || '(missing)'} is not an audio container`;
+        if (!config.allowed_mime.includes(mime))
             return `MIME type ${file.mime || '(missing)'} is not allowed`;
         if (file.size > config.max_file_bytes)
             return `a file exceeds the ${config.max_file_bytes}-byte limit`;
@@ -148,9 +161,10 @@ export async function admitAttachments(files, dir, config) {
         total += bytes.length;
         if (total > config.max_request_bytes)
             throw new Error('retrieved attachments exceed the request size limit');
-        const detectedMime = detectMime(bytes, file.mime);
-        if (!mimeCompatible(file.mime, detectedMime))
-            throw new Error(`retrieved attachment content does not match declared MIME ${file.mime}`);
+        const declaredMime = policyMime(file);
+        const detectedMime = detectMime(bytes, declaredMime);
+        if (!mimeCompatible(declaredMime, detectedMime))
+            throw new Error(`retrieved attachment content does not match declared MIME ${declaredMime}`);
         const filename = sanitizeFilename(file.filename);
         const finalPath = join(dir, `${index + 1}-${file.wireId.slice(0, 12)}-${filename}`);
         const tmp = join(dir, `.${basename(finalPath)}.${randomUUID()}.tmp`);
@@ -175,7 +189,7 @@ export async function admitAttachments(files, dir, config) {
         await rm(tmp, { force: true });
         await chmod(finalPath, 0o600);
         admitted.push({
-            wireId: file.wireId, filename, path: finalPath, declaredMime: file.mime,
+            wireId: file.wireId, filename, path: finalPath, declaredMime,
             detectedMime, size: bytes.length, sha256: digest, kind: file.kind,
             ...(file.transcription ? { transcription: {
                     configured: file.transcription.configured, attempted: file.transcription.attempted,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",