@securecoms/agent-bridge 0.1.0 → 0.3.0

package/README.md

@@ -363,6 +363,25 @@ The loopback hop carries plaintext by design — the agent is the endpoint and t
 
 ---
 
+## Attachments and any-language agents
+
+The daemon is the universal substrate: an agent in any language (Python, Go,
+TypeScript, ...) connects over the local loopback WS/HTTP and never speaks MLS
+itself. The daemon performs all MLS encryption/decryption in TypeScript and hands
+the agent **plaintext** — message text and, for attachments, a **local file path**.
+
+- **Receiving an attachment:** the delivered message includes
+  `attachments: [{ filename, mime, size, path, sha256 }]`. Read the file at `path`
+  (saved under `<store-dir>/attachments/<channel>/`). No MLS, no key handling.
+- **Sending an attachment:** `POST /v1/send-attachment` with
+  `{ "channel_id": "...", "path": "/local/file.png", "caption": "optional" }`.
+  The daemon reads, encrypts, uploads, and dispatches it.
+
+This is why Python agents (which have no native MLS library) fully support
+attachments: the cryptography lives in the daemon, not the agent.
+
+---
+
 ## Flags and environment
 
 | Flag | Env var | Default | Description |

package/dist/bin.d.ts

@@ -1,3 +1,13 @@
 #!/usr/bin/env node
 export declare function nodeMajorOk(version: string): boolean;
+/**
+ * P0b (daemon-stability): a redacted fingerprint of a bearer token for logs —
+ * a short prefix plus the total length, never the raw value. Lets an
+ * operator eyeball "yes, a token was loaded, and it looks like the one I
+ * expect" without the full secret ever hitting stderr (see the tokenFile
+ * comment at the top of this file). Mirrors the install-path token hint's
+ * philosophy of pointing at the token FILE rather than printing the secret
+ * (see service/install.ts's tokenHint, which returns the bridge-token path).
+ */
+export declare function tokenFingerprint(token: string): string;
 export declare function parseVerb(argv: string[]): "install" | "uninstall" | null;