@securecoms/agent-bridge 0.19.0 → 0.21.0

package/README.md

@@ -1,5 +1,24 @@
 # @agentvault/connect-agent-bridge
 
+## Non-destructive runtime reply monitoring
+
+Attached runtimes should include the inbound `message_id` as `in_reply_to` on
+their outbound `send` frame/request. After the encrypted send publishes, the
+bridge retains a bounded, 15-minute content-free receipt and exposes it at the
+bearer-gated loopback route:
+
+```text
+GET /v1/reply-receipt?in_reply_to=<message_id>
+```
+
+The response is either `{ "found": false }` or a receipt containing only the
+inbound message id, outbound message id, channel id, and publish timestamp. It
+contains no prompt or reply text. `scripts/agent-reply-probe.mjs` uses this
+surface and never calls `/v1/messages`, `/v1/events`, or `/v1/ws`, so routine
+monitoring cannot compete with or evict the attached runtime. The older
+`scripts/fleet-probe.mjs` remains an attended promotion tool because it drains
+the single-consumer stream to inspect reply plaintext.
+
 An always-on local daemon that holds an AI agent's SecureComs credential and MLS state, then exposes a loopback API so any agent — Python, Node, Go, shell scripts, whatever — can send and receive end-to-end encrypted messages without touching any cryptography itself. All MLS key agreement, AEAD encryption, and channel admission happen inside the daemon.
 
 The daemon serves two interfaces on the same port:
@@ -217,12 +236,32 @@ All frames are JSON text.
 **Daemon → agent**
 
 ```
-{ "type":"message", "channel_id":"...", "message_id":"...", "sender_id":"...", "text":"...", "ts": 1234567890 }
+{ "type":"message", "channel_id":"...", "message_id":"...", "sender_id":"...", "text":"...", "ts": 1234567890,
+  "authorization": { "version":1, "audience":"owner_dm"|"team_room"|"partner_room"|"other_human_dm"|"agent_to_agent"|"unknown",
+    "sender_membership":"active"|"unknown", "tool_grants":[] } }
 { "type":"sent", "message_id":"..." }                       // acks your send
 { "type":"ok" }                                             // acks your status report
 { "type":"error", "error":"channel_pending"|"invalid_request", "message":"...", "detail":"..." }
 ```
 
+The daemon derives `authorization` only from the authenticated channel and
+roster APIs; message text, display names, and model output cannot set it.
+Missing or stale roster data produces `unknown` with no grants. This release
+deliberately issues no channel tool grants while grant persistence and owner
+controls are staged, so consumers must treat `tool_grants:[]` as authoritative.
+Future side-effect grants will also bind an exact operation digest,
+confirmation id, idempotency key, and expiry rather than granting a tool name
+globally.
+
+When `memory.provider` is `openclaw`, OpenClaw text history and workspace facts
+are owner-DM-only. The live fast path consumes them only when the immutable
+turn authorization says `owner_dm` with active membership. The loopback memory
+context API independently refreshes authenticated channel/roster metadata and
+returns an empty context unless the channel is a DM with exactly one non-agent
+human counterpart and that counterpart is the agent owner. Missing, stale,
+ambiguous, room, partner, other-human, and agent-to-agent state therefore fails
+closed without exposing OpenClaw memory.
+
 **Agent → daemon**
 
 ```

package/connectors/hermes/adapter.py

@@ -406,7 +406,11 @@ class SecureComsAdapter(BasePlatformAdapter):
             async with self._session.post(
                 f"{self.bridge_url}/v1/send",
                 headers=self._auth(),
-                json={"channel_id": chat_id, "text": content},
+                json={
+                    "channel_id": chat_id,
+                    "text": content,
+                    **({"in_reply_to": reply_to} if reply_to else {}),
+                },
             ) as r:
                 if r.status == 200:
                     j = await r.json()

package/connectors/hermes/tests/test_adapter_wiring.py

@@ -344,10 +344,15 @@ class TestSendWiring:
         a.bridge_url = "http://127.0.0.1:9001"
         a._token = "tok"
 
-        result = await a.send("chan-1", "hello")
+        result = await a.send("chan-1", "hello", reply_to="inbound-7")
 
         assert result.success is True
         assert calls == ["chan-1"]
+        assert a._session.post_calls[0][2] == {
+            "channel_id": "chan-1",
+            "text": "hello",
+            "in_reply_to": "inbound-7",
+        }
 
     @pytest.mark.asyncio
     async def test_send_failure_does_not_fire_on_reply_posted(self, monkeypatch):

package/connectors/openclaw/openclaw-entry.js

@@ -169,7 +169,7 @@ function listAccountIds(cfg) {
 // Dependency-free: Node 22 global WebSocket + global fetch.
 // ---------------------------------------------------------------------------
 
-class LoopbackChannel {
+export class LoopbackChannel {
   constructor({ boundIdentity, sc, onMessage, onStateChange, log }) {
     // Fixed for the connector's life (spec §4.3): re-derived nowhere below.
     this.boundIdentity = boundIdentity;
@@ -343,11 +343,15 @@ class LoopbackChannel {
   }
 
   /** Send a reply into a specific SecureComs channel via the daemon. */
-  async send(channelId, text) {
+  async send(channelId, text, inReplyTo) {
     const r = await fetch(`${this.bridgeUrl}/v1/send`, {
       method: "POST",
       headers: { "content-type": "application/json", authorization: `Bearer ${this.token}` },
-      body: JSON.stringify({ channel_id: channelId, text }),
+      body: JSON.stringify({
+        channel_id: channelId,
+        text,
+        ...(inReplyTo ? { in_reply_to: inReplyTo } : {}),
+      }),
     });
     if (!r.ok) throw new Error(`send failed: ${r.status} ${(await r.text()).slice(0, 200)}`);
     return r.json();
@@ -466,7 +470,7 @@ async function _handleInbound({ text, metadata, channel, account, cfg }) {
           // Drop chain-of-thought / reasoning blocks; only send finalized text.
           if (payload?.kind === "thinking" || payload?.kind === "reasoning") return;
           const t = (payload?.text ?? "").trim();
-          if (t) await channel.send(conv, t);
+          if (t) await channel.send(conv, t, metadata.messageId);
         },
         onError: (err, info) => core.error?.(`[SecureComs] ${info?.kind ?? "reply"} error: ${String(err)}`),
       },

package/connectors/openclaw/openclaw-entry.smoke.test.ts

@@ -1,7 +1,9 @@
-import { describe, it, expect } from "vitest";
+import { afterEach, describe, it, expect, vi } from "vitest";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
+afterEach(() => vi.unstubAllGlobals());
+
 describe("openclaw-entry", () => {
   it("loads as ESM and exposes the plugin entry without connecting", async () => {
     const mod = await import("./openclaw-entry.js");
@@ -27,4 +29,24 @@ describe("openclaw-entry", () => {
     expect(topLevel).not.toMatch(/new WebSocket\(/);
     expect(topLevel).not.toMatch(/\bfetch\(/);
   });
+
+  it("posts content-free inbound correlation with a runtime reply", async () => {
+    const requests: Array<Record<string, unknown>> = [];
+    vi.stubGlobal("fetch", async (_url: string, init: RequestInit) => {
+      requests.push(JSON.parse(String(init.body)) as Record<string, unknown>);
+      return { ok: true, json: async () => ({ message_id: "out-1" }) };
+    });
+    const { LoopbackChannel } = await import("./openclaw-entry.js");
+    const channel = new LoopbackChannel({ boundIdentity: "agent-1" });
+    channel.bridgeUrl = "http://127.0.0.1:7090";
+    channel.token = "token";
+
+    await channel.send("channel-1", "reply text", "inbound-1");
+
+    expect(requests).toEqual([{
+      channel_id: "channel-1",
+      text: "reply text",
+      in_reply_to: "inbound-1",
+    }]);
+  });
 });