@securecoms/agent-bridge 0.20.0 → 0.21.0

package/dist/bin.js

@@ -5460,8 +5460,11 @@ var RestMlsBackend = class {
       queue_ids: queueIds
     });
   }
-  async nackDelivery(_deviceId, queueIds) {
-    await this.post("/api/v1/mls/delivery/nack", { queue_ids: queueIds });
+  async nackDelivery(deviceId, queueIds) {
+    await this.post("/api/v1/mls/delivery/nack", {
+      device_id: deviceId,
+      queue_ids: queueIds
+    });
   }
   async listGroupMessages(deviceId, groupId, opts) {
     const params = new URLSearchParams({ device_id: deviceId, limit: String(opts?.limit ?? 100) });
@@ -5969,7 +5972,7 @@ import { DatabaseSync } from "node:sqlite";
 import { MLSGroupManager as MLSGroupManager3, bytesToHex as bytesToHex4, hexToBytes as hexToBytes3 } from "@agentvault/crypto";
 
 // ../connect-mls-store/dist/schema.js
-var SCHEMA_VERSION = 6;
+var SCHEMA_VERSION = 7;
 function openSchema(db) {
   db.exec("PRAGMA journal_mode=WAL");
   const row = db.prepare("PRAGMA user_version").get();
@@ -6061,6 +6064,17 @@ function openSchema(db) {
       );
     `);
   }
+  if (row.user_version < 7) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS agent_memory_fact_assignment (
+        identity_id     TEXT NOT NULL,
+        assignment_key  TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        applied_at      INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, assignment_key)
+      );
+    `);
+  }
   db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
 }
 
@@ -6100,6 +6114,10 @@ function decodeBundle(bytes) {
     }
   };
 }
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_MEMORY_RETENTION_MS = 30 * DAY_MS;
+var DEFAULT_MEMORY_FACT_RETENTION_K = 200;
+var DEFAULT_MEMORY_FACT_RETENTION_MS = 90 * DAY_MS;
 var SqliteMlsStateStore = class {
   db;
   id;
@@ -6113,6 +6131,10 @@ var SqliteMlsStateStore = class {
   bundles = /* @__PURE__ */ new Map();
   lastKpIds = /* @__PURE__ */ new Map();
   memoryRetentionK;
+  memoryRetentionMs;
+  memoryFactRetentionK;
+  memoryFactRetentionMs;
+  memoryNow;
   // M0(b)/F4-1 + C1 + H2: in-memory ONLY for now — the daemon side of FileSafe
   // (this store) isn't wired into the multi-member vault yet (Task 5's capture
   // sites are all connect-web/browser owner paths). Kept here purely so
@@ -6127,6 +6149,10 @@ var SqliteMlsStateStore = class {
     this.id = opts.identityId;
     this.cipher = opts.cipherFor(opts.identityId);
     this.memoryRetentionK = opts.memoryRetentionK ?? 500;
+    this.memoryRetentionMs = opts.memoryRetentionMs ?? DEFAULT_MEMORY_RETENTION_MS;
+    this.memoryFactRetentionK = opts.memoryFactRetentionK ?? DEFAULT_MEMORY_FACT_RETENTION_K;
+    this.memoryFactRetentionMs = opts.memoryFactRetentionMs ?? DEFAULT_MEMORY_FACT_RETENTION_MS;
+    this.memoryNow = opts.memoryNow ?? Date.now;
     try {
       this.db = new DatabaseSync(opts.dbPath);
     } catch (e) {
@@ -6344,23 +6370,24 @@ var SqliteMlsStateStore = class {
     const dedupKey = input.messageId ?? input.idempotencyKey ?? null;
     if (!dedupKey)
       throw new Error("recordMemory requires message_id or idempotency_key");
+    const now = this.memoryNow();
+    this.pruneMemory(input.conversationId, now);
     const sealed = await this.cipher.seal(new TextEncoder().encode(input.text));
     const info = this.db.prepare(`INSERT OR IGNORE INTO agent_memory
          (identity_id, conversation_id, seq, role, peer_id, sealed_text, modality, message_id, idempotency_key, dedup_key, recorded_at)
        VALUES (?, ?,
          (SELECT COALESCE(MAX(seq),0)+1 FROM agent_memory WHERE identity_id=? AND conversation_id=?),
-         ?, ?, ?, ?, ?, ?, ?, ?)`).run(this.id, input.conversationId, this.id, input.conversationId, input.role, input.peerId ?? null, sealed, input.modality, input.messageId ?? null, input.idempotencyKey ?? null, dedupKey, Date.now());
+         ?, ?, ?, ?, ?, ?, ?, ?)`).run(this.id, input.conversationId, this.id, input.conversationId, input.role, input.peerId ?? null, sealed, input.modality, input.messageId ?? null, input.idempotencyKey ?? null, dedupKey, now);
     if (info.changes === 0) {
       const row2 = this.db.prepare("SELECT seq FROM agent_memory WHERE identity_id=? AND conversation_id=? AND dedup_key=?").get(this.id, input.conversationId, dedupKey);
       return { seq: row2.seq, deduped: true };
     }
     const row = this.db.prepare("SELECT MAX(seq) AS seq FROM agent_memory WHERE identity_id=? AND conversation_id=?").get(this.id, input.conversationId);
-    if (this.memoryRetentionK > 0) {
-      this.db.prepare("DELETE FROM agent_memory WHERE identity_id=? AND conversation_id=? AND seq <= ?").run(this.id, input.conversationId, row.seq - this.memoryRetentionK);
-    }
+    this.pruneMemoryTurns(input.conversationId, now);
     return { seq: row.seq, deduped: false };
   }
   async memoryContext(conversationId, limit = 50) {
+    this.pruneMemory(conversationId, this.memoryNow());
     const rows = this.db.prepare(`SELECT seq, role, peer_id, sealed_text, recorded_at FROM agent_memory
        WHERE identity_id=? AND conversation_id=? ORDER BY seq DESC LIMIT ?`).all(this.id, conversationId, limit);
     const recent = [];
@@ -6375,9 +6402,94 @@ var SqliteMlsStateStore = class {
     return { recent, facts };
   }
   async recordMemoryFact(conversationId, fact) {
+    const now = this.memoryNow();
     const sealed = await this.cipher.seal(new TextEncoder().encode(fact));
     this.db.prepare(`INSERT INTO agent_memory_fact (identity_id, conversation_id, fact_id, sealed_fact, added_at)
-       VALUES (?, ?, (SELECT COALESCE(MAX(fact_id),0)+1 FROM agent_memory_fact WHERE identity_id=? AND conversation_id=?), ?, ?)`).run(this.id, conversationId, this.id, conversationId, sealed, Date.now());
+       VALUES (?, ?, (SELECT COALESCE(MAX(fact_id),0)+1 FROM agent_memory_fact WHERE identity_id=? AND conversation_id=?), ?, ?)`).run(this.id, conversationId, this.id, conversationId, sealed, now);
+    this.pruneMemoryFacts(conversationId, now);
+  }
+  /**
+   * Import one owner-approved legacy fact exactly once. `assignmentKey` is
+   * content-free (`source-id:line-hash`) and intentionally excludes the target
+   * channel: the same legacy fact can therefore never be replayed into a
+   * second audience. The ledger and sealed fact commit atomically.
+   */
+  async recordImportedMemoryFact(conversationId, fact, assignmentKey) {
+    if (!/^[0-9a-f]{64}:[0-9a-f]{64}$/.test(assignmentKey)) {
+      throw new Error("invalid legacy memory assignment key");
+    }
+    const existing = this.db.prepare(`SELECT conversation_id FROM agent_memory_fact_assignment
+       WHERE identity_id=? AND assignment_key=?`).get(this.id, assignmentKey);
+    if (existing) {
+      if (existing.conversation_id !== conversationId) {
+        throw new Error("legacy memory fact is already assigned to another channel");
+      }
+      return { factId: 0, deduped: true };
+    }
+    const now = this.memoryNow();
+    const sealed = await this.cipher.seal(new TextEncoder().encode(fact));
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const raced = this.db.prepare(`SELECT conversation_id FROM agent_memory_fact_assignment
+         WHERE identity_id=? AND assignment_key=?`).get(this.id, assignmentKey);
+      if (raced) {
+        if (raced.conversation_id !== conversationId) {
+          throw new Error("legacy memory fact is already assigned to another channel");
+        }
+        this.db.exec("COMMIT");
+        return { factId: 0, deduped: true };
+      }
+      const row = this.db.prepare("SELECT COALESCE(MAX(fact_id),0)+1 AS fact_id FROM agent_memory_fact WHERE identity_id=? AND conversation_id=?").get(this.id, conversationId);
+      this.db.prepare(`INSERT INTO agent_memory_fact (identity_id, conversation_id, fact_id, sealed_fact, added_at)
+         VALUES (?, ?, ?, ?, ?)`).run(this.id, conversationId, row.fact_id, sealed, now);
+      this.db.prepare(`INSERT INTO agent_memory_fact_assignment (identity_id, assignment_key, conversation_id, applied_at)
+         VALUES (?, ?, ?, ?)`).run(this.id, assignmentKey, conversationId, now);
+      this.pruneMemoryFacts(conversationId, now);
+      this.db.exec("COMMIT");
+      return { factId: row.fact_id, deduped: false };
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  /** Remove every durable turn and fact in one channel-scoped namespace. */
+  purgeMemory(conversationId) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      this.db.prepare("DELETE FROM agent_memory WHERE identity_id=? AND conversation_id=?").run(this.id, conversationId);
+      this.db.prepare("DELETE FROM agent_memory_fact WHERE identity_id=? AND conversation_id=?").run(this.id, conversationId);
+      this.db.prepare("DELETE FROM agent_memory_fact_assignment WHERE identity_id=? AND conversation_id=?").run(this.id, conversationId);
+      this.db.exec("COMMIT");
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  pruneMemory(conversationId, now) {
+    this.pruneMemoryTurns(conversationId, now);
+    this.pruneMemoryFacts(conversationId, now);
+  }
+  pruneMemoryTurns(conversationId, now) {
+    if (this.memoryRetentionMs > 0) {
+      this.db.prepare("DELETE FROM agent_memory WHERE identity_id=? AND conversation_id=? AND recorded_at < ?").run(this.id, conversationId, now - this.memoryRetentionMs);
+    }
+    if (this.memoryRetentionK > 0) {
+      const row = this.db.prepare("SELECT MAX(seq) AS seq FROM agent_memory WHERE identity_id=? AND conversation_id=?").get(this.id, conversationId);
+      if (row.seq != null) {
+        this.db.prepare("DELETE FROM agent_memory WHERE identity_id=? AND conversation_id=? AND seq <= ?").run(this.id, conversationId, row.seq - this.memoryRetentionK);
+      }
+    }
+  }
+  pruneMemoryFacts(conversationId, now) {
+    if (this.memoryFactRetentionMs > 0) {
+      this.db.prepare("DELETE FROM agent_memory_fact WHERE identity_id=? AND conversation_id=? AND added_at < ?").run(this.id, conversationId, now - this.memoryFactRetentionMs);
+    }
+    if (this.memoryFactRetentionK > 0) {
+      const row = this.db.prepare("SELECT MAX(fact_id) AS fact_id FROM agent_memory_fact WHERE identity_id=? AND conversation_id=?").get(this.id, conversationId);
+      if (row.fact_id != null) {
+        this.db.prepare("DELETE FROM agent_memory_fact WHERE identity_id=? AND conversation_id=? AND fact_id <= ?").run(this.id, conversationId, row.fact_id - this.memoryFactRetentionK);
+      }
+    }
   }
   /** @internal test-only */
   _rawMainForTest(identityId, channelId) {
@@ -7469,6 +7581,7 @@ import { createHash, randomUUID } from "node:crypto";
 import {
   chmodSync,
   existsSync,
+  lstatSync,
   mkdirSync,
   readFileSync as readFileSync6,
   renameSync,
@@ -7476,7 +7589,7 @@ import {
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { basename as basename2, join as join8 } from "node:path";
+import { basename as basename2, isAbsolute, join as join8 } from "node:path";
 var MEMORY_FILE = "MEMORY.md";
 var REAL_FS = {
   mkdir: (p, mode) => mkdirSync(p, { recursive: true, mode }),
@@ -7551,6 +7664,54 @@ function lineHash(line) {
   return createHash("sha256").update(line.trim(), "utf8").digest("hex");
 }
 var LOCAL_REPORT_FILE = "local-config.json";
+var LEGACY_MEMORY_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
+var LEGACY_MEMORY_REPORT_MAX_BYTES = 4 * 1024 * 1024;
+var LEGACY_MEMORY_REPORT_MAX_SOURCES = 100;
+var LEGACY_MEMORY_FACT_MAX_BYTES = 1024;
+var LEGACY_MEMORY_FACT_DECISION_MAX = 500;
+function legacySourceId(source, bytes) {
+  return createHash("sha256").update(source.kind).update("\0").update(source.channel_id ?? "").update("\0").update(source.path).update("\0").update(bytes).digest("hex");
+}
+function localLegacySources(doc) {
+  if (!Array.isArray(doc.legacy_memory)) return [];
+  const out = [];
+  let contentBudget = LEGACY_MEMORY_REPORT_MAX_BYTES;
+  for (const raw of doc.legacy_memory) {
+    if (out.length >= LEGACY_MEMORY_REPORT_MAX_SOURCES) break;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const source = raw;
+    const kind = source.kind;
+    const path = source.path;
+    const channelId = source.channelId;
+    if (kind !== "global-memory" && kind !== "conversation-history" && kind !== "captured-memory" || typeof path !== "string" || !isAbsolute(path) || channelId !== void 0 && typeof channelId !== "string") continue;
+    try {
+      const st = lstatSync(path);
+      if (!st.isFile() || st.isSymbolicLink()) continue;
+      if (st.size <= LEGACY_MEMORY_SOURCE_MAX_BYTES && st.size > contentBudget) continue;
+      const oversize = st.size > LEGACY_MEMORY_SOURCE_MAX_BYTES;
+      const bytes = oversize ? Buffer.from(`oversize:${st.size}:${st.mtimeMs}:${st.ctimeMs}`, "utf8") : Buffer.from(readFileSync6(path));
+      if (!oversize && (bytes.byteLength > LEGACY_MEMORY_SOURCE_MAX_BYTES || bytes.byteLength > contentBudget)) {
+        continue;
+      }
+      const exportable = !oversize;
+      const candidate = {
+        id: "",
+        kind,
+        ...typeof channelId === "string" && channelId ? { channel_id: channelId } : {},
+        path,
+        content: exportable ? bytes.toString("utf8") : null,
+        bytes: exportable ? bytes.byteLength : st.size,
+        exportable
+      };
+      candidate.id = legacySourceId(candidate, bytes);
+      if (source.id !== candidate.id) continue;
+      out.push(candidate);
+      if (exportable) contentBudget -= bytes.byteLength;
+    } catch {
+    }
+  }
+  return out;
+}
 function readLocalReport(home, identityId) {
   const p = join8(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync(p)) return null;
@@ -7567,7 +7728,93 @@ function readLocalReport(home, identityId) {
   const persona = raw && typeof raw === "object" && !Array.isArray(raw) ? Object.fromEntries(
     Object.entries(raw).filter(([, v]) => typeof v === "string")
   ) : {};
-  return { persona, has_search_key: hasSearchKey, has_llm_key: hasLlmKey };
+  return {
+    persona,
+    has_search_key: hasSearchKey,
+    has_llm_key: hasLlmKey,
+    legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source)
+  };
+}
+function deleteLegacyMemorySources(home, identityId, ids) {
+  if (ids.length === 0) return 0;
+  const p = join8(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  if (!existsSync(p)) return 0;
+  let doc;
+  try {
+    doc = JSON.parse(readFileSync6(p, "utf8"));
+  } catch {
+    return 0;
+  }
+  const wanted = new Set(ids);
+  let deleted = 0;
+  for (const source of localLegacySources(doc)) {
+    if (!wanted.has(source.id)) continue;
+    try {
+      unlinkSync(source.path);
+      deleted += 1;
+    } catch {
+    }
+  }
+  return deleted;
+}
+async function applyLegacyMemoryFactDecisions(home, identityId, rawDecisions, recordFact) {
+  if (!Array.isArray(rawDecisions) || rawDecisions.length > LEGACY_MEMORY_FACT_DECISION_MAX) {
+    return { sourcesDeleted: 0, factsAssigned: 0 };
+  }
+  const bySource = /* @__PURE__ */ new Map();
+  for (const raw of rawDecisions) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      return { sourcesDeleted: 0, factsAssigned: 0 };
+    }
+    const d = raw;
+    if (typeof d.source_id !== "string" || !/^[0-9a-f]{64}$/.test(d.source_id) || typeof d.fact_hash !== "string" || !/^[0-9a-f]{64}$/.test(d.fact_hash) || d.action !== "assign" && d.action !== "delete" || d.action === "assign" && (typeof d.channel_id !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(d.channel_id)) || d.action === "delete" && d.channel_id !== void 0) return { sourcesDeleted: 0, factsAssigned: 0 };
+    const decision = d;
+    const current = bySource.get(decision.source_id);
+    if (current === null) continue;
+    const group = current ?? /* @__PURE__ */ new Map();
+    const prior = group.get(decision.fact_hash);
+    if (prior && (prior.action !== decision.action || prior.channel_id !== decision.channel_id)) {
+      bySource.set(decision.source_id, null);
+      continue;
+    }
+    group.set(decision.fact_hash, decision);
+    bySource.set(decision.source_id, group);
+  }
+  const reportPath = join8(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  if (!existsSync(reportPath)) return { sourcesDeleted: 0, factsAssigned: 0 };
+  let doc;
+  try {
+    doc = JSON.parse(readFileSync6(reportPath, "utf8"));
+  } catch {
+    return { sourcesDeleted: 0, factsAssigned: 0 };
+  }
+  let sourcesDeleted = 0;
+  let factsAssigned = 0;
+  for (const source of localLegacySources(doc)) {
+    const decisions = bySource.get(source.id);
+    if (!decisions || source.kind !== "global-memory" || source.content === null) continue;
+    const facts = source.content.split("\n").map((line) => line.trim()).filter(Boolean);
+    const currentHashes = new Set(facts.map(lineHash));
+    if (currentHashes.size === 0 || decisions.size !== currentHashes.size || [...currentHashes].some((hash) => !decisions.has(hash)) || [...decisions].some(([hash]) => !currentHashes.has(hash))) continue;
+    const uniqueFacts = /* @__PURE__ */ new Map();
+    for (const fact of facts) uniqueFacts.set(lineHash(fact), fact);
+    const assignments = [...decisions].filter(([, decision]) => decision.action === "assign");
+    if (assignments.some(([hash]) => Buffer.byteLength(uniqueFacts.get(hash) ?? "", "utf8") > LEGACY_MEMORY_FACT_MAX_BYTES)) {
+      continue;
+    }
+    try {
+      for (const [hash, decision] of assignments) {
+        await recordFact(decision.channel_id, uniqueFacts.get(hash), `${source.id}:${hash}`);
+        factsAssigned += 1;
+      }
+      const stillCurrent = localLegacySources(doc).some((candidate) => candidate.id === source.id);
+      if (!stillCurrent) continue;
+      unlinkSync(source.path);
+      sourcesDeleted += 1;
+    } catch {
+    }
+  }
+  return { sourcesDeleted, factsAssigned };
 }
 function readManagedMemory(home, identityId) {
   const p = join8(runtimeConfigDir(home, identityId), MEMORY_FILE);
@@ -7596,6 +7843,51 @@ function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
 
 // src/bridge-agent.ts
 import { homedir as homedir2 } from "node:os";
+
+// src/reply-receipts.ts
+var DEFAULT_TTL_MS = 15 * 60 * 1e3;
+var DEFAULT_CAPACITY2 = 256;
+var RuntimeReplyReceiptLedger = class {
+  receipts = /* @__PURE__ */ new Map();
+  ttlMs;
+  capacity;
+  now;
+  constructor(opts = {}) {
+    this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+    this.capacity = opts.capacity ?? DEFAULT_CAPACITY2;
+    this.now = opts.now ?? Date.now;
+    if (!Number.isFinite(this.ttlMs) || this.ttlMs <= 0) throw new Error("reply receipt ttlMs must be positive");
+    if (!Number.isInteger(this.capacity) || this.capacity <= 0) throw new Error("reply receipt capacity must be positive");
+  }
+  record(inReplyTo, channelId, replyMessageId) {
+    const receipt = Object.freeze({
+      in_reply_to: inReplyTo,
+      reply_message_id: replyMessageId,
+      channel_id: channelId,
+      replied_at: this.now()
+    });
+    this.prune(receipt.replied_at);
+    this.receipts.delete(inReplyTo);
+    this.receipts.set(inReplyTo, receipt);
+    while (this.receipts.size > this.capacity) {
+      const oldest = this.receipts.keys().next().value;
+      if (oldest === void 0) break;
+      this.receipts.delete(oldest);
+    }
+    return receipt;
+  }
+  get(inReplyTo) {
+    this.prune(this.now());
+    return this.receipts.get(inReplyTo) ?? null;
+  }
+  prune(now) {
+    for (const [key, receipt] of this.receipts) {
+      if (now - receipt.replied_at >= this.ttlMs) this.receipts.delete(key);
+    }
+  }
+};
+
+// src/bridge-agent.ts
 var VOICE_MODE_GUIDANCE = "Reply immediately and conversationally, one short sentence per message; never bundle multiple points into one message.";
 var FAST_PATH_SPOKEN_GUIDANCE = "A one-sentence spoken acknowledgement has already been sent for this turn. Reply only with information it did not contain, in one or two short sentences; if there is nothing to add, send nothing.";
 var ROOM_VOICE_GUIDANCE_MENTION_ONLY = "You are in a group voice room. Reply ONLY when a message @mentions your display name. Keep replies to one short sentence. When you should not reply, send nothing.";
@@ -7865,6 +8157,12 @@ var BridgeAgent = class _BridgeAgent {
   channelOwner = /* @__PURE__ */ new Map();
   buffer = [];
   maxBuffer;
+  /**
+   * Short-lived, content-free runtime reply correlations. The attached runtime
+   * supplies the inbound message id only when an outbound send is its reply;
+   * ws-server/http-server record the receipt after send() publishes.
+   */
+  runtimeReplyReceipts = new RuntimeReplyReceiptLedger();
   /** Cumulative count of messages shed by the buffer cap (surfaced on health()/metrics()). */
   droppedMessages = 0;
   /**
@@ -8090,6 +8388,7 @@ var BridgeAgent = class _BridgeAgent {
   waiters = [];
   pingHandle;
   safetyTimer;
+  runtimeConfigTimer;
   listeners = /* @__PURE__ */ new Set();
   startedAt = 0;
   store;
@@ -8199,25 +8498,65 @@ var BridgeAgent = class _BridgeAgent {
       });
       if (!res.ok) throw new Error(`runtime-config ${res.status}`);
       const payload = await res.json();
-      if (!payload || !payload.version) {
+      if (!payload) {
+        process.stderr.write("[bridge] runtime config not applied (empty response)\n");
+        return;
+      }
+      if (typeof payload.version !== "number") {
         process.stderr.write(
-          `[bridge] runtime config not applied (version ${JSON.stringify(payload?.version ?? null)} \u2014 no saved config)
+          `[bridge] runtime config not applied (version ${JSON.stringify(payload.version ?? null)} \u2014 invalid response)
 `
         );
         return;
       }
+      const version = payload.version;
+      if (!version) {
+        writeManagedFiles(this.home, this.cfg.identityId, {});
+        process.stderr.write(
+          `[bridge] runtime config not applied (version ${JSON.stringify(payload?.version ?? null)} \u2014 no saved config)
+`
+        );
+      }
       const skillsJson = payload.skills_json ?? {};
-      writeManagedFiles(this.home, this.cfg.identityId, {
-        ...payload.files ?? {},
-        "skills.json": `${JSON.stringify(skillsJson, null, 2)}
+      if (version) {
+        writeManagedFiles(this.home, this.cfg.identityId, {
+          ...payload.files ?? {},
+          "skills.json": `${JSON.stringify(skillsJson, null, 2)}
 `
-      });
+        });
+      }
       if (payload.memory_prunes?.length) {
         pruneManagedMemory(this.home, this.cfg.identityId, payload.memory_prunes);
       }
+      if (payload.legacy_memory_deletes?.length) {
+        deleteLegacyMemorySources(this.home, this.cfg.identityId, payload.legacy_memory_deletes);
+      }
+      if (payload.legacy_memory_fact_decisions?.length) {
+        const provider = this.cfg.memoryProvider ?? "securecoms";
+        const result = await applyLegacyMemoryFactDecisions(
+          this.home,
+          this.cfg.identityId,
+          payload.legacy_memory_fact_decisions,
+          async (channelId, fact, assignmentKey) => {
+            if (provider === "none" || provider === "hermes") {
+              throw new Error("configured memory provider has no protected channel-fact import path");
+            }
+            if (provider === "openclaw" && !await this.mayReadOpenClawMemory(channelId)) {
+              throw new Error("OpenClaw legacy fact target is not the active owner DM");
+            }
+            await this.store.recordImportedMemoryFact(channelId, fact, assignmentKey);
+          }
+        );
+        if (result.sourcesDeleted > 0) {
+          process.stderr.write(
+            `[bridge] legacy-memory disposition applied (sources=${result.sourcesDeleted}, assigned=${result.factsAssigned})
+`
+          );
+        }
+      }
       const local = readLocalReport(this.home, this.cfg.identityId);
       const report = {
-        applied_version: payload.version,
+        applied_version: version,
         paths: checkConfiguredPaths(skillsJson),
         // Read AFTER the prunes above, so the owner's next view of memory is
         // the file as it now stands, not the one they just pruned from.
@@ -8232,7 +8571,15 @@ var BridgeAgent = class _BridgeAgent {
         has_search_key: local?.has_search_key ?? false,
         // Same idea, for the BYOK LLM key file: only the runtime can see
         // whether one is configured in its own environment.
-        has_llm_key: local?.has_llm_key ?? false
+        has_llm_key: local?.has_llm_key ?? false,
+        // The backend uses this only to expose target channels compatible with
+        // the actual protected-memory adapter. It is an enum, never a path or
+        // provider credential.
+        memory_provider: this.cfg.memoryProvider ?? "securecoms",
+        // Inert legacy files only. `readLocalReport` revalidates the current
+        // regular-file bytes and strips every local path before this leaves the
+        // machine.
+        legacy_memory: local?.legacy_memory ?? []
       };
       const posted = await this.fetchImpl(`${base}/report`, {
         method: "POST",
@@ -8244,13 +8591,16 @@ var BridgeAgent = class _BridgeAgent {
       });
       if (!posted.ok) {
         process.stderr.write(
-          `[bridge] runtime config v${payload.version} written, but reporting it failed (${posted.status}) \u2014 the console will keep showing it as not applied until the next cycle
+          version ? `[bridge] runtime config v${version} written, but reporting it failed (${posted.status}) \u2014 the console will keep showing it as not applied until the next cycle
+` : `[bridge] legacy-memory inventory report failed (${posted.status}); no saved runtime config was applied
 `
         );
         return;
       }
-      process.stderr.write(`[bridge] runtime config v${payload.version} applied
-`);
+      process.stderr.write(
+        version ? `[bridge] runtime config v${version} applied
+` : "[bridge] legacy-memory inventory reported; no saved runtime config was applied\n"
+      );
     } catch (e) {
       process.stderr.write(
         `[bridge] runtime config refetch failed: ${e?.message ?? e}
@@ -8286,6 +8636,10 @@ var BridgeAgent = class _BridgeAgent {
     await this.provider.publishKeyPackage();
     await this.refetchVoiceSettings();
     await this.refetchRuntimeConfig();
+    this.runtimeConfigTimer = setInterval(() => {
+      void this.refetchRuntimeConfig();
+    }, 6 * 60 * 60 * 1e3);
+    this.runtimeConfigTimer.unref?.();
     this.startReceivePump();
     if (this.selfHealSweepEnabled) {
       this.bootSweepTimer = setTimeout(
@@ -9088,7 +9442,47 @@ var BridgeAgent = class _BridgeAgent {
   async recordMemory(input) {
     return this.memory.record(input);
   }
+  /**
+   * OpenClaw collapses text history and workspace facts into the owner's
+   * session. Resolve the channel from fresh, authenticated server metadata
+   * before exposing that provider through the local bridge API. A cold or
+   * stale cache is refreshed once; any failure remains a fail-closed denial.
+   */
+  async mayReadOpenClawMemory(channelId) {
+    if (this.cfg.memoryProvider !== "openclaw") return true;
+    if (!this.freshMeta(channelId)) await this.refreshChannelMeta();
+    if (!this.freshRoster(channelId)) await this.refreshChannelRoster(channelId);
+    const meta = this.freshMeta(channelId);
+    const roster = this.freshRoster(channelId);
+    if (meta?.is_dm !== true || !roster) return false;
+    const humanCounterparts = [...roster.entries()].filter(
+      ([identityId, member]) => identityId !== this.cfg.identityId && !member.is_agent
+    );
+    return humanCounterparts.length === 1 && humanCounterparts[0][1].is_agent_owner;
+  }
+  /** An inbound turn may receive OpenClaw memory only from an active owner DM. */
+  mayReadOpenClawMemoryForTurn(authorization) {
+    return this.cfg.memoryProvider !== "openclaw" || authorization.sender_membership === "active" && authorization.audience === "owner_dm";
+  }
+  /**
+   * Resolve the prior-turn snapshot carried to the native runtime. OpenClaw
+   * stays owner-DM-only; every provider failure degrades to empty context and
+   * never falls back to the runtime's retired plaintext JSON files.
+   */
+  async memoryForTurn(channelId, authorization, limit = 50) {
+    if (!this.mayReadOpenClawMemoryForTurn(authorization)) {
+      return { recent: [], facts: [] };
+    }
+    try {
+      return await this.memory.context(channelId, limit);
+    } catch {
+      return { recent: [], facts: [] };
+    }
+  }
   async memoryContext(conversationId, limit) {
+    if (!await this.mayReadOpenClawMemory(conversationId)) {
+      return { recent: [], facts: [] };
+    }
     return this.memory.context(conversationId, limit);
   }
   /**
@@ -9132,10 +9526,14 @@ var BridgeAgent = class _BridgeAgent {
     }
     try {
       let memory;
-      try {
-        memory = await this.memory.context(m.channelId, 30);
-      } catch {
+      if (!this.mayReadOpenClawMemoryForTurn(m.authorization)) {
         memory = { recent: [], facts: [] };
+      } else {
+        try {
+          memory = await this.memory.context(m.channelId, 30);
+        } catch {
+          memory = { recent: [], facts: [] };
+        }
       }
       const messages = buildFastMessages({
         persona: this.cfg.voice.persona,
@@ -9388,13 +9786,42 @@ var BridgeAgent = class _BridgeAgent {
       const rows = await res.json();
       const members = /* @__PURE__ */ new Map();
       for (const r of rows) {
-        members.set(r.identity_id, { name: r.display_name, is_agent: r.is_agent });
+        members.set(r.identity_id, {
+          name: r.display_name,
+          is_agent: r.is_agent,
+          is_agent_owner: r.is_agent_owner === true,
+          is_partner: r.is_partner === true
+        });
       }
       this.channelRoster.set(channelId, { members, at: Date.now() });
       await this.resolveAndPinOwner(channelId, rows);
     } catch {
     }
   }
+  /**
+   * Classify the sender only from server-authenticated channel/roster data.
+   * Missing or stale metadata is UNKNOWN with zero grants, never a permissive
+   * guess. The returned object and grant array are frozen before they cross the
+   * daemon boundary so one consumer cannot widen a later execution check.
+   */
+  authorizationFor(channelId, senderId) {
+    const meta = this.freshMeta(channelId);
+    const sender = this.freshRoster(channelId)?.get(senderId);
+    let audience = "unknown";
+    if (meta && sender) {
+      if (sender.is_agent) audience = "agent_to_agent";
+      else if (meta.is_dm && sender.is_agent_owner) audience = "owner_dm";
+      else if (meta.is_dm) audience = "other_human_dm";
+      else if (sender.is_partner) audience = "partner_room";
+      else audience = "team_room";
+    }
+    return Object.freeze({
+      version: 1,
+      audience,
+      sender_membership: sender ? "active" : "unknown",
+      tool_grants: Object.freeze([])
+    });
+  }
   /**
    * Task 8 (owner-attested Reset Secure Session): STRUCTURAL owner selection —
    * NEVER read the server's `role` field to pick the owner. In a DM the owner
@@ -9908,6 +10335,7 @@ var BridgeAgent = class _BridgeAgent {
                 sender_id: m.envelope.sender_id,
                 text: typeof parsed.text === "string" ? parsed.text : "",
                 ts: m.receivedAt,
+                authorization: this.authorizationFor(m.channelId, m.envelope.sender_id),
                 sender_name: senderName,
                 sender_is_agent: senderIsAgent,
                 attachments: [attachment],
@@ -9946,6 +10374,11 @@ var BridgeAgent = class _BridgeAgent {
             const senderName = this.freshRoster(m.channelId)?.get(
               m.envelope.sender_id
             )?.name;
+            const turnAuthorization = this.authorizationFor(
+              m.channelId,
+              m.envelope.sender_id
+            );
+            const runtimeMemory = this.memoryForTurn(m.channelId, turnAuthorization);
             const speaker = parsed.relay === true && typeof parsed.speaker_identity_id === "string" && typeof parsed.speaker_display_name === "string" ? {
               identityId: parsed.speaker_identity_id,
               displayName: parsed.speaker_display_name
@@ -9962,12 +10395,14 @@ var BridgeAgent = class _BridgeAgent {
             const turnText = parsed.text;
             const isCallStart = turnText.trim() === VOICE_CALL_START_MARKER;
             const fastGreeting = isCallStart && fastPathFiring;
-            const runtimeEntry = (ackSent) => ({
+            const runtimeEntry = (ackSent, memory) => ({
               channel_id: m.channelId,
               message_id: m.messageId,
               sender_id: m.envelope.sender_id,
               text: turnText,
               ts: m.receivedAt,
+              authorization: turnAuthorization,
+              memory,
               // A relay-attributed turn is the SPEAKER's message to the runtime:
               // name it after them and never flag it as agent-authored.
               sender_name: speaker?.displayName ?? senderName,
@@ -9981,18 +10416,23 @@ var BridgeAgent = class _BridgeAgent {
             if (fastPathFiring) {
               const fastSpeaker = speaker ?? (senderName ? { identityId: m.envelope.sender_id, displayName: senderName } : void 0);
               void this.runFastPath(
-                { channelId: m.channelId, messageId: m.messageId, senderId: m.envelope.sender_id },
+                {
+                  channelId: m.channelId,
+                  messageId: m.messageId,
+                  senderId: m.envelope.sender_id,
+                  authorization: turnAuthorization
+                },
                 fastGreeting ? greetingTurnFor(this.voiceSettings ?? DEFAULT_VOICE_SETTINGS, fastSpeaker?.displayName) : parsed.text,
                 voiceGuidance,
                 fastSpeaker
-              ).then((outcome) => {
+              ).then(async (outcome) => {
                 if (outcome === "answered") return;
-                this.buffer.push(runtimeEntry(outcome === "deferred"));
+                this.buffer.push(runtimeEntry(outcome === "deferred", await runtimeMemory));
                 this.capBuffer();
                 this.wakeListeners();
               });
             } else {
-              this.buffer.push(runtimeEntry(false));
+              this.buffer.push(runtimeEntry(false, await runtimeMemory));
             }
             this.capBuffer();
             void recordInboundMemory(
@@ -10058,6 +10498,12 @@ var BridgeAgent = class _BridgeAgent {
     this.buffer.push(...keep);
     return out;
   }
+  recordRuntimeReply(inReplyTo, channelId, replyMessageId) {
+    return this.runtimeReplyReceipts.record(inReplyTo, channelId, replyMessageId);
+  }
+  runtimeReplyReceipt(inReplyTo) {
+    return this.runtimeReplyReceipts.get(inReplyTo);
+  }
   /**
    * Put messages back at the front (SSE/disconnect write-failure recovery).
    *
@@ -10209,6 +10655,7 @@ var BridgeAgent = class _BridgeAgent {
     this.closingDown = true;
     this.pingHandle?.close();
     if (this.safetyTimer) clearInterval(this.safetyTimer);
+    if (this.runtimeConfigTimer) clearInterval(this.runtimeConfigTimer);
     if (this.bootSweepTimer) clearTimeout(this.bootSweepTimer);
     if (this.selfHealTimer) clearTimeout(this.selfHealTimer);
     await this.provider.drainInFlight(_BridgeAgent.GRACEFUL_DRAIN_MS);
@@ -10334,6 +10781,7 @@ var sendSchema = z3.object({
   channel_id: z3.string().min(1),
   text: z3.string().optional(),
   idempotency_key: z3.string().optional(),
+  in_reply_to: z3.string().min(1).max(200).optional(),
   a2a: a2aSchema.optional()
 }).refine((d) => typeof d.text === "string" || d.a2a !== void 0, {
   message: "send requires either text or a2a"
@@ -10450,10 +10898,19 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/metrics") {
         return json(res, 200, agent.metrics());
       }
+      if (method === "GET" && path === "/v1/reply-receipt") {
+        const inReplyTo = url.searchParams.get("in_reply_to");
+        if (!inReplyTo || inReplyTo.length > 200) return jsonError(res, "invalid_request");
+        const receipt = agent.runtimeReplyReceipt(inReplyTo);
+        return json(res, 200, receipt ? { found: true, receipt } : { found: false });
+      }
       if (method === "POST" && path === "/v1/send") {
         const parsed = sendSchema.safeParse(JSON.parse(await readBody(req, SEND_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
         const r = parsed.data.a2a ? await agent.sendA2A(parsed.data.channel_id, parsed.data.a2a) : await agent.send(parsed.data.channel_id, parsed.data.text);
+        if (parsed.data.in_reply_to) {
+          agent.recordRuntimeReply(parsed.data.in_reply_to, parsed.data.channel_id, r.message_id);
+        }
         return json(res, 200, r);
       }
       if (method === "POST" && path === "/v1/send-attachment") {
@@ -10709,6 +11166,10 @@ async function handleInbound(sock, agent, data, inflight) {
       sendJson(sock, wsErrorFrame("invalid_request"));
       return;
     }
+    if (m.in_reply_to !== void 0 && (typeof m.in_reply_to !== "string" || m.in_reply_to.length === 0 || m.in_reply_to.length > 200)) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
     if (m.a2a && typeof m.a2a === "object") {
       const a = m.a2a;
       if (typeof a.a2a_version !== "string" || !a.a2a_version || a.kind !== "message" && a.kind !== "task" && a.kind !== "artifact" || typeof a.object !== "object" || a.object === null) {
@@ -10717,6 +11178,9 @@ async function handleInbound(sock, agent, data, inflight) {
       }
       try {
         const r = await agent.sendA2A(m.channel_id, { a2a_version: a.a2a_version, kind: a.kind, object: a.object });
+        if (typeof m.in_reply_to === "string") {
+          agent.recordRuntimeReply(m.in_reply_to, m.channel_id, r.message_id);
+        }
         sendJson(sock, { type: "sent", message_id: r.message_id });
       } catch (e) {
         if (e instanceof ChannelPendingError) {
@@ -10735,6 +11199,9 @@ async function handleInbound(sock, agent, data, inflight) {
     }
     try {
       const r = await agent.send(m.channel_id, m.text);
+      if (typeof m.in_reply_to === "string") {
+        agent.recordRuntimeReply(m.in_reply_to, m.channel_id, r.message_id);
+      }
       sendJson(sock, { type: "sent", message_id: r.message_id });
     } catch (e) {
       if (e instanceof ChannelPendingError) {
@@ -10846,7 +11313,7 @@ async function handleInbound(sock, agent, data, inflight) {
 
 // src/bin.ts
 import { readFileSync as readFileSync9, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync, existsSync as existsSync3, realpathSync, readdirSync as readdirSync2, statSync as statSync4 } from "node:fs";
-import { join as join13, dirname as dirname7, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
+import { join as join13, dirname as dirname7, isAbsolute as isAbsolute3, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { homedir as homedir3, userInfo } from "node:os";
 import { spawnSync } from "node:child_process";
@@ -10855,7 +11322,7 @@ import { spawnSync } from "node:child_process";
 import { dirname as dirname4 } from "node:path";
 
 // src/service/config.ts
-import { basename as basename3, extname, isAbsolute, resolve } from "node:path";
+import { basename as basename3, extname, isAbsolute as isAbsolute2, resolve } from "node:path";
 
 // src/service/resolve-node.ts
 var REQUIRED_NODE_MAJOR = 24;
@@ -10935,9 +11402,9 @@ function deriveServiceConfig(input) {
   }
   const stem = input.label ?? basename3(input.credentialPath, extname(input.credentialPath));
   const slug = slugify(stem);
-  const cred = isAbsolute(input.credentialPath) ? input.credentialPath : resolve(input.credentialPath);
+  const cred = isAbsolute2(input.credentialPath) ? input.credentialPath : resolve(input.credentialPath);
   const args2 = ["--credential", cred];
-  if (input.storePath) args2.push("--store", isAbsolute(input.storePath) ? input.storePath : resolve(input.storePath));
+  if (input.storePath) args2.push("--store", isAbsolute2(input.storePath) ? input.storePath : resolve(input.storePath));
   if (input.port != null) args2.push("--port", String(input.port));
   return {
     slug,
@@ -12048,7 +12515,7 @@ async function runServiceVerb(verb) {
   }
   try {
     if (verb === "install") {
-      const credAbs = isAbsolute2(credentialPath) ? credentialPath : resolve2(credentialPath);
+      const credAbs = isAbsolute3(credentialPath) ? credentialPath : resolve2(credentialPath);
       const installExecPath = chooseInstallExecPath(
         process.execPath,
         argOrEnv("--exec-path", "SECURECOMS_EXEC_PATH"),