@securecoms/agent-bridge 0.20.0 → 0.21.0

package/dist/bridge-agent.d.ts

@@ -1,4 +1,5 @@
 import { MlsGroupKeyProvider } from "@agentvault/connect-sdk-ts";
+import type { MemoryContextResult } from "@agentvault/connect-mls-store";
 /**
  * M6 (ADR-0013 Decision H): what the sweep observed about one channel.
  *
@@ -35,12 +36,45 @@ import { type ChatMessage } from "./voice/fast-prompt.js";
 import { VOICE_CALL_START_MARKER } from "./voice/prompt-compiler.js";
 import { type VaultListNode } from "./vault.js";
 import type { AgentActionNodeType, AgentActionNodeStatus, AgentActionNodeDetail } from "@agentvault/connect-core";
+import { type RuntimeReplyReceipt } from "./reply-receipts.js";
+export type AgentAudience = "owner_dm" | "team_room" | "partner_room" | "other_human_dm" | "agent_to_agent" | "unknown";
+export type BridgeToolGrant = {
+    readonly tool: string;
+    readonly mode: "read";
+} | {
+    readonly tool: string;
+    readonly mode: "side_effect";
+    readonly operation_sha256: string;
+    readonly confirmation_id: string;
+    readonly idempotency_key: string;
+    readonly expires_at: string;
+};
+/**
+ * Immutable authorization context derived from authenticated backend roster
+ * data. The E2E plaintext never contributes to these claims. Tool grants are
+ * intentionally empty until the channel-grant persistence/API lands; this
+ * makes the new contract fail closed during staged deployment.
+ */
+export interface BridgeAuthorization {
+    readonly version: 1;
+    readonly audience: AgentAudience;
+    readonly sender_membership: "active" | "unknown";
+    readonly tool_grants: readonly BridgeToolGrant[];
+}
 export interface BridgeMessage {
     channel_id: string;
     message_id: string;
     sender_id: string;
     text: string;
     ts: number;
+    authorization: BridgeAuthorization;
+    /**
+     * Protected, channel-scoped memory captured before this inbound turn is
+     * recorded. The runtime can therefore prepend prior context without owning
+     * a second plaintext persistence path or duplicating the current message.
+     * Missing only for non-text/legacy buffered entries.
+     */
+    memory?: MemoryContextResult;
     /**
      * Phase 2 (sender attribution): the sender's display name, resolved from the
      * channel roster cache. Undefined when the roster hasn't resolved the
@@ -383,6 +417,12 @@ export declare class BridgeAgent {
     private readonly channelOwner;
     private readonly buffer;
     private readonly maxBuffer;
+    /**
+     * Short-lived, content-free runtime reply correlations. The attached runtime
+     * supplies the inbound message id only when an outbound send is its reply;
+     * ws-server/http-server record the receipt after send() publishes.
+     */
+    private readonly runtimeReplyReceipts;
     /** Cumulative count of messages shed by the buffer cap (surfaced on health()/metrics()). */
     private droppedMessages;
     /**
@@ -601,6 +641,7 @@ export declare class BridgeAgent {
     private readonly waiters;
     private pingHandle?;
     private safetyTimer?;
+    private runtimeConfigTimer?;
     private readonly listeners;
     private startedAt;
     private readonly store;
@@ -937,6 +978,21 @@ export declare class BridgeAgent {
         seq: number;
         deduped: boolean;
     }>;
+    /**
+     * OpenClaw collapses text history and workspace facts into the owner's
+     * session. Resolve the channel from fresh, authenticated server metadata
+     * before exposing that provider through the local bridge API. A cold or
+     * stale cache is refreshed once; any failure remains a fail-closed denial.
+     */
+    private mayReadOpenClawMemory;
+    /** An inbound turn may receive OpenClaw memory only from an active owner DM. */
+    private mayReadOpenClawMemoryForTurn;
+    /**
+     * Resolve the prior-turn snapshot carried to the native runtime. OpenClaw
+     * stays owner-DM-only; every provider failure degrades to empty context and
+     * never falls back to the runtime's retired plaintext JSON files.
+     */
+    private memoryForTurn;
     memoryContext(conversationId: string, limit?: number): Promise<import("@agentvault/connect-mls-store").MemoryContextResult>;
     /**
      * Task 4 (self-hosted fast voice): instant persona-voiced acknowledgement
@@ -1118,6 +1174,13 @@ export declare class BridgeAgent {
      * attribution must NEVER block or drop a message.
      */
     private refreshChannelRoster;
+    /**
+     * Classify the sender only from server-authenticated channel/roster data.
+     * Missing or stale metadata is UNKNOWN with zero grants, never a permissive
+     * guess. The returned object and grant array are frozen before they cross the
+     * daemon boundary so one consumer cannot widen a later execution check.
+     */
+    private authorizationFor;
     /**
      * Task 8 (owner-attested Reset Secure Session): STRUCTURAL owner selection —
      * NEVER read the server's `role` field to pick the owner. In a DM the owner
@@ -1211,6 +1274,8 @@ export declare class BridgeAgent {
     subscribe(listener: () => void): () => void;
     /** Synchronous splice of buffered messages (all, or one channel). Shared by drain + SSE. */
     takeBuffered(channelId?: string): BridgeMessage[];
+    recordRuntimeReply(inReplyTo: string, channelId: string, replyMessageId: string): RuntimeReplyReceipt;
+    runtimeReplyReceipt(inReplyTo: string): RuntimeReplyReceipt | null;
     /**
      * Put messages back at the front (SSE/disconnect write-failure recovery).
      *