@securecoms/agent-bridge 0.20.0 → 0.23.0

package/README.md

@@ -1,5 +1,24 @@
 # @agentvault/connect-agent-bridge
 
+## Non-destructive runtime reply monitoring
+
+Attached runtimes should include the inbound `message_id` as `in_reply_to` on
+their outbound `send` frame/request. After the encrypted send publishes, the
+bridge retains a bounded, 15-minute content-free receipt and exposes it at the
+bearer-gated loopback route:
+
+```text
+GET /v1/reply-receipt?in_reply_to=<message_id>
+```
+
+The response is either `{ "found": false }` or a receipt containing only the
+inbound message id, outbound message id, channel id, and publish timestamp. It
+contains no prompt or reply text. `scripts/agent-reply-probe.mjs` uses this
+surface and never calls `/v1/messages`, `/v1/events`, or `/v1/ws`, so routine
+monitoring cannot compete with or evict the attached runtime. The older
+`scripts/fleet-probe.mjs` remains an attended promotion tool because it drains
+the single-consumer stream to inspect reply plaintext.
+
 An always-on local daemon that holds an AI agent's SecureComs credential and MLS state, then exposes a loopback API so any agent — Python, Node, Go, shell scripts, whatever — can send and receive end-to-end encrypted messages without touching any cryptography itself. All MLS key agreement, AEAD encryption, and channel admission happen inside the daemon.
 
 The daemon serves two interfaces on the same port:
@@ -217,12 +236,32 @@ All frames are JSON text.
 **Daemon → agent**
 
 ```
-{ "type":"message", "channel_id":"...", "message_id":"...", "sender_id":"...", "text":"...", "ts": 1234567890 }
+{ "type":"message", "channel_id":"...", "message_id":"...", "sender_id":"...", "text":"...", "ts": 1234567890,
+  "authorization": { "version":1, "audience":"owner_dm"|"team_room"|"partner_room"|"other_human_dm"|"agent_to_agent"|"unknown",
+    "sender_membership":"active"|"unknown", "tool_grants":[] } }
 { "type":"sent", "message_id":"..." }                       // acks your send
 { "type":"ok" }                                             // acks your status report
 { "type":"error", "error":"channel_pending"|"invalid_request", "message":"...", "detail":"..." }
 ```
 
+The daemon derives `authorization` only from the authenticated channel and
+roster APIs; message text, display names, and model output cannot set it.
+Missing or stale roster data produces `unknown` with no grants. This release
+deliberately issues no channel tool grants while grant persistence and owner
+controls are staged, so consumers must treat `tool_grants:[]` as authoritative.
+Future side-effect grants will also bind an exact operation digest,
+confirmation id, idempotency key, and expiry rather than granting a tool name
+globally.
+
+When `memory.provider` is `openclaw`, OpenClaw text history and workspace facts
+are owner-DM-only. The live fast path consumes them only when the immutable
+turn authorization says `owner_dm` with active membership. The loopback memory
+context API independently refreshes authenticated channel/roster metadata and
+returns an empty context unless the channel is a DM with exactly one non-agent
+human counterpart and that counterpart is the agent owner. Missing, stale,
+ambiguous, room, partner, other-human, and agent-to-agent state therefore fails
+closed without exposing OpenClaw memory.
+
 **Agent → daemon**
 
 ```
@@ -231,7 +270,14 @@ All frames are JSON text.
 { "type":"ack", "message_id":"..." }                        // confirms you consumed a delivered message
 ```
 
-**Acknowledge what you receive.** Inbound delivery is **at-least-once**. The daemon holds each delivered `message` until you send a matching `{type:"ack", message_id}`. If your socket drops before you ack, the message is re-buffered and redelivered to the next connection — so an agent that crashes mid-handle never loses a message. The cost is that you may occasionally see a message twice; dedup by `message_id`. (Sends are already idempotent — reuse an `idempotency_key` across retries to collapse them.) Ack as soon as you've durably handled a message, not before.
+**Acknowledge what you receive.** Inbound delivery is **at-least-once**. Before the remote server queue is acknowledged, the daemon seals each runtime-bound `message` into `bridge-state.db`. It remains durable until you send a matching `{type:"ack", message_id}`. If your socket, daemon, or host disappears first, the message is restored and redelivered to the next consumer in FIFO order. The cost is that you may occasionally see a message twice; dedup by `message_id`. Ack as soon as you've durably handled a message, not before.
+
+For the first-party runtime, a reply carries `in_reply_to`. The daemon persists a
+content-free reply receipt after publish, and a replacement runtime checks that
+receipt before running the turn again. This closes the publish-success/ACK-loss
+window where the result is known. It does not pretend an indeterminate external
+tool call is safe to repeat; those calls use the runtime's separate reconciliation
+ledger.
 
 **One consumer at a time.** The daemon serves a single agent per process. Opening a second `/v1/ws` connection closes the first (newest wins, code `1000`); the replaced socket's un-acked messages are re-buffered for the new one. Don't run two consumers against one daemon expecting to share the stream.
 

package/connectors/hermes/adapter.py

@@ -81,6 +81,17 @@ _BINDING_PATH = os.path.join(_PLUGIN_DIR, "securecoms.binding.json")
 _CONNECTIONS_DIR = os.path.expanduser("~/.securecoms/connections")
 
 
+def _error_class(error: object) -> str:
+    """Return a bounded class name without reading exception prose."""
+    try:
+        name = type(error).__name__
+    except Exception:
+        return "Error"
+    if not name or len(name) > 64 or not name.replace("_", "a").isalnum():
+        return "Error"
+    return name
+
+
 def _read_file_text(path: str) -> str:
     with open(path, "r") as f:
         return f.read()
@@ -184,7 +195,7 @@ class SecureComsAdapter(BasePlatformAdapter):
         self._recv_task = asyncio.create_task(self._supervise())
         self._tick_task = asyncio.create_task(self._tick_loop())
         self._mark_connected()
-        logger.info("SecureComs: connected to daemon at %s", self.bridge_url)
+        logger.info("SecureComs: connected to daemon")
         return True
 
     async def _open_ws(self) -> bool:
@@ -230,7 +241,7 @@ class SecureComsAdapter(BasePlatformAdapter):
         changed = self._hold_reason != reason
         self._hold_reason = reason
         if changed:
-            logger.warning("SecureComs: waiting for SecureComs daemon: %s", reason)
+            logger.warning("SecureComs: waiting for SecureComs daemon")
         self._set_fatal_error(
             "waiting_for_daemon",
             f"waiting for SecureComs daemon: {reason}",
@@ -253,7 +264,10 @@ class SecureComsAdapter(BasePlatformAdapter):
             except asyncio.CancelledError:
                 raise
             except Exception as e:
-                logger.warning("SecureComs: receive error: %s", e)
+                logger.warning(
+                    "SecureComs: receive failed (error_class=%s)",
+                    _error_class(e),
+                )
             if self._stopped:
                 break
             self._mark_disconnected()
@@ -311,7 +325,10 @@ class SecureComsAdapter(BasePlatformAdapter):
                             "is_dm": bool(c.get("is_dm")),
                         }
         except Exception as e:
-            logger.debug("SecureComs: channel refresh failed: %s", e)
+            logger.debug(
+                "SecureComs: channel refresh failed (error_class=%s)",
+                _error_class(e),
+            )
 
     # ── Status emit ───────────────────────────────────────────────────────
 
@@ -321,7 +338,10 @@ class SecureComsAdapter(BasePlatformAdapter):
         try:
             await self._ws.send_json(frame)
         except Exception as e:
-            logger.debug("SecureComs: status frame send failed: %s", e)
+            logger.debug(
+                "SecureComs: status frame send failed (error_class=%s)",
+                _error_class(e),
+            )
 
     async def _tick_loop(self) -> None:
         """Drives ChannelStatusManager.tick() so a channel goes idle after
@@ -334,7 +354,10 @@ class SecureComsAdapter(BasePlatformAdapter):
             except asyncio.CancelledError:
                 raise
             except Exception as e:
-                logger.debug("SecureComs: status tick error: %s", e)
+                logger.debug(
+                    "SecureComs: status tick failed (error_class=%s)",
+                    _error_class(e),
+                )
 
     # ── Inbound ───────────────────────────────────────────────────────────
 
@@ -360,7 +383,10 @@ class SecureComsAdapter(BasePlatformAdapter):
                             {"type": "ack", "message_id": frame.get("message_id")}
                         )
                     except Exception as e:
-                        logger.warning("SecureComs: ack failed: %s", e)
+                        logger.warning(
+                            "SecureComs: ack failed (error_class=%s)",
+                            _error_class(e),
+                        )
             elif msg.type in (aiohttp.WSMsgType.CLOSED, aiohttp.WSMsgType.ERROR):
                 return  # WS closed → supervisor reconnects
 
@@ -406,7 +432,11 @@ class SecureComsAdapter(BasePlatformAdapter):
             async with self._session.post(
                 f"{self.bridge_url}/v1/send",
                 headers=self._auth(),
-                json={"channel_id": chat_id, "text": content},
+                json={
+                    "channel_id": chat_id,
+                    "text": content,
+                    **({"in_reply_to": reply_to} if reply_to else {}),
+                },
             ) as r:
                 if r.status == 200:
                     j = await r.json()

package/connectors/hermes/tests/test_adapter_wiring.py

@@ -344,10 +344,15 @@ class TestSendWiring:
         a.bridge_url = "http://127.0.0.1:9001"
         a._token = "tok"
 
-        result = await a.send("chan-1", "hello")
+        result = await a.send("chan-1", "hello", reply_to="inbound-7")
 
         assert result.success is True
         assert calls == ["chan-1"]
+        assert a._session.post_calls[0][2] == {
+            "channel_id": "chan-1",
+            "text": "hello",
+            "in_reply_to": "inbound-7",
+        }
 
     @pytest.mark.asyncio
     async def test_send_failure_does_not_fire_on_reply_posted(self, monkeypatch):

package/connectors/hermes/tests/test_logging_privacy.py

@@ -0,0 +1,61 @@
+import ast
+from pathlib import Path
+
+from adapter import _error_class
+
+
+def _logging_violations(source: str) -> list[str]:
+    violations: list[str] = []
+    tree = ast.parse(source)
+    for node in ast.walk(tree):
+        if not (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and isinstance(node.func.value, ast.Name)
+            and node.func.value.id == "logger"
+        ):
+            continue
+        if node.func.attr == "exception":
+            violations.append("logger.exception")
+        if not node.args or not (
+            isinstance(node.args[0], ast.Constant)
+            and isinstance(node.args[0].value, str)
+        ):
+            violations.append("dynamic format")
+            continue
+        rendered = node.args[0].value.lower()
+        if any(label in rendered for label in ("identity=", "channel=", "reason=", "url=")):
+            violations.append("sensitive field")
+        for arg in node.args[1:]:
+            if not (
+                isinstance(arg, ast.Call)
+                and isinstance(arg.func, ast.Name)
+                and arg.func.id == "_error_class"
+            ) and not (isinstance(arg, ast.Name) and arg.id == "backoff"):
+                violations.append("unbounded argument")
+    return violations
+
+
+def test_adapter_logging_source_is_content_free() -> None:
+    source = (Path(__file__).parents[1] / "adapter.py").read_text()
+    assert _logging_violations(source) == []
+
+
+def test_adapter_logging_guard_detects_dynamic_values() -> None:
+    hostile = '''
+logger.info(dynamic_format, identity)
+logger.warning("channel=%s", channel_id)
+logger.error("failed: %s", error)
+'''
+    violations = _logging_violations(hostile)
+    assert "dynamic format" in violations
+    assert "sensitive field" in violations
+    assert "unbounded argument" in violations
+
+
+def test_error_class_does_not_render_exception_prose() -> None:
+    class HostileError(RuntimeError):
+        def __str__(self) -> str:
+            raise AssertionError("exception prose was rendered")
+
+    assert _error_class(HostileError()) == "HostileError"