@securecoms/agent-bridge 0.23.0 → 0.25.0

package/dist/reply-intent.d.ts

@@ -0,0 +1,68 @@
+/** The body of one reply part, as the intent stores it (sealed at rest). */
+export type ReplyBody = {
+    kind: "text";
+    text: string;
+} | {
+    kind: "a2a";
+    a2a: {
+        a2a_version: string;
+        kind: "message" | "task" | "artifact";
+        object: Record<string, unknown>;
+    };
+};
+/** Where an intent lives: its scope (what it answers) and its part within it. */
+export interface ReplyIntentKey {
+    scope: string;
+    part: string;
+    inReplyTo: string | null;
+}
+/** Longest idempotency_key accepted (mirrors the in_reply_to bound). */
+export declare const MAX_IDEMPOTENCY_KEY_LENGTH = 200;
+/** The HMAC key for reply ids and body MACs, derived from the identity seed. */
+export declare function deriveReplyIdKey(identitySeed: Uint8Array): Buffer;
+/**
+ * The first 16 bytes of `digest` as an RFC 4122-shaped UUID (version nibble 4,
+ * variant 10). The backend parses message_id with `uuid.UUID()` and the
+ * envelope schema only requires `format: uuid`; this is the encoding the voice
+ * fast path's `fastReplyId` already ships with.
+ */
+export declare function uuidFromDigest(digest: Uint8Array): string;
+/**
+ * The deterministic message_id of one reply part. JSON array encoding keeps the
+ * input injective (no separator can be smuggled through a free-text key).
+ */
+export declare function replyMessageId(key: Uint8Array, identityId: string, channelId: string, intent: Pick<ReplyIntentKey, "scope" | "part">): string;
+/** Canonical bytes of a reply body (what is sealed and what is MACed). */
+export declare function encodeReplyBody(body: ReplyBody): Uint8Array;
+export declare function decodeReplyBody(bytes: Uint8Array): ReplyBody;
+/**
+ * Keyed MAC binding a body to its reply id and channel. Compares retries
+ * without storing a plain digest, and (PR #716 review LOW-6) makes a body moved
+ * to another row, or a row whose channel was edited, fail verification.
+ */
+export declare function replyBodyMac(key: Uint8Array, replyId: string, channelId: string, body: Uint8Array): string;
+/** The ordinal of an unkeyed reply part (`p:<n>`), or null for a keyed part. */
+export declare function partOrdinal(part: string): number | null;
+/**
+ * The intent key for a send. `in_reply_to` wins the scope; an explicit
+ * idempotency_key names the part (else the per-delivery ordinal does). An
+ * idempotency_key alone is its own scope with a single part.
+ */
+export declare function replyIntentKey(opts: {
+    inReplyTo?: string;
+    idempotencyKey?: string;
+    ordinal: () => number;
+}): ReplyIntentKey | null;
+/** A caller reused an explicit idempotency_key for a different body. */
+export declare class IdempotencyConflictError extends Error {
+    constructor();
+}
+/**
+ * PR #716 review LOW-6: a stored reply intent failed verification (its id does
+ * not derive from its own identity, channel, scope and part, its body does not
+ * match its MAC, or its cached envelope names another id or channel). It is
+ * dropped and never published.
+ */
+export declare class ReplyIntentIntegrityError extends Error {
+    constructor();
+}

package/dist/sodium-ready.d.ts

@@ -33,11 +33,17 @@
  * second warm-up, not a shortcut.
  *
  * ⛔ 2. DO NOT IMPORT `libsodium-wrappers-sumo` DIRECTLY HERE. ⇒ THIS ONE STILL
- * BINDS ON THIS FILE, UNCHANGED. `esbuild.config.mjs:15` inlines every
- * `@agentvault/connect-*` workspace package into the bridge bundle and that
- * specifier is absent from the EXTERNAL list at `:3-8`, so esbuild would bundle
- * a SECOND libsodium instance out of this file. The await would then warm a
- * heap that nothing reads, and this fix would look correct and do nothing.
+ * BINDS ON THIS FILE. Before #895 that specifier was absent from the EXTERNAL
+ * list in `esbuild.config.mjs`, so esbuild would have bundled a SECOND
+ * libsodium instance out of this file: the await would warm a heap that
+ * nothing reads, and the fix would look correct and do nothing. #895 inlines
+ * the patched `@agentvault/crypto` and makes `libsodium-wrappers-sumo` EXTERNAL
+ * precisely so the process keeps ONE instance, shared by the inlined crypto
+ * and anything else. ⛔ That singleton is now carried by the EXTERNAL entry;
+ * removing it from that list re-creates the split heap. `scripts/pack-smoke.sh`
+ * G-5b proves it on the installed tarball: the warm-up below, which only
+ * touches the INLINED crypto, must warm the libsodium the installed tree
+ * resolves.
  * ⚠️ The same inlining is why the delegate below is not a no-op in the shipped
  * bundle: the SDK barrier is inlined into `dist/bin.js` exactly once, and this
  * delegate points at that one copy.

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.23.0";
+export declare const BRIDGE_VERSION = "0.25.0";

package/dist/voice/fast-client.d.ts

@@ -1,13 +1,23 @@
 import type { FastPathConfig } from "./persona";
 import type { ChatMessage } from "./fast-prompt";
+/**
+ * SEC-06 (#12): the response body cap. A fast completion is at most 400
+ * tokens (a few KB of JSON), and the backend proxy enforces the same 64 KiB.
+ */
+export declare const FAST_LLM_MAX_RESPONSE_BYTES: number;
 export declare class FastLlmError extends Error {
-    readonly kind: "timeout" | "http" | "shape" | "network";
-    constructor(message: string, kind: "timeout" | "http" | "shape" | "network");
+    readonly kind: "timeout" | "http" | "shape" | "network" | "size";
+    constructor(message: string, kind: "timeout" | "http" | "shape" | "network" | "size");
 }
 export declare class FastLlmClient {
     private readonly cfg;
     private readonly fetchImpl;
     private readonly key;
     constructor(cfg: FastPathConfig, fetchImpl: typeof fetch);
+    /**
+     * One deadline (`cfg.timeoutMs`) covers the whole call: connect, headers
+     * AND the body. The timer stays armed until the body is read, so a peer that
+     * sends headers and then stalls or trickles cannot hold the voice turn.
+     */
     complete(messages: ChatMessage[]): Promise<string>;
 }

package/dist/ws-server.d.ts

@@ -16,12 +16,19 @@
  *     { "type":"error", error, message, detail? }   // canonical codes (see errors.ts):
  *                                                    // channel_pending | rate_limited |
  *                                                    // invalid_request | agent_paused |
- *                                                    // send_forbidden (the last two are
+ *                                                    // send_forbidden (those two are
  *                                                    // TERMINAL: the in_reply_to message
- *                                                    // is acked by the daemon, no retry)
+ *                                                    // is acked by the daemon, no retry) |
+ *                                                    // group_superseded (NOT terminal:
+ *                                                    // the reply is republished after
+ *                                                    // the agent rejoins)
  *   Agent → daemon:
  *     { "type":"send", channel_id, text?, a2a?, idempotency_key?,
- *       in_reply_to? }   // exactly one of text | a2a; correlation is metadata-only
+ *       in_reply_to? }   // exactly one of text | a2a. SEC-06 #18: in_reply_to
+ *                        // and/or idempotency_key make the send idempotent — a
+ *                        // deterministic keyed message_id and a durable reply
+ *                        // intent written before the publish, so a retry or a
+ *                        // redelivery republishes the SAME reply
  *     { "type":"status", channel_id, state, detail? }
  *     { "type":"ack", message_id }   // confirms a delivered `message` was consumed
  *     { "type":"nack", message_id, reason? }  // final-wave I1(b): THIS message's turn
@@ -38,7 +45,9 @@
  * Inbound delivery is at-least-once. A delivered `message` is held in-flight
  * until the agent sends a matching `ack`; if the socket drops first, the frame
  * is re-buffered and redelivered to the next consumer. The agent dedups by
- * message_id (a fresh UUID minted per send; server-side dedup is on replay_nonce).
+ * message_id. SEC-06 #18: a redelivered message whose reply already has a
+ * durable intent is NOT handed to the agent again; the daemon republishes that
+ * reply itself (same message_id), so the model does not run twice.
  *
  * Bounded work (Phase 3):
  *   - F2 ordering: at most ONE message per channel is in flight on a socket;
@@ -55,6 +64,9 @@
  *     behind a 2^attempts × 5 s backoff. A nack fails only its own message.
  *     Messages never handed over (mid-flush close, a failed frame write) go
  *     back without that penalty.
+ *   - #842: a delivery still un-acked after INFLIGHT_STALE_AFTER_MS is LOGGED
+ *     once (`runtime_inbox.inflight_stale`) and otherwise left alone. There
+ *     is deliberately no lease: see INFLIGHT_STALE_AFTER_MS.
  *
  * Single consumer: the daemon serves one agent per process. A new `/v1/ws`
  * connection replaces the prior one (newest wins, mirroring the SSE path); the
@@ -68,7 +80,24 @@ import type { BridgeAgent } from "./bridge-agent.js";
 export interface AgentWebSocketOptions {
     token: string;
     allowOrigins: string[];
+    /** Test seam: the stale-in-flight sweep period (default INFLIGHT_STALE_SWEEP_MS). */
+    inflightStaleSweepMs?: number;
+    /** Test seam: the age past which an un-acked delivery is logged (default INFLIGHT_STALE_AFTER_MS). */
+    inflightStaleAfterMs?: number;
+    /** Test seam: the clock the delivery ages are measured on. */
+    now?: () => number;
 }
+/**
+ * FB-P1-024 / #842 ruling §3: a stale-in-flight OBSERVATION, not a lease.
+ * The bridge cannot tell a message queued inside the consumer from one whose
+ * turn is running, so it must not requeue or cancel on age: a lease short
+ * enough to matter would re-run live turns (duplicate replies and side
+ * effects). It only logs `runtime_inbox.inflight_stale`, once per delivery,
+ * content-free, and takes NO action. The post-launch fix is protocol v2
+ * (`started` / `cancel` negotiated in `hello`), not a shorter threshold here.
+ */
+export declare const INFLIGHT_STALE_SWEEP_MS = 60000;
+export declare const INFLIGHT_STALE_AFTER_MS: number;
 export declare function attachAgentWebSocket(server: HttpServer, agent: BridgeAgent, opts: AgentWebSocketOptions): {
     close(): void;
 };

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "type": "module",
+  "engines": {
+    "node": ">=22.5.0"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
@@ -34,17 +37,24 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agentvault/crypto": "0.4.1",
+    "@hpke/chacha20poly1305": "^1.8.0",
+    "@hpke/core": "^1.8.0",
+    "@hpke/dhkem-x448": "^1.8.0",
+    "@hpke/hybridkem-x-wing": "^0.7.0",
+    "@hpke/ml-kem": "^0.3.0",
     "@noble/ciphers": "^1.3.0",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.4.0",
+    "@noble/post-quantum": "^0.6.0",
     "ajv": "^8.18.0",
     "ajv-formats": "^3.0.1",
+    "libsodium-wrappers-sumo": "0.7.15",
     "ws": "^8.21.0",
     "zod": "^3.23.0"
   },
   "devDependencies": {
     "@agentvault/connect-core": "*",
+    "@agentvault/crypto": "0.4.1",
     "@types/node": "^22.0.0",
     "@types/ws": "^8.18.1",
     "esbuild": "0.24.0",