@securecoms/agent-bridge 0.26.2 → 0.26.3

package/dist/bin.js

@@ -7597,6 +7597,15 @@ function systemPrompt(p, settings, agentName) {
 }
 
 // src/service-log.ts
+var ENUM_VALUE = /^[a-z][a-z_]{0,31}$/;
+var ServiceLogEnum = class _ServiceLogEnum {
+  constructor(value) {
+    this.value = value;
+  }
+  static of(value, allowed) {
+    return new _ServiceLogEnum(allowed.includes(value) && ENUM_VALUE.test(value) ? value : "invalid");
+  }
+};
 var TOKEN = /^[a-z][a-z0-9_.-]{0,63}$/;
 var CLASS = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
 function errorClass(error) {
@@ -7626,6 +7635,7 @@ function formatServiceLog(level3, event, fields = {}, error) {
     if (!TOKEN.test(key)) continue;
     if (typeof value === "boolean") parts.push(`${key}=${value}`);
     else if (typeof value === "number" && Number.isFinite(value)) parts.push(`${key}=${value}`);
+    else if (value instanceof ServiceLogEnum && ENUM_VALUE.test(value.value)) parts.push(`${key}=${value.value}`);
   }
   if (error !== void 0) parts.push(`error_class=${errorClass(error)}`);
   return parts.join(" ");
@@ -32344,6 +32354,7 @@ var BridgeAgent = class _BridgeAgent {
         if (ownerDirect || ownerRelayed) tool_grants = OWNER_DM_DEFAULT_READ_GRANTS;
       }
     }
+    this.logAuthzDecision(channelId, senderId, relaySpeakerId, audience, tool_grants.length);
     return Object.freeze({
       version: 1,
       audience,
@@ -32351,6 +32362,54 @@ var BridgeAgent = class _BridgeAgent {
       tool_grants
     });
   }
+  /**
+   * One content-free INFO line per authorization decision (every call site of
+   * authorizationFor stages exactly one runtime turn). It says WHY a turn got
+   * the grants it got, without any identifier, name or text: every field is a
+   * boolean, a count, or a closed-set label.
+   *
+   *   owner_pin                pinned | anomalous | missing (channelOwner cache)
+   *   owner_row_is_agent_owner the pinned owner's roster row; `absent` when
+   *                            there is no pin or the row is not in the roster
+   *   sender_is_owner          sender identity == pinned owner identity
+   *   relay                    sender's roster row has is_relay
+   *   relay_speaker_is_owner   `na` unless a relay speaker was passed
+   *   kill_switch              SECURECOMS_OWNER_DM_DEFAULT_GRANTS as read at
+   *                            startup: `on` = default grants enabled
+   *   meta_fresh / roster_fresh whether the channel meta / roster caches were
+   *                            fresh (either stale forces audience=unknown)
+   */
+  logAuthzDecision(channelId, senderId, relaySpeakerId, audience, grants) {
+    const meta = this.freshMeta(channelId);
+    const roster = this.freshRoster(channelId);
+    const sender = roster?.get(senderId);
+    const pinned = this.channelOwner.get(channelId);
+    const ownerId = pinned && pinned !== "anomalous" ? pinned.identityId : void 0;
+    const ownerRow = ownerId !== void 0 ? roster?.get(ownerId) : void 0;
+    const ownerPin = pinned === void 0 ? "missing" : pinned === "anomalous" ? "anomalous" : "pinned";
+    const ownerRowIsAgentOwner = ownerRow === void 0 ? "absent" : ownerRow.is_agent_owner ? "true" : "false";
+    const speakerIsOwner = relaySpeakerId === void 0 ? "na" : ownerId !== void 0 && relaySpeakerId === ownerId ? "true" : "false";
+    writeServiceLog("info", "authz.decision", {
+      audience: ServiceLogEnum.of(audience, [
+        "owner_dm",
+        "other_human_dm",
+        "team_room",
+        "partner_room",
+        "agent_to_agent",
+        "unknown"
+      ]),
+      grants,
+      owner_pin: ServiceLogEnum.of(ownerPin, ["pinned", "anomalous", "missing"]),
+      owner_row_is_agent_owner: ServiceLogEnum.of(ownerRowIsAgentOwner, ["true", "false", "absent"]),
+      sender_is_owner: ownerId !== void 0 && senderId === ownerId,
+      relay: sender?.is_relay === true,
+      relay_speaker_is_owner: ServiceLogEnum.of(speakerIsOwner, ["true", "false", "na"]),
+      is_dm: meta?.is_dm === true,
+      kill_switch: ServiceLogEnum.of(this.ownerDmDefaultGrants ? "on" : "off", ["on", "off"]),
+      meta_fresh: meta !== void 0,
+      roster_fresh: roster !== void 0
+    });
+  }
   /**
    * Task 8 (owner-attested Reset Secure Session): STRUCTURAL owner selection —
    * NEVER read the server's `role` field to pick the owner. In a DM the owner

package/dist/bridge-agent.d.ts

@@ -1967,6 +1967,24 @@ export declare class BridgeAgent {
      * Everything else gets the frozen empty list.
      */
     private authorizationFor;
+    /**
+     * One content-free INFO line per authorization decision (every call site of
+     * authorizationFor stages exactly one runtime turn). It says WHY a turn got
+     * the grants it got, without any identifier, name or text: every field is a
+     * boolean, a count, or a closed-set label.
+     *
+     *   owner_pin                pinned | anomalous | missing (channelOwner cache)
+     *   owner_row_is_agent_owner the pinned owner's roster row; `absent` when
+     *                            there is no pin or the row is not in the roster
+     *   sender_is_owner          sender identity == pinned owner identity
+     *   relay                    sender's roster row has is_relay
+     *   relay_speaker_is_owner   `na` unless a relay speaker was passed
+     *   kill_switch              SECURECOMS_OWNER_DM_DEFAULT_GRANTS as read at
+     *                            startup: `on` = default grants enabled
+     *   meta_fresh / roster_fresh whether the channel meta / roster caches were
+     *                            fresh (either stale forces audience=unknown)
+     */
+    private logAuthzDecision;
     /**
      * Task 8 (owner-attested Reset Secure Session): STRUCTURAL owner selection —
      * NEVER read the server's `role` field to pick the owner. In a DM the owner

package/dist/index.js

@@ -27308,6 +27308,15 @@ var TokenBucketFloor = class {
 };
 
 // src/service-log.ts
+var ENUM_VALUE = /^[a-z][a-z_]{0,31}$/;
+var ServiceLogEnum = class _ServiceLogEnum {
+  constructor(value) {
+    this.value = value;
+  }
+  static of(value, allowed) {
+    return new _ServiceLogEnum(allowed.includes(value) && ENUM_VALUE.test(value) ? value : "invalid");
+  }
+};
 var TOKEN2 = /^[a-z][a-z0-9_.-]{0,63}$/;
 var CLASS2 = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
 function errorClass2(error) {
@@ -27337,6 +27346,7 @@ function formatServiceLog2(level3, event, fields = {}, error) {
     if (!TOKEN2.test(key)) continue;
     if (typeof value === "boolean") parts.push(`${key}=${value}`);
     else if (typeof value === "number" && Number.isFinite(value)) parts.push(`${key}=${value}`);
+    else if (value instanceof ServiceLogEnum && ENUM_VALUE.test(value.value)) parts.push(`${key}=${value.value}`);
   }
   if (error !== void 0) parts.push(`error_class=${errorClass2(error)}`);
   return parts.join(" ");
@@ -32192,6 +32202,7 @@ var BridgeAgent = class _BridgeAgent {
         if (ownerDirect || ownerRelayed) tool_grants = OWNER_DM_DEFAULT_READ_GRANTS;
       }
     }
+    this.logAuthzDecision(channelId, senderId, relaySpeakerId, audience, tool_grants.length);
     return Object.freeze({
       version: 1,
       audience,
@@ -32199,6 +32210,54 @@ var BridgeAgent = class _BridgeAgent {
       tool_grants
     });
   }
+  /**
+   * One content-free INFO line per authorization decision (every call site of
+   * authorizationFor stages exactly one runtime turn). It says WHY a turn got
+   * the grants it got, without any identifier, name or text: every field is a
+   * boolean, a count, or a closed-set label.
+   *
+   *   owner_pin                pinned | anomalous | missing (channelOwner cache)
+   *   owner_row_is_agent_owner the pinned owner's roster row; `absent` when
+   *                            there is no pin or the row is not in the roster
+   *   sender_is_owner          sender identity == pinned owner identity
+   *   relay                    sender's roster row has is_relay
+   *   relay_speaker_is_owner   `na` unless a relay speaker was passed
+   *   kill_switch              SECURECOMS_OWNER_DM_DEFAULT_GRANTS as read at
+   *                            startup: `on` = default grants enabled
+   *   meta_fresh / roster_fresh whether the channel meta / roster caches were
+   *                            fresh (either stale forces audience=unknown)
+   */
+  logAuthzDecision(channelId, senderId, relaySpeakerId, audience, grants) {
+    const meta = this.freshMeta(channelId);
+    const roster = this.freshRoster(channelId);
+    const sender = roster?.get(senderId);
+    const pinned = this.channelOwner.get(channelId);
+    const ownerId = pinned && pinned !== "anomalous" ? pinned.identityId : void 0;
+    const ownerRow = ownerId !== void 0 ? roster?.get(ownerId) : void 0;
+    const ownerPin = pinned === void 0 ? "missing" : pinned === "anomalous" ? "anomalous" : "pinned";
+    const ownerRowIsAgentOwner = ownerRow === void 0 ? "absent" : ownerRow.is_agent_owner ? "true" : "false";
+    const speakerIsOwner = relaySpeakerId === void 0 ? "na" : ownerId !== void 0 && relaySpeakerId === ownerId ? "true" : "false";
+    writeServiceLog2("info", "authz.decision", {
+      audience: ServiceLogEnum.of(audience, [
+        "owner_dm",
+        "other_human_dm",
+        "team_room",
+        "partner_room",
+        "agent_to_agent",
+        "unknown"
+      ]),
+      grants,
+      owner_pin: ServiceLogEnum.of(ownerPin, ["pinned", "anomalous", "missing"]),
+      owner_row_is_agent_owner: ServiceLogEnum.of(ownerRowIsAgentOwner, ["true", "false", "absent"]),
+      sender_is_owner: ownerId !== void 0 && senderId === ownerId,
+      relay: sender?.is_relay === true,
+      relay_speaker_is_owner: ServiceLogEnum.of(speakerIsOwner, ["true", "false", "na"]),
+      is_dm: meta?.is_dm === true,
+      kill_switch: ServiceLogEnum.of(this.ownerDmDefaultGrants ? "on" : "off", ["on", "off"]),
+      meta_fresh: meta !== void 0,
+      roster_fresh: roster !== void 0
+    });
+  }
   /**
    * Task 8 (owner-attested Reset Secure Session): STRUCTURAL owner selection —
    * NEVER read the server's `role` field to pick the owner. In a DM the owner

package/dist/service-log.d.ts

@@ -1,5 +1,18 @@
 export type ServiceLogLevel = "debug" | "info" | "warn" | "error";
-export type ServiceLogFields = Readonly<Record<string, number | boolean>>;
+/**
+ * A closed-set label for a service-log field. The only way to build one is
+ * `ServiceLogEnum.of(value, allowed)`: a value outside `allowed`, or one that
+ * is not a short lowercase word, renders as `invalid`. Raw strings are still
+ * dropped by `formatServiceLog`, so an identifier, name or message text can
+ * never reach the log through a field. The privacy test requires `allowed` to
+ * be an inline array of string literals at every call site.
+ */
+export declare class ServiceLogEnum {
+    readonly value: string;
+    private constructor();
+    static of<T extends string>(value: T, allowed: readonly T[]): ServiceLogEnum;
+}
+export type ServiceLogFields = Readonly<Record<string, number | boolean | ServiceLogEnum>>;
 export type ServiceLog = (level: ServiceLogLevel, event: string, fields?: ServiceLogFields, error?: unknown) => void;
 /** Reduce a thrown value without reading its message, stack, or string form. */
 export declare function errorClass(error: unknown): string;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.26.2";
+export declare const BRIDGE_VERSION = "0.26.3";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.26.2",
+  "version": "0.26.3",
   "type": "module",
   "engines": {
     "node": ">=22.5.0"