@securecoms/agent-bridge 0.26.3 → 0.26.5

package/dist/bin.js

@@ -28512,11 +28512,26 @@ function clampContent(content, max = MAX_MESSAGE_CHARS) {
   const marker = "\u2026";
   return content.slice(0, Math.max(0, max - marker.length)) + marker;
 }
+var FAST_DEFER_RULE = `Whenever you cannot answer completely from what is shown here, never say you can't, that you lack a tool, access or real-time data: reply with one short sentence like "Let me check that." and end with the exact token [[DEFER]] so the full agent answers next.`;
+var REFUSAL_PATTERNS = [
+  // "I can't / cannot / am unable to / am not able to <check|access|...>", optional adverb.
+  /\b(?:can't|cannot|can\s+not|unable\s+to|not\s+able\s+to)\s+(?:\w+ly\s+)?(?:check|access|look|see|browse|search|get|provide|give\s+you|find|retrieve|fetch|pull|know|help\s+with\s+(?:that|this)|do\s+that)\b/,
+  // "I don't / do not / doesn't have (a|any|the)? <tool|access|ability|real-time|live ...>".
+  /\b(?:don't|do\s+not|doesn't|does\s+not|lack)\s+(?:have\s+)?(?:a\s+|any\s+|the\s+)?(?:tool|tools|access|ability|capability|real[-\s]?time|live|current|internet|web|way\s+to)\b/,
+  /\bno\s+(?:access|tools?|internet|web\s+access|real[-\s]?time|live\s+data|way\s+to\s+(?:check|access|know|see))\b/,
+  /\bas\s+an\s+(?:ai|a\.i\.|language\s+model)\b/,
+  /\bbeyond\s+my\s+(?:capabilities|abilities|capability)\b/,
+  /\b(?:knowledge\s+cutoff|training\s+data)\b/
+];
+function isRefusal(reply) {
+  const t = reply.toLowerCase().replace(/[‘’]/g, "'");
+  return REFUSAL_PATTERNS.some((re) => re.test(t));
+}
 function buildFastMessages(args2) {
   const cap = args2.charCap ?? FAST_RECENT_CHARS_CAP;
   const sp = systemPrompt(args2.persona, args2.settings, args2.agentName);
   const head = sp.slice(0, sp.length - CONTINUITY_CLAUSE.length).trimEnd();
-  const system = `${head} ${args2.guidance.trim()} ${CONTINUITY_CLAUSE}`;
+  const system = `${head} ${args2.guidance.trim()} ${FAST_DEFER_RULE} ${CONTINUITY_CLAUSE}`;
   const recent = args2.memory.recent.map((t) => ({
     role: t.role === "agent" ? "assistant" : "user",
     content: t.text
@@ -28775,7 +28790,7 @@ function assertManagedName(name) {
 }
 function isLocalOnlyName(name) {
   const n = name.toLowerCase().replace(/[. ]+$/, "");
-  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json";
+  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets";
 }
 function atomicWrite(path, body, deps) {
   const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -28834,6 +28849,26 @@ function lineHash(line) {
   return createHash2("sha256").update(line.trim(), "utf8").digest("hex");
 }
 var LOCAL_REPORT_FILE = "local-config.json";
+var SECRET_PATH_COUNT_MAX = 1e4;
+var isCount = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0 && v <= SECRET_PATH_COUNT_MAX;
+function parseSecretPathsReport(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const r = raw;
+  const f = r.outside_by_field;
+  if (r.mode !== "report" && r.mode !== "enforce" || !isCount(r.inside) || !isCount(r.allowlisted) || !isCount(r.outside) || !f || typeof f !== "object" || Array.isArray(f) || !isCount(f.headers_file) || !isCount(f.postgres_url_file) || !isCount(f.search_key_file) || f.sqlite !== void 0 && !isCount(f.sqlite)) return void 0;
+  return {
+    mode: r.mode,
+    inside: r.inside,
+    allowlisted: r.allowlisted,
+    outside: r.outside,
+    outside_by_field: {
+      headers_file: f.headers_file,
+      postgres_url_file: f.postgres_url_file,
+      search_key_file: f.search_key_file,
+      ...f.sqlite !== void 0 ? { sqlite: f.sqlite } : {}
+    }
+  };
+}
 var LEGACY_MEMORY_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 var LEGACY_MEMORY_REPORT_MAX_BYTES = 4 * 1024 * 1024;
 var LEGACY_MEMORY_REPORT_MAX_SOURCES = 100;
@@ -28902,7 +28937,8 @@ function readLocalReport(home, identityId) {
     persona,
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
-    legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source)
+    legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source),
+    secret_paths: parseSecretPathsReport(doc.secret_paths)
   };
 }
 function deleteLegacyMemorySources(home, identityId, ids) {
@@ -29704,6 +29740,8 @@ var BridgeAgent = class _BridgeAgent {
   fastPathDeferred = 0;
   /** Of those, `full`-mode turns the deterministic pre-check deferred without calling the fast model. */
   fastPathIntentDeferred = 0;
+  /** Of those, fast-model replies that voiced inability ("I can't check...") — never spoken; the ack is spoken instead. */
+  fastPathRefusalDeferred = 0;
   /**
    * Task 8: count of live AUTHENTICATED /v1/ws sessions, so a later `status`
    * verb can tell "bridge process up" (the app's green dot, which only
@@ -30098,7 +30136,11 @@ var BridgeAgent = class _BridgeAgent {
         // Inert legacy files only. `readLocalReport` revalidates the current
         // regular-file bytes and strips every local path before this leaves the
         // machine.
-        legacy_memory: local?.legacy_memory ?? []
+        legacy_memory: local?.legacy_memory ?? [],
+        // §B.4: counts of server-named secret paths inside / allowlisted /
+        // outside the secrets directory, and the runtime's mode. Numbers and
+        // one enum only; readLocalReport rebuilds it so no path rides along.
+        secret_paths: local?.secret_paths ?? null
       };
       const posted = await this.fetchBounded("runtime_config_report", "control", `${base}/report`, {
         method: "POST",
@@ -31981,11 +32023,15 @@ var BridgeAgent = class _BridgeAgent {
       });
       const maxSentences = this.voiceSettings?.brevity === "one" ? 1 : 2;
       const raw = await this.latency.time("voice.fast_llm", () => fastLlm.complete(messages));
-      const { reply, defer } = splitFastReply(raw, 200, maxSentences);
-      if (!reply) return "failed";
+      const split3 = splitFastReply(raw, 200, maxSentences);
+      if (!split3.reply) return "failed";
+      const refusal = !isGreeting && isRefusal(split3.reply);
+      const defer = split3.defer || refusal;
+      const reply = refusal ? deferAck(m.messageId) : split3.reply;
       await this.sendSpoken(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId));
       this.fastPathSent++;
       if (defer) this.fastPathDeferred++;
+      if (refusal) this.fastPathRefusalDeferred++;
       return defer ? "deferred" : "answered";
     } catch (e) {
       this.fastPathFailed++;
@@ -32322,14 +32368,25 @@ var BridgeAgent = class _BridgeAgent {
    *
    * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
    * the kill switch is on, the channel is a DM, and EITHER
-   *   (a) audience is owner_dm AND the sender is the pinned structural owner
-   *       (`channelOwner`, never "anomalous") — a lying `is_agent_owner` flag
-   *       alone gets nothing; OR
+   *   (a) audience is owner_dm AND the sender is the channel's pinned DM
+   *       counterpart (`channelOwner`, never "anomalous"). A server-marked
+   *       `is_agent_owner` on a member who is NOT the DM's single human
+   *       counterpart gets nothing; on the counterpart it is trusted (see
+   *       LIMIT below); OR
    *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
    *       relayed `speaker_identity_id` (passed by the caller only for relay
    *       turns) is that same pinned owner, whose roster row is the agent's
    *       owner. A speaker claim from any non-relay sender gets nothing.
    * Everything else gets the frozen empty list.
+   *
+   *   LIMIT (harness gate review H2, 2026-10-05): "pinned structural owner"
+   *   is PER CHANNEL. resolveAndPinOwner pins the single human counterpart of
+   *   ANY DM, so in a DM with member Bob, Bob is that channel's pin. What
+   *   separates Bob from the real owner is only the server's `is_agent_owner`
+   *   flag (connect_channels.py: counterpart user == agent's creator). A
+   *   backend that sets that flag wrongly gives Bob the grants, and a harness
+   *   connector turns grants into its full toolset. Binding the owner identity
+   *   once, outside server control, is an open design follow-up.
    */
   authorizationFor(channelId, senderId, relaySpeakerId) {
     const meta = this.freshMeta(channelId);
@@ -33875,6 +33932,31 @@ var BridgeAgent = class _BridgeAgent {
   noteSessionEvicted() {
     this.evictions++;
   }
+  /** Harness tool gate H4: latest connector self-report (see harness-report.ts). */
+  harness = null;
+  /**
+   * Record a connector's harness report (from its /v1/ws hello). WARN once
+   * each time the attached harness turns to an inactive veto: such a harness
+   * refuses every turn without a tool grant, so its rooms go quiet.
+   */
+  recordHarnessReport(report) {
+    const wasInactive = this.harness?.tool_veto === "inactive";
+    this.harness = report;
+    if (report.tool_veto === "inactive" && !wasInactive) {
+      writeServiceLog("warn", "harness.tool_veto_inactive", {
+        harness: ServiceLogEnum.of(report.name, ["hermes", "openclaw", "other"])
+      });
+    }
+  }
+  /** Forget `report` when the connector that sent it disconnects. A report
+   *  from a newer connector (a different object) is kept. */
+  clearHarnessReport(report) {
+    if (this.harness === report) this.harness = null;
+  }
+  /** The latest harness report, or null (GET /v1/status). */
+  harnessReport() {
+    return this.harness;
+  }
   health() {
     let joined = 0;
     for (const s of this.joinState.values()) if (s === "JOINED") joined++;
@@ -33937,12 +34019,14 @@ var BridgeAgent = class _BridgeAgent {
       fast_path_skipped: this.fastPathSkipped,
       fast_path_deferred: this.fastPathDeferred,
       fast_path_intent_deferred: this.fastPathIntentDeferred,
+      fast_path_refusal_deferred: this.fastPathRefusalDeferred,
       fast_path_mode: this.cfg.voiceFastPathMode ?? "full",
       voice_settings_version: this.voiceSettingsVersion,
       voice_settings_source: this.voiceSettingsSource,
       delivery_pings: this.pingsReceived,
       agent_sessions: this.authSessions,
       evictions: this.evictions,
+      harness_tool_veto_active: this.harness === null ? null : this.harness.tool_veto === "active",
       uptime_s: this.startedAt ? Math.floor((Date.now() - this.startedAt) / 1e3) : 0,
       version: BRIDGE_VERSION,
       ...this.memory.stats?.() ?? {}
@@ -34367,6 +34451,9 @@ function createHttpServer(agent, opts) {
         const r = await agent.vaultDelete(parsed.data.enclave_id, parsed.data.vault_channel_id, parsed.data.node_id);
         return json(res, 200, r);
       }
+      if (method === "GET" && path === "/v1/status") {
+        return json(res, 200, { harness: agent.harnessReport() });
+      }
       if (method === "POST" && path === "/v1/status") {
         const parsed = statusSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
@@ -34456,6 +34543,17 @@ function createHttpServer(agent, opts) {
   return { server, closeAllSseStreams: () => closeSse() };
 }
 
+// src/harness-report.ts
+var VERSION_TOKEN = /^[0-9A-Za-z][0-9A-Za-z.+_-]{0,39}$/;
+function parseHarnessReport(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const r = raw;
+  const name = r.name === "hermes" || r.name === "openclaw" ? r.name : "other";
+  const version = typeof r.version === "string" && VERSION_TOKEN.test(r.version) ? r.version : null;
+  const tool_veto = r.tool_veto === "active" || r.tool_veto === "inactive" ? r.tool_veto : "unknown";
+  return Object.freeze({ name, version, tool_veto });
+}
+
 // src/ws-server.ts
 import { WebSocketServer, WebSocket } from "ws";
 var PING_INTERVAL_MS = 3e4;
@@ -34586,6 +34684,7 @@ function attachAgentWebSocket(server, agent, opts) {
       }
       delivered.clear();
       if (current?.sock === sock) current = null;
+      if (session.harness) agent.clearHarnessReport(session.harness);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -34648,7 +34747,11 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     return;
   }
   if (m.type === "hello") {
-    session.consumer = "runtime";
+    const report = m.harness === void 0 ? null : parseHarnessReport(m.harness);
+    if (report) {
+      session.harness = report;
+      agent.recordHarnessReport(report);
+    } else session.consumer = "runtime";
     sendJson(sock, { type: "hello", features: ["nack"] });
     return;
   }

package/dist/bridge-agent.d.ts

@@ -1,4 +1,5 @@
 import { MlsGroupKeyProvider } from "@agentvault/connect-sdk-ts";
+import type { HarnessReport } from "./harness-report.js";
 import type { MemoryContextResult } from "@agentvault/connect-mls-store";
 /**
  * M6 (ADR-0013 Decision H): what the sweep observed about one channel.
@@ -58,7 +59,10 @@ export type BridgeToolGrant = {
  * Tool grants (architect ruling, 2026-10-02): until channel-grant persistence
  * lands, the ONLY non-empty grant list is OWNER_DM_DEFAULT_READ_GRANTS
  * (`current_time` + `web_search`, read mode), and only on a DM whose sender is
- * the pinned structural owner (or a relayed voice turn whose speaker is). Every
+ * that DM's pinned human counterpart AND server-marked `is_agent_owner` (or a
+ * relayed voice turn whose speaker is). The pin is per channel, so the
+ * owner distinction rests on the server's flag: see authorizationFor's LIMIT
+ * note. Every
  * other audience, an unpinned or anomalous owner, and the kill switch
  * `SECURECOMS_OWNER_DM_DEFAULT_GRANTS` (anything but unset/`on`) get `[]`.
  * SEC-06 is LIVE for these two tools: docs/security/sec-06-runtime-bounds-audit.md.
@@ -800,6 +804,8 @@ export declare class BridgeAgent {
     private fastPathDeferred;
     /** Of those, `full`-mode turns the deterministic pre-check deferred without calling the fast model. */
     private fastPathIntentDeferred;
+    /** Of those, fast-model replies that voiced inability ("I can't check...") — never spoken; the ack is spoken instead. */
+    private fastPathRefusalDeferred;
     /**
      * Task 8: count of live AUTHENTICATED /v1/ws sessions, so a later `status`
      * verb can tell "bridge process up" (the app's green dot, which only
@@ -1957,14 +1963,25 @@ export declare class BridgeAgent {
      *
      * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
      * the kill switch is on, the channel is a DM, and EITHER
-     *   (a) audience is owner_dm AND the sender is the pinned structural owner
-     *       (`channelOwner`, never "anomalous") — a lying `is_agent_owner` flag
-     *       alone gets nothing; OR
+     *   (a) audience is owner_dm AND the sender is the channel's pinned DM
+     *       counterpart (`channelOwner`, never "anomalous"). A server-marked
+     *       `is_agent_owner` on a member who is NOT the DM's single human
+     *       counterpart gets nothing; on the counterpart it is trusted (see
+     *       LIMIT below); OR
      *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
      *       relayed `speaker_identity_id` (passed by the caller only for relay
      *       turns) is that same pinned owner, whose roster row is the agent's
      *       owner. A speaker claim from any non-relay sender gets nothing.
      * Everything else gets the frozen empty list.
+     *
+     *   LIMIT (harness gate review H2, 2026-10-05): "pinned structural owner"
+     *   is PER CHANNEL. resolveAndPinOwner pins the single human counterpart of
+     *   ANY DM, so in a DM with member Bob, Bob is that channel's pin. What
+     *   separates Bob from the real owner is only the server's `is_agent_owner`
+     *   flag (connect_channels.py: counterpart user == agent's creator). A
+     *   backend that sets that flag wrongly gives Bob the grants, and a harness
+     *   connector turns grants into its full toolset. Binding the owner identity
+     *   once, outside server control, is an open design follow-up.
      */
     private authorizationFor;
     /**
@@ -2296,6 +2313,19 @@ export declare class BridgeAgent {
      * ws-server.ts right after prior.cleanup() in the eviction path.
      */
     noteSessionEvicted(): void;
+    /** Harness tool gate H4: latest connector self-report (see harness-report.ts). */
+    private harness;
+    /**
+     * Record a connector's harness report (from its /v1/ws hello). WARN once
+     * each time the attached harness turns to an inactive veto: such a harness
+     * refuses every turn without a tool grant, so its rooms go quiet.
+     */
+    recordHarnessReport(report: HarnessReport): void;
+    /** Forget `report` when the connector that sent it disconnects. A report
+     *  from a newer connector (a different object) is kept. */
+    clearHarnessReport(report: HarnessReport): void;
+    /** The latest harness report, or null (GET /v1/status). */
+    harnessReport(): HarnessReport | null;
     health(): {
         status: "ok";
         identity_id: string;
@@ -2344,6 +2374,8 @@ export declare class BridgeAgent {
         fast_path_deferred: number;
         /** `full`-mode turns deferred by the deterministic pre-check (no fast model call). */
         fast_path_intent_deferred: number;
+        /** Fast-model replies that voiced inability/lack of tools: never spoken, deferred behind the canned ack instead. */
+        fast_path_refusal_deferred: number;
         /** Credential `voice_fast_path_mode`: "full" (default), "ack_only" or "off". */
         fast_path_mode: "full" | "ack_only" | "off";
         /** Plan 2026-09-06 (agent voice settings): version of the loaded backend
@@ -2365,6 +2397,12 @@ export declare class BridgeAgent {
          *  agent_sessions stays >=1 means two connectors are flapping the same
          *  identity (split-brain), not one stable harness. */
         evictions: number;
+        /** Harness tool gate H4: is the attached harness's tool veto active?
+         *  null when no connector is attached with a report. false means that
+         *  harness refuses every turn without a tool grant. Only this boolean is
+         *  on the unauthenticated /healthz; name and version are on the
+         *  authenticated GET /v1/status. */
+        harness_tool_veto_active: boolean | null;
         uptime_s: number;
         version: string;
         /** M6: is the self-heal sweep running at all? It is the SOLE writer of the

package/dist/harness-report.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A connector's self-report, carried on its `/v1/ws` hello (harness tool
+ * gate, fix round 1 H4): which harness is attached and whether its tool veto
+ * is active. Untrusted input from a loopback client: every field is closed to
+ * a known set or a bounded version token, so only booleans/versions reach
+ * /healthz, GET /v1/status and the service log.
+ */
+export interface HarnessReport {
+    readonly name: "hermes" | "openclaw" | "other";
+    readonly version: string | null;
+    /** "inactive": the harness refuses every turn without a tool grant. */
+    readonly tool_veto: "active" | "inactive" | "unknown";
+}
+export declare function parseHarnessReport(raw: unknown): HarnessReport | null;

package/dist/index.js

@@ -28288,11 +28288,26 @@ function clampContent(content, max = MAX_MESSAGE_CHARS) {
   const marker = "\u2026";
   return content.slice(0, Math.max(0, max - marker.length)) + marker;
 }
+var FAST_DEFER_RULE = `Whenever you cannot answer completely from what is shown here, never say you can't, that you lack a tool, access or real-time data: reply with one short sentence like "Let me check that." and end with the exact token [[DEFER]] so the full agent answers next.`;
+var REFUSAL_PATTERNS = [
+  // "I can't / cannot / am unable to / am not able to <check|access|...>", optional adverb.
+  /\b(?:can't|cannot|can\s+not|unable\s+to|not\s+able\s+to)\s+(?:\w+ly\s+)?(?:check|access|look|see|browse|search|get|provide|give\s+you|find|retrieve|fetch|pull|know|help\s+with\s+(?:that|this)|do\s+that)\b/,
+  // "I don't / do not / doesn't have (a|any|the)? <tool|access|ability|real-time|live ...>".
+  /\b(?:don't|do\s+not|doesn't|does\s+not|lack)\s+(?:have\s+)?(?:a\s+|any\s+|the\s+)?(?:tool|tools|access|ability|capability|real[-\s]?time|live|current|internet|web|way\s+to)\b/,
+  /\bno\s+(?:access|tools?|internet|web\s+access|real[-\s]?time|live\s+data|way\s+to\s+(?:check|access|know|see))\b/,
+  /\bas\s+an\s+(?:ai|a\.i\.|language\s+model)\b/,
+  /\bbeyond\s+my\s+(?:capabilities|abilities|capability)\b/,
+  /\b(?:knowledge\s+cutoff|training\s+data)\b/
+];
+function isRefusal(reply) {
+  const t = reply.toLowerCase().replace(/[‘’]/g, "'");
+  return REFUSAL_PATTERNS.some((re) => re.test(t));
+}
 function buildFastMessages(args2) {
   const cap = args2.charCap ?? FAST_RECENT_CHARS_CAP;
   const sp = systemPrompt(args2.persona, args2.settings, args2.agentName);
   const head = sp.slice(0, sp.length - CONTINUITY_CLAUSE.length).trimEnd();
-  const system = `${head} ${args2.guidance.trim()} ${CONTINUITY_CLAUSE}`;
+  const system = `${head} ${args2.guidance.trim()} ${FAST_DEFER_RULE} ${CONTINUITY_CLAUSE}`;
   const recent = args2.memory.recent.map((t) => ({
     role: t.role === "agent" ? "assistant" : "user",
     content: t.text
@@ -28623,7 +28638,7 @@ function assertManagedName(name) {
 }
 function isLocalOnlyName(name) {
   const n = name.toLowerCase().replace(/[. ]+$/, "");
-  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json";
+  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets";
 }
 function atomicWrite(path, body, deps) {
   const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -28682,6 +28697,26 @@ function lineHash(line) {
   return createHash2("sha256").update(line.trim(), "utf8").digest("hex");
 }
 var LOCAL_REPORT_FILE = "local-config.json";
+var SECRET_PATH_COUNT_MAX = 1e4;
+var isCount = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0 && v <= SECRET_PATH_COUNT_MAX;
+function parseSecretPathsReport(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const r = raw;
+  const f = r.outside_by_field;
+  if (r.mode !== "report" && r.mode !== "enforce" || !isCount(r.inside) || !isCount(r.allowlisted) || !isCount(r.outside) || !f || typeof f !== "object" || Array.isArray(f) || !isCount(f.headers_file) || !isCount(f.postgres_url_file) || !isCount(f.search_key_file) || f.sqlite !== void 0 && !isCount(f.sqlite)) return void 0;
+  return {
+    mode: r.mode,
+    inside: r.inside,
+    allowlisted: r.allowlisted,
+    outside: r.outside,
+    outside_by_field: {
+      headers_file: f.headers_file,
+      postgres_url_file: f.postgres_url_file,
+      search_key_file: f.search_key_file,
+      ...f.sqlite !== void 0 ? { sqlite: f.sqlite } : {}
+    }
+  };
+}
 var LEGACY_MEMORY_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 var LEGACY_MEMORY_REPORT_MAX_BYTES = 4 * 1024 * 1024;
 var LEGACY_MEMORY_REPORT_MAX_SOURCES = 100;
@@ -28750,7 +28785,8 @@ function readLocalReport(home, identityId) {
     persona,
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
-    legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source)
+    legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source),
+    secret_paths: parseSecretPathsReport(doc.secret_paths)
   };
 }
 function deleteLegacyMemorySources(home, identityId, ids) {
@@ -29552,6 +29588,8 @@ var BridgeAgent = class _BridgeAgent {
   fastPathDeferred = 0;
   /** Of those, `full`-mode turns the deterministic pre-check deferred without calling the fast model. */
   fastPathIntentDeferred = 0;
+  /** Of those, fast-model replies that voiced inability ("I can't check...") — never spoken; the ack is spoken instead. */
+  fastPathRefusalDeferred = 0;
   /**
    * Task 8: count of live AUTHENTICATED /v1/ws sessions, so a later `status`
    * verb can tell "bridge process up" (the app's green dot, which only
@@ -29946,7 +29984,11 @@ var BridgeAgent = class _BridgeAgent {
         // Inert legacy files only. `readLocalReport` revalidates the current
         // regular-file bytes and strips every local path before this leaves the
         // machine.
-        legacy_memory: local?.legacy_memory ?? []
+        legacy_memory: local?.legacy_memory ?? [],
+        // §B.4: counts of server-named secret paths inside / allowlisted /
+        // outside the secrets directory, and the runtime's mode. Numbers and
+        // one enum only; readLocalReport rebuilds it so no path rides along.
+        secret_paths: local?.secret_paths ?? null
       };
       const posted = await this.fetchBounded("runtime_config_report", "control", `${base}/report`, {
         method: "POST",
@@ -31829,11 +31871,15 @@ var BridgeAgent = class _BridgeAgent {
       });
       const maxSentences = this.voiceSettings?.brevity === "one" ? 1 : 2;
       const raw = await this.latency.time("voice.fast_llm", () => fastLlm.complete(messages));
-      const { reply, defer } = splitFastReply(raw, 200, maxSentences);
-      if (!reply) return "failed";
+      const split3 = splitFastReply(raw, 200, maxSentences);
+      if (!split3.reply) return "failed";
+      const refusal = !isGreeting && isRefusal(split3.reply);
+      const defer = split3.defer || refusal;
+      const reply = refusal ? deferAck(m.messageId) : split3.reply;
       await this.sendSpoken(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId));
       this.fastPathSent++;
       if (defer) this.fastPathDeferred++;
+      if (refusal) this.fastPathRefusalDeferred++;
       return defer ? "deferred" : "answered";
     } catch (e) {
       this.fastPathFailed++;
@@ -32170,14 +32216,25 @@ var BridgeAgent = class _BridgeAgent {
    *
    * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
    * the kill switch is on, the channel is a DM, and EITHER
-   *   (a) audience is owner_dm AND the sender is the pinned structural owner
-   *       (`channelOwner`, never "anomalous") — a lying `is_agent_owner` flag
-   *       alone gets nothing; OR
+   *   (a) audience is owner_dm AND the sender is the channel's pinned DM
+   *       counterpart (`channelOwner`, never "anomalous"). A server-marked
+   *       `is_agent_owner` on a member who is NOT the DM's single human
+   *       counterpart gets nothing; on the counterpart it is trusted (see
+   *       LIMIT below); OR
    *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
    *       relayed `speaker_identity_id` (passed by the caller only for relay
    *       turns) is that same pinned owner, whose roster row is the agent's
    *       owner. A speaker claim from any non-relay sender gets nothing.
    * Everything else gets the frozen empty list.
+   *
+   *   LIMIT (harness gate review H2, 2026-10-05): "pinned structural owner"
+   *   is PER CHANNEL. resolveAndPinOwner pins the single human counterpart of
+   *   ANY DM, so in a DM with member Bob, Bob is that channel's pin. What
+   *   separates Bob from the real owner is only the server's `is_agent_owner`
+   *   flag (connect_channels.py: counterpart user == agent's creator). A
+   *   backend that sets that flag wrongly gives Bob the grants, and a harness
+   *   connector turns grants into its full toolset. Binding the owner identity
+   *   once, outside server control, is an open design follow-up.
    */
   authorizationFor(channelId, senderId, relaySpeakerId) {
     const meta = this.freshMeta(channelId);
@@ -33723,6 +33780,31 @@ var BridgeAgent = class _BridgeAgent {
   noteSessionEvicted() {
     this.evictions++;
   }
+  /** Harness tool gate H4: latest connector self-report (see harness-report.ts). */
+  harness = null;
+  /**
+   * Record a connector's harness report (from its /v1/ws hello). WARN once
+   * each time the attached harness turns to an inactive veto: such a harness
+   * refuses every turn without a tool grant, so its rooms go quiet.
+   */
+  recordHarnessReport(report) {
+    const wasInactive = this.harness?.tool_veto === "inactive";
+    this.harness = report;
+    if (report.tool_veto === "inactive" && !wasInactive) {
+      writeServiceLog2("warn", "harness.tool_veto_inactive", {
+        harness: ServiceLogEnum.of(report.name, ["hermes", "openclaw", "other"])
+      });
+    }
+  }
+  /** Forget `report` when the connector that sent it disconnects. A report
+   *  from a newer connector (a different object) is kept. */
+  clearHarnessReport(report) {
+    if (this.harness === report) this.harness = null;
+  }
+  /** The latest harness report, or null (GET /v1/status). */
+  harnessReport() {
+    return this.harness;
+  }
   health() {
     let joined = 0;
     for (const s of this.joinState.values()) if (s === "JOINED") joined++;
@@ -33785,12 +33867,14 @@ var BridgeAgent = class _BridgeAgent {
       fast_path_skipped: this.fastPathSkipped,
       fast_path_deferred: this.fastPathDeferred,
       fast_path_intent_deferred: this.fastPathIntentDeferred,
+      fast_path_refusal_deferred: this.fastPathRefusalDeferred,
       fast_path_mode: this.cfg.voiceFastPathMode ?? "full",
       voice_settings_version: this.voiceSettingsVersion,
       voice_settings_source: this.voiceSettingsSource,
       delivery_pings: this.pingsReceived,
       agent_sessions: this.authSessions,
       evictions: this.evictions,
+      harness_tool_veto_active: this.harness === null ? null : this.harness.tool_veto === "active",
       uptime_s: this.startedAt ? Math.floor((Date.now() - this.startedAt) / 1e3) : 0,
       version: BRIDGE_VERSION,
       ...this.memory.stats?.() ?? {}
@@ -34323,6 +34407,9 @@ function createHttpServer(agent, opts) {
         const r = await agent.vaultDelete(parsed.data.enclave_id, parsed.data.vault_channel_id, parsed.data.node_id);
         return json(res, 200, r);
       }
+      if (method === "GET" && path === "/v1/status") {
+        return json(res, 200, { harness: agent.harnessReport() });
+      }
       if (method === "POST" && path === "/v1/status") {
         const parsed = statusSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
@@ -34412,6 +34499,17 @@ function createHttpServer(agent, opts) {
   return { server, closeAllSseStreams: () => closeSse() };
 }
 
+// src/harness-report.ts
+var VERSION_TOKEN = /^[0-9A-Za-z][0-9A-Za-z.+_-]{0,39}$/;
+function parseHarnessReport(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const r = raw;
+  const name = r.name === "hermes" || r.name === "openclaw" ? r.name : "other";
+  const version = typeof r.version === "string" && VERSION_TOKEN.test(r.version) ? r.version : null;
+  const tool_veto = r.tool_veto === "active" || r.tool_veto === "inactive" ? r.tool_veto : "unknown";
+  return Object.freeze({ name, version, tool_veto });
+}
+
 // src/ws-server.ts
 import { WebSocketServer, WebSocket } from "ws";
 var PING_INTERVAL_MS = 3e4;
@@ -34542,6 +34640,7 @@ function attachAgentWebSocket(server, agent, opts) {
       }
       delivered.clear();
       if (current?.sock === sock) current = null;
+      if (session.harness) agent.clearHarnessReport(session.harness);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -34604,7 +34703,11 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     return;
   }
   if (m.type === "hello") {
-    session.consumer = "runtime";
+    const report = m.harness === void 0 ? null : parseHarnessReport(m.harness);
+    if (report) {
+      session.harness = report;
+      agent.recordHarnessReport(report);
+    } else session.consumer = "runtime";
     sendJson(sock, { type: "hello", features: ["nack"] });
     return;
   }

package/dist/service/runtime-config-dir.d.ts

@@ -35,6 +35,28 @@ export interface LocalReport {
     has_search_key: boolean;
     has_llm_key: boolean;
     legacy_memory: LegacyMemoryReport[];
+    /** §B.4 counts; undefined when the runtime reported none or the block was malformed. */
+    secret_paths?: SecretPathsReport;
+}
+/**
+ * §B.4: how many server-named secret paths in the managed config are inside
+ * the secrets directory, owner-allowlisted, or outside it, and the runtime's
+ * mode. Rebuilt field by field from the runtime's file: numbers and one enum,
+ * so no path (the owner's `allowed_secret_paths` sits in the same file) can
+ * ride along to the backend.
+ */
+export interface SecretPathsReport {
+    mode: "report" | "enforce";
+    inside: number;
+    allowlisted: number;
+    outside: number;
+    /** `sqlite` (H1) is absent from a runtime that predates it; absent means unknown, not zero. */
+    outside_by_field: {
+        headers_file: number;
+        postgres_url_file: number;
+        search_key_file: number;
+        sqlite?: number;
+    };
 }
 export type LegacyMemoryKind = "global-memory" | "conversation-history" | "captured-memory";
 export declare const LEGACY_MEMORY_FACT_MAX_BYTES = 1024;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.26.3";
+export declare const BRIDGE_VERSION = "0.26.5";

package/dist/voice/fast-prompt.d.ts

@@ -29,6 +29,15 @@ export declare const MAX_MESSAGE_CHARS = 8000;
 export declare const FAST_PATH_MEMORY_TURNS = 10;
 export declare const FAST_RECENT_CHARS_CAP = 1500;
 export declare const FAST_FACTS_CHARS_CAP = 2000;
+/**
+ * Live bug 2026-10-02 (bridge 0.26.3): asked for Sydney's weather, the fast
+ * model said "I can't check the weather right now since I don't have a
+ * tool..." with no [[DEFER]], so the runtime (which has web_search) never got
+ * the turn. Placed last before the continuity clause so it is the final rule
+ * the model reads. Compiled in, never interpolated with peer data.
+ */
+export declare const FAST_DEFER_RULE: string;
+export declare function isRefusal(reply: string): boolean;
 export declare function buildFastMessages(args: {
     persona: VoicePersona;
     guidance: string;