@securecoms/agent-bridge 0.26.4 → 0.26.5

package/dist/bridge-agent.d.ts

@@ -1,4 +1,5 @@
 import { MlsGroupKeyProvider } from "@agentvault/connect-sdk-ts";
+import type { HarnessReport } from "./harness-report.js";
 import type { MemoryContextResult } from "@agentvault/connect-mls-store";
 /**
  * M6 (ADR-0013 Decision H): what the sweep observed about one channel.
@@ -58,7 +59,10 @@ export type BridgeToolGrant = {
  * Tool grants (architect ruling, 2026-10-02): until channel-grant persistence
  * lands, the ONLY non-empty grant list is OWNER_DM_DEFAULT_READ_GRANTS
  * (`current_time` + `web_search`, read mode), and only on a DM whose sender is
- * the pinned structural owner (or a relayed voice turn whose speaker is). Every
+ * that DM's pinned human counterpart AND server-marked `is_agent_owner` (or a
+ * relayed voice turn whose speaker is). The pin is per channel, so the
+ * owner distinction rests on the server's flag: see authorizationFor's LIMIT
+ * note. Every
  * other audience, an unpinned or anomalous owner, and the kill switch
  * `SECURECOMS_OWNER_DM_DEFAULT_GRANTS` (anything but unset/`on`) get `[]`.
  * SEC-06 is LIVE for these two tools: docs/security/sec-06-runtime-bounds-audit.md.
@@ -1959,14 +1963,25 @@ export declare class BridgeAgent {
      *
      * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
      * the kill switch is on, the channel is a DM, and EITHER
-     *   (a) audience is owner_dm AND the sender is the pinned structural owner
-     *       (`channelOwner`, never "anomalous") — a lying `is_agent_owner` flag
-     *       alone gets nothing; OR
+     *   (a) audience is owner_dm AND the sender is the channel's pinned DM
+     *       counterpart (`channelOwner`, never "anomalous"). A server-marked
+     *       `is_agent_owner` on a member who is NOT the DM's single human
+     *       counterpart gets nothing; on the counterpart it is trusted (see
+     *       LIMIT below); OR
      *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
      *       relayed `speaker_identity_id` (passed by the caller only for relay
      *       turns) is that same pinned owner, whose roster row is the agent's
      *       owner. A speaker claim from any non-relay sender gets nothing.
      * Everything else gets the frozen empty list.
+     *
+     *   LIMIT (harness gate review H2, 2026-10-05): "pinned structural owner"
+     *   is PER CHANNEL. resolveAndPinOwner pins the single human counterpart of
+     *   ANY DM, so in a DM with member Bob, Bob is that channel's pin. What
+     *   separates Bob from the real owner is only the server's `is_agent_owner`
+     *   flag (connect_channels.py: counterpart user == agent's creator). A
+     *   backend that sets that flag wrongly gives Bob the grants, and a harness
+     *   connector turns grants into its full toolset. Binding the owner identity
+     *   once, outside server control, is an open design follow-up.
      */
     private authorizationFor;
     /**
@@ -2298,6 +2313,19 @@ export declare class BridgeAgent {
      * ws-server.ts right after prior.cleanup() in the eviction path.
      */
     noteSessionEvicted(): void;
+    /** Harness tool gate H4: latest connector self-report (see harness-report.ts). */
+    private harness;
+    /**
+     * Record a connector's harness report (from its /v1/ws hello). WARN once
+     * each time the attached harness turns to an inactive veto: such a harness
+     * refuses every turn without a tool grant, so its rooms go quiet.
+     */
+    recordHarnessReport(report: HarnessReport): void;
+    /** Forget `report` when the connector that sent it disconnects. A report
+     *  from a newer connector (a different object) is kept. */
+    clearHarnessReport(report: HarnessReport): void;
+    /** The latest harness report, or null (GET /v1/status). */
+    harnessReport(): HarnessReport | null;
     health(): {
         status: "ok";
         identity_id: string;
@@ -2369,6 +2397,12 @@ export declare class BridgeAgent {
          *  agent_sessions stays >=1 means two connectors are flapping the same
          *  identity (split-brain), not one stable harness. */
         evictions: number;
+        /** Harness tool gate H4: is the attached harness's tool veto active?
+         *  null when no connector is attached with a report. false means that
+         *  harness refuses every turn without a tool grant. Only this boolean is
+         *  on the unauthenticated /healthz; name and version are on the
+         *  authenticated GET /v1/status. */
+        harness_tool_veto_active: boolean | null;
         uptime_s: number;
         version: string;
         /** M6: is the self-heal sweep running at all? It is the SOLE writer of the

package/dist/harness-report.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A connector's self-report, carried on its `/v1/ws` hello (harness tool
+ * gate, fix round 1 H4): which harness is attached and whether its tool veto
+ * is active. Untrusted input from a loopback client: every field is closed to
+ * a known set or a bounded version token, so only booleans/versions reach
+ * /healthz, GET /v1/status and the service log.
+ */
+export interface HarnessReport {
+    readonly name: "hermes" | "openclaw" | "other";
+    readonly version: string | null;
+    /** "inactive": the harness refuses every turn without a tool grant. */
+    readonly tool_veto: "active" | "inactive" | "unknown";
+}
+export declare function parseHarnessReport(raw: unknown): HarnessReport | null;

package/dist/index.js

@@ -28638,7 +28638,7 @@ function assertManagedName(name) {
 }
 function isLocalOnlyName(name) {
   const n = name.toLowerCase().replace(/[. ]+$/, "");
-  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json";
+  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets";
 }
 function atomicWrite(path, body, deps) {
   const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -28697,6 +28697,26 @@ function lineHash(line) {
   return createHash2("sha256").update(line.trim(), "utf8").digest("hex");
 }
 var LOCAL_REPORT_FILE = "local-config.json";
+var SECRET_PATH_COUNT_MAX = 1e4;
+var isCount = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0 && v <= SECRET_PATH_COUNT_MAX;
+function parseSecretPathsReport(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const r = raw;
+  const f = r.outside_by_field;
+  if (r.mode !== "report" && r.mode !== "enforce" || !isCount(r.inside) || !isCount(r.allowlisted) || !isCount(r.outside) || !f || typeof f !== "object" || Array.isArray(f) || !isCount(f.headers_file) || !isCount(f.postgres_url_file) || !isCount(f.search_key_file) || f.sqlite !== void 0 && !isCount(f.sqlite)) return void 0;
+  return {
+    mode: r.mode,
+    inside: r.inside,
+    allowlisted: r.allowlisted,
+    outside: r.outside,
+    outside_by_field: {
+      headers_file: f.headers_file,
+      postgres_url_file: f.postgres_url_file,
+      search_key_file: f.search_key_file,
+      ...f.sqlite !== void 0 ? { sqlite: f.sqlite } : {}
+    }
+  };
+}
 var LEGACY_MEMORY_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 var LEGACY_MEMORY_REPORT_MAX_BYTES = 4 * 1024 * 1024;
 var LEGACY_MEMORY_REPORT_MAX_SOURCES = 100;
@@ -28765,7 +28785,8 @@ function readLocalReport(home, identityId) {
     persona,
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
-    legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source)
+    legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source),
+    secret_paths: parseSecretPathsReport(doc.secret_paths)
   };
 }
 function deleteLegacyMemorySources(home, identityId, ids) {
@@ -29963,7 +29984,11 @@ var BridgeAgent = class _BridgeAgent {
         // Inert legacy files only. `readLocalReport` revalidates the current
         // regular-file bytes and strips every local path before this leaves the
         // machine.
-        legacy_memory: local?.legacy_memory ?? []
+        legacy_memory: local?.legacy_memory ?? [],
+        // §B.4: counts of server-named secret paths inside / allowlisted /
+        // outside the secrets directory, and the runtime's mode. Numbers and
+        // one enum only; readLocalReport rebuilds it so no path rides along.
+        secret_paths: local?.secret_paths ?? null
       };
       const posted = await this.fetchBounded("runtime_config_report", "control", `${base}/report`, {
         method: "POST",
@@ -32191,14 +32216,25 @@ var BridgeAgent = class _BridgeAgent {
    *
    * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
    * the kill switch is on, the channel is a DM, and EITHER
-   *   (a) audience is owner_dm AND the sender is the pinned structural owner
-   *       (`channelOwner`, never "anomalous") — a lying `is_agent_owner` flag
-   *       alone gets nothing; OR
+   *   (a) audience is owner_dm AND the sender is the channel's pinned DM
+   *       counterpart (`channelOwner`, never "anomalous"). A server-marked
+   *       `is_agent_owner` on a member who is NOT the DM's single human
+   *       counterpart gets nothing; on the counterpart it is trusted (see
+   *       LIMIT below); OR
    *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
    *       relayed `speaker_identity_id` (passed by the caller only for relay
    *       turns) is that same pinned owner, whose roster row is the agent's
    *       owner. A speaker claim from any non-relay sender gets nothing.
    * Everything else gets the frozen empty list.
+   *
+   *   LIMIT (harness gate review H2, 2026-10-05): "pinned structural owner"
+   *   is PER CHANNEL. resolveAndPinOwner pins the single human counterpart of
+   *   ANY DM, so in a DM with member Bob, Bob is that channel's pin. What
+   *   separates Bob from the real owner is only the server's `is_agent_owner`
+   *   flag (connect_channels.py: counterpart user == agent's creator). A
+   *   backend that sets that flag wrongly gives Bob the grants, and a harness
+   *   connector turns grants into its full toolset. Binding the owner identity
+   *   once, outside server control, is an open design follow-up.
    */
   authorizationFor(channelId, senderId, relaySpeakerId) {
     const meta = this.freshMeta(channelId);
@@ -33744,6 +33780,31 @@ var BridgeAgent = class _BridgeAgent {
   noteSessionEvicted() {
     this.evictions++;
   }
+  /** Harness tool gate H4: latest connector self-report (see harness-report.ts). */
+  harness = null;
+  /**
+   * Record a connector's harness report (from its /v1/ws hello). WARN once
+   * each time the attached harness turns to an inactive veto: such a harness
+   * refuses every turn without a tool grant, so its rooms go quiet.
+   */
+  recordHarnessReport(report) {
+    const wasInactive = this.harness?.tool_veto === "inactive";
+    this.harness = report;
+    if (report.tool_veto === "inactive" && !wasInactive) {
+      writeServiceLog2("warn", "harness.tool_veto_inactive", {
+        harness: ServiceLogEnum.of(report.name, ["hermes", "openclaw", "other"])
+      });
+    }
+  }
+  /** Forget `report` when the connector that sent it disconnects. A report
+   *  from a newer connector (a different object) is kept. */
+  clearHarnessReport(report) {
+    if (this.harness === report) this.harness = null;
+  }
+  /** The latest harness report, or null (GET /v1/status). */
+  harnessReport() {
+    return this.harness;
+  }
   health() {
     let joined = 0;
     for (const s of this.joinState.values()) if (s === "JOINED") joined++;
@@ -33813,6 +33874,7 @@ var BridgeAgent = class _BridgeAgent {
       delivery_pings: this.pingsReceived,
       agent_sessions: this.authSessions,
       evictions: this.evictions,
+      harness_tool_veto_active: this.harness === null ? null : this.harness.tool_veto === "active",
       uptime_s: this.startedAt ? Math.floor((Date.now() - this.startedAt) / 1e3) : 0,
       version: BRIDGE_VERSION,
       ...this.memory.stats?.() ?? {}
@@ -34345,6 +34407,9 @@ function createHttpServer(agent, opts) {
         const r = await agent.vaultDelete(parsed.data.enclave_id, parsed.data.vault_channel_id, parsed.data.node_id);
         return json(res, 200, r);
       }
+      if (method === "GET" && path === "/v1/status") {
+        return json(res, 200, { harness: agent.harnessReport() });
+      }
       if (method === "POST" && path === "/v1/status") {
         const parsed = statusSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
@@ -34434,6 +34499,17 @@ function createHttpServer(agent, opts) {
   return { server, closeAllSseStreams: () => closeSse() };
 }
 
+// src/harness-report.ts
+var VERSION_TOKEN = /^[0-9A-Za-z][0-9A-Za-z.+_-]{0,39}$/;
+function parseHarnessReport(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const r = raw;
+  const name = r.name === "hermes" || r.name === "openclaw" ? r.name : "other";
+  const version = typeof r.version === "string" && VERSION_TOKEN.test(r.version) ? r.version : null;
+  const tool_veto = r.tool_veto === "active" || r.tool_veto === "inactive" ? r.tool_veto : "unknown";
+  return Object.freeze({ name, version, tool_veto });
+}
+
 // src/ws-server.ts
 import { WebSocketServer, WebSocket } from "ws";
 var PING_INTERVAL_MS = 3e4;
@@ -34564,6 +34640,7 @@ function attachAgentWebSocket(server, agent, opts) {
       }
       delivered.clear();
       if (current?.sock === sock) current = null;
+      if (session.harness) agent.clearHarnessReport(session.harness);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -34626,7 +34703,11 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     return;
   }
   if (m.type === "hello") {
-    session.consumer = "runtime";
+    const report = m.harness === void 0 ? null : parseHarnessReport(m.harness);
+    if (report) {
+      session.harness = report;
+      agent.recordHarnessReport(report);
+    } else session.consumer = "runtime";
     sendJson(sock, { type: "hello", features: ["nack"] });
     return;
   }

package/dist/service/runtime-config-dir.d.ts

@@ -35,6 +35,28 @@ export interface LocalReport {
     has_search_key: boolean;
     has_llm_key: boolean;
     legacy_memory: LegacyMemoryReport[];
+    /** §B.4 counts; undefined when the runtime reported none or the block was malformed. */
+    secret_paths?: SecretPathsReport;
+}
+/**
+ * §B.4: how many server-named secret paths in the managed config are inside
+ * the secrets directory, owner-allowlisted, or outside it, and the runtime's
+ * mode. Rebuilt field by field from the runtime's file: numbers and one enum,
+ * so no path (the owner's `allowed_secret_paths` sits in the same file) can
+ * ride along to the backend.
+ */
+export interface SecretPathsReport {
+    mode: "report" | "enforce";
+    inside: number;
+    allowlisted: number;
+    outside: number;
+    /** `sqlite` (H1) is absent from a runtime that predates it; absent means unknown, not zero. */
+    outside_by_field: {
+        headers_file: number;
+        postgres_url_file: number;
+        search_key_file: number;
+        sqlite?: number;
+    };
 }
 export type LegacyMemoryKind = "global-memory" | "conversation-history" | "captured-memory";
 export declare const LEGACY_MEMORY_FACT_MAX_BYTES = 1024;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.26.4";
+export declare const BRIDGE_VERSION = "0.26.5";

package/dist/ws-server.d.ts

@@ -1,80 +1,3 @@
-/**
- * Agent-facing keepalive WebSocket (/v1/ws).
- *
- * Adds a single persistent bidirectional socket for the AGENT⇄DAEMON hop,
- * modeled on AgentVault's keepalive WS (token in `?token=` query OR
- * `Authorization: Bearer`). This replaces the curl/long-poll loop: the agent
- * receives live inbound messages as JSON frames and sends/reports status over
- * the same socket.
- *
- * Protocol (all frames are JSON text):
- *   Daemon → agent:
- *     { "type":"message", channel_id, message_id, sender_id, text, ts,
- *       authorization:{version,audience,sender_membership,tool_grants} } // inbound, decrypted
- *     { "type":"sent", message_id }                                      // ack of a send
- *     { "type":"ok" }                                                    // ack of a status report
- *     { "type":"error", error, message, detail? }   // canonical codes (see errors.ts):
- *                                                    // channel_pending | rate_limited |
- *                                                    // invalid_request | agent_paused |
- *                                                    // send_forbidden (those two are
- *                                                    // TERMINAL: the in_reply_to message
- *                                                    // is acked by the daemon, no retry) |
- *                                                    // group_superseded (NOT terminal:
- *                                                    // the reply is republished after
- *                                                    // the agent rejoins)
- *   Agent → daemon:
- *     { "type":"send", channel_id, text?, a2a?, idempotency_key?,
- *       in_reply_to? }   // exactly one of text | a2a. SEC-06 #18: in_reply_to
- *                        // and/or idempotency_key make the send idempotent — a
- *                        // deterministic keyed message_id and a durable reply
- *                        // intent written before the publish, so a retry or a
- *                        // redelivery republishes the SAME reply
- *     { "type":"status", channel_id, state, detail? }
- *     { "type":"ack", message_id }   // confirms a delivered `message` was consumed
- *     { "type":"nack", message_id, reason? }  // final-wave I1(b): THIS message's turn
- *                                    // failed — requeued behind a backoff; the
- *                                    // socket and other channels' turns stay up
- *     { "type":"hello", features? }  // → { "type":"hello", features:["nack"] }; a
- *                                    // runtime nacks only after seeing "nack" here
- *     { "type":"action_begin", channel_id }                                   // → { "type":"action_begun", run_id }
- *     { "type":"action_start", run_id, node_type, title, parent_id? }         // → { "type":"action_started", node_id }
- *     { "type":"action_update", run_id, node_id, status?, detail? }           // → { "type":"ok" }
- *     { "type":"action_finish", run_id, node_id, status, detail? }            // → { "type":"ok" }
- *     { "type":"action_settle", run_id, result_message_id? }                  // → { "type":"action_settled", run_id }
- *
- * Inbound delivery is at-least-once. A delivered `message` is held in-flight
- * until the agent sends a matching `ack`; if the socket drops first, the frame
- * is re-buffered and redelivered to the next consumer. The agent dedups by
- * message_id. SEC-06 #18: a redelivered message whose reply already has a
- * durable intent is NOT handed to the agent again; the daemon republishes that
- * reply itself (same message_id), so the model does not run twice.
- *
- * Bounded work (Phase 3):
- *   - F2 ordering: at most ONE message per channel is in flight on a socket;
- *     the next message for that channel is sent only after the previous one is
- *     acked (or retired). A backlog replays in order instead of flooding the
- *     runtime, which used to answer the overflow with a "busy" reply and ack it.
- *   - F1 attempt cap: every delivery is counted durably; a message that
- *     reaches the cap is dead-lettered (content-free log + ack + one
- *     content-free notice to the channel per hour) rather than redelivered
- *     forever, and a channel where the agent is paused is not delivered at
- *     all (no model call).
- *   - Final-wave I1: a FAILED delivery (a `nack`, or the socket closing with
- *     it in flight — older runtimes close on any failed turn) is requeued
- *     behind a 2^attempts × 5 s backoff. A nack fails only its own message.
- *     Messages never handed over (mid-flush close, a failed frame write) go
- *     back without that penalty.
- *   - #842: a delivery still un-acked after INFLIGHT_STALE_AFTER_MS is LOGGED
- *     once (`runtime_inbox.inflight_stale`) and otherwise left alone. There
- *     is deliberately no lease: see INFLIGHT_STALE_AFTER_MS.
- *
- * Single consumer: the daemon serves one agent per process. A new `/v1/ws`
- * connection replaces the prior one (newest wins, mirroring the SSE path); the
- * replaced socket's un-acked in-flight messages are re-buffered.
- *
- * Keepalive uses the ws library's server-side ping (the protocol-level ping
- * frame, not an application message); dead sockets are reaped via pong tracking.
- */
 import type { Server as HttpServer } from "node:http";
 import type { BridgeAgent } from "./bridge-agent.js";
 export interface AgentWebSocketOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.26.4",
+  "version": "0.26.5",
   "type": "module",
   "engines": {
     "node": ">=22.5.0"