@securecoms/agent-bridge 0.26.4 → 0.26.6

package/dist/room-tools.d.ts

@@ -0,0 +1,23 @@
+export type RoomToolClass = "room_safe_read" | "owner_credential" | "egress" | "side_effect";
+/** §7A.1a, verbatim. A tool carries every class that applies; the most
+ *  restrictive governs. `READ_ONLY_TOOLS` in the runtime is NOT this table:
+ *  it says whether an implementation writes, not whose credential it spends
+ *  or where it sends data (audit H-4). */
+export declare const TOOL_ROOM_CLASSES: Readonly<Record<string, readonly RoomToolClass[]>>;
+/** Edge statuses whose rows are channel MEMBERS for attribution and the
+ *  existing roster consumers (today's set). The wider rows feed
+ *  classification only. */
+export declare const LIVE_MEMBER_STATUSES: ReadonlySet<string>;
+/** A row that is a channel member: a live status (or an older backend with no
+ *  status) and not a leaf row (audit M-B2: a departed member still holding a
+ *  leaf counts for the class, never as a member). */
+export declare function isLiveRow(r: {
+    status?: string;
+    left_but_in_group?: boolean | null;
+}): boolean;
+/** §7A.4 (1): a room is cross-org if ANY row's org differs from the agent
+ *  owner's, leaf rows included. A row with no claim (an older backend, a
+ *  member with no edge) makes the class unknown, which grants nothing (§7A.5). */
+export declare function roomIsCrossOrg(rows: ReadonlyArray<{
+    is_same_org_as_agent_owner?: boolean | null;
+}>): boolean | null;

package/dist/service/runtime-config-dir.d.ts

@@ -35,6 +35,28 @@ export interface LocalReport {
     has_search_key: boolean;
     has_llm_key: boolean;
     legacy_memory: LegacyMemoryReport[];
+    /** §B.4 counts; undefined when the runtime reported none or the block was malformed. */
+    secret_paths?: SecretPathsReport;
+}
+/**
+ * §B.4: how many server-named secret paths in the managed config are inside
+ * the secrets directory, owner-allowlisted, or outside it, and the runtime's
+ * mode. Rebuilt field by field from the runtime's file: numbers and one enum,
+ * so no path (the owner's `allowed_secret_paths` sits in the same file) can
+ * ride along to the backend.
+ */
+export interface SecretPathsReport {
+    mode: "report" | "enforce";
+    inside: number;
+    allowlisted: number;
+    outside: number;
+    /** `sqlite` (H1) is absent from a runtime that predates it; absent means unknown, not zero. */
+    outside_by_field: {
+        headers_file: number;
+        postgres_url_file: number;
+        search_key_file: number;
+        sqlite?: number;
+    };
 }
 export type LegacyMemoryKind = "global-memory" | "conversation-history" | "captured-memory";
 export declare const LEGACY_MEMORY_FACT_MAX_BYTES = 1024;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.26.4";
+export declare const BRIDGE_VERSION = "0.26.6";

package/dist/ws-server.d.ts

@@ -1,80 +1,3 @@
-/**
- * Agent-facing keepalive WebSocket (/v1/ws).
- *
- * Adds a single persistent bidirectional socket for the AGENT⇄DAEMON hop,
- * modeled on AgentVault's keepalive WS (token in `?token=` query OR
- * `Authorization: Bearer`). This replaces the curl/long-poll loop: the agent
- * receives live inbound messages as JSON frames and sends/reports status over
- * the same socket.
- *
- * Protocol (all frames are JSON text):
- *   Daemon → agent:
- *     { "type":"message", channel_id, message_id, sender_id, text, ts,
- *       authorization:{version,audience,sender_membership,tool_grants} } // inbound, decrypted
- *     { "type":"sent", message_id }                                      // ack of a send
- *     { "type":"ok" }                                                    // ack of a status report
- *     { "type":"error", error, message, detail? }   // canonical codes (see errors.ts):
- *                                                    // channel_pending | rate_limited |
- *                                                    // invalid_request | agent_paused |
- *                                                    // send_forbidden (those two are
- *                                                    // TERMINAL: the in_reply_to message
- *                                                    // is acked by the daemon, no retry) |
- *                                                    // group_superseded (NOT terminal:
- *                                                    // the reply is republished after
- *                                                    // the agent rejoins)
- *   Agent → daemon:
- *     { "type":"send", channel_id, text?, a2a?, idempotency_key?,
- *       in_reply_to? }   // exactly one of text | a2a. SEC-06 #18: in_reply_to
- *                        // and/or idempotency_key make the send idempotent — a
- *                        // deterministic keyed message_id and a durable reply
- *                        // intent written before the publish, so a retry or a
- *                        // redelivery republishes the SAME reply
- *     { "type":"status", channel_id, state, detail? }
- *     { "type":"ack", message_id }   // confirms a delivered `message` was consumed
- *     { "type":"nack", message_id, reason? }  // final-wave I1(b): THIS message's turn
- *                                    // failed — requeued behind a backoff; the
- *                                    // socket and other channels' turns stay up
- *     { "type":"hello", features? }  // → { "type":"hello", features:["nack"] }; a
- *                                    // runtime nacks only after seeing "nack" here
- *     { "type":"action_begin", channel_id }                                   // → { "type":"action_begun", run_id }
- *     { "type":"action_start", run_id, node_type, title, parent_id? }         // → { "type":"action_started", node_id }
- *     { "type":"action_update", run_id, node_id, status?, detail? }           // → { "type":"ok" }
- *     { "type":"action_finish", run_id, node_id, status, detail? }            // → { "type":"ok" }
- *     { "type":"action_settle", run_id, result_message_id? }                  // → { "type":"action_settled", run_id }
- *
- * Inbound delivery is at-least-once. A delivered `message` is held in-flight
- * until the agent sends a matching `ack`; if the socket drops first, the frame
- * is re-buffered and redelivered to the next consumer. The agent dedups by
- * message_id. SEC-06 #18: a redelivered message whose reply already has a
- * durable intent is NOT handed to the agent again; the daemon republishes that
- * reply itself (same message_id), so the model does not run twice.
- *
- * Bounded work (Phase 3):
- *   - F2 ordering: at most ONE message per channel is in flight on a socket;
- *     the next message for that channel is sent only after the previous one is
- *     acked (or retired). A backlog replays in order instead of flooding the
- *     runtime, which used to answer the overflow with a "busy" reply and ack it.
- *   - F1 attempt cap: every delivery is counted durably; a message that
- *     reaches the cap is dead-lettered (content-free log + ack + one
- *     content-free notice to the channel per hour) rather than redelivered
- *     forever, and a channel where the agent is paused is not delivered at
- *     all (no model call).
- *   - Final-wave I1: a FAILED delivery (a `nack`, or the socket closing with
- *     it in flight — older runtimes close on any failed turn) is requeued
- *     behind a 2^attempts × 5 s backoff. A nack fails only its own message.
- *     Messages never handed over (mid-flush close, a failed frame write) go
- *     back without that penalty.
- *   - #842: a delivery still un-acked after INFLIGHT_STALE_AFTER_MS is LOGGED
- *     once (`runtime_inbox.inflight_stale`) and otherwise left alone. There
- *     is deliberately no lease: see INFLIGHT_STALE_AFTER_MS.
- *
- * Single consumer: the daemon serves one agent per process. A new `/v1/ws`
- * connection replaces the prior one (newest wins, mirroring the SSE path); the
- * replaced socket's un-acked in-flight messages are re-buffered.
- *
- * Keepalive uses the ws library's server-side ping (the protocol-level ping
- * frame, not an application message); dead sockets are reaped via pong tracking.
- */
 import type { Server as HttpServer } from "node:http";
 import type { BridgeAgent } from "./bridge-agent.js";
 export interface AgentWebSocketOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.26.4",
+  "version": "0.26.6",
   "type": "module",
   "engines": {
     "node": ">=22.5.0"