@securecoms/agent-bridge 0.26.5 → 0.26.6

package/dist/bridge-agent.d.ts

@@ -65,6 +65,9 @@ export type BridgeToolGrant = {
  * note. Every
  * other audience, an unpinned or anomalous owner, and the kill switch
  * `SECURECOMS_OWNER_DM_DEFAULT_GRANTS` (anything but unset/`on`) get `[]`.
+ * PR R adds exactly one more non-empty list, ROOM_DEFAULT_READ_GRANTS
+ * (`current_time` only), for an INTERNAL room's same-org human sender; see
+ * authorizationFor.
  * SEC-06 is LIVE for these two tools: docs/security/sec-06-runtime-bounds-audit.md.
  */
 /**
@@ -75,17 +78,42 @@ export type BridgeToolGrant = {
  * and `http_request` are deliberately absent.
  */
 export declare const OWNER_DM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
+/**
+ * PR R (spec §7A.1a; controller ruling 2026-10-05, audit r1: current_time
+ * only). Granted only in a room classified INTERNAL from the server roster
+ * (every row, leaf rows included, in the agent owner's org), to a same-org
+ * human sender, while the roster is as fresh as the agent's MLS epoch, while
+ * a declared per-tool consumer is attached (audit C-B1), and while
+ * SECURECOMS_ROOM_DEFAULT_GRANTS is on (plan OQ-3). Frozen; the runtime intersects
+ * it with ROOM_SAFE_READ_TOOLS (turn-loop.ts).
+ */
+export declare const ROOM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
 /**
  * Kill switch for OWNER_DM_DEFAULT_READ_GRANTS, read once at BridgeAgent
  * construction (daemon startup). Unset or exactly `on` keeps the grants;
  * any other value (`off`, `0`, `false`, empty) sends `[]` on every turn.
  */
 export declare function ownerDmDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Kill switch for ROOM_DEFAULT_READ_GRANTS (plan OQ-3, RULED), read once at
+ * BridgeAgent construction exactly like ownerDmDefaultGrantsEnabled. Unset or
+ * exactly `on` keeps the room default; any other value sends `[]` on every
+ * room turn. It never touches the owner DM.
+ */
+export declare function roomDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
 export interface BridgeAuthorization {
     readonly version: 1;
     readonly audience: AgentAudience;
     readonly sender_membership: "active" | "unknown";
     readonly tool_grants: readonly BridgeToolGrant[];
+    /**
+     * Audit r2 R2-T1 (plan OQ-6 ruling): "owner" ONLY on authorizationFor's
+     * ownerRelayed branch: the channel's server-marked relay sent a turn whose
+     * relayed speaker is the channel's pinned owner. Set by the daemon, never
+     * copied from message text. A harness connector honours a grant on
+     * audience owner_dm or on this mark, nothing else.
+     */
+    readonly relay_speaker?: "owner";
 }
 export interface BridgeMessage {
     channel_id: string;
@@ -517,6 +545,15 @@ export declare class SendForbiddenError extends Error {
     readonly channelId: string;
     constructor(channelId: string);
 }
+/**
+ * Audit M-B1 (controller ruling 2026-10-05): a reply to a room-granted turn
+ * would be sealed at an epoch the room was not classified at, and the room is
+ * not internal there. Dropped. A SendForbiddenError, so both transports treat
+ * it as terminal (send_forbidden: the runtime acks, nothing redelivers).
+ */
+export declare class RoomClassChangedSendError extends SendForbiddenError {
+    constructor(channelId: string);
+}
 /**
  * Stranded sender (spec 2026-09-26 §7.4): the backend refused a publish with
  * 409 `mls.group_superseded`: the envelope was sealed under a group that is no
@@ -896,6 +933,21 @@ export declare class BridgeAgent {
     private readonly selfHealSweepEnabled;
     /** Read once at startup; see ownerDmDefaultGrantsEnabled. */
     private readonly ownerDmDefaultGrants;
+    /** Read once at startup; see roomDefaultGrantsEnabled. */
+    private readonly roomDefaultGrants;
+    /**
+     * Audit M-B4: DM channels whose roster was epoch-fresh at THIS ingest
+     * cycle's refresh (refreshRostersForCycle). Cleared at each cycle's start.
+     */
+    private readonly ownerDmCycleFresh;
+    /**
+     * Audit M-B1: room-granted turns, keyed by the inbound message id, with the
+     * channel, MLS group and epoch the room was classified at (review I-1: an
+     * epoch NUMBER alone repeats across channels and across a supersede). A
+     * reply to one is sealed only there, or re-classified once
+     * (publishBodyForReply). Forgotten at the runtime's ack.
+     */
+    private readonly roomGrantEpochs;
     /** Task 12: proactive sweep cadence (in addition to the once-at-boot fire). */
     private static readonly SELF_HEAL_SWEEP_INTERVAL_MS;
     /**
@@ -1509,6 +1561,25 @@ export declare class BridgeAgent {
      * there so a retry can resend the exact bytes).
      */
     private publishBody;
+    /**
+     * Audit M-B1 (controller ruling): a reply to a room-granted turn is sealed
+     * only at the epoch the room was classified at. On a move, the room is
+     * re-classified ONCE from a roster fetched at the new epoch: still internal,
+     * the reply is sealed at that epoch; anything else, it is dropped. The check
+     * throws before an envelope is built, so nothing is stored or posted.
+     *
+     * `inReplyTo` is the STORED intent's inbound id, not the send's options, so
+     * the redelivery replay (replayReplyIntents, which has no in_reply_to in its
+     * options) is checked the same as a live send.
+     */
+    private publishBodyForReply;
+    /**
+     * Re-read the room at the agent's current group and epoch; true only if it
+     * is still internal there. Review I-1: the entry must come from THIS re-read
+     * (a fail-soft refresh leaves an older entry whose epoch label can repeat
+     * across a supersede), and the group must not move around the reads.
+     */
+    private reclassifyForReply;
     private enforceBodyRateFloor;
     /** Bookkeeping after a CONFIRMED publish of `body` under `id`. */
     private afterPublish;
@@ -1947,6 +2018,19 @@ export declare class BridgeAgent {
     private enclavesToCover;
     /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
     private freshRoster;
+    /** The whole cache entry when fresh, else undefined (TTL; the epoch is checked by the caller). */
+    private freshRosterEntry;
+    /** The agent's held MLS group id for a channel; null when none (fail closed). */
+    private heldGroupFor;
+    /**
+     * Review I-1 + fix round 2: the agent's held (group, epoch) for a channel.
+     * The group is read on BOTH sides of the epoch read, so the epoch provably
+     * belongs to it (a supersede in between installs a new group whose epoch
+     * counter restarts); a group that moved, or none held, is null (fail closed).
+     */
+    private heldPosition;
+    /** The agent's own MLS epoch for a channel; null when no group is held (fail closed). */
+    private heldEpochFor;
     /**
      * Resolve one channel's roster (members + display names + is-agent) from the
      * GET members endpoint into the roster cache. Called AT MOST ONCE per ingest
@@ -1955,6 +2039,15 @@ export declare class BridgeAgent {
      * attribution must NEVER block or drop a message.
      */
     private refreshChannelRoster;
+    /**
+     * S-1 (roster) + §7A.5 + audit M-B4: once per ingest cycle, per distinct
+     * channel, re-read the roster when the TTL lapsed OR the epoch moved since
+     * the fetch, then record which DMs are epoch-fresh for the rest of this
+     * cycle. Fail-soft inside refreshChannelRoster (never blocks ingest).
+     */
+    private refreshRostersForCycle;
+    /** Classify one inbound turn at the agent's CURRENT epoch for its channel. */
+    private authorizeTurn;
     /**
      * Classify the sender only from server-authenticated channel/roster data.
      * Missing or stale metadata is UNKNOWN with zero grants, never a permissive
@@ -1972,6 +2065,13 @@ export declare class BridgeAgent {
      *       relayed `speaker_identity_id` (passed by the caller only for relay
      *       turns) is that same pinned owner, whose roster row is the agent's
      *       owner. A speaker claim from any non-relay sender gets nothing.
+     * Both need the roster fetched at `heldEpoch` (the agent's current MLS
+     * epoch for the channel), or the DM marked epoch-fresh at this ingest
+     * cycle's refresh (audit M-B4).
+     * PR R: ROOM_DEFAULT_READ_GRANTS only when the room kill switch is on, a
+     * per-tool consumer is attached, the roster was fetched at `heldEpoch`
+     * (no cycle carve-out), the room is INTERNAL (roomIsCrossOrg === false
+     * over every row, leaf rows included) and the audience is team_room.
      * Everything else gets the frozen empty list.
      *
      *   LIMIT (harness gate review H2, 2026-10-05): "pinned structural owner"
@@ -2000,6 +2100,13 @@ export declare class BridgeAgent {
      *                            startup: `on` = default grants enabled
      *   meta_fresh / roster_fresh whether the channel meta / roster caches were
      *                            fresh (either stale forces audience=unknown)
+     *   room_class               the room's class from the server roster (`na`
+     *                            for a DM): internal | cross_org | unknown
+     *   epoch_fresh              the roster was fetched at the agent's current
+     *                            MLS epoch for the channel
+     *   room_kill_switch         SECURECOMS_ROOM_DEFAULT_GRANTS as read at startup
+     *   per_tool_consumer        a consumer that declared per-tool grant
+     *                            enforcement is attached
      */
     private logAuthzDecision;
     /**
@@ -2326,6 +2433,18 @@ export declare class BridgeAgent {
     clearHarnessReport(report: HarnessReport): void;
     /** The latest harness report, or null (GET /v1/status). */
     harnessReport(): HarnessReport | null;
+    /**
+     * Audit C-B1: the attached /v1/ws consumer that declared per-tool grant
+     * enforcement (its hello carried "per_tool_grants" and no harness report),
+     * or null. authorizationFor issues a room grant only while one is attached
+     * (Task R2); every delivery path also strips room grants for any other
+     * consumer (consumer-grants.ts). The token is the socket's session object.
+     */
+    private perToolConsumer;
+    notePerToolConsumer(token: object): void;
+    /** Forget `token` when its socket closes; a newer consumer's token is kept. */
+    clearPerToolConsumer(token: object): void;
+    perToolConsumerAttached(): boolean;
     health(): {
         status: "ok";
         identity_id: string;

package/dist/consumer-grants.d.ts

@@ -0,0 +1,22 @@
+import type { BridgeMessage } from "./bridge-agent.js";
+/**
+ * The /v1/ws hello feature a consumer sends to declare per-tool grant
+ * enforcement. The runtime exports the same value (connect-agent-runtime
+ * data-plane.ts PER_TOOL_GRANTS_FEATURE); the two packages share no
+ * dependency, so ws-server.test.ts pins them equal and drives the bridge with
+ * the runtime's own hello frame.
+ */
+export declare const PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
+/**
+ * `m` unchanged for a per-tool consumer; otherwise `m` with any room grant
+ * stripped to []. The owner's own turns, which a harness has always been
+ * granted for, pass unchanged: the owner's DM, and the owner-spoken relayed
+ * voice turn the daemon marks relay_speaker "owner" (audit r2 R2-T1; the SAME
+ * rule the connectors apply, Task R2a). Everything else with grants is
+ * stripped: an allowlist fails closed on any new granted audience.
+ *
+ * Never mutates `m`: the buffer and in-flight records keep the original, so a
+ * later per-tool consumer still receives it. The stripped copy keeps every
+ * other field (audience, relay_speaker) as is.
+ */
+export declare function withConsumerGrants(m: BridgeMessage, perToolConsumer: boolean): BridgeMessage;

package/dist/http-server.d.ts

@@ -16,6 +16,16 @@ export declare function writeSse(res: {
     writableEnded?: boolean;
     write: (s: string) => boolean;
 }, msgs: BridgeMessage[], onWriteError?: (error: unknown) => void): BridgeMessage[];
+/**
+ * Audit C-B1 / r2 R2-T2: deliver one SSE batch. An SSE consumer never declares
+ * per-tool enforcement, so the WRITTEN copies have room grants stripped; the
+ * unwritten tail is requeued as the ORIGINAL messages, never a stripped copy,
+ * so a later per-tool consumer still receives the grant.
+ */
+export declare function deliverSseBatch(res: Parameters<typeof writeSse>[0], batch: BridgeMessage[], agent: {
+    ackRuntimeMessages(ids: string[]): void;
+    requeueFront(msgs: BridgeMessage[]): void;
+}, onWriteError?: (error: unknown) => void): void;
 /**
  * Once-per-connection write-failure reporter (#335). A throwing `res.write`
  * means the socket is dying — teardown follows via the request's `'close'` —