@securecoms/agent-bridge 0.26.5 → 0.26.6

package/dist/index.js

@@ -28960,6 +28960,29 @@ var StatusGate = class {
   }
 };
 
+// src/room-tools.ts
+var TOOL_ROOM_CLASSES = Object.freeze({
+  current_time: Object.freeze(["room_safe_read"]),
+  echo: Object.freeze(["room_safe_read"]),
+  web_search: Object.freeze(["owner_credential"]),
+  fetch_url: Object.freeze(["egress"]),
+  sql_query: Object.freeze(["owner_credential"]),
+  http_request: Object.freeze(["owner_credential", "egress", "side_effect"])
+});
+var LIVE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["active", "add_pending"]);
+function isLiveRow(r) {
+  return (r.status === void 0 || LIVE_MEMBER_STATUSES.has(r.status)) && r.left_but_in_group !== true;
+}
+function roomIsCrossOrg(rows) {
+  if (rows.length === 0) return null;
+  let unknown = false;
+  for (const r of rows) {
+    if (r.is_same_org_as_agent_owner === false) return true;
+    if (r.is_same_org_as_agent_owner !== true) unknown = true;
+  }
+  return unknown ? null : false;
+}
+
 // src/bridge-agent.ts
 function logSendSupersededAdoption(kind) {
   switch (kind) {
@@ -29008,11 +29031,18 @@ var OWNER_DM_DEFAULT_READ_GRANTS = Object.freeze([
   Object.freeze({ tool: "current_time", mode: "read" }),
   Object.freeze({ tool: "web_search", mode: "read" })
 ]);
+var ROOM_DEFAULT_READ_GRANTS = Object.freeze([
+  Object.freeze({ tool: "current_time", mode: "read" })
+]);
 var NO_TOOL_GRANTS = Object.freeze([]);
 function ownerDmDefaultGrantsEnabled(env = process.env) {
   const v = env.SECURECOMS_OWNER_DM_DEFAULT_GRANTS;
   return v === void 0 || v === "on";
 }
+function roomDefaultGrantsEnabled(env = process.env) {
+  const v = env.SECURECOMS_ROOM_DEFAULT_GRANTS;
+  return v === void 0 || v === "on";
+}
 var VAULT_REF_BARE_TEXT = "[Files link]";
 var VOICE_MODE_GUIDANCE = "Reply immediately and conversationally, one short sentence per message; never bundle multiple points into one message.";
 var FAST_PATH_SPOKEN_GUIDANCE = "A one-sentence spoken acknowledgement has already been sent for this turn. Reply only with information it did not contain, in one or two short sentences; if there is nothing to add, send nothing.";
@@ -29191,6 +29221,19 @@ var SendForbiddenError = class extends Error {
     this.name = "SendForbiddenError";
   }
 };
+var RoomClassChangedSendError = class extends SendForbiddenError {
+  constructor(channelId) {
+    super(channelId);
+    this.name = "RoomClassChangedSendError";
+    this.message = `reply dropped for channel ${channelId}: the room changed after its tools were granted; no retry`;
+  }
+};
+function rosterFreshAt(entry, heldEpoch, heldGroupId) {
+  return entry !== void 0 && typeof heldEpoch === "number" && entry.epoch === heldEpoch && typeof heldGroupId === "string" && entry.groupId === heldGroupId;
+}
+var RoomGrantEpochMovedError = class extends Error {
+};
+var ROOM_GRANT_TRACK_MAX = 4096;
 var GroupSupersededSendError = class extends Error {
   constructor(channelId, activeGroupId) {
     super(`send refused for channel ${channelId}: the channel moved to a new secure group; not sent`);
@@ -29681,6 +29724,21 @@ var BridgeAgent = class _BridgeAgent {
   selfHealSweepEnabled = process.env.SECURECOMS_SELF_HEAL_SWEEP !== "false";
   /** Read once at startup; see ownerDmDefaultGrantsEnabled. */
   ownerDmDefaultGrants = ownerDmDefaultGrantsEnabled();
+  /** Read once at startup; see roomDefaultGrantsEnabled. */
+  roomDefaultGrants = roomDefaultGrantsEnabled();
+  /**
+   * Audit M-B4: DM channels whose roster was epoch-fresh at THIS ingest
+   * cycle's refresh (refreshRostersForCycle). Cleared at each cycle's start.
+   */
+  ownerDmCycleFresh = /* @__PURE__ */ new Set();
+  /**
+   * Audit M-B1: room-granted turns, keyed by the inbound message id, with the
+   * channel, MLS group and epoch the room was classified at (review I-1: an
+   * epoch NUMBER alone repeats across channels and across a supersede). A
+   * reply to one is sealed only there, or re-classified once
+   * (publishBodyForReply). Forgotten at the runtime's ack.
+   */
+  roomGrantEpochs = /* @__PURE__ */ new Map();
   /** Task 12: proactive sweep cadence (in addition to the once-at-boot fire). */
   static SELF_HEAL_SWEEP_INTERVAL_MS = SELF_HEAL_SWEEP_INTERVAL_MS;
   /**
@@ -30992,7 +31050,7 @@ var BridgeAgent = class _BridgeAgent {
    * for every envelope built, BEFORE it is published (SEC-06 #18 persists it
    * there so a retry can resend the exact bytes).
    */
-  async publishBody(channelId, body, id, onEnvelope) {
+  async publishBody(channelId, body, id, onEnvelope, sealCheck) {
     this.enforceBodyRateFloor(channelId, body);
     this.statusGate.replyStarted(channelId);
     const joined = await this.reconcileJoin(channelId);
@@ -31001,33 +31059,36 @@ var BridgeAgent = class _BridgeAgent {
     await this.sendWithSelfHealTerminal(
       this.provider,
       channelId,
-      (epoch) => this.latency.time(
-        "send.encrypt",
-        () => buildOutboundEnvelope({
-          custody: this.custody,
-          groupKey: this.provider,
-          messageId: id,
-          channelId,
-          enclaveId: this.resolveEnclave(channelId),
-          senderId: this.cfg.identityId,
-          senderType: "agent",
-          type: body.kind === "text" ? "text" : "a2a",
-          bodyPlaintext: body.kind === "text" ? JSON.stringify({ text: body.text }) : JSON.stringify({
-            type: "a2a",
-            a2a_version: body.a2a.a2a_version,
-            kind: body.a2a.kind,
-            object: body.a2a.object
-          }),
-          bindingId: "",
-          bindingVersion: "0.0.0",
-          agentSkillId: null,
-          epoch,
-          traceparent: ZERO_TRACEPARENT,
-          references: [],
-          stage5Outcome: "allow",
-          stage5Evaluators: []
-        })
-      ),
+      (epoch) => {
+        sealCheck?.(epoch);
+        return this.latency.time(
+          "send.encrypt",
+          () => buildOutboundEnvelope({
+            custody: this.custody,
+            groupKey: this.provider,
+            messageId: id,
+            channelId,
+            enclaveId: this.resolveEnclave(channelId),
+            senderId: this.cfg.identityId,
+            senderType: "agent",
+            type: body.kind === "text" ? "text" : "a2a",
+            bodyPlaintext: body.kind === "text" ? JSON.stringify({ text: body.text }) : JSON.stringify({
+              type: "a2a",
+              a2a_version: body.a2a.a2a_version,
+              kind: body.a2a.kind,
+              object: body.a2a.object
+            }),
+            bindingId: "",
+            bindingVersion: "0.0.0",
+            agentSkillId: null,
+            epoch,
+            traceparent: ZERO_TRACEPARENT,
+            references: [],
+            stage5Outcome: "allow",
+            stage5Evaluators: []
+          })
+        );
+      },
       async (envelope) => {
         if (onEnvelope) await onEnvelope(envelope);
         return this.publishEnvelope(
@@ -31038,6 +31099,71 @@ var BridgeAgent = class _BridgeAgent {
     );
     this.latency.record("send.total", performance.now() - sendStart);
   }
+  /**
+   * Audit M-B1 (controller ruling): a reply to a room-granted turn is sealed
+   * only at the epoch the room was classified at. On a move, the room is
+   * re-classified ONCE from a roster fetched at the new epoch: still internal,
+   * the reply is sealed at that epoch; anything else, it is dropped. The check
+   * throws before an envelope is built, so nothing is stored or posted.
+   *
+   * `inReplyTo` is the STORED intent's inbound id, not the send's options, so
+   * the redelivery replay (replayReplyIntents, which has no in_reply_to in its
+   * options) is checked the same as a live send.
+   */
+  async publishBodyForReply(channelId, body, id, inReplyTo, onEnvelope) {
+    const grant = inReplyTo !== null ? this.roomGrantEpochs.get(inReplyTo) : void 0;
+    if (grant === void 0) return this.publishBody(channelId, body, id, onEnvelope);
+    if (channelId !== grant.channelId) {
+      writeServiceLog2("warn", "reply.room_class_changed");
+      throw new RoomClassChangedSendError(channelId);
+    }
+    let reclassified = false;
+    for (; ; ) {
+      try {
+        return await this.publishBody(
+          channelId,
+          body,
+          id,
+          // Review I-1: the group the envelope was ACTUALLY sealed under
+          // (captured with the key, inside the channel lock), checked before
+          // the durable save and before the post. An equal epoch number in a
+          // new group (the supersede replay) is a move.
+          async (envelope) => {
+            if (sealedGroupIdOf(envelope) !== grant.groupId) throw new RoomGrantEpochMovedError();
+            if (onEnvelope) await onEnvelope(envelope);
+          },
+          (epoch) => {
+            if (epoch !== grant.epoch) throw new RoomGrantEpochMovedError();
+          }
+        );
+      } catch (e) {
+        if (!(e instanceof RoomGrantEpochMovedError)) throw e;
+        if (reclassified || !await this.reclassifyForReply(channelId, grant)) {
+          writeServiceLog2("warn", "reply.room_class_changed");
+          throw new RoomClassChangedSendError(channelId);
+        }
+        reclassified = true;
+      }
+    }
+  }
+  /**
+   * Re-read the room at the agent's current group and epoch; true only if it
+   * is still internal there. Review I-1: the entry must come from THIS re-read
+   * (a fail-soft refresh leaves an older entry whose epoch label can repeat
+   * across a supersede), and the group must not move around the reads.
+   */
+  async reclassifyForReply(channelId, grant) {
+    const startedAt = Date.now();
+    await this.refreshChannelRoster(channelId);
+    const held = await this.heldPosition(channelId);
+    const hit = this.freshRosterEntry(channelId);
+    if (hit === void 0 || hit.at < startedAt || !rosterFreshAt(hit, held.epoch, held.groupId) || hit.crossOrg !== false || held.epoch === null || held.groupId === null) {
+      return false;
+    }
+    grant.groupId = held.groupId;
+    grant.epoch = held.epoch;
+    return true;
+  }
   enforceBodyRateFloor(channelId, body) {
     if (body.kind === "a2a") {
       this.enforceRateFloor("a2a", channelId);
@@ -31163,7 +31289,7 @@ var BridgeAgent = class _BridgeAgent {
       const bytes = intent.body;
       const body = decodeReplyBody(bytes);
       try {
-        await this.publishIntentWithRetry(intent.channelId, body, intent.replyMessageId, key);
+        await this.publishIntentWithRetry(intent.channelId, body, intent.replyMessageId, key, intent.inReplyTo);
       } catch (e) {
         if (e instanceof AgentPausedSendError || e instanceof SendForbiddenError) {
           if (intent.inReplyTo !== null) this.store.deletePendingReplyIntents(intent.inReplyTo);
@@ -31218,12 +31344,12 @@ var BridgeAgent = class _BridgeAgent {
    * failure. Either way the intent stays pending, so the redelivery
    * republishes the same reply.
    */
-  async publishIntentWithRetry(channelId, body, id, key) {
+  async publishIntentWithRetry(channelId, body, id, key, inReplyTo) {
     let rateLimited = 0;
     let inFlight = 0;
     for (; ; ) {
       try {
-        await this.publishIntentOnce(channelId, body, id, key);
+        await this.publishIntentOnce(channelId, body, id, key, inReplyTo);
         return;
       } catch (e) {
         if (e instanceof ReplyInFlightError) {
@@ -31294,7 +31420,7 @@ var BridgeAgent = class _BridgeAgent {
    * original ack; a conflict can only mean the slot belongs to another
    * message (for example an old reply whose intent was pruned).
    */
-  async publishIntentOnce(channelId, body, id, key) {
+  async publishIntentOnce(channelId, body, id, key, inReplyTo) {
     const current = await this.store.getReplyIntent(key.scope, key.part);
     try {
       if (current?.envelope) {
@@ -31335,10 +31461,11 @@ var BridgeAgent = class _BridgeAgent {
         }
       }
       try {
-        await this.publishBody(
+        await this.publishBodyForReply(
           channelId,
           body,
           id,
+          inReplyTo,
           (envelope) => this.store.saveReplyIntentEnvelope(
             key.scope,
             key.part,
@@ -32169,10 +32296,33 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
   freshRoster(channelId) {
+    return this.freshRosterEntry(channelId)?.members;
+  }
+  /** The whole cache entry when fresh, else undefined (TTL; the epoch is checked by the caller). */
+  freshRosterEntry(channelId) {
     const hit = this.channelRoster.get(channelId);
-    if (!hit) return void 0;
-    if (Date.now() - hit.at >= CHANNEL_ROSTER_TTL_MS) return void 0;
-    return hit.members;
+    if (!hit || Date.now() - hit.at >= CHANNEL_ROSTER_TTL_MS) return void 0;
+    return hit;
+  }
+  /** The agent's held MLS group id for a channel; null when none (fail closed). */
+  async heldGroupFor(channelId) {
+    return this.provider.heldGroupIdFor(channelId).catch(() => null);
+  }
+  /**
+   * Review I-1 + fix round 2: the agent's held (group, epoch) for a channel.
+   * The group is read on BOTH sides of the epoch read, so the epoch provably
+   * belongs to it (a supersede in between installs a new group whose epoch
+   * counter restarts); a group that moved, or none held, is null (fail closed).
+   */
+  async heldPosition(channelId) {
+    const before = await this.heldGroupFor(channelId);
+    const epoch = await this.heldEpochFor(channelId);
+    const after = await this.heldGroupFor(channelId);
+    return { groupId: before !== null && after === before ? before : null, epoch };
+  }
+  /** The agent's own MLS epoch for a channel; null when no group is held (fail closed). */
+  async heldEpochFor(channelId) {
+    return this.provider.currentEpoch(channelId).catch(() => null);
   }
   /**
    * Resolve one channel's roster (members + display names + is-agent) from the
@@ -32183,16 +32333,18 @@ var BridgeAgent = class _BridgeAgent {
    */
   async refreshChannelRoster(channelId) {
     try {
+      const { epoch, groupId } = await this.heldPosition(channelId);
       const url = `${this.cfg.apiBase}/api/v1/channels/${encodeURIComponent(
         channelId
-      )}/members?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+      )}/members?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}&include_pending=true`;
       const res = await this.fetchBounded("channel_roster", "read", url, {
         headers: { authorization: `Bearer ${this.cfg.apiKey}` }
       });
       if (!res.ok) return;
       const rows = await res.json();
       const members = /* @__PURE__ */ new Map();
-      for (const r of rows) {
+      const liveRows = rows.filter(isLiveRow);
+      for (const r of liveRows) {
         members.set(r.identity_id, {
           name: r.display_name,
           is_agent: r.is_agent,
@@ -32201,13 +32353,45 @@ var BridgeAgent = class _BridgeAgent {
           is_relay: r.is_relay === true
         });
       }
-      this.channelRoster.set(channelId, { members, at: Date.now() });
+      this.channelRoster.set(channelId, { members, at: Date.now(), epoch, groupId, crossOrg: roomIsCrossOrg(rows) });
       const self = members.get(this.cfg.identityId);
       if (self?.name) this.lastOwnDisplayName = self.name;
-      await this.resolveAndPinOwner(channelId, rows);
+      await this.resolveAndPinOwner(channelId, liveRows);
     } catch {
     }
   }
+  /**
+   * S-1 (roster) + §7A.5 + audit M-B4: once per ingest cycle, per distinct
+   * channel, re-read the roster when the TTL lapsed OR the epoch moved since
+   * the fetch, then record which DMs are epoch-fresh for the rest of this
+   * cycle. Fail-soft inside refreshChannelRoster (never blocks ingest).
+   */
+  async refreshRostersForCycle(channelIds) {
+    this.ownerDmCycleFresh.clear();
+    for (const channelId of new Set(channelIds)) {
+      const held = await this.heldPosition(channelId);
+      const hit = this.freshRosterEntry(channelId);
+      if (hit === void 0 || hit.epoch !== held.epoch || hit.groupId !== held.groupId) {
+        await this.refreshChannelRoster(channelId);
+      }
+      const now = this.freshRosterEntry(channelId);
+      if (rosterFreshAt(now, held.epoch, held.groupId) && this.freshMeta(channelId)?.is_dm === true) {
+        this.ownerDmCycleFresh.add(channelId);
+      }
+    }
+  }
+  /** Classify one inbound turn at the agent's CURRENT epoch for its channel. */
+  async authorizeTurn(channelId, messageId, senderId, relaySpeakerId) {
+    const held = await this.heldPosition(channelId);
+    const auth = this.authorizationFor(channelId, senderId, relaySpeakerId, held.epoch, held.groupId);
+    if (auth.tool_grants !== ROOM_DEFAULT_READ_GRANTS) return auth;
+    if (this.roomGrantEpochs.size >= ROOM_GRANT_TRACK_MAX || held.epoch === null || held.groupId === null) {
+      writeServiceLog2("warn", "room_grant.untracked");
+      return Object.freeze({ ...auth, tool_grants: NO_TOOL_GRANTS });
+    }
+    this.roomGrantEpochs.set(messageId, { channelId, groupId: held.groupId, epoch: held.epoch });
+    return auth;
+  }
   /**
    * Classify the sender only from server-authenticated channel/roster data.
    * Missing or stale metadata is UNKNOWN with zero grants, never a permissive
@@ -32225,6 +32409,13 @@ var BridgeAgent = class _BridgeAgent {
    *       relayed `speaker_identity_id` (passed by the caller only for relay
    *       turns) is that same pinned owner, whose roster row is the agent's
    *       owner. A speaker claim from any non-relay sender gets nothing.
+   * Both need the roster fetched at `heldEpoch` (the agent's current MLS
+   * epoch for the channel), or the DM marked epoch-fresh at this ingest
+   * cycle's refresh (audit M-B4).
+   * PR R: ROOM_DEFAULT_READ_GRANTS only when the room kill switch is on, a
+   * per-tool consumer is attached, the roster was fetched at `heldEpoch`
+   * (no cycle carve-out), the room is INTERNAL (roomIsCrossOrg === false
+   * over every row, leaf rows included) and the audience is team_room.
    * Everything else gets the frozen empty list.
    *
    *   LIMIT (harness gate review H2, 2026-10-05): "pinned structural owner"
@@ -32236,9 +32427,10 @@ var BridgeAgent = class _BridgeAgent {
    *   connector turns grants into its full toolset. Binding the owner identity
    *   once, outside server control, is an open design follow-up.
    */
-  authorizationFor(channelId, senderId, relaySpeakerId) {
+  authorizationFor(channelId, senderId, relaySpeakerId, heldEpoch, heldGroupId) {
     const meta = this.freshMeta(channelId);
-    const roster = this.freshRoster(channelId);
+    const entry = this.freshRosterEntry(channelId);
+    const roster = entry?.members;
     const sender = roster?.get(senderId);
     let audience = "unknown";
     if (meta && sender) {
@@ -32249,7 +32441,10 @@ var BridgeAgent = class _BridgeAgent {
       else audience = "team_room";
     }
     let tool_grants = NO_TOOL_GRANTS;
-    if (this.ownerDmDefaultGrants && meta?.is_dm === true && sender) {
+    let relaySpeaker;
+    const epochFresh = rosterFreshAt(entry, heldEpoch, heldGroupId);
+    const ownerDmFresh = epochFresh || this.ownerDmCycleFresh.has(channelId);
+    if (ownerDmFresh && this.ownerDmDefaultGrants && meta?.is_dm === true && sender) {
       const pinned = this.channelOwner.get(channelId);
       const ownerId = pinned && pinned !== "anomalous" ? pinned.identityId : void 0;
       if (ownerId !== void 0) {
@@ -32257,14 +32452,20 @@ var BridgeAgent = class _BridgeAgent {
         const owner = roster?.get(ownerId);
         const ownerRelayed = relaySpeakerId !== void 0 && sender.is_relay && relaySpeakerId === ownerId && owner !== void 0 && !owner.is_agent && owner.is_agent_owner;
         if (ownerDirect || ownerRelayed) tool_grants = OWNER_DM_DEFAULT_READ_GRANTS;
+        if (ownerRelayed) relaySpeaker = "owner";
       }
     }
-    this.logAuthzDecision(channelId, senderId, relaySpeakerId, audience, tool_grants.length);
+    if (this.roomDefaultGrants && this.perToolConsumer !== null && epochFresh && meta?.is_dm === false && audience === "team_room" && entry.crossOrg === false) {
+      tool_grants = ROOM_DEFAULT_READ_GRANTS;
+    }
+    const roomClass = meta?.is_dm !== false ? "na" : entry?.crossOrg === false ? "internal" : entry?.crossOrg === true ? "cross_org" : "unknown";
+    this.logAuthzDecision(channelId, senderId, relaySpeakerId, audience, tool_grants.length, roomClass, epochFresh);
     return Object.freeze({
       version: 1,
       audience,
       sender_membership: sender ? "active" : "unknown",
-      tool_grants
+      tool_grants,
+      ...relaySpeaker ? { relay_speaker: relaySpeaker } : {}
     });
   }
   /**
@@ -32283,8 +32484,15 @@ var BridgeAgent = class _BridgeAgent {
    *                            startup: `on` = default grants enabled
    *   meta_fresh / roster_fresh whether the channel meta / roster caches were
    *                            fresh (either stale forces audience=unknown)
+   *   room_class               the room's class from the server roster (`na`
+   *                            for a DM): internal | cross_org | unknown
+   *   epoch_fresh              the roster was fetched at the agent's current
+   *                            MLS epoch for the channel
+   *   room_kill_switch         SECURECOMS_ROOM_DEFAULT_GRANTS as read at startup
+   *   per_tool_consumer        a consumer that declared per-tool grant
+   *                            enforcement is attached
    */
-  logAuthzDecision(channelId, senderId, relaySpeakerId, audience, grants) {
+  logAuthzDecision(channelId, senderId, relaySpeakerId, audience, grants, roomClass, epochFresh) {
     const meta = this.freshMeta(channelId);
     const roster = this.freshRoster(channelId);
     const sender = roster?.get(senderId);
@@ -32312,7 +32520,11 @@ var BridgeAgent = class _BridgeAgent {
       is_dm: meta?.is_dm === true,
       kill_switch: ServiceLogEnum.of(this.ownerDmDefaultGrants ? "on" : "off", ["on", "off"]),
       meta_fresh: meta !== void 0,
-      roster_fresh: roster !== void 0
+      roster_fresh: roster !== void 0,
+      room_class: ServiceLogEnum.of(roomClass, ["na", "internal", "cross_org", "unknown"]),
+      epoch_fresh: epochFresh,
+      room_kill_switch: ServiceLogEnum.of(this.roomDefaultGrants ? "on" : "off", ["on", "off"]),
+      per_tool_consumer: this.perToolConsumer !== null
     });
   }
   /**
@@ -32898,14 +33110,7 @@ var BridgeAgent = class _BridgeAgent {
       await this.refreshChannelMeta();
       metaRefreshed = true;
     }
-    const rosterRefreshed = /* @__PURE__ */ new Set();
-    for (const m of entries) {
-      if (rosterRefreshed.has(m.channelId)) continue;
-      rosterRefreshed.add(m.channelId);
-      if (this.freshRoster(m.channelId) === void 0) {
-        await this.refreshChannelRoster(m.channelId);
-      }
-    }
+    await this.refreshRostersForCycle(entries.map((m) => m.channelId));
     const relayMissRefreshed = /* @__PURE__ */ new Set();
     const acked = [];
     for (const m of entries) {
@@ -32988,7 +33193,7 @@ var BridgeAgent = class _BridgeAgent {
               // ignores vault_refs.
               text: ref.text ? ref.text : VAULT_REF_BARE_TEXT,
               ts: m.receivedAt,
-              authorization: this.authorizationFor(m.channelId, m.envelope.sender_id),
+              authorization: await this.authorizeTurn(m.channelId, m.messageId, m.envelope.sender_id),
               sender_name: this.freshRoster(m.channelId)?.get(m.envelope.sender_id)?.name,
               sender_is_agent: senderIsAgent,
               vault_refs: [toVaultRefEntry(ref)],
@@ -33044,7 +33249,7 @@ var BridgeAgent = class _BridgeAgent {
                 sender_id: m.envelope.sender_id,
                 text: typeof parsed.text === "string" ? parsed.text : "",
                 ts: m.receivedAt,
-                authorization: this.authorizationFor(m.channelId, m.envelope.sender_id),
+                authorization: await this.authorizeTurn(m.channelId, m.messageId, m.envelope.sender_id),
                 sender_name: senderName,
                 sender_is_agent: senderIsAgent,
                 attachments: [attachment],
@@ -33104,8 +33309,9 @@ var BridgeAgent = class _BridgeAgent {
             const senderName = this.freshRoster(m.channelId)?.get(
               m.envelope.sender_id
             )?.name;
-            const turnAuthorization = this.authorizationFor(
+            const turnAuthorization = await this.authorizeTurn(
               m.channelId,
+              m.messageId,
               m.envelope.sender_id,
               speaker?.identityId
             );
@@ -33676,6 +33882,7 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** Complete the durable handoff only after the runtime explicitly acks. */
   ackRuntimeMessages(messageIds) {
+    for (const id of messageIds) this.roomGrantEpochs.delete(id);
     for (const messageId of messageIds) {
       this.store.ackRuntimeInbox(messageId);
       this.runtimePendingIds.delete(messageId);
@@ -33805,6 +34012,24 @@ var BridgeAgent = class _BridgeAgent {
   harnessReport() {
     return this.harness;
   }
+  /**
+   * Audit C-B1: the attached /v1/ws consumer that declared per-tool grant
+   * enforcement (its hello carried "per_tool_grants" and no harness report),
+   * or null. authorizationFor issues a room grant only while one is attached
+   * (Task R2); every delivery path also strips room grants for any other
+   * consumer (consumer-grants.ts). The token is the socket's session object.
+   */
+  perToolConsumer = null;
+  notePerToolConsumer(token) {
+    this.perToolConsumer = token;
+  }
+  /** Forget `token` when its socket closes; a newer consumer's token is kept. */
+  clearPerToolConsumer(token) {
+    if (this.perToolConsumer === token) this.perToolConsumer = null;
+  }
+  perToolConsumerAttached() {
+    return this.perToolConsumer !== null;
+  }
   health() {
     let joined = 0;
     for (const s of this.joinState.values()) if (s === "JOINED") joined++;
@@ -34158,6 +34383,16 @@ function wsErrorFrame(code, detail) {
   return { type: "error", ...errorBody(code, detail) };
 }
 
+// src/consumer-grants.ts
+var NO_GRANTS = Object.freeze([]);
+var PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
+function withConsumerGrants(m, perToolConsumer) {
+  if (perToolConsumer) return m;
+  const a = m.authorization;
+  if (!a || a.tool_grants.length === 0 || a.audience === "owner_dm" || a.relay_speaker === "owner") return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
+}
+
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
   for (let i = 0; i < msgs.length; i++) {
@@ -34177,6 +34412,12 @@ data: ${JSON.stringify(msgs[i])}
   }
   return [];
 }
+function deliverSseBatch(res, batch, agent, onWriteError) {
+  const left3 = writeSse(res, batch.map((m) => withConsumerGrants(m, false)), onWriteError);
+  const leftIds = new Set(left3.map((message) => message.message_id));
+  agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
+  if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
+}
 function sseWriteFailureReporter() {
   let warned = false;
   return (error) => {
@@ -34439,7 +34680,7 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/messages") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
         const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
-        return json(res, 200, await agent.drain(channel, wait));
+        return json(res, 200, (await agent.drain(channel, wait)).map((m) => withConsumerGrants(m, false)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -34451,13 +34692,7 @@ function createHttpServer(agent, opts) {
         });
         res.write(":connected\n\n");
         const onWriteError = sseWriteFailureReporter();
-        const drainToClient = () => {
-          const batch = agent.takeBuffered(channel);
-          const left3 = writeSse(res, batch, onWriteError);
-          const leftIds = new Set(left3.map((message) => message.message_id));
-          agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
-          if (left3.length) agent.requeueFront(left3);
-        };
+        const drainToClient = () => deliverSseBatch(res, agent.takeBuffered(channel), agent, onWriteError);
         const unsubscribe = agent.subscribe(drainToClient);
         const keepalive = setInterval(() => {
           try {
@@ -34573,7 +34808,7 @@ function attachAgentWebSocket(server, agent, opts) {
     });
     const inflight = /* @__PURE__ */ new Map();
     const delivered = /* @__PURE__ */ new Map();
-    const session = { consumer: "unknown" };
+    const session = { consumer: "unknown", perToolGrants: false };
     const sweepStale = () => {
       const at = now();
       for (const [id, d] of delivered) {
@@ -34611,7 +34846,7 @@ function attachAgentWebSocket(server, agent, opts) {
             retired = true;
             continue;
           }
-          const frame = { type: "message", ...batch[i] };
+          const frame = { type: "message", ...withConsumerGrants(batch[i], session.perToolGrants) };
           try {
             sock.send(JSON.stringify(frame));
             inflight.set(batch[i].message_id, batch[i]);
@@ -34641,6 +34876,7 @@ function attachAgentWebSocket(server, agent, opts) {
       delivered.clear();
       if (current?.sock === sock) current = null;
       if (session.harness) agent.clearHarnessReport(session.harness);
+      if (session.perToolGrants) agent.clearPerToolConsumer(session);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -34708,6 +34944,15 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       session.harness = report;
       agent.recordHarnessReport(report);
     } else session.consumer = "runtime";
+    if (m.harness !== void 0) session.harnessClaimed = true;
+    const perTool = session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(PER_TOOL_GRANTS_FEATURE);
+    if (perTool && !session.perToolGrants) {
+      session.perToolGrants = true;
+      agent.notePerToolConsumer(session);
+    } else if (!perTool && session.perToolGrants) {
+      session.perToolGrants = false;
+      agent.clearPerToolConsumer(session);
+    }
     sendJson(sock, { type: "hello", features: ["nack"] });
     return;
   }

package/dist/room-tools.d.ts

@@ -0,0 +1,23 @@
+export type RoomToolClass = "room_safe_read" | "owner_credential" | "egress" | "side_effect";
+/** §7A.1a, verbatim. A tool carries every class that applies; the most
+ *  restrictive governs. `READ_ONLY_TOOLS` in the runtime is NOT this table:
+ *  it says whether an implementation writes, not whose credential it spends
+ *  or where it sends data (audit H-4). */
+export declare const TOOL_ROOM_CLASSES: Readonly<Record<string, readonly RoomToolClass[]>>;
+/** Edge statuses whose rows are channel MEMBERS for attribution and the
+ *  existing roster consumers (today's set). The wider rows feed
+ *  classification only. */
+export declare const LIVE_MEMBER_STATUSES: ReadonlySet<string>;
+/** A row that is a channel member: a live status (or an older backend with no
+ *  status) and not a leaf row (audit M-B2: a departed member still holding a
+ *  leaf counts for the class, never as a member). */
+export declare function isLiveRow(r: {
+    status?: string;
+    left_but_in_group?: boolean | null;
+}): boolean;
+/** §7A.4 (1): a room is cross-org if ANY row's org differs from the agent
+ *  owner's, leaf rows included. A row with no claim (an older backend, a
+ *  member with no edge) makes the class unknown, which grants nothing (§7A.5). */
+export declare function roomIsCrossOrg(rows: ReadonlyArray<{
+    is_same_org_as_agent_owner?: boolean | null;
+}>): boolean | null;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.26.5";
+export declare const BRIDGE_VERSION = "0.26.6";