@securecoms/agent-bridge 0.26.5 → 0.27.0

package/README.md

@@ -56,6 +56,19 @@ The bundled connectors give tools only to the agent owner's turns. Each harness
 
 On an older harness the connector reports its tool veto as inactive and refuses every turn that has no tool grant, so non-owner rooms go quiet instead of running tools unchecked. `/healthz` shows `harness_tool_veto_active` (true, false, or null when no connector is attached), the authenticated `GET /v1/status` shows the harness name and version, and the daemon logs `harness.tool_veto_inactive` once when an attached harness cannot veto. After upgrading the package, re-run `agent-bridge wire --harness openclaw` (or re-copy the Hermes connector files) so the harness loads the new connector, then restart the harness gateway.
 
+### Room tool rule (0.26.6 and later)
+
+In a room whose every member, including pending members and anyone who left but still holds an MLS leaf, is in the agent owner's org, a same-org human sender's turn may use `current_time` only. Cross-org and unknown rooms get no tools. The owner DM keeps `current_time` and `web_search`. Replies to room turns are re-classified when they are sent.
+
+Operator steps:
+
+- **Deploy order:** backend (already live), then this bridge, then `@securecoms/agent-runtime` 0.9.9. A new runtime on an old bridge offers no tools on the owner's relayed voice turns. Room grants need both the new bridge and the new runtime.
+- **Re-wire connectors:** re-run `agent-bridge wire --harness ...` on every Hermes and OpenClaw host after upgrading. Connectors are copied at wire time and an upgrade does not refresh them. A bridge downgrade after re-wiring makes the new connectors refuse tools on the owner's voice turns.
+- **Kill switch:** `SECURECOMS_ROOM_DEFAULT_GRANTS` (bridge service environment, read at startup). Unset or `on` keeps the room default; any other value sends no tools on every room turn. It does not affect the owner DM. `SECURECOMS_OWNER_DM_DEFAULT_GRANTS` is unchanged.
+- **Owner-DM epoch freshness:** owner-DM tools now also require a roster read at the agent's current MLS group and epoch. A wedged or group-less DM shows no tools. Diagnose with the `authz.decision` log fields `epoch_fresh`, `room_class`, `per_tool_consumer` and `room_kill_switch`.
+- **Restart residual:** after a bridge restart, a reply to a room turn granted before the restart is not re-classified. Only `current_time` output can be affected.
+- **Post-deploy probe:** count `connect.roster_mirror_unresolved` warnings and rooms reading `unknown`. A high rate means roster mirror drift is hiding room tools.
+
 ---
 
 ## Quickstart
@@ -692,6 +705,84 @@ including its key). Each proxied call is metered server-side
 
 ---
 
+## Markdown notes (0.27.0)
+
+SecureComs-runtime agents keep short notes of what the owner asks them to
+remember, in the owner's private chat only. The runtime saves a note with the
+`memory_note` tool, and the bridge stores only a quote of the owner's own
+current message. Each note is sealed per row in `bridge-state.db` (schema
+v10) and is delivered only to the runtime's `/v1/ws` socket, never to a
+harness, HTTP, SSE, a room, another chat or the voice fast path.
+
+**Compatibility.**
+
+- Install `@securecoms/agent-runtime` 0.10.0 together with the bridge and
+  restart both (`launchctl bootout` then `bootstrap`, never `kickstart`). The
+  bridge moves legacy owner-DM facts into notes, and reports
+  `memory_notes: true`, only after a runtime whose hello declares
+  `memory_notes` has connected in that bridge process. A 0.9.x runtime's
+  hello does not, so a 0.27 bridge with a 0.9.x runtime keeps today's facts
+  and recall, but it is not a supported pairing.
+- Harness daemons (Hermes, OpenClaw) must name `memory.provider` in their
+  credential file. A daemon whose file omits it is treated as `securecoms`;
+  its harness socket still never receives notes and never turns on the import
+  or the report, so naming the provider is defence in depth. A global
+  `npm install -g --prefix ~/.local` reaches every daemon whose plist points
+  at the global `dist/bin.js`, at its next restart; check each credential file
+  (`jq .memory.provider <credential-file>`) before installing.
+- A `/v1/ws` consumer that sends no hello waits about 2 seconds for its first
+  delivery.
+- Notes are off in a freshly started bridge until a runtime-config refetch
+  succeeds. A bridge restarted while the backend is unreachable serves no
+  notes and accepts no writes until the backend answers.
+
+**Known limitations.**
+
+- Text the owner pastes counts as the owner's own words, up to the
+  600-unit short-message bound.
+- A quote can drop a condition or a negation ("Never cc X" can be saved as
+  "cc X"). Ask the agent what it saved.
+- Short notes in CJK or Thai (fewer than 2 space-separated tokens) are
+  refused.
+- UUIDs and long letter-and-digit tokens are refused as possible secrets.
+- Forget and clear are logical deletes: sealed bytes can stay in free
+  database pages until they are overwritten, and they still open under the
+  device key.
+- "Clear all notes" does not delete chat history or legacy facts. Legacy facts
+  that did not fit before can become notes after a clear.
+- The voice fast path still sends the last 10 DM messages through the
+  backend proxy.
+
+**Off switches.** There are three. Use the narrowest that fits.
+
+- `memory.provider: "none"` in the credential file, then a daemon restart.
+  This turns notes off, and it also drops the recent history.
+- `SECURECOMS_OWNER_DM_DEFAULT_GRANTS=off` in the bridge service environment.
+  This also drops the owner-DM tools, not only `memory_note`.
+- `SECURECOMS_TOOL_DENY=memory_note` removes only the note tool.
+
+**Log events.** All are content-free: counts and classes only, never note text.
+`memory.note_written` (`op`, `notes_count`, `doc_chars`),
+`memory.note_refused` (`reason_class`), `memory.notes_cache_miss`,
+`memory.note_open_failed`, `memory.import_partial` (`remaining`),
+`memory.config_unrecognized`, `memory.clear_generation_regressed`,
+`memory.clear_failed`, `memory.applied_generation_out_of_range`,
+`memory.notes_fill_failed`, `memory.import_failed`,
+`memory.note_write_failed` (error class only), and `ws.hello_timeout` (no
+fields: a `/v1/ws` socket sent no hello and delivery opened after the wait).
+
+**Upgrade order.** Upgrade and restart the bridge and the runtime together.
+First check `memory.provider` in the credential file of every daemon that a
+global install reaches (`jq .memory.provider <credential-file>`).
+
+**Rollback.** A 0.26.x bridge leaves the notes sealed on disk and reads
+neither the notes nor the legacy facts already moved into them, until it is
+upgraded again; the same holds for a 0.9.x runtime. Roll back the runtime and
+the bridge together, and restart both: the bridge decides once per process
+that a notes-reading runtime is present.
+
+---
+
 ## Flags and environment
 
 | Flag | Env var | Default | Description |

package/connectors/hermes/securecoms_authz.py

@@ -9,11 +9,13 @@ The daemon attaches an ``authorization`` block to every inbound frame
 from server-authenticated roster data, never from message plaintext):
 
     {"version": 1, "audience": ..., "sender_membership": "active"|"unknown",
-     "tool_grants": [{"tool": ..., "mode": ...}, ...]}
+     "tool_grants": [{"tool": ..., "mode": ...}, ...],
+     "relay_speaker": "owner"}   # optional; only on an owner-spoken relay turn
 
 ``tool_grants`` is non-empty ONLY for a DM's single human counterpart whom the
 server marks as the agent's owner (``is_agent_owner``), or a relayed voice
-turn whose speaker is that person. The daemon pins that counterpart per
+turn whose speaker is that person (the daemon marks it ``relay_speaker:
+"owner"``). The daemon pins that counterpart per
 channel, so the owner distinction rests on the server's flag: a backend that
 mis-sets it would grant a DM member tools (review H2; binding the owner
 identity outside server control is an open follow-up). Every other sender (room
@@ -24,7 +26,11 @@ not positively recognise as a grant is "no tools".
 
 Hermes cannot express the daemon's per-tool grants (current_time, web_search)
 as its own toolsets, so a granted turn keeps the owner's configured Hermes
-toolsets unchanged and an ungranted turn gets none.
+toolsets unchanged and an ungranted turn gets none. Because of that, a grant
+is honoured ONLY on an ``owner_dm`` block or a block the daemon marked
+``relay_speaker: "owner"`` (audit C-B1, r2 R2-T1): the daemon's room grants
+are per-tool and are delivered only to a per-tool consumer, never to this
+connector.
 """
 
 from collections import OrderedDict
@@ -91,10 +97,16 @@ def _is_grant(entry: Any) -> bool:
 
 
 def tools_allowed(frame: Any) -> bool:
-    """True only when the daemon granted this turn at least one tool."""
+    """True only when the turn is the owner's own (its owner_dm block, or the
+    daemon's relay_speaker="owner" mark on a relayed voice turn) AND the daemon
+    granted it at least one tool. Audit C-B1, r2 R2-T1 (2026-10-05): a daemon
+    grant names ONE tool, but a granted turn here keeps the owner's whole Hermes
+    toolset, so nothing else is ever honoured, whatever the daemon sends."""
     block = _valid_block(frame)
     if block is None:
         return False
+    if block.get("audience") != "owner_dm" and block.get("relay_speaker") != "owner":
+        return False
     grants = block.get("tool_grants")
     if not isinstance(grants, list) or not grants:
         return False

package/connectors/hermes/tests/test_securecoms_authz.py

@@ -3,10 +3,12 @@
 # Per-turn tool authorization for the Hermes connector. The daemon attaches
 # an `authorization` block to every inbound frame (BridgeAgent.authorizationFor,
 # derived from server-authenticated roster data). Its `tool_grants` list is
-# non-empty ONLY for the agent's pinned owner in their DM (or a relayed voice
-# turn spoken by that owner). Everything else - room members, other-org
-# members, agent senders, an older daemon that sends no block, a malformed
-# block - must run with NO tools. Fail closed.
+# non-empty ONLY for the agent's pinned owner in their DM, a relayed voice turn
+# spoken by that owner (marked `relay_speaker: "owner"` by the daemon), or
+# (from PR R on) a same-org human in an internal room. This connector honours
+# a grant ONLY on an `owner_dm` block or a block marked
+# `relay_speaker: "owner"` (audit C-B1, r2 R2-T1): every other turn runs with
+# NO tools. Fail closed.
 
 import securecoms_authz as authz
 
@@ -36,8 +38,31 @@ class TestToolsAllowed:
 
     def test_relayed_owner_voice_turn_with_grants_is_allowed(self):
         # The daemon grants a relay turn only when the relayed speaker is the
-        # pinned owner; its audience is agent_to_agent (the relay is an agent).
-        assert authz.tools_allowed(frame(auth("agent_to_agent"))) is True
+        # pinned owner, and marks it relay_speaker="owner" (audit r2 R2-T1);
+        # its audience is agent_to_agent (the relay is an agent).
+        assert authz.tools_allowed(frame({**auth("agent_to_agent"), "relay_speaker": "owner"})) is True
+
+    def test_agent_to_agent_grants_without_the_owner_relay_mark_are_refused(self):
+        # Audit C-B1 / R2-T1: a grant is honoured only on owner_dm or on the
+        # bridge's relay_speaker="owner" mark, whatever the daemon sends.
+        assert authz.tools_allowed(frame(auth("agent_to_agent"))) is False
+
+    def test_a_non_owner_relay_mark_with_grants_is_refused(self):
+        # Review R2a fix 1: only the exact string "owner" is the mark. A
+        # truthiness check would accept every one of these.
+        for value in ("Owner", "OWNER", "guest", "", True, 1, ["owner"], {"v": "owner"}, "\u043ewner", "owner\u200b"):
+            block = {**auth("agent_to_agent"), "relay_speaker": value}
+            assert authz.tools_allowed(frame(block)) is False, repr(value)
+
+    def test_the_owner_relay_mark_without_grants_is_refused(self):
+        # Audit r2 R2-T1: the no-grants agent_to_agent case. The mark alone grants nothing.
+        assert authz.tools_allowed(frame({**auth("agent_to_agent", grants=[]), "relay_speaker": "owner"})) is False
+
+    def test_a_granted_block_outside_the_owner_dm_is_refused(self):
+        # Audit C-B1: a room grant means ONE named tool to the daemon, but a
+        # granted turn here keeps the owner's whole Hermes toolset.
+        for audience in ("team_room", "partner_room", "other_human_dm", "unknown"):
+            assert authz.tools_allowed(frame(auth(audience))) is False, audience
 
     def test_room_member_without_grants_is_refused(self):
         assert authz.tools_allowed(frame(auth("team_room", grants=[]))) is False

package/connectors/openclaw/openclaw-entry.js

@@ -148,9 +148,11 @@ export function isOwnerAuthorization(authorization) {
 // OpenClaw runs every turn with the agent's configured tools, so without this
 // a room member, a partner-org member or another agent reaches the same exec
 // and file tools as the owner. The daemon's authorization block says which
-// turn was granted tools: tool_grants is non-empty ONLY for the agent's pinned
-// owner in their DM, or a relayed voice turn the owner spoke
-// (BridgeAgent.authorizationFor). OpenClaw has no per-message "no tools"
+// turn was granted tools (BridgeAgent.authorizationFor). A daemon grant names
+// ONE tool, but a granted turn here lifts the veto for every configured tool,
+// so the connector honours a grant ONLY on the owner's own turn: an owner_dm
+// block, or a relayed voice turn the daemon marked relay_speaker "owner"
+// (audit C-B1, r2 R2-T1). OpenClaw has no per-message "no tools"
 // switch the channel can set, so the connector registers a before_tool_call
 // hook and BLOCKS every tool call in a SecureComs session whose turn was not
 // granted tools. If the host gives the plugin no hook API, a turn without a
@@ -180,9 +182,11 @@ export const NO_TOOLS_TURN_NOTE =
   "Tools are disabled for this message because its sender is not this agent's owner in a direct message. Answer in text only and do not try to call any tool.";
 
 /**
- * True only when the daemon granted this turn at least one tool: a v1 block,
- * an active sender, and a non-empty list of `{ tool: <name> }` grants. The
- * audience alone never grants tools (an unpinned or anomalous owner, or the
+ * True only when the daemon granted the OWNER'S OWN turn at least one tool: a
+ * v1 block, an active sender, audience owner_dm or the daemon's
+ * relay_speaker "owner" mark (audit C-B1, r2 R2-T1: any other audience gets no
+ * tools even with grants), and a non-empty list of `{ tool: <name> }` grants.
+ * The audience alone never grants tools (an unpinned or anomalous owner, or the
  * grants kill switch, arrives as owner_dm with no grants). The daemon grants
  * a DM's single human counterpart whom the server marks `is_agent_owner`; the
  * pin is per channel, so a backend that mis-sets that flag would grant a DM
@@ -192,6 +196,10 @@ export const NO_TOOLS_TURN_NOTE =
 export function toolsAuthorized(authorization) {
   if (authorization === null || typeof authorization !== "object") return false;
   if (authorization.version !== 1 || authorization.sender_membership !== "active") return false;
+  // Audit C-B1, r2 R2-T1 (2026-10-05): a daemon grant names ONE tool, but a
+  // granted turn here lifts the veto for every configured tool. Only the
+  // owner's own turn is honoured: its DM, or the daemon's relay_speaker mark.
+  if (authorization.audience !== "owner_dm" && authorization.relay_speaker !== "owner") return false;
   const grants = authorization.tool_grants;
   if (!Array.isArray(grants) || grants.length === 0) return false;
   return grants.every((g) => g !== null && typeof g === "object" && typeof g.tool === "string" && g.tool !== "");

package/connectors/openclaw/openclaw-entry.toolgate.test.ts

@@ -1,13 +1,15 @@
 // packages/connect-agent-bridge/connectors/openclaw/openclaw-entry.toolgate.test.ts
 //
-// Tool gate (security fix 2026-10-05): only a turn the daemon granted tools
-// (its authorization block's tool_grants is non-empty, which the daemon does
-// ONLY for the agent's pinned owner in their DM or an owner-spoken relayed
-// voice turn) may run OpenClaw tools. Every other sender (room member,
-// other-org member, another agent, a frame with no or a malformed block) runs
-// with every tool call BLOCKED by the connector's before_tool_call hook. If
-// the OpenClaw host gives the plugin no hook API, such a turn is refused
-// outright (acked, never dispatched). Fail closed.
+// Tool gate (security fix 2026-10-05): the daemon's authorization block's
+// tool_grants is non-empty ONLY for the agent's pinned owner in their DM, a
+// relayed voice turn spoken by that owner (marked `relay_speaker: "owner"` by
+// the daemon), or (from PR R on) a same-org human in an internal room. This
+// connector honours a grant ONLY on an `owner_dm` block or a block marked
+// `relay_speaker: "owner"` (audit C-B1, r2 R2-T1). Every other turn (room
+// member, other-org member, another agent, a frame with no or a malformed
+// block) runs with every tool call BLOCKED by the connector's
+// before_tool_call hook. If the OpenClaw host gives the plugin no hook API,
+// such a turn is refused outright (acked, never dispatched). Fail closed.
 //
 // Drives the REAL register() + plugin.gateway.startAccount path with a fake
 // OpenClaw runtime and api, like openclaw-entry.inbound.test.ts.
@@ -234,7 +236,16 @@ describe("openclaw-entry — tool gate (non-owner senders get no tools)", () =>
     it("is true only for a v1 block from an active sender with at least one tool grant", async () => {
       const m = await import("./openclaw-entry.js");
       expect(m.toolsAuthorized(OWNER_AUTH)).toBe(true);
-      expect(m.toolsAuthorized({ ...noGrant("agent_to_agent"), tool_grants: GRANTS })).toBe(true); // owner-spoken relay turn
+      expect(m.toolsAuthorized({ ...noGrant("agent_to_agent"), tool_grants: GRANTS, relay_speaker: "owner" })).toBe(true); // owner-spoken relay turn (R2-T1)
+      expect(m.toolsAuthorized({ ...noGrant("agent_to_agent"), tool_grants: GRANTS })).toBe(false); // no owner relay mark
+      expect(m.toolsAuthorized({ ...noGrant("agent_to_agent"), relay_speaker: "owner" })).toBe(false); // the mark alone grants nothing
+      // Review R2a fix 1: only the exact string "owner" is the mark; a truthiness check would accept these.
+      for (const v of ["Owner", "OWNER", "guest", "", true, 1, ["owner"], { v: "owner" }, "\u043ewner", "owner\u200b"]) {
+        expect(m.toolsAuthorized({ ...noGrant("agent_to_agent"), tool_grants: GRANTS, relay_speaker: v }), JSON.stringify(v)).toBe(false);
+      }
+      for (const aud of ["team_room", "partner_room", "other_human_dm", "unknown"]) {
+        expect(m.toolsAuthorized({ ...noGrant(aud), tool_grants: GRANTS }), aud).toBe(false); // audit C-B1
+      }
       expect(m.toolsAuthorized(noGrant("owner_dm"))).toBe(false); // kill switch / unpinned owner / lying flag
       expect(m.toolsAuthorized(noGrant("team_room"))).toBe(false);
       expect(m.toolsAuthorized(noGrant("partner_room"))).toBe(false);

package/dist/bin.d.ts

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import { BridgeAgent } from "./bridge-agent.js";
+import { createHttpServer } from "./http-server.js";
+import { attachAgentWebSocket } from "./ws-server.js";
 import { type ResolveNodeDeps } from "./service/resolve-node.js";
 import { type Harness } from "./service/wire.js";
 export declare function nodeMajorOk(version: string): boolean;
@@ -12,3 +15,23 @@ export declare function parseVerb(argv: string[]): "install" | "uninstall" | "st
 export declare function slugFromCredentialPath(credentialPath: string): string;
 export declare function chooseInstallExecPath(runningExecPath: string, override: string | undefined, deps: ResolveNodeDeps): string;
 export declare function realCopyConnector(srcDir: string, dstDir: string, harness: Harness): void;
+/**
+ * Markdown memory 7a, N-L5: start the agent, THEN create the HTTP server and
+ * attach /v1/ws. start() applies the runtime config (and any clear issued
+ * while the machine was offline) and warms the restored turns before it
+ * resolves, so no route or socket exists while a stale note could be served.
+ * main() can listen only on the server this returns. `readTls` runs after
+ * start(), as the inline read did.
+ */
+export declare function startThenServe(agent: BridgeAgent, opts: {
+    token: string;
+    allowOrigins: string[];
+    readTls: () => {
+        cert: string;
+        key: string;
+    } | undefined;
+}): Promise<{
+    server: ReturnType<typeof createHttpServer>["server"];
+    closeAllSseStreams: () => void;
+    agentWs: ReturnType<typeof attachAgentWebSocket>;
+}>;