@securecoms/agent-bridge 0.29.0 → 0.30.1

package/dist/memory/unified/item-book.d.ts

@@ -23,6 +23,9 @@ export interface ItemWriteRequest {
     sourceRef?: string;
     vec?: Float32Array | null;
     vecModelId?: string | null;
+    /** Owner grants plan 4 Task 16 (T-30): who wrote the line and, for an agent line, its origin (sealed in the record). */
+    role?: "peer" | "agent";
+    origin?: "fast_path" | "reply" | "untrusted";
     /** Pins and migrated notes: one item, never chunked. */
     noChunk?: true;
     /** Task 30: a migrated source row changed since the marker: replace the item with the same source_ref, same trust. */

package/dist/memory/unified/migrate.d.ts

@@ -12,6 +12,7 @@
  * marker to just past the clear in the store's clear transaction (fix round 1), so no later run re-imports pre-clear
  * history (a clear keeps history, section 14.4). After a disable or a purge the markers stay, so a later run resumes.
  */
+import { type LineOrigin } from "../../grants/voice-fence.js";
 import { type SqliteMlsStateStore } from "@agentvault/connect-mls-store";
 import { type ServiceLog } from "../../service-log.js";
 import type { ItemBook } from "./item-book.js";
@@ -35,6 +36,16 @@ export interface MigrationDeps {
      * never migrated, never retried, holds nothing); "unknown" when it cannot be classified now (retried on a later run).
      */
     classify: (conversationId: string) => MigrationClass;
+    /**
+     * Owner grants plan 4 Task 16 (T-30): the origin of an agent history row, so a fast-path line migrated from 0.30.0 on
+     * is marked. Absent: the row's own origin, else the pure rule with no fast-id knowledge (classifyAgentLine).
+     */
+    classifyHistoryOrigin?: (conversationId: string, row: {
+        messageId: string | null;
+        modality: string;
+        origin?: LineOrigin;
+        recordedAt: number;
+    }) => LineOrigin;
     /** Called after a conversation's notes committed pins (the bridge empties its pin cache under the memory mutex, as Task 28 does). */
     pinsChanged?: () => Promise<void>;
     /**

package/dist/memory/unified/read-book.d.ts

@@ -8,6 +8,7 @@
 import { type SqliteMlsStateStore } from "@agentvault/connect-mls-store";
 import type { Embedder } from "../embedder/client.js";
 import type { RankingClient } from "./ranking-client.js";
+import type { OpenedItem } from "./worker-protocol.js";
 export interface UnifiedFrameItem {
     block: "pinned" | "owner" | "reference";
     id: number;
@@ -63,7 +64,7 @@ export declare class UnifiedReadBook {
         kind: "text" | "voice";
     }): Promise<void>;
     /** ws flush (synchronous): the entry's own channel and owner scope, its capture still current (H-4, U11). */
-    deliverable(messageId: string, channelId: string, scopeIdNow: string): {
+    deliverable(messageId: string, channelId: string, scopeIdNow: string, keep?: (i: OpenedItem) => boolean): {
         items: UnifiedFrameItem[];
         pinnedMore: number;
     } | undefined;

package/dist/memory/unified/worker-protocol.d.ts

@@ -38,6 +38,10 @@ export interface OpenedItem {
     source: ItemSource;
     trust: ItemTrust;
     text: string;
+    /** Owner grants plan 4 Task 16 (voice fence, OQ-9): text only, from the sealed record and the row's clear source_ref. */
+    role?: "peer" | "agent";
+    origin?: "fast_path" | "reply" | "untrusted";
+    sourceRef?: string;
 }
 export type ToWorker = {
     type: "query";

package/dist/memory-taps.d.ts

@@ -15,5 +15,5 @@ interface MemorySink {
 export declare function recordInboundMemory(sink: MemorySink, channelId: string, senderId: string, text: string, messageId: string, modality?: "text" | "voice", expectPurgeEpoch?: number): Promise<void>;
 /** Record the agent's own outbound reply. Best-effort. `modality` is "voice"
  *  for a line the voice fast path spoke (H1), else "text". */
-export declare function recordOutboundMemory(sink: MemorySink, channelId: string, text: string, messageId: string, modality?: "text" | "voice", expectPurgeEpoch?: number): Promise<void>;
+export declare function recordOutboundMemory(sink: MemorySink, channelId: string, text: string, messageId: string, modality?: "text" | "voice", expectPurgeEpoch?: number, origin?: "fast_path" | "reply" | "untrusted"): Promise<void>;
 export {};

package/dist/memory-worker.js

@@ -150,7 +150,7 @@ function decodeItemRecord(b) {
   }
   if (!o || typeof o !== "object" || Array.isArray(o))
     return null;
-  const { v, t, s, tr, sr, c } = o;
+  const { v, t, s, tr, sr, c, ro, or } = o;
   if (v !== 1 || typeof t !== "string" || typeof s !== "string" || !ITEM_SOURCES.includes(s))
     return null;
   if (tr !== "owner" && tr !== "reference")
@@ -161,7 +161,19 @@ function decodeItemRecord(b) {
     return null;
   if (c !== void 0 && (typeof c !== "number" || !Number.isSafeInteger(c) || c < 1))
     return null;
-  return { text: t, source: s, trust: tr, ...sr !== void 0 ? { sourceRef: sr } : {}, ...c !== void 0 ? { chunks: c } : {} };
+  if (ro !== void 0 && ro !== "peer" && ro !== "agent")
+    return null;
+  if (or !== void 0 && or !== "fast_path" && or !== "reply" && or !== "untrusted")
+    return null;
+  return {
+    text: t,
+    source: s,
+    trust: tr,
+    ...sr !== void 0 ? { sourceRef: sr } : {},
+    ...c !== void 0 ? { chunks: c } : {},
+    ...ro !== void 0 ? { role: ro } : {},
+    ...or !== void 0 ? { origin: or } : {}
+  };
 }
 
 // src/memory/unified/ranking-core.ts
@@ -422,7 +434,10 @@ var RankingCore = class {
       originAt: Number(r.origin_at),
       source: rec.source,
       trust: rec.trust,
-      text: rec.text
+      text: rec.text,
+      ...rec.role !== void 0 ? { role: rec.role } : {},
+      ...rec.origin !== void 0 ? { origin: rec.origin } : {},
+      ...rec.sourceRef !== void 0 ? { sourceRef: rec.sourceRef } : {}
     };
   }
   /** H-7: one batched statement, LIMIT 5,001 per MAC inside the allowed scopes; a MAC that fills its limit is skipped. */

package/dist/service/install-prep.d.ts

@@ -1,5 +1,19 @@
 import { type ServiceInput } from "./config.js";
 import { type AutoWireDeps } from "./harness-wire.js";
+/** The parsed `/healthz` body fields the install and status liveness checks read. */
+export interface DaemonHealth {
+    agent_sessions?: number;
+    evictions?: number;
+    state?: string;
+}
+/**
+ * Liveness is a routed `/healthz` 200 whose state is not `session_superseded`
+ * (P-2). A TCP accept proves nothing: the daemon pre-binds its port before
+ * `agent.start()`, so a connect succeeds before the bridge routes anything.
+ */
+export declare function isDaemonRouted(h: DaemonHealth | null): h is DaemonHealth;
+/** Default install wait: the boot drain may take up to BOOT_DRAIN_WAIT_MS_DEFAULT, plus 15 s. */
+export declare const VERIFY_BUDGET_MS: number;
 export interface PrepDeps {
     readFile: (p: string) => string;
     writeFileMode: (p: string, data: string, mode: number) => void;
@@ -8,8 +22,11 @@ export interface PrepDeps {
     realpath: (p: string) => string;
     listDir: (p: string) => string[];
     probeBindFree: (port: number) => boolean;
-    probeConnect: (port: number) => boolean;
+    /** Routed `/healthz` probe (P-2): null unless the daemon answered a 200 with parseable JSON. */
+    getHealth: (port: number) => DaemonHealth | null;
     sleep: (ms: number) => Promise<void>;
+    /** Wall clock in ms (Date.now). verifyDaemonUp's deadline reads it, so probe time counts, not only sleep. */
+    now: () => number;
 }
 export interface ParsedCredential {
     deviceId: string;
@@ -19,6 +36,9 @@ export interface ParsedCredential {
 export declare function assertReadableCredential(absPath: string, deps: PrepDeps): ParsedCredential;
 export declare function durableDir(home: string, slug: string): string;
 export declare function durableCredentialPath(home: string, slug: string): string;
+/** M5 (OQ-3): the approved refusal text for an identity that is already installed. */
+export declare class InstallRefusedError extends Error {
+}
 export declare function takeCustody(args: {
     home: string;
     slug: string;

package/dist/service/instance-lock.d.ts

@@ -0,0 +1,88 @@
+import type { ServiceLog } from "../service-log.js";
+/** An unparseable lock this young may be a holder mid-write. */
+export declare const LOCK_PARTIAL_WRITE_GRACE_MS = 10000;
+/** A takeover guard this old was left by a crashed takeover. */
+export declare const LOCK_TAKEOVER_GUARD_STALE_MS = 30000;
+/** Two boot-epoch reads further apart than this are two different boots. */
+export declare const BOOT_TOLERANCE_SEC = 120;
+/** A holder refreshes its lock's mtime this often (#808 N1). */
+export declare const LOCK_HEARTBEAT_MS = 60000;
+/** A same-kernel, other-hostname lock untouched for this long is abandoned. */
+export declare const LOCK_FOREIGN_STALE_MS: number;
+export type LockRefusal = "held" | "foreign_host" | "unreadable" | "busy" | "failed";
+export type LockResult = "acquired" | LockRefusal;
+/** Everything the lock reads about the machine. Injected in tests. */
+export interface LockEnv {
+    pid: number;
+    hostname(): string;
+    /** Linux boot_id, or undefined where the platform has none. */
+    bootId(): string | undefined;
+    bootEpochSec(): number;
+    /** Linux /proc/<pid>/stat start time, or undefined (not Linux / no such pid). */
+    procStart(pid: number): string | undefined;
+    /** kill(pid, 0): true when running (EPERM counts as running). */
+    pidAlive(pid: number): boolean;
+    /** Test seam: runs after the takeover guard is taken, before the re-read. */
+    beforeTakeoverReread?(): void;
+    /** Test seam: runs after the stale lock is unlinked, before our create. */
+    beforeTakeoverCreate?(): void;
+    /** Test seam: runs after an O_EXCL create found the lock, before it is read. */
+    beforeLockRead?(): void;
+}
+/** Field 22 of /proc/<pid>/stat. The comm field (2) may contain spaces or
+ *  parentheses, so fields are counted from the LAST ')'. */
+export declare function procStartFromStat(stat: string): string | undefined;
+export declare function pidAliveByKill(pid: number): boolean;
+export declare const realLockEnv: LockEnv;
+export declare class InstanceLock {
+    readonly path: string;
+    private readonly env;
+    private readonly log;
+    private readonly heartbeatMs;
+    held: boolean;
+    /** The exact body this process wrote (#808 N1): release and the ownership
+     *  check compare the file against THIS, never against live machine facts
+     *  (a hostname can change under a running process). */
+    private written;
+    private heartbeat;
+    /** The error behind the last `unreadable` / `failed`, for the caller's one
+     *  log line (the lock itself never logs a refusal: it is retried per call). */
+    lastError: unknown;
+    /** PID read from the lock body of the live holder behind the last `held`. */
+    private holderPid;
+    constructor(path: string, env?: LockEnv, log?: ServiceLog, heartbeatMs?: number);
+    private body;
+    /** Try to hold the lock. Never throws (#808 L-e: machine reads included). */
+    acquire(): {
+        result: LockResult;
+        holderPid?: number;
+    };
+    /**
+     * True while the file is still exactly the body this process wrote. Read
+     * before every reserve (one small read), so a holder whose lock was taken
+     * while it was frozen stops before it spends (#808 N1). A lost lock is
+     * dropped: the caller then refuses, and later calls try to re-acquire.
+     */
+    stillHeld(): boolean;
+    private acquireUnguarded;
+    /** Remove the lock only while it is still exactly the body this process
+     *  wrote (#808 N1: not the live hostname, which can change under us). */
+    release(): void;
+    private drop;
+    /** We hold it: remember what we wrote (the file as it is now, ours) and
+     *  start the heartbeat. */
+    private took;
+    /** Refresh the mtime while the file is still ours; stop if it is not. */
+    private beat;
+    private sameBoot;
+    /** O_EXCL create with our body. A write failure removes the half-written
+     *  file (it is ours: we created it) and reports `failed`, never throws. */
+    private create;
+    /**
+     * Replace a stale lock. Only the holder of the O_EXCL takeover guard may
+     * remove a lock, and only after re-reading it UNCHANGED, so two runtimes
+     * that both saw the same stale lock cannot each delete the other's new one.
+     * A fresh guard means a takeover is in progress: busy this time.
+     */
+    private takeOver;
+}

package/dist/service/launchd.d.ts

@@ -1,4 +1,4 @@
 import type { ServiceConfig } from "./config.js";
 /** A deterministic launchd LaunchAgent plist. ProgramArguments re-invoke the
- *  running bin in run mode; KeepAlive restarts on crash, RunAtLoad starts at login. */
+ *  running bin in run mode; KeepAlive{SuccessfulExit:false} restarts only on a non-zero exit (a clean exit stays down), RunAtLoad starts at login. */
 export declare function renderLaunchdPlist(cfg: ServiceConfig): string;

package/dist/service/runtime-config-dir.d.ts

@@ -13,6 +13,21 @@ export interface FsDeps {
     unlink: (p: string) => void;
 }
 export declare function runtimeConfigDir(home: string, identityId: string): string;
+/** Owner grants (spec §7.8): the runtime honours a manifest-marked grant only for a tool listed here. */
+export declare const MANIFEST_POLICY_FILE = "manifest-policy.json";
+export interface ManifestPolicyDoc {
+    readonly v: 1;
+    readonly manifest_tools: readonly string[];
+    readonly secret_path_mode: "enforce";
+}
+/**
+ * Owner grants review H-2: under a manifest whose config signs no llm, a managed llm-source.json (written before the
+ * manifest, by an unsigned config) must not stay in force. The one deletion in this directory, by name, bridge-only.
+ * ENOENT is success; any other error throws.
+ */
+export declare function removeManagedLlmSource(home: string, identityId: string, deps?: FsDeps): void;
+/** The bridge's own writer for manifest-policy.json (writeManagedFiles refuses the name). Atomic, 0600. Throws. */
+export declare function writeManifestPolicy(home: string, identityId: string, policy: ManifestPolicyDoc, deps?: FsDeps): void;
 export declare function writeManagedFiles(home: string, identityId: string, files: Record<string, string>, deps?: FsDeps): void;
 /** Every path skills.json names, checked on disk. Contents are never read. */
 export declare function checkConfiguredPaths(skillsJson: Record<string, unknown>, statFn?: (p: string) => {

package/dist/service/status.d.ts

@@ -1,11 +1,9 @@
 import type { AgentFleetEntry } from "./fleet.js";
+import { type DaemonHealth } from "./install-prep.js";
 export interface StatusDeps {
     readFleet: () => AgentFleetEntry[];
-    probeConnect: (port: number) => boolean;
-    getHealth: (port: number) => {
-        agent_sessions?: number;
-        evictions?: number;
-    } | null;
+    /** Routed `/healthz` probe (P-2): null unless the daemon answered a 200. */
+    getHealth: (port: number) => DaemonHealth | null;
 }
 export interface AgentStatusRow {
     slug: string;

package/dist/service/systemd.d.ts

@@ -1,4 +1,4 @@
 import type { ServiceConfig } from "./config.js";
 /** A systemd --user unit. ExecStart re-invokes the running bin in run mode;
- *  Restart=always supervises crashes. WantedBy=default.target enables at login. */
+ *  Restart=on-failure supervises crashes only (a clean exit stays down). WantedBy=default.target enables at login. */
 export declare function renderSystemdUnit(cfg: ServiceConfig): string;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.29.0";
+export declare const BRIDGE_VERSION = "0.30.1";

package/dist/ws-server.d.ts

@@ -34,6 +34,9 @@ export declare const INFLIGHT_STALE_AFTER_MS: number;
  * consumer, so it never carried its notes.
  */
 export declare const HELLO_WAIT_MS = 2000;
+/** C9: the close code a superseded bridge sends its local runtime sockets;
+ *  the same code the server sends the bridge (spec §4.1.5, OQ-9). */
+export declare const WS_CLOSE_SESSION_SUPERSEDED = 4409;
 /** Spec §8.5: the hello-reply feature that tells the runtime it may offer memory_note on this socket. */
 export declare const MEMORY_NOTES_FEATURE = "memory_notes";
 /** Semantic memory 7b (spec §7.2 Q4): the hello feature a runtime declares to receive `memory.recall`; the bridge echoes it. */
@@ -48,8 +51,9 @@ export declare const MEMORY_UNIFIED_FEATURE = "memory_unified";
  * fake against this list at run time (7b gate fix: a member added here without
  * a fake made three tests throw "is not a function").
  */
-export declare const WS_AGENT_MEMBERS: readonly ["ackRuntimeMessages", "action", "admitRuntimeDelivery", "applyMemoryNote", "clearHarnessReport", "clearPerToolConsumer", "isRuntimeMessageRetired", "noteNotesConsumer", "notePerToolConsumer", "noteRecallConsumer", "noteUnifiedConsumer", "noteSessionClose", "noteSessionEvicted", "noteSessionOpen", "notesAppliedGeneration", "notesForDelivery", "recallForDelivery", "unifiedFeatureOn", "unifiedForDelivery", "recordHarnessReport", "recordRuntimeReply", "reportStatusGated", "requeueFailedRuntimeDeliveries", "requeueFront", "runtimeReplyReceipt", "send", "sendA2A", "subscribe", "takeDeliverable", "wakeListeners"];
+export declare const WS_AGENT_MEMBERS: readonly ["ackRuntimeMessages", "action", "admitRuntimeDelivery", "applyMemoryNote", "clearHarnessReport", "clearManifestConsumer", "clearPerToolConsumer", "harnessGrantsWithheld", "isRuntimeMessageRetired", "noteConsumerCapability", "noteManifestConsumer", "noteRoomCapReached", "noteNotesConsumer", "notePerToolConsumer", "noteRecallConsumer", "noteUnifiedConsumer", "noteSessionClose", "noteSessionEvicted", "noteSessionOpen", "notesAppliedGeneration", "notesForDelivery", "recallForDelivery", "unifiedFeatureOn", "unifiedForDelivery", "recordHarnessReport", "recordRuntimeReply", "reportStatusGated", "requeueFailedRuntimeDeliveries", "requeueFront", "runtimeReplyReceipt", "send", "sendA2A", "subscribe", "takeDeliverable", "wakeListeners"];
 export type WsAgent = Pick<BridgeAgent, (typeof WS_AGENT_MEMBERS)[number]>;
 export declare function attachAgentWebSocket(server: HttpServer, agent: WsAgent, opts: AgentWebSocketOptions): {
     close(): void;
+    enterSessionSuperseded(): void;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.29.0",
+  "version": "0.30.1",
   "type": "module",
   "engines": {
     "node": ">=22.5.0"