@securecoms/agent-bridge 0.3.1 → 0.4.0

package/dist/bin.js

@@ -23,6 +23,26 @@ function loadConfig(opts) {
   const agentName = typeof json2.agent_name === "string" && json2.agent_name ? json2.agent_name : typeof json2.display_name === "string" && json2.display_name ? json2.display_name : void 0;
   const rateLimitCapacity = typeof json2.rate_limit_capacity === "number" ? json2.rate_limit_capacity : 20;
   const rateLimitRefillPerMinute = typeof json2.rate_limit_refill_per_minute === "number" ? json2.rate_limit_refill_per_minute : 20;
+  const memProvRaw = json2.memory?.provider;
+  let memoryProvider;
+  let memoryBaseDir;
+  let memoryAgent;
+  if (memProvRaw === "none") {
+    memoryProvider = "none";
+  } else if (memProvRaw === "hermes") {
+    memoryProvider = "hermes";
+    const bd = json2.memory?.base_dir;
+    memoryBaseDir = typeof bd === "string" && bd ? bd : "~/.hermes";
+  } else if (memProvRaw === "openclaw") {
+    memoryProvider = "openclaw";
+    const oc = json2.memory?.openclaw;
+    const bd = oc?.base_dir;
+    memoryBaseDir = typeof bd === "string" && bd ? bd : "~/.openclaw";
+    const ag = oc?.agent;
+    memoryAgent = typeof ag === "string" && ag ? ag : void 0;
+  } else {
+    memoryProvider = "securecoms";
+  }
   return {
     apiKey: json2.api_key,
     identityId: json2.identity_id,
@@ -33,7 +53,10 @@ function loadConfig(opts) {
     storePath,
     agentName,
     rateLimitCapacity,
-    rateLimitRefillPerMinute
+    rateLimitRefillPerMinute,
+    memoryProvider,
+    memoryBaseDir,
+    memoryAgent
   };
 }
 function arg(argv, flag) {
@@ -640,6 +663,152 @@ var payloadsSchema = {
           }
         }
       ]
+    },
+    "call_control": {
+      "description": 'The call_control signaling body for 1:1 voice calls (docs/superpowers/specs/2026-07-12-voice-human-to-human-calling-design.md). NOT a message_type \u2014 it rides envelope message_type "system_event"; the "kind":"call_control" field is a body-level discriminator and "event" selects the variant. Compiled standalone via validate.ts validateCallControlBody. SERVER-BLIND KEY CONTRACT: NO variant ever carries media key material (the media key is derived independently from the MLS exporter, never transmitted). Every variant sets additionalProperties:false so a stray media_key/key/secret is rejected \u2014 the only key-adjacent field is `key_confirmation` on accept, which is HMAC(media_key, call_id), not the key itself.',
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id",
+            "room",
+            "caller_identity_id",
+            "epoch",
+            "ts"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "invite"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "room": {
+              "type": "string",
+              "minLength": 1
+            },
+            "caller_identity_id": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "epoch": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "ts": {
+              "type": "number"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id",
+            "accepting_device_id",
+            "key_confirmation"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "accept"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "accepting_device_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "key_confirmation": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "decline"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "reason": {
+              "type": "string",
+              "enum": [
+                "busy",
+                "declined"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "cancel"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "end"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        }
+      ]
     }
   }
 };
@@ -664,6 +833,11 @@ if (!agentActionDef) {
   throw new Error(`payloads.schema.json is missing the "agent_action" $defs schema`);
 }
 var agentActionValidator = ajv.compile(agentActionDef);
+var callControlDef = payloadDefs["call_control"];
+if (!callControlDef) {
+  throw new Error(`payloads.schema.json is missing the "call_control" $defs schema`);
+}
+var callControlValidator = ajv.compile(callControlDef);
 
 // ../connect-core/dist/envelope/sign.js
 import { canonicalize } from "@agentvault/crypto/canonical";
@@ -725,6 +899,7 @@ import { gcm } from "@noble/ciphers/aes";
 import { xchacha20poly1305 } from "@noble/ciphers/chacha";
 import { randomBytes } from "@noble/hashes/utils";
 import { canonicalize as canonicalize2 } from "@agentvault/crypto/canonical";
+var VOICE_MEDIA_EXPORTER_LABEL = "securecoms-voice-media-v1";
 var APPLICATION_KEY_BYTES = 32;
 var REPLAY_NONCE_BYTES = 24;
 var NONCE_BYTES = {
@@ -746,10 +921,20 @@ function epochToBytes(epoch) {
   new DataView(b.buffer).setBigUint64(0, BigInt(epoch), false);
   return b;
 }
+function u32ToBytes(n) {
+  const b = new Uint8Array(4);
+  new DataView(b.buffer).setUint32(0, n >>> 0, false);
+  return b;
+}
 function buildExporterContext(enclaveId, channelId, epoch) {
   const enc = new TextEncoder();
   return concatBytes(enc.encode(enclaveId), enc.encode(channelId), epochToBytes(epoch));
 }
+function buildVoiceExporterContext(enclaveId, channelId, epoch, callId) {
+  const enc = new TextEncoder();
+  const callIdBytes = enc.encode(callId);
+  return concatBytes(buildExporterContext(enclaveId, channelId, epoch), u32ToBytes(callIdBytes.length), callIdBytes);
+}
 function cipherFor(suite, key, nonce, aad) {
   return suite === "aes256gcm" ? gcm(key, nonce, aad) : xchacha20poly1305(key, nonce, aad);
 }
@@ -1117,8 +1302,13 @@ var ALWAYS_SAMPLE = /* @__PURE__ */ new Set([
 // ../connect-sdk-ts/dist/spans/emitter.js
 var KNOWN = new Set(Object.values(SPAN));
 
+// ../connect-sdk-ts/dist/voice-key.js
+import { hmac } from "@noble/hashes/hmac";
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@agentvault/crypto";
+
 // ../connect-sdk-ts/dist/groupkey/mls.js
-import { MLSGroupManager, bytesToHex, hexToBytes, verifyApprovalArtifact } from "@agentvault/crypto";
+import { MLSGroupManager, bytesToHex as bytesToHex2, hexToBytes, verifyApprovalArtifact } from "@agentvault/crypto";
 
 // ../connect-sdk-ts/dist/groupkey/operation-queue.js
 var MlsOperationQueue = class {
@@ -1498,6 +1688,28 @@ var MlsGroupKeyProvider = class {
     const mgr = await this.manager(channelId);
     return mgr.exportSecret(LABEL, buildExporterContext(enclaveId, channelId, epoch), 32);
   }
+  /**
+   * The 1:1 voice media key: taken STRAIGHT from the MLS exporter under a
+   * DEDICATED label ({@link VOICE_MEDIA_EXPORTER_LABEL}) and a context that
+   * binds `callId` (voice-h2h spec, audit H-P1) — domain-separated from the
+   * message key ({@link exporterKey}) and per-call, with NO HKDF layered on
+   * top. Taken under the per-channel lock (as the receive-side message-key
+   * read is, mls.ts) so the exporter read is epoch-stable against a concurrent
+   * commit. Never transmitted or persisted; both call participants derive it
+   * independently at the invite epoch.
+   *
+   * CONTRACT: unlike {@link exporterKey} (lock-free — its callers wrap it), this
+   * takes the channel lock INTERNALLY. The lock queue is non-reentrant, so this
+   * MUST NOT be called while already holding this channel's lock (doing so
+   * self-deadlocks). Call it stand-alone from the call-setup path, never from
+   * inside another `locks.run(channelId, ...)` for the same channel.
+   */
+  async voiceMediaKey(enclaveId, channelId, epoch, callId) {
+    return this.locks.run(channelId, async () => {
+      const mgr = await this.manager(channelId);
+      return mgr.exportSecret(VOICE_MEDIA_EXPORTER_LABEL, buildVoiceExporterContext(enclaveId, channelId, epoch, callId), 32);
+    });
+  }
   /**
    * Join a channel from the host-committed Welcome, then drain any commits that
    * landed after the Welcome so we converge on the true current epoch. Without
@@ -1626,7 +1838,7 @@ var MlsGroupKeyProvider = class {
       const bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
       if (!bundle)
         return false;
-      const heldHex = bytesToHex(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
+      const heldHex = bytesToHex2(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
       const published = await this.o.backend.fetchKeyPackages([this.o.deviceId]);
       const pubHex = published[this.o.deviceId];
       return !!pubHex && pubHex === heldHex;
@@ -1642,7 +1854,7 @@ var MlsGroupKeyProvider = class {
     console.warn(`publishKeyPackage: minting a fresh KeyPackage (rotation) for device ${this.o.deviceId.slice(0, 8)}`);
     const mgr = new MLSGroupManager();
     const bundle = await mgr.generateKeyPackage(this.o.identity);
-    const hex = bytesToHex(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
+    const hex = bytesToHex2(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
     const id = await this.o.backend.publishKeyPackage(this.o.deviceId, hex);
     await this.o.store.saveLastKpAndBundle(this.o.deviceId, id, bundle);
     return id;
@@ -1682,11 +1894,11 @@ var MlsGroupKeyProvider = class {
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(reinit.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: reinit.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
-        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
       });
       await this.o.store.save(channelId, mgr.exportState());
       this.managers.set(channelId, mgr);
@@ -1709,11 +1921,11 @@ var MlsGroupKeyProvider = class {
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(init.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: init.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
-        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
       });
       this.managers.set(channelId, mgr);
       await this.o.store.save(channelId, mgr.exportState());
@@ -1773,12 +1985,12 @@ var MlsGroupKeyProvider = class {
     try {
       await this.o.backend.distribute(init.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: priorEpoch,
         member_device_ids: members,
         op: "add",
-        welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex(welcome) }] : []
+        welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex2(welcome) }] : []
       });
     } catch (e) {
       this.managers.delete(channelId);
@@ -1836,7 +2048,7 @@ var MlsGroupKeyProvider = class {
     try {
       await this.o.backend.distribute(init.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: priorEpoch,
         member_device_ids: members,
@@ -1904,11 +2116,11 @@ var MlsGroupKeyProvider = class {
     }
     await this.o.store.saveStaging(channelId, mgr.exportState());
     const members = init.member_device_ids ?? [this.o.deviceId];
-    const removedIdentity = typeof opts.identity === "string" ? opts.identity : bytesToHex(opts.identity);
+    const removedIdentity = typeof opts.identity === "string" ? opts.identity : bytesToHex2(opts.identity);
     try {
       await this.o.backend.distribute(init.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: priorEpoch,
         member_device_ids: members,
@@ -2139,11 +2351,11 @@ var MlsGroupKeyProvider = class {
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(reinit.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: reinit.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
-        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
       });
       await this.o.store.save(channelId, mgr.exportState());
       this.managers.set(channelId, mgr);
@@ -3095,11 +3307,11 @@ var RestMlsBackend = class {
 };
 
 // ../connect-sdk-ts/dist/mls/fake-backend.js
-import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2 } from "@agentvault/crypto";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes2 } from "@agentvault/crypto";
 
 // ../connect-sdk-ts/dist/receive/inbox-cipher.js
 import { hkdf } from "@noble/hashes/hkdf";
-import { sha256 as sha2562 } from "@noble/hashes/sha256";
+import { sha256 as sha2563 } from "@noble/hashes/sha256";
 var SUITE = "xchacha20poly1305";
 var INFO = new TextEncoder().encode("agentvault-connect-inbox-v1");
 var EMPTY_AAD = new Uint8Array(0);
@@ -3127,12 +3339,12 @@ var KeyedInboxCipher = class {
 };
 var MLS_STORE_INFO = new TextEncoder().encode("agentvault-connect-mls-store-v1");
 function deriveMlsStoreKey(identityKeyMaterial) {
-  return hkdf(sha2562, identityKeyMaterial, void 0, MLS_STORE_INFO, 32);
+  return hkdf(sha2563, identityKeyMaterial, void 0, MLS_STORE_INFO, 32);
 }
 
 // ../connect-sdk-ts/dist/recovery/backup-crypto.js
 import { hkdf as hkdf2 } from "@noble/hashes/hkdf";
-import { sha256 as sha2563 } from "@noble/hashes/sha256";
+import { sha256 as sha2564 } from "@noble/hashes/sha256";
 import { randomBytes as randomBytes2 } from "@noble/hashes/utils";
 var BACKUP_INFO = new TextEncoder().encode("connect-backup-v1");
 var RECOVERY_INFO = new TextEncoder().encode("connect-recovery-v1");
@@ -3140,15 +3352,15 @@ var RECOVERY_INFO = new TextEncoder().encode("connect-recovery-v1");
 // ../connect-sdk-ts/dist/recovery/guest-recovery-crypto.js
 import { argon2idAsync } from "@noble/hashes/argon2";
 import { hkdf as hkdf3 } from "@noble/hashes/hkdf";
-import { sha256 as sha2564 } from "@noble/hashes/sha256";
+import { sha256 as sha2565 } from "@noble/hashes/sha256";
 var HKDF_INFO = new TextEncoder().encode("connect-guest-recovery-wrap-v1");
 
 // ../connect-mls-store/dist/sqlite-store.js
 import { DatabaseSync } from "node:sqlite";
-import { MLSGroupManager as MLSGroupManager2, bytesToHex as bytesToHex3, hexToBytes as hexToBytes3 } from "@agentvault/crypto";
+import { MLSGroupManager as MLSGroupManager2, bytesToHex as bytesToHex4, hexToBytes as hexToBytes3 } from "@agentvault/crypto";
 
 // ../connect-mls-store/dist/schema.js
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 6;
 function openSchema(db) {
   db.exec("PRAGMA journal_mode=WAL");
   const row = db.prepare("PRAGMA user_version").get();
@@ -3195,6 +3407,51 @@ function openSchema(db) {
       );
     `);
   }
+  if (row.user_version < 5) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS channel_meta (
+        identity_id TEXT NOT NULL,
+        channel_id  TEXT NOT NULL,
+        enclave_id  TEXT,
+        is_dm       INTEGER,
+        updated_at  INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, channel_id)
+      );
+    `);
+  }
+  if (row.user_version < 6) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS agent_memory (
+        identity_id     TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        seq             INTEGER NOT NULL,
+        role            TEXT NOT NULL,
+        peer_id         TEXT,
+        sealed_text     BLOB NOT NULL,
+        modality        TEXT NOT NULL,
+        message_id      TEXT,
+        idempotency_key TEXT,
+        dedup_key       TEXT,
+        recorded_at     INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, conversation_id, seq)
+      );
+    `);
+    db.exec(`
+      CREATE UNIQUE INDEX IF NOT EXISTS agent_memory_dedup
+        ON agent_memory (identity_id, conversation_id, dedup_key)
+        WHERE dedup_key IS NOT NULL;
+    `);
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS agent_memory_fact (
+        identity_id     TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        fact_id         INTEGER NOT NULL,
+        sealed_fact     BLOB NOT NULL,
+        added_at        INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, conversation_id, fact_id)
+      );
+    `);
+  }
   db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
 }
 
@@ -3216,10 +3473,10 @@ var MlsStoreSealError = class extends Error {
 function encodeBundle(bundle) {
   const pp = bundle.privatePackage;
   const obj = {
-    pub: bytesToHex3(MLSGroupManager2.serializeKeyPackage(bundle.publicPackage)),
-    initPriv: bytesToHex3(pp.initPrivateKey),
-    hpkePriv: bytesToHex3(pp.hpkePrivateKey),
-    sigPriv: bytesToHex3(pp.signaturePrivateKey)
+    pub: bytesToHex4(MLSGroupManager2.serializeKeyPackage(bundle.publicPackage)),
+    initPriv: bytesToHex4(pp.initPrivateKey),
+    hpkePriv: bytesToHex4(pp.hpkePrivateKey),
+    sigPriv: bytesToHex4(pp.signaturePrivateKey)
   };
   return new TextEncoder().encode(JSON.stringify(obj));
 }
@@ -3246,9 +3503,11 @@ var SqliteMlsStateStore = class {
   // the source of truth across process restarts.
   bundles = /* @__PURE__ */ new Map();
   lastKpIds = /* @__PURE__ */ new Map();
+  memoryRetentionK;
   constructor(opts) {
     this.id = opts.identityId;
     this.cipher = opts.cipherFor(opts.identityId);
+    this.memoryRetentionK = opts.memoryRetentionK ?? 500;
     try {
       this.db = new DatabaseSync(opts.dbPath);
     } catch (e) {
@@ -3383,6 +3642,74 @@ var SqliteMlsStateStore = class {
     const rows = this.db.prepare("SELECT group_id FROM mls_retired_group WHERE channel_id=?").all(channelId);
     return rows.map((r) => r.group_id);
   }
+  recordChannelEnclave(channelId, enclaveId) {
+    this.db.prepare(`INSERT INTO channel_meta (identity_id, channel_id, enclave_id, updated_at)
+       VALUES (?,?,?,?)
+       ON CONFLICT(identity_id, channel_id) DO UPDATE SET enclave_id=excluded.enclave_id, updated_at=excluded.updated_at`).run(this.id, channelId, enclaveId, Date.now());
+  }
+  recordChannelIsDm(channelId, isDm) {
+    this.db.prepare(`INSERT INTO channel_meta (identity_id, channel_id, is_dm, updated_at)
+       VALUES (?,?,?,?)
+       ON CONFLICT(identity_id, channel_id) DO UPDATE SET is_dm=excluded.is_dm, updated_at=excluded.updated_at`).run(this.id, channelId, isDm ? 1 : 0, Date.now());
+  }
+  getChannelMeta(channelId) {
+    const row = this.db.prepare("SELECT enclave_id, is_dm FROM channel_meta WHERE identity_id=? AND channel_id=?").get(this.id, channelId);
+    if (!row)
+      return void 0;
+    return {
+      enclaveId: row.enclave_id ?? void 0,
+      isDm: row.is_dm == null ? void 0 : row.is_dm === 1
+    };
+  }
+  /**
+   * The set of enclave ids this identity has learned about (from inbound
+   * envelopes or a prior listChannels discovery), beyond its own home
+   * enclave. Task 3: refreshChannelMeta unions this with cfg.enclaveId so a
+   * cross-enclave room's is_dm gets resolved instead of staying UNKNOWN.
+   */
+  distinctEnclaveIds() {
+    const rows = this.db.prepare("SELECT DISTINCT enclave_id FROM channel_meta WHERE identity_id=? AND enclave_id IS NOT NULL").all(this.id);
+    return rows.map((r) => r.enclave_id);
+  }
+  async recordMemory(input) {
+    const dedupKey = input.messageId ?? input.idempotencyKey ?? null;
+    if (!dedupKey)
+      throw new Error("recordMemory requires message_id or idempotency_key");
+    const sealed = await this.cipher.seal(new TextEncoder().encode(input.text));
+    const info = this.db.prepare(`INSERT OR IGNORE INTO agent_memory
+         (identity_id, conversation_id, seq, role, peer_id, sealed_text, modality, message_id, idempotency_key, dedup_key, recorded_at)
+       VALUES (?, ?,
+         (SELECT COALESCE(MAX(seq),0)+1 FROM agent_memory WHERE identity_id=? AND conversation_id=?),
+         ?, ?, ?, ?, ?, ?, ?, ?)`).run(this.id, input.conversationId, this.id, input.conversationId, input.role, input.peerId ?? null, sealed, input.modality, input.messageId ?? null, input.idempotencyKey ?? null, dedupKey, Date.now());
+    if (info.changes === 0) {
+      const row2 = this.db.prepare("SELECT seq FROM agent_memory WHERE identity_id=? AND conversation_id=? AND dedup_key=?").get(this.id, input.conversationId, dedupKey);
+      return { seq: row2.seq, deduped: true };
+    }
+    const row = this.db.prepare("SELECT MAX(seq) AS seq FROM agent_memory WHERE identity_id=? AND conversation_id=?").get(this.id, input.conversationId);
+    if (this.memoryRetentionK > 0) {
+      this.db.prepare("DELETE FROM agent_memory WHERE identity_id=? AND conversation_id=? AND seq <= ?").run(this.id, input.conversationId, row.seq - this.memoryRetentionK);
+    }
+    return { seq: row.seq, deduped: false };
+  }
+  async memoryContext(conversationId, limit = 50) {
+    const rows = this.db.prepare(`SELECT seq, role, peer_id, sealed_text, recorded_at FROM agent_memory
+       WHERE identity_id=? AND conversation_id=? ORDER BY seq DESC LIMIT ?`).all(this.id, conversationId, limit);
+    const recent = [];
+    for (const r of rows.reverse()) {
+      const text = new TextDecoder().decode(await this.cipher.open(r.sealed_text));
+      recent.push({ seq: r.seq, role: r.role, peerId: r.peer_id ?? void 0, text, ts: r.recorded_at });
+    }
+    const factRows = this.db.prepare("SELECT sealed_fact FROM agent_memory_fact WHERE identity_id=? AND conversation_id=? ORDER BY fact_id ASC").all(this.id, conversationId);
+    const facts = [];
+    for (const f of factRows)
+      facts.push(new TextDecoder().decode(await this.cipher.open(f.sealed_fact)));
+    return { recent, facts };
+  }
+  async recordMemoryFact(conversationId, fact) {
+    const sealed = await this.cipher.seal(new TextEncoder().encode(fact));
+    this.db.prepare(`INSERT INTO agent_memory_fact (identity_id, conversation_id, fact_id, sealed_fact, added_at)
+       VALUES (?, ?, (SELECT COALESCE(MAX(fact_id),0)+1 FROM agent_memory_fact WHERE identity_id=? AND conversation_id=?), ?, ?)`).run(this.id, conversationId, this.id, conversationId, sealed, Date.now());
+  }
   /** @internal test-only */
   _rawMainForTest(identityId, channelId) {
     const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(identityId, channelId);
@@ -3395,8 +3722,59 @@ var SqliteMlsStateStore = class {
 
 // src/bridge-agent.ts
 import { decryptFile, encryptFile, computeFileDigest, base64ToBytes as base64ToBytes2, bytesToBase64 as bytesToBase642 } from "@agentvault/crypto";
-import { promises as fsp } from "node:fs";
+
+// src/service/resolve-bin.ts
 import { join as join2, dirname as dirname2 } from "node:path";
+import { createRequire } from "node:module";
+var GlobalInstallPermissionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GlobalInstallPermissionError";
+  }
+};
+function isEphemeralPath(p) {
+  return /[\\/]_npx[\\/]/.test(p);
+}
+function refersToSameFile(a, b, realpath) {
+  if (a === b) return true;
+  try {
+    return realpath(a) === realpath(b);
+  } catch {
+    return false;
+  }
+}
+function resolveStableBinScript(input, deps) {
+  const ephemeral = isEphemeralPath(input.binScript);
+  if (!ephemeral) {
+    if (deps.fileExists(input.binScript)) return input.binScript;
+    throw new Error(`bin path does not exist and is not an npx cache path: ${input.binScript}`);
+  }
+  const pkgRoot = dirname2(dirname2(input.binScript));
+  const inst = deps.run("npm", ["i", "-g", pkgRoot, "--install-links"]);
+  if (inst.status !== 0) {
+    if (/EACCES|permission denied/i.test(inst.stderr)) {
+      throw new GlobalInstallPermissionError(
+        `Can't write the global npm prefix. Run this once, then re-run install:
+  npm i -g ${input.packageName}`
+      );
+    }
+    throw new Error(`npm i -g ${pkgRoot} failed (exit ${inst.status})${inst.stderr ? `: ${inst.stderr.trim()}` : ""}`);
+  }
+  const root = deps.run("npm", ["root", "-g"]);
+  if (root.status !== 0) throw new Error(`npm root -g failed (exit ${root.status})`);
+  const stable = join2(root.stdout.trim(), input.packageName, "dist", "bin.js");
+  if (!deps.fileExists(stable)) throw new Error(`global install did not produce ${stable}`);
+  return stable;
+}
+function loadPackageMeta(importMetaUrl) {
+  const require2 = createRequire(importMetaUrl);
+  const pkg = require2("../package.json");
+  return { name: pkg.name, version: pkg.version };
+}
+
+// src/bridge-agent.ts
+import { promises as fsp } from "node:fs";
+import { join as join7, dirname as dirname3 } from "node:path";
 
 // src/latency.ts
 var DEFAULT_CAPACITY = 1024;
@@ -3670,8 +4048,8 @@ async function prepareAttachment(filePath, caption, channelId, deps) {
 }
 async function materializeAttachment(body, ctx, deps) {
   const ciphertext = await deps.downloadBlob(body.blobId);
-  const sha2565 = deps.computeFileDigest(ciphertext);
-  if (sha2565 !== body.digest) {
+  const sha2566 = deps.computeFileDigest(ciphertext);
+  if (sha2566 !== body.digest) {
     throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
   }
   const plain = deps.decryptFile(
@@ -3684,7 +4062,328 @@ async function materializeAttachment(body, ctx, deps) {
   const path = `${dir}/${ctx.messageId}-${safeName}`;
   await deps.mkdirp(dir);
   await deps.writeFile(path, plain);
-  return { filename: safeName, mime: body.mime, size: plain.length, path, sha256: sha2565 };
+  return { filename: safeName, mime: body.mime, size: plain.length, path, sha256: sha2566 };
+}
+
+// src/memory/hermes-session-map.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join3 } from "node:path";
+function expandHome(p) {
+  return p === "~" || p.startsWith("~/") ? join3(homedir(), p.slice(1)) : p;
+}
+function resolveHermesSession(baseDir, conversationId) {
+  try {
+    const path = join3(expandHome(baseDir), "sessions", "sessions.json");
+    const map = JSON.parse(readFileSync2(path, "utf8"));
+    const entry = map[`agent:main:securecoms:dm:${conversationId}`];
+    const sid = entry?.session_id;
+    return typeof sid === "string" && sid ? sid : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/memory/hermes-store.ts
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { join as join4 } from "node:path";
+var HermesStore = class {
+  dbPath;
+  constructor(baseDir) {
+    this.dbPath = join4(expandHome(baseDir), "state.db");
+  }
+  /** Recent-K conversational turns for a session, chronological. Fail-safe → []. */
+  readRecent(sessionId, limit) {
+    let db;
+    try {
+      db = new DatabaseSync2(this.dbPath, { readOnly: true });
+      const rows = db.prepare(
+        `SELECT id, role, content, timestamp FROM messages
+         WHERE session_id = ? AND active = 1 AND content IS NOT NULL AND role IN ('user','assistant')
+         ORDER BY timestamp DESC LIMIT ?`
+      ).all(sessionId, limit);
+      return rows.reverse().map((r) => ({ id: r.id, role: r.role, content: r.content, timestamp: r.timestamp }));
+    } catch {
+      return [];
+    } finally {
+      db?.close();
+    }
+  }
+  open(busyMs = 5e3) {
+    const db = new DatabaseSync2(this.dbPath);
+    db.exec(`PRAGMA busy_timeout = ${busyMs}`);
+    return db;
+  }
+  /**
+   * Append a voice turn to a session in one synchronous BEGIN IMMEDIATE block
+   * (no await between statements → atomic against Hermes and our own retries).
+   * Guards: skip when the session is absent/archived/ended; in-transaction dedup
+   * on (session_id, platform_message_id). Writes only `messages`. Fail-safe.
+   */
+  writeVoiceTurn(input) {
+    let db;
+    try {
+      db = this.open();
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const s = db.prepare("SELECT archived, ended_at FROM sessions WHERE id = ?").get(input.sessionId);
+        if (!s || s.archived === 1 || s.ended_at != null) {
+          db.exec("ROLLBACK");
+          return "skipped";
+        }
+        if (input.dedupKey) {
+          const dup = db.prepare("SELECT 1 FROM messages WHERE session_id = ? AND platform_message_id = ?").get(input.sessionId, input.dedupKey);
+          if (dup) {
+            db.exec("ROLLBACK");
+            return "deduped";
+          }
+        }
+        db.prepare(
+          `INSERT INTO messages (session_id, role, content, timestamp, active, platform_message_id) VALUES (?, ?, ?, ?, 1, ?)`
+        ).run(input.sessionId, input.role, input.content, input.timestamp, input.dedupKey);
+        db.exec("COMMIT");
+        return "written";
+      } catch (e) {
+        try {
+          db.exec("ROLLBACK");
+        } catch {
+        }
+        throw e;
+      }
+    } catch {
+      return "failed";
+    } finally {
+      db?.close();
+    }
+  }
+  /**
+   * Startup write-capability probe: insert a sentinel against any existing
+   * session inside a rolled-back transaction. Throws if the write path is broken
+   * (e.g. a schema regression). No-op when the db has no sessions.
+   */
+  probeWrite() {
+    let db;
+    try {
+      db = this.open(500);
+      const s = db.prepare("SELECT id FROM sessions LIMIT 1").get();
+      if (!s) return;
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        db.prepare(
+          `INSERT INTO messages (session_id, role, content, timestamp, active, platform_message_id) VALUES (?, 'assistant', '[voice] __probe__', ?, 1, ?)`
+        ).run(s.id, Date.now() / 1e3, `__probe__${Date.now()}`);
+      } finally {
+        db.exec("ROLLBACK");
+      }
+    } finally {
+      db?.close();
+    }
+  }
+};
+
+// src/memory/hermes-provider.ts
+var DEFAULT_K = 30;
+var HermesMemoryProvider = class {
+  constructor(baseDir) {
+    this.baseDir = baseDir;
+    this.store = new HermesStore(baseDir);
+    try {
+      this.store.probeWrite();
+    } catch (e) {
+      process.stderr.write(`[bridge] HERMES MEMORY WRITE-BACK NON-FUNCTIONAL (schema probe failed): ${String(e)}
+`);
+    }
+  }
+  store;
+  noSession = 0;
+  skipped = 0;
+  writeFailed = 0;
+  async record(input) {
+    if (input.modality !== "voice") return { seq: 0, deduped: true };
+    const sessionId = resolveHermesSession(this.baseDir, input.conversationId);
+    if (!sessionId) {
+      this.noSession++;
+      return { seq: 0, deduped: false };
+    }
+    const role = input.role === "peer" ? "user" : "assistant";
+    const res = this.store.writeVoiceTurn({
+      sessionId,
+      role,
+      content: `[voice] ${input.text}`,
+      dedupKey: input.idempotencyKey ?? input.messageId ?? null,
+      timestamp: Date.now() / 1e3
+    });
+    if (res === "failed") this.writeFailed++;
+    else if (res === "skipped") this.skipped++;
+    return { seq: 0, deduped: res === "deduped" };
+  }
+  async context(conversationId, limit) {
+    const sessionId = resolveHermesSession(this.baseDir, conversationId);
+    if (!sessionId) return { recent: [], facts: [] };
+    const turns = this.store.readRecent(sessionId, limit ?? DEFAULT_K);
+    return {
+      recent: turns.map((t) => ({ seq: t.id, role: t.role === "user" ? "peer" : "agent", text: t.content })),
+      facts: []
+    };
+  }
+  stats() {
+    return { hermes_no_session: this.noSession, hermes_skipped: this.skipped, hermes_write_failed: this.writeFailed };
+  }
+};
+
+// src/memory/openclaw-session-map.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { join as join5 } from "node:path";
+function resolveOwnerDmSession(baseDir, agent) {
+  try {
+    const path = join5(expandHome(baseDir), "agents", agent, "sessions", "sessions.json");
+    const map = JSON.parse(readFileSync3(path, "utf8"));
+    let best = null;
+    for (const [key, entry] of Object.entries(map)) {
+      if (!key.includes(":direct:") || !key.endsWith(":owner")) continue;
+      const sid = entry?.sessionId;
+      if (typeof sid !== "string" || !sid) continue;
+      const updatedAt = typeof entry?.updatedAt === "number" ? entry.updatedAt : 0;
+      if (!best || updatedAt > best.updatedAt) best = { sid, updatedAt };
+    }
+    return best?.sid ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// src/memory/openclaw-session-log.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join6 } from "node:path";
+function readRecentTurns(baseDir, agent, sessionId, k) {
+  let raw;
+  try {
+    raw = readFileSync4(join6(expandHome(baseDir), "agents", agent, "sessions", `${sessionId}.jsonl`), "utf8");
+  } catch {
+    return [];
+  }
+  const turns = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    let o;
+    try {
+      o = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (o?.type !== "message" || !o.message) continue;
+    const ts = typeof o.timestamp === "string" ? Date.parse(o.timestamp) : NaN;
+    if (Number.isNaN(ts)) continue;
+    const role = o.message.role;
+    if (role === "user") {
+      const text = typeof o.message.content === "string" ? o.message.content.trim() : "";
+      if (text) turns.push({ role: "peer", text, ts });
+    } else if (role === "assistant") {
+      const blocks = Array.isArray(o.message.content) ? o.message.content : [];
+      const text = blocks.filter((b) => !!b && b.type === "text" && typeof b.text === "string").map((b) => b.text).join("\n").trim();
+      if (text) turns.push({ role: "agent", text, ts });
+    }
+  }
+  return k > 0 ? turns.slice(-k) : [];
+}
+
+// src/memory/openclaw-provider.ts
+var DEFAULT_K2 = 200;
+var OpenClawMemoryProvider = class {
+  constructor(store, baseDir, agent) {
+    this.store = store;
+    this.baseDir = baseDir;
+    this.agent = agent;
+  }
+  noSession = 0;
+  readFailed = 0;
+  async record(input) {
+    if (input.modality !== "voice") return { seq: 0, deduped: true };
+    return this.store.recordMemory({ ...input, text: `[voice] ${input.text}` });
+  }
+  async context(conversationId, limit) {
+    const k = limit ?? DEFAULT_K2;
+    const voice = await this.store.memoryContext(conversationId, k);
+    let textTurns = [];
+    try {
+      const sid = resolveOwnerDmSession(this.baseDir, this.agent);
+      if (!sid) {
+        this.noSession++;
+        return voice;
+      }
+      textTurns = readRecentTurns(this.baseDir, this.agent, sid, k).map((t) => ({
+        seq: 0,
+        role: t.role,
+        text: t.text,
+        ts: t.ts
+      }));
+    } catch {
+      this.readFailed++;
+      return voice;
+    }
+    const tagged = [
+      ...textTurns.map((t, i) => ({ ...t, _src: 0, _i: i })),
+      ...voice.recent.map((t, i) => ({ ...t, _src: 1, _i: i }))
+    ];
+    tagged.sort((a, b) => {
+      const at = a.ts ?? 0, bt = b.ts ?? 0;
+      if (at !== bt) return at - bt;
+      if (a._src !== b._src) return a._src - b._src;
+      return a._i - b._i;
+    });
+    const recent = (k > 0 ? tagged.slice(-k) : []).map((t, i) => ({
+      seq: i + 1,
+      role: t.role,
+      peerId: t.peerId,
+      text: t.text,
+      ts: t.ts
+    }));
+    return { recent, facts: voice.facts };
+  }
+  stats() {
+    return { openclaw_no_session: this.noSession, openclaw_read_failed: this.readFailed };
+  }
+};
+
+// src/memory/provider.ts
+var SecureComsLocalMemory = class {
+  constructor(store) {
+    this.store = store;
+  }
+  record(input) {
+    return this.store.recordMemory(input);
+  }
+  context(conversationId, limit) {
+    return this.store.memoryContext(conversationId, limit);
+  }
+};
+var NullMemory = class {
+  async record() {
+    return { seq: 0, deduped: false };
+  }
+  async context() {
+    return { recent: [], facts: [] };
+  }
+};
+function createMemoryProvider(provider, store, baseDir, agent) {
+  if (provider === "none") return new NullMemory();
+  if (provider === "hermes") return new HermesMemoryProvider(baseDir ?? "~/.hermes");
+  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "");
+  return new SecureComsLocalMemory(store);
+}
+
+// src/memory-taps.ts
+async function recordInboundMemory(sink, channelId, senderId, text, messageId) {
+  try {
+    await sink.record({ conversationId: channelId, role: "peer", peerId: senderId, text, modality: "text", messageId });
+  } catch {
+  }
+}
+async function recordOutboundMemory(sink, channelId, text, messageId) {
+  try {
+    await sink.record({ conversationId: channelId, role: "agent", text, modality: "text", messageId });
+  } catch {
+  }
 }
 
 // src/bridge-agent.ts
@@ -3729,7 +4428,13 @@ var UnknownActionRunError = class extends Error {
     this.name = "UnknownActionRunError";
   }
 };
-var BRIDGE_VERSION = "0.0.0";
+var BRIDGE_VERSION = (() => {
+  try {
+    return loadPackageMeta(import.meta.url).version;
+  } catch {
+    return "0.0.0";
+  }
+})();
 function hexToBytes4(h) {
   return new Uint8Array(Buffer.from(h, "hex"));
 }
@@ -3755,6 +4460,7 @@ var BridgeAgent = class _BridgeAgent {
       identityId: cfg.identityId,
       cipherFor: () => new KeyedInboxCipher(deriveMlsStoreKey(seed))
     });
+    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent);
     this.provider = new MlsGroupKeyProvider({
       store: this.store,
       backend: this.backend,
@@ -3834,7 +4540,7 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join2(dirname2(cfg.storePath), "attachments");
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join7(dirname3(cfg.storePath), "attachments");
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -4006,6 +4712,13 @@ var BridgeAgent = class _BridgeAgent {
   listeners = /* @__PURE__ */ new Set();
   startedAt = 0;
   store;
+  memory;
+  /** Task 2: warn-once-per-channel guard for the enclave-map fallback (below). */
+  enclaveFallbackWarned = /* @__PURE__ */ new Set();
+  /** Task 2: dedupe guard so ingestOnce writes a channel's enclave at most once
+   *  per process — a channel's enclave is immutable, so no need to UPSERT on
+   *  every message on the hot receive path (audit M2). */
+  channelEnclaveRecorded = /* @__PURE__ */ new Set();
   latency;
   /** Track 5: injectable blob download fn (default: fetch-based). */
   downloadBlobImpl;
@@ -4045,6 +4758,26 @@ var BridgeAgent = class _BridgeAgent {
   sweepJitter() {
     return Math.floor(this.rng() * _BridgeAgent.SELF_HEAL_SWEEP_JITTER_MS);
   }
+  /**
+   * Task 2 (multi-enclave core fix): resolve the enclave to stamp on outbound
+   * traffic for `channelId`. The daemon previously stamped `cfg.enclaveId`
+   * (its "home" enclave) on EVERY channel, so an agent admitted to a second
+   * enclave got a backend 400 on every send/reply there. The channel→enclave
+   * map (`channel_meta`, Task 1) is fed by inbound envelopes (`ingestOnce`)
+   * and by `listChannels`; a channel not yet in the map (never seen inbound,
+   * never discovered) falls back to home and logs once so the fallback is
+   * diagnosable (audit H3) rather than silently wrong.
+   */
+  resolveEnclave(channelId) {
+    const mapped = this.store.getChannelMeta(channelId)?.enclaveId;
+    if (mapped) return mapped;
+    if (!this.enclaveFallbackWarned.has(channelId)) {
+      this.enclaveFallbackWarned.add(channelId);
+      process.stderr.write(`[bridge] send.enclave_fallback channel=${channelId} stamped=home
+`);
+    }
+    return this.cfg.enclaveId;
+  }
   async reconcileJoin(channelId) {
     if (this.joinState.get(channelId) === "JOINED") return true;
     try {
@@ -4258,7 +4991,7 @@ var BridgeAgent = class _BridgeAgent {
           groupKey: this.provider,
           messageId: id,
           channelId,
-          enclaveId: this.cfg.enclaveId,
+          enclaveId: this.resolveEnclave(channelId),
           senderId: this.cfg.identityId,
           senderType: "agent",
           type: "text",
@@ -4276,6 +5009,7 @@ var BridgeAgent = class _BridgeAgent {
       (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
     );
     this.latency.record("send.total", performance.now() - sendStart);
+    void recordOutboundMemory(this.memory, channelId, text, id);
     return { message_id: id, status: "sent" };
   }
   async sendA2A(channelId, a2a, messageId) {
@@ -4294,7 +5028,7 @@ var BridgeAgent = class _BridgeAgent {
           groupKey: this.provider,
           messageId: id,
           channelId,
-          enclaveId: this.cfg.enclaveId,
+          enclaveId: this.resolveEnclave(channelId),
           senderId: this.cfg.identityId,
           senderType: "agent",
           type: "a2a",
@@ -4347,7 +5081,7 @@ var BridgeAgent = class _BridgeAgent {
           groupKey: this.provider,
           messageId: id,
           channelId,
-          enclaveId: this.cfg.enclaveId,
+          enclaveId: this.resolveEnclave(channelId),
           senderId: this.cfg.identityId,
           senderType: "agent",
           type: "artifact_share",
@@ -4367,42 +5101,91 @@ var BridgeAgent = class _BridgeAgent {
     this.latency.record("send.total", performance.now() - sendStart);
     return { message_id: id, status: "sent" };
   }
-  async listChannels() {
-    const url = `${this.cfg.apiBase}/api/v1/enclaves/${this.cfg.enclaveId}/channels?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+  /** Task 3: delegates to the configured MemoryProvider (SecureComsLocal | Null). */
+  async recordMemory(input) {
+    return this.memory.record(input);
+  }
+  async memoryContext(conversationId, limit) {
+    return this.memory.context(conversationId, limit);
+  }
+  /**
+   * List channels in one enclave (default: the daemon's own home enclave).
+   * Task 3: called per-*known* enclave by refreshChannelMeta so a
+   * cross-enclave room's is_dm gets resolved — see the scope caveat there
+   * (same-tenant only; a cross-tenant enclave 404s under the agent's bearer).
+   */
+  async listChannels(enclaveId = this.cfg.enclaveId) {
+    const url = `${this.cfg.apiBase}/api/v1/enclaves/${enclaveId}/channels?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
     const res = await this.fetchImpl(url, {
       headers: { authorization: `Bearer ${this.cfg.apiKey}` }
     });
     if (!res.ok) throw new Error(`list_channels failed: ${res.status}`);
     const rows = await res.json();
+    for (const r of rows) this.store.recordChannelEnclave(r.channel_id, r.enclave_id);
     return rows.map((r) => ({
       channel_id: r.channel_id,
       name: r.name ?? null,
       is_dm: r.is_dm,
-      joined: true
+      joined: true,
+      enclave_id: r.enclave_id
     }));
   }
-  /** A live channelMeta entry, or undefined if missing OR expired past the TTL. */
+  /**
+   * A live channelMeta entry, or undefined if missing OR expired past the
+   * TTL. A never-cached-this-process channel (no in-memory entry at all —
+   * cold start, or every listChannels() call in refreshChannelMeta failed,
+   * e.g. network down) falls back to the store's persisted is_dm (Task 3) so
+   * a cross-enclave room stays classified across a restart instead of
+   * reverting to UNKNOWN/fail-open. The store has no TTL (is_dm is immutable
+   * per channel); `name` is not persisted so it comes back undefined on this
+   * path and re-resolves once a listChannels() call succeeds.
+   *
+   * A TTL-*expired* in-memory entry deliberately does NOT use the store
+   * fallback and is still treated as a miss — that miss is what drives
+   * ingestOnce to retry a refresh each cycle (S-2: keeping `name` fresh after
+   * a rename); serving the persisted is_dm there would silently suppress
+   * that retry forever.
+   */
   freshMeta(channelId) {
     const hit = this.channelMeta.get(channelId);
-    if (!hit) return void 0;
-    if (Date.now() - hit.at >= CHANNEL_META_TTL_MS) return void 0;
-    return { is_dm: hit.is_dm, name: hit.name };
+    if (hit) {
+      if (Date.now() - hit.at < CHANNEL_META_TTL_MS) return { is_dm: hit.is_dm, name: hit.name };
+      return void 0;
+    }
+    const persisted = this.store.getChannelMeta(channelId);
+    if (persisted?.isDm !== void 0) {
+      return { is_dm: persisted.isDm, name: void 0 };
+    }
+    return void 0;
   }
   /**
-   * One-shot, whole-listing refresh of channelMeta. Called AT MOST ONCE per
-   * ingest cycle (the caller guards with a cycle-local "refreshed" flag), so a
-   * burst of K unknown channels fires a single listChannels() instead of K. Any
-   * listChannels failure is swallowed (UNKNOWN → fail open) so ingest never
-   * blocks on the network.
+   * Whole-listing refresh of channelMeta, one listChannels() call per *known*
+   * enclave — the daemon's own home enclave plus every enclave it has learned
+   * about from inbound envelopes or a prior discovery (store.distinctEnclaveIds()).
+   * Called AT MOST ONCE per ingest cycle (the caller guards with a
+   * cycle-local "refreshed" flag). Task 3 (M1): without this, a cross-enclave
+   * room is never listed under the home-enclave-only call, so its is_dm never
+   * resolves and the @mention filter fails open for that room.
+   *
+   * Each enclave is wrapped in its own try/catch (scope caveat — audit
+   * H2/tenant): list_channels_in_enclave filters on tenant_id, so a
+   * same-tenant enclave the agent has learned about resolves fine, but a
+   * cross-TENANT federated-partner enclave 404s under this agent's bearer;
+   * that enclave's channels are left unresolved (fail open) without aborting
+   * the other enclaves in the set.
    */
   async refreshChannelMeta() {
-    try {
-      const now = Date.now();
-      const channels = await this.listChannels();
-      for (const c of channels) {
-        this.channelMeta.set(c.channel_id, { is_dm: c.is_dm, name: c.name, at: now });
+    const enclaves = /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.store.distinctEnclaveIds()]);
+    const now = Date.now();
+    for (const encId of enclaves) {
+      try {
+        const channels = await this.listChannels(encId);
+        for (const c of channels) {
+          this.channelMeta.set(c.channel_id, { is_dm: c.is_dm, name: c.name, at: now });
+          this.store.recordChannelIsDm(c.channel_id, c.is_dm);
+        }
+      } catch {
       }
-    } catch {
     }
   }
   /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
@@ -4508,6 +5291,8 @@ var BridgeAgent = class _BridgeAgent {
   async reportStatus(channelId, state, detail) {
     const joined = await this.reconcileJoin(channelId);
     if (!joined) throw new ChannelPendingError(channelId);
+    const enc = this.store.getChannelMeta(channelId)?.enclaveId;
+    if (!enc) return;
     await sendWithSelfHeal(
       this.provider,
       channelId,
@@ -4516,7 +5301,7 @@ var BridgeAgent = class _BridgeAgent {
         groupKey: this.provider,
         messageId: crypto.randomUUID(),
         channelId,
-        enclaveId: this.cfg.enclaveId,
+        enclaveId: enc,
         senderId: this.cfg.identityId,
         senderType: "agent",
         type: "system_event",
@@ -4563,7 +5348,7 @@ var BridgeAgent = class _BridgeAgent {
         groupKey: this.provider,
         messageId: crypto.randomUUID(),
         channelId,
-        enclaveId: this.cfg.enclaveId,
+        enclaveId: this.resolveEnclave(channelId),
         senderId: this.cfg.identityId,
         senderType: "agent",
         type: "system_event",
@@ -4807,6 +5592,11 @@ var BridgeAgent = class _BridgeAgent {
     const acked = [];
     for (const m of entries) {
       try {
+        const encId = m.envelope.enclave_id;
+        if (encId && !this.channelEnclaveRecorded.has(m.channelId)) {
+          this.channelEnclaveRecorded.add(m.channelId);
+          this.store.recordChannelEnclave(m.channelId, encId);
+        }
         const parsed = JSON.parse(
           new TextDecoder().decode(m.plaintext)
         );
@@ -4878,6 +5668,7 @@ var BridgeAgent = class _BridgeAgent {
               sender_is_agent: senderIsAgent
             });
             this.capBuffer();
+            void recordInboundMemory(this.memory, m.channelId, m.envelope.sender_id, parsed.text, m.messageId);
           }
         }
         acked.push(m.queueId);
@@ -4974,7 +5765,8 @@ var BridgeAgent = class _BridgeAgent {
       failed_attachments: this.failedAttachments,
       delivery_pings: this.pingsReceived,
       uptime_s: this.startedAt ? Math.floor((Date.now() - this.startedAt) / 1e3) : 0,
-      version: BRIDGE_VERSION
+      version: BRIDGE_VERSION,
+      ...this.memory.stats?.() ?? {}
     };
   }
   /**
@@ -5030,11 +5822,11 @@ var BridgeAgent = class _BridgeAgent {
 
 // src/auth.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync5, writeFileSync } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync(f)) return readFileSync2(f, "utf8").trim();
+  if (f && existsSync(f)) return readFileSync5(f, "utf8").trim();
   const tok = randomBytes3(32).toString("base64url");
   if (f) writeFileSync(f, tok, { mode: 384 });
   return tok;
@@ -5149,6 +5941,17 @@ var statusSchema = z.object({
   state: z.enum(["idle", "working", "stalled", "error"]),
   detail: z.string().optional()
 });
+var memoryRecordSchema = z.object({
+  conversation_id: z.string().min(1),
+  role: z.enum(["peer", "agent"]),
+  peer_id: z.string().optional(),
+  text: z.string(),
+  modality: z.enum(["text", "voice"]),
+  message_id: z.string().optional(),
+  idempotency_key: z.string().optional()
+}).refine((d) => Boolean(d.message_id || d.idempotency_key), {
+  message: "memory record requires message_id or idempotency_key"
+});
 function json(res, status, body) {
   const s = JSON.stringify(body);
   res.writeHead(status, { "content-type": "application/json" });
@@ -5242,6 +6045,26 @@ function createHttpServer(agent, opts) {
         await agent.reportStatus(parsed.data.channel_id, parsed.data.state, parsed.data.detail);
         return json(res, 200, { ok: true });
       }
+      if (method === "POST" && path === "/v1/memory/record") {
+        const parsed = memoryRecordSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
+        if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
+        const r = await agent.recordMemory({
+          conversationId: parsed.data.conversation_id,
+          role: parsed.data.role,
+          peerId: parsed.data.peer_id,
+          text: parsed.data.text,
+          modality: parsed.data.modality,
+          messageId: parsed.data.message_id,
+          idempotencyKey: parsed.data.idempotency_key
+        });
+        return json(res, 200, r);
+      }
+      if (method === "GET" && path === "/v1/memory/context") {
+        const conv = url.searchParams.get("conversation_id");
+        if (!conv) return jsonError(res, "invalid_request", "conversation_id required");
+        const limit = Math.max(1, Math.min(200, Number(url.searchParams.get("limit") ?? 50)));
+        return json(res, 200, await agent.memoryContext(conv, limit));
+      }
       if (method === "GET" && path === "/v1/messages") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
         const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
@@ -5572,14 +6395,14 @@ async function handleInbound(sock, agent, data, inflight) {
 }
 
 // src/bin.ts
-import { readFileSync as readFileSync3, mkdirSync, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync2, realpathSync } from "node:fs";
-import { join as join4, dirname as dirname5 } from "node:path";
+import { readFileSync as readFileSync6, mkdirSync, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync2, realpathSync } from "node:fs";
+import { join as join8, dirname as dirname5 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { homedir, userInfo } from "node:os";
+import { homedir as homedir2, userInfo } from "node:os";
 import { spawnSync } from "node:child_process";
 
 // src/service/install.ts
-import { dirname as dirname3 } from "node:path";
+import { dirname as dirname4 } from "node:path";
 
 // src/service/config.ts
 import { basename as basename2, extname, isAbsolute, resolve } from "node:path";
@@ -5663,7 +6486,7 @@ WantedBy=default.target
 var ServiceUnsupportedError = class extends Error {
 };
 function tokenHint(input) {
-  return `${dirname3(input.credentialPath)}/bridge-token`;
+  return `${dirname4(input.credentialPath)}/bridge-token`;
 }
 function requireOk(r, what) {
   if (r.status !== 0) throw new Error(`${what} failed (exit ${r.status})${r.stderr ? `: ${r.stderr.trim()}` : ""}`);
@@ -5671,8 +6494,8 @@ function requireOk(r, what) {
 function installService(input, deps) {
   const cfg = deriveServiceConfig(input);
   if (deps.platform === "darwin") {
-    deps.mkdirp(dirname3(cfg.plistPath));
-    deps.mkdirp(dirname3(cfg.logPath));
+    deps.mkdirp(dirname4(cfg.plistPath));
+    deps.mkdirp(dirname4(cfg.logPath));
     deps.writeFile(cfg.plistPath, renderLaunchdPlist(cfg));
     deps.run("launchctl", ["bootout", `gui/${cfg.uid}/${cfg.label}`]);
     requireOk(deps.run("launchctl", ["bootstrap", `gui/${cfg.uid}`, cfg.plistPath]), "launchctl bootstrap");
@@ -5681,7 +6504,7 @@ function installService(input, deps) {
     return { label: cfg.label, filePath: cfg.plistPath, logHint: cfg.logPath, tokenHint: tokenHint(input) };
   }
   if (deps.platform === "linux") {
-    deps.mkdirp(dirname3(cfg.unitPath));
+    deps.mkdirp(dirname4(cfg.unitPath));
     deps.writeFile(cfg.unitPath, renderSystemdUnit(cfg));
     deps.run("systemctl", ["--user", "daemon-reload"]);
     deps.run("loginctl", ["enable-linger", deps.user]);
@@ -5708,55 +6531,6 @@ function uninstallService(input, deps) {
   throw new ServiceUnsupportedError(`Service uninstall isn't supported on ${deps.platform} yet.`);
 }
 
-// src/service/resolve-bin.ts
-import { join as join3, dirname as dirname4 } from "node:path";
-import { createRequire } from "node:module";
-var GlobalInstallPermissionError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GlobalInstallPermissionError";
-  }
-};
-function isEphemeralPath(p) {
-  return /[\\/]_npx[\\/]/.test(p);
-}
-function refersToSameFile(a, b, realpath) {
-  if (a === b) return true;
-  try {
-    return realpath(a) === realpath(b);
-  } catch {
-    return false;
-  }
-}
-function resolveStableBinScript(input, deps) {
-  const ephemeral = isEphemeralPath(input.binScript);
-  if (!ephemeral) {
-    if (deps.fileExists(input.binScript)) return input.binScript;
-    throw new Error(`bin path does not exist and is not an npx cache path: ${input.binScript}`);
-  }
-  const pkgRoot = dirname4(dirname4(input.binScript));
-  const inst = deps.run("npm", ["i", "-g", pkgRoot, "--install-links"]);
-  if (inst.status !== 0) {
-    if (/EACCES|permission denied/i.test(inst.stderr)) {
-      throw new GlobalInstallPermissionError(
-        `Can't write the global npm prefix. Run this once, then re-run install:
-  npm i -g ${input.packageName}`
-      );
-    }
-    throw new Error(`npm i -g ${pkgRoot} failed (exit ${inst.status})${inst.stderr ? `: ${inst.stderr.trim()}` : ""}`);
-  }
-  const root = deps.run("npm", ["root", "-g"]);
-  if (root.status !== 0) throw new Error(`npm root -g failed (exit ${root.status})`);
-  const stable = join3(root.stdout.trim(), input.packageName, "dist", "bin.js");
-  if (!deps.fileExists(stable)) throw new Error(`global install did not produce ${stable}`);
-  return stable;
-}
-function loadPackageMeta(importMetaUrl) {
-  const require2 = createRequire(importMetaUrl);
-  const pkg = require2("../package.json");
-  return { name: pkg.name, version: pkg.version };
-}
-
 // src/bin.ts
 function nodeMajorOk(version) {
   return Number(version.split(".")[0]) >= 24;
@@ -5818,7 +6592,7 @@ function runServiceVerb(verb) {
     label,
     execPath: process.execPath,
     binScript,
-    home: homedir(),
+    home: homedir2(),
     uid: userInfo().uid
   };
   try {
@@ -5870,11 +6644,11 @@ async function main() {
 `);
     process.exit(1);
   }
-  const tokenFile = daemon.tokenFile ?? join4(dirname5(credentialPath), "bridge-token");
+  const tokenFile = daemon.tokenFile ?? join8(dirname5(credentialPath), "bridge-token");
   const token = resolveToken({ tokenFile, token: daemon.token });
   const agent = new BridgeAgent(cfg);
   await agent.start();
-  const tls = daemon.tls ? { cert: readFileSync3(daemon.tlsCert, "utf8"), key: readFileSync3(daemon.tlsKey, "utf8") } : void 0;
+  const tls = daemon.tls ? { cert: readFileSync6(daemon.tlsCert, "utf8"), key: readFileSync6(daemon.tlsKey, "utf8") } : void 0;
   const { server, closeAllSseStreams } = createHttpServer(agent, { token, allowOrigins: daemon.allowOrigins, tls, websocket: true });
   const agentWs = attachAgentWebSocket(server, agent, { token, allowOrigins: daemon.allowOrigins });
   let down = false;