@securecoms/agent-bridge 0.3.2 → 0.5.0

package/dist/bin.js

@@ -23,6 +23,26 @@ function loadConfig(opts) {
   const agentName = typeof json2.agent_name === "string" && json2.agent_name ? json2.agent_name : typeof json2.display_name === "string" && json2.display_name ? json2.display_name : void 0;
   const rateLimitCapacity = typeof json2.rate_limit_capacity === "number" ? json2.rate_limit_capacity : 20;
   const rateLimitRefillPerMinute = typeof json2.rate_limit_refill_per_minute === "number" ? json2.rate_limit_refill_per_minute : 20;
+  const memProvRaw = json2.memory?.provider;
+  let memoryProvider;
+  let memoryBaseDir;
+  let memoryAgent;
+  if (memProvRaw === "none") {
+    memoryProvider = "none";
+  } else if (memProvRaw === "hermes") {
+    memoryProvider = "hermes";
+    const bd = json2.memory?.base_dir;
+    memoryBaseDir = typeof bd === "string" && bd ? bd : "~/.hermes";
+  } else if (memProvRaw === "openclaw") {
+    memoryProvider = "openclaw";
+    const oc = json2.memory?.openclaw;
+    const bd = oc?.base_dir;
+    memoryBaseDir = typeof bd === "string" && bd ? bd : "~/.openclaw";
+    const ag = oc?.agent;
+    memoryAgent = typeof ag === "string" && ag ? ag : void 0;
+  } else {
+    memoryProvider = "securecoms";
+  }
   return {
     apiKey: json2.api_key,
     identityId: json2.identity_id,
@@ -33,7 +53,10 @@ function loadConfig(opts) {
     storePath,
     agentName,
     rateLimitCapacity,
-    rateLimitRefillPerMinute
+    rateLimitRefillPerMinute,
+    memoryProvider,
+    memoryBaseDir,
+    memoryAgent
   };
 }
 function arg(argv, flag) {
@@ -640,6 +663,152 @@ var payloadsSchema = {
           }
         }
       ]
+    },
+    "call_control": {
+      "description": 'The call_control signaling body for 1:1 voice calls (docs/superpowers/specs/2026-07-12-voice-human-to-human-calling-design.md). NOT a message_type \u2014 it rides envelope message_type "system_event"; the "kind":"call_control" field is a body-level discriminator and "event" selects the variant. Compiled standalone via validate.ts validateCallControlBody. SERVER-BLIND KEY CONTRACT: NO variant ever carries media key material (the media key is derived independently from the MLS exporter, never transmitted). Every variant sets additionalProperties:false so a stray media_key/key/secret is rejected \u2014 the only key-adjacent field is `key_confirmation` on accept, which is HMAC(media_key, call_id), not the key itself.',
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id",
+            "room",
+            "caller_identity_id",
+            "epoch",
+            "ts"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "invite"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "room": {
+              "type": "string",
+              "minLength": 1
+            },
+            "caller_identity_id": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "epoch": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "ts": {
+              "type": "number"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id",
+            "accepting_device_id",
+            "key_confirmation"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "accept"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "accepting_device_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "key_confirmation": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "decline"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "reason": {
+              "type": "string",
+              "enum": [
+                "busy",
+                "declined"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "cancel"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "event",
+            "call_id"
+          ],
+          "properties": {
+            "kind": {
+              "const": "call_control"
+            },
+            "event": {
+              "const": "end"
+            },
+            "call_id": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        }
+      ]
     }
   }
 };
@@ -664,6 +833,11 @@ if (!agentActionDef) {
   throw new Error(`payloads.schema.json is missing the "agent_action" $defs schema`);
 }
 var agentActionValidator = ajv.compile(agentActionDef);
+var callControlDef = payloadDefs["call_control"];
+if (!callControlDef) {
+  throw new Error(`payloads.schema.json is missing the "call_control" $defs schema`);
+}
+var callControlValidator = ajv.compile(callControlDef);
 
 // ../connect-core/dist/envelope/sign.js
 import { canonicalize } from "@agentvault/crypto/canonical";
@@ -725,6 +899,7 @@ import { gcm } from "@noble/ciphers/aes";
 import { xchacha20poly1305 } from "@noble/ciphers/chacha";
 import { randomBytes } from "@noble/hashes/utils";
 import { canonicalize as canonicalize2 } from "@agentvault/crypto/canonical";
+var VOICE_MEDIA_EXPORTER_LABEL = "securecoms-voice-media-v1";
 var APPLICATION_KEY_BYTES = 32;
 var REPLAY_NONCE_BYTES = 24;
 var NONCE_BYTES = {
@@ -746,10 +921,20 @@ function epochToBytes(epoch) {
   new DataView(b.buffer).setBigUint64(0, BigInt(epoch), false);
   return b;
 }
+function u32ToBytes(n) {
+  const b = new Uint8Array(4);
+  new DataView(b.buffer).setUint32(0, n >>> 0, false);
+  return b;
+}
 function buildExporterContext(enclaveId, channelId, epoch) {
   const enc = new TextEncoder();
   return concatBytes(enc.encode(enclaveId), enc.encode(channelId), epochToBytes(epoch));
 }
+function buildVoiceExporterContext(enclaveId, channelId, epoch, callId) {
+  const enc = new TextEncoder();
+  const callIdBytes = enc.encode(callId);
+  return concatBytes(buildExporterContext(enclaveId, channelId, epoch), u32ToBytes(callIdBytes.length), callIdBytes);
+}
 function cipherFor(suite, key, nonce, aad) {
   return suite === "aes256gcm" ? gcm(key, nonce, aad) : xchacha20poly1305(key, nonce, aad);
 }
@@ -1117,8 +1302,13 @@ var ALWAYS_SAMPLE = /* @__PURE__ */ new Set([
 // ../connect-sdk-ts/dist/spans/emitter.js
 var KNOWN = new Set(Object.values(SPAN));
 
+// ../connect-sdk-ts/dist/voice-key.js
+import { hmac } from "@noble/hashes/hmac";
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@agentvault/crypto";
+
 // ../connect-sdk-ts/dist/groupkey/mls.js
-import { MLSGroupManager, bytesToHex, hexToBytes, verifyApprovalArtifact } from "@agentvault/crypto";
+import { MLSGroupManager, bytesToHex as bytesToHex2, hexToBytes, verifyApprovalArtifact } from "@agentvault/crypto";
 
 // ../connect-sdk-ts/dist/groupkey/operation-queue.js
 var MlsOperationQueue = class {
@@ -1498,6 +1688,28 @@ var MlsGroupKeyProvider = class {
     const mgr = await this.manager(channelId);
     return mgr.exportSecret(LABEL, buildExporterContext(enclaveId, channelId, epoch), 32);
   }
+  /**
+   * The 1:1 voice media key: taken STRAIGHT from the MLS exporter under a
+   * DEDICATED label ({@link VOICE_MEDIA_EXPORTER_LABEL}) and a context that
+   * binds `callId` (voice-h2h spec, audit H-P1) — domain-separated from the
+   * message key ({@link exporterKey}) and per-call, with NO HKDF layered on
+   * top. Taken under the per-channel lock (as the receive-side message-key
+   * read is, mls.ts) so the exporter read is epoch-stable against a concurrent
+   * commit. Never transmitted or persisted; both call participants derive it
+   * independently at the invite epoch.
+   *
+   * CONTRACT: unlike {@link exporterKey} (lock-free — its callers wrap it), this
+   * takes the channel lock INTERNALLY. The lock queue is non-reentrant, so this
+   * MUST NOT be called while already holding this channel's lock (doing so
+   * self-deadlocks). Call it stand-alone from the call-setup path, never from
+   * inside another `locks.run(channelId, ...)` for the same channel.
+   */
+  async voiceMediaKey(enclaveId, channelId, epoch, callId) {
+    return this.locks.run(channelId, async () => {
+      const mgr = await this.manager(channelId);
+      return mgr.exportSecret(VOICE_MEDIA_EXPORTER_LABEL, buildVoiceExporterContext(enclaveId, channelId, epoch, callId), 32);
+    });
+  }
   /**
    * Join a channel from the host-committed Welcome, then drain any commits that
    * landed after the Welcome so we converge on the true current epoch. Without
@@ -1626,7 +1838,7 @@ var MlsGroupKeyProvider = class {
       const bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
       if (!bundle)
         return false;
-      const heldHex = bytesToHex(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
+      const heldHex = bytesToHex2(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
       const published = await this.o.backend.fetchKeyPackages([this.o.deviceId]);
       const pubHex = published[this.o.deviceId];
       return !!pubHex && pubHex === heldHex;
@@ -1642,7 +1854,7 @@ var MlsGroupKeyProvider = class {
     console.warn(`publishKeyPackage: minting a fresh KeyPackage (rotation) for device ${this.o.deviceId.slice(0, 8)}`);
     const mgr = new MLSGroupManager();
     const bundle = await mgr.generateKeyPackage(this.o.identity);
-    const hex = bytesToHex(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
+    const hex = bytesToHex2(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
     const id = await this.o.backend.publishKeyPackage(this.o.deviceId, hex);
     await this.o.store.saveLastKpAndBundle(this.o.deviceId, id, bundle);
     return id;
@@ -1682,11 +1894,11 @@ var MlsGroupKeyProvider = class {
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(reinit.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: reinit.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
-        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
       });
       await this.o.store.save(channelId, mgr.exportState());
       this.managers.set(channelId, mgr);
@@ -1709,11 +1921,11 @@ var MlsGroupKeyProvider = class {
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(init.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: init.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
-        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
       });
       this.managers.set(channelId, mgr);
       await this.o.store.save(channelId, mgr.exportState());
@@ -1773,12 +1985,12 @@ var MlsGroupKeyProvider = class {
     try {
       await this.o.backend.distribute(init.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: priorEpoch,
         member_device_ids: members,
         op: "add",
-        welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex(welcome) }] : []
+        welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex2(welcome) }] : []
       });
     } catch (e) {
       this.managers.delete(channelId);
@@ -1836,7 +2048,7 @@ var MlsGroupKeyProvider = class {
     try {
       await this.o.backend.distribute(init.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: priorEpoch,
         member_device_ids: members,
@@ -1904,11 +2116,11 @@ var MlsGroupKeyProvider = class {
     }
     await this.o.store.saveStaging(channelId, mgr.exportState());
     const members = init.member_device_ids ?? [this.o.deviceId];
-    const removedIdentity = typeof opts.identity === "string" ? opts.identity : bytesToHex(opts.identity);
+    const removedIdentity = typeof opts.identity === "string" ? opts.identity : bytesToHex2(opts.identity);
     try {
       await this.o.backend.distribute(init.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: priorEpoch,
         member_device_ids: members,
@@ -2139,11 +2351,11 @@ var MlsGroupKeyProvider = class {
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(reinit.group_id, {
         device_id: this.o.deviceId,
-        commit: bytesToHex(commit),
+        commit: bytesToHex2(commit),
         commit_epoch: Number(mgr.epoch),
         expected_epoch: reinit.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
-        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex2(welcome) })) : []
       });
       await this.o.store.save(channelId, mgr.exportState());
       this.managers.set(channelId, mgr);
@@ -2513,6 +2725,15 @@ function parseServerFrame(frame) {
 }
 
 // ../connect-sdk-ts/dist/transport/ws-pings.js
+function base64UrlNoPad(s) {
+  const bytes = new TextEncoder().encode(s);
+  let bin = "";
+  for (const b of bytes)
+    bin += String.fromCharCode(b);
+  const b64 = typeof btoa === "function" ? btoa(bin) : Buffer.from(bytes).toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var BEARER_SUBPROTOCOL = "securecoms.bearer.v1";
 function openDeliveryPings(o) {
   const base = o.backoffBaseMs ?? 500;
   const cap = o.backoffCapMs ?? 8e3;
@@ -2661,8 +2882,7 @@ function openDeliveryPings(o) {
     }
     if (closed || gen !== connectGen)
       return;
-    const sep = o.url.includes("?") ? "&" : "?";
-    const ws = new o.wsImpl(`${o.url}${sep}token=${encodeURIComponent(token)}`);
+    const ws = new o.wsImpl(o.url, [BEARER_SUBPROTOCOL, base64UrlNoPad(token)]);
     sock = ws;
     ws.onopen = () => {
       push({ reconnected: true });
@@ -2762,8 +2982,8 @@ function openDeliveryPings(o) {
             return Promise.resolve({ value: void 0, done: true });
           if (queue.length)
             return Promise.resolve({ value: queue.shift(), done: false });
-          return new Promise((resolve2) => {
-            waiter = resolve2;
+          return new Promise((resolve3) => {
+            waiter = resolve3;
           });
         }
       };
@@ -3095,11 +3315,11 @@ var RestMlsBackend = class {
 };
 
 // ../connect-sdk-ts/dist/mls/fake-backend.js
-import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2 } from "@agentvault/crypto";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes2 } from "@agentvault/crypto";
 
 // ../connect-sdk-ts/dist/receive/inbox-cipher.js
 import { hkdf } from "@noble/hashes/hkdf";
-import { sha256 as sha2562 } from "@noble/hashes/sha256";
+import { sha256 as sha2563 } from "@noble/hashes/sha256";
 var SUITE = "xchacha20poly1305";
 var INFO = new TextEncoder().encode("agentvault-connect-inbox-v1");
 var EMPTY_AAD = new Uint8Array(0);
@@ -3127,12 +3347,12 @@ var KeyedInboxCipher = class {
 };
 var MLS_STORE_INFO = new TextEncoder().encode("agentvault-connect-mls-store-v1");
 function deriveMlsStoreKey(identityKeyMaterial) {
-  return hkdf(sha2562, identityKeyMaterial, void 0, MLS_STORE_INFO, 32);
+  return hkdf(sha2563, identityKeyMaterial, void 0, MLS_STORE_INFO, 32);
 }
 
 // ../connect-sdk-ts/dist/recovery/backup-crypto.js
 import { hkdf as hkdf2 } from "@noble/hashes/hkdf";
-import { sha256 as sha2563 } from "@noble/hashes/sha256";
+import { sha256 as sha2564 } from "@noble/hashes/sha256";
 import { randomBytes as randomBytes2 } from "@noble/hashes/utils";
 var BACKUP_INFO = new TextEncoder().encode("connect-backup-v1");
 var RECOVERY_INFO = new TextEncoder().encode("connect-recovery-v1");
@@ -3140,15 +3360,15 @@ var RECOVERY_INFO = new TextEncoder().encode("connect-recovery-v1");
 // ../connect-sdk-ts/dist/recovery/guest-recovery-crypto.js
 import { argon2idAsync } from "@noble/hashes/argon2";
 import { hkdf as hkdf3 } from "@noble/hashes/hkdf";
-import { sha256 as sha2564 } from "@noble/hashes/sha256";
+import { sha256 as sha2565 } from "@noble/hashes/sha256";
 var HKDF_INFO = new TextEncoder().encode("connect-guest-recovery-wrap-v1");
 
 // ../connect-mls-store/dist/sqlite-store.js
 import { DatabaseSync } from "node:sqlite";
-import { MLSGroupManager as MLSGroupManager2, bytesToHex as bytesToHex3, hexToBytes as hexToBytes3 } from "@agentvault/crypto";
+import { MLSGroupManager as MLSGroupManager2, bytesToHex as bytesToHex4, hexToBytes as hexToBytes3 } from "@agentvault/crypto";
 
 // ../connect-mls-store/dist/schema.js
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 6;
 function openSchema(db) {
   db.exec("PRAGMA journal_mode=WAL");
   const row = db.prepare("PRAGMA user_version").get();
@@ -3195,6 +3415,51 @@ function openSchema(db) {
       );
     `);
   }
+  if (row.user_version < 5) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS channel_meta (
+        identity_id TEXT NOT NULL,
+        channel_id  TEXT NOT NULL,
+        enclave_id  TEXT,
+        is_dm       INTEGER,
+        updated_at  INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, channel_id)
+      );
+    `);
+  }
+  if (row.user_version < 6) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS agent_memory (
+        identity_id     TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        seq             INTEGER NOT NULL,
+        role            TEXT NOT NULL,
+        peer_id         TEXT,
+        sealed_text     BLOB NOT NULL,
+        modality        TEXT NOT NULL,
+        message_id      TEXT,
+        idempotency_key TEXT,
+        dedup_key       TEXT,
+        recorded_at     INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, conversation_id, seq)
+      );
+    `);
+    db.exec(`
+      CREATE UNIQUE INDEX IF NOT EXISTS agent_memory_dedup
+        ON agent_memory (identity_id, conversation_id, dedup_key)
+        WHERE dedup_key IS NOT NULL;
+    `);
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS agent_memory_fact (
+        identity_id     TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        fact_id         INTEGER NOT NULL,
+        sealed_fact     BLOB NOT NULL,
+        added_at        INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, conversation_id, fact_id)
+      );
+    `);
+  }
   db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
 }
 
@@ -3216,10 +3481,10 @@ var MlsStoreSealError = class extends Error {
 function encodeBundle(bundle) {
   const pp = bundle.privatePackage;
   const obj = {
-    pub: bytesToHex3(MLSGroupManager2.serializeKeyPackage(bundle.publicPackage)),
-    initPriv: bytesToHex3(pp.initPrivateKey),
-    hpkePriv: bytesToHex3(pp.hpkePrivateKey),
-    sigPriv: bytesToHex3(pp.signaturePrivateKey)
+    pub: bytesToHex4(MLSGroupManager2.serializeKeyPackage(bundle.publicPackage)),
+    initPriv: bytesToHex4(pp.initPrivateKey),
+    hpkePriv: bytesToHex4(pp.hpkePrivateKey),
+    sigPriv: bytesToHex4(pp.signaturePrivateKey)
   };
   return new TextEncoder().encode(JSON.stringify(obj));
 }
@@ -3246,9 +3511,11 @@ var SqliteMlsStateStore = class {
   // the source of truth across process restarts.
   bundles = /* @__PURE__ */ new Map();
   lastKpIds = /* @__PURE__ */ new Map();
+  memoryRetentionK;
   constructor(opts) {
     this.id = opts.identityId;
     this.cipher = opts.cipherFor(opts.identityId);
+    this.memoryRetentionK = opts.memoryRetentionK ?? 500;
     try {
       this.db = new DatabaseSync(opts.dbPath);
     } catch (e) {
@@ -3383,6 +3650,74 @@ var SqliteMlsStateStore = class {
     const rows = this.db.prepare("SELECT group_id FROM mls_retired_group WHERE channel_id=?").all(channelId);
     return rows.map((r) => r.group_id);
   }
+  recordChannelEnclave(channelId, enclaveId) {
+    this.db.prepare(`INSERT INTO channel_meta (identity_id, channel_id, enclave_id, updated_at)
+       VALUES (?,?,?,?)
+       ON CONFLICT(identity_id, channel_id) DO UPDATE SET enclave_id=excluded.enclave_id, updated_at=excluded.updated_at`).run(this.id, channelId, enclaveId, Date.now());
+  }
+  recordChannelIsDm(channelId, isDm) {
+    this.db.prepare(`INSERT INTO channel_meta (identity_id, channel_id, is_dm, updated_at)
+       VALUES (?,?,?,?)
+       ON CONFLICT(identity_id, channel_id) DO UPDATE SET is_dm=excluded.is_dm, updated_at=excluded.updated_at`).run(this.id, channelId, isDm ? 1 : 0, Date.now());
+  }
+  getChannelMeta(channelId) {
+    const row = this.db.prepare("SELECT enclave_id, is_dm FROM channel_meta WHERE identity_id=? AND channel_id=?").get(this.id, channelId);
+    if (!row)
+      return void 0;
+    return {
+      enclaveId: row.enclave_id ?? void 0,
+      isDm: row.is_dm == null ? void 0 : row.is_dm === 1
+    };
+  }
+  /**
+   * The set of enclave ids this identity has learned about (from inbound
+   * envelopes or a prior listChannels discovery), beyond its own home
+   * enclave. Task 3: refreshChannelMeta unions this with cfg.enclaveId so a
+   * cross-enclave room's is_dm gets resolved instead of staying UNKNOWN.
+   */
+  distinctEnclaveIds() {
+    const rows = this.db.prepare("SELECT DISTINCT enclave_id FROM channel_meta WHERE identity_id=? AND enclave_id IS NOT NULL").all(this.id);
+    return rows.map((r) => r.enclave_id);
+  }
+  async recordMemory(input) {
+    const dedupKey = input.messageId ?? input.idempotencyKey ?? null;
+    if (!dedupKey)
+      throw new Error("recordMemory requires message_id or idempotency_key");
+    const sealed = await this.cipher.seal(new TextEncoder().encode(input.text));
+    const info = this.db.prepare(`INSERT OR IGNORE INTO agent_memory
+         (identity_id, conversation_id, seq, role, peer_id, sealed_text, modality, message_id, idempotency_key, dedup_key, recorded_at)
+       VALUES (?, ?,
+         (SELECT COALESCE(MAX(seq),0)+1 FROM agent_memory WHERE identity_id=? AND conversation_id=?),
+         ?, ?, ?, ?, ?, ?, ?, ?)`).run(this.id, input.conversationId, this.id, input.conversationId, input.role, input.peerId ?? null, sealed, input.modality, input.messageId ?? null, input.idempotencyKey ?? null, dedupKey, Date.now());
+    if (info.changes === 0) {
+      const row2 = this.db.prepare("SELECT seq FROM agent_memory WHERE identity_id=? AND conversation_id=? AND dedup_key=?").get(this.id, input.conversationId, dedupKey);
+      return { seq: row2.seq, deduped: true };
+    }
+    const row = this.db.prepare("SELECT MAX(seq) AS seq FROM agent_memory WHERE identity_id=? AND conversation_id=?").get(this.id, input.conversationId);
+    if (this.memoryRetentionK > 0) {
+      this.db.prepare("DELETE FROM agent_memory WHERE identity_id=? AND conversation_id=? AND seq <= ?").run(this.id, input.conversationId, row.seq - this.memoryRetentionK);
+    }
+    return { seq: row.seq, deduped: false };
+  }
+  async memoryContext(conversationId, limit = 50) {
+    const rows = this.db.prepare(`SELECT seq, role, peer_id, sealed_text, recorded_at FROM agent_memory
+       WHERE identity_id=? AND conversation_id=? ORDER BY seq DESC LIMIT ?`).all(this.id, conversationId, limit);
+    const recent = [];
+    for (const r of rows.reverse()) {
+      const text = new TextDecoder().decode(await this.cipher.open(r.sealed_text));
+      recent.push({ seq: r.seq, role: r.role, peerId: r.peer_id ?? void 0, text, ts: r.recorded_at });
+    }
+    const factRows = this.db.prepare("SELECT sealed_fact FROM agent_memory_fact WHERE identity_id=? AND conversation_id=? ORDER BY fact_id ASC").all(this.id, conversationId);
+    const facts = [];
+    for (const f of factRows)
+      facts.push(new TextDecoder().decode(await this.cipher.open(f.sealed_fact)));
+    return { recent, facts };
+  }
+  async recordMemoryFact(conversationId, fact) {
+    const sealed = await this.cipher.seal(new TextEncoder().encode(fact));
+    this.db.prepare(`INSERT INTO agent_memory_fact (identity_id, conversation_id, fact_id, sealed_fact, added_at)
+       VALUES (?, ?, (SELECT COALESCE(MAX(fact_id),0)+1 FROM agent_memory_fact WHERE identity_id=? AND conversation_id=?), ?, ?)`).run(this.id, conversationId, this.id, conversationId, sealed, Date.now());
+  }
   /** @internal test-only */
   _rawMainForTest(identityId, channelId) {
     const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(identityId, channelId);
@@ -3447,7 +3782,7 @@ function loadPackageMeta(importMetaUrl) {
 
 // src/bridge-agent.ts
 import { promises as fsp } from "node:fs";
-import { join as join3, dirname as dirname3 } from "node:path";
+import { join as join7, dirname as dirname3 } from "node:path";
 
 // src/latency.ts
 var DEFAULT_CAPACITY = 1024;
@@ -3721,8 +4056,8 @@ async function prepareAttachment(filePath, caption, channelId, deps) {
 }
 async function materializeAttachment(body, ctx, deps) {
   const ciphertext = await deps.downloadBlob(body.blobId);
-  const sha2565 = deps.computeFileDigest(ciphertext);
-  if (sha2565 !== body.digest) {
+  const sha2566 = deps.computeFileDigest(ciphertext);
+  if (sha2566 !== body.digest) {
     throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
   }
   const plain = deps.decryptFile(
@@ -3735,7 +4070,328 @@ async function materializeAttachment(body, ctx, deps) {
   const path = `${dir}/${ctx.messageId}-${safeName}`;
   await deps.mkdirp(dir);
   await deps.writeFile(path, plain);
-  return { filename: safeName, mime: body.mime, size: plain.length, path, sha256: sha2565 };
+  return { filename: safeName, mime: body.mime, size: plain.length, path, sha256: sha2566 };
+}
+
+// src/memory/hermes-session-map.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join3 } from "node:path";
+function expandHome(p) {
+  return p === "~" || p.startsWith("~/") ? join3(homedir(), p.slice(1)) : p;
+}
+function resolveHermesSession(baseDir, conversationId) {
+  try {
+    const path = join3(expandHome(baseDir), "sessions", "sessions.json");
+    const map = JSON.parse(readFileSync2(path, "utf8"));
+    const entry = map[`agent:main:securecoms:dm:${conversationId}`];
+    const sid = entry?.session_id;
+    return typeof sid === "string" && sid ? sid : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/memory/hermes-store.ts
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { join as join4 } from "node:path";
+var HermesStore = class {
+  dbPath;
+  constructor(baseDir) {
+    this.dbPath = join4(expandHome(baseDir), "state.db");
+  }
+  /** Recent-K conversational turns for a session, chronological. Fail-safe → []. */
+  readRecent(sessionId, limit) {
+    let db;
+    try {
+      db = new DatabaseSync2(this.dbPath, { readOnly: true });
+      const rows = db.prepare(
+        `SELECT id, role, content, timestamp FROM messages
+         WHERE session_id = ? AND active = 1 AND content IS NOT NULL AND role IN ('user','assistant')
+         ORDER BY timestamp DESC LIMIT ?`
+      ).all(sessionId, limit);
+      return rows.reverse().map((r) => ({ id: r.id, role: r.role, content: r.content, timestamp: r.timestamp }));
+    } catch {
+      return [];
+    } finally {
+      db?.close();
+    }
+  }
+  open(busyMs = 5e3) {
+    const db = new DatabaseSync2(this.dbPath);
+    db.exec(`PRAGMA busy_timeout = ${busyMs}`);
+    return db;
+  }
+  /**
+   * Append a voice turn to a session in one synchronous BEGIN IMMEDIATE block
+   * (no await between statements → atomic against Hermes and our own retries).
+   * Guards: skip when the session is absent/archived/ended; in-transaction dedup
+   * on (session_id, platform_message_id). Writes only `messages`. Fail-safe.
+   */
+  writeVoiceTurn(input) {
+    let db;
+    try {
+      db = this.open();
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const s = db.prepare("SELECT archived, ended_at FROM sessions WHERE id = ?").get(input.sessionId);
+        if (!s || s.archived === 1 || s.ended_at != null) {
+          db.exec("ROLLBACK");
+          return "skipped";
+        }
+        if (input.dedupKey) {
+          const dup = db.prepare("SELECT 1 FROM messages WHERE session_id = ? AND platform_message_id = ?").get(input.sessionId, input.dedupKey);
+          if (dup) {
+            db.exec("ROLLBACK");
+            return "deduped";
+          }
+        }
+        db.prepare(
+          `INSERT INTO messages (session_id, role, content, timestamp, active, platform_message_id) VALUES (?, ?, ?, ?, 1, ?)`
+        ).run(input.sessionId, input.role, input.content, input.timestamp, input.dedupKey);
+        db.exec("COMMIT");
+        return "written";
+      } catch (e) {
+        try {
+          db.exec("ROLLBACK");
+        } catch {
+        }
+        throw e;
+      }
+    } catch {
+      return "failed";
+    } finally {
+      db?.close();
+    }
+  }
+  /**
+   * Startup write-capability probe: insert a sentinel against any existing
+   * session inside a rolled-back transaction. Throws if the write path is broken
+   * (e.g. a schema regression). No-op when the db has no sessions.
+   */
+  probeWrite() {
+    let db;
+    try {
+      db = this.open(500);
+      const s = db.prepare("SELECT id FROM sessions LIMIT 1").get();
+      if (!s) return;
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        db.prepare(
+          `INSERT INTO messages (session_id, role, content, timestamp, active, platform_message_id) VALUES (?, 'assistant', '[voice] __probe__', ?, 1, ?)`
+        ).run(s.id, Date.now() / 1e3, `__probe__${Date.now()}`);
+      } finally {
+        db.exec("ROLLBACK");
+      }
+    } finally {
+      db?.close();
+    }
+  }
+};
+
+// src/memory/hermes-provider.ts
+var DEFAULT_K = 30;
+var HermesMemoryProvider = class {
+  constructor(baseDir) {
+    this.baseDir = baseDir;
+    this.store = new HermesStore(baseDir);
+    try {
+      this.store.probeWrite();
+    } catch (e) {
+      process.stderr.write(`[bridge] HERMES MEMORY WRITE-BACK NON-FUNCTIONAL (schema probe failed): ${String(e)}
+`);
+    }
+  }
+  store;
+  noSession = 0;
+  skipped = 0;
+  writeFailed = 0;
+  async record(input) {
+    if (input.modality !== "voice") return { seq: 0, deduped: true };
+    const sessionId = resolveHermesSession(this.baseDir, input.conversationId);
+    if (!sessionId) {
+      this.noSession++;
+      return { seq: 0, deduped: false };
+    }
+    const role = input.role === "peer" ? "user" : "assistant";
+    const res = this.store.writeVoiceTurn({
+      sessionId,
+      role,
+      content: `[voice] ${input.text}`,
+      dedupKey: input.idempotencyKey ?? input.messageId ?? null,
+      timestamp: Date.now() / 1e3
+    });
+    if (res === "failed") this.writeFailed++;
+    else if (res === "skipped") this.skipped++;
+    return { seq: 0, deduped: res === "deduped" };
+  }
+  async context(conversationId, limit) {
+    const sessionId = resolveHermesSession(this.baseDir, conversationId);
+    if (!sessionId) return { recent: [], facts: [] };
+    const turns = this.store.readRecent(sessionId, limit ?? DEFAULT_K);
+    return {
+      recent: turns.map((t) => ({ seq: t.id, role: t.role === "user" ? "peer" : "agent", text: t.content })),
+      facts: []
+    };
+  }
+  stats() {
+    return { hermes_no_session: this.noSession, hermes_skipped: this.skipped, hermes_write_failed: this.writeFailed };
+  }
+};
+
+// src/memory/openclaw-session-map.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { join as join5 } from "node:path";
+function resolveOwnerDmSession(baseDir, agent) {
+  try {
+    const path = join5(expandHome(baseDir), "agents", agent, "sessions", "sessions.json");
+    const map = JSON.parse(readFileSync3(path, "utf8"));
+    let best = null;
+    for (const [key, entry] of Object.entries(map)) {
+      if (!key.includes(":direct:") || !key.endsWith(":owner")) continue;
+      const sid = entry?.sessionId;
+      if (typeof sid !== "string" || !sid) continue;
+      const updatedAt = typeof entry?.updatedAt === "number" ? entry.updatedAt : 0;
+      if (!best || updatedAt > best.updatedAt) best = { sid, updatedAt };
+    }
+    return best?.sid ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// src/memory/openclaw-session-log.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join6 } from "node:path";
+function readRecentTurns(baseDir, agent, sessionId, k) {
+  let raw;
+  try {
+    raw = readFileSync4(join6(expandHome(baseDir), "agents", agent, "sessions", `${sessionId}.jsonl`), "utf8");
+  } catch {
+    return [];
+  }
+  const turns = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    let o;
+    try {
+      o = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (o?.type !== "message" || !o.message) continue;
+    const ts = typeof o.timestamp === "string" ? Date.parse(o.timestamp) : NaN;
+    if (Number.isNaN(ts)) continue;
+    const role = o.message.role;
+    if (role === "user") {
+      const text = typeof o.message.content === "string" ? o.message.content.trim() : "";
+      if (text) turns.push({ role: "peer", text, ts });
+    } else if (role === "assistant") {
+      const blocks = Array.isArray(o.message.content) ? o.message.content : [];
+      const text = blocks.filter((b) => !!b && b.type === "text" && typeof b.text === "string").map((b) => b.text).join("\n").trim();
+      if (text) turns.push({ role: "agent", text, ts });
+    }
+  }
+  return k > 0 ? turns.slice(-k) : [];
+}
+
+// src/memory/openclaw-provider.ts
+var DEFAULT_K2 = 200;
+var OpenClawMemoryProvider = class {
+  constructor(store, baseDir, agent) {
+    this.store = store;
+    this.baseDir = baseDir;
+    this.agent = agent;
+  }
+  noSession = 0;
+  readFailed = 0;
+  async record(input) {
+    if (input.modality !== "voice") return { seq: 0, deduped: true };
+    return this.store.recordMemory({ ...input, text: `[voice] ${input.text}` });
+  }
+  async context(conversationId, limit) {
+    const k = limit ?? DEFAULT_K2;
+    const voice = await this.store.memoryContext(conversationId, k);
+    let textTurns = [];
+    try {
+      const sid = resolveOwnerDmSession(this.baseDir, this.agent);
+      if (!sid) {
+        this.noSession++;
+        return voice;
+      }
+      textTurns = readRecentTurns(this.baseDir, this.agent, sid, k).map((t) => ({
+        seq: 0,
+        role: t.role,
+        text: t.text,
+        ts: t.ts
+      }));
+    } catch {
+      this.readFailed++;
+      return voice;
+    }
+    const tagged = [
+      ...textTurns.map((t, i) => ({ ...t, _src: 0, _i: i })),
+      ...voice.recent.map((t, i) => ({ ...t, _src: 1, _i: i }))
+    ];
+    tagged.sort((a, b) => {
+      const at = a.ts ?? 0, bt = b.ts ?? 0;
+      if (at !== bt) return at - bt;
+      if (a._src !== b._src) return a._src - b._src;
+      return a._i - b._i;
+    });
+    const recent = (k > 0 ? tagged.slice(-k) : []).map((t, i) => ({
+      seq: i + 1,
+      role: t.role,
+      peerId: t.peerId,
+      text: t.text,
+      ts: t.ts
+    }));
+    return { recent, facts: voice.facts };
+  }
+  stats() {
+    return { openclaw_no_session: this.noSession, openclaw_read_failed: this.readFailed };
+  }
+};
+
+// src/memory/provider.ts
+var SecureComsLocalMemory = class {
+  constructor(store) {
+    this.store = store;
+  }
+  record(input) {
+    return this.store.recordMemory(input);
+  }
+  context(conversationId, limit) {
+    return this.store.memoryContext(conversationId, limit);
+  }
+};
+var NullMemory = class {
+  async record() {
+    return { seq: 0, deduped: false };
+  }
+  async context() {
+    return { recent: [], facts: [] };
+  }
+};
+function createMemoryProvider(provider, store, baseDir, agent) {
+  if (provider === "none") return new NullMemory();
+  if (provider === "hermes") return new HermesMemoryProvider(baseDir ?? "~/.hermes");
+  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "");
+  return new SecureComsLocalMemory(store);
+}
+
+// src/memory-taps.ts
+async function recordInboundMemory(sink, channelId, senderId, text, messageId) {
+  try {
+    await sink.record({ conversationId: channelId, role: "peer", peerId: senderId, text, modality: "text", messageId });
+  } catch {
+  }
+}
+async function recordOutboundMemory(sink, channelId, text, messageId) {
+  try {
+    await sink.record({ conversationId: channelId, role: "agent", text, modality: "text", messageId });
+  } catch {
+  }
 }
 
 // src/bridge-agent.ts
@@ -3812,6 +4468,7 @@ var BridgeAgent = class _BridgeAgent {
       identityId: cfg.identityId,
       cipherFor: () => new KeyedInboxCipher(deriveMlsStoreKey(seed))
     });
+    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent);
     this.provider = new MlsGroupKeyProvider({
       store: this.store,
       backend: this.backend,
@@ -3891,7 +4548,7 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join3(dirname3(cfg.storePath), "attachments");
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join7(dirname3(cfg.storePath), "attachments");
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -4063,6 +4720,13 @@ var BridgeAgent = class _BridgeAgent {
   listeners = /* @__PURE__ */ new Set();
   startedAt = 0;
   store;
+  memory;
+  /** Task 2: warn-once-per-channel guard for the enclave-map fallback (below). */
+  enclaveFallbackWarned = /* @__PURE__ */ new Set();
+  /** Task 2: dedupe guard so ingestOnce writes a channel's enclave at most once
+   *  per process — a channel's enclave is immutable, so no need to UPSERT on
+   *  every message on the hot receive path (audit M2). */
+  channelEnclaveRecorded = /* @__PURE__ */ new Set();
   latency;
   /** Track 5: injectable blob download fn (default: fetch-based). */
   downloadBlobImpl;
@@ -4102,6 +4766,26 @@ var BridgeAgent = class _BridgeAgent {
   sweepJitter() {
     return Math.floor(this.rng() * _BridgeAgent.SELF_HEAL_SWEEP_JITTER_MS);
   }
+  /**
+   * Task 2 (multi-enclave core fix): resolve the enclave to stamp on outbound
+   * traffic for `channelId`. The daemon previously stamped `cfg.enclaveId`
+   * (its "home" enclave) on EVERY channel, so an agent admitted to a second
+   * enclave got a backend 400 on every send/reply there. The channel→enclave
+   * map (`channel_meta`, Task 1) is fed by inbound envelopes (`ingestOnce`)
+   * and by `listChannels`; a channel not yet in the map (never seen inbound,
+   * never discovered) falls back to home and logs once so the fallback is
+   * diagnosable (audit H3) rather than silently wrong.
+   */
+  resolveEnclave(channelId) {
+    const mapped = this.store.getChannelMeta(channelId)?.enclaveId;
+    if (mapped) return mapped;
+    if (!this.enclaveFallbackWarned.has(channelId)) {
+      this.enclaveFallbackWarned.add(channelId);
+      process.stderr.write(`[bridge] send.enclave_fallback channel=${channelId} stamped=home
+`);
+    }
+    return this.cfg.enclaveId;
+  }
   async reconcileJoin(channelId) {
     if (this.joinState.get(channelId) === "JOINED") return true;
     try {
@@ -4315,7 +4999,7 @@ var BridgeAgent = class _BridgeAgent {
           groupKey: this.provider,
           messageId: id,
           channelId,
-          enclaveId: this.cfg.enclaveId,
+          enclaveId: this.resolveEnclave(channelId),
           senderId: this.cfg.identityId,
           senderType: "agent",
           type: "text",
@@ -4333,6 +5017,7 @@ var BridgeAgent = class _BridgeAgent {
       (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
     );
     this.latency.record("send.total", performance.now() - sendStart);
+    void recordOutboundMemory(this.memory, channelId, text, id);
     return { message_id: id, status: "sent" };
   }
   async sendA2A(channelId, a2a, messageId) {
@@ -4351,7 +5036,7 @@ var BridgeAgent = class _BridgeAgent {
           groupKey: this.provider,
           messageId: id,
           channelId,
-          enclaveId: this.cfg.enclaveId,
+          enclaveId: this.resolveEnclave(channelId),
           senderId: this.cfg.identityId,
           senderType: "agent",
           type: "a2a",
@@ -4404,7 +5089,7 @@ var BridgeAgent = class _BridgeAgent {
           groupKey: this.provider,
           messageId: id,
           channelId,
-          enclaveId: this.cfg.enclaveId,
+          enclaveId: this.resolveEnclave(channelId),
           senderId: this.cfg.identityId,
           senderType: "agent",
           type: "artifact_share",
@@ -4424,42 +5109,91 @@ var BridgeAgent = class _BridgeAgent {
     this.latency.record("send.total", performance.now() - sendStart);
     return { message_id: id, status: "sent" };
   }
-  async listChannels() {
-    const url = `${this.cfg.apiBase}/api/v1/enclaves/${this.cfg.enclaveId}/channels?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+  /** Task 3: delegates to the configured MemoryProvider (SecureComsLocal | Null). */
+  async recordMemory(input) {
+    return this.memory.record(input);
+  }
+  async memoryContext(conversationId, limit) {
+    return this.memory.context(conversationId, limit);
+  }
+  /**
+   * List channels in one enclave (default: the daemon's own home enclave).
+   * Task 3: called per-*known* enclave by refreshChannelMeta so a
+   * cross-enclave room's is_dm gets resolved — see the scope caveat there
+   * (same-tenant only; a cross-tenant enclave 404s under the agent's bearer).
+   */
+  async listChannels(enclaveId = this.cfg.enclaveId) {
+    const url = `${this.cfg.apiBase}/api/v1/enclaves/${enclaveId}/channels?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
     const res = await this.fetchImpl(url, {
       headers: { authorization: `Bearer ${this.cfg.apiKey}` }
     });
     if (!res.ok) throw new Error(`list_channels failed: ${res.status}`);
     const rows = await res.json();
+    for (const r of rows) this.store.recordChannelEnclave(r.channel_id, r.enclave_id);
     return rows.map((r) => ({
       channel_id: r.channel_id,
       name: r.name ?? null,
       is_dm: r.is_dm,
-      joined: true
+      joined: true,
+      enclave_id: r.enclave_id
     }));
   }
-  /** A live channelMeta entry, or undefined if missing OR expired past the TTL. */
+  /**
+   * A live channelMeta entry, or undefined if missing OR expired past the
+   * TTL. A never-cached-this-process channel (no in-memory entry at all —
+   * cold start, or every listChannels() call in refreshChannelMeta failed,
+   * e.g. network down) falls back to the store's persisted is_dm (Task 3) so
+   * a cross-enclave room stays classified across a restart instead of
+   * reverting to UNKNOWN/fail-open. The store has no TTL (is_dm is immutable
+   * per channel); `name` is not persisted so it comes back undefined on this
+   * path and re-resolves once a listChannels() call succeeds.
+   *
+   * A TTL-*expired* in-memory entry deliberately does NOT use the store
+   * fallback and is still treated as a miss — that miss is what drives
+   * ingestOnce to retry a refresh each cycle (S-2: keeping `name` fresh after
+   * a rename); serving the persisted is_dm there would silently suppress
+   * that retry forever.
+   */
   freshMeta(channelId) {
     const hit = this.channelMeta.get(channelId);
-    if (!hit) return void 0;
-    if (Date.now() - hit.at >= CHANNEL_META_TTL_MS) return void 0;
-    return { is_dm: hit.is_dm, name: hit.name };
+    if (hit) {
+      if (Date.now() - hit.at < CHANNEL_META_TTL_MS) return { is_dm: hit.is_dm, name: hit.name };
+      return void 0;
+    }
+    const persisted = this.store.getChannelMeta(channelId);
+    if (persisted?.isDm !== void 0) {
+      return { is_dm: persisted.isDm, name: void 0 };
+    }
+    return void 0;
   }
   /**
-   * One-shot, whole-listing refresh of channelMeta. Called AT MOST ONCE per
-   * ingest cycle (the caller guards with a cycle-local "refreshed" flag), so a
-   * burst of K unknown channels fires a single listChannels() instead of K. Any
-   * listChannels failure is swallowed (UNKNOWN → fail open) so ingest never
-   * blocks on the network.
+   * Whole-listing refresh of channelMeta, one listChannels() call per *known*
+   * enclave — the daemon's own home enclave plus every enclave it has learned
+   * about from inbound envelopes or a prior discovery (store.distinctEnclaveIds()).
+   * Called AT MOST ONCE per ingest cycle (the caller guards with a
+   * cycle-local "refreshed" flag). Task 3 (M1): without this, a cross-enclave
+   * room is never listed under the home-enclave-only call, so its is_dm never
+   * resolves and the @mention filter fails open for that room.
+   *
+   * Each enclave is wrapped in its own try/catch (scope caveat — audit
+   * H2/tenant): list_channels_in_enclave filters on tenant_id, so a
+   * same-tenant enclave the agent has learned about resolves fine, but a
+   * cross-TENANT federated-partner enclave 404s under this agent's bearer;
+   * that enclave's channels are left unresolved (fail open) without aborting
+   * the other enclaves in the set.
    */
   async refreshChannelMeta() {
-    try {
-      const now = Date.now();
-      const channels = await this.listChannels();
-      for (const c of channels) {
-        this.channelMeta.set(c.channel_id, { is_dm: c.is_dm, name: c.name, at: now });
+    const enclaves = /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.store.distinctEnclaveIds()]);
+    const now = Date.now();
+    for (const encId of enclaves) {
+      try {
+        const channels = await this.listChannels(encId);
+        for (const c of channels) {
+          this.channelMeta.set(c.channel_id, { is_dm: c.is_dm, name: c.name, at: now });
+          this.store.recordChannelIsDm(c.channel_id, c.is_dm);
+        }
+      } catch {
       }
-    } catch {
     }
   }
   /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
@@ -4565,6 +5299,8 @@ var BridgeAgent = class _BridgeAgent {
   async reportStatus(channelId, state, detail) {
     const joined = await this.reconcileJoin(channelId);
     if (!joined) throw new ChannelPendingError(channelId);
+    const enc = this.store.getChannelMeta(channelId)?.enclaveId;
+    if (!enc) return;
     await sendWithSelfHeal(
       this.provider,
       channelId,
@@ -4573,7 +5309,7 @@ var BridgeAgent = class _BridgeAgent {
         groupKey: this.provider,
         messageId: crypto.randomUUID(),
         channelId,
-        enclaveId: this.cfg.enclaveId,
+        enclaveId: enc,
         senderId: this.cfg.identityId,
         senderType: "agent",
         type: "system_event",
@@ -4620,7 +5356,7 @@ var BridgeAgent = class _BridgeAgent {
         groupKey: this.provider,
         messageId: crypto.randomUUID(),
         channelId,
-        enclaveId: this.cfg.enclaveId,
+        enclaveId: this.resolveEnclave(channelId),
         senderId: this.cfg.identityId,
         senderType: "agent",
         type: "system_event",
@@ -4864,6 +5600,11 @@ var BridgeAgent = class _BridgeAgent {
     const acked = [];
     for (const m of entries) {
       try {
+        const encId = m.envelope.enclave_id;
+        if (encId && !this.channelEnclaveRecorded.has(m.channelId)) {
+          this.channelEnclaveRecorded.add(m.channelId);
+          this.store.recordChannelEnclave(m.channelId, encId);
+        }
         const parsed = JSON.parse(
           new TextDecoder().decode(m.plaintext)
         );
@@ -4935,6 +5676,7 @@ var BridgeAgent = class _BridgeAgent {
               sender_is_agent: senderIsAgent
             });
             this.capBuffer();
+            void recordInboundMemory(this.memory, m.channelId, m.envelope.sender_id, parsed.text, m.messageId);
           }
         }
         acked.push(m.queueId);
@@ -4959,7 +5701,7 @@ var BridgeAgent = class _BridgeAgent {
     let got = this.takeBuffered(channelId);
     if (got.length || waitSeconds <= 0) return got;
     const cap = Math.min(waitSeconds, 50) * 1e3;
-    await new Promise((resolve2) => {
+    await new Promise((resolve3) => {
       let fired = false;
       let timer;
       const wake = () => {
@@ -4968,7 +5710,7 @@ var BridgeAgent = class _BridgeAgent {
         clearTimeout(timer);
         const i = this.waiters.indexOf(wake);
         if (i >= 0) this.waiters.splice(i, 1);
-        resolve2();
+        resolve3();
       };
       timer = setTimeout(wake, cap);
       this.waiters.push(wake);
@@ -5031,7 +5773,8 @@ var BridgeAgent = class _BridgeAgent {
       failed_attachments: this.failedAttachments,
       delivery_pings: this.pingsReceived,
       uptime_s: this.startedAt ? Math.floor((Date.now() - this.startedAt) / 1e3) : 0,
-      version: BRIDGE_VERSION
+      version: BRIDGE_VERSION,
+      ...this.memory.stats?.() ?? {}
     };
   }
   /**
@@ -5087,11 +5830,11 @@ var BridgeAgent = class _BridgeAgent {
 
 // src/auth.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync5, writeFileSync } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync(f)) return readFileSync2(f, "utf8").trim();
+  if (f && existsSync(f)) return readFileSync5(f, "utf8").trim();
   const tok = randomBytes3(32).toString("base64url");
   if (f) writeFileSync(f, tok, { mode: 384 });
   return tok;
@@ -5206,6 +5949,17 @@ var statusSchema = z.object({
   state: z.enum(["idle", "working", "stalled", "error"]),
   detail: z.string().optional()
 });
+var memoryRecordSchema = z.object({
+  conversation_id: z.string().min(1),
+  role: z.enum(["peer", "agent"]),
+  peer_id: z.string().optional(),
+  text: z.string(),
+  modality: z.enum(["text", "voice"]),
+  message_id: z.string().optional(),
+  idempotency_key: z.string().optional()
+}).refine((d) => Boolean(d.message_id || d.idempotency_key), {
+  message: "memory record requires message_id or idempotency_key"
+});
 function json(res, status, body) {
   const s = JSON.stringify(body);
   res.writeHead(status, { "content-type": "application/json" });
@@ -5215,7 +5969,7 @@ function jsonError(res, code, detail) {
   json(res, httpStatus(code), errorBody(code, detail));
 }
 function readBody(req, cap) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let size = 0;
     let done = false;
     const chunks = [];
@@ -5235,7 +5989,7 @@ function readBody(req, cap) {
     req.on("end", () => {
       if (!done) {
         done = true;
-        resolve2(Buffer.concat(chunks).toString("utf8"));
+        resolve3(Buffer.concat(chunks).toString("utf8"));
       }
     });
     req.on("error", (e) => {
@@ -5299,6 +6053,26 @@ function createHttpServer(agent, opts) {
         await agent.reportStatus(parsed.data.channel_id, parsed.data.state, parsed.data.detail);
         return json(res, 200, { ok: true });
       }
+      if (method === "POST" && path === "/v1/memory/record") {
+        const parsed = memoryRecordSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
+        if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
+        const r = await agent.recordMemory({
+          conversationId: parsed.data.conversation_id,
+          role: parsed.data.role,
+          peerId: parsed.data.peer_id,
+          text: parsed.data.text,
+          modality: parsed.data.modality,
+          messageId: parsed.data.message_id,
+          idempotencyKey: parsed.data.idempotency_key
+        });
+        return json(res, 200, r);
+      }
+      if (method === "GET" && path === "/v1/memory/context") {
+        const conv = url.searchParams.get("conversation_id");
+        if (!conv) return jsonError(res, "invalid_request", "conversation_id required");
+        const limit = Math.max(1, Math.min(200, Number(url.searchParams.get("limit") ?? 50)));
+        return json(res, 200, await agent.memoryContext(conv, limit));
+      }
       if (method === "GET" && path === "/v1/messages") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
         const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
@@ -5629,10 +6403,10 @@ async function handleInbound(sock, agent, data, inflight) {
 }
 
 // src/bin.ts
-import { readFileSync as readFileSync3, mkdirSync, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync2, realpathSync } from "node:fs";
-import { join as join4, dirname as dirname5 } from "node:path";
+import { readFileSync as readFileSync6, mkdirSync, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync2, realpathSync, readdirSync } from "node:fs";
+import { join as join9, dirname as dirname5, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { homedir, userInfo } from "node:os";
+import { homedir as homedir2, userInfo } from "node:os";
 import { spawnSync } from "node:child_process";
 
 // src/service/install.ts
@@ -5765,6 +6539,161 @@ function uninstallService(input, deps) {
   throw new ServiceUnsupportedError(`Service uninstall isn't supported on ${deps.platform} yet.`);
 }
 
+// src/service/install-prep.ts
+import { join as join8 } from "node:path";
+function assertReadableCredential(absPath, deps) {
+  let raw;
+  try {
+    raw = deps.readFile(absPath);
+  } catch {
+    throw new Error(`install: credential file not found or unreadable: ${absPath}`);
+  }
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    throw new Error(`install: credential file is not valid JSON: ${absPath}`);
+  }
+  for (const k of REQUIRED) {
+    if (typeof json2[k] !== "string" || !json2[k]) {
+      throw new Error(`install: credential file missing required field '${k}': ${absPath}`);
+    }
+  }
+  const issuedAt = typeof json2.issued_at === "string" && json2.issued_at ? json2.issued_at : null;
+  return { deviceId: json2.device_id, identityId: json2.identity_id, issuedAt };
+}
+function durableDir(home, slug) {
+  return join8(home, `securecoms-agent-${slug}`);
+}
+function durableCredentialPath(home, slug) {
+  return join8(durableDir(home, slug), `${slug}.json`);
+}
+function takeCustody(args2, deps) {
+  const dir = durableDir(args2.home, args2.slug);
+  const dest = durableCredentialPath(args2.home, args2.slug);
+  try {
+    if (deps.fileExists(dest) && deps.realpath(args2.sourceAbsPath) === deps.realpath(dest)) return dest;
+  } catch {
+  }
+  if (deps.fileExists(dest)) {
+    try {
+      const existing = JSON.parse(deps.readFile(dest));
+      if (existing.device_id && existing.device_id !== args2.parsed.deviceId) {
+        throw new Error(
+          `install: ${dir} already belongs to a different agent (device ${existing.device_id}). Pass a distinct --label to install this agent in its own directory.`
+        );
+      }
+    } catch (e) {
+      if (e instanceof Error && e.message.startsWith("install:")) throw e;
+    }
+  }
+  deps.mkdirp(dir, 448);
+  deps.writeFileMode(dest, deps.readFile(args2.sourceAbsPath), 384);
+  return dest;
+}
+var PORT_MIN = 7077;
+var PORT_MAX = 7276;
+function parseClaimedPorts(fileContents) {
+  const claimed = /* @__PURE__ */ new Set();
+  const re = /--port(?:<\/string>\s*<string>|\s+)(\d+)/g;
+  for (const text of fileContents) {
+    let m;
+    while ((m = re.exec(text)) !== null) claimed.add(Number(m[1]));
+  }
+  return claimed;
+}
+function readSiblingDefs(dir, prefix, deps) {
+  let names;
+  try {
+    names = deps.listDir(dir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const n of names) {
+    if (!n.startsWith(prefix)) continue;
+    try {
+      out.push(deps.readFile(join8(dir, n)));
+    } catch {
+    }
+  }
+  return out;
+}
+function selectPort(args2, deps) {
+  const defs = [
+    ...readSiblingDefs(args2.launchAgentsDir, "com.securecoms.bridge.", deps),
+    ...readSiblingDefs(args2.systemdDir, "securecoms-bridge-", deps)
+  ];
+  const claimed = parseClaimedPorts(defs);
+  for (let port = PORT_MIN; port <= PORT_MAX; port++) {
+    if (claimed.has(port)) continue;
+    if (!deps.probeBindFree(port)) continue;
+    return port;
+  }
+  throw new Error(`install: no free port in ${PORT_MIN}-${PORT_MAX} \u2014 stop an unused bridge or pass --port`);
+}
+async function verifyDaemonUp(args2, deps) {
+  const attempts = args2.attempts ?? 20;
+  const delayMs = args2.delayMs ?? 250;
+  for (let i = 0; i < attempts; i++) {
+    if (deps.probeConnect(args2.port)) return true;
+    try {
+      if (deps.readFile(args2.logPath).includes("[bridge] listening on")) return true;
+    } catch {
+    }
+    await deps.sleep(delayMs);
+  }
+  return false;
+}
+function harnessSnippet(args2) {
+  const label = args2.harness === "hermes" ? "Hermes" : args2.harness === "openclaw" ? "OpenClaw" : "your harness";
+  return [
+    `# ${label}: point the agent at this bridge`,
+    `SECURECOMS_BRIDGE_URL=ws://127.0.0.1:${args2.port}/v1/ws`,
+    `SECURECOMS_BRIDGE_TOKEN="$(cat ${args2.tokenFilePath})"`
+  ].join("\n");
+}
+async function orchestrateInstall(ctx) {
+  const parsed = assertReadableCredential(ctx.credentialAbsPath, ctx.prepDeps);
+  const stemForSlug = ctx.label ?? ctx.credentialAbsPath.replace(/^.*[\\/]/, "").replace(/\.[^.]*$/, "");
+  const slug = slugify(stemForSlug);
+  const durablePath = takeCustody(
+    { home: ctx.home, slug, sourceAbsPath: ctx.credentialAbsPath, parsed },
+    ctx.prepDeps
+  );
+  const port = ctx.explicitPort ?? selectPort(
+    { launchAgentsDir: ctx.launchAgentsDir ?? `${ctx.home}/Library/LaunchAgents`, systemdDir: ctx.systemdDir ?? `${ctx.home}/.config/systemd/user` },
+    ctx.prepDeps
+  );
+  const input = ctx.buildServiceInput(durablePath, port, slug);
+  const result = ctx.installService(input);
+  const up = await verifyDaemonUp(
+    { port, logPath: result.logHint, attempts: ctx.verifyAttempts, delayMs: ctx.verifyDelayMs },
+    ctx.prepDeps
+  );
+  if (!up) {
+    throw new Error(
+      `install: the daemon did not come up \u2014 check its log: ${result.logHint}`
+    );
+  }
+  const apiKey = JSON.parse(ctx.prepDeps.readFile(durablePath)).api_key;
+  const lines = [
+    `Installed service ${result.label}`,
+    `  device:  ${parsed.deviceId}`,
+    parsed.issuedAt ? `  issued:  ${parsed.issuedAt}` : `  issued:  (unknown \u2014 older credential)`,
+    `  api key: ${tokenFingerprint(apiKey)}`,
+    `  port:    ${port}`,
+    `  token:   ${result.tokenHint}`,
+    `  (Re-running install is the only way to update a live credential \u2014 replacing the download alone does nothing.)`
+  ];
+  let harnessSnippetShown = false;
+  if (ctx.harness && ctx.harness !== "none") {
+    lines.push("", harnessSnippet({ slug, port, tokenFilePath: result.tokenHint, harness: ctx.harness }));
+    harnessSnippetShown = true;
+  }
+  return { echo: lines.join("\n") + "\n", harnessSnippetShown };
+}
+
 // src/bin.ts
 function nodeMajorOk(version) {
   return Number(version.split(".")[0]) >= 24;
@@ -5805,11 +6734,47 @@ function realResolveDeps() {
     fileExists: (p) => existsSync2(p)
   };
 }
-function runServiceVerb(verb) {
+function realPrepDeps() {
+  return {
+    readFile: (p) => readFileSync6(p, "utf8"),
+    writeFileMode: (p, data, mode) => writeFileSync2(p, data, { mode }),
+    mkdirp: (p, mode) => {
+      mkdirSync(p, { recursive: true, mode: mode ?? 493 });
+    },
+    fileExists: (p) => existsSync2(p),
+    realpath: (p) => realpathSync(p),
+    listDir: (p) => {
+      try {
+        return readdirSync(p);
+      } catch {
+        return [];
+      }
+    },
+    // Synchronous spawn-free-loop probes: node's net API is async-only, so each
+    // probe is a tiny `node -e` child that binds/connects and exits 0/1.
+    probeBindFree: (port) => {
+      const r = spawnSync(process.execPath, [
+        "-e",
+        `const s=require('net').createServer();s.once('error',()=>process.exit(1));s.listen(${port},'127.0.0.1',()=>{s.close(()=>process.exit(0))});`
+      ]);
+      return r.status === 0;
+    },
+    probeConnect: (port) => {
+      const r = spawnSync(process.execPath, [
+        "-e",
+        `const s=require('net').connect(${port},'127.0.0.1');s.once('connect',()=>{s.destroy();process.exit(0)});s.once('error',()=>process.exit(1));setTimeout(()=>process.exit(1),500);`
+      ]);
+      return r.status === 0;
+    },
+    // No unref: an unref'd timer would let the process exit mid-verification.
+    sleep: (ms) => new Promise((res) => setTimeout(res, ms))
+  };
+}
+async function runServiceVerb(verb) {
   const credentialPath = argOrEnv("--credential", "SECURECOMS_CREDENTIAL");
   const label = argOrEnv("--label", "SECURECOMS_LABEL");
-  if (!credentialPath && !label) {
-    process.stderr.write(`usage: agent-bridge ${verb} --credential <path> [--label <name>] [--store <path>] [--port N]
+  if (verb === "install" ? !credentialPath : !credentialPath && !label) {
+    process.stderr.write(`usage: agent-bridge ${verb} --credential <path> [--label <name>] [--store <path>] [--port N] [--harness openclaw|hermes|custom]
 `);
     process.exit(2);
   }
@@ -5819,25 +6784,43 @@ function runServiceVerb(verb) {
     const meta = loadPackageMeta(import.meta.url);
     binScript = resolveStableBinScript({ binScript, packageName: meta.name }, realResolveDeps());
   }
-  const input = {
-    credentialPath: credentialPath ?? "",
-    storePath: argOrEnv("--store", "SECURECOMS_STORE"),
-    port: portStr ? Number(portStr) : void 0,
-    label,
-    execPath: process.execPath,
-    binScript,
-    home: homedir(),
-    uid: userInfo().uid
-  };
   try {
     if (verb === "install") {
-      const r = installService(input, realServiceDeps());
-      process.stdout.write(`Installed service ${r.label}
-  file:  ${r.filePath}
-  logs:  ${r.logHint}
-  token: ${r.tokenHint} (the local BRIDGE_TOKEN)
-`);
+      const credAbs = isAbsolute2(credentialPath) ? credentialPath : resolve2(credentialPath);
+      const r = await orchestrateInstall({
+        credentialAbsPath: credAbs,
+        label,
+        explicitPort: portStr ? Number(portStr) : void 0,
+        harness: argOrEnv("--harness", "SECURECOMS_HARNESS"),
+        home: homedir2(),
+        prepDeps: realPrepDeps(),
+        // O-1: the real installService is 2-arg; partially apply the deps so
+        // orchestrateInstall only ever sees the 1-arg seam.
+        installService: (input) => installService(input, realServiceDeps()),
+        buildServiceInput: (durableCredentialPath2, port, _slug) => ({
+          credentialPath: durableCredentialPath2,
+          storePath: argOrEnv("--store", "SECURECOMS_STORE"),
+          // O-2: not dropped
+          port,
+          label,
+          execPath: process.execPath,
+          binScript,
+          home: homedir2(),
+          uid: userInfo().uid
+        })
+      });
+      process.stdout.write(r.echo);
     } else {
+      const input = {
+        credentialPath: credentialPath ?? "",
+        storePath: argOrEnv("--store", "SECURECOMS_STORE"),
+        port: portStr ? Number(portStr) : void 0,
+        label,
+        execPath: process.execPath,
+        binScript,
+        home: homedir2(),
+        uid: userInfo().uid
+      };
       const r = uninstallService(input, realServiceDeps());
       process.stdout.write(r.removed ? `Removed service (${r.filePath})
 ` : `No service installed for this agent
@@ -5859,7 +6842,7 @@ async function main() {
   }
   const verb = parseVerb(process.argv);
   if (verb) {
-    runServiceVerb(verb);
+    await runServiceVerb(verb);
     return;
   }
   const credentialPath = argOrEnv("--credential", "SECURECOMS_CREDENTIAL");
@@ -5878,11 +6861,11 @@ async function main() {
 `);
     process.exit(1);
   }
-  const tokenFile = daemon.tokenFile ?? join4(dirname5(credentialPath), "bridge-token");
+  const tokenFile = daemon.tokenFile ?? join9(dirname5(credentialPath), "bridge-token");
   const token = resolveToken({ tokenFile, token: daemon.token });
   const agent = new BridgeAgent(cfg);
   await agent.start();
-  const tls = daemon.tls ? { cert: readFileSync3(daemon.tlsCert, "utf8"), key: readFileSync3(daemon.tlsKey, "utf8") } : void 0;
+  const tls = daemon.tls ? { cert: readFileSync6(daemon.tlsCert, "utf8"), key: readFileSync6(daemon.tlsKey, "utf8") } : void 0;
   const { server, closeAllSseStreams } = createHttpServer(agent, { token, allowOrigins: daemon.allowOrigins, tls, websocket: true });
   const agentWs = attachAgentWebSocket(server, agent, { token, allowOrigins: daemon.allowOrigins });
   let down = false;