@securecoms/agent-bridge 0.30.1 → 0.30.3

package/README.md

@@ -35,13 +35,9 @@ The server still sees ciphertext only. The trust boundary is the machine running
 - **Node.js 24 LTS or newer.** The daemon requires >= 24 (node:sqlite stable API).
 - A valid SecureComs agent credential (`agent.json`, `chmod 600`)
 
-You don't have to check your Node version yourself. The installer self-checks before anything else runs: on an older Node it prints a clear diagnosis instead of crashing, and on macOS it offers to install Node 24 LTS for you. The install is consent-gated and names its source before asking. If Homebrew is present it runs `brew install node` (user-space, no sudo); otherwise it downloads the official installer from nodejs.org over TLS and verifies the published SHA-256 checksum (an integrity check on the download) before running it.
+You don't have to check your Node version yourself. The installer checks it before anything else runs. On an older Node it says so plainly, and on macOS it offers to install Node 24 from nodejs.org after asking you. That step needs your computer's administrator password. It checks the download's published SHA-256 checksum before running it.
 
-To install Node 24 manually instead:
-
-1. Official installer (recommended): download the Node 24 LTS installer from [nodejs.org](https://nodejs.org) and run it.
-2. Homebrew (macOS): `brew install node`
-3. nvm: `nvm install 24 && nvm use 24`
+To install Node 24 yourself, download the Node 24 LTS installer from [nodejs.org](https://nodejs.org) and run it. Then run the install command again.
 
 Always re-run the install command after upgrading Node — the background service pins the Node path it was installed with.
 
@@ -935,6 +931,81 @@ copied after the owner's next typed message.
 
 ---
 
+## Release notes: 0.30.3
+
+<!-- [COPY, approved by Eric 2026-10-17 (search release notes) and 2026-10-16 (held items); adapted to 0.30.3 on 2026-10-18] -->
+
+0.30.3 enforces the owner's signed search provider and daily limit, gates the
+new page reading tool, and keeps older runtimes from using a provider the
+owner did not sign. Install it together with `@securecoms/agent-runtime`
+0.14.0 and restart both.
+
+- **Upgrade the bridge and the runtime together.** An older bridge with a new
+  runtime can still use install-time search keys after a search setup
+  mismatch.
+- **Signed search settings.** An owner may sign one of five search providers
+  (Brave, Tavily, Parallel, Exa, Firecrawl) and a daily search limit from 0 to
+  2000 for the private chat. An older bridge reads a manifest with a new
+  provider or a limit as invalid and keeps its last good one.
+- **Read web pages.** `web_extract` is offered in the owner's private chat only
+  when every attached runtime supports it. An attached harness connector,
+  such as OpenClaw or Hermes, turns it off.
+- **Older runtimes.** On an agent whose owner signed any provider other than
+  Brave (Tavily included) and that runs an older runtime, web search is
+  withheld everywhere until the runtime is updated. The owner sees "Update the
+  agent to use this search provider."
+- **No fallback after a mismatch.** When the server's search setting does not
+  match the signed provider and no earlier good setting was saved, the agent
+  gets the signed provider with no key file, so a new runtime has no search
+  instead of using install-time keys.
+- **Linux reinstall.** Install on Linux now restarts a running service, so the
+  new version starts.
+- **Release check.** The publish workflow refuses to publish when the live Node
+  24 checksum list no longer parses.
+
+Each runtime restart on an agent with signed tool settings causes one or two
+extra config refreshes. You do not need to change anything after the upgrade.
+
+---
+
+## Release notes: 0.30.2
+
+<!-- [COPY, approved by Eric 2026-10-15] -->
+
+0.30.2 fixes the guided Node upgrade, makes reinstall safe while the agent is
+running, and prints plain messages when the agent cannot start.
+
+- **The Node upgrade works again on macOS.** When this computer has an older
+  Node, install offers to install Node 24 from nodejs.org. Before 0.30.2 this
+  step could not find the installer and stopped without saying why. It now
+  finds it, checks its published SHA-256 checksum, and asks first:
+  `SecureComs needs Node 24. Install it now from nodejs.org? This needs your
+  computer's administrator password. [y/N]`. If the step fails after you say
+  yes, it prints: `Couldn't install Node 24 from nodejs.org.`
+- **Homebrew is no longer used.** The guided upgrade always uses the
+  nodejs.org installer.
+- **Reinstall while the agent runs.** Install now waits up to 10 seconds for
+  the running Connector to stop before it starts the new one. Before, the new
+  copy could start too early, find the old copy still running, and stay
+  stopped. If the old copy does not stop in time, install starts nothing and
+  tells you to run install again.
+- **Plain messages when the agent cannot start.** A missing, unreadable or
+  invalid key file, or a bad setting in it, now each print one short line
+  that says what to do. File paths are printed only in a terminal, not in the
+  service log.
+- **No key file found.** If the copied install command finds no key file, it
+  prints: `No key file was found in your Downloads folder. Download the key
+  file again from SecureComs, or add --credential <path>.` An empty
+  `--credential` no longer falls back to the `SECURECOMS_CREDENTIAL`
+  environment variable.
+- **Node 24 or newer.** The package now declares `node >= 24`, which the
+  Connector already required to run.
+
+You do not need to change anything after the upgrade. Run the install command
+again only if you want the new install behavior now.
+
+---
+
 ## Release notes: 0.30.1
 
 <!-- [COPY, approved by Eric 2026-10-14] -->

package/dist/bin.d.ts

@@ -7,7 +7,7 @@
  * token, its fingerprint, or its path. This prevents the former
  * `BRIDGE_TOKEN=<value>` leak into journald/launchd logs.
  */
-import { type BridgeConfig } from "./config.js";
+import { type BridgeConfig, type ConfigErrorReason } from "./config.js";
 import { BridgeAgent } from "./bridge-agent.js";
 import { createHttpServer } from "./http-server.js";
 import { attachAgentWebSocket } from "./ws-server.js";
@@ -98,8 +98,27 @@ export interface RunModeDeps {
     exit(code: number): void;
     /** One line of approved user-facing copy (spec §8). */
     print(line: string): void;
+    /**
+     * Whether stderr is a terminal. Under launchd and systemd stderr IS the
+     * service log, so a printed line may carry a path only when this is true
+     * (spec 2026-10-15 §5.3 path rule).
+     */
+    isTTY: boolean;
     log: ServiceLog;
 }
+export type StartupConfigReason = ConfigErrorReason | "identity_id_invalid" | "bind_refused" | "unknown";
+/**
+ * The one human line for a run-mode config refusal (spec 2026-10-15 §5.3,
+ * E1-E7 approved; E5 with source=env is the BT-5 draft). The path is shown
+ * only on a TTY; `field` is one of the six fixed REQUIRED names. `unknown`
+ * has no line. Never built from an error message.
+ */
+export declare function configErrorLine(reason: StartupConfigReason, o: {
+    path: string;
+    isTTY: boolean;
+    field?: string;
+    source?: "file" | "env";
+}): string | undefined;
 /**
  * The daemon's run mode (spec §4.1.1). Order, each step gated on the last:
  *   1. loadConfig (+ daemon args, bind check);