@securecoms/agent-bridge 0.30.1 → 0.30.3

package/dist/index.js

@@ -17457,7 +17457,13 @@ var CODES = [
   // lookup missed and before any write, so a retry can never land: the
   // pending commit is dropped instead of being resent forever. The same pair
   // answers an application send into a deleted channel (#325 F5).
-  { status: 409, code: "channel_unavailable" }
+  { status: 409, code: "channel_unavailable" },
+  // ADR-0023 B.1: an Add or Welcome into a humans-only enclave's group naming
+  // a device that is not provably a person's. Refused after the replay lookup
+  // missed and before any write, so nothing landed. Definite: the committer's
+  // work cannot name an agent in a humans-only enclave (admission refuses
+  // one), so dropping the commit starts no resend loop.
+  { status: 403, code: "humans_only_enclave" }
 ];
 var DISTRIBUTE_DEFINITE_CODES = Object.freeze(CODES.map((c) => Object.freeze({ ...c })));
 var DEFINITE_KEYS = new Set(DISTRIBUTE_DEFINITE_CODES.map((c) => `${c.status} ${c.code}`));
@@ -29095,7 +29101,7 @@ function loadPackageMeta(importMetaUrl) {
 }
 
 // src/bridge-agent.ts
-import { existsSync as existsSync5, promises as fsp, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync5, promises as fsp, readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
 import { join as join17, dirname as dirname5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -34026,6 +34032,15 @@ import {
   writeFileSync
 } from "node:fs";
 import { basename as basename4, isAbsolute, join as join15 } from "node:path";
+
+// src/grants/search-providers.ts
+var SEARCH_PROVIDERS = /* @__PURE__ */ new Set(["brave", "tavily", "parallel", "exa", "firecrawl"]);
+var OWNER_DM_SEARCH_DAILY_CAP_MAX = 2e3;
+function isSearchProvider(value) {
+  return typeof value === "string" && SEARCH_PROVIDERS.has(value);
+}
+
+// src/service/runtime-config-dir.ts
 var MEMORY_FILE = "MEMORY.md";
 var REAL_FS = {
   mkdir: (p, mode) => mkdirSync5(p, { recursive: true, mode }),
@@ -34208,10 +34223,14 @@ function readLocalReport(home, identityId) {
   const persona = raw && typeof raw === "object" && !Array.isArray(raw) ? Object.fromEntries(
     Object.entries(raw).filter(([, v]) => typeof v === "string")
   ) : {};
+  const capRaw = doc.owner_dm_search_cap_effective;
+  const ownerDmCap = typeof capRaw === "number" && Number.isInteger(capRaw) && capRaw >= 0 && capRaw <= OWNER_DM_SEARCH_DAILY_CAP_MAX ? capRaw : void 0;
   return {
     persona,
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
+    has_extract_provider: doc.has_extract_provider === true,
+    ...ownerDmCap !== void 0 ? { owner_dm_search_cap_effective: ownerDmCap } : {},
     legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source),
     secret_paths: parseSecretPathsReport(doc.secret_paths)
   };
@@ -34410,7 +34429,8 @@ function loadOwnerGrantPin(opts) {
 // src/grants/manifest.ts
 var TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
 var MANIFEST_KNOWN_TOOLS = Object.freeze({
-  owner_dm: Object.freeze(["web_search", "fetch_url", "http_request", "sql_query"]),
+  owner_dm: Object.freeze(["web_search", "web_extract", "fetch_url", "http_request", "sql_query"]),
+  // web_extract: owner DM only, never team_room (spec §5.4, D5)
   team_room: Object.freeze(["web_search"])
 });
 function manifestSignedBytes(manifest) {
@@ -34485,7 +34505,11 @@ function parseConfig(v) {
   }
   if ("search" in v) {
     const sr = v.search;
-    if (!isPlainObject(sr) || !exactKeys(sr, ["provider"]) || sr.provider !== "brave" && sr.provider !== "tavily") return null;
+    if (!isPlainObject(sr) || !exactKeys(sr, ["provider"], ["owner_dm_daily_cap"]) || !isSearchProvider(sr.provider)) return null;
+    if ("owner_dm_daily_cap" in sr) {
+      const cap = sr.owner_dm_daily_cap;
+      if (typeof cap !== "number" || !Number.isSafeInteger(cap) || cap < 0 || cap > OWNER_DM_SEARCH_DAILY_CAP_MAX) return null;
+    }
   }
   const mem = v.memory;
   if (!isPlainObject(mem) || !exactKeys(mem, ["mode"], ["recall_days"])) return null;
@@ -34495,7 +34519,12 @@ function parseConfig(v) {
   return Object.freeze({
     persona_sha256: v.persona_sha256,
     ...isPlainObject(v.llm) ? { llm: Object.freeze({ provider: v.llm.provider, model: v.llm.model }) } : {},
-    ...isPlainObject(v.search) ? { search: Object.freeze({ provider: v.search.provider }) } : {},
+    ...isPlainObject(v.search) ? {
+      search: Object.freeze({
+        provider: v.search.provider,
+        ..."owner_dm_daily_cap" in v.search ? { owner_dm_daily_cap: v.search.owner_dm_daily_cap } : {}
+      })
+    } : {},
     ...isStringArray(v.tools_allow) ? { tools_allow: Object.freeze([...v.tools_allow]) } : {},
     flags: Object.freeze([...v.flags]),
     memory: Object.freeze({ mode: mem.mode, ..."recall_days" in mem ? { recall_days: mem.recall_days } : {} }),
@@ -34726,7 +34755,20 @@ function bindTargets(raw, signed, equals) {
   }
   return { written, mismatches };
 }
-function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }) {
+function signedManifestTools(manifest, audience, searchProvidersCapable) {
+  return MANIFEST_KNOWN_TOOLS[audience].filter((t) => (manifest.grants[audience] ?? []).includes(t) && (t !== "web_extract" || searchProvidersCapable));
+}
+function manifestPolicyFor(manifest, switches, searchProvidersCapable) {
+  return {
+    v: 1,
+    manifest_tools: [.../* @__PURE__ */ new Set([
+      ...switches.ownerDm ? signedManifestTools(manifest, "owner_dm", searchProvidersCapable) : [],
+      ...switches.room ? signedManifestTools(manifest, "team_room", searchProvidersCapable) : []
+    ])].sort(),
+    secret_path_mode: "enforce"
+  };
+}
+function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }, searchProvidersCapable = false) {
   const mismatches = /* @__PURE__ */ new Set();
   const cfg = manifest.config;
   const out = {};
@@ -34755,6 +34797,7 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
   for (const name of Object.keys(files)) {
     if (name !== LLM_SOURCE && !PERSONA_FILES.includes(name)) mismatches.add("files");
   }
+  const ownerDmTools = signedManifestTools(manifest, "owner_dm", searchProvidersCapable);
   const sj = isObj2(payload.skills_json) ? payload.skills_json : void 0;
   const eps = bindTargets(sj?.endpoints, manifest.endpoints, endpointEquals);
   const dbs = bindTargets(sj?.databases, manifest.databases, databaseEquals);
@@ -34772,14 +34815,20 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     appliedSearch = searchBlock;
   } else {
     mismatches.add("search");
-    searchBlock = (prior.search?.provider ?? void 0) === cfg.search?.provider ? prior.search : void 0;
+    const usablePrior = cfg.search !== void 0 && prior.search?.provider === cfg.search.provider ? prior.search : void 0;
+    searchBlock = cfg.search === void 0 ? void 0 : usablePrior ?? Object.freeze({ provider: cfg.search.provider });
   }
   const skillsDoc = {
     endpoints: eps.written,
     databases: dbs.written,
     flags: [...cfg.flags],
     ...deny !== void 0 || cfg.tools_allow !== void 0 ? { tools: { ...deny !== void 0 ? { deny } : {}, ...cfg.tools_allow !== void 0 ? { allow: [...cfg.tools_allow] } : {} } } : {},
-    ...searchBlock ? { search: searchBlock } : {}
+    ...searchBlock ? { search: searchBlock } : {},
+    // D31: the marker the runtime keys D24 (iii) on; written under every manifest, true when config.search is signed.
+    search_signed: cfg.search !== void 0,
+    // D36, D39: the signed owner-DM cap, only when the owner-DM switch is on and the manifest grants an owner-DM tool;
+    // otherwise none, so the runtime clamps a signed raise to the default. Never read from the payload.
+    ...cfg.search?.owner_dm_daily_cap !== void 0 && switches.ownerDm && ownerDmTools.length > 0 ? { owner_dm_search_cap: cfg.search.owner_dm_daily_cap } : {}
   };
   out["skills.json"] = JSON.stringify(skillsDoc, null, 2) + "\n";
   const signedMemory = { mode: cfg.memory.mode, ...cfg.memory.recall_days !== void 0 ? { recall_days: cfg.memory.recall_days } : {} };
@@ -34810,12 +34859,7 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     mismatches.add("legacy_assign");
     legacyDecisions = decisions.filter((d) => isObj2(d) && d.action === "delete");
   }
-  const signedTools = (a) => MANIFEST_KNOWN_TOOLS[a].filter((t) => (manifest.grants[a] ?? []).includes(t));
-  const policy = {
-    v: 1,
-    manifest_tools: [.../* @__PURE__ */ new Set([...switches.ownerDm ? signedTools("owner_dm") : [], ...switches.room ? signedTools("team_room") : []])].sort(),
-    secret_path_mode: "enforce"
-  };
+  const policy = manifestPolicyFor(manifest, switches, searchProvidersCapable);
   return {
     mismatches: CONFIG_BINDING_FIELDS.filter((f) => mismatches.has(f)).sort(),
     targetMismatches: { endpoint: eps.mismatches, database: dbs.mismatches },
@@ -34954,6 +34998,8 @@ var TOOL_ROOM_CLASSES = Object.freeze({
   current_time: Object.freeze(["room_safe_read"]),
   echo: Object.freeze(["room_safe_read"]),
   web_search: Object.freeze(["owner_credential"]),
+  web_extract: Object.freeze(["owner_credential", "egress"]),
+  // D5: spends the owner's key and sends URLs out
   fetch_url: Object.freeze(["egress"]),
   sql_query: Object.freeze(["owner_credential"]),
   http_request: Object.freeze(["owner_credential", "egress", "side_effect"])
@@ -35375,6 +35421,8 @@ function hexToBytes4(h) {
   return new Uint8Array(Buffer.from(h, "hex"));
 }
 var BOOT_DRAIN_WAIT_MS_DEFAULT = 6e4;
+var SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS = 1e3;
+var SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS = 1e4;
 var BootDrainRotationRefusedError = class extends Error {
   constructor() {
     super("key-package rotation refused: the boot drain has not settled");
@@ -35570,6 +35618,8 @@ var BridgeAgent = class _BridgeAgent {
     this.actionClock = deps.actionThrottleNow ?? Date.now;
     this.rng = deps.rng ?? Math.random;
     this.bootDrainWaitMs = deps.bootDrainWaitMs ?? BOOT_DRAIN_WAIT_MS_DEFAULT;
+    this.searchCapabilityRefetchDebounceMs = deps.searchCapabilityRefetchDebounceMs ?? SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS;
+    this.searchCapabilityRefetchMaxWaitMs = deps.searchCapabilityRefetchMaxWaitMs ?? SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS;
     this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve) => {
       const t = setTimeout(resolve, ms);
       t.unref?.();
@@ -36008,6 +36058,8 @@ var BridgeAgent = class _BridgeAgent {
   bootSweepTimer;
   rng;
   bootDrainWaitMs;
+  searchCapabilityRefetchDebounceMs;
+  searchCapabilityRefetchMaxWaitMs;
   /** Resolved (and cleared) each time an ingest cycle settles: see start(). */
   ingestSettledWaiters = [];
   /** The boot key-package publish, when start() had to defer it. Test seam. */
@@ -36453,9 +36505,14 @@ var BridgeAgent = class _BridgeAgent {
       }
       const skillsJson = payload.skills_json ?? {};
       if (version && inForce === null) {
+        let asDelivered = skillsJson;
+        if (skillsJson !== null && typeof skillsJson === "object" && !Array.isArray(skillsJson)) {
+          const { owner_dm_search_cap: _cap, search_signed: _signed, ...rest } = skillsJson;
+          asDelivered = rest;
+        }
         this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, {
           ...payload.files ?? {},
-          "skills.json": `${JSON.stringify(skillsJson, null, 2)}
+          "skills.json": `${JSON.stringify(asDelivered, null, 2)}
 `
         });
       }
@@ -36510,7 +36567,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     let bound;
     try {
-      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants });
+      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable());
     } catch (e) {
       bound = null;
       return this.bindFailed(manifest, payload.memory, e);
@@ -36529,9 +36586,9 @@ var BridgeAgent = class _BridgeAgent {
       return true;
     }
     try {
-      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, bound.policy);
       this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, bound.files);
       if (manifest.config.llm === void 0) this.grantWriters.removeManagedLlmSource(this.home, this.cfg.identityId);
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable()));
     } catch (e) {
       this.manifestBinding = null;
       throw e;
@@ -36584,6 +36641,7 @@ var BridgeAgent = class _BridgeAgent {
   /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
   async postRuntimeConfigReport(base, version, skillsJson) {
     const local = readLocalReport(this.home, this.cfg.identityId);
+    const reportedSearchProviders = this.searchProvidersCapable();
     const report = {
       applied_version: version,
       paths: checkConfiguredPaths(skillsJson),
@@ -36598,6 +36656,13 @@ var BridgeAgent = class _BridgeAgent {
       // to the backend. The backend needs it to generate a truthful tool
       // paragraph, so it rides along here.
       has_search_key: local?.has_search_key ?? false,
+      // L-2 (spec §7.9): only the runtime knows whether an extract-capable provider key is readable; never derived
+      // from has_search_key. An older runtime omits it: false.
+      // Final review I-2 (controller ruling): AND the current search_providers_v2, so the web never shows extract while
+      // the bridge withholds web_extract from the runtime.
+      has_extract_provider: (local?.has_extract_provider ?? false) && reportedSearchProviders,
+      // D39: the owner-DM daily cap the runtime enforces, passed through when it reported a valid one; never the signed value.
+      ...local?.owner_dm_search_cap_effective !== void 0 ? { owner_dm_search_cap_effective: local.owner_dm_search_cap_effective } : {},
       // Same idea, for the BYOK LLM key file: only the runtime can see
       // whether one is configured in its own environment.
       has_llm_key: local?.has_llm_key ?? false,
@@ -36637,7 +36702,11 @@ var BridgeAgent = class _BridgeAgent {
         // Plan 4 Task 15 (OQ-5): sorted, unique enums; capability is the latest hello's class.
         config_binding_mismatches: [...this.configBindingMismatches],
         target_mismatches: ["database", "endpoint"].filter((k) => this.targetMismatches[k] > 0),
-        capability: this.lastConsumerCapability
+        capability: this.lastConsumerCapability,
+        // D28 (§11.1 step 3): a separate key, never a value in the capability enum. False with no runtime attached.
+        search_providers_v2: reportedSearchProviders,
+        // D19 item 4: content-free; the signed provider is one the attached runtime(s) cannot honour.
+        search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders)
       }
     };
     const reportedVerifyFailures = this.ownerVerifyFailures;
@@ -36658,6 +36727,7 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
+    this.lastReportedSearchProviders = reportedSearchProviders;
     if (version) writeServiceLog2("info", "runtime_config.applied", { version });
     else writeServiceLog2("info", "runtime_config.legacy_memory_reported");
   }
@@ -36727,6 +36797,7 @@ var BridgeAgent = class _BridgeAgent {
     this.startedAt = Date.now();
     await this.restoreRuntimeInbox();
     await this.loadToolGrantState();
+    this.recomputeManifestPolicy(false);
     try {
       this.store.pruneRoomSearchCap(utcDayOf(Date.now()));
     } catch (e) {
@@ -42518,6 +42589,115 @@ ${channelId}`;
   manifestConsumerAttached() {
     return this.manifestConsumer !== null;
   }
+  /**
+   * D28 (B-4): every socket that said hello, with whether its latest hello declared search_providers_v2 on the
+   * manifest_grants_v1 predicate (ws-server.ts). The agent value is the AND over all of them, absent (false) with
+   * none: unlike manifestConsumer, never newest wins. The per-delivery filter judges each socket by its own hello.
+   */
+  searchProvidersSockets = /* @__PURE__ */ new Map();
+  /**
+   * The D28 value the files were last recomputed for; null until the first socket observation, so that observation
+   * always recomputes (final review I-1), even when it is non-capable.
+   */
+  searchProvidersState = null;
+  searchCapabilityRefetchTimer = null;
+  /** When the current burst's first change happened (valid while the timer is set). */
+  searchCapabilityBurstStart = 0;
+  /** The D28 value in the last report posted (null until one is); a change needs a refetch to reach the web. */
+  lastReportedSearchProviders = null;
+  noteSearchProvidersSocket(token, declared) {
+    this.searchProvidersSockets.set(token, declared);
+    this.onSearchProvidersMaybeChanged();
+  }
+  clearSearchProvidersSocket(token) {
+    if (this.searchProvidersSockets.delete(token)) this.onSearchProvidersMaybeChanged();
+  }
+  /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
+  searchProvidersCapable() {
+    if (this.searchProvidersSockets.size === 0) return false;
+    for (const v of this.searchProvidersSockets.values()) if (!v) return false;
+    return true;
+  }
+  /**
+   * D19 item 3 (B-6): the search provider signed in the stored verified manifest in force (a pin loaded and a good
+   * manifest), never the server payload; undefined with no pin, no manifest, or no signed search block. The
+   * per-delivery filter (consumer-grants.ts withSearchCapability) and the S-28 report reason both read this.
+   */
+  signedSearchProvider() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    return pin !== null ? this.toolGrantManifest?.config.search?.provider : void 0;
+  }
+  /** D19 item 4, D34: the in-force signed provider is not brave, and the attached runtime(s) lack the capability. */
+  searchProviderUnsupported(capable) {
+    if (capable) return false;
+    const provider = this.signedSearchProvider();
+    return provider !== void 0 && provider !== "brave";
+  }
+  /**
+   * D35 (P-4): on a capability change, rewrite manifest-policy.json at once from the stored manifest, the kill
+   * switches and the new capability, then a debounced refetch (one per burst) only when needed.
+   */
+  onSearchProvidersMaybeChanged() {
+    const capable = this.searchProvidersCapable();
+    const prev = this.searchProvidersState;
+    if (capable === prev) return;
+    this.searchProvidersState = capable;
+    this.recomputeManifestPolicy(capable);
+    if (this.closingDown) return;
+    if (prev === null && !capable) return;
+    const now = Date.now();
+    if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
+    else this.searchCapabilityBurstStart = now;
+    const delay = Math.max(0, Math.min(this.searchCapabilityRefetchDebounceMs, this.searchCapabilityBurstStart + this.searchCapabilityRefetchMaxWaitMs - now));
+    this.searchCapabilityRefetchTimer = setTimeout(() => {
+      this.searchCapabilityRefetchTimer = null;
+      if (this.searchCapabilityRefetchNeeded()) void this.refetchRuntimeConfig();
+    }, delay);
+    this.searchCapabilityRefetchTimer.unref?.();
+  }
+  /**
+   * A refetch re-renders skills.json (owner_dm_search_cap counts web_extract only with the capability, D39) and posts
+   * the report. Needed under a manifest in force, or when the reported value is stale. Never before the boot fetch.
+   */
+  searchCapabilityRefetchNeeded() {
+    if (!this.bootConfigSettled || this.closingDown) return false;
+    const inForce = (this.cfg.ownerGrantPin?.pin ?? null) !== null && this.toolGrantManifest !== null;
+    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable();
+  }
+  /**
+   * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
+   * so a policy is never written ahead of its skills.json. Narrowing never waits: with no binding in force, a file that
+   * lists web_extract loses it at once, so an older runtime never reads it as unreadable (which drops every grant).
+   * Content-free; a write failure is logged and the debounced refetch tries again.
+   */
+  recomputeManifestPolicy(capable) {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const manifest = pin !== null ? this.toolGrantManifest : null;
+    try {
+      if (manifest !== null && this.manifestBinding !== null && this.manifestBinding.counter === manifest.counter) {
+        this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, capable));
+        return;
+      }
+      if (capable) return;
+      const path = join17(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
+      if (!existsSync5(path)) return;
+      let doc;
+      try {
+        doc = JSON.parse(readFileSync10(path, "utf8"));
+      } catch {
+        return;
+      }
+      const tools = doc?.manifest_tools;
+      if (!Array.isArray(tools) || !tools.includes("web_extract")) return;
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, {
+        v: 1,
+        manifest_tools: tools.filter((t) => typeof t === "string" && t !== "web_extract"),
+        secret_path_mode: "enforce"
+      });
+    } catch (e) {
+      writeServiceLog2("warn", "authz.search_capability", { state: ServiceLogEnum.of("policy_write_failed", ["policy_write_failed"]) }, e);
+    }
+  }
   noteConsumerCapability(state) {
     this.lastConsumerCapability = state;
     if (state !== "ok") {
@@ -42709,6 +42889,8 @@ ${channelId}`;
     this.supersedeRecheckTimers.clear();
     if (this.redeliveryTimer !== null) clearTimeout(this.redeliveryTimer);
     this.redeliveryTimer = null;
+    if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
+    this.searchCapabilityRefetchTimer = null;
     this.pingHandle?.close();
     if (this.safetyTimer) clearInterval(this.safetyTimer);
     if (this.runtimeConfigTimer) clearInterval(this.runtimeConfigTimer);
@@ -42818,11 +43000,33 @@ ${channelId}`;
 };
 
 // src/config.ts
-import { readFileSync as readFileSync10, statSync as statSync5 } from "node:fs";
+import { readFileSync as readFileSync11, statSync as statSync5 } from "node:fs";
 import { dirname as dirname6, join as join18 } from "node:path";
 var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
+var CONFIG_ERROR_MESSAGE = {
+  credential_not_found: "credential file not found",
+  credential_unreadable: "credential file could not be read",
+  credential_not_json: "credential file is not valid JSON",
+  credential_missing_field: "credential file missing required field",
+  credential_voice_invalid: "credential file voice config invalid"
+};
+var ConfigError = class extends Error {
+  constructor(reason, field, source) {
+    super(CONFIG_ERROR_MESSAGE[reason] + (field ? `: ${field}` : ""));
+    this.reason = reason;
+    this.field = field;
+    this.source = source;
+    this.name = "ConfigError";
+  }
+};
 function loadConfig(opts) {
-  const raw = readFileSync10(opts.credentialPath, "utf8");
+  let raw;
+  try {
+    raw = readFileSync11(opts.credentialPath, "utf8");
+  } catch (e) {
+    const code = e?.code;
+    throw new ConfigError(code === "ENOENT" ? "credential_not_found" : "credential_unreadable");
+  }
   try {
     const mode = statSync5(opts.credentialPath).mode & 511;
     if (mode & 63) writeServiceLog2("warn", "config.credential_permissions_unsafe");
@@ -42832,9 +43036,9 @@ function loadConfig(opts) {
   try {
     json2 = JSON.parse(raw);
   } catch {
-    throw new Error("credential file is not valid JSON");
+    throw new ConfigError("credential_not_json");
   }
-  for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new Error(`credential file missing required field: ${k}`);
+  for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new ConfigError("credential_missing_field", k);
   const storePath = opts.storePath ?? join18(dirname6(opts.credentialPath), "bridge-state.db");
   const ownerGrantPin = loadOwnerGrantPin({ credentialPath: opts.credentialPath, credentialJson: json2 });
   writeServiceLog2(ownerGrantPin.state === "ok" || ownerGrantPin.state === "no_pin" ? "info" : "warn", "authz.pin", {
@@ -42872,8 +43076,14 @@ function loadConfig(opts) {
   let voice;
   try {
     voice = parseVoiceConfig(json2.voice, process.env);
-  } catch (e) {
-    throw new Error(`credential file voice config invalid: ${e.message}`);
+  } catch {
+    let source = "env";
+    try {
+      parseVoiceConfig(json2.voice, {});
+    } catch {
+      source = "file";
+    }
+    throw new ConfigError("credential_voice_invalid", void 0, source);
   }
   const modelSource = json2.memory?.model_source === "import_only" ? "import_only" : "download";
   const enabledRaw = json2.memory?.enabled;
@@ -42942,11 +43152,11 @@ import { z as z3 } from "zod";
 
 // src/auth.ts
 import { randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync6(f)) return readFileSync11(f, "utf8").trim();
+  if (f && existsSync6(f)) return readFileSync12(f, "utf8").trim();
   const tok = randomBytes11(32).toString("base64url");
   if (f) writeFileSync2(f, tok, { mode: 384 });
   return tok;
@@ -43042,6 +43252,7 @@ function withConsumerGrants(m, perToolConsumer) {
   return { ...m, authorization: Object.freeze({ ...rest, ...stripGrants ? { tool_grants: NO_GRANTS } : {} }) };
 }
 var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
 var CONSTANT_TOOL_NAMES = Object.freeze({
   owner_dm: Object.freeze(["current_time", "web_search"]),
   team_room: Object.freeze(["current_time"])
@@ -43064,6 +43275,15 @@ function withHarnessGrants(m, withheld) {
   if (!a || a.tool_grants.length === 0) return m;
   return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
 }
+function withSearchCapability(m, consumerHasFeature, signedProvider) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const stripSearch = signedProvider !== void 0 && signedProvider !== "brave";
+  const kept = a.tool_grants.filter((g) => g.tool !== "web_extract" && !(stripSearch && g.tool === "web_search"));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
 
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
@@ -43086,7 +43306,8 @@ data: ${JSON.stringify(msgs[i])}
 }
 function deliverSseBatch(res, batch, agent, onWriteError) {
   const withheld = agent.harnessGrantsWithheld();
-  const left3 = writeSse(res, batch.map((m) => withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false)), onWriteError);
+  const provider = agent.signedSearchProvider();
+  const left3 = writeSse(res, batch.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)), onWriteError);
   const leftIds = new Set(left3.map((message) => message.message_id));
   agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
   if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
@@ -43357,7 +43578,10 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/messages") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
         const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
-        return json(res, 200, (await agent.drain(channel, wait)).map((m) => withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), agent.harnessGrantsWithheld()), false)));
+        const drained = await agent.drain(channel, wait);
+        const withheld = agent.harnessGrantsWithheld();
+        const provider = agent.signedSearchProvider();
+        return json(res, 200, drained.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -43531,6 +43755,7 @@ function attachAgentWebSocket(server, agent, opts) {
       consumer: "unknown",
       perToolGrants: false,
       manifestGrants: false,
+      searchProviders: false,
       // helloWaitMs 0 keeps today's synchronous initial flush exactly (the opt-out the existing tests use).
       deliveryOpen: helloWaitMs <= 0,
       deliveryToken: /* @__PURE__ */ new Map(),
@@ -43584,9 +43809,13 @@ function attachAgentWebSocket(server, agent, opts) {
             continue;
           }
           const out = withConsumerNotes(
-            withManifestCapability(
-              withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
-              session.manifestGrants
+            withSearchCapability(
+              withManifestCapability(
+                withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
+                session.manifestGrants
+              ),
+              session.searchProviders,
+              agent.signedSearchProvider()
             ),
             batch[i],
             session,
@@ -43622,6 +43851,7 @@ function attachAgentWebSocket(server, agent, opts) {
     const cleanup = () => {
       if (cleaned) return;
       cleaned = true;
+      session.closed = true;
       if (helloTimer) clearTimeout(helloTimer);
       agent.noteSessionClose();
       unsubscribe();
@@ -43642,6 +43872,7 @@ function attachAgentWebSocket(server, agent, opts) {
       if (session.harness) agent.clearHarnessReport(session.harness);
       if (session.perToolGrants) agent.clearPerToolConsumer(session);
       if (session.manifestGrants) agent.clearManifestConsumer(session);
+      agent.clearSearchProvidersSocket(session);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -43717,6 +43948,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     return;
   }
   if (m.type === "hello") {
+    if (session.closed) return;
     const report = m.harness === void 0 ? null : parseHarnessReport(m.harness);
     if (report) {
       session.harness = report;
@@ -43740,6 +43972,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       agent.clearManifestConsumer(session);
     }
     agent.noteConsumerCapability(manifest ? "ok" : session.harnessClaimed ? "harness_consumer" : "missing");
+    session.searchProviders = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(SEARCH_PROVIDERS_FEATURE);
+    agent.noteSearchProvidersSocket(session, session.searchProviders);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -43747,7 +43981,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();

package/dist/preflight-upgrade.d.cts

@@ -1,3 +1,4 @@
+export declare const DIST_BASE = "https://nodejs.org/dist/latest-v24.x";
 export declare function parseShasums(text: string, arch: string): {
     filename: string;
     sha256: string;
@@ -14,8 +15,6 @@ export interface UpgradeDeps {
     isTTY: boolean;
     stderr: (s: string) => void;
     ask: (q: string) => Promise<string>;
-    hasBrew: () => boolean;
-    runBrew: () => number;
     fetchText: (url: string) => Promise<string>;
     fetchBinary: (url: string, destPath: string) => Promise<void>;
     fileSha256: (p: string) => string;