@securecoms/agent-bridge 0.30.1 → 0.30.3

package/dist/preflight.cjs

@@ -33,6 +33,7 @@ var init_resolve_node = __esm({
 // src/preflight-upgrade.cts
 var preflight_upgrade_exports = {};
 __export(preflight_upgrade_exports, {
+  DIST_BASE: () => DIST_BASE,
   guidedUpgrade: () => guidedUpgrade,
   parseShasums: () => parseShasums,
   promptYesNo: () => promptYesNo,
@@ -41,11 +42,10 @@ __export(preflight_upgrade_exports, {
   sha256Hex: () => sha256Hex
 });
 function parseShasums(text, arch) {
-  const want = "-darwin-" + arch + ".pkg";
   const lines = String(text).split("\n");
   for (let i = 0; i < lines.length; i++) {
     const m = lines[i].trim().match(/^([0-9a-f]{6,64})\s+(\S+)$/);
-    if (m && m[2].indexOf(want) !== -1 && m[2].indexOf("node-v24.") === 0) {
+    if (m && PKG_NAME.test(m[2])) {
       return { filename: m[2], sha256: m[1] };
     }
   }
@@ -62,48 +62,47 @@ async function promptYesNo(question, deps) {
 }
 async function guidedUpgrade(deps) {
   if (deps.platform !== "darwin") return false;
+  let consented = false;
+  const failed = () => {
+    if (consented) deps.stderr("[bridge] Couldn't install Node 24 from nodejs.org.\n");
+    return false;
+  };
   try {
     const existing = deps.existingCompatibleNode();
     if (existing) {
       deps.stderr(
-        "[bridge] Node " + deps.activeVersion + " is running, but a compatible Node (>= " + REQUIRED_NODE_MAJOR + ") is already installed at " + existing + " \u2014 it is shadowed earlier on your PATH. Continuing under it (no install needed).\n"
+        "[bridge] Using Node " + REQUIRED_NODE_MAJOR + " or newer found at " + existing + ". (The node command on this computer is an older version.)\n"
       );
       return deps.reexec(existing);
     }
-    const viaBrew = deps.hasBrew();
-    const source = viaBrew ? "Homebrew (brew install node \u2014 user-space, no sudo)" : "the official installer from " + DIST_BASE + " (needs your admin password)";
     const ok = await promptYesNo(
-      "[bridge] Node 24 LTS is required. Install it now via " + source + "? [y/N] ",
+      "[bridge] SecureComs needs Node 24. Install it now from nodejs.org? This needs your computer's administrator password. [y/N] ",
       deps
     );
     if (!ok) return false;
-    if (viaBrew) {
-      deps.stderr("[bridge] running: brew install node\n");
-      if (deps.runBrew() !== 0) return false;
-    } else {
-      const shasums = await deps.fetchText(DIST_BASE + "/SHASUMS256.txt");
-      const entry = parseShasums(shasums, deps.arch);
-      if (!entry) return false;
-      const dest = deps.tmpdir() + "/" + entry.filename;
-      deps.stderr("[bridge] downloading " + DIST_BASE + "/" + entry.filename + "\n");
-      try {
-        await deps.fetchBinary(DIST_BASE + "/" + entry.filename, dest);
-        if (deps.fileSha256(dest) !== entry.sha256) {
-          deps.stderr("[bridge] checksum mismatch \u2014 aborting install (file discarded)\n");
-          return false;
-        }
-        deps.stderr("[bridge] running: sudo installer -pkg " + entry.filename + " -target /\n");
-        if (deps.runSudoInstaller(dest) !== 0) return false;
-      } finally {
-        deps.cleanup(dest);
+    consented = true;
+    const shasums = await deps.fetchText(DIST_BASE + "/SHASUMS256.txt");
+    const entry = parseShasums(shasums, deps.arch);
+    if (!entry) return failed();
+    const dest = deps.tmpdir() + "/" + entry.filename;
+    deps.stderr("[bridge] downloading " + DIST_BASE + "/" + entry.filename + "\n");
+    try {
+      await deps.fetchBinary(DIST_BASE + "/" + entry.filename, dest);
+      if (deps.fileSha256(dest) !== entry.sha256) {
+        deps.stderr("[bridge] checksum mismatch \u2014 aborting install (file discarded)\n");
+        return failed();
       }
+      deps.stderr("[bridge] running: sudo installer -pkg " + entry.filename + " -target /\n");
+      if (deps.runSudoInstaller(dest) !== 0) return failed();
+    } finally {
+      deps.cleanup(dest);
     }
     const fresh = deps.resolveNewNode();
-    if (!fresh) return false;
+    if (!fresh) return failed();
     deps.stderr("[bridge] Node 24 installed \u2014 continuing under " + fresh + "\n");
     return deps.reexec(fresh);
   } catch {
-    return false;
+    return failed();
   }
 }
 function resolveNewNodeFrom(probe, candidates) {
@@ -152,11 +151,6 @@ function realUpgradeDeps(originalArgv) {
         resolve(a);
       });
     }),
-    hasBrew: () => spawnSync("brew", ["--version"], { stdio: "ignore" }).status === 0,
-    runBrew: () => {
-      var _a;
-      return (_a = spawnSync("brew", ["install", "node"], { stdio: "inherit" }).status) != null ? _a : 1;
-    },
     fetchText: async (url) => {
       const res = await fetch(url, 3);
       let out = "";
@@ -197,12 +191,13 @@ function realUpgradeDeps(originalArgv) {
     }
   };
 }
-var DIST_BASE, NODE_CANDIDATES;
+var DIST_BASE, PKG_NAME, NODE_CANDIDATES;
 var init_preflight_upgrade = __esm({
   "src/preflight-upgrade.cts"() {
     "use strict";
     init_resolve_node();
     DIST_BASE = "https://nodejs.org/dist/latest-v24.x";
+    PKG_NAME = /^node-v24\.\d+\.\d+\.pkg$/;
     NODE_CANDIDATES = [
       "/usr/local/bin/node",
       // nodejs.org pkg (stable across upgrades)
@@ -216,6 +211,7 @@ var init_preflight_upgrade = __esm({
 // src/preflight.cts
 var preflight_exports = {};
 __export(preflight_exports, {
+  NODE_FLOOR: () => NODE_FLOOR,
   effectiveVersion: () => effectiveVersion,
   instructionsBlock: () => instructionsBlock,
   meetsFloor: () => meetsFloor,
@@ -224,7 +220,6 @@ __export(preflight_exports, {
 });
 module.exports = __toCommonJS(preflight_exports);
 var NODE_FLOOR = 24;
-var FLOOR_REASON = "requires >= 24 (node:sqlite stable API)";
 function parseNodeMajor(version) {
   const n = Number(String(version).split(".")[0]);
   return Number.isFinite(n) && n > 0 ? n : 0;
@@ -239,23 +234,30 @@ function effectiveVersion(real, faked) {
   return real;
 }
 function instructionsBlock(platform, current) {
-  const lines = [
-    "[bridge] Node " + current + " is too old \u2014 SecureComs " + FLOOR_REASON + ".",
-    "",
-    "How to get Node 24 LTS:",
-    "  1. Official installer (recommended): https://nodejs.org \u2014 download the",
-    "     Node 24 LTS installer for your platform and run it."
-  ];
+  const n = String(NODE_FLOOR);
+  const head = "[bridge] This computer has Node " + current + ". SecureComs needs Node " + n + " or newer.";
+  let lines;
   if (platform === "darwin") {
-    lines.push("  2. Homebrew: brew install node");
+    lines = [
+      head,
+      "",
+      "To get Node " + n + ":",
+      "  1. Download the Node " + n + " LTS installer for macOS from https://nodejs.org and run it.",
+      "  2. Run the SecureComs install command again."
+    ];
+  } else if (platform === "win32") {
+    lines = [
+      head,
+      "",
+      "Install Node " + n + " from https://nodejs.org, then run the SecureComs install command again."
+    ];
+  } else {
+    lines = [
+      head,
+      "",
+      "Install Node " + n + " so that it is at /usr/local/bin/node or /usr/bin/node, then run the SecureComs install command again. See https://nodejs.org for options."
+    ];
   }
-  lines.push("  " + (platform === "darwin" ? "3" : "2") + ". nvm:      nvm install 24 && nvm use 24");
-  lines.push(
-    "",
-    "Then re-run the install command. (Always re-run the install command after",
-    "upgrading Node \u2014 the background service pins the Node path it was",
-    "installed with.)"
-  );
   return lines.join("\n") + "\n";
 }
 async function runPreflight(deps) {
@@ -292,6 +294,7 @@ if (require.main === module) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  NODE_FLOOR,
   effectiveVersion,
   instructionsBlock,
   meetsFloor,

package/dist/preflight.d.cts

@@ -1,4 +1,18 @@
 #!/usr/bin/env node
+/**
+ * CommonJS preflight shim — the package's bin entry. CJS on purpose: any
+ * Node back to v10 can parse it, so a machine with stale Node always gets
+ * the friendly diagnosis instead of an ESM/builtin crash (static imports in
+ * the ESM bundle hoist — node:sqlite would detonate before any guard ran).
+ * Built with esbuild format=cjs target=node10 to dist/preflight.cjs.
+ *
+ * AUDIT C1: this file must contain ZERO dynamic `import()` — esbuild's
+ * node10 downlevel would turn it into require() (cannot load ESM), and
+ * keeping the syntax breaks node10 parse. The real import lives in
+ * preflight-modern.cts, which is only require()d AFTER the gate passes.
+ * An artifact test greps the emitted file to pin this.
+ */
+export declare const NODE_FLOOR = 24;
 export declare function parseNodeMajor(version: string): number;
 export declare function meetsFloor(version: string): boolean;
 export declare function effectiveVersion(real: string, faked: string | undefined): string;

package/dist/service/credential-arg.d.ts

@@ -0,0 +1,23 @@
+/**
+ * How `--credential` is read for `install` and run mode (spec 2026-10-15
+ * §5.3, OQ-18 (b)). A flag that is present with an empty value means "no key
+ * file": it never falls back to SECURECOMS_CREDENTIAL, so a copied command
+ * whose Downloads lookup found nothing cannot silently pick up a different
+ * agent's key file from the environment. The variable is used only when the
+ * flag is absent. Every other flag keeps argOrEnv's behaviour.
+ */
+export type CredentialArg = {
+    kind: "path";
+    path: string;
+} | {
+    kind: "empty_flag";
+} | {
+    kind: "absent";
+};
+export declare function readCredentialArg(argv: string[], env: NodeJS.ProcessEnv): CredentialArg;
+/**
+ * The one line printed when no key file was given: E8 for run mode
+ * (approved), E9 for install (DRAFT: the approved E9 names the agent, which
+ * the bridge cannot know when no key file was found).
+ */
+export declare function noCredentialLine(verb: "run" | "install"): string;

package/dist/service/install.d.ts

@@ -13,7 +13,14 @@ export interface ServiceDeps {
     mkdirp: (path: string) => void;
     fileExists: (path: string) => boolean;
     user: string;
+    /** kill(pid, 0): true while the process runs (EPERM counts as running). */
+    pidAlive: (pid: number) => boolean;
+    /** Blocking sleep: installService is synchronous end to end. */
+    sleepMs: (ms: number) => void;
+    now: () => number;
 }
+/** How long install waits for the previous bridge to exit after bootout. */
+export declare const PREVIOUS_EXIT_WAIT_MS = 10000;
 export interface InstallResult {
     label: string;
     filePath: string;

package/dist/service/resolve-node.d.ts

@@ -7,6 +7,7 @@ export interface ResolveNodeDeps {
     arch: () => string;
     archOf: (p: string) => string | null;
 }
+export declare const STABLE_LOCATIONS: readonly string[];
 export declare function resolveStableNodePath(runningExecPath: string, deps: ResolveNodeDeps): {
     path: string;
     stable: boolean;

package/dist/service/runtime-config-dir.d.ts

@@ -49,6 +49,10 @@ export interface LocalReport {
     persona: Record<string, string>;
     has_search_key: boolean;
     has_llm_key: boolean;
+    /** L-2 (spec §7.9): a readable key for an extract-capable provider. Only a real true counts; absent is false. */
+    has_extract_provider: boolean;
+    /** D39: the owner-DM daily search cap the runtime enforces; an integer in [0, 2000], otherwise undefined. */
+    owner_dm_search_cap_effective?: number;
     legacy_memory: LegacyMemoryReport[];
     /** §B.4 counts; undefined when the runtime reported none or the block was malformed. */
     secret_paths?: SecretPathsReport;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.30.1";
+export declare const BRIDGE_VERSION = "0.30.3";

package/dist/ws-server.d.ts

@@ -51,7 +51,7 @@ export declare const MEMORY_UNIFIED_FEATURE = "memory_unified";
  * fake against this list at run time (7b gate fix: a member added here without
  * a fake made three tests throw "is not a function").
  */
-export declare const WS_AGENT_MEMBERS: readonly ["ackRuntimeMessages", "action", "admitRuntimeDelivery", "applyMemoryNote", "clearHarnessReport", "clearManifestConsumer", "clearPerToolConsumer", "harnessGrantsWithheld", "isRuntimeMessageRetired", "noteConsumerCapability", "noteManifestConsumer", "noteRoomCapReached", "noteNotesConsumer", "notePerToolConsumer", "noteRecallConsumer", "noteUnifiedConsumer", "noteSessionClose", "noteSessionEvicted", "noteSessionOpen", "notesAppliedGeneration", "notesForDelivery", "recallForDelivery", "unifiedFeatureOn", "unifiedForDelivery", "recordHarnessReport", "recordRuntimeReply", "reportStatusGated", "requeueFailedRuntimeDeliveries", "requeueFront", "runtimeReplyReceipt", "send", "sendA2A", "subscribe", "takeDeliverable", "wakeListeners"];
+export declare const WS_AGENT_MEMBERS: readonly ["ackRuntimeMessages", "action", "admitRuntimeDelivery", "applyMemoryNote", "clearHarnessReport", "clearManifestConsumer", "clearPerToolConsumer", "clearSearchProvidersSocket", "harnessGrantsWithheld", "signedSearchProvider", "isRuntimeMessageRetired", "noteConsumerCapability", "noteManifestConsumer", "noteRoomCapReached", "noteSearchProvidersSocket", "noteNotesConsumer", "notePerToolConsumer", "noteRecallConsumer", "noteUnifiedConsumer", "noteSessionClose", "noteSessionEvicted", "noteSessionOpen", "notesAppliedGeneration", "notesForDelivery", "recallForDelivery", "unifiedFeatureOn", "unifiedForDelivery", "recordHarnessReport", "recordRuntimeReply", "reportStatusGated", "requeueFailedRuntimeDeliveries", "requeueFront", "runtimeReplyReceipt", "send", "sendA2A", "subscribe", "takeDeliverable", "wakeListeners"];
 export type WsAgent = Pick<BridgeAgent, (typeof WS_AGENT_MEMBERS)[number]>;
 export declare function attachAgentWebSocket(server: HttpServer, agent: WsAgent, opts: AgentWebSocketOptions): {
     close(): void;

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.30.1",
+  "version": "0.30.3",
   "type": "module",
   "engines": {
-    "node": ">=22.5.0"
+    "node": ">=24"
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",