@securecoms/agent-bridge 0.30.2 → 0.30.3

package/dist/bin.js

@@ -7556,7 +7556,7 @@ __export(import_bundle_exports, {
   importModelBundle: () => importModelBundle
 });
 import { createHash as createHash6, randomBytes as randomBytes12 } from "node:crypto";
-import { readFileSync as readFileSync15, statSync as statSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { readFileSync as readFileSync16, statSync as statSync7, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join24 } from "node:path";
 async function importModelBundle(srcDir, root3, m) {
   const verified = [];
@@ -7574,7 +7574,7 @@ async function importModelBundle(srcDir, root3, m) {
     if (size !== f.size) throw mismatch;
     let bytes;
     try {
-      bytes = readFileSync15(src);
+      bytes = readFileSync16(src);
     } catch {
       throw new ModelImportError(`${f.name} is missing from the import directory`);
     }
@@ -29882,7 +29882,7 @@ function loadPackageMeta(importMetaUrl) {
 }
 
 // src/bridge-agent.ts
-import { existsSync as existsSync5, promises as fsp, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync5, promises as fsp, readFileSync as readFileSync11, statSync as statSync5 } from "node:fs";
 import { join as join19, dirname as dirname7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -34397,6 +34397,15 @@ import {
   writeFileSync
 } from "node:fs";
 import { basename as basename4, isAbsolute, join as join18 } from "node:path";
+
+// src/grants/search-providers.ts
+var SEARCH_PROVIDERS = /* @__PURE__ */ new Set(["brave", "tavily", "parallel", "exa", "firecrawl"]);
+var OWNER_DM_SEARCH_DAILY_CAP_MAX = 2e3;
+function isSearchProvider(value) {
+  return typeof value === "string" && SEARCH_PROVIDERS.has(value);
+}
+
+// src/service/runtime-config-dir.ts
 var MEMORY_FILE = "MEMORY.md";
 var REAL_FS = {
   mkdir: (p, mode) => mkdirSync5(p, { recursive: true, mode }),
@@ -34579,10 +34588,14 @@ function readLocalReport(home, identityId) {
   const persona = raw && typeof raw === "object" && !Array.isArray(raw) ? Object.fromEntries(
     Object.entries(raw).filter(([, v]) => typeof v === "string")
   ) : {};
+  const capRaw = doc.owner_dm_search_cap_effective;
+  const ownerDmCap = typeof capRaw === "number" && Number.isInteger(capRaw) && capRaw >= 0 && capRaw <= OWNER_DM_SEARCH_DAILY_CAP_MAX ? capRaw : void 0;
   return {
     persona,
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
+    has_extract_provider: doc.has_extract_provider === true,
+    ...ownerDmCap !== void 0 ? { owner_dm_search_cap_effective: ownerDmCap } : {},
     legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source),
     secret_paths: parseSecretPathsReport(doc.secret_paths)
   };
@@ -34700,7 +34713,8 @@ import { sha256 as sha25611 } from "@noble/hashes/sha256";
 import { ed25519 as ed255195 } from "@noble/curves/ed25519";
 var TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
 var MANIFEST_KNOWN_TOOLS = Object.freeze({
-  owner_dm: Object.freeze(["web_search", "fetch_url", "http_request", "sql_query"]),
+  owner_dm: Object.freeze(["web_search", "web_extract", "fetch_url", "http_request", "sql_query"]),
+  // web_extract: owner DM only, never team_room (spec §5.4, D5)
   team_room: Object.freeze(["web_search"])
 });
 function manifestSignedBytes(manifest) {
@@ -34775,7 +34789,11 @@ function parseConfig(v) {
   }
   if ("search" in v) {
     const sr = v.search;
-    if (!isPlainObject(sr) || !exactKeys(sr, ["provider"]) || sr.provider !== "brave" && sr.provider !== "tavily") return null;
+    if (!isPlainObject(sr) || !exactKeys(sr, ["provider"], ["owner_dm_daily_cap"]) || !isSearchProvider(sr.provider)) return null;
+    if ("owner_dm_daily_cap" in sr) {
+      const cap = sr.owner_dm_daily_cap;
+      if (typeof cap !== "number" || !Number.isSafeInteger(cap) || cap < 0 || cap > OWNER_DM_SEARCH_DAILY_CAP_MAX) return null;
+    }
   }
   const mem = v.memory;
   if (!isPlainObject(mem) || !exactKeys(mem, ["mode"], ["recall_days"])) return null;
@@ -34785,7 +34803,12 @@ function parseConfig(v) {
   return Object.freeze({
     persona_sha256: v.persona_sha256,
     ...isPlainObject(v.llm) ? { llm: Object.freeze({ provider: v.llm.provider, model: v.llm.model }) } : {},
-    ...isPlainObject(v.search) ? { search: Object.freeze({ provider: v.search.provider }) } : {},
+    ...isPlainObject(v.search) ? {
+      search: Object.freeze({
+        provider: v.search.provider,
+        ..."owner_dm_daily_cap" in v.search ? { owner_dm_daily_cap: v.search.owner_dm_daily_cap } : {}
+      })
+    } : {},
     ...isStringArray(v.tools_allow) ? { tools_allow: Object.freeze([...v.tools_allow]) } : {},
     flags: Object.freeze([...v.flags]),
     memory: Object.freeze({ mode: mem.mode, ..."recall_days" in mem ? { recall_days: mem.recall_days } : {} }),
@@ -35016,7 +35039,20 @@ function bindTargets(raw, signed, equals) {
   }
   return { written, mismatches };
 }
-function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }) {
+function signedManifestTools(manifest, audience, searchProvidersCapable) {
+  return MANIFEST_KNOWN_TOOLS[audience].filter((t) => (manifest.grants[audience] ?? []).includes(t) && (t !== "web_extract" || searchProvidersCapable));
+}
+function manifestPolicyFor(manifest, switches, searchProvidersCapable) {
+  return {
+    v: 1,
+    manifest_tools: [.../* @__PURE__ */ new Set([
+      ...switches.ownerDm ? signedManifestTools(manifest, "owner_dm", searchProvidersCapable) : [],
+      ...switches.room ? signedManifestTools(manifest, "team_room", searchProvidersCapable) : []
+    ])].sort(),
+    secret_path_mode: "enforce"
+  };
+}
+function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }, searchProvidersCapable = false) {
   const mismatches = /* @__PURE__ */ new Set();
   const cfg = manifest.config;
   const out = {};
@@ -35045,6 +35081,7 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
   for (const name of Object.keys(files)) {
     if (name !== LLM_SOURCE && !PERSONA_FILES.includes(name)) mismatches.add("files");
   }
+  const ownerDmTools = signedManifestTools(manifest, "owner_dm", searchProvidersCapable);
   const sj = isObj2(payload.skills_json) ? payload.skills_json : void 0;
   const eps = bindTargets(sj?.endpoints, manifest.endpoints, endpointEquals);
   const dbs = bindTargets(sj?.databases, manifest.databases, databaseEquals);
@@ -35062,14 +35099,20 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     appliedSearch = searchBlock;
   } else {
     mismatches.add("search");
-    searchBlock = (prior.search?.provider ?? void 0) === cfg.search?.provider ? prior.search : void 0;
+    const usablePrior = cfg.search !== void 0 && prior.search?.provider === cfg.search.provider ? prior.search : void 0;
+    searchBlock = cfg.search === void 0 ? void 0 : usablePrior ?? Object.freeze({ provider: cfg.search.provider });
   }
   const skillsDoc = {
     endpoints: eps.written,
     databases: dbs.written,
     flags: [...cfg.flags],
     ...deny !== void 0 || cfg.tools_allow !== void 0 ? { tools: { ...deny !== void 0 ? { deny } : {}, ...cfg.tools_allow !== void 0 ? { allow: [...cfg.tools_allow] } : {} } } : {},
-    ...searchBlock ? { search: searchBlock } : {}
+    ...searchBlock ? { search: searchBlock } : {},
+    // D31: the marker the runtime keys D24 (iii) on; written under every manifest, true when config.search is signed.
+    search_signed: cfg.search !== void 0,
+    // D36, D39: the signed owner-DM cap, only when the owner-DM switch is on and the manifest grants an owner-DM tool;
+    // otherwise none, so the runtime clamps a signed raise to the default. Never read from the payload.
+    ...cfg.search?.owner_dm_daily_cap !== void 0 && switches.ownerDm && ownerDmTools.length > 0 ? { owner_dm_search_cap: cfg.search.owner_dm_daily_cap } : {}
   };
   out["skills.json"] = JSON.stringify(skillsDoc, null, 2) + "\n";
   const signedMemory = { mode: cfg.memory.mode, ...cfg.memory.recall_days !== void 0 ? { recall_days: cfg.memory.recall_days } : {} };
@@ -35100,12 +35143,7 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     mismatches.add("legacy_assign");
     legacyDecisions = decisions.filter((d) => isObj2(d) && d.action === "delete");
   }
-  const signedTools = (a) => MANIFEST_KNOWN_TOOLS[a].filter((t) => (manifest.grants[a] ?? []).includes(t));
-  const policy = {
-    v: 1,
-    manifest_tools: [.../* @__PURE__ */ new Set([...switches.ownerDm ? signedTools("owner_dm") : [], ...switches.room ? signedTools("team_room") : []])].sort(),
-    secret_path_mode: "enforce"
-  };
+  const policy = manifestPolicyFor(manifest, switches, searchProvidersCapable);
   return {
     mismatches: CONFIG_BINDING_FIELDS.filter((f) => mismatches.has(f)).sort(),
     targetMismatches: { endpoint: eps.mismatches, database: dbs.mismatches },
@@ -35244,6 +35282,8 @@ var TOOL_ROOM_CLASSES = Object.freeze({
   current_time: Object.freeze(["room_safe_read"]),
   echo: Object.freeze(["room_safe_read"]),
   web_search: Object.freeze(["owner_credential"]),
+  web_extract: Object.freeze(["owner_credential", "egress"]),
+  // D5: spends the owner's key and sends URLs out
   fetch_url: Object.freeze(["egress"]),
   sql_query: Object.freeze(["owner_credential"]),
   http_request: Object.freeze(["owner_credential", "egress", "side_effect"])
@@ -35665,6 +35705,8 @@ function hexToBytes4(h) {
   return new Uint8Array(Buffer.from(h, "hex"));
 }
 var BOOT_DRAIN_WAIT_MS_DEFAULT = 6e4;
+var SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS = 1e3;
+var SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS = 1e4;
 var BootDrainRotationRefusedError = class extends Error {
   constructor() {
     super("key-package rotation refused: the boot drain has not settled");
@@ -35860,6 +35902,8 @@ var BridgeAgent = class _BridgeAgent {
     this.actionClock = deps.actionThrottleNow ?? Date.now;
     this.rng = deps.rng ?? Math.random;
     this.bootDrainWaitMs = deps.bootDrainWaitMs ?? BOOT_DRAIN_WAIT_MS_DEFAULT;
+    this.searchCapabilityRefetchDebounceMs = deps.searchCapabilityRefetchDebounceMs ?? SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS;
+    this.searchCapabilityRefetchMaxWaitMs = deps.searchCapabilityRefetchMaxWaitMs ?? SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS;
     this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve4) => {
       const t = setTimeout(resolve4, ms);
       t.unref?.();
@@ -36298,6 +36342,8 @@ var BridgeAgent = class _BridgeAgent {
   bootSweepTimer;
   rng;
   bootDrainWaitMs;
+  searchCapabilityRefetchDebounceMs;
+  searchCapabilityRefetchMaxWaitMs;
   /** Resolved (and cleared) each time an ingest cycle settles: see start(). */
   ingestSettledWaiters = [];
   /** The boot key-package publish, when start() had to defer it. Test seam. */
@@ -36743,9 +36789,14 @@ var BridgeAgent = class _BridgeAgent {
       }
       const skillsJson = payload.skills_json ?? {};
       if (version && inForce === null) {
+        let asDelivered = skillsJson;
+        if (skillsJson !== null && typeof skillsJson === "object" && !Array.isArray(skillsJson)) {
+          const { owner_dm_search_cap: _cap, search_signed: _signed, ...rest } = skillsJson;
+          asDelivered = rest;
+        }
         this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, {
           ...payload.files ?? {},
-          "skills.json": `${JSON.stringify(skillsJson, null, 2)}
+          "skills.json": `${JSON.stringify(asDelivered, null, 2)}
 `
         });
       }
@@ -36800,7 +36851,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     let bound;
     try {
-      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants });
+      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable());
     } catch (e) {
       bound = null;
       return this.bindFailed(manifest, payload.memory, e);
@@ -36819,9 +36870,9 @@ var BridgeAgent = class _BridgeAgent {
       return true;
     }
     try {
-      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, bound.policy);
       this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, bound.files);
       if (manifest.config.llm === void 0) this.grantWriters.removeManagedLlmSource(this.home, this.cfg.identityId);
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable()));
     } catch (e) {
       this.manifestBinding = null;
       throw e;
@@ -36874,6 +36925,7 @@ var BridgeAgent = class _BridgeAgent {
   /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
   async postRuntimeConfigReport(base, version, skillsJson) {
     const local = readLocalReport(this.home, this.cfg.identityId);
+    const reportedSearchProviders = this.searchProvidersCapable();
     const report = {
       applied_version: version,
       paths: checkConfiguredPaths(skillsJson),
@@ -36888,6 +36940,13 @@ var BridgeAgent = class _BridgeAgent {
       // to the backend. The backend needs it to generate a truthful tool
       // paragraph, so it rides along here.
       has_search_key: local?.has_search_key ?? false,
+      // L-2 (spec §7.9): only the runtime knows whether an extract-capable provider key is readable; never derived
+      // from has_search_key. An older runtime omits it: false.
+      // Final review I-2 (controller ruling): AND the current search_providers_v2, so the web never shows extract while
+      // the bridge withholds web_extract from the runtime.
+      has_extract_provider: (local?.has_extract_provider ?? false) && reportedSearchProviders,
+      // D39: the owner-DM daily cap the runtime enforces, passed through when it reported a valid one; never the signed value.
+      ...local?.owner_dm_search_cap_effective !== void 0 ? { owner_dm_search_cap_effective: local.owner_dm_search_cap_effective } : {},
       // Same idea, for the BYOK LLM key file: only the runtime can see
       // whether one is configured in its own environment.
       has_llm_key: local?.has_llm_key ?? false,
@@ -36927,7 +36986,11 @@ var BridgeAgent = class _BridgeAgent {
         // Plan 4 Task 15 (OQ-5): sorted, unique enums; capability is the latest hello's class.
         config_binding_mismatches: [...this.configBindingMismatches],
         target_mismatches: ["database", "endpoint"].filter((k) => this.targetMismatches[k] > 0),
-        capability: this.lastConsumerCapability
+        capability: this.lastConsumerCapability,
+        // D28 (§11.1 step 3): a separate key, never a value in the capability enum. False with no runtime attached.
+        search_providers_v2: reportedSearchProviders,
+        // D19 item 4: content-free; the signed provider is one the attached runtime(s) cannot honour.
+        search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders)
       }
     };
     const reportedVerifyFailures = this.ownerVerifyFailures;
@@ -36948,6 +37011,7 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
+    this.lastReportedSearchProviders = reportedSearchProviders;
     if (version) writeServiceLog("info", "runtime_config.applied", { version });
     else writeServiceLog("info", "runtime_config.legacy_memory_reported");
   }
@@ -37017,6 +37081,7 @@ var BridgeAgent = class _BridgeAgent {
     this.startedAt = Date.now();
     await this.restoreRuntimeInbox();
     await this.loadToolGrantState();
+    this.recomputeManifestPolicy(false);
     try {
       this.store.pruneRoomSearchCap(utcDayOf(Date.now()));
     } catch (e) {
@@ -42808,6 +42873,115 @@ ${channelId}`;
   manifestConsumerAttached() {
     return this.manifestConsumer !== null;
   }
+  /**
+   * D28 (B-4): every socket that said hello, with whether its latest hello declared search_providers_v2 on the
+   * manifest_grants_v1 predicate (ws-server.ts). The agent value is the AND over all of them, absent (false) with
+   * none: unlike manifestConsumer, never newest wins. The per-delivery filter judges each socket by its own hello.
+   */
+  searchProvidersSockets = /* @__PURE__ */ new Map();
+  /**
+   * The D28 value the files were last recomputed for; null until the first socket observation, so that observation
+   * always recomputes (final review I-1), even when it is non-capable.
+   */
+  searchProvidersState = null;
+  searchCapabilityRefetchTimer = null;
+  /** When the current burst's first change happened (valid while the timer is set). */
+  searchCapabilityBurstStart = 0;
+  /** The D28 value in the last report posted (null until one is); a change needs a refetch to reach the web. */
+  lastReportedSearchProviders = null;
+  noteSearchProvidersSocket(token, declared) {
+    this.searchProvidersSockets.set(token, declared);
+    this.onSearchProvidersMaybeChanged();
+  }
+  clearSearchProvidersSocket(token) {
+    if (this.searchProvidersSockets.delete(token)) this.onSearchProvidersMaybeChanged();
+  }
+  /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
+  searchProvidersCapable() {
+    if (this.searchProvidersSockets.size === 0) return false;
+    for (const v of this.searchProvidersSockets.values()) if (!v) return false;
+    return true;
+  }
+  /**
+   * D19 item 3 (B-6): the search provider signed in the stored verified manifest in force (a pin loaded and a good
+   * manifest), never the server payload; undefined with no pin, no manifest, or no signed search block. The
+   * per-delivery filter (consumer-grants.ts withSearchCapability) and the S-28 report reason both read this.
+   */
+  signedSearchProvider() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    return pin !== null ? this.toolGrantManifest?.config.search?.provider : void 0;
+  }
+  /** D19 item 4, D34: the in-force signed provider is not brave, and the attached runtime(s) lack the capability. */
+  searchProviderUnsupported(capable) {
+    if (capable) return false;
+    const provider = this.signedSearchProvider();
+    return provider !== void 0 && provider !== "brave";
+  }
+  /**
+   * D35 (P-4): on a capability change, rewrite manifest-policy.json at once from the stored manifest, the kill
+   * switches and the new capability, then a debounced refetch (one per burst) only when needed.
+   */
+  onSearchProvidersMaybeChanged() {
+    const capable = this.searchProvidersCapable();
+    const prev = this.searchProvidersState;
+    if (capable === prev) return;
+    this.searchProvidersState = capable;
+    this.recomputeManifestPolicy(capable);
+    if (this.closingDown) return;
+    if (prev === null && !capable) return;
+    const now = Date.now();
+    if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
+    else this.searchCapabilityBurstStart = now;
+    const delay = Math.max(0, Math.min(this.searchCapabilityRefetchDebounceMs, this.searchCapabilityBurstStart + this.searchCapabilityRefetchMaxWaitMs - now));
+    this.searchCapabilityRefetchTimer = setTimeout(() => {
+      this.searchCapabilityRefetchTimer = null;
+      if (this.searchCapabilityRefetchNeeded()) void this.refetchRuntimeConfig();
+    }, delay);
+    this.searchCapabilityRefetchTimer.unref?.();
+  }
+  /**
+   * A refetch re-renders skills.json (owner_dm_search_cap counts web_extract only with the capability, D39) and posts
+   * the report. Needed under a manifest in force, or when the reported value is stale. Never before the boot fetch.
+   */
+  searchCapabilityRefetchNeeded() {
+    if (!this.bootConfigSettled || this.closingDown) return false;
+    const inForce = (this.cfg.ownerGrantPin?.pin ?? null) !== null && this.toolGrantManifest !== null;
+    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable();
+  }
+  /**
+   * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
+   * so a policy is never written ahead of its skills.json. Narrowing never waits: with no binding in force, a file that
+   * lists web_extract loses it at once, so an older runtime never reads it as unreadable (which drops every grant).
+   * Content-free; a write failure is logged and the debounced refetch tries again.
+   */
+  recomputeManifestPolicy(capable) {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const manifest = pin !== null ? this.toolGrantManifest : null;
+    try {
+      if (manifest !== null && this.manifestBinding !== null && this.manifestBinding.counter === manifest.counter) {
+        this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, capable));
+        return;
+      }
+      if (capable) return;
+      const path = join19(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
+      if (!existsSync5(path)) return;
+      let doc;
+      try {
+        doc = JSON.parse(readFileSync11(path, "utf8"));
+      } catch {
+        return;
+      }
+      const tools = doc?.manifest_tools;
+      if (!Array.isArray(tools) || !tools.includes("web_extract")) return;
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, {
+        v: 1,
+        manifest_tools: tools.filter((t) => typeof t === "string" && t !== "web_extract"),
+        secret_path_mode: "enforce"
+      });
+    } catch (e) {
+      writeServiceLog("warn", "authz.search_capability", { state: ServiceLogEnum.of("policy_write_failed", ["policy_write_failed"]) }, e);
+    }
+  }
   noteConsumerCapability(state) {
     this.lastConsumerCapability = state;
     if (state !== "ok") {
@@ -42999,6 +43173,8 @@ ${channelId}`;
     this.supersedeRecheckTimers.clear();
     if (this.redeliveryTimer !== null) clearTimeout(this.redeliveryTimer);
     this.redeliveryTimer = null;
+    if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
+    this.searchCapabilityRefetchTimer = null;
     this.pingHandle?.close();
     if (this.safetyTimer) clearInterval(this.safetyTimer);
     if (this.runtimeConfigTimer) clearInterval(this.runtimeConfigTimer);
@@ -43109,11 +43285,11 @@ ${channelId}`;
 
 // src/auth.ts
 import { randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync6(f)) return readFileSync11(f, "utf8").trim();
+  if (f && existsSync6(f)) return readFileSync12(f, "utf8").trim();
   const tok = randomBytes11(32).toString("base64url");
   if (f) writeFileSync2(f, tok, { mode: 384 });
   return tok;
@@ -43214,6 +43390,7 @@ function withConsumerGrants(m, perToolConsumer) {
   return { ...m, authorization: Object.freeze({ ...rest, ...stripGrants ? { tool_grants: NO_GRANTS } : {} }) };
 }
 var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
 var CONSTANT_TOOL_NAMES = Object.freeze({
   owner_dm: Object.freeze(["current_time", "web_search"]),
   team_room: Object.freeze(["current_time"])
@@ -43236,6 +43413,15 @@ function withHarnessGrants(m, withheld) {
   if (!a || a.tool_grants.length === 0) return m;
   return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
 }
+function withSearchCapability(m, consumerHasFeature, signedProvider) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const stripSearch = signedProvider !== void 0 && signedProvider !== "brave";
+  const kept = a.tool_grants.filter((g) => g.tool !== "web_extract" && !(stripSearch && g.tool === "web_search"));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
 
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
@@ -43258,7 +43444,8 @@ data: ${JSON.stringify(msgs[i])}
 }
 function deliverSseBatch(res, batch, agent, onWriteError) {
   const withheld = agent.harnessGrantsWithheld();
-  const left3 = writeSse(res, batch.map((m) => withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false)), onWriteError);
+  const provider = agent.signedSearchProvider();
+  const left3 = writeSse(res, batch.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)), onWriteError);
   const leftIds = new Set(left3.map((message) => message.message_id));
   agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
   if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
@@ -43529,7 +43716,10 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/messages") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
         const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
-        return json(res, 200, (await agent.drain(channel, wait)).map((m) => withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), agent.harnessGrantsWithheld()), false)));
+        const drained = await agent.drain(channel, wait);
+        const withheld = agent.harnessGrantsWithheld();
+        const provider = agent.signedSearchProvider();
+        return json(res, 200, drained.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -43703,6 +43893,7 @@ function attachAgentWebSocket(server, agent, opts) {
       consumer: "unknown",
       perToolGrants: false,
       manifestGrants: false,
+      searchProviders: false,
       // helloWaitMs 0 keeps today's synchronous initial flush exactly (the opt-out the existing tests use).
       deliveryOpen: helloWaitMs <= 0,
       deliveryToken: /* @__PURE__ */ new Map(),
@@ -43756,9 +43947,13 @@ function attachAgentWebSocket(server, agent, opts) {
             continue;
           }
           const out = withConsumerNotes(
-            withManifestCapability(
-              withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
-              session.manifestGrants
+            withSearchCapability(
+              withManifestCapability(
+                withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
+                session.manifestGrants
+              ),
+              session.searchProviders,
+              agent.signedSearchProvider()
             ),
             batch[i],
             session,
@@ -43794,6 +43989,7 @@ function attachAgentWebSocket(server, agent, opts) {
     const cleanup = () => {
       if (cleaned) return;
       cleaned = true;
+      session.closed = true;
       if (helloTimer) clearTimeout(helloTimer);
       agent.noteSessionClose();
       unsubscribe();
@@ -43814,6 +44010,7 @@ function attachAgentWebSocket(server, agent, opts) {
       if (session.harness) agent.clearHarnessReport(session.harness);
       if (session.perToolGrants) agent.clearPerToolConsumer(session);
       if (session.manifestGrants) agent.clearManifestConsumer(session);
+      agent.clearSearchProvidersSocket(session);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -43889,6 +44086,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     return;
   }
   if (m.type === "hello") {
+    if (session.closed) return;
     const report = m.harness === void 0 ? null : parseHarnessReport(m.harness);
     if (report) {
       session.harness = report;
@@ -43912,6 +44110,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       agent.clearManifestConsumer(session);
     }
     agent.noteConsumerCapability(manifest ? "ok" : session.harnessClaimed ? "harness_consumer" : "missing");
+    session.searchProviders = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(SEARCH_PROVIDERS_FEATURE);
+    agent.noteSearchProvidersSocket(session, session.searchProviders);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -43919,7 +44119,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
@@ -44145,7 +44345,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
 var LOWER_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 // src/bin.ts
-import { readFileSync as readFileSync16, mkdirSync as mkdirSync8, writeFileSync as writeFileSync5, rmSync as rmSync8, existsSync as existsSync7, realpathSync as realpathSync3, readdirSync as readdirSync4, statSync as statSync8, chmodSync as chmodSync6 } from "node:fs";
+import { readFileSync as readFileSync17, mkdirSync as mkdirSync8, writeFileSync as writeFileSync5, rmSync as rmSync8, existsSync as existsSync7, realpathSync as realpathSync3, readdirSync as readdirSync4, statSync as statSync8, chmodSync as chmodSync6 } from "node:fs";
 import { join as join25, dirname as dirname13, isAbsolute as isAbsolute3, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { homedir as homedir5, userInfo } from "node:os";
@@ -44358,7 +44558,8 @@ function installService(input, deps) {
     deps.writeFile(cfg.unitPath, renderSystemdUnit(cfg));
     deps.run("systemctl", ["--user", "daemon-reload"]);
     deps.run("loginctl", ["enable-linger", deps.user]);
-    requireOk(deps.run("systemctl", ["--user", "enable", "--now", cfg.unitName]), "systemctl --user enable --now");
+    requireOk(deps.run("systemctl", ["--user", "enable", cfg.unitName]), "systemctl --user enable");
+    requireOk(deps.run("systemctl", ["--user", "restart", cfg.unitName]), "systemctl --user restart");
     return { label: cfg.unitName, filePath: cfg.unitPath, logHint: `journalctl --user -u ${cfg.unitName} -f`, tokenHint: tokenHint(input) };
   }
   throw new ServiceUnsupportedError(`Service install isn't supported on ${deps.platform} yet. Run the agent in a terminal, or use a process manager.`);
@@ -45107,7 +45308,7 @@ function renderStatusTable(rows) {
 import {
   chmodSync as chmodSync5,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   renameSync as renameSync4,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync3
@@ -45119,7 +45320,7 @@ var REAL_FS2 = {
   chmod: (p, mode) => chmodSync5(p, mode),
   writeFile: (p, data, mode) => writeFileSync3(p, data, { mode }),
   rename: (a, b) => renameSync4(a, b),
-  readFile: (p) => readFileSync12(p, "utf8"),
+  readFile: (p) => readFileSync13(p, "utf8"),
   unlink: (p) => unlinkSync2(p)
 };
 function securecomsDir(home) {
@@ -45168,7 +45369,7 @@ function removeConnectionFileIfOwned(home, identityId, instanceId, deps = REAL_F
 
 // src/service/instance-lock.ts
 import { execFileSync } from "node:child_process";
-import { closeSync as closeSync4, fsyncSync, mkdirSync as mkdirSync7, openSync as openSync4, readFileSync as readFileSync13, statSync as statSync6, unlinkSync as unlinkSync3, utimesSync, writeSync as writeSync2 } from "node:fs";
+import { closeSync as closeSync4, fsyncSync, mkdirSync as mkdirSync7, openSync as openSync4, readFileSync as readFileSync14, statSync as statSync6, unlinkSync as unlinkSync3, utimesSync, writeSync as writeSync2 } from "node:fs";
 import { hostname, uptime as uptime2 } from "node:os";
 import { dirname as dirname11 } from "node:path";
 var LOCK_PARTIAL_WRITE_GRACE_MS = 1e4;
@@ -45182,7 +45383,7 @@ function errno(error) {
 }
 function readTrimmed(path) {
   try {
-    const v = readFileSync13(path, "utf8").trim();
+    const v = readFileSync14(path, "utf8").trim();
     return v === "" ? void 0 : v;
   } catch {
     return void 0;
@@ -45297,7 +45498,7 @@ var InstanceLock = class {
     if (!this.held) return false;
     let current;
     try {
-      current = readFileSync13(this.path, "utf8");
+      current = readFileSync14(this.path, "utf8");
     } catch {
       current = void 0;
     }
@@ -45315,7 +45516,7 @@ var InstanceLock = class {
     let ageMs;
     this.env.beforeLockRead?.();
     try {
-      raw = readFileSync13(this.path, "utf8");
+      raw = readFileSync14(this.path, "utf8");
       ageMs = Date.now() - statSync6(this.path).mtimeMs;
     } catch (error) {
       if (errno(error) === "ENOENT") {
@@ -45356,7 +45557,7 @@ var InstanceLock = class {
     const written = this.written;
     this.drop();
     try {
-      if (written !== void 0 && readFileSync13(this.path, "utf8") === written) unlinkSync3(this.path);
+      if (written !== void 0 && readFileSync14(this.path, "utf8") === written) unlinkSync3(this.path);
     } catch {
     }
   }
@@ -45370,7 +45571,7 @@ var InstanceLock = class {
   took() {
     this.held = true;
     try {
-      this.written = readFileSync13(this.path, "utf8");
+      this.written = readFileSync14(this.path, "utf8");
     } catch {
       this.written = void 0;
     }
@@ -45452,7 +45653,7 @@ var InstanceLock = class {
       this.env.beforeTakeoverReread?.();
       let current;
       try {
-        current = readFileSync13(this.path, "utf8");
+        current = readFileSync14(this.path, "utf8");
       } catch {
         current = void 0;
       }
@@ -45466,7 +45667,7 @@ var InstanceLock = class {
       if (created !== "created") {
         if (created === "failed") return "failed";
         try {
-          this.holderPid = parseBody(readFileSync13(this.path, "utf8"))?.pid;
+          this.holderPid = parseBody(readFileSync14(this.path, "utf8"))?.pid;
         } catch {
         }
         return "held";
@@ -45492,7 +45693,7 @@ import {
   fsyncSync as fsyncSync2,
   lstatSync as lstatSync8,
   openSync as openSync5,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   realpathSync as realpathSync2,
   renameSync as renameSync5,
   unlinkSync as unlinkSync4,
@@ -45529,7 +45730,7 @@ function isSymlink(path) {
   }
 }
 function readJson(path) {
-  return JSON.parse(readFileSync14(path, "utf8"));
+  return JSON.parse(readFileSync15(path, "utf8"));
 }
 function publicKeyOf(v) {
   const r = parsePinObject(v);
@@ -45773,7 +45974,7 @@ function realResolveDeps() {
 }
 function realPrepDeps() {
   return {
-    readFile: (p) => readFileSync16(p, "utf8"),
+    readFile: (p) => readFileSync17(p, "utf8"),
     writeFileMode: (p, data, mode) => writeFileSync5(p, data, { mode }),
     mkdirp: (p, mode) => {
       mkdirSync8(p, { recursive: true, mode: mode ?? 493 });
@@ -45826,7 +46027,7 @@ function realReadFleet() {
         return [];
       }
     },
-    readFile: (p) => readFileSync16(p, "utf8")
+    readFile: (p) => readFileSync17(p, "utf8")
   });
 }
 function runStatus() {
@@ -45851,7 +46052,7 @@ function realCopyConnector(srcDir, dstDir, harness) {
     }
     if (name.includes(".test.")) continue;
     if (!allowedExt.some((ext) => name.endsWith(ext))) continue;
-    writeFileSync5(join25(dstDir, name), readFileSync16(srcPath));
+    writeFileSync5(join25(dstDir, name), readFileSync17(srcPath));
   }
 }
 function realWriteBinding(dstDir, identityId) {
@@ -45860,7 +46061,7 @@ function realWriteBinding(dstDir, identityId) {
 }
 function realReadBinding(dstDir) {
   try {
-    const parsed = JSON.parse(readFileSync16(join25(dstDir, "securecoms.binding.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync17(join25(dstDir, "securecoms.binding.json"), "utf8"));
     return parsed.identity_id ?? null;
   } catch {
     return null;
@@ -45878,7 +46079,7 @@ function realStatDir(p) {
 }
 function realReadHermesConfig(p) {
   try {
-    return readFileSync16(p, "utf8");
+    return readFileSync17(p, "utf8");
   } catch {
     return null;
   }
@@ -46268,7 +46469,7 @@ async function runMode(deps) {
     served = await deps.serve(agent, {
       token,
       allowOrigins: daemon.allowOrigins,
-      readTls: () => daemon.tls ? { cert: readFileSync16(daemon.tlsCert, "utf8"), key: readFileSync16(daemon.tlsKey, "utf8") } : void 0
+      readTls: () => daemon.tls ? { cert: readFileSync17(daemon.tlsCert, "utf8"), key: readFileSync17(daemon.tlsKey, "utf8") } : void 0
     });
   } catch (e) {
     if (!(e instanceof SessionSupersededError)) throw e;