@securecoms/agent-bridge 0.30.2 → 0.31.0

package/dist/index.js

@@ -29101,7 +29101,7 @@ function loadPackageMeta(importMetaUrl) {
 }
 
 // src/bridge-agent.ts
-import { existsSync as existsSync5, promises as fsp, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync5, promises as fsp, readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
 import { join as join17, dirname as dirname5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -33431,7 +33431,8 @@ var FastLlmClient = class {
       try {
         res = await this.fetchImpl(`${this.cfg.baseUrl}${this.cfg.path ?? "/chat/completions"}`, {
           method: "POST",
-          headers: { "content-type": "application/json", ...this.key ? { authorization: `Bearer ${this.key}` } : {} },
+          // Final fix T8: configured headers first, so they can never displace content-type or the bearer.
+          headers: { ...this.cfg.headers, "content-type": "application/json", ...this.key ? { authorization: `Bearer ${this.key}` } : {} },
           body: JSON.stringify({ model: this.cfg.model, messages, max_tokens: this.cfg.maxTokens, temperature: 0.4 }),
           signal: ac.signal
         });
@@ -33635,7 +33636,9 @@ function settingsToVoiceConfig(s, proxy) {
       model: "securecoms-fast",
       apiKey: proxy.apiKey,
       timeoutMs: 2500,
-      maxTokens: 80
+      maxTokens: 80,
+      // Spec 7.2: tells the proxy this bridge scopes voice turns. Sent to the SecureComs proxy only.
+      headers: { "x-securecoms-bridge-caps": "voice-scope-v1" }
     },
     settings: s
   };
@@ -33643,6 +33646,7 @@ function settingsToVoiceConfig(s, proxy) {
 
 // src/voice/persona.ts
 var CONTINUITY_CLAUSE = "The text messages in this chat and this voice call are one and the same ongoing conversation, and the earlier turns you can see ARE those messages. If asked whether you remember or received a message, answer from that history \u2014 never say you cannot access previous messages.";
+var VOICE_CALL_CLAUSE = "This is a live voice call. The earlier turns you can see are from this call only; during a call you cannot see the typed chat, saved notes or memory. If asked about a message, file or note you cannot see, say plainly that you can't see the chat while on a call and offer to pick it up in the chat afterwards. Never guess at what it said.";
 var schema = z2.object({
   persona: z2.object({
     display_name: z2.string().min(1).optional(),
@@ -33723,7 +33727,7 @@ function buildFastMessages(args2) {
   const sp = systemPrompt(args2.persona, args2.settings, args2.agentName);
   const head = sp.slice(0, sp.length - CONTINUITY_CLAUSE.length).trimEnd();
   const notesLine = args2.notesDeferLine ? ` ${FAST_NOTES_DEFER_LINE}` : "";
-  const system = `${head} ${args2.guidance.trim()}${notesLine} ${FAST_DEFER_RULE} ${CONTINUITY_CLAUSE}`;
+  const system = `${head} ${args2.guidance.trim()}${notesLine} ${FAST_DEFER_RULE} ${VOICE_CALL_CLAUSE}`;
   const recent = args2.memory.recent.map((t) => ({
     role: t.role === "agent" ? "assistant" : "user",
     content: t.text
@@ -33760,6 +33764,160 @@ function normalizeFastReply(raw, maxChars = 200, maxSentences = 2) {
   return sentences.slice(0, maxSentences).join(" ").slice(0, maxChars);
 }
 
+// src/voice/voice-scope.ts
+function isVoiceScopedTurn(t) {
+  return t.speaker !== void 0 || t.transcribed === true || t.senderIsRelay || t.text.trim() === VOICE_CALL_START_MARKER;
+}
+function admitsToCallBuffer(t) {
+  return t.speaker !== void 0 || t.transcribed === true;
+}
+
+// src/voice/call-buffer.ts
+var CALL_BUFFER_CAP = 50;
+var CALL_BUFFER_IDLE_MS = 30 * 6e4;
+var CALL_BUFFER_ID_CAP = 5e3;
+var CallBuffer = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  channels = /* @__PURE__ */ new Map();
+  /** messageId -> channelId, insertion ordered (oldest first) for the cap. */
+  voiceIds = /* @__PURE__ */ new Map();
+  /** messageId -> { channelId, the channel's bufSeq at the mark, the channel's generation then }. */
+  seqNotes = /* @__PURE__ */ new Map();
+  /**
+   * Final fix I-1: messageId -> { channelId, the channel's bufSeq just before the turn's own peer entry }. A row the
+   * backend redelivers (a failed ack, runtime_inbox.full backpressure) is ingested again; its id here means its text is
+   * already in the call, so it is not appended again and its snapshot stops before its own entry (A-6).
+   */
+  admitted = /* @__PURE__ */ new Map();
+  /** The last bufSeq handed out per channel (kept across resets, so the sequence never runs backwards). */
+  lastSeq = /* @__PURE__ */ new Map();
+  nextSeq = 1;
+  /** Per-channel reset generation (advanced by every reset, the idle rule included). */
+  gens = /* @__PURE__ */ new Map();
+  /**
+   * Append a spoken turn's text, once per turn id (final fix I-1). Returns false (and appends nothing) when the id was
+   * already admitted in this call, or when the buffer is disabled.
+   */
+  appendPeer(channelId, text, messageId) {
+    if (!this.opts.enabled) return false;
+    if (this.admittedAt(messageId) !== void 0) return false;
+    const before = this.seqAt(channelId);
+    this.append(channelId, { role: "peer", text });
+    this.admitted.set(messageId, { channelId, before });
+    if (this.admitted.size > CALL_BUFFER_ID_CAP) this.admitted.delete(this.admitted.keys().next().value);
+    return true;
+  }
+  /**
+   * Final fix I-1: for a turn already admitted in this call, the channel's bufSeq just before its own entry (the end seq
+   * of its first snapshot); undefined for a turn not admitted (or forgotten by a reset, the idle rule or the id cap).
+   */
+  admittedAt(messageId) {
+    const a = this.admitted.get(messageId);
+    if (a === void 0) return void 0;
+    this.expireIfIdle(a.channelId);
+    return this.admitted.get(messageId)?.before;
+  }
+  appendAgent(channelId, text, origin) {
+    this.append(channelId, { role: "agent", text, origin });
+  }
+  /**
+   * Record a voice-scoped turn's id (for reply admission only, A-4) and note the channel's seq at this point. Final fix
+   * I-1: a turn already admitted (a redelivered row) keeps the seq of its first admission, so the note never moves past
+   * the turn's own entry.
+   */
+  markVoiceScoped(channelId, messageId) {
+    if (!this.opts.enabled) return;
+    this.expireIfIdle(channelId);
+    this.voiceIds.delete(messageId);
+    this.voiceIds.set(messageId, channelId);
+    if (this.voiceIds.size > CALL_BUFFER_ID_CAP) this.voiceIds.delete(this.voiceIds.keys().next().value);
+    const seq = this.admittedAt(messageId) ?? this.seqAt(channelId);
+    this.seqNotes.delete(messageId);
+    this.seqNotes.set(messageId, { channelId, seq, generation: this.generation(channelId) });
+    if (this.seqNotes.size > CALL_BUFFER_ID_CAP) this.seqNotes.delete(this.seqNotes.keys().next().value);
+  }
+  /** A-4: read ONLY by the bridge's `afterPublish` reply admission. */
+  isVoiceScopedId(messageId) {
+    const channelId = this.voiceIds.get(messageId);
+    if (channelId === void 0) return false;
+    this.expireIfIdle(channelId);
+    return this.voiceIds.has(messageId);
+  }
+  /** The channel's mark noted when `messageId` was marked (the release re-read), or undefined (e.g. after a restart). */
+  seqNoted(messageId) {
+    const note = this.seqNotes.get(messageId);
+    if (note === void 0) return void 0;
+    this.expireIfIdle(note.channelId);
+    const kept = this.seqNotes.get(messageId);
+    return kept === void 0 ? void 0 : { seq: kept.seq, generation: kept.generation };
+  }
+  /** The bufSeq of the channel's newest entry (0 before any append). A snapshot's end seq. */
+  seqAt(channelId) {
+    this.expireIfIdle(channelId);
+    return this.lastSeq.get(channelId) ?? 0;
+  }
+  /**
+   * The channel's last `limit` entries, oldest first. With `upTo` (final fix I-1, a redelivered turn's re-snapshot),
+   * only entries at or below that bufSeq.
+   */
+  recent(channelId, limit, upTo) {
+    if (limit <= 0) return [];
+    this.expireIfIdle(channelId);
+    const all = this.channels.get(channelId)?.entries ?? [];
+    const entries = upTo === void 0 ? all : all.filter((e) => e.bufSeq <= upTo);
+    return entries.slice(-limit).map(deliver);
+  }
+  /**
+   * The channel's AGENT entries appended after `since.seq` (lines spoken or answered since a snapshot), oldest first.
+   * Final fix M-4: nothing when the channel has been reset since the mark (a later call's lines).
+   */
+  agentAfter(channelId, since) {
+    if (this.generation(channelId) !== since.generation) return [];
+    const entries = this.channels.get(channelId)?.entries ?? [];
+    return entries.filter((e) => e.role === "agent" && e.bufSeq > since.seq).map(deliver);
+  }
+  /**
+   * The channel's reset generation: it changes on every reset (explicit or idle) and on nothing else. A caller that
+   * holds text across an await (the coalesce window) compares it to skip an append into a call that has since ended.
+   */
+  generation(channelId) {
+    this.expireIfIdle(channelId);
+    return this.gens.get(channelId) ?? 0;
+  }
+  /** Clear the channel: its entries, its voice-scoped ids, its seq notes and its admitted ids. Only ever removes. */
+  reset(channelId) {
+    this.gens.set(channelId, (this.gens.get(channelId) ?? 0) + 1);
+    this.channels.delete(channelId);
+    for (const [id, c] of this.voiceIds) if (c === channelId) this.voiceIds.delete(id);
+    for (const [id, n] of this.seqNotes) if (n.channelId === channelId) this.seqNotes.delete(id);
+    for (const [id, a] of this.admitted) if (a.channelId === channelId) this.admitted.delete(id);
+  }
+  append(channelId, e) {
+    if (!this.opts.enabled) return;
+    this.expireIfIdle(channelId);
+    let ch = this.channels.get(channelId);
+    if (ch === void 0) {
+      ch = { entries: [], lastAppend: 0 };
+      this.channels.set(channelId, ch);
+    }
+    const bufSeq = this.nextSeq++;
+    this.lastSeq.set(channelId, bufSeq);
+    ch.entries.push({ ...e, bufSeq });
+    if (ch.entries.length > this.opts.cap) ch.entries.splice(0, ch.entries.length - this.opts.cap);
+    ch.lastAppend = this.opts.now();
+  }
+  /** Reset (c): more than `idleMs` since the channel's last append clears it, checked on every read and append. */
+  expireIfIdle(channelId) {
+    const ch = this.channels.get(channelId);
+    if (ch !== void 0 && this.opts.now() - ch.lastAppend > this.opts.idleMs) this.reset(channelId);
+  }
+};
+function deliver(e) {
+  return { role: e.role, text: e.text, seq: 0, ...e.origin ? { origin: e.origin } : {} };
+}
+
 // src/voice/defer-intent.ts
 var NEEDS_RUNTIME = [
   // Current time / date / day.
@@ -34032,6 +34190,15 @@ import {
   writeFileSync
 } from "node:fs";
 import { basename as basename4, isAbsolute, join as join15 } from "node:path";
+
+// src/grants/search-providers.ts
+var SEARCH_PROVIDERS = /* @__PURE__ */ new Set(["brave", "tavily", "parallel", "exa", "firecrawl"]);
+var OWNER_DM_SEARCH_DAILY_CAP_MAX = 2e3;
+function isSearchProvider(value) {
+  return typeof value === "string" && SEARCH_PROVIDERS.has(value);
+}
+
+// src/service/runtime-config-dir.ts
 var MEMORY_FILE = "MEMORY.md";
 var REAL_FS = {
   mkdir: (p, mode) => mkdirSync5(p, { recursive: true, mode }),
@@ -34214,10 +34381,14 @@ function readLocalReport(home, identityId) {
   const persona = raw && typeof raw === "object" && !Array.isArray(raw) ? Object.fromEntries(
     Object.entries(raw).filter(([, v]) => typeof v === "string")
   ) : {};
+  const capRaw = doc.owner_dm_search_cap_effective;
+  const ownerDmCap = typeof capRaw === "number" && Number.isInteger(capRaw) && capRaw >= 0 && capRaw <= OWNER_DM_SEARCH_DAILY_CAP_MAX ? capRaw : void 0;
   return {
     persona,
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
+    has_extract_provider: doc.has_extract_provider === true,
+    ...ownerDmCap !== void 0 ? { owner_dm_search_cap_effective: ownerDmCap } : {},
     legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source),
     secret_paths: parseSecretPathsReport(doc.secret_paths)
   };
@@ -34416,7 +34587,8 @@ function loadOwnerGrantPin(opts) {
 // src/grants/manifest.ts
 var TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
 var MANIFEST_KNOWN_TOOLS = Object.freeze({
-  owner_dm: Object.freeze(["web_search", "fetch_url", "http_request", "sql_query"]),
+  owner_dm: Object.freeze(["web_search", "web_extract", "fetch_url", "http_request", "sql_query"]),
+  // web_extract: owner DM only, never team_room (spec §5.4, D5)
   team_room: Object.freeze(["web_search"])
 });
 function manifestSignedBytes(manifest) {
@@ -34491,7 +34663,11 @@ function parseConfig(v) {
   }
   if ("search" in v) {
     const sr = v.search;
-    if (!isPlainObject(sr) || !exactKeys(sr, ["provider"]) || sr.provider !== "brave" && sr.provider !== "tavily") return null;
+    if (!isPlainObject(sr) || !exactKeys(sr, ["provider"], ["owner_dm_daily_cap"]) || !isSearchProvider(sr.provider)) return null;
+    if ("owner_dm_daily_cap" in sr) {
+      const cap = sr.owner_dm_daily_cap;
+      if (typeof cap !== "number" || !Number.isSafeInteger(cap) || cap < 0 || cap > OWNER_DM_SEARCH_DAILY_CAP_MAX) return null;
+    }
   }
   const mem = v.memory;
   if (!isPlainObject(mem) || !exactKeys(mem, ["mode"], ["recall_days"])) return null;
@@ -34501,7 +34677,12 @@ function parseConfig(v) {
   return Object.freeze({
     persona_sha256: v.persona_sha256,
     ...isPlainObject(v.llm) ? { llm: Object.freeze({ provider: v.llm.provider, model: v.llm.model }) } : {},
-    ...isPlainObject(v.search) ? { search: Object.freeze({ provider: v.search.provider }) } : {},
+    ...isPlainObject(v.search) ? {
+      search: Object.freeze({
+        provider: v.search.provider,
+        ..."owner_dm_daily_cap" in v.search ? { owner_dm_daily_cap: v.search.owner_dm_daily_cap } : {}
+      })
+    } : {},
     ...isStringArray(v.tools_allow) ? { tools_allow: Object.freeze([...v.tools_allow]) } : {},
     flags: Object.freeze([...v.flags]),
     memory: Object.freeze({ mode: mem.mode, ..."recall_days" in mem ? { recall_days: mem.recall_days } : {} }),
@@ -34732,7 +34913,20 @@ function bindTargets(raw, signed, equals) {
   }
   return { written, mismatches };
 }
-function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }) {
+function signedManifestTools(manifest, audience, searchProvidersCapable) {
+  return MANIFEST_KNOWN_TOOLS[audience].filter((t) => (manifest.grants[audience] ?? []).includes(t) && (t !== "web_extract" || searchProvidersCapable));
+}
+function manifestPolicyFor(manifest, switches, searchProvidersCapable) {
+  return {
+    v: 1,
+    manifest_tools: [.../* @__PURE__ */ new Set([
+      ...switches.ownerDm ? signedManifestTools(manifest, "owner_dm", searchProvidersCapable) : [],
+      ...switches.room ? signedManifestTools(manifest, "team_room", searchProvidersCapable) : []
+    ])].sort(),
+    secret_path_mode: "enforce"
+  };
+}
+function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }, searchProvidersCapable = false) {
   const mismatches = /* @__PURE__ */ new Set();
   const cfg = manifest.config;
   const out = {};
@@ -34761,6 +34955,7 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
   for (const name of Object.keys(files)) {
     if (name !== LLM_SOURCE && !PERSONA_FILES.includes(name)) mismatches.add("files");
   }
+  const ownerDmTools = signedManifestTools(manifest, "owner_dm", searchProvidersCapable);
   const sj = isObj2(payload.skills_json) ? payload.skills_json : void 0;
   const eps = bindTargets(sj?.endpoints, manifest.endpoints, endpointEquals);
   const dbs = bindTargets(sj?.databases, manifest.databases, databaseEquals);
@@ -34778,14 +34973,20 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     appliedSearch = searchBlock;
   } else {
     mismatches.add("search");
-    searchBlock = (prior.search?.provider ?? void 0) === cfg.search?.provider ? prior.search : void 0;
+    const usablePrior = cfg.search !== void 0 && prior.search?.provider === cfg.search.provider ? prior.search : void 0;
+    searchBlock = cfg.search === void 0 ? void 0 : usablePrior ?? Object.freeze({ provider: cfg.search.provider });
   }
   const skillsDoc = {
     endpoints: eps.written,
     databases: dbs.written,
     flags: [...cfg.flags],
     ...deny !== void 0 || cfg.tools_allow !== void 0 ? { tools: { ...deny !== void 0 ? { deny } : {}, ...cfg.tools_allow !== void 0 ? { allow: [...cfg.tools_allow] } : {} } } : {},
-    ...searchBlock ? { search: searchBlock } : {}
+    ...searchBlock ? { search: searchBlock } : {},
+    // D31: the marker the runtime keys D24 (iii) on; written under every manifest, true when config.search is signed.
+    search_signed: cfg.search !== void 0,
+    // D36, D39: the signed owner-DM cap, only when the owner-DM switch is on and the manifest grants an owner-DM tool;
+    // otherwise none, so the runtime clamps a signed raise to the default. Never read from the payload.
+    ...cfg.search?.owner_dm_daily_cap !== void 0 && switches.ownerDm && ownerDmTools.length > 0 ? { owner_dm_search_cap: cfg.search.owner_dm_daily_cap } : {}
   };
   out["skills.json"] = JSON.stringify(skillsDoc, null, 2) + "\n";
   const signedMemory = { mode: cfg.memory.mode, ...cfg.memory.recall_days !== void 0 ? { recall_days: cfg.memory.recall_days } : {} };
@@ -34816,12 +35017,7 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     mismatches.add("legacy_assign");
     legacyDecisions = decisions.filter((d) => isObj2(d) && d.action === "delete");
   }
-  const signedTools = (a) => MANIFEST_KNOWN_TOOLS[a].filter((t) => (manifest.grants[a] ?? []).includes(t));
-  const policy = {
-    v: 1,
-    manifest_tools: [.../* @__PURE__ */ new Set([...switches.ownerDm ? signedTools("owner_dm") : [], ...switches.room ? signedTools("team_room") : []])].sort(),
-    secret_path_mode: "enforce"
-  };
+  const policy = manifestPolicyFor(manifest, switches, searchProvidersCapable);
   return {
     mismatches: CONFIG_BINDING_FIELDS.filter((f) => mismatches.has(f)).sort(),
     targetMismatches: { endpoint: eps.mismatches, database: dbs.mismatches },
@@ -34960,6 +35156,8 @@ var TOOL_ROOM_CLASSES = Object.freeze({
   current_time: Object.freeze(["room_safe_read"]),
   echo: Object.freeze(["room_safe_read"]),
   web_search: Object.freeze(["owner_credential"]),
+  web_extract: Object.freeze(["owner_credential", "egress"]),
+  // D5: spends the owner's key and sends URLs out
   fetch_url: Object.freeze(["egress"]),
   sql_query: Object.freeze(["owner_credential"]),
   http_request: Object.freeze(["owner_credential", "egress", "side_effect"])
@@ -35073,6 +35271,10 @@ var OWNER_DM_DEFAULT_READ_GRANTS = Object.freeze([
 var ROOM_DEFAULT_READ_GRANTS = Object.freeze([
   Object.freeze({ tool: "current_time", mode: "read" })
 ]);
+var RELAYED_VOICE_GRANTS = Object.freeze([
+  Object.freeze({ tool: "current_time", mode: "read" }),
+  Object.freeze({ tool: "web_search", mode: "read" })
+]);
 var NO_TOOL_GRANTS = Object.freeze([]);
 var WS_CLOSE_SESSION_SUPERSEDED2 = 4409;
 var OWNER_REPLAY_PRUNE_INTERVAL_MS = 5 * 60 * 1e3;
@@ -35381,6 +35583,8 @@ function hexToBytes4(h) {
   return new Uint8Array(Buffer.from(h, "hex"));
 }
 var BOOT_DRAIN_WAIT_MS_DEFAULT = 6e4;
+var SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS = 1e3;
+var SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS = 1e4;
 var BootDrainRotationRefusedError = class extends Error {
   constructor() {
     super("key-package rotation refused: the boot drain has not settled");
@@ -35430,6 +35634,12 @@ var BridgeAgent = class _BridgeAgent {
       workspaceDir: this.cfg.memoryWorkspaceDir,
       factsCharBudget: this.cfg.memoryFactsCharBudget
     });
+    this.callBuffer = new CallBuffer({
+      cap: CALL_BUFFER_CAP,
+      idleMs: CALL_BUFFER_IDLE_MS,
+      now: () => Date.now(),
+      enabled: (this.cfg.memoryProvider ?? "securecoms") !== "none"
+    });
     this.provider = new MlsGroupKeyProvider({
       store: this.store,
       backend: this.backend,
@@ -35576,6 +35786,8 @@ var BridgeAgent = class _BridgeAgent {
     this.actionClock = deps.actionThrottleNow ?? Date.now;
     this.rng = deps.rng ?? Math.random;
     this.bootDrainWaitMs = deps.bootDrainWaitMs ?? BOOT_DRAIN_WAIT_MS_DEFAULT;
+    this.searchCapabilityRefetchDebounceMs = deps.searchCapabilityRefetchDebounceMs ?? SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS;
+    this.searchCapabilityRefetchMaxWaitMs = deps.searchCapabilityRefetchMaxWaitMs ?? SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS;
     this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve) => {
       const t = setTimeout(resolve, ms);
       t.unref?.();
@@ -36014,6 +36226,8 @@ var BridgeAgent = class _BridgeAgent {
   bootSweepTimer;
   rng;
   bootDrainWaitMs;
+  searchCapabilityRefetchDebounceMs;
+  searchCapabilityRefetchMaxWaitMs;
   /** Resolved (and cleared) each time an ingest cycle settles: see start(). */
   ingestSettledWaiters = [];
   /** The boot key-package publish, when start() had to defer it. Test seam. */
@@ -36249,6 +36463,11 @@ var BridgeAgent = class _BridgeAgent {
   startedAt = 0;
   store;
   memory;
+  /**
+   * Voice fast-path privacy, Task 4b (spec §2.1, OQ-1 ruled): the current calls' spoken turns, in process only. The
+   * ONLY history a voice-scoped turn sees; read through voiceScopedHistory, once per turn, at ingest.
+   */
+  callBuffer;
   /**
    * Markdown memory 7a: the one owner of every note mutation and of the
    * delivery cache (spec §6.3, §7.2). One per store, so one per identity.
@@ -36459,9 +36678,14 @@ var BridgeAgent = class _BridgeAgent {
       }
       const skillsJson = payload.skills_json ?? {};
       if (version && inForce === null) {
+        let asDelivered = skillsJson;
+        if (skillsJson !== null && typeof skillsJson === "object" && !Array.isArray(skillsJson)) {
+          const { owner_dm_search_cap: _cap, search_signed: _signed, ...rest } = skillsJson;
+          asDelivered = rest;
+        }
         this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, {
           ...payload.files ?? {},
-          "skills.json": `${JSON.stringify(skillsJson, null, 2)}
+          "skills.json": `${JSON.stringify(asDelivered, null, 2)}
 `
         });
       }
@@ -36516,7 +36740,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     let bound;
     try {
-      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants });
+      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable());
     } catch (e) {
       bound = null;
       return this.bindFailed(manifest, payload.memory, e);
@@ -36535,9 +36759,9 @@ var BridgeAgent = class _BridgeAgent {
       return true;
     }
     try {
-      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, bound.policy);
       this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, bound.files);
       if (manifest.config.llm === void 0) this.grantWriters.removeManagedLlmSource(this.home, this.cfg.identityId);
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable()));
     } catch (e) {
       this.manifestBinding = null;
       throw e;
@@ -36590,6 +36814,7 @@ var BridgeAgent = class _BridgeAgent {
   /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
   async postRuntimeConfigReport(base, version, skillsJson) {
     const local = readLocalReport(this.home, this.cfg.identityId);
+    const reportedSearchProviders = this.searchProvidersCapable();
     const report = {
       applied_version: version,
       paths: checkConfiguredPaths(skillsJson),
@@ -36604,6 +36829,13 @@ var BridgeAgent = class _BridgeAgent {
       // to the backend. The backend needs it to generate a truthful tool
       // paragraph, so it rides along here.
       has_search_key: local?.has_search_key ?? false,
+      // L-2 (spec §7.9): only the runtime knows whether an extract-capable provider key is readable; never derived
+      // from has_search_key. An older runtime omits it: false.
+      // Final review I-2 (controller ruling): AND the current search_providers_v2, so the web never shows extract while
+      // the bridge withholds web_extract from the runtime.
+      has_extract_provider: (local?.has_extract_provider ?? false) && reportedSearchProviders,
+      // D39: the owner-DM daily cap the runtime enforces, passed through when it reported a valid one; never the signed value.
+      ...local?.owner_dm_search_cap_effective !== void 0 ? { owner_dm_search_cap_effective: local.owner_dm_search_cap_effective } : {},
       // Same idea, for the BYOK LLM key file: only the runtime can see
       // whether one is configured in its own environment.
       has_llm_key: local?.has_llm_key ?? false,
@@ -36643,7 +36875,11 @@ var BridgeAgent = class _BridgeAgent {
         // Plan 4 Task 15 (OQ-5): sorted, unique enums; capability is the latest hello's class.
         config_binding_mismatches: [...this.configBindingMismatches],
         target_mismatches: ["database", "endpoint"].filter((k) => this.targetMismatches[k] > 0),
-        capability: this.lastConsumerCapability
+        capability: this.lastConsumerCapability,
+        // D28 (§11.1 step 3): a separate key, never a value in the capability enum. False with no runtime attached.
+        search_providers_v2: reportedSearchProviders,
+        // D19 item 4: content-free; the signed provider is one the attached runtime(s) cannot honour.
+        search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders)
       }
     };
     const reportedVerifyFailures = this.ownerVerifyFailures;
@@ -36664,6 +36900,7 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
+    this.lastReportedSearchProviders = reportedSearchProviders;
     if (version) writeServiceLog2("info", "runtime_config.applied", { version });
     else writeServiceLog2("info", "runtime_config.legacy_memory_reported");
   }
@@ -36733,6 +36970,7 @@ var BridgeAgent = class _BridgeAgent {
     this.startedAt = Date.now();
     await this.restoreRuntimeInbox();
     await this.loadToolGrantState();
+    this.recomputeManifestPolicy(false);
     try {
       this.store.pruneRoomSearchCap(utcDayOf(Date.now()));
     } catch (e) {
@@ -37877,6 +38115,9 @@ var BridgeAgent = class _BridgeAgent {
     const modality = this.spokenReplyIds.has(id) ? "voice" : "text";
     const bridgeLine = this.unifiedOn && body.kind === "text" && isBridgeMemoryLine(body.text);
     if (opts.inReplyTo !== void 0 && this.isOwnerVerifyFailed(opts.inReplyTo)) return;
+    if (body.kind === "text" && opts.callBufferReply === true && opts.inReplyTo !== void 0 && !this.spokenReplyIds.has(id) && !isBridgeMemoryLine(body.text) && this.callBuffer.isVoiceScopedId(opts.inReplyTo)) {
+      this.callBuffer.appendAgent(channelId, body.text, "reply");
+    }
     const origin = this.spokenReplyIds.has(id) ? "fast_path" : !this.taintScope(channelId) ? "reply" : opts.inReplyTo !== void 0 && this.cleanTurns.has(opts.inReplyTo) && !this.taintedTurns.has(opts.inReplyTo) ? "reply" : "untrusted";
     if (body.kind === "text" && !bridgeLine) void recordOutboundMemory(this.memory, channelId, body.text, id, modality, purgeEpoch, origin);
     if (this.unifiedOn && body.kind === "text" && !bridgeLine) this.spawnUnifiedReply(channelId, body.text, id, replyCapture ?? null, origin);
@@ -38647,6 +38888,27 @@ var BridgeAgent = class _BridgeAgent {
   mayReadHistoryForTurn(messageId, authorization) {
     return !this.isOwnerVerifyFailed(messageId) && this.mayReadOpenClawMemoryForTurn(authorization);
   }
+  /**
+   * Voice fast-path privacy (spec §2.1, OQ-1 ruled): the ONLY history source of a voice-scoped turn, the call buffer.
+   * Never reads the memory provider, the store, the unified store or the 7b index. A-6: called once per turn, at ingest
+   * (takeVoiceSnapshot), after the reset signals and before the turn's own append.
+   */
+  voiceScopedHistory(channelId, limit, upTo) {
+    return this.callBuffer.recent(channelId, limit, upTo);
+  }
+  /**
+   * Task 4b (A-6): the turn's snapshot, taken BEFORE its own text is appended (audit finding 2). Final fix I-1: a turn
+   * already admitted to this call (a redelivered row) is snapshotted up to just before its own entry, as it was the
+   * first time, so its snapshot never contains itself.
+   */
+  takeVoiceSnapshot(channelId, messageId) {
+    const upTo = this.callBuffer.admittedAt(messageId);
+    return {
+      recent: this.voiceScopedHistory(channelId, _BridgeAgent.TURN_MEMORY_LIMIT, upTo),
+      endSeq: upTo ?? this.callBuffer.seqAt(channelId),
+      generation: this.callBuffer.generation(channelId)
+    };
+  }
   /** An inbound turn may receive OpenClaw memory only from an active owner DM. */
   mayReadOpenClawMemoryForTurn(authorization) {
     return this.cfg.memoryProvider !== "openclaw" || authorization.sender_membership === "active" && authorization.audience === "owner_dm";
@@ -38656,16 +38918,26 @@ var BridgeAgent = class _BridgeAgent {
    * stays owner-DM-only; every provider failure degrades to empty context and
    * never falls back to the runtime's retired plaintext JSON files.
    */
-  async memoryForTurn(channelId, messageId, authorization, limit = 50) {
+  async memoryForTurn(channelId, messageId, authorization, limit = 50, voice) {
     if (!this.mayReadHistoryForTurn(messageId, authorization)) {
       return { recent: [], facts: [] };
     }
+    if (voice) return { recent: this.voiceFrameTurns(voice.snapshot?.recent ?? []), facts: [] };
     try {
       return this.fenceMemory(channelId, await this.memory.context(channelId, limit), holdsManifestGrant(authorization));
     } catch {
       return { recent: [], facts: [] };
     }
   }
+  /**
+   * Task 6 (spec §2.2 A-1, N1): call-buffer entries as runtime-frame turns. Under the voice fence (a pin is loaded) the
+   * fast model's own lines (origin "fast_path") are dropped, as fenceMemory drops them from store history; the fast
+   * prompt keeps them. The internal origin is not carried into the frame; `seq` stays 0 (A-5).
+   */
+  voiceFrameTurns(entries) {
+    const fenced = this.voiceFenceOn();
+    return entries.filter((e) => !(fenced && e.origin === "fast_path")).map((e) => ({ seq: e.seq, role: e.role, text: e.text }));
+  }
   /**
    * Owner grants plan 4 Task 16 (T-30, audit r2 H-1): the voice fence is on whenever a pin is loaded, on EVERY runtime
    * turn (manifest, fallback, greeting, relayed, constants-only alike). It never depends on a turn's grants.
@@ -38700,7 +38972,7 @@ var BridgeAgent = class _BridgeAgent {
     if (!strict && !ctx.recent.some((t) => t.role === "agent")) return ctx;
     const ownerId = this.cfg.ownerGrantPin?.pin?.ownerIdentityId ?? "";
     const securecoms = (this.cfg.memoryProvider ?? "securecoms") === "securecoms";
-    const meta = securecoms ? this.store.memoryLineMeta(channelId, ctx.recent.filter((t) => strict || t.role === "agent").map((t) => t.seq)) : /* @__PURE__ */ new Map();
+    const meta = securecoms ? this.store.memoryLineMeta(channelId, ctx.recent.filter((t) => (strict || t.role === "agent") && t.seq !== 0).map((t) => t.seq)) : /* @__PURE__ */ new Map();
     const fence = this.fenceContext(channelId);
     const recent = ctx.recent.filter((t) => {
       const m = meta.get(t.seq);
@@ -38719,7 +38991,7 @@ var BridgeAgent = class _BridgeAgent {
     if (recent.length === 0) return false;
     const ownerId = this.cfg.ownerGrantPin?.pin?.ownerIdentityId ?? "";
     const securecoms = (this.cfg.memoryProvider ?? "securecoms") === "securecoms";
-    const meta = securecoms ? this.store.memoryLineMeta(m.channel_id, recent.filter((t) => t.role !== "agent").map((t) => t.seq)) : /* @__PURE__ */ new Map();
+    const meta = securecoms ? this.store.memoryLineMeta(m.channel_id, recent.filter((t) => t.role !== "agent" && t.seq !== 0).map((t) => t.seq)) : /* @__PURE__ */ new Map();
     return recent.some((t) => t.role !== "agent" && isRelayClassPeer({ peerId: t.peerId, modality: meta.get(t.seq)?.modality }, ownerId));
   }
   /**
@@ -39015,9 +39287,18 @@ var BridgeAgent = class _BridgeAgent {
       writeServiceLog2("warn", "memory.recall_prepare_failed", {}, e);
     }
   }
+  /**
+   * Voice fast-path privacy, Task 7 (spec §4): the frame-keyed delivery check. A voice-scoped frame gets no notes, no
+   * recall and no unified items, whatever its authorization says. Keys on the frame's own marks, NEVER on the call
+   * buffer's id set (a reset evicts ids; the staged frame must stay scoped).
+   */
+  frameIsVoiceScoped(m) {
+    return m.voice_scoped === true || m.transcribed === true || m.speaker !== void 0;
+  }
   /** ws flush (synchronous). Q1 to Q3 and Q6 again at delivery, on the ORIGINAL message; Q4 lives in withConsumerRecall. */
   recallForDelivery(m) {
     if (this.unifiedOn) return void 0;
+    if (this.frameIsVoiceScoped(m)) return void 0;
     if (!this.recallProviderOn() || !this.notesReadable(m.authorization)) return void 0;
     return this.recall.deliverable(m.message_id, m.channel_id);
   }
@@ -39250,6 +39531,7 @@ var BridgeAgent = class _BridgeAgent {
   /** ws flush (synchronous). The predicate and the owner scope again at delivery, on the ORIGINAL message (H-4, Review Focus 3). */
   unifiedForDelivery(m) {
     if (!this.unifiedProviderOn()) return void 0;
+    if (this.frameIsVoiceScoped(m)) return void 0;
     const a = m.authorization;
     if (!(a?.memory_write === true || a?.relay_speaker === "owner")) return void 0;
     const scopeId = this.ownerScopeNow(m.channel_id);
@@ -39485,6 +39767,7 @@ var BridgeAgent = class _BridgeAgent {
   notesForDelivery(m) {
     if (this.unifiedOn) return { generation: this.notes.appliedGeneration() };
     const generation = this.notes.appliedGeneration();
+    if (this.frameIsVoiceScoped(m)) return { generation };
     if (!this.notesReadable(m.authorization)) return { generation };
     const d = this.notes.deliverable(m.channel_id);
     if (d.miss) {
@@ -39844,7 +40127,7 @@ var BridgeAgent = class _BridgeAgent {
    * deferring fast reply was actually published — F3).
    */
   async speakAndSettle(turn, plan, held, heldAfterAck, fastText, guidance, fastSpeaker, greeting) {
-    const outcome = plan.kind === "ack" ? await this.sendFastLine(turn.channelId, turn.messageId, plan.line) ? "deferred" : "failed" : await this.runFastReply(turn, fastText, guidance, fastSpeaker, greeting);
+    const outcome = plan.kind === "ack" ? await this.sendFastLine(turn, plan.line) ? "deferred" : "failed" : await this.runFastReply(turn, fastText, guidance, fastSpeaker, greeting);
     if (outcome === "answered") await this.settleHeldRuntimeMessage(held, false);
     else await this.settleHeldRuntimeMessage(outcome === "deferred" ? heldAfterAck : held, true);
   }
@@ -39863,19 +40146,29 @@ var BridgeAgent = class _BridgeAgent {
   async settleFastReplies() {
     while (this.fastReplyChains.size) await Promise.all([...this.fastReplyChains.values()]);
   }
-  /** Send a line the voice fast path speaks: its memory record is "voice" (H1). */
-  async sendSpoken(channelId, text, messageId) {
+  /**
+   * Send a line the voice fast path speaks: its memory record is "voice" (H1).
+   * Task 4b (spec §2.1 agent appends (1), A-1, A-2): once published, the line enters the call buffer as "fast_path",
+   * unless the turn it answers failed owner verification (its id, or any fragment of a coalesced turn). A line answering
+   * a turn the ingest did not find voice-scoped is not appended either (defense in depth: the fast path fires only on
+   * voice-scoped turns, Task 5).
+   */
+  async sendSpoken(channelId, text, messageId, turn) {
     this.spokenReplyIds.add(messageId);
     try {
       await this.send(channelId, text, messageId);
     } finally {
       this.spokenReplyIds.delete(messageId);
     }
+    if (turn.voiceScoped === true && turn.anyFragmentVerifyFailed !== true && !this.isOwnerVerifyFailed(turn.messageId)) {
+      this.callBuffer.appendAgent(channelId, text, "fast_path");
+    }
   }
   /** Speak a fixed acknowledgement line; failures are counted, never thrown. */
-  async sendFastLine(channelId, messageId, line) {
+  async sendFastLine(turn, line) {
+    const { channelId, messageId } = turn;
     try {
-      await this.sendSpoken(channelId, line, fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, messageId));
+      await this.sendSpoken(channelId, line, fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, messageId), turn);
       this.fastPathSent++;
       return true;
     } catch (e) {
@@ -39889,8 +40182,8 @@ var BridgeAgent = class _BridgeAgent {
    * the fast model's reply — or, in `ack_only`, the greeting template — is
    * spoken, and the outcome decides whether the runtime answers next.
    *
-   * MUST NEVER throw: every failure path (memory lookup, the LLM call,
-   * normalization, or the send itself) is caught, counted in
+   * MUST NEVER throw: every failure path (the LLM call, normalization,
+   * or the send itself) is caught, counted in
    * `fastPathFailed`, and logged WITHOUT the turn text or the model's reply.
    * The `fastReplyId(...)` send id is deterministic, so a duplicate that
    * slipped past the in-memory dedupe (e.g. a restart) resolves to the same
@@ -39904,20 +40197,18 @@ var BridgeAgent = class _BridgeAgent {
     try {
       if ((this.cfg.voiceFastPathMode ?? "full") === "ack_only") {
         if (!isGreeting) return "failed";
-        const ok = await this.sendFastLine(m.channelId, m.messageId, ackOnlyGreeting(this.voiceAgentName(), speaker?.displayName));
+        const ok = await this.sendFastLine(m, ackOnlyGreeting(this.voiceAgentName(), speaker?.displayName));
         return ok ? "answered" : "failed";
       }
       const fastLlm = this.fastLlm;
       if (!fastLlm || !this.cfg.voice) return "failed";
-      let memory;
-      if (!this.mayReadHistoryForTurn(m.messageId, m.authorization)) {
-        memory = { recent: [], facts: [] };
-      } else {
-        try {
-          memory = await this.memory.context(m.channelId, FAST_PATH_MEMORY_TURNS);
-        } catch {
-          memory = { recent: [], facts: [] };
-        }
+      let memory = { recent: [], facts: [] };
+      const snapshot = m.voiceSnapshot;
+      if (m.voiceScoped === true && snapshot !== void 0 && m.anyFragmentVerifyFailed !== true && this.mayReadHistoryForTurn(m.messageId, m.authorization)) {
+        memory = {
+          recent: [...snapshot.recent, ...this.callBuffer.agentAfter(m.channelId, { seq: snapshot.endSeq, generation: snapshot.generation })].slice(-FAST_PATH_MEMORY_TURNS),
+          facts: []
+        };
       }
       const messages = buildFastMessages({
         persona: this.cfg.voice.persona,
@@ -39940,7 +40231,7 @@ var BridgeAgent = class _BridgeAgent {
       const refusal = !isGreeting && isRefusal(split3.reply);
       const defer = split3.defer || refusal;
       const reply = refusal ? deferAck(m.messageId) : split3.reply;
-      await this.sendSpoken(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId));
+      await this.sendSpoken(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId), m);
       this.fastPathSent++;
       if (defer) this.fastPathDeferred++;
       if (refusal) this.fastPathRefusalDeferred++;
@@ -40004,6 +40295,15 @@ var BridgeAgent = class _BridgeAgent {
   async memoryAtRelease(message) {
     const prior = message.memory;
     if (!prior || !this.mayReadHistoryForTurn(message.message_id, message.authorization)) return prior;
+    if (this.frameIsVoiceScoped(message)) {
+      const tails = this.voiceCoalescedTails.get(message.message_id) ?? [];
+      if (tails.some((id) => this.isOwnerVerifyFailed(id))) return prior;
+      const noted = this.callBuffer.seqNoted(message.message_id);
+      if (noted === void 0) return prior;
+      const spoken2 = this.voiceFrameTurns(this.callBuffer.agentAfter(message.channel_id, noted));
+      if (spoken2.length === 0) return prior;
+      return { recent: [...prior.recent, ...spoken2].slice(-_BridgeAgent.TURN_MEMORY_LIMIT), facts: [] };
+    }
     let fresh;
     try {
       fresh = await this.memory.context(message.channel_id, _BridgeAgent.TURN_MEMORY_LIMIT);
@@ -40515,9 +40815,9 @@ var BridgeAgent = class _BridgeAgent {
     });
   }
   /** Classify one inbound turn at the agent's CURRENT epoch for its channel. */
-  async authorizeTurn(channelId, messageId, senderId, ownerVerdict, relaySpeakerId) {
+  async authorizeTurn(channelId, messageId, senderId, ownerVerdict, relaySpeakerId, voiceScoped) {
     const held = await this.heldPosition(channelId);
-    const auth = this.authorizationFor(channelId, senderId, relaySpeakerId, held.epoch, held.groupId, { ownerVerdict });
+    const auth = this.authorizationFor(channelId, senderId, relaySpeakerId, held.epoch, held.groupId, { ownerVerdict, voiceScoped });
     if (!(auth.audience === "team_room" && auth.tool_grants.length > 0)) return auth;
     if (this.roomGrantEpochs.size >= ROOM_GRANT_TRACK_MAX || held.epoch === null || held.groupId === null) {
       writeServiceLog2("warn", "room_grant.untracked");
@@ -40532,17 +40832,22 @@ var BridgeAgent = class _BridgeAgent {
    * guess. The returned object and grant array are frozen before they cross the
    * daemon boundary so one consumer cannot widen a later execution check.
    *
-   * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
-   * the kill switch is on, the channel is a DM, and EITHER
+   * Grants (architect ruling 2026-10-02; P-5 and G-1, spec §9): an owner-DM
+   * constant only when the kill switch is on, the channel is a DM, and EITHER
    *   (a) audience is owner_dm AND the sender is the channel's pinned DM
    *       counterpart (`channelOwner`, never "anomalous"). A server-marked
    *       `is_agent_owner` on a member who is NOT the DM's single human
    *       counterpart gets nothing; on the counterpart it is trusted (see
-   *       LIMIT below); OR
+   *       LIMIT below). OWNER_DM_DEFAULT_READ_GRANTS on a typed turn;
+   *       RELAYED_VOICE_GRANTS and no memory_write when `opts.voiceScoped`
+   *       (G-1: the ingest predicate isVoiceScopedTurn, spec §1); OR
    *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
    *       relayed `speaker_identity_id` (passed by the caller only for relay
    *       turns) is that same pinned owner, whose roster row is the agent's
-   *       owner. A speaker claim from any non-relay sender gets nothing.
+   *       owner: RELAYED_VOICE_GRANTS. A speaker claim from any non-relay
+   *       sender gets nothing.
+   * RELAYED_VOICE_GRANTS is never manifest-eligible: effectiveToolGrants gives
+   * the constant by reference, or the fallback when a good manifest is held.
    * Both need the roster fetched at `heldEpoch` (the agent's current MLS
    * epoch for the channel), or the DM marked epoch-fresh at this ingest
    * cycle's refresh (audit M-B4).
@@ -40586,9 +40891,11 @@ var BridgeAgent = class _BridgeAgent {
         const ownerDirect = audience === "owner_dm" && senderId === ownerId;
         const owner = roster?.get(ownerId);
         const ownerRelayed = relaySpeakerId !== void 0 && sender.is_relay && relaySpeakerId === ownerId && owner !== void 0 && !owner.is_agent && owner.is_agent_owner;
-        if (ownerDirect || ownerRelayed) tool_grants = OWNER_DM_DEFAULT_READ_GRANTS;
+        if (ownerDirect) tool_grants = opts.voiceScoped === true ? RELAYED_VOICE_GRANTS : OWNER_DM_DEFAULT_READ_GRANTS;
+        if (ownerRelayed) tool_grants = RELAYED_VOICE_GRANTS;
         if (ownerRelayed) relaySpeaker = "owner";
-        if (ownerDirect && relaySpeakerId === void 0 && (this.cfg.memoryProvider ?? "securecoms") === "securecoms" && // Final review M-4: the live payload flag too, so with notes off the
+        if (ownerDirect && relaySpeakerId === void 0 && // G-1: never on a voice-scoped turn.
+        opts.voiceScoped !== true && (this.cfg.memoryProvider ?? "securecoms") === "securecoms" && // Final review M-4: the live payload flag too, so with notes off the
         // runtime does not offer memory_note at all. Not memoryConfigConfirmed:
         // a turn the boot drain pulls before the boot refetch keeps its mark,
         // and the read and write gates (notesProviderOn) hold it until then.
@@ -40605,11 +40912,11 @@ var BridgeAgent = class _BridgeAgent {
     const binding = this.manifestBinding;
     const boundNow = binding !== null && binding.state === "bound" && binding.counter === this.toolGrantCounter;
     const signedTargets = boundNow ? binding.signedTargets : { endpoints: 0, databases: 0 };
-    if (tool_grants === OWNER_DM_DEFAULT_READ_GRANTS) {
-      const eligible = relaySpeakerId === void 0 && opts.ownerVerdict?.kind === "verified" && manifest?.owner_dm_channel_id === channelId && boundNow && this.manifestConsumer !== null;
+    if (tool_grants === OWNER_DM_DEFAULT_READ_GRANTS || tool_grants === RELAYED_VOICE_GRANTS) {
+      const eligible = relaySpeakerId === void 0 && opts.ownerVerdict?.kind === "verified" && manifest?.owner_dm_channel_id === channelId && boundNow && this.manifestConsumer !== null && tool_grants !== RELAYED_VOICE_GRANTS;
       const r = effectiveToolGrants({
         audience: "owner_dm",
-        base: OWNER_DM_DEFAULT_READ_GRANTS,
+        base: tool_grants,
         manifest,
         eligible,
         manifestSwitchOn: this.ownerDmManifestGrants,
@@ -41331,6 +41638,7 @@ var BridgeAgent = class _BridgeAgent {
     const acked = [];
     for (const m of entries) {
       try {
+        if (m.voiceMode === false) this.callBuffer.reset(m.channelId);
         const encId = m.envelope.enclave_id;
         if (encId && !this.channelEnclaveRecorded.has(m.channelId)) {
           this.channelEnclaveRecorded.add(m.channelId);
@@ -41488,6 +41796,7 @@ var BridgeAgent = class _BridgeAgent {
           continue;
         }
         if (typeof parsed.text === "string") {
+          if (parsed.text.trim() === VOICE_CALL_START_MARKER) this.callBuffer.reset(m.channelId);
           const meta = this.freshMeta(m.channelId);
           const senderType = m.envelope.sender_type;
           const senderIsAgent = senderType === "agent" ? true : senderType === "human" ? false : void 0;
@@ -41529,23 +41838,39 @@ var BridgeAgent = class _BridgeAgent {
             const senderName = this.freshRoster(m.channelId)?.get(
               m.envelope.sender_id
             )?.name;
+            const voiceScoped = isVoiceScopedTurn({
+              speaker,
+              transcribed: parsed.transcribed,
+              senderIsRelay: this.freshRoster(m.channelId)?.get(m.envelope.sender_id)?.is_relay === true,
+              text: parsed.text
+            });
             const ownerVerdict = await this.verifyOwnerTurn(m);
             const turnAuthorization = await this.authorizeTurn(
               m.channelId,
               m.messageId,
               m.envelope.sender_id,
               ownerVerdict,
-              speaker?.identityId
+              speaker?.identityId,
+              voiceScoped
             );
             await this.prepareNotesForTurn(m.channelId, turnAuthorization);
-            const runtimeMemory = this.memoryForTurn(m.channelId, m.messageId, turnAuthorization);
             const voiceGuidance = m.voiceMode ? selectVoiceGuidance(meta?.is_dm, m.voiceDefaultResponder) : void 0;
             const humanTurn = senderIsAgent !== true || speaker !== void 0;
-            const fastPathEligible = Boolean(m.voiceMode && humanTurn && this.fastLlm && voiceGuidance);
+            const fastPathEligible = Boolean(voiceScoped && m.voiceMode && humanTurn && this.fastLlm && voiceGuidance);
             const turnText = parsed.text;
             const isCallStart = turnText.trim() === VOICE_CALL_START_MARKER;
             const windowEligible = voiceWindowEligible({ voiceMode: m.voiceMode, speaker, transcribed: parsed.transcribed, voiceGuidance, isCallStart });
             const coalescible = this.voiceCoalesceWindowMs > 0 && windowEligible;
+            const callPeer = admitsToCallBuffer({ speaker, transcribed: parsed.transcribed });
+            let voiceSnapshot;
+            if (voiceScoped) {
+              this.callBuffer.markVoiceScoped(m.channelId, m.messageId);
+              if (!coalescible) {
+                voiceSnapshot = this.takeVoiceSnapshot(m.channelId, m.messageId);
+                if (callPeer && !this.isOwnerVerifyFailed(m.messageId)) this.callBuffer.appendPeer(m.channelId, parsed.text, m.messageId);
+              }
+            }
+            const runtimeMemory = this.memoryForTurn(m.channelId, m.messageId, turnAuthorization, void 0, voiceScoped ? { snapshot: voiceSnapshot } : void 0);
             if (!coalescible) {
               const kind2 = m.voiceMode === true || parsed.transcribed === true ? "voice" : "text";
               if (this.unifiedOn) await this.prepareUnifiedForTurn({ channelId: m.channelId, messageId: m.messageId, text: parsed.text, authorization: turnAuthorization, kind: kind2 });
@@ -41561,7 +41886,9 @@ var BridgeAgent = class _BridgeAgent {
             const fastGreeting = isCallStart && fastPathFiring;
             const runtimeVoice = (ackSent) => m.voiceMode ? {
               voice: true,
-              guidance: ackSent ? `${voiceGuidance} ${FAST_PATH_SPOKEN_GUIDANCE}` : voiceGuidance
+              // Task 6 (OQ-3): a voice-scoped frame's guidance ends with VOICE_CALL_CLAUSE, on all three frames
+              // (held, coalesced after-ack, after-ack); a typed turn during a call keeps its guidance.
+              guidance: `${ackSent ? `${voiceGuidance} ${FAST_PATH_SPOKEN_GUIDANCE}` : voiceGuidance}${voiceScoped ? ` ${VOICE_CALL_CLAUSE}` : ""}`
             } : {};
             const runtimeEntry = (ackSent, memory) => ({
               channel_id: m.channelId,
@@ -41582,6 +41909,7 @@ var BridgeAgent = class _BridgeAgent {
               // identify: the envelope's own claim (relay or on-device
               // transcript) or a relay-attributed turn.
               ...parsed.transcribed === true || speaker !== void 0 ? { transcribed: true } : {},
+              ...voiceScoped ? { voice_scoped: true } : {},
               ...runtimeVoice(ackSent)
             });
             if (coalescible) {
@@ -41611,6 +41939,7 @@ var BridgeAgent = class _BridgeAgent {
                 acked.push(m.queueId);
                 continue;
               }
+              const bufferGeneration = this.callBuffer.generation(m.channelId);
               const held = runtimeEntry(false, await runtimeMemory);
               if (!await this.stageHeldRuntimeMessage(held)) continue;
               this.noteVoiceCoalesced(m.messageId);
@@ -41621,7 +41950,8 @@ var BridgeAgent = class _BridgeAgent {
                 closed: false,
                 pending: Promise.resolve(),
                 purgeEpoch: purgeEpochAtReceipt.get(m.channelId),
-                itemCapture: itemCaptureAtReceipt.get(m.channelId)
+                itemCapture: itemCaptureAtReceipt.get(m.channelId),
+                bufferGeneration
               };
               this.voiceCoalescing.set(windowKey, win);
               const openedAt = Date.now();
@@ -41637,9 +41967,18 @@ var BridgeAgent = class _BridgeAgent {
                 const [firstId, ...tailIds] = win.ids;
                 if (tailIds.length) this.voiceCoalescedTails.set(firstId, tailIds);
                 const text = win.parts.join(" ");
+                const sameCall = this.callBuffer.generation(channelId) === win.bufferGeneration;
+                const anyFragmentVerifyFailed = win.ids.some((id) => this.isOwnerVerifyFailed(id));
+                let windowSnapshot;
+                if (sameCall) {
+                  this.callBuffer.markVoiceScoped(channelId, firstId);
+                  windowSnapshot = this.takeVoiceSnapshot(channelId, firstId);
+                }
+                if (callPeer && sameCall && !anyFragmentVerifyFailed) this.callBuffer.appendPeer(channelId, text, firstId);
                 if (this.unifiedOn) await this.prepareUnifiedForTurn({ channelId, messageId: firstId, text, authorization: turnAuthorization, kind: "voice" });
                 else await this.prepareRecallForTurn({ channelId, messageId: firstId, text, authorization: turnAuthorization, kind: "voice" });
-                const merged = { ...held, text };
+                const windowMemory = await this.memoryForTurn(channelId, firstId, turnAuthorization, void 0, { snapshot: anyFragmentVerifyFailed ? void 0 : windowSnapshot });
+                const merged = { ...held, text, memory: windowMemory };
                 if (this.unifiedOn) {
                   const snap = win.itemCapture ?? { ...this.store.itemCapture(channelId), purgeEpoch: -1 };
                   const work = this.tapUnifiedVoice(merged, { stamp: this.ingestGeneration.get(firstId), capture: { ...snap, purgeEpoch: win.purgeEpoch ?? -1 } });
@@ -41667,7 +42006,7 @@ var BridgeAgent = class _BridgeAgent {
                 const release = this.reserveFastReply(channelId);
                 try {
                   await this.speakAndSettle(
-                    { channelId, messageId: firstId, senderId, authorization: turnAuthorization },
+                    { channelId, messageId: firstId, senderId, authorization: turnAuthorization, voiceScoped: voiceScoped && sameCall, voiceSnapshot: windowSnapshot, anyFragmentVerifyFailed },
                     plan,
                     merged,
                     { ...merged, ...runtimeVoice(true) },
@@ -41699,7 +42038,9 @@ var BridgeAgent = class _BridgeAgent {
                   channelId: m.channelId,
                   messageId: m.messageId,
                   senderId: m.envelope.sender_id,
-                  authorization: turnAuthorization
+                  authorization: turnAuthorization,
+                  voiceScoped,
+                  voiceSnapshot
                 };
                 const guidanceForFast = voiceGuidance;
                 const greeting = fastGreeting;
@@ -42524,6 +42865,115 @@ ${channelId}`;
   manifestConsumerAttached() {
     return this.manifestConsumer !== null;
   }
+  /**
+   * D28 (B-4): every socket that said hello, with whether its latest hello declared search_providers_v2 on the
+   * manifest_grants_v1 predicate (ws-server.ts). The agent value is the AND over all of them, absent (false) with
+   * none: unlike manifestConsumer, never newest wins. The per-delivery filter judges each socket by its own hello.
+   */
+  searchProvidersSockets = /* @__PURE__ */ new Map();
+  /**
+   * The D28 value the files were last recomputed for; null until the first socket observation, so that observation
+   * always recomputes (final review I-1), even when it is non-capable.
+   */
+  searchProvidersState = null;
+  searchCapabilityRefetchTimer = null;
+  /** When the current burst's first change happened (valid while the timer is set). */
+  searchCapabilityBurstStart = 0;
+  /** The D28 value in the last report posted (null until one is); a change needs a refetch to reach the web. */
+  lastReportedSearchProviders = null;
+  noteSearchProvidersSocket(token, declared) {
+    this.searchProvidersSockets.set(token, declared);
+    this.onSearchProvidersMaybeChanged();
+  }
+  clearSearchProvidersSocket(token) {
+    if (this.searchProvidersSockets.delete(token)) this.onSearchProvidersMaybeChanged();
+  }
+  /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
+  searchProvidersCapable() {
+    if (this.searchProvidersSockets.size === 0) return false;
+    for (const v of this.searchProvidersSockets.values()) if (!v) return false;
+    return true;
+  }
+  /**
+   * D19 item 3 (B-6): the search provider signed in the stored verified manifest in force (a pin loaded and a good
+   * manifest), never the server payload; undefined with no pin, no manifest, or no signed search block. The
+   * per-delivery filter (consumer-grants.ts withSearchCapability) and the S-28 report reason both read this.
+   */
+  signedSearchProvider() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    return pin !== null ? this.toolGrantManifest?.config.search?.provider : void 0;
+  }
+  /** D19 item 4, D34: the in-force signed provider is not brave, and the attached runtime(s) lack the capability. */
+  searchProviderUnsupported(capable) {
+    if (capable) return false;
+    const provider = this.signedSearchProvider();
+    return provider !== void 0 && provider !== "brave";
+  }
+  /**
+   * D35 (P-4): on a capability change, rewrite manifest-policy.json at once from the stored manifest, the kill
+   * switches and the new capability, then a debounced refetch (one per burst) only when needed.
+   */
+  onSearchProvidersMaybeChanged() {
+    const capable = this.searchProvidersCapable();
+    const prev = this.searchProvidersState;
+    if (capable === prev) return;
+    this.searchProvidersState = capable;
+    this.recomputeManifestPolicy(capable);
+    if (this.closingDown) return;
+    if (prev === null && !capable) return;
+    const now = Date.now();
+    if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
+    else this.searchCapabilityBurstStart = now;
+    const delay = Math.max(0, Math.min(this.searchCapabilityRefetchDebounceMs, this.searchCapabilityBurstStart + this.searchCapabilityRefetchMaxWaitMs - now));
+    this.searchCapabilityRefetchTimer = setTimeout(() => {
+      this.searchCapabilityRefetchTimer = null;
+      if (this.searchCapabilityRefetchNeeded()) void this.refetchRuntimeConfig();
+    }, delay);
+    this.searchCapabilityRefetchTimer.unref?.();
+  }
+  /**
+   * A refetch re-renders skills.json (owner_dm_search_cap counts web_extract only with the capability, D39) and posts
+   * the report. Needed under a manifest in force, or when the reported value is stale. Never before the boot fetch.
+   */
+  searchCapabilityRefetchNeeded() {
+    if (!this.bootConfigSettled || this.closingDown) return false;
+    const inForce = (this.cfg.ownerGrantPin?.pin ?? null) !== null && this.toolGrantManifest !== null;
+    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable();
+  }
+  /**
+   * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
+   * so a policy is never written ahead of its skills.json. Narrowing never waits: with no binding in force, a file that
+   * lists web_extract loses it at once, so an older runtime never reads it as unreadable (which drops every grant).
+   * Content-free; a write failure is logged and the debounced refetch tries again.
+   */
+  recomputeManifestPolicy(capable) {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const manifest = pin !== null ? this.toolGrantManifest : null;
+    try {
+      if (manifest !== null && this.manifestBinding !== null && this.manifestBinding.counter === manifest.counter) {
+        this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, capable));
+        return;
+      }
+      if (capable) return;
+      const path = join17(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
+      if (!existsSync5(path)) return;
+      let doc;
+      try {
+        doc = JSON.parse(readFileSync10(path, "utf8"));
+      } catch {
+        return;
+      }
+      const tools = doc?.manifest_tools;
+      if (!Array.isArray(tools) || !tools.includes("web_extract")) return;
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, {
+        v: 1,
+        manifest_tools: tools.filter((t) => typeof t === "string" && t !== "web_extract"),
+        secret_path_mode: "enforce"
+      });
+    } catch (e) {
+      writeServiceLog2("warn", "authz.search_capability", { state: ServiceLogEnum.of("policy_write_failed", ["policy_write_failed"]) }, e);
+    }
+  }
   noteConsumerCapability(state) {
     this.lastConsumerCapability = state;
     if (state !== "ok") {
@@ -42715,6 +43165,8 @@ ${channelId}`;
     this.supersedeRecheckTimers.clear();
     if (this.redeliveryTimer !== null) clearTimeout(this.redeliveryTimer);
     this.redeliveryTimer = null;
+    if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
+    this.searchCapabilityRefetchTimer = null;
     this.pingHandle?.close();
     if (this.safetyTimer) clearInterval(this.safetyTimer);
     if (this.runtimeConfigTimer) clearInterval(this.runtimeConfigTimer);
@@ -42824,7 +43276,7 @@ ${channelId}`;
 };
 
 // src/config.ts
-import { readFileSync as readFileSync10, statSync as statSync5 } from "node:fs";
+import { readFileSync as readFileSync11, statSync as statSync5 } from "node:fs";
 import { dirname as dirname6, join as join18 } from "node:path";
 var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 var CONFIG_ERROR_MESSAGE = {
@@ -42846,7 +43298,7 @@ var ConfigError = class extends Error {
 function loadConfig(opts) {
   let raw;
   try {
-    raw = readFileSync10(opts.credentialPath, "utf8");
+    raw = readFileSync11(opts.credentialPath, "utf8");
   } catch (e) {
     const code = e?.code;
     throw new ConfigError(code === "ENOENT" ? "credential_not_found" : "credential_unreadable");
@@ -42976,11 +43428,11 @@ import { z as z3 } from "zod";
 
 // src/auth.ts
 import { randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync6(f)) return readFileSync11(f, "utf8").trim();
+  if (f && existsSync6(f)) return readFileSync12(f, "utf8").trim();
   const tok = randomBytes11(32).toString("base64url");
   if (f) writeFileSync2(f, tok, { mode: 384 });
   return tok;
@@ -43076,6 +43528,7 @@ function withConsumerGrants(m, perToolConsumer) {
   return { ...m, authorization: Object.freeze({ ...rest, ...stripGrants ? { tool_grants: NO_GRANTS } : {} }) };
 }
 var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
 var CONSTANT_TOOL_NAMES = Object.freeze({
   owner_dm: Object.freeze(["current_time", "web_search"]),
   team_room: Object.freeze(["current_time"])
@@ -43098,6 +43551,15 @@ function withHarnessGrants(m, withheld) {
   if (!a || a.tool_grants.length === 0) return m;
   return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
 }
+function withSearchCapability(m, consumerHasFeature, signedProvider) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const stripSearch = signedProvider !== void 0 && signedProvider !== "brave";
+  const kept = a.tool_grants.filter((g) => g.tool !== "web_extract" && !(stripSearch && g.tool === "web_search"));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
 
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
@@ -43120,7 +43582,8 @@ data: ${JSON.stringify(msgs[i])}
 }
 function deliverSseBatch(res, batch, agent, onWriteError) {
   const withheld = agent.harnessGrantsWithheld();
-  const left3 = writeSse(res, batch.map((m) => withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false)), onWriteError);
+  const provider = agent.signedSearchProvider();
+  const left3 = writeSse(res, batch.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)), onWriteError);
   const leftIds = new Set(left3.map((message) => message.message_id));
   agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
   if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
@@ -43391,7 +43854,10 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/messages") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
         const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
-        return json(res, 200, (await agent.drain(channel, wait)).map((m) => withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), agent.harnessGrantsWithheld()), false)));
+        const drained = await agent.drain(channel, wait);
+        const withheld = agent.harnessGrantsWithheld();
+        const provider = agent.signedSearchProvider();
+        return json(res, 200, drained.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -43565,6 +44031,7 @@ function attachAgentWebSocket(server, agent, opts) {
       consumer: "unknown",
       perToolGrants: false,
       manifestGrants: false,
+      searchProviders: false,
       // helloWaitMs 0 keeps today's synchronous initial flush exactly (the opt-out the existing tests use).
       deliveryOpen: helloWaitMs <= 0,
       deliveryToken: /* @__PURE__ */ new Map(),
@@ -43618,9 +44085,13 @@ function attachAgentWebSocket(server, agent, opts) {
             continue;
           }
           const out = withConsumerNotes(
-            withManifestCapability(
-              withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
-              session.manifestGrants
+            withSearchCapability(
+              withManifestCapability(
+                withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
+                session.manifestGrants
+              ),
+              session.searchProviders,
+              agent.signedSearchProvider()
             ),
             batch[i],
             session,
@@ -43656,6 +44127,7 @@ function attachAgentWebSocket(server, agent, opts) {
     const cleanup = () => {
       if (cleaned) return;
       cleaned = true;
+      session.closed = true;
       if (helloTimer) clearTimeout(helloTimer);
       agent.noteSessionClose();
       unsubscribe();
@@ -43676,6 +44148,7 @@ function attachAgentWebSocket(server, agent, opts) {
       if (session.harness) agent.clearHarnessReport(session.harness);
       if (session.perToolGrants) agent.clearPerToolConsumer(session);
       if (session.manifestGrants) agent.clearManifestConsumer(session);
+      agent.clearSearchProvidersSocket(session);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -43751,6 +44224,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     return;
   }
   if (m.type === "hello") {
+    if (session.closed) return;
     const report = m.harness === void 0 ? null : parseHarnessReport(m.harness);
     if (report) {
       session.harness = report;
@@ -43774,6 +44248,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       agent.clearManifestConsumer(session);
     }
     agent.noteConsumerCapability(manifest ? "ok" : session.harnessClaimed ? "harness_consumer" : "missing");
+    session.searchProviders = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(SEARCH_PROVIDERS_FEATURE);
+    agent.noteSearchProvidersSocket(session, session.searchProviders);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -43781,7 +44257,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
@@ -43833,10 +44309,13 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       sendJson(sock, wsErrorFrame("invalid_request"));
       return;
     }
+    const record = typeof m.in_reply_to === "string" ? inflight.get(m.in_reply_to) : void 0;
+    const callBufferReply = session.consumer === "runtime" && session.perToolGrants === true && session.harnessClaimed !== true && typeof m.in_reply_to === "string" && record !== void 0 && session.deliveryToken.get(m.in_reply_to) !== void 0 && record.channel_id === m.channel_id && !agent.isRuntimeMessageRetired(m.in_reply_to);
     const sendOpts = {
       agentTurn: isAgentTurn(agent, m),
       ...typeof m.in_reply_to === "string" ? { inReplyTo: m.in_reply_to } : {},
-      ...typeof m.idempotency_key === "string" ? { idempotencyKey: m.idempotency_key } : {}
+      ...typeof m.idempotency_key === "string" ? { idempotencyKey: m.idempotency_key } : {},
+      ...callBufferReply ? { callBufferReply: true } : {}
     };
     if (m.a2a && typeof m.a2a === "object") {
       const a = m.a2a;