@securecoms/agent-bridge 0.30.3 → 0.31.0

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.30.3";
+export declare const BRIDGE_VERSION = "0.31.0";

package/dist/voice/call-buffer.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Voice fast-path privacy (spec §2.1, OQ-1 ruled option (iii); amendments §2.2 A-1 to A-6): the CALL BUFFER.
+ *
+ * An in-process, per-channel list of the current call's spoken turns. It is the ONLY history a voice-scoped turn
+ * sees: it never reads the memory provider, the SecureComs store, the unified store or the 7b index. What enters it can
+ * reach the fast-complete proxy and OpenRouter, so its admission rules (enforced by the bridge, not here) are the
+ * privacy boundary:
+ *  - peer entries: the text of a VS-1 or VS-2 turn only (never VS-3 or VS-4 alone), never a turn that failed owner
+ *    verification;
+ *  - agent entries: `sendSpoken` lines (origin "fast_path") and admitted runtime replies (origin "reply").
+ *
+ * Every reset signal (reset(), the idle rule, a restart) only REMOVES entries. No persistence of any kind.
+ *
+ * A-5: an entry's sequence number is internal (`bufSeq`, monotonic across all channels and resets, so a snapshot's
+ * end seq never collides with a later call's entries). Entries handed out by `recent` and `agentAfter` carry `seq: 0`,
+ * a value no store row has, so the bridge's store-meta readers can skip them.
+ *
+ * Final fix I-1: a peer entry is admitted once per turn id (the admitted-id set), so a redelivered row never re-enters
+ * the call and its re-snapshot never contains itself.
+ *
+ * A-4: the voice-scoped id set and the per-message seq notes exist ONLY to admit runtime replies and for the release
+ * re-read. No delivery gate may key on them: forgetting an id (a reset, the idle rule, the cap) only stops a later
+ * reply from being buffered, which fails closed.
+ */
+/** Spec §2.1: 50 entries per channel, the `memoryForTurn` default limit. */
+export declare const CALL_BUFFER_CAP = 50;
+/** Spec §2.1 reset (c): 30 minutes with no append clears the channel. */
+export declare const CALL_BUFFER_IDLE_MS: number;
+/** Spec §2.1 bounds (audit finding 10a): the id set and the seq notes, as `taintedTurns` / `cleanTurns` (5000). */
+export declare const CALL_BUFFER_ID_CAP = 5000;
+/**
+ * A point in a channel's buffer: the newest bufSeq at that moment and the channel's reset generation then. Final fix
+ * M-4: `agentAfter` from a mark of an earlier generation returns nothing, so lines of a later call never join an older
+ * snapshot.
+ */
+export interface CallBufferMark {
+    seq: number;
+    generation: number;
+}
+/** N1 (A-1): where an agent entry came from. Peer entries carry none. */
+export type CallBufferOrigin = "fast_path" | "reply";
+/** One entry as handed out: shaped to `MemoryTurn` (`seq` required), with `seq` always 0 (A-5). */
+export interface CallBufferTurn {
+    role: "peer" | "agent";
+    text: string;
+    seq: 0;
+    origin?: CallBufferOrigin;
+}
+export interface CallBufferOptions {
+    cap: number;
+    idleMs: number;
+    now: () => number;
+    /** False when the agent's memory provider is "none": appends and marks are dropped (one guard, at the write), so reads return nothing. */
+    enabled: boolean;
+}
+export declare class CallBuffer {
+    private readonly opts;
+    private readonly channels;
+    /** messageId -> channelId, insertion ordered (oldest first) for the cap. */
+    private readonly voiceIds;
+    /** messageId -> { channelId, the channel's bufSeq at the mark, the channel's generation then }. */
+    private readonly seqNotes;
+    /**
+     * Final fix I-1: messageId -> { channelId, the channel's bufSeq just before the turn's own peer entry }. A row the
+     * backend redelivers (a failed ack, runtime_inbox.full backpressure) is ingested again; its id here means its text is
+     * already in the call, so it is not appended again and its snapshot stops before its own entry (A-6).
+     */
+    private readonly admitted;
+    /** The last bufSeq handed out per channel (kept across resets, so the sequence never runs backwards). */
+    private readonly lastSeq;
+    private nextSeq;
+    /** Per-channel reset generation (advanced by every reset, the idle rule included). */
+    private readonly gens;
+    constructor(opts: CallBufferOptions);
+    /**
+     * Append a spoken turn's text, once per turn id (final fix I-1). Returns false (and appends nothing) when the id was
+     * already admitted in this call, or when the buffer is disabled.
+     */
+    appendPeer(channelId: string, text: string, messageId: string): boolean;
+    /**
+     * Final fix I-1: for a turn already admitted in this call, the channel's bufSeq just before its own entry (the end seq
+     * of its first snapshot); undefined for a turn not admitted (or forgotten by a reset, the idle rule or the id cap).
+     */
+    admittedAt(messageId: string): number | undefined;
+    appendAgent(channelId: string, text: string, origin: CallBufferOrigin): void;
+    /**
+     * Record a voice-scoped turn's id (for reply admission only, A-4) and note the channel's seq at this point. Final fix
+     * I-1: a turn already admitted (a redelivered row) keeps the seq of its first admission, so the note never moves past
+     * the turn's own entry.
+     */
+    markVoiceScoped(channelId: string, messageId: string): void;
+    /** A-4: read ONLY by the bridge's `afterPublish` reply admission. */
+    isVoiceScopedId(messageId: string): boolean;
+    /** The channel's mark noted when `messageId` was marked (the release re-read), or undefined (e.g. after a restart). */
+    seqNoted(messageId: string): CallBufferMark | undefined;
+    /** The bufSeq of the channel's newest entry (0 before any append). A snapshot's end seq. */
+    seqAt(channelId: string): number;
+    /**
+     * The channel's last `limit` entries, oldest first. With `upTo` (final fix I-1, a redelivered turn's re-snapshot),
+     * only entries at or below that bufSeq.
+     */
+    recent(channelId: string, limit: number, upTo?: number): CallBufferTurn[];
+    /**
+     * The channel's AGENT entries appended after `since.seq` (lines spoken or answered since a snapshot), oldest first.
+     * Final fix M-4: nothing when the channel has been reset since the mark (a later call's lines).
+     */
+    agentAfter(channelId: string, since: CallBufferMark): CallBufferTurn[];
+    /**
+     * The channel's reset generation: it changes on every reset (explicit or idle) and on nothing else. A caller that
+     * holds text across an await (the coalesce window) compares it to skip an append into a call that has since ended.
+     */
+    generation(channelId: string): number;
+    /** Clear the channel: its entries, its voice-scoped ids, its seq notes and its admitted ids. Only ever removes. */
+    reset(channelId: string): void;
+    private append;
+    /** Reset (c): more than `idleMs` since the channel's last append clears it, checked on every read and append. */
+    private expireIfIdle;
+}

package/dist/voice/persona.d.ts

@@ -1,5 +1,12 @@
 import { type VoiceSettings } from "./settings.js";
 export declare const CONTINUITY_CLAUSE: string;
+/**
+ * Voice fast-path privacy, spec §3 OQ-3 (ruled 2026-10-18): the clause that ends the fast prompt (and, Task 6, a
+ * voice-scoped runtime frame's guidance) in place of CONTINUITY_CLAUSE. On a voice-scoped turn the model sees only the
+ * call's own spoken turns, so it is told so and given a safe script instead of being told it sees the whole chat.
+ * Model instruction, not user copy. CONTINUITY_CLAUSE itself is unchanged (the compiled prompt, the worker).
+ */
+export declare const VOICE_CALL_CLAUSE: string;
 /**
  * `displayName` is legacy (the credential file's `voice.persona.display_name`,
  * or the backend's voice settings `display_name`). It is still parsed so old
@@ -19,6 +26,8 @@ export interface FastPathConfig {
     apiKey?: string;
     timeoutMs: number;
     maxTokens: number;
+    /** Extra request headers. Set only by settingsToVoiceConfig (the SecureComs proxy); never by parseVoiceConfig. */
+    headers?: Readonly<Record<string, string>>;
 }
 export interface VoiceConfig {
     persona: VoicePersona;

package/dist/voice/voice-scope.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Voice fast-path privacy (spec §1; OQ-2 ruled): a turn is VOICE-SCOPED when ANY of these holds, evaluated once at
+ * ingest from authenticated or narrowing-only inputs:
+ *   VS-1 `speaker !== undefined`: a relay-attributed spoken turn (the body claims `relay: true` with both speaker strings
+ *        AND the envelope sender's roster row is `is_relay`);
+ *   VS-2 `transcribed === true`: the E2E body's own claim (a peer that forges it only narrows its own turn);
+ *   VS-3 the envelope sender's roster row is `is_relay`: a relay-sent text is not a human's typed turn;
+ *   VS-4 the turn text is exactly the call-start marker (after trim).
+ * A typed message sent during a live call (server `voiceMode` true, none of VS-1 to VS-4) is NOT voice-scoped.
+ * A voice-scoped verdict narrows what the turn's model sees and the owner's grants (G-1); no disjunct may widen anything.
+ */
+export declare function isVoiceScopedTurn(t: {
+    speaker: {
+        identityId: string;
+    } | undefined;
+    transcribed: unknown;
+    senderIsRelay: boolean;
+    text: string;
+}): boolean;
+/**
+ * Task 4b (spec §1 split table, audit round 1 finding 3): a voice-scoped turn's text is admitted to the call buffer
+ * only when VS-1 (relay speaker) or VS-2 (the body's own `transcribed`) holds. VS-3 (the server's `is_relay` flag
+ * alone) and VS-4 (the call-start marker, an instruction, not speech) never admit: what a forged admitting disjunct can
+ * add is only the sender's own words.
+ */
+export declare function admitsToCallBuffer(t: {
+    speaker: {
+        identityId: string;
+    } | undefined;
+    transcribed: unknown;
+}): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.30.3",
+  "version": "0.31.0",
   "type": "module",
   "engines": {
     "node": ">=24"