@securecoms/agent-bridge 0.33.1 → 0.35.0

package/dist/bin.js

@@ -7416,37 +7416,37 @@ __export(layout_exports, {
   presentWithSize: () => presentWithSize,
   wrongTypeAt: () => wrongTypeAt
 });
-import { chmodSync, lstatSync as lstatSync2, mkdirSync, renameSync, rmSync } from "node:fs";
+import { chmodSync as chmodSync2, lstatSync as lstatSync3, mkdirSync as mkdirSync2, renameSync, rmSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, dirname as dirname4, join as join9 } from "node:path";
+import { basename as basename3, dirname as dirname5, join as join10 } from "node:path";
 function kind(p) {
   try {
-    return lstatSync2(p).isDirectory() ? "dir" : "other";
+    return lstatSync3(p).isDirectory() ? "dir" : "other";
   } catch (e) {
     if (e.code === "ENOENT") return "absent";
     throw e;
   }
 }
 function plainDirChain(root3, parts, opts) {
-  const modelsDir = dirname4(root3);
+  const modelsDir = dirname5(root3);
   for (const part of parts) if (!part || part === "." || part === ".." || part.includes("/") || part.includes("\\")) throw new LayoutRefused();
   const k = kind(modelsDir);
   if (k === "other") throw new LayoutRefused();
   if (k === "absent") {
     if (!opts.create) return null;
-    mkdirSync(modelsDir, { recursive: true, mode: 448 });
+    mkdirSync2(modelsDir, { recursive: true, mode: 448 });
     if (kind(modelsDir) !== "dir") throw new LayoutRefused();
   }
-  const chain = opts.fromModelsDir ? parts : [basename2(root3), ...parts];
+  const chain = opts.fromModelsDir ? parts : [basename3(root3), ...parts];
   let p = modelsDir;
   for (let i = 0; i < chain.length; i++) {
-    p = join9(p, chain[i]);
+    p = join10(p, chain[i]);
     const c = kind(p);
     if (c === "other") throw new LayoutRefused();
     if (c === "absent") {
       if (!opts.create) return null;
       try {
-        mkdirSync(p, { mode: i === chain.length - 1 && opts.mode !== void 0 ? opts.mode : 493 });
+        mkdirSync2(p, { mode: i === chain.length - 1 && opts.mode !== void 0 ? opts.mode : 493 });
       } catch (e) {
         if (e.code !== "EEXIST") throw e;
       }
@@ -7457,7 +7457,7 @@ function plainDirChain(root3, parts, opts) {
 }
 function presentWithSize(p, size) {
   try {
-    const s = lstatSync2(p);
+    const s = lstatSync3(p);
     return s.isFile() && s.size === size;
   } catch {
     return false;
@@ -7465,7 +7465,7 @@ function presentWithSize(p, size) {
 }
 function wrongTypeAt(p) {
   try {
-    const s = lstatSync2(p);
+    const s = lstatSync3(p);
     return !s.isFile() && !s.isSymbolicLink();
   } catch {
     return false;
@@ -7478,16 +7478,16 @@ function installVerified(root3, modelId, f, partial, opts) {
     dir = plainDirChain(root3, [modelId, f.sha256], { create: true });
     if (!dir) throw new LayoutRefused();
     if (!opts.replace && presentWithSize(dest, f.size)) return;
-    chmodSync(dir, 493);
+    chmodSync2(dir, 493);
     try {
       renameSync(partial, dest);
     } catch (e) {
       if (!presentWithSize(dest, f.size)) throw e;
       return;
     }
-    chmodSync(dest, 292);
+    chmodSync2(dest, 292);
   } finally {
-    if (dir) chmodSync(dir, 365);
+    if (dir) chmodSync2(dir, 365);
     rmSync(partial, { force: true });
   }
 }
@@ -7495,9 +7495,9 @@ var defaultModelsRoot, partialDir, filePath, LayoutRefused;
 var init_layout = __esm({
   "src/memory/embedder/layout.ts"() {
     "use strict";
-    defaultModelsRoot = (home = homedir2()) => join9(home, ".securecoms", "models", "embeddings");
-    partialDir = (root3) => join9(dirname4(root3), ".partial");
-    filePath = (root3, modelId, f) => join9(root3, modelId, f.sha256, f.name);
+    defaultModelsRoot = (home = homedir2()) => join10(home, ".securecoms", "models", "embeddings");
+    partialDir = (root3) => join10(dirname5(root3), ".partial");
+    filePath = (root3, modelId, f) => join10(root3, modelId, f.sha256, f.name);
     LayoutRefused = class extends Error {
       constructor() {
         super("the model directory is not a plain directory");
@@ -7557,11 +7557,11 @@ __export(import_bundle_exports, {
 });
 import { createHash as createHash6, randomBytes as randomBytes12 } from "node:crypto";
 import { readFileSync as readFileSync16, statSync as statSync7, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 async function importModelBundle(srcDir, root3, m) {
   const verified = [];
   for (const f of m.files) {
-    const src = join24(srcDir, f.name);
+    const src = join25(srcDir, f.name);
     let size;
     try {
       const s = statSync7(src);
@@ -7585,7 +7585,7 @@ async function importModelBundle(srcDir, root3, m) {
   for (const { f, bytes } of verified) {
     try {
       const pdir = plainDirChain(root3, [".partial"], { create: true, fromModelsDir: true, mode: 448 });
-      const partial = join24(pdir, randomBytes12(12).toString("hex"));
+      const partial = join25(pdir, randomBytes12(12).toString("hex"));
       writeFileSync4(partial, bytes, { mode: 384, flag: "wx" });
       installVerified(root3, m.modelId, f, partial, { replace: true });
     } catch (e) {
@@ -19331,6 +19331,8 @@ function isEpochConflict(e) {
 var LABEL = "agentvault-connect-v1";
 var DEFAULT_STUCK_THRESHOLD = 2;
 var DEFAULT_QUARANTINE_THRESHOLD = 8;
+var KEPT_WELCOME_COMMIT_DEFER_MS = 24 * 60 * 60 * 1e3;
+var KEPT_WELCOME_COMMIT_DEFER_MAX_ROWS = 32;
 var DELIVERY_PULL_PAGE = 100;
 var DELIVERY_MAX_RETRIES = 5;
 var DrainPageFullError = class extends Error {
@@ -19535,6 +19537,15 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * {@link errorStats}; mutated only through {@link recordDecryptError} /
    * {@link recordDecryptSuccess}.
    */
+  /** {@link KEPT_WELCOME_COMMIT_DEFER_MS}: channel -> when its first commit was
+   *  deferred behind the kept Welcome `welcomeId`. Restarted for a different
+   *  Welcome; cleared when the channel decrypts, or when a pass that saw the
+   *  whole queue kept no Welcome for it (fix round 1, L2: the Welcome
+   *  resolved, so a later re-Welcome gets a fresh, bounded window). An entry
+   *  past its bound stays (expired) until then, so the bound cannot restart
+   *  itself pass after pass. In memory: a reload restarts it, and the
+   *  per-pass row cap is what bounds the page cost across reloads. */
+  keptWelcomeDeferSince = /* @__PURE__ */ new Map();
   errors = /* @__PURE__ */ new Map();
   stuckThreshold;
   /** Consecutive-error threshold at which a wedged channel's row is quarantined
@@ -19753,8 +19764,33 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * channel resumes normal processing and can quarantine again later if it
    * re-wedges (the onWedged guard is reset so the hook can fire again).
    */
+  /** See {@link MlsGroupKeyProviderOpts.deferCommitsWhileWelcomePending}. The
+   *  caller has already established that this pass KEPT a no-state Welcome
+   *  for `channelId`. True: defer the commit row. Never throws. */
+  deferKeptWelcomeCommit(channelId, welcomeId) {
+    const pred = this.o.deferCommitsWhileWelcomePending;
+    if (!pred)
+      return false;
+    let boundMs = 0;
+    try {
+      const v = pred(channelId);
+      boundMs = v === true ? KEPT_WELCOME_COMMIT_DEFER_MS : typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.min(v, KEPT_WELCOME_COMMIT_DEFER_MS) : 0;
+    } catch {
+      boundMs = 0;
+    }
+    if (boundMs <= 0)
+      return false;
+    const now = this.nowMs();
+    const entry = this.keptWelcomeDeferSince.get(channelId);
+    if (entry === void 0 || entry.welcomeId !== welcomeId) {
+      this.keptWelcomeDeferSince.set(channelId, { since: now, welcomeId });
+      return true;
+    }
+    return now - entry.since < boundMs;
+  }
   recordDecryptSuccess(channelId) {
     this.lastDecryptAt.set(channelId, Date.now());
+    this.keptWelcomeDeferSince.delete(channelId);
     const e = this.errors.get(channelId);
     if (!e)
       return;
@@ -20150,6 +20186,12 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * server's REJOIN_THRESHOLD, there was nothing to apply, or a commit would
    * not apply (which means the state is genuinely FORKED, not merely behind,
    * and replay cannot fix a fork).
+   *
+   * THROWS (retryable, never `false`, #1290): CustodyPersistError when the
+   * channel is under the custody hold (nothing applied), and the C2 classes
+   * (PendingCommitUnresolvedError from the guarded MAIN write) after evicting
+   * the advanced cache, so the persisted state is unchanged. A /sync request
+   * that fails also throws, before anything is applied.
    */
   async resyncByReplay(channelId, groupId) {
     if (!await this.hasPersistedChannelState(channelId))
@@ -20169,12 +20211,26 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     let applied = 0;
     try {
       await this.locks.run(channelId, async () => {
+        if (await this.custodyHeld(channelId))
+          throw new CustodyPersistError(channelId);
         const mgr = await this.manager(channelId);
         try {
           for (const c of commits) {
             if (c.epoch <= Number(mgr.epoch))
               continue;
-            await mgr.decrypt(hexToBytes22(c.payload));
+            const commitBytes = hexToBytes22(c.payload);
+            try {
+              await mgr.decrypt(commitBytes);
+            } catch (e) {
+              if (await probeOwnRemoval(mgr, commitBytes) !== null) {
+                this.noteOwnLeafRemoved(channelId, {
+                  group_id: groupId,
+                  epoch: c.epoch,
+                  message_id: c.id
+                });
+              }
+              throw e;
+            }
             applied++;
           }
           if (applied > 0)
@@ -20186,6 +20242,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         }
       });
     } catch (e) {
+      if (isSdkError(e, "CustodyPersistError") || e instanceof CustodyPersistError || e instanceof PendingCommitUnresolvedError || e instanceof GroupSupersededError || e instanceof AttestedOrphanRefusedError) {
+        writeServiceLog2("warn", "resync.replay_held", { applied }, e);
+        throw e;
+      }
       writeServiceLog2("warn", "resync.replay_commit_failed", { applied }, e);
       return false;
     }
@@ -22886,6 +22946,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         out.push({
           queueId: `replay-${m.id}`,
           messageId: envelope.message_id,
+          // #1246 C-1: the group-messages row id is the same mls_messages key.
+          ...typeof m.id === "string" && m.id ? { serverMessageId: m.id } : {},
           channelId,
           plaintext,
           envelope,
@@ -23786,6 +23848,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     const heldBundleRefs = () => heldBundleRefsMemo ??= this.readHeldBundleRefs();
     const w2Acked = /* @__PURE__ */ new Map();
     const w2Kept = /* @__PURE__ */ new Set();
+    const keptWelcomeId = /* @__PURE__ */ new Map();
+    const deferredThisPass = /* @__PURE__ */ new Map();
     const unpinnedRefusals = /* @__PURE__ */ new Map();
     const welcomes = rows.filter((r) => r.message_type === "welcome");
     const nonWelcomes = rows.filter((r) => r.message_type !== "welcome");
@@ -23944,6 +24008,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
                 writeServiceLog2("warn", "welcome.unopenable");
               } else {
                 w2Kept.add(wcid);
+                if (!keptWelcomeId.has(wcid))
+                  keptWelcomeId.set(wcid, row.queue_id);
                 if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
                   writeServiceLog2("debug", "delivery.welcome_no_local_state");
                 }
@@ -23954,6 +24020,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           const cid = row.connect_channel_id;
           if (!cid)
             continue;
+          if (w2Kept.has(cid) && (deferredThisPass.get(cid) ?? 0) < KEPT_WELCOME_COMMIT_DEFER_MAX_ROWS && this.deferKeptWelcomeCommit(cid, keptWelcomeId.get(cid) ?? "")) {
+            deferredThisPass.set(cid, (deferredThisPass.get(cid) ?? 0) + 1);
+            continue;
+          }
           let advancedEpoch;
           let custodyHeld = false;
           await this.locks.run(cid, async () => {
@@ -24110,6 +24180,12 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         this.leftStreak.set(cid, { pulls: 1, since: pullNow });
       this.scheduleAutoResolve(cid);
     }
+    if (rows.length < DELIVERY_PULL_PAGE) {
+      for (const cid of [...this.keptWelcomeDeferSince.keys()]) {
+        if (!w2Kept.has(cid))
+          this.keptWelcomeDeferSince.delete(cid);
+      }
+    }
     for (const [cid, gid] of w2Acked) {
       if (w2Kept.has(cid))
         continue;
@@ -24389,7 +24465,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         voiceDefaultResponder: row.voice_default_responder ?? void 0,
         ...typeof row.identity_signature === "string" && row.identity_signature ? { identitySignature: row.identity_signature } : {},
         payloadHex: row.payload,
-        openedAt
+        openedAt,
+        // #1246 C-1: the server row id, beside the sender-chosen envelope id.
+        ...typeof row.message_id === "string" && row.message_id ? { serverMessageId: row.message_id } : {}
       };
       const custodiedAt = this.nowMs();
       this.custody.set(row.queue_id, entry);
@@ -25396,8 +25474,8 @@ function openDeliveryPings(o) {
             return Promise.resolve({ value: void 0, done: true });
           if (queue.length)
             return Promise.resolve({ value: queue.shift(), done: false });
-          return new Promise((resolve4) => {
-            waiter = resolve4;
+          return new Promise((resolve5) => {
+            waiter = resolve5;
           });
         }
       };
@@ -25717,8 +25795,8 @@ var PingSubscriber = class {
             return Promise.resolve({ value: void 0, done: true });
           if (this.queue.length)
             return Promise.resolve({ value: this.queue.shift(), done: false });
-          return new Promise((resolve4) => {
-            this.waiter = resolve4;
+          return new Promise((resolve5) => {
+            this.waiter = resolve5;
           });
         }
       };
@@ -26911,6 +26989,11 @@ var FakeConnectBackend = class _FakeConnectBackend {
   // Owner-signed tool grants (spec §7.0): like Plan 0's backend, each row carries
   // the envelope's `identity_proof.signature` as `identity_signature` beside the
   // unsigned canonical payload. `omitSignature` models a pre-Plan-0 row.
+  /** `rowMessageId` (#1246 C-1): the server row id to deliver, when it is NOT
+   *  the envelope's id. The REST send path keys the row by the envelope id
+   *  (connect_messages.py, `MLSMessage(id=message_id)`); the WS `message_mls`
+   *  path stores through `store_mls_message`, whose row id is server-generated,
+   *  so there the two differ and the envelope id is the sender's free choice. */
   async ingestApplication(envelope, opts) {
     const channelId = envelope.channel_id;
     const canonical = await canonicalEnvelopeBytes(envelope);
@@ -26922,7 +27005,7 @@ var FakeConnectBackend = class _FakeConnectBackend {
         continue;
       this.q(dev).push({
         queue_id: "q-" + this._seq++,
-        message_id: envelope.message_id,
+        message_id: opts?.rowMessageId ?? envelope.message_id,
         group_id: groupId,
         message_type: "application",
         sender_device_id: senderDeviceId ?? "",
@@ -27306,6 +27389,7 @@ function openSchema(db) {
   ensureRuntimeInboxDeliveryAttempts(db);
   ensureRuntimeReplyIntent(db);
   ensureRuntimeReplyIntentEnvelopeGroup(db);
+  ensureRuntimeReplyIntentCredit(db);
   ensureGroupLink(db);
   ensureMlsCustody(db);
   ensureToolGrantTables(db);
@@ -27386,6 +27470,19 @@ function ensureRuntimeReplyIntentEnvelopeGroup(db) {
     throw e;
   }
 }
+function ensureRuntimeReplyIntentCredit(db) {
+  const hasColumn = () => db.prepare("PRAGMA table_info(runtime_reply_intent)").all().some((c) => c.name === "reply_credit");
+  const cols = db.prepare("PRAGMA table_info(runtime_reply_intent)").all();
+  if (cols.length === 0 || cols.some((c) => c.name === "reply_credit"))
+    return;
+  try {
+    db.exec("ALTER TABLE runtime_reply_intent ADD COLUMN reply_credit TEXT");
+  } catch (e) {
+    if (hasColumn())
+      return;
+    throw e;
+  }
+}
 var RECALL_STATE_COLUMNS = [
   ["recall_enabled", "INTEGER NOT NULL DEFAULT 0"],
   ["recall_mode_epoch", "INTEGER NOT NULL DEFAULT 0"],
@@ -28437,8 +28534,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
     this.db.prepare("DELETE FROM runtime_reply_intent WHERE identity_id=? AND updated_at < ?").run(this.id, now - RUNTIME_REPLY_INTENT_RETENTION_MS);
     const info = this.db.prepare(`INSERT OR IGNORE INTO runtime_reply_intent
          (identity_id, scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-          sealed_body, sealed_envelope, state, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?)`).run(this.id, input.scope, input.part, input.inReplyTo, input.channelId, input.replyMessageId, input.bodyMac, sealed, now, now);
+          sealed_body, sealed_envelope, state, created_at, updated_at, reply_credit)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?)`).run(this.id, input.scope, input.part, input.inReplyTo, input.channelId, input.replyMessageId, input.bodyMac, sealed, now, now, input.replyCredit ?? null);
     const count = this.db.prepare("SELECT COUNT(*) AS n FROM runtime_reply_intent WHERE identity_id=?").get(this.id);
     if (count.n > RUNTIME_REPLY_INTENT_MAX) {
       this.db.prepare(`DELETE FROM runtime_reply_intent
@@ -28448,7 +28545,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
          )`).run(this.id, this.id, RUNTIME_REPLY_INTENT_MAX);
     }
     const row = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
        FROM runtime_reply_intent WHERE identity_id=? AND scope=? AND part=?`).get(this.id, input.scope, input.part);
     if (!row)
       throw new Error("reply intent vanished after claim");
@@ -28457,7 +28554,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   /** SEC-06 #18: every intent answering `inReplyTo`, in claim order. */
   async listReplyIntents(inReplyTo) {
     const rows = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
        FROM runtime_reply_intent WHERE identity_id=? AND in_reply_to=?
        ORDER BY created_at ASC, rowid ASC`).all(this.id, inReplyTo);
     const out = [];
@@ -28468,7 +28565,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   /** SEC-06 #18: re-read one intent by its key (null when absent). */
   async getReplyIntent(scope, part) {
     const row = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
        FROM runtime_reply_intent WHERE identity_id=? AND scope=? AND part=?`).get(this.id, scope, part);
     return row ? this.openReplyIntent(row) : null;
   }
@@ -28542,7 +28639,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       envelope,
       envelopeGroupId: envelopeGroupFor(envelope, await openOrNull(row.sealed_envelope_group)),
       state: row.state === "sent" ? "sent" : row.state === "skipped" ? "skipped" : "pending",
-      createdAt: Number(row.created_at)
+      createdAt: Number(row.created_at),
+      replyCredit: typeof row.reply_credit === "string" ? row.reply_credit : null
     };
   }
   async recordMemory(input) {
@@ -30312,8 +30410,8 @@ function decodeReplyBody(bytes) {
   if (b?.kind === "a2a" && b.a2a && typeof b.a2a === "object") return b;
   throw new Error("reply intent body is malformed");
 }
-function replyBodyMac(key, replyId, channelId, body) {
-  return createHmac("sha256", key).update(JSON.stringify(["reply-body", replyId, channelId])).update("\0").update(body).digest("hex");
+function replyBodyMac(key, replyId, channelId, body, credit) {
+  return createHmac("sha256", key).update(JSON.stringify(credit === void 0 ? ["reply-body", replyId, channelId] : ["reply-body", replyId, channelId, credit])).update("\0").update(body).digest("hex");
 }
 function partOrdinal(part) {
   const m = /^p:(\d+)$/.exec(part);
@@ -30395,8 +30493,96 @@ function loadPackageMeta(importMetaUrl) {
 }
 
 // src/bridge-agent.ts
-import { existsSync as existsSync5, promises as fsp, readFileSync as readFileSync11, statSync as statSync5 } from "node:fs";
-import { join as join19, dirname as dirname7 } from "node:path";
+import { existsSync as existsSync5, promises as fsp2, readFileSync as readFileSync11, statSync as statSync5 } from "node:fs";
+
+// src/outbox.ts
+import { constants, mkdirSync, lstatSync as lstatSync2, chmodSync, realpathSync, promises as fsp } from "node:fs";
+import { basename, dirname as dirname4, join as join4, resolve } from "node:path";
+var VAULT_OUTBOX_DIRNAME = "vault-outbox";
+var PathOutsideOutboxError = class extends Error {
+  constructor() {
+    super("path_outside_outbox");
+    this.name = "PathOutsideOutboxError";
+  }
+};
+var POSIX = process.platform !== "win32";
+function ownedPrivateDir(st) {
+  if (st.isSymbolicLink() || !st.isDirectory()) return false;
+  if (!POSIX) return true;
+  const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
+  if (uid !== void 0 && st.uid !== uid) return false;
+  return (st.mode & 511) === 448;
+}
+function ensureOutbox(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  let st = lstatSync2(dir);
+  if (st.isSymbolicLink() || !st.isDirectory()) throw new PathOutsideOutboxError();
+  const uid = POSIX && typeof process.getuid === "function" ? process.getuid() : void 0;
+  if (uid !== void 0 && st.uid !== uid) throw new PathOutsideOutboxError();
+  if (POSIX && (st.mode & 511) !== 448) {
+    chmodSync(dir, 448);
+    st = lstatSync2(dir);
+  }
+  if (!ownedPrivateDir(st)) throw new PathOutsideOutboxError();
+  return { dir, real: realpathSync(dir), dev: st.dev, ino: st.ino };
+}
+var NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+var NONBLOCK = constants.O_NONBLOCK ?? 0;
+async function readOutboxFile(pin, callerPath) {
+  if (!pin) throw new PathOutsideOutboxError();
+  try {
+    const st = await fsp.lstat(pin.dir);
+    if (!ownedPrivateDir(st) || st.dev !== pin.dev || st.ino !== pin.ino) throw new PathOutsideOutboxError();
+  } catch {
+    throw new PathOutsideOutboxError();
+  }
+  const requested = resolve(pin.dir, callerPath);
+  const name = basename(requested);
+  let realParent;
+  try {
+    realParent = await fsp.realpath(dirname4(requested));
+  } catch {
+    throw new PathOutsideOutboxError();
+  }
+  if (realParent !== pin.real) throw new PathOutsideOutboxError();
+  const target = join4(pin.real, name);
+  const pre = await fsp.lstat(target);
+  if (pre.isSymbolicLink() || !pre.isFile()) throw new PathOutsideOutboxError();
+  let handle;
+  try {
+    handle = await fsp.open(target, constants.O_RDONLY | NOFOLLOW | NONBLOCK);
+  } catch (e) {
+    if (e.code === "ENOENT") throw e;
+    throw new PathOutsideOutboxError();
+  }
+  try {
+    const st = await handle.stat();
+    if (!st.isFile() || st.dev !== pre.dev || st.ino !== pre.ino || st.nlink !== 1) {
+      throw new PathOutsideOutboxError();
+    }
+    return { bytes: new Uint8Array(await handle.readFile()), path: target, dev: st.dev, ino: st.ino };
+  } finally {
+    await handle.close().catch(() => {
+    });
+  }
+}
+async function consumeOutboxFile(pin, read) {
+  try {
+    const dir = await fsp.lstat(pin.dir);
+    if (!ownedPrivateDir(dir) || dir.dev !== pin.dev || dir.ino !== pin.ino) return false;
+    if (await fsp.realpath(pin.dir) !== pin.real) return false;
+    const target = join4(pin.real, basename(read.path));
+    const st = await fsp.lstat(target);
+    if (st.isSymbolicLink() || st.dev !== read.dev || st.ino !== read.ino) return false;
+    await fsp.unlink(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/bridge-agent.ts
+import { join as join20, dirname as dirname8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/latency.ts
@@ -30844,11 +31030,21 @@ function pinCoverage(pinStripped, ownerMessage, coverTexts) {
 }
 
 // src/attachments.ts
-import { basename } from "node:path";
+import { basename as basename2 } from "node:path";
 var VAULT_REF_MAX_SIZE_HINT = 100 * 1024 * 1024 - 16;
 var VAULT_REF_MAX_NAME = 255;
 var VAULT_REF_MAX_MIME = 127;
 var CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var InvalidBlobIdError = class extends Error {
+  constructor() {
+    super("invalid_blob_id");
+    this.name = "InvalidBlobIdError";
+  }
+};
+function assertBlobId(blobId) {
+  if (typeof blobId !== "string" || !CANONICAL_UUID.test(blobId)) throw new InvalidBlobIdError();
+  return blobId;
+}
 var VAULT_PIN = /^blake2b:[0-9a-f]{64}$/;
 var HINT_FORBIDDEN = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/;
 var MIME_TYPE = /^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*$/;
@@ -30887,7 +31083,7 @@ function toVaultRefEntry(body) {
   return entry;
 }
 function sanitizeFilename(name, fallback) {
-  const base = basename(name ?? "");
+  const base = basename2(name ?? "");
   const cleaned = base.replace(/[/\\]/g, "").replace(/^\.+$/, "");
   return cleaned.length > 0 ? cleaned : fallback;
 }
@@ -30917,7 +31113,7 @@ function mimeForName(name) {
 async function prepareAttachment(filePath2, caption, channelId, deps) {
   await deps.ready();
   const bytes = await deps.readFile(filePath2);
-  const name = basename(filePath2);
+  const name = basename2(filePath2);
   const { encryptedData, fileKey, fileNonce, digest } = await deps.encryptFile(bytes);
   const blobId = await deps.uploadBlob(encryptedData, channelId);
   const body = {
@@ -30935,8 +31131,9 @@ async function prepareAttachment(filePath2, caption, channelId, deps) {
   return body;
 }
 async function materializeAttachment(body, ctx, deps) {
+  const blobId = assertBlobId(body.blobId);
   await deps.ready();
-  const ciphertext = await deps.downloadBlob(body.blobId);
+  const ciphertext = await deps.downloadBlob(blobId);
   const sha25612 = await deps.computeFileDigest(ciphertext);
   if (sha25612 !== body.digest) {
     throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
@@ -30962,13 +31159,13 @@ function ensureSodiumReady2() {
 // src/memory/hermes-session-map.ts
 import { readFileSync as readFileSync3 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 function expandHome(p) {
-  return p === "~" || p.startsWith("~/") ? join4(homedir(), p.slice(1)) : p;
+  return p === "~" || p.startsWith("~/") ? join5(homedir(), p.slice(1)) : p;
 }
 function resolveHermesSession(baseDir, conversationId) {
   try {
-    const path = join4(expandHome(baseDir), "sessions", "sessions.json");
+    const path = join5(expandHome(baseDir), "sessions", "sessions.json");
     const map = JSON.parse(readFileSync3(path, "utf8"));
     const entry = map[`agent:main:securecoms:dm:${conversationId}`];
     const sid = entry?.session_id;
@@ -30980,11 +31177,11 @@ function resolveHermesSession(baseDir, conversationId) {
 
 // src/memory/hermes-store.ts
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var HermesStore = class {
   dbPath;
   constructor(baseDir) {
-    this.dbPath = join5(expandHome(baseDir), "state.db");
+    this.dbPath = join6(expandHome(baseDir), "state.db");
   }
   /** Recent-K conversational turns for a session, chronological. Fail-safe → []. */
   readRecent(sessionId, limit) {
@@ -31126,10 +31323,10 @@ var HermesMemoryProvider = class {
 
 // src/memory/openclaw-session-map.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function resolveOwnerDmSession(baseDir, agent) {
   try {
-    const path = join6(expandHome(baseDir), "agents", agent, "sessions", "sessions.json");
+    const path = join7(expandHome(baseDir), "agents", agent, "sessions", "sessions.json");
     const map = JSON.parse(readFileSync4(path, "utf8"));
     let best = null;
     for (const [key, entry] of Object.entries(map)) {
@@ -31147,11 +31344,11 @@ function resolveOwnerDmSession(baseDir, agent) {
 
 // src/memory/openclaw-session-log.ts
 import { readFileSync as readFileSync5 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function readRecentTurns(baseDir, agent, sessionId, k) {
   let raw;
   try {
-    raw = readFileSync5(join7(expandHome(baseDir), "agents", agent, "sessions", `${sessionId}.jsonl`), "utf8");
+    raw = readFileSync5(join8(expandHome(baseDir), "agents", agent, "sessions", `${sessionId}.jsonl`), "utf8");
   } catch {
     return [];
   }
@@ -31182,7 +31379,7 @@ function readRecentTurns(baseDir, agent, sessionId, k) {
 
 // src/memory/openclaw-workspace-facts.ts
 import { readdirSync, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 var DEFAULT_FACTS_BUDGET = 8e3;
 var MEMORY_MD_CAP = 6e3;
 var MIN_FRAGMENT = 200;
@@ -31193,7 +31390,7 @@ function resolveWorkspaceDir(baseDir, agent, override) {
   const base = expandHome(baseDir);
   const isMain2 = agent === "" || agent === "main";
   try {
-    const cfg = JSON.parse(readFileSync6(join8(base, "openclaw.json"), "utf8"));
+    const cfg = JSON.parse(readFileSync6(join9(base, "openclaw.json"), "utf8"));
     const agents = cfg?.agents;
     if (agents && typeof agents === "object") {
       const list = Array.isArray(agents.list) ? agents.list : [];
@@ -31206,7 +31403,7 @@ function resolveWorkspaceDir(baseDir, agent, override) {
     }
   } catch {
   }
-  return isMain2 ? join8(base, "workspace") : join8(base, `workspace-${agent}`);
+  return isMain2 ? join9(base, "workspace") : join9(base, `workspace-${agent}`);
 }
 var TRUNC = "\u2026[truncated]";
 function headSlice(s, n) {
@@ -31236,7 +31433,7 @@ function readWorkspaceFacts(baseDir, agent, opts) {
   let truncated = false;
   let remaining = budget;
   try {
-    const r = readBounded(join8(dir, "MEMORY.md"));
+    const r = readBounded(join9(dir, "MEMORY.md"));
     if (r.oversize) truncated = true;
     else if (r.text && r.text.trim()) {
       const { text, clipped } = headSlice(r.text, Math.min(MEMORY_MD_CAP, budget));
@@ -31249,7 +31446,7 @@ ${TRUNC}` : ""}`);
   } catch {
   }
   try {
-    const dailies = readdirSync(join8(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
+    const dailies = readdirSync(join9(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
     for (const f of dailies) {
       if (remaining < MIN_FRAGMENT) {
         truncated = true;
@@ -31257,7 +31454,7 @@ ${TRUNC}` : ""}`);
       }
       let r;
       try {
-        r = readBounded(join8(dir, "memory", f));
+        r = readBounded(join9(dir, "memory", f));
       } catch {
         continue;
       }
@@ -31996,14 +32193,14 @@ function parsePayloadMemory(raw) {
 
 // src/memory/embedder/client.ts
 import { connect } from "node:net";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync9, rmSync as rmSync6, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync9, rmSync as rmSync6, statSync as statSync3 } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 // src/memory/embedder/download.ts
 import { createHash as createHash2, randomBytes as randomBytes6 } from "node:crypto";
-import { chmodSync as chmodSync2, rmSync as rmSync2 } from "node:fs";
+import { chmodSync as chmodSync3, rmSync as rmSync2 } from "node:fs";
 import { open } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 init_layout();
 var WRONG_TYPE_STRIKES = 3;
 var wrongTypeStrikes = /* @__PURE__ */ new Map();
@@ -32019,8 +32216,8 @@ function removeModelFiles(root3, m) {
   for (const f of m.files) {
     const dir = plainDirChain(root3, [m.modelId, f.sha256], { create: false });
     if (!dir) continue;
-    chmodSync2(dir, 493);
-    rmSync2(join10(dir, f.name), { force: true });
+    chmodSync3(dir, 493);
+    rmSync2(join11(dir, f.name), { force: true });
   }
 }
 var VerifyFailed = class extends Error {
@@ -32067,7 +32264,7 @@ async function fetchSameOrigin(url, origin, fetchImpl, signal, stallMs, abort) {
 async function downloadOne(f, o) {
   if (wrongTypeAt(filePath(o.root, o.modelId, f))) throw new WrongType("wrong type at model path");
   const pdir = plainDirChain(o.root, [".partial"], { create: true, fromModelsDir: true, mode: 448 });
-  const partial = join10(pdir, randomBytes6(12).toString("hex"));
+  const partial = join11(pdir, randomBytes6(12).toString("hex"));
   const fh = await open(partial, "wx", 384);
   const ac = new AbortController();
   const abort = () => ac.abort();
@@ -32144,17 +32341,17 @@ async function ensureModelFiles(o) {
 
 // src/memory/embedder/gc.ts
 init_layout();
-import { chmodSync as chmodSync3, closeSync, constants, fstatSync, futimesSync, lstatSync as lstatSync3, openSync, readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
-import { join as join11 } from "node:path";
+import { chmodSync as chmodSync4, closeSync, constants as constants2, fstatSync, futimesSync, lstatSync as lstatSync4, openSync, readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
+import { join as join12 } from "node:path";
 var THIRTY_DAYS = 30 * 864e5;
 var SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
 function touchUserMarker(root3, modelId, identityId) {
   if (!SAFE_ID.test(identityId)) throw new Error("invalid identity id for the model marker");
   const dir = plainDirChain(root3, [modelId, ".users"], { create: true });
-  const p = join11(dir, identityId);
+  const p = join12(dir, identityId);
   let fd;
   try {
-    fd = openSync(p, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK, 420);
+    fd = openSync(p, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_NOFOLLOW | constants2.O_NONBLOCK, 420);
   } catch {
     throw new Error("the model marker is not a regular file");
   }
@@ -32168,22 +32365,22 @@ function touchUserMarker(root3, modelId, identityId) {
 }
 function isRealDir(p) {
   try {
-    return lstatSync3(p).isDirectory();
+    return lstatSync4(p).isDirectory();
   } catch {
     return false;
   }
 }
 function makeWritable(p) {
   if (!isRealDir(p)) return;
-  chmodSync3(p, 493);
-  for (const e of readdirSync2(p)) makeWritable(join11(p, e));
+  chmodSync4(p, 493);
+  for (const e of readdirSync2(p)) makeWritable(join12(p, e));
 }
 function newestMarkerMs(users) {
   if (!isRealDir(users)) return void 0;
   let newest;
   for (const u of readdirSync2(users)) {
     try {
-      const s = lstatSync3(join11(users, u));
+      const s = lstatSync4(join12(users, u));
       if (!s.isFile()) continue;
       newest = newest === void 0 ? s.mtimeMs : Math.max(newest, s.mtimeMs);
     } catch {
@@ -32196,9 +32393,9 @@ function gcModels(root3, keepModelIds, now, maxAgeMs = THIRTY_DAYS) {
   const removed = [];
   for (const modelId of readdirSync2(root3).sort()) {
     if (modelId.startsWith(".") || keepModelIds.includes(modelId)) continue;
-    const tree = join11(root3, modelId);
+    const tree = join12(root3, modelId);
     if (!isRealDir(tree)) continue;
-    const lastUse = newestMarkerMs(join11(tree, ".users")) ?? lstatSync3(tree).mtimeMs;
+    const lastUse = newestMarkerMs(join12(tree, ".users")) ?? lstatSync4(tree).mtimeMs;
     if (now - lastUse <= maxAgeMs) continue;
     makeWritable(tree);
     rmSync3(tree, { recursive: true, force: true });
@@ -32304,44 +32501,44 @@ var SealedChannel = class {
 // src/memory/embedder/embedder-paths.ts
 import { createHash as createHash3 } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function embedderKey(m) {
   const model = m.files.find((f) => f.name === "model.onnx");
   return createHash3("sha256").update(`${EMBEDDER_PROTOCOL}\0${m.modelId}\0${model.sha256}\0${m.wasmSha256}`).digest("hex").slice(0, 16);
 }
-var embedderRunDir = (home = homedir3()) => join12(home, ".securecoms", "run", "embedder");
+var embedderRunDir = (home = homedir3()) => join13(home, ".securecoms", "run", "embedder");
 var embedderPaths = (dir, key) => ({
-  sock: join12(dir, `${key}.sock`),
-  token: join12(dir, `${key}.token`),
-  lock: join12(dir, `${key}.spawn.lock`),
-  status: join12(dir, `${key}.status`),
-  pid: join12(dir, `${key}.pid`)
+  sock: join13(dir, `${key}.sock`),
+  token: join13(dir, `${key}.token`),
+  lock: join13(dir, `${key}.spawn.lock`),
+  status: join13(dir, `${key}.status`),
+  pid: join13(dir, `${key}.pid`)
   // E1 delta H1: the instance's lifetime lock
 });
 var SOCKET_PATH_MAX = 103;
 var windowsRunDir = (env = process.env) => {
   if (!env.LOCALAPPDATA) throw new Error("LOCALAPPDATA unset");
-  return join12(env.LOCALAPPDATA, "SecureComs", "run", "embedder");
+  return join13(env.LOCALAPPDATA, "SecureComs", "run", "embedder");
 };
 
 // src/memory/embedder/spawn.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, realpathSync } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync4, realpathSync as realpathSync2 } from "node:fs";
 
 // src/memory/embedder/run-dir.ts
-import { existsSync, lstatSync as lstatSync4, mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { existsSync, lstatSync as lstatSync5, mkdirSync as mkdirSync3 } from "node:fs";
+import { dirname as dirname6 } from "node:path";
 var RunDirRefused = class extends Error {
 };
-function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync4) {
-  const parent3 = dirname5(dir);
-  if (!existsSync(parent3)) mkdirSync2(parent3, { recursive: true, mode: 448 });
+function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync5) {
+  const parent3 = dirname6(dir);
+  if (!existsSync(parent3)) mkdirSync3(parent3, { recursive: true, mode: 448 });
   const ps = lstat(parent3);
   if (ps.isSymbolicLink() || !ps.isDirectory()) throw new RunDirRefused("run directory parent is not a real directory");
   if (ps.uid !== uid) throw new RunDirRefused("run directory parent is not owned by this user");
   if ((ps.mode & 18) !== 0) throw new RunDirRefused("run directory parent is group or world writable");
   try {
-    mkdirSync2(dir, { mode: 448 });
+    mkdirSync3(dir, { mode: 448 });
   } catch (e) {
     if (e.code !== "EEXIST") throw e;
   }
@@ -32352,11 +32549,11 @@ function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync4) {
 }
 
 // src/memory/embedder/spawn.ts
-import { basename as basename3, dirname as dirname6, join as join13 } from "node:path";
+import { basename as basename4, dirname as dirname7, join as join14 } from "node:path";
 init_layout();
 
 // src/memory/embedder/locks.ts
-import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, linkSync, openSync as openSync2, readFileSync as readFileSync7, renameSync as renameSync2, rmSync as rmSync4, writeSync } from "node:fs";
+import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, linkSync, openSync as openSync2, readFileSync as readFileSync7, renameSync as renameSync2, rmSync as rmSync4, writeSync } from "node:fs";
 import { randomBytes as randomBytes9 } from "node:crypto";
 import { uptime } from "node:os";
 var LOCK_STALE_MS = 1e4;
@@ -32378,7 +32575,7 @@ var PROCESS_LOCK_ENV = {
 function inspect(path) {
   let fd;
   try {
-    fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    fd = openSync2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
   } catch {
     return null;
   }
@@ -32402,7 +32599,7 @@ function takeLock(path, now = Date.now, env = PROCESS_LOCK_ENV) {
   const id = `${env.pid} ${env.bootTime()} ${env.startTime()} ${randomBytes9(8).toString("hex")}`;
   for (let attempt = 0; attempt < 3; attempt++) {
     try {
-      const fd = openSync2(path, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+      const fd = openSync2(path, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
       try {
         writeSync(fd, id);
       } finally {
@@ -32463,7 +32660,7 @@ function embedderEnv(env = process.env, platform = process.platform) {
 }
 var withReal = (p) => {
   try {
-    const r = realpathSync(p);
+    const r = realpathSync2(p);
     return r === p ? [p] : [p, r];
   } catch {
     return [p];
@@ -32471,10 +32668,10 @@ var withReal = (p) => {
 };
 var realish = (p) => {
   try {
-    return realpathSync(p);
+    return realpathSync2(p);
   } catch {
-    const up = dirname6(p);
-    return up === p ? p : join13(realish(up), basename3(p));
+    const up = dirname7(p);
+    return up === p ? p : join14(realish(up), basename4(p));
   }
 };
 var both = (p) => {
@@ -32486,7 +32683,7 @@ function spawnEmbedder(o) {
   const run = o.runDir ?? embedderRunDir(o.home);
   const win = (o.platform ?? process.platform) === "win32";
   if (o.createRunDir !== false) {
-    if (win) mkdirSync3(run, { recursive: true, mode: 448 });
+    if (win) mkdirSync4(run, { recursive: true, mode: 448 });
     else ensureRunDir(run);
   }
   const perm = permissionFlags();
@@ -32495,13 +32692,13 @@ function spawnEmbedder(o) {
     o.onNoPermissionModel?.();
   }
   const reads = perm.length === 0 ? [] : [
-    ...withReal(dirname6(o.distDir)),
+    ...withReal(dirname7(o.distDir)),
     ...existsSync2(defaultModelsRoot(o.home)) ? withReal(defaultModelsRoot(o.home)) : [defaultModelsRoot(o.home)],
-    ...both(dirname6(run)),
-    ...win ? both(join13(o.home, ".securecoms", "run")) : []
+    ...both(dirname7(run)),
+    ...win ? both(join14(o.home, ".securecoms", "run")) : []
     // the voice-call heartbeats (the run dir lives elsewhere)
   ];
-  const script = withReal(join13(o.distDir, "embedder.js")).at(-1);
+  const script = withReal(join14(o.distDir, "embedder.js")).at(-1);
   const net = (o.nodeFlags ?? process.allowedNodeEnvironmentFlags).has("--allow-net") ? ["--allow-net"] : [];
   const flags = perm.length === 0 ? [] : [...perm, ...reads.map((r) => `--allow-fs-read=${r}`), ...both(run).map((w) => `--allow-fs-write=${w}`), "--allow-worker", ...net];
   const child = (o.spawnFn ?? spawn)(
@@ -32510,7 +32707,7 @@ function spawnEmbedder(o) {
     // 11c review LOW 3, fixed by the Task 12 Mini gate: cwd is the run directory's PARENT, which the bridge created (0700)
     // before spawning; the run directory itself is created by the embedder, so on a first start it does not exist yet and
     // a cwd there fails the spawn with ENOENT. Never the bridge's working directory.
-    { detached: true, stdio: "ignore", windowsHide: true, cwd: dirname6(run), env: win ? { ...embedderEnv(process.env, "win32"), USERPROFILE: o.home, LOCALAPPDATA: dirname6(dirname6(dirname6(run))) } : { ...embedderEnv(), HOME: o.home } }
+    { detached: true, stdio: "ignore", windowsHide: true, cwd: dirname7(run), env: win ? { ...embedderEnv(process.env, "win32"), USERPROFILE: o.home, LOCALAPPDATA: dirname7(dirname7(dirname7(run))) } : { ...embedderEnv(), HOME: o.home } }
   );
   child.unref();
   child.on("error", () => {
@@ -32522,8 +32719,8 @@ function spawnEmbedder(o) {
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { randomBytes as randomBytes10 } from "node:crypto";
-import { lstatSync as lstatSync5, readFileSync as readFileSync8, rmSync as rmSync5 } from "node:fs";
-import { join as join14, win32 } from "node:path";
+import { lstatSync as lstatSync6, readFileSync as readFileSync8, rmSync as rmSync5 } from "node:fs";
+import { join as join15, win32 } from "node:path";
 var WINDOWS_SEMANTIC_ENABLED = false;
 var windowsSemanticOn = (platform, enabled = WINDOWS_SEMANTIC_ENABLED) => platform !== "win32" || enabled;
 function parseSaveSddl(saveFile) {
@@ -32551,7 +32748,7 @@ function aclAllows(sddl, ownerSid) {
   if (aces.length === 0 || rest !== "" && !rest.startsWith("S:")) return false;
   return aces.every((a) => a[0] === "A" && allowed.has(a[5] ?? "") || a[0] === "D");
 }
-function hasReparsePoint(path, lstat = lstatSync5) {
+function hasReparsePoint(path, lstat = lstatSync6) {
   const root3 = win32.parse(path).root;
   let cur = root3;
   for (const part of path.slice(root3.length).split(/[\\/]/).filter(Boolean)) {
@@ -32570,7 +32767,7 @@ async function currentUserSid(run = defaultRunner) {
 }
 async function verifyRunDirAcl(path, deps = {}, sid) {
   const run = deps.run ?? defaultRunner;
-  const out = join14(deps.tmp ?? process.env.TEMP ?? process.env.TMP ?? ".", `sc-acl-${randomBytes10(8).toString("hex")}.txt`);
+  const out = join15(deps.tmp ?? process.env.TEMP ?? process.env.TMP ?? ".", `sc-acl-${randomBytes10(8).toString("hex")}.txt`);
   try {
     if (hasReparsePoint(path, deps.lstat)) return false;
     const user = await (sid ? sid() : currentUserSid(run));
@@ -32651,12 +32848,12 @@ var EmbedderClient = class {
   ready(ms) {
     if (this.st.state === "ready") return Promise.resolve(true);
     if (this.st.state !== "preparing" || !(ms > 0)) return Promise.resolve(false);
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       let t;
       const w = (ok) => {
         clearTimeout(t);
         this.readyWaiters.delete(w);
-        resolve4(ok);
+        resolve5(ok);
       };
       this.readyWaiters.add(w);
       t = setTimeout(() => w(false), ms);
@@ -32765,7 +32962,7 @@ var EmbedderClient = class {
     const p = this.paths();
     if (!this.tcp() && Buffer.byteLength(`${p.sock}.00000000`) > SOCKET_PATH_MAX) return this.fail("run_dir_refused");
     if (this.tcp()) {
-      mkdirSync4(this.runDir(), { recursive: true, mode: 448 });
+      mkdirSync5(this.runDir(), { recursive: true, mode: 448 });
       if (!await this.aclOk(true)) return this.fail("acl_unverified");
     }
     if (!this.tcp()) {
@@ -32901,7 +33098,7 @@ var EmbedderClient = class {
       }
       if (this.closed) return false;
     }
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const s = this.tcp() ? connect({ host: "127.0.0.1", port: pub.port }) : connect(p.sock);
       const nc = nonce();
       let ns = "";
@@ -32914,7 +33111,7 @@ var EmbedderClient = class {
         if (!settled) {
           settled = true;
           clearTimeout(t);
-          resolve4(ok);
+          resolve5(ok);
         }
       }
       const refuse3 = (reason) => {
@@ -33483,12 +33680,12 @@ var ReembedQueue = class {
 };
 
 // src/memory/recall/call-heartbeat.ts
-import { closeSync as closeSync3, constants as constants3, fstatSync as fstatSync3, futimesSync as futimesSync2, openSync as openSync3, rmSync as rmSync7 } from "node:fs";
-import { join as join16 } from "node:path";
+import { closeSync as closeSync3, constants as constants4, fstatSync as fstatSync3, futimesSync as futimesSync2, openSync as openSync3, rmSync as rmSync7 } from "node:fs";
+import { join as join17 } from "node:path";
 
 // src/memory/embedder/heartbeats.ts
-import { lstatSync as lstatSync6, readdirSync as readdirSync3 } from "node:fs";
-import { join as join15 } from "node:path";
+import { lstatSync as lstatSync7, readdirSync as readdirSync3 } from "node:fs";
+import { join as join16 } from "node:path";
 var HEARTBEAT_FUTURE_SKEW_MS = 6e4;
 var HEARTBEAT_STALE_MS = 3e4;
 function heartbeatAgeFresh(ageMs, staleMs = HEARTBEAT_STALE_MS) {
@@ -33503,7 +33700,7 @@ function anyHeartbeatFresh(dir, now, staleMs = HEARTBEAT_STALE_MS) {
   }
   return names.some((n) => {
     try {
-      const st = lstatSync6(join15(dir, n));
+      const st = lstatSync7(join16(dir, n));
       return st.isFile() && heartbeatAgeFresh(now - st.mtimeMs, staleMs);
     } catch {
       return false;
@@ -33569,7 +33766,7 @@ var CallHeartbeat = class {
     if (dir === null) return;
     let fd;
     try {
-      fd = openSync3(join16(dir, this.identityId), constants3.O_WRONLY | constants3.O_CREAT | constants3.O_NOFOLLOW | constants3.O_NONBLOCK, 384);
+      fd = openSync3(join17(dir, this.identityId), constants4.O_WRONLY | constants4.O_CREAT | constants4.O_NOFOLLOW | constants4.O_NONBLOCK, 384);
       if (!fstatSync3(fd).isFile()) return;
       const t = new Date(this.now());
       futimesSync2(fd, t, t);
@@ -33584,7 +33781,7 @@ var CallHeartbeat = class {
     const dir = SAFE_ID2.test(this.identityId) ? this.dirOk() : null;
     if (dir === null) return;
     try {
-      rmSync7(join16(dir, this.identityId), { force: true });
+      rmSync7(join17(dir, this.identityId), { force: true });
       this.wrote = false;
     } catch (e) {
       this.log("warn", "memory.call_heartbeat_failed", {}, e);
@@ -33647,9 +33844,9 @@ function queryTokenMacs(key, text, max = QUERY_MACS_MAX) {
 
 // src/memory/unified/ranking-client.ts
 import { Worker } from "node:worker_threads";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function workerTransport(init, distDir) {
-  const w = new Worker(join17(distDir, "memory-worker.js"), { workerData: init });
+  const w = new Worker(join18(distDir, "memory-worker.js"), { workerData: init });
   return {
     post: (m) => w.postMessage(m),
     onMessage: (cb) => {
@@ -33709,15 +33906,15 @@ var RankingClient = class {
   ask(build, deadlineAt) {
     const id = ++this.seq;
     if (this.closed) return Promise.resolve("failed");
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const timer = setTimeout(() => {
         this.waiting.delete(id);
         this.misses++;
-        resolve4("late");
+        resolve5("late");
       }, Math.max(0, deadlineAt - Date.now()));
       this.waiting.set(id, { resolve: (m) => {
         clearTimeout(timer);
-        resolve4(m);
+        resolve5(m);
       } });
       try {
         this.transport().post(build(id));
@@ -33726,7 +33923,7 @@ var RankingClient = class {
         this.waiting.delete(id);
         this.misses++;
         (this.d.log ?? writeServiceLog)("warn", "memory.ranking_worker_spawn_failed", void 0, e);
-        resolve4("failed");
+        resolve5("failed");
       }
     });
   }
@@ -35054,17 +35251,17 @@ async function runSummarize(opts) {
 // src/service/runtime-config-dir.ts
 import { createHash as createHash5, randomUUID } from "node:crypto";
 import {
-  chmodSync as chmodSync4,
+  chmodSync as chmodSync5,
   existsSync as existsSync4,
-  lstatSync as lstatSync7,
-  mkdirSync as mkdirSync5,
+  lstatSync as lstatSync8,
+  mkdirSync as mkdirSync6,
   readFileSync as readFileSync10,
   renameSync as renameSync3,
   statSync as statSync4,
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { basename as basename4, isAbsolute, join as join18 } from "node:path";
+import { basename as basename5, isAbsolute, join as join19 } from "node:path";
 
 // src/grants/search-providers.ts
 var SEARCH_PROVIDERS = /* @__PURE__ */ new Set(["brave", "tavily", "parallel", "exa", "firecrawl"]);
@@ -35076,18 +35273,18 @@ function isSearchProvider(value) {
 // src/service/runtime-config-dir.ts
 var MEMORY_FILE = "MEMORY.md";
 var REAL_FS = {
-  mkdir: (p, mode) => mkdirSync5(p, { recursive: true, mode }),
-  chmod: (p, mode) => chmodSync4(p, mode),
+  mkdir: (p, mode) => mkdirSync6(p, { recursive: true, mode }),
+  chmod: (p, mode) => chmodSync5(p, mode),
   writeFile: (p, data, mode) => writeFileSync(p, data, { mode }),
   rename: (a, b) => renameSync3(a, b),
   readFile: (p) => readFileSync10(p, "utf8"),
   unlink: (p) => unlinkSync(p)
 };
 function runtimeConfigDir(home, identityId) {
-  return join18(home, ".securecoms", "runtime-config", identityId);
+  return join19(home, ".securecoms", "runtime-config", identityId);
 }
 function assertManagedName(name) {
-  if (!name || name.includes("/") || name.includes("\\") || name === "." || name === ".." || name !== basename4(name)) {
+  if (!name || name.includes("/") || name.includes("\\") || name === "." || name === ".." || name !== basename5(name)) {
     throw new Error(`refusing managed config file name ${JSON.stringify(name)}: not a plain filename`);
   }
   if (isLocalOnlyName(name)) {
@@ -35101,19 +35298,19 @@ function isLocalOnlyName(name) {
 var MANIFEST_POLICY_FILE = "manifest-policy.json";
 function removeManagedLlmSource(home, identityId, deps = REAL_FS) {
   try {
-    deps.unlink(join18(runtimeConfigDir(home, identityId), "llm-source.json"));
+    deps.unlink(join19(runtimeConfigDir(home, identityId), "llm-source.json"));
   } catch (e) {
     if (e?.code !== "ENOENT") throw e;
   }
 }
 function writeManifestPolicy(home, identityId, policy, deps = REAL_FS) {
-  const parent3 = join18(home, ".securecoms", "runtime-config");
+  const parent3 = join19(home, ".securecoms", "runtime-config");
   const dir = runtimeConfigDir(home, identityId);
-  for (const d of [join18(home, ".securecoms"), parent3, dir]) {
+  for (const d of [join19(home, ".securecoms"), parent3, dir]) {
     deps.mkdir(d, 448);
     deps.chmod(d, 448);
   }
-  atomicWrite(join18(dir, MANIFEST_POLICY_FILE), JSON.stringify(policy) + "\n", deps);
+  atomicWrite(join19(dir, MANIFEST_POLICY_FILE), JSON.stringify(policy) + "\n", deps);
 }
 function atomicWrite(path, body, deps) {
   const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -35132,13 +35329,13 @@ function atomicWrite(path, body, deps) {
 function writeManagedFiles(home, identityId, files, deps = REAL_FS) {
   const entries = Object.entries(files);
   for (const [name] of entries) assertManagedName(name);
-  const parent3 = join18(home, ".securecoms", "runtime-config");
+  const parent3 = join19(home, ".securecoms", "runtime-config");
   const dir = runtimeConfigDir(home, identityId);
-  for (const d of [join18(home, ".securecoms"), parent3, dir]) {
+  for (const d of [join19(home, ".securecoms"), parent3, dir]) {
     deps.mkdir(d, 448);
     deps.chmod(d, 448);
   }
-  for (const [name, body] of entries) atomicWrite(join18(dir, name), body, deps);
+  for (const [name, body] of entries) atomicWrite(join19(dir, name), body, deps);
 }
 function checkConfiguredPaths(skillsJson, statFn = (p) => {
   const s = statSync4(p);
@@ -35154,6 +35351,8 @@ function checkConfiguredPaths(skillsJson, statFn = (p) => {
   }
   const search = skillsJson.search;
   if (search?.keyFile) paths.push(search.keyFile);
+  const weather = skillsJson.weather;
+  if (weather?.keyFile) paths.push(weather.keyFile);
   return paths.map((path) => {
     let st;
     try {
@@ -35179,7 +35378,7 @@ function parseSecretPathsReport(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
   const r = raw;
   const f = r.outside_by_field;
-  if (r.mode !== "report" && r.mode !== "enforce" || !isCount(r.inside) || !isCount(r.allowlisted) || !isCount(r.outside) || !f || typeof f !== "object" || Array.isArray(f) || !isCount(f.headers_file) || !isCount(f.postgres_url_file) || !isCount(f.search_key_file) || f.sqlite !== void 0 && !isCount(f.sqlite)) return void 0;
+  if (r.mode !== "report" && r.mode !== "enforce" || !isCount(r.inside) || !isCount(r.allowlisted) || !isCount(r.outside) || !f || typeof f !== "object" || Array.isArray(f) || !isCount(f.headers_file) || !isCount(f.postgres_url_file) || !isCount(f.search_key_file) || f.sqlite !== void 0 && !isCount(f.sqlite) || f.weather_key_file !== void 0 && !isCount(f.weather_key_file)) return void 0;
   return {
     mode: r.mode,
     inside: r.inside,
@@ -35189,7 +35388,8 @@ function parseSecretPathsReport(raw) {
       headers_file: f.headers_file,
       postgres_url_file: f.postgres_url_file,
       search_key_file: f.search_key_file,
-      ...f.sqlite !== void 0 ? { sqlite: f.sqlite } : {}
+      ...f.sqlite !== void 0 ? { sqlite: f.sqlite } : {},
+      ...f.weather_key_file !== void 0 ? { weather_key_file: f.weather_key_file } : {}
     }
   };
 }
@@ -35214,7 +35414,7 @@ function localLegacySources(doc) {
     const channelId = source.channelId;
     if (kind2 !== "global-memory" && kind2 !== "conversation-history" && kind2 !== "captured-memory" || typeof path !== "string" || !isAbsolute(path) || channelId !== void 0 && typeof channelId !== "string") continue;
     try {
-      const st = lstatSync7(path);
+      const st = lstatSync8(path);
       if (!st.isFile() || st.isSymbolicLink()) continue;
       if (st.size <= LEGACY_MEMORY_SOURCE_MAX_BYTES && st.size > contentBudget) continue;
       const oversize = st.size > LEGACY_MEMORY_SOURCE_MAX_BYTES;
@@ -35242,7 +35442,7 @@ function localLegacySources(doc) {
   return out;
 }
 function readLocalReport(home, identityId) {
-  const p = join18(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const p = join19(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(p)) return null;
   let doc;
   try {
@@ -35269,6 +35469,7 @@ function readLocalReport(home, identityId) {
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
     has_extract_provider: doc.has_extract_provider === true,
+    has_weather_key: doc.has_weather_key === true,
     ...ownerDmCap !== void 0 ? { owner_dm_search_cap_effective: ownerDmCap } : {},
     legacy_memory: localLegacySources(doc).map(({ path: _path, content: _content, ...source }) => source),
     secret_paths: parseSecretPathsReport(doc.secret_paths)
@@ -35276,7 +35477,7 @@ function readLocalReport(home, identityId) {
 }
 function deleteLegacyMemorySources(home, identityId, ids) {
   if (ids.length === 0) return 0;
-  const p = join18(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const p = join19(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(p)) return 0;
   let doc;
   try {
@@ -35319,7 +35520,7 @@ async function applyLegacyMemoryFactDecisions(home, identityId, rawDecisions, re
     group.set(decision.fact_hash, decision);
     bySource.set(decision.source_id, group);
   }
-  const reportPath = join18(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const reportPath = join19(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(reportPath)) return { sourcesDeleted: 0, factsAssigned: 0 };
   let doc;
   try {
@@ -35357,7 +35558,7 @@ async function applyLegacyMemoryFactDecisions(home, identityId, rawDecisions, re
 }
 function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
   const dir = runtimeConfigDir(home, identityId);
-  const path = join18(dir, MEMORY_FILE);
+  const path = join19(dir, MEMORY_FILE);
   if (!existsSync4(path)) return 0;
   const drop = new Set(hashes);
   const before = deps.readFile(path).split("\n");
@@ -35370,6 +35571,19 @@ function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
   return removed;
 }
 
+// src/reply-credit.ts
+var REPLY_CREDIT_FEATURE = "reply_credit_v1";
+var WEATHER_CREDIT_LINE = "Weather data: WeatherAPI.com. For general information only.";
+var WEATHER_CREDIT_SUFFIX = `
+
+${WEATHER_CREDIT_LINE}`;
+function isReplyCredit(v) {
+  return v === "weatherapi";
+}
+function stripCreditSuffix(text) {
+  return text.endsWith(WEATHER_CREDIT_SUFFIX) ? text.slice(0, text.length - WEATHER_CREDIT_SUFFIX.length) : text;
+}
+
 // src/grants/binding.ts
 import { sha256 as sha25611 } from "@noble/hashes/sha256";
 
@@ -35377,9 +35591,10 @@ import { sha256 as sha25611 } from "@noble/hashes/sha256";
 import { ed25519 as ed255195 } from "@noble/curves/ed25519";
 var TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
 var MANIFEST_KNOWN_TOOLS = Object.freeze({
-  owner_dm: Object.freeze(["web_search", "web_extract", "fetch_url", "http_request", "sql_query"]),
+  owner_dm: Object.freeze(["web_search", "web_extract", "fetch_url", "http_request", "sql_query", "weather_forecast", "currency_convert"]),
   // web_extract: owner DM only, never team_room (spec §5.4, D5)
-  team_room: Object.freeze(["web_search"])
+  // Weather/currency spec §6.3 (U5): both utility tools in both audiences, each held behind utility_tools_v1 (TOOL_FEATURE).
+  team_room: Object.freeze(["web_search", "weather_forecast", "currency_convert"])
 });
 function manifestSignedBytes(manifest) {
   const domain = new TextEncoder().encode(TOOL_GRANTS_DOMAIN);
@@ -35703,20 +35918,30 @@ function bindTargets(raw, signed, equals) {
   }
   return { written, mismatches };
 }
-function signedManifestTools(manifest, audience, searchProvidersCapable) {
-  return MANIFEST_KNOWN_TOOLS[audience].filter((t) => (manifest.grants[audience] ?? []).includes(t) && (t !== "web_extract" || searchProvidersCapable));
+var NO_FEATURES = Object.freeze(/* @__PURE__ */ new Set());
+var TOOL_FEATURE = Object.freeze({
+  web_extract: "search_providers_v2",
+  weather_forecast: "utility_tools_v1",
+  currency_convert: "utility_tools_v1"
+});
+function toolAllowedByFeatures(tool, features) {
+  if (!Object.hasOwn(TOOL_FEATURE, tool)) return true;
+  return features.has(TOOL_FEATURE[tool]);
 }
-function manifestPolicyFor(manifest, switches, searchProvidersCapable) {
+function signedManifestTools(manifest, audience, features) {
+  return MANIFEST_KNOWN_TOOLS[audience].filter((t) => (manifest.grants[audience] ?? []).includes(t) && toolAllowedByFeatures(t, features));
+}
+function manifestPolicyFor(manifest, switches, features) {
   return {
     v: 1,
     manifest_tools: [.../* @__PURE__ */ new Set([
-      ...switches.ownerDm ? signedManifestTools(manifest, "owner_dm", searchProvidersCapable) : [],
-      ...switches.room ? signedManifestTools(manifest, "team_room", searchProvidersCapable) : []
+      ...switches.ownerDm ? signedManifestTools(manifest, "owner_dm", features) : [],
+      ...switches.room ? signedManifestTools(manifest, "team_room", features) : []
     ])].sort(),
     secret_path_mode: "enforce"
   };
 }
-function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }, searchProvidersCapable = false) {
+function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }, features = NO_FEATURES) {
   const mismatches = /* @__PURE__ */ new Set();
   const cfg = manifest.config;
   const out = {};
@@ -35745,7 +35970,8 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
   for (const name of Object.keys(files)) {
     if (name !== LLM_SOURCE && !PERSONA_FILES.includes(name)) mismatches.add("files");
   }
-  const ownerDmTools = signedManifestTools(manifest, "owner_dm", searchProvidersCapable);
+  const ownerDmTools = signedManifestTools(manifest, "owner_dm", features);
+  const ownerDmSearchTools = ownerDmTools.filter((t) => t === "web_search" || t === "web_extract");
   const sj = isObj2(payload.skills_json) ? payload.skills_json : void 0;
   const eps = bindTargets(sj?.endpoints, manifest.endpoints, endpointEquals);
   const dbs = bindTargets(sj?.databases, manifest.databases, databaseEquals);
@@ -35766,17 +35992,20 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     const usablePrior = cfg.search !== void 0 && prior.search?.provider === cfg.search.provider ? prior.search : void 0;
     searchBlock = cfg.search === void 0 ? void 0 : usablePrior ?? Object.freeze({ provider: cfg.search.provider });
   }
+  const pw = isObj2(sj?.weather) ? sj.weather : void 0;
+  const weatherBlock = typeof pw?.keyFile === "string" && pw.keyFile !== "" ? { keyFile: pw.keyFile } : void 0;
   const skillsDoc = {
     endpoints: eps.written,
     databases: dbs.written,
     flags: [...cfg.flags],
     ...deny !== void 0 || cfg.tools_allow !== void 0 ? { tools: { ...deny !== void 0 ? { deny } : {}, ...cfg.tools_allow !== void 0 ? { allow: [...cfg.tools_allow] } : {} } } : {},
     ...searchBlock ? { search: searchBlock } : {},
+    ...weatherBlock ? { weather: weatherBlock } : {},
     // D31: the marker the runtime keys D24 (iii) on; written under every manifest, true when config.search is signed.
     search_signed: cfg.search !== void 0,
     // D36, D39: the signed owner-DM cap, only when the owner-DM switch is on and the manifest grants an owner-DM tool;
     // otherwise none, so the runtime clamps a signed raise to the default. Never read from the payload.
-    ...cfg.search?.owner_dm_daily_cap !== void 0 && switches.ownerDm && ownerDmTools.length > 0 ? { owner_dm_search_cap: cfg.search.owner_dm_daily_cap } : {}
+    ...cfg.search?.owner_dm_daily_cap !== void 0 && switches.ownerDm && ownerDmSearchTools.length > 0 ? { owner_dm_search_cap: cfg.search.owner_dm_daily_cap } : {}
   };
   out["skills.json"] = JSON.stringify(skillsDoc, null, 2) + "\n";
   const signedMemory = { mode: cfg.memory.mode, ...cfg.memory.recall_days !== void 0 ? { recall_days: cfg.memory.recall_days } : {} };
@@ -35807,7 +36036,7 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     mismatches.add("legacy_assign");
     legacyDecisions = decisions.filter((d) => isObj2(d) && d.action === "delete");
   }
-  const policy = manifestPolicyFor(manifest, switches, searchProvidersCapable);
+  const policy = manifestPolicyFor(manifest, switches, features);
   return {
     mismatches: CONFIG_BINDING_FIELDS.filter((f) => mismatches.has(f)).sort(),
     targetMismatches: { endpoint: eps.mismatches, database: dbs.mismatches },
@@ -35950,7 +36179,11 @@ var TOOL_ROOM_CLASSES = Object.freeze({
   // D5: spends the owner's key and sends URLs out
   fetch_url: Object.freeze(["egress"]),
   sql_query: Object.freeze(["owner_credential"]),
-  http_request: Object.freeze(["owner_credential", "egress", "side_effect"])
+  http_request: Object.freeze(["owner_credential", "egress", "side_effect"]),
+  // Weather/currency (plan audit r1; supersedes spec §8's values): both send room words to an outside host, and weather
+  // spends the owner's key.
+  weather_forecast: Object.freeze(["owner_credential", "egress"]),
+  currency_convert: Object.freeze(["egress"])
 });
 var LIVE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["active", "add_pending"]);
 function isLiveRow(r) {
@@ -36367,8 +36600,8 @@ function voiceWindowEligible(t) {
 }
 function waitMs(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve4) => {
-    const t = setTimeout(resolve4, ms);
+  return new Promise((resolve5) => {
+    const t = setTimeout(resolve5, ms);
     t.unref?.();
   });
 }
@@ -36505,7 +36738,7 @@ var FileOwnerAuthorityStore = class {
   }
   async readAll() {
     try {
-      return JSON.parse(await fsp.readFile(this.path, "utf8"));
+      return JSON.parse(await fsp2.readFile(this.path, "utf8"));
     } catch (e) {
       if (e.code === "ENOENT") return {};
       throw e;
@@ -36518,8 +36751,8 @@ var FileOwnerAuthorityStore = class {
   async save(enclaveId, pin) {
     const all = await this.readAll();
     all[enclaveId] = pin;
-    await fsp.mkdir(dirname7(this.path), { recursive: true });
-    await fsp.writeFile(this.path, JSON.stringify(all), "utf8");
+    await fsp2.mkdir(dirname8(this.path), { recursive: true });
+    await fsp2.writeFile(this.path, JSON.stringify(all), "utf8");
   }
 };
 var AgentPausedSendError = class extends Error {
@@ -36726,7 +36959,7 @@ var BridgeAgent = class _BridgeAgent {
           threshold: EMBEDDING_MANIFEST.similarityThreshold,
           warm: windowsSemanticOn(this.platform)
         };
-        return deps.rankingTransport ? deps.rankingTransport(init) : workerTransport(init, dirname7(fileURLToPath2(import.meta.url)));
+        return deps.rankingTransport ? deps.rankingTransport(init) : workerTransport(init, dirname8(fileURLToPath2(import.meta.url)));
       }
     });
     this.embedder = deps.embedder ?? (deps.hostMachine === true && deps.home === void 0 ? new EmbedderClient({ identityId: cfg.identityId, home: homedir4(), source: cfg.modelSource, fetchImpl: this.fetchImpl, platform: this.platform }) : INERT_EMBEDDER);
@@ -36737,7 +36970,7 @@ var BridgeAgent = class _BridgeAgent {
       modelId: EMBEDDING_MANIFEST.modelId,
       threshold: EMBEDDING_MANIFEST.similarityThreshold
     });
-    this.heartbeat = new CallHeartbeat(this.machinePaths ? join19(this.home, ".securecoms", "run", "voice-call") : null, cfg.identityId, VOICE_LIVE_WINDOW_MS);
+    this.heartbeat = new CallHeartbeat(this.machinePaths ? join20(this.home, ".securecoms", "run", "voice-call") : null, cfg.identityId, VOICE_LIVE_WINDOW_MS);
     this.reembed = new ReembedQueue({
       store: this.store,
       embedder: this.embedder,
@@ -36796,15 +37029,15 @@ var BridgeAgent = class _BridgeAgent {
     this.bootDrainWaitMs = deps.bootDrainWaitMs ?? BOOT_DRAIN_WAIT_MS_DEFAULT;
     this.searchCapabilityRefetchDebounceMs = deps.searchCapabilityRefetchDebounceMs ?? SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS;
     this.searchCapabilityRefetchMaxWaitMs = deps.searchCapabilityRefetchMaxWaitMs ?? SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS;
-    this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve4) => {
-      const t = setTimeout(resolve4, ms);
+    this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve5) => {
+      const t = setTimeout(resolve5, ms);
       t.unref?.();
     }));
     this.actionRateFloor = new TokenBucketFloor({ capacity: 1, refillPerMinute: 30, now: this.actionClock });
     this.globalActionRateFloor = new TokenBucketFloor({ capacity: 1, refillPerMinute: 30, now: this.actionClock });
     const self = this;
     this.downloadBlobImpl = deps.downloadBlob ?? async function(blobId) {
-      const url = `${cfg.apiBase}/api/v1/attachments/${encodeURIComponent(blobId)}?caller_identity_id=${encodeURIComponent(cfg.identityId)}`;
+      const url = `${cfg.apiBase}/api/v1/attachments/${encodeURIComponent(assertBlobId(blobId))}?caller_identity_id=${encodeURIComponent(cfg.identityId)}`;
       const res = await fetchWithDeadline(self.fetchImpl, url, { headers: { authorization: `Bearer ${cfg.apiKey}` } }, {
         op: "attachment_download",
         timeoutMs: FETCH_DEADLINE_MS.blobBase,
@@ -36824,8 +37057,9 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join19(dirname7(cfg.storePath), "attachments");
-    this.vaultOwnerStoreImpl = deps.vaultOwnerStore ?? new FileOwnerAuthorityStore(join19(dirname7(cfg.storePath), "vault-owner-pins.json"));
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join20(dirname8(cfg.storePath), "attachments");
+    this.vaultOutboxDirImpl = deps.vaultOutboxDir !== void 0 ? deps.vaultOutboxDir : cfg.storePath === ":memory:" ? null : join20(dirname8(cfg.storePath), VAULT_OUTBOX_DIRNAME);
+    this.vaultOwnerStoreImpl = deps.vaultOwnerStore ?? new FileOwnerAuthorityStore(join20(dirname8(cfg.storePath), "vault-owner-pins.json"));
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -37556,6 +37790,9 @@ var BridgeAgent = class _BridgeAgent {
   uploadBlobImpl;
   /** Track 5: directory where received attachments are saved. */
   attachmentsDirImpl;
+  vaultOutboxDirImpl;
+  /** Audit 2026-10-30 HIGH 2: the outbox pinned at start(); null = every upload refused. */
+  outboxPin = null;
   /** B7: persistence for the vault kekset's owner-pin TOFU state. */
   vaultOwnerStoreImpl;
   /** B7: last-seen kekset generation per enclave, enforced monotonic across
@@ -37764,7 +38001,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     let bound;
     try {
-      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable());
+      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.capabilityFeatures());
     } catch (e) {
       bound = null;
       return this.bindFailed(manifest, payload.memory, e);
@@ -37785,7 +38022,7 @@ var BridgeAgent = class _BridgeAgent {
     try {
       this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, bound.files);
       if (manifest.config.llm === void 0) this.grantWriters.removeManagedLlmSource(this.home, this.cfg.identityId);
-      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable()));
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.capabilityFeatures()));
     } catch (e) {
       this.manifestBinding = null;
       throw e;
@@ -37832,13 +38069,14 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** No manifest in force: a manifest-policy.json left by an earlier one is replaced by an empty tool list. */
   overwriteStalePolicy() {
-    if (!existsSync5(join19(runtimeConfigDir(this.home, this.cfg.identityId), "manifest-policy.json"))) return;
+    if (!existsSync5(join20(runtimeConfigDir(this.home, this.cfg.identityId), "manifest-policy.json"))) return;
     this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, { v: 1, manifest_tools: [], secret_path_mode: "enforce" });
   }
   /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
   async postRuntimeConfigReport(base, version, skillsJson) {
     const local = readLocalReport(this.home, this.cfg.identityId);
     const reportedSearchProviders = this.searchProvidersCapable();
+    const reportedUtilityTools = this.utilityToolsCapable();
     const report = {
       applied_version: version,
       paths: checkConfiguredPaths(skillsJson),
@@ -37856,6 +38094,9 @@ var BridgeAgent = class _BridgeAgent {
       // Final review I-2 (controller ruling): AND the current search_providers_v2, so the web never shows extract while
       // the bridge withholds web_extract from the runtime.
       has_extract_provider: (local?.has_extract_provider ?? false) && reportedSearchProviders,
+      // Weather/currency L-1, §8 item 5: AND the current utility_tools_v1, so the web never shows a usable weather key
+      // while the bridge withholds weather_forecast from the runtime.
+      has_weather_key: (local?.has_weather_key ?? false) && reportedUtilityTools,
       // D39: the owner-DM daily cap the runtime enforces, passed through when it reported a valid one; never the signed value.
       ...local?.owner_dm_search_cap_effective !== void 0 ? { owner_dm_search_cap_effective: local.owner_dm_search_cap_effective } : {},
       // Same idea, for the BYOK LLM key file: only the runtime can see
@@ -37903,7 +38144,9 @@ var BridgeAgent = class _BridgeAgent {
         // D28 (§11.1 step 3): a separate key, never a value in the capability enum. False with no runtime attached.
         search_providers_v2: reportedSearchProviders,
         // D19 item 4: content-free; the signed provider is one the attached runtime(s) cannot honour.
-        search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders)
+        search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders),
+        // Weather/currency §8 item 5: a separate key, false with no runtime attached.
+        utility_tools_v1: reportedUtilityTools
       }
     };
     const reportedVerifyFailures = this.ownerVerifyFailures;
@@ -37925,6 +38168,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
     this.lastReportedSearchProviders = reportedSearchProviders;
+    this.lastReportedUtilityTools = reportedUtilityTools;
     if (version) writeServiceLog("info", "runtime_config.applied", { version });
     else writeServiceLog("info", "runtime_config.legacy_memory_reported");
   }
@@ -37992,9 +38236,16 @@ var BridgeAgent = class _BridgeAgent {
   }
   async startBody() {
     this.startedAt = Date.now();
+    if (this.vaultOutboxDirImpl) {
+      try {
+        this.outboxPin = ensureOutbox(this.vaultOutboxDirImpl);
+      } catch (e) {
+        writeServiceLog("warn", "vault_outbox.unavailable", {}, e);
+      }
+    }
     await this.restoreRuntimeInbox();
     await this.loadToolGrantState();
-    this.recomputeManifestPolicy(false);
+    this.recomputeManifestPolicy(NO_FEATURES);
     try {
       this.store.pruneRoomSearchCap(utcDayOf(Date.now()));
     } catch (e) {
@@ -38017,8 +38268,8 @@ var BridgeAgent = class _BridgeAgent {
     const drain = this.ingestOnce().then(() => true, () => true);
     const drainedInTime = await Promise.race([
       drain,
-      new Promise((resolve4) => {
-        const t = setTimeout(() => resolve4(false), this.bootDrainWaitMs);
+      new Promise((resolve5) => {
+        const t = setTimeout(() => resolve5(false), this.bootDrainWaitMs);
         t.unref?.();
         void drain.then(() => clearTimeout(t));
       })
@@ -38028,7 +38279,7 @@ var BridgeAgent = class _BridgeAgent {
       await this.bootReconcileKeyPackage();
     } else {
       writeServiceLog("warn", "boot.drain_slow", { wait_ms: this.bootDrainWaitMs });
-      const settled = new Promise((resolve4) => this.ingestSettledWaiters.push(resolve4));
+      const settled = new Promise((resolve5) => this.ingestSettledWaiters.push(resolve5));
       this.deferredBootPublish = settled.then(async () => {
         this.bootDrainPending = false;
         if (this.closingDown) return;
@@ -38977,13 +39228,13 @@ var BridgeAgent = class _BridgeAgent {
    * absent, because the id is derived.
    */
   async send(channelId, text, messageId, opts = {}) {
-    const body = { kind: "text", text };
+    const body = { kind: "text", text: opts.credit !== void 0 ? text + WEATHER_CREDIT_SUFFIX : text };
     if (this.isIdempotentSend(messageId, opts)) return this.trackReplyWork(this.sendIdempotent(channelId, body, opts));
     const id = resolveMessageId(messageId);
     const purgeEpochBeforePublish = this.store.conversationPurgeEpoch(channelId);
     const replyCapture = this.unifiedReplyCapture(channelId, opts.inReplyTo);
     await this.publishBody(channelId, body, id);
-    this.afterPublish(channelId, body, id, opts, purgeEpochBeforePublish, replyCapture);
+    this.afterPublish(channelId, body, id, opts, purgeEpochBeforePublish, replyCapture, text);
     return { message_id: id, status: "sent" };
   }
   /** PR #716 review MEDIUM-5: register reply work so close() can wait for it. */
@@ -39002,7 +39253,7 @@ var BridgeAgent = class _BridgeAgent {
     const purgeEpochBeforePublish = this.store.conversationPurgeEpoch(channelId);
     const replyCapture = this.unifiedReplyCapture(channelId, opts.inReplyTo);
     await this.publishBody(channelId, body, id);
-    this.afterPublish(channelId, body, id, opts, purgeEpochBeforePublish, replyCapture);
+    this.afterPublish(channelId, body, id, opts, purgeEpochBeforePublish, replyCapture, null);
     return { message_id: id, status: "sent" };
   }
   /**
@@ -39135,18 +39386,24 @@ var BridgeAgent = class _BridgeAgent {
     const meta = this.freshMeta(capChannel);
     if (meta && !meta.is_dm) this.enforceRateFloor("room", capChannel);
   }
-  /** Bookkeeping after a CONFIRMED publish of `body` under `id`. */
-  afterPublish(channelId, body, id, opts, purgeEpoch, replyCapture) {
+  /**
+   * Bookkeeping after a CONFIRMED publish of `body` under `id`. `recordText` (weather/currency Task 17) is what a text
+   * reply is RECORDED as: the published text minus any credit line. Every record site below reads `recorded`, never
+   * `body.text`. Every production caller passes it (pinned by reply-credit.test.ts: text, or null for an a2a body);
+   * undefined is left only for direct test calls of an uncredited body, where the published and record texts are equal.
+   */
+  afterPublish(channelId, body, id, opts, purgeEpoch, replyCapture, recordText) {
+    const recorded = recordText ?? (recordText === void 0 && body.kind === "text" ? body.text : "");
     if (opts.agentTurn !== false) this.agentHops.noteOwnSend(channelId);
     const modality = this.spokenReplyIds.has(id) ? "voice" : "text";
-    const bridgeLine = this.unifiedOn && body.kind === "text" && isBridgeMemoryLine(body.text);
+    const bridgeLine = this.unifiedOn && body.kind === "text" && isBridgeMemoryLine(recorded);
     if (opts.inReplyTo !== void 0 && this.isOwnerVerifyFailed(opts.inReplyTo)) return;
-    if (body.kind === "text" && opts.callBufferReply === true && opts.inReplyTo !== void 0 && !this.spokenReplyIds.has(id) && !isBridgeMemoryLine(body.text) && this.callBuffer.isVoiceScopedId(opts.inReplyTo)) {
-      this.callBuffer.appendAgent(channelId, body.text, "reply");
+    if (body.kind === "text" && opts.callBufferReply === true && opts.inReplyTo !== void 0 && !this.spokenReplyIds.has(id) && !isBridgeMemoryLine(recorded) && this.callBuffer.isVoiceScopedId(opts.inReplyTo)) {
+      this.callBuffer.appendAgent(channelId, recorded, "reply");
     }
     const origin = this.spokenReplyIds.has(id) ? "fast_path" : !this.taintScope(channelId) ? "reply" : opts.inReplyTo !== void 0 && this.cleanTurns.has(opts.inReplyTo) && !this.taintedTurns.has(opts.inReplyTo) ? "reply" : "untrusted";
-    if (body.kind === "text" && !bridgeLine) void recordOutboundMemory(this.memory, channelId, body.text, id, modality, purgeEpoch, origin);
-    if (this.unifiedOn && body.kind === "text" && !bridgeLine) this.spawnUnifiedReply(channelId, body.text, id, replyCapture ?? null, origin);
+    if (body.kind === "text" && !bridgeLine) void recordOutboundMemory(this.memory, channelId, recorded, id, modality, purgeEpoch, origin);
+    if (this.unifiedOn && body.kind === "text" && !bridgeLine) this.spawnUnifiedReply(channelId, recorded, id, replyCapture ?? null, origin);
   }
   /**
    * Final review bridge I-1 (ledger T25): the agent reply's U11 capture, taken BEFORE the publish await. The clear generation
@@ -39224,14 +39481,14 @@ var BridgeAgent = class _BridgeAgent {
         const k = replyIntentKey({ inReplyTo: opts.inReplyTo, idempotencyKey: opts.idempotencyKey, ordinal: () => 0 });
         if (!k) throw new Error("idempotent send without a key");
         const id = replyMessageId(this.replyIdKey, this.cfg.identityId, channelId, k);
-        const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes);
-        const { intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes });
+        const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, opts.credit);
+        const { intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit: opts.credit ?? null });
         if (intent.bodyMac !== mac2 || intent.channelId !== channelId || intent.state === "skipped") {
           throw new IdempotencyConflictError();
         }
         return k;
       }
-      return this.claimUnkeyedPart(opts.inReplyTo, channelId, bytes, true);
+      return this.claimUnkeyedPart(opts.inReplyTo, channelId, bytes, true, opts.credit ?? null);
     });
     return this.publishIntent(key, opts);
   }
@@ -39240,22 +39497,23 @@ var BridgeAgent = class _BridgeAgent {
    * the reply to `inReplyTo`. Caller holds the scope lock. `matchRetry` false
    * after a slot collision: the body must go to a NEW part.
    */
-  async claimUnkeyedPart(inReplyTo, channelId, bytes, matchRetry) {
+  async claimUnkeyedPart(inReplyTo, channelId, bytes, matchRetry, replyCredit) {
+    const credit = replyCredit ?? void 0;
     const scope = `reply:${inReplyTo}`;
     let latest = null;
     for (const intent of await this.store.listReplyIntents(inReplyTo)) {
       const n = intent.scope === scope ? partOrdinal(intent.part) : null;
       if (n !== null && (latest === null || n > latest.ordinal)) latest = { ordinal: n, intent };
     }
-    if (matchRetry && latest && latest.intent.state !== "skipped" && latest.intent.channelId === channelId && latest.intent.bodyMac === replyBodyMac(this.replyIdKey, latest.intent.replyMessageId, channelId, bytes)) {
+    if (matchRetry && latest && latest.intent.state !== "skipped" && latest.intent.channelId === channelId && latest.intent.bodyMac === replyBodyMac(this.replyIdKey, latest.intent.replyMessageId, channelId, bytes, credit)) {
       return { scope, part: latest.intent.part, inReplyTo };
     }
     let ordinal = latest ? latest.ordinal + 1 : 0;
     for (let i = 0; i < REPLY_MAX_PART_ADVANCES; i++, ordinal++) {
       const k = { scope, part: `p:${ordinal}`, inReplyTo };
       const id = replyMessageId(this.replyIdKey, this.cfg.identityId, channelId, k);
-      const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes);
-      const { created, intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes });
+      const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, credit);
+      const { created, intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit });
       if (created) return k;
       if (matchRetry && intent.state !== "skipped" && intent.bodyMac === mac2 && intent.channelId === channelId) return k;
       writeServiceLog("info", "reply.part_slot_taken", { attempt: i + 1 });
@@ -39300,6 +39558,12 @@ var BridgeAgent = class _BridgeAgent {
       }
       const bytes = intent.body;
       const body = decodeReplyBody(bytes);
+      const recordText = this.recordTextOf(intent.replyCredit, body);
+      if (recordText === void 0) {
+        writeServiceLog("error", "reply.intent_integrity_refused");
+        this.store.deletePendingReplyIntent(key.scope, key.part);
+        throw new ReplyIntentIntegrityError();
+      }
       const purgeEpochBeforePublish = this.store.conversationPurgeEpoch(intent.channelId);
       const replyCapture = this.unifiedReplyCapture(intent.channelId, intent.inReplyTo ?? void 0);
       try {
@@ -39328,14 +39592,17 @@ var BridgeAgent = class _BridgeAgent {
           const inReplyTo = intent.inReplyTo;
           const next = await this.withReplyLock(
             JSON.stringify(["scope", key.scope]),
-            () => this.claimUnkeyedPart(inReplyTo, intent.channelId, bytes, false)
+            () => (
+              // r2 BLOCKER 1: the colliding row's OWN credit (verified above), never `opts`.
+              this.claimUnkeyedPart(inReplyTo, intent.channelId, bytes, false, isReplyCredit(intent.replyCredit) ? intent.replyCredit : null)
+            )
           );
           return this.publishIntent(next, opts, advances + 1);
         }
         throw e;
       }
       this.store.markReplyIntentSent(key.scope, key.part);
-      this.afterPublish(intent.channelId, body, intent.replyMessageId, opts, purgeEpochBeforePublish, replyCapture);
+      this.afterPublish(intent.channelId, body, intent.replyMessageId, opts, purgeEpochBeforePublish, replyCapture, recordText);
       return { message_id: intent.replyMessageId, status: "sent" };
     });
   }
@@ -39345,9 +39612,21 @@ var BridgeAgent = class _BridgeAgent {
    */
   intentVerifies(intent) {
     if (!intent.body) return false;
+    const credit = intent.replyCredit ?? null;
+    if (credit !== null && !isReplyCredit(credit)) return false;
     const id = replyMessageId(this.replyIdKey, this.cfg.identityId, intent.channelId, intent);
     if (id !== intent.replyMessageId) return false;
-    return replyBodyMac(this.replyIdKey, intent.replyMessageId, intent.channelId, intent.body) === intent.bodyMac;
+    return replyBodyMac(this.replyIdKey, intent.replyMessageId, intent.channelId, intent.body, credit ?? void 0) === intent.bodyMac;
+  }
+  /**
+   * Weather/currency Task 17: what a verified row's reply is RECORDED as. Null credit: the decoded text unchanged (null
+   * for an a2a body). "weatherapi": the text minus the exact credit suffix. Undefined: the row is refused (an unknown
+   * credit, a credited a2a body, or a credited text without the exact suffix).
+   */
+  recordTextOf(credit, body) {
+    if (credit === null) return body.kind === "text" ? body.text : null;
+    if (!isReplyCredit(credit) || body.kind !== "text" || !body.text.endsWith(WEATHER_CREDIT_SUFFIX)) return void 0;
+    return body.text.slice(0, body.text.length - WEATHER_CREDIT_SUFFIX.length);
   }
   /**
    * SEC-06 #18 item 3: a rate-limited reply retries the PUBLISH in-process
@@ -39507,7 +39786,8 @@ var BridgeAgent = class _BridgeAgent {
       uploadBlob: (ciphertext, channelId) => this.uploadBlobImpl(ciphertext, channelId),
       encryptFile,
       bytesToBase64: bytesToBase642,
-      readFile: (p) => fsp.readFile(p).then((b) => new Uint8Array(b))
+      // Security fix 2026-10-30: attachments upload only from the outbox.
+      readFile: (p) => readOutboxFile(this.outboxPin, p).then((r) => r.bytes)
     };
   }
   receiveDeps() {
@@ -39517,8 +39797,8 @@ var BridgeAgent = class _BridgeAgent {
       decryptFile,
       computeFileDigest,
       base64ToBytes: base64ToBytes2,
-      mkdirp: (d) => fsp.mkdir(d, { recursive: true }).then(() => void 0),
-      writeFile: (p, data) => fsp.writeFile(p, data)
+      mkdirp: (d) => fsp2.mkdir(d, { recursive: true }).then(() => void 0),
+      writeFile: (p, data) => fsp2.writeFile(p, data)
     };
   }
   async sendAttachment(channelId, filePath2, caption) {
@@ -39526,8 +39806,11 @@ var BridgeAgent = class _BridgeAgent {
     const joined = await this.reconcileJoin(channelId);
     if (!joined) throw new ChannelPendingError(channelId);
     let body;
+    let read;
     try {
-      body = await prepareAttachment(filePath2, caption, channelId, this.sendDeps());
+      read = await readOutboxFile(this.outboxPin, filePath2);
+      const bytes = read.bytes;
+      body = await prepareAttachment(filePath2, caption, channelId, { ...this.sendDeps(), readFile: async () => bytes });
     } catch (e) {
       if (e.code === "ENOENT" || e.code === "EACCES" || e.code === "ENOTDIR" || e.code === "EISDIR") {
         throw new InvalidPathError(filePath2, e);
@@ -39568,6 +39851,7 @@ var BridgeAgent = class _BridgeAgent {
     );
     this.latency.record("send.total", performance.now() - sendStart);
     this.agentHops.noteOwnSend(channelId);
+    await this.consumeUploaded(read);
     return { message_id: id, status: "sent" };
   }
   // ── B7: FileSafe vault commands (loopback boundary) ──────────────────────
@@ -40093,25 +40377,26 @@ var BridgeAgent = class _BridgeAgent {
       }
     };
   }
-  /** Read `path` off local disk, encrypt + wrap its DEK under the vault's
+  /** Read `path` from the vault outbox (security fix 2026-10-30; see
+   *  ./outbox.ts), encrypt + wrap its DEK under the vault's
    *  current KEK generation, and create+upload+commit it as a new vault
    *  file node named `name` (which may differ from `path`'s basename). */
   async vaultWrite(enclaveId, vaultChannelId, path, name) {
-    const session = await this.getVaultSession(enclaveId, await this.resolveVaultChannelId(enclaveId, vaultChannelId));
-    let bytes;
+    let read;
     try {
-      bytes = new Uint8Array(await fsp.readFile(path));
+      read = await readOutboxFile(this.outboxPin, path);
     } catch (e) {
       const code = e.code;
       if (code === "ENOENT" || code === "EACCES" || code === "ENOTDIR" || code === "EISDIR") throw new InvalidPathError(path, e);
       throw e;
     }
+    const session = await this.getVaultSession(enclaveId, await this.resolveVaultChannelId(enclaveId, vaultChannelId));
     const nodeId = crypto.randomUUID();
-    return vaultWriteImpl({
+    const written = await vaultWriteImpl({
       enclaveId,
       nodeId,
       name,
-      bytes,
+      bytes: read.bytes,
       deps: {
         exporterKekForGeneration: session.kekForGeneration,
         currentGeneration: session.currentGeneration,
@@ -40120,6 +40405,16 @@ var BridgeAgent = class _BridgeAgent {
         commitNode: (committedNodeId) => this.vaultCommitNode(enclaveId, committedNodeId)
       }
     });
+    await this.consumeUploaded(read);
+    return written;
+  }
+  /** Audit 2026-10-30 MED 5: an uploaded file leaves the outbox (no plaintext lingers). Content-free log. */
+  async consumeUploaded(read) {
+    if (!this.outboxPin || !await consumeOutboxFile(this.outboxPin, read)) writeServiceLog("warn", "vault_outbox.consume_failed");
+  }
+  /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
+  vaultOutboxPath() {
+    return this.outboxPin?.dir ?? null;
   }
   /** Download + verify + decrypt a vault file node. Returns the plaintext
    *  base64-encoded (the loopback boundary is JSON-only, mirroring how
@@ -42552,13 +42847,13 @@ var BridgeAgent = class _BridgeAgent {
       throw new Error("summarize_no_runtime");
     }
     const messages = [{ role: "user", content: prompt }];
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const onAbort = () => reject(new Error("aborted"));
       signal.addEventListener("abort", onAbort);
       this.fastLlm.complete(messages).then(
         (text) => {
           signal.removeEventListener("abort", onAbort);
-          resolve4(text);
+          resolve5(text);
         },
         (err) => {
           signal.removeEventListener("abort", onAbort);
@@ -43471,7 +43766,7 @@ var BridgeAgent = class _BridgeAgent {
               this.memory,
               m.channelId,
               m.envelope.sender_id,
-              parsed.text,
+              m.envelope.sender_id === this.cfg.identityId ? stripCreditSuffix(parsed.text) : parsed.text,
               m.messageId,
               m.voiceMode ? "voice" : "text",
               purgeEpochAtTap
@@ -43506,7 +43801,7 @@ var BridgeAgent = class _BridgeAgent {
       return got;
     }
     const cap = Math.min(waitSeconds, 50) * 1e3;
-    await new Promise((resolve4) => {
+    await new Promise((resolve5) => {
       let fired = false;
       let timer;
       const wake = () => {
@@ -43515,7 +43810,7 @@ var BridgeAgent = class _BridgeAgent {
         clearTimeout(timer);
         const i = this.waiters.indexOf(wake);
         if (i >= 0) this.waiters.splice(i, 1);
-        resolve4();
+        resolve5();
       };
       timer = setTimeout(wake, cap);
       this.waiters.push(wake);
@@ -43558,13 +43853,13 @@ var BridgeAgent = class _BridgeAgent {
     const bound = b !== null && b.state === "bound" && b.counter === this.toolGrantCounter;
     const switchOn = audience === "owner_dm" ? this.ownerDmManifestGrants : audience === "team_room" ? this.roomManifestGrants : false;
     const signedNow = new Set(audience && manifest ? manifest.grants[audience] ?? [] : []);
-    const constants4 = new Set(audience === "owner_dm" ? OWNER_DM_DEFAULT_READ_GRANTS.map((g) => g.tool) : audience === "team_room" ? ROOM_DEFAULT_READ_GRANTS.map((g) => g.tool) : []);
+    const constants5 = new Set(audience === "owner_dm" ? OWNER_DM_DEFAULT_READ_GRANTS.map((g) => g.tool) : audience === "team_room" ? ROOM_DEFAULT_READ_GRANTS.map((g) => g.tool) : []);
     let changed = false;
     const out = a.tool_grants.flatMap((g) => {
       if (!(g.mode === "read" && g.source === "manifest")) return [g];
       if (switchOn && bound && signedNow.has(g.tool)) return [g];
       changed = true;
-      return constants4.has(g.tool) && signedNow.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+      return constants5.has(g.tool) && signedNow.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
     });
     if (!changed) return m;
     return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(out) }) };
@@ -44269,21 +44564,49 @@ ${channelId}`;
    */
   searchProvidersSockets = /* @__PURE__ */ new Map();
   /**
-   * The D28 value the files were last recomputed for; null until the first socket observation, so that observation
-   * always recomputes (final review I-1), even when it is non-capable.
+   * Weather/currency U6 (H-1): the same AND-over-sockets state for utility_tools_v1, kept separately per socket, so a
+   * runtime that declares search_providers_v2 but not utility_tools_v1 (0.14.0, 0.14.1) keeps web_extract and never
+   * sees a utility name.
+   */
+  utilityToolsSockets = /* @__PURE__ */ new Map();
+  /**
+   * The (search, utility) tuple the files were last recomputed for; null until the first socket observation, so that
+   * observation always recomputes (final review I-1), even when it is non-capable. One trigger keyed on BOTH values.
    */
-  searchProvidersState = null;
+  capabilityState = null;
   searchCapabilityRefetchTimer = null;
   /** When the current burst's first change happened (valid while the timer is set). */
   searchCapabilityBurstStart = 0;
   /** The D28 value in the last report posted (null until one is); a change needs a refetch to reach the web. */
   lastReportedSearchProviders = null;
+  /** U6: the utility_tools_v1 value in the last report posted (null until one is). */
+  lastReportedUtilityTools = null;
   noteSearchProvidersSocket(token, declared) {
     this.searchProvidersSockets.set(token, declared);
-    this.onSearchProvidersMaybeChanged();
+    this.onCapabilityMaybeChanged();
   }
   clearSearchProvidersSocket(token) {
-    if (this.searchProvidersSockets.delete(token)) this.onSearchProvidersMaybeChanged();
+    if (this.searchProvidersSockets.delete(token)) this.onCapabilityMaybeChanged();
+  }
+  noteUtilityToolsSocket(token, declared) {
+    this.utilityToolsSockets.set(token, declared);
+    this.onCapabilityMaybeChanged();
+  }
+  clearUtilityToolsSocket(token) {
+    if (this.utilityToolsSockets.delete(token)) this.onCapabilityMaybeChanged();
+  }
+  /** U6: every attached runtime socket declared utility_tools_v1; no socket attached means absent (false). */
+  utilityToolsCapable() {
+    if (this.utilityToolsSockets.size === 0) return false;
+    for (const v of this.utilityToolsSockets.values()) if (!v) return false;
+    return true;
+  }
+  /** U6: the features every attached runtime socket declared, for the policy functions. */
+  capabilityFeatures() {
+    const out = /* @__PURE__ */ new Set();
+    if (this.searchProvidersCapable()) out.add("search_providers_v2");
+    if (this.utilityToolsCapable()) out.add("utility_tools_v1");
+    return out;
   }
   /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
   searchProvidersCapable() {
@@ -44310,14 +44633,14 @@ ${channelId}`;
    * D35 (P-4): on a capability change, rewrite manifest-policy.json at once from the stored manifest, the kill
    * switches and the new capability, then a debounced refetch (one per burst) only when needed.
    */
-  onSearchProvidersMaybeChanged() {
-    const capable = this.searchProvidersCapable();
-    const prev = this.searchProvidersState;
-    if (capable === prev) return;
-    this.searchProvidersState = capable;
-    this.recomputeManifestPolicy(capable);
+  onCapabilityMaybeChanged() {
+    const next = { search: this.searchProvidersCapable(), utility: this.utilityToolsCapable() };
+    const prev = this.capabilityState;
+    if (prev !== null && prev.search === next.search && prev.utility === next.utility) return;
+    this.capabilityState = next;
+    this.recomputeManifestPolicy(this.capabilityFeatures());
     if (this.closingDown) return;
-    if (prev === null && !capable) return;
+    if (prev === null && !next.search && !next.utility) return;
     const now = Date.now();
     if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
     else this.searchCapabilityBurstStart = now;
@@ -44335,7 +44658,7 @@ ${channelId}`;
   searchCapabilityRefetchNeeded() {
     if (!this.bootConfigSettled || this.closingDown) return false;
     const inForce = (this.cfg.ownerGrantPin?.pin ?? null) !== null && this.toolGrantManifest !== null;
-    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable();
+    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable() || this.lastReportedUtilityTools !== this.utilityToolsCapable();
   }
   /**
    * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
@@ -44343,16 +44666,17 @@ ${channelId}`;
    * lists web_extract loses it at once, so an older runtime never reads it as unreadable (which drops every grant).
    * Content-free; a write failure is logged and the debounced refetch tries again.
    */
-  recomputeManifestPolicy(capable) {
+  recomputeManifestPolicy(features) {
     const pin = this.cfg.ownerGrantPin?.pin ?? null;
     const manifest = pin !== null ? this.toolGrantManifest : null;
     try {
       if (manifest !== null && this.manifestBinding !== null && this.manifestBinding.counter === manifest.counter) {
-        this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, capable));
+        this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, features));
         return;
       }
-      if (capable) return;
-      const path = join19(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
+      const withheld = new Set(Object.keys(TOOL_FEATURE).filter((t) => !toolAllowedByFeatures(t, features)));
+      if (withheld.size === 0) return;
+      const path = join20(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
       if (!existsSync5(path)) return;
       let doc;
       try {
@@ -44361,10 +44685,10 @@ ${channelId}`;
         return;
       }
       const tools = doc?.manifest_tools;
-      if (!Array.isArray(tools) || !tools.includes("web_extract")) return;
+      if (!Array.isArray(tools) || !tools.some((t) => typeof t === "string" && withheld.has(t))) return;
       this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, {
         v: 1,
-        manifest_tools: tools.filter((t) => typeof t === "string" && t !== "web_extract"),
+        manifest_tools: tools.filter((t) => typeof t === "string" && !withheld.has(t)),
         secret_path_mode: "enforce"
       });
     } catch (e) {
@@ -44577,8 +44901,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         ingest.released,
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44588,8 +44912,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         starting,
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44598,8 +44922,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.membershipSweepWork,
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44609,8 +44933,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallPruneWork,
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44620,8 +44944,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallMaintenanceWork,
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44633,8 +44957,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.recallTapWork]),
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44643,8 +44967,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.unifiedWork]),
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44653,8 +44977,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallPrewarmWork,
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44664,8 +44988,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.replyWork]),
-        new Promise((resolve4) => {
-          timer = setTimeout(resolve4, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve5) => {
+          timer = setTimeout(resolve5, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44755,6 +45079,13 @@ var BRIDGE_ERRORS = {
   // C9 (spec §4.1.6 step 1): another copy of this agent took its SecureComs
   // session (WS 4409), so this copy stopped. Every local route but /healthz.
   session_superseded: { http: 503, message: "another copy of this agent took its session; this copy stopped" },
+  // Weather/currency Task 17 (OQ-P1): a send frame's credit is not the closed value, or rides an a2a frame. TERMINAL:
+  // the inbound is retired, so the model (and the weather call) never runs again for it.
+  reply_credit_unknown: { http: 400, message: "reply credit not recognised; not sent" },
+  // Security fix 2026-10-30: an upload route was given a path that is not a
+  // regular file directly inside the bridge's vault outbox (`vault_outbox` on
+  // /healthz). Fixed and content-free: the path is never echoed or logged.
+  path_outside_outbox: { http: 400, message: "uploads must come from the bridge vault outbox; copy the file there first" },
   internal: { http: 500, message: "internal error" }
 };
 function errorBody(code, detail) {
@@ -44784,6 +45115,7 @@ function withConsumerGrants(m, perToolConsumer) {
 }
 var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
 var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
+var UTILITY_TOOLS_FEATURE = "utility_tools_v1";
 var CONSTANT_TOOL_NAMES = Object.freeze({
   owner_dm: Object.freeze(["current_time", "web_search"]),
   team_room: Object.freeze(["current_time"])
@@ -44793,10 +45125,10 @@ function withManifestCapability(m, manifestConsumer) {
   if (manifestConsumer) return m;
   const a = m.authorization;
   if (!a || !a.tool_grants.some(isManifestGrant)) return m;
-  const constants4 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
+  const constants5 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
   const narrowed = a.tool_grants.flatMap((g) => {
     if (!isManifestGrant(g)) return [g];
-    return constants4.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+    return constants5.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
   });
   return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(narrowed) }) };
 }
@@ -44815,6 +45147,15 @@ function withSearchCapability(m, consumerHasFeature, signedProvider) {
   if (kept.length === a.tool_grants.length) return m;
   return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
 }
+var UTILITY_TOOL_NAMES = /* @__PURE__ */ new Set(["weather_forecast", "currency_convert"]);
+function withUtilityCapability(m, consumerHasFeature) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const kept = a.tool_grants.filter((g) => !UTILITY_TOOL_NAMES.has(g.tool));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
 
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
@@ -44838,7 +45179,7 @@ data: ${JSON.stringify(msgs[i])}
 function deliverSseBatch(res, batch, agent, onWriteError) {
   const withheld = agent.harnessGrantsWithheld();
   const provider = agent.signedSearchProvider();
-  const left3 = writeSse(res, batch.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)), onWriteError);
+  const left3 = writeSse(res, batch.map((m) => withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false)), onWriteError);
   const leftIds = new Set(left3.map((message) => message.message_id));
   agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
   if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
@@ -44870,7 +45211,7 @@ var OTHER_CAP = 8 * 1024;
 var a2aSchema = z3.object({
   a2a_version: z3.string().min(1),
   kind: z3.enum(["message", "task", "artifact"]),
-  object: z3.record(z3.unknown())
+  object: z3.record(z3.string(), z3.unknown())
 });
 var sendAttachmentSchema = z3.object({
   channel_id: z3.string().min(1),
@@ -44945,7 +45286,7 @@ function jsonError(res, code, detail) {
   json(res, httpStatus(code), errorBody(code, detail));
 }
 function readBody(req, cap) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let size = 0;
     let done = false;
     const chunks = [];
@@ -44965,7 +45306,7 @@ function readBody(req, cap) {
     req.on("end", () => {
       if (!done) {
         done = true;
-        resolve4(Buffer.concat(chunks).toString("utf8"));
+        resolve5(Buffer.concat(chunks).toString("utf8"));
       }
     });
     req.on("error", (e) => {
@@ -45043,6 +45384,9 @@ function createHttpServer(agent, opts) {
         }
         return json(res, 200, r);
       }
+      if (method === "GET" && path === "/v1/vault-outbox") {
+        return json(res, 200, { path: agent.vaultOutboxPath() });
+      }
       if (method === "POST" && path === "/v1/send-attachment") {
         const parsed = sendAttachmentSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
@@ -45112,7 +45456,7 @@ function createHttpServer(agent, opts) {
         const drained = await agent.drain(channel, wait);
         const withheld = agent.harnessGrantsWithheld();
         const provider = agent.signedSearchProvider();
-        return json(res, 200, drained.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)));
+        return json(res, 200, drained.map((m) => withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -45154,6 +45498,10 @@ function createHttpServer(agent, opts) {
       if (e instanceof SendForbiddenError) return jsonError(res, "send_forbidden");
       if (e instanceof GroupSupersededSendError) return jsonError(res, "group_superseded");
       if (e instanceof IdempotencyConflictError) return jsonError(res, "invalid_request", e.message);
+      if (e instanceof PathOutsideOutboxError) {
+        writeServiceLog("warn", "vault_outbox.refused");
+        return jsonError(res, "path_outside_outbox");
+      }
       if (e instanceof InvalidPathError) return jsonError(res, "invalid_request", e.message);
       if (e instanceof VaultPinMismatchError) return jsonError(res, "vault_ref_changed", { pin: e.pin });
       if (e instanceof VaultIntegrityError) return jsonError(res, "vault_integrity_failed", e.message);
@@ -45287,6 +45635,7 @@ function attachAgentWebSocket(server, agent, opts) {
       perToolGrants: false,
       manifestGrants: false,
       searchProviders: false,
+      utilityTools: false,
       // helloWaitMs 0 keeps today's synchronous initial flush exactly (the opt-out the existing tests use).
       deliveryOpen: helloWaitMs <= 0,
       deliveryToken: /* @__PURE__ */ new Map(),
@@ -45340,14 +45689,14 @@ function attachAgentWebSocket(server, agent, opts) {
             continue;
           }
           const out = withConsumerNotes(
-            withSearchCapability(
+            withUtilityCapability(withSearchCapability(
               withManifestCapability(
                 withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
                 session.manifestGrants
               ),
               session.searchProviders,
               agent.signedSearchProvider()
-            ),
+            ), session.utilityTools),
             batch[i],
             session,
             agent
@@ -45404,6 +45753,7 @@ function attachAgentWebSocket(server, agent, opts) {
       if (session.perToolGrants) agent.clearPerToolConsumer(session);
       if (session.manifestGrants) agent.clearManifestConsumer(session);
       agent.clearSearchProvidersSocket(session);
+      agent.clearUtilityToolsSocket(session);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -45444,7 +45794,10 @@ function sendJson(sock, body) {
   } catch {
   }
 }
+var ReplyCreditUnknownError = class extends Error {
+};
 function sendErrorCode(e) {
+  if (e instanceof ReplyCreditUnknownError) return "reply_credit_unknown";
   if (e instanceof ChannelPendingError) return "channel_pending";
   if (e instanceof RateLimitedError) return "rate_limited";
   if (e instanceof AgentPausedSendError) return "agent_paused";
@@ -45505,6 +45858,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     agent.noteConsumerCapability(manifest ? "ok" : session.harnessClaimed ? "harness_consumer" : "missing");
     session.searchProviders = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(SEARCH_PROVIDERS_FEATURE);
     agent.noteSearchProvidersSocket(session, session.searchProviders);
+    session.utilityTools = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(UTILITY_TOOLS_FEATURE);
+    agent.noteUtilityToolsSocket(session, session.utilityTools);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -45512,7 +45867,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
@@ -45541,7 +45896,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
   }
   const replyFailed = (e, inReplyTo) => {
     const code = sendErrorCode(e);
-    if ((code === "agent_paused" || code === "send_forbidden") && typeof inReplyTo === "string") {
+    const terminal = code === "agent_paused" || code === "send_forbidden" || code === "reply_credit_unknown";
+    if (terminal && typeof inReplyTo === "string") {
       inflight.delete(inReplyTo);
       session.deliveryToken.delete(inReplyTo);
       session.shownRecall.delete(inReplyTo);
@@ -45549,7 +45905,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       agent.ackRuntimeMessages([inReplyTo]);
     }
     sendJson(sock, { ...wsErrorFrame(code), ...typeof inReplyTo === "string" ? { in_reply_to: inReplyTo } : {} });
-    if (code === "agent_paused" || code === "send_forbidden") flush();
+    if (terminal) flush();
   };
   if (m.type === "send") {
     if (typeof m.channel_id !== "string" || !m.channel_id) {
@@ -45566,8 +45922,14 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     }
     const record = typeof m.in_reply_to === "string" ? inflight.get(m.in_reply_to) : void 0;
     const callBufferReply = session.consumer === "runtime" && session.perToolGrants === true && session.harnessClaimed !== true && typeof m.in_reply_to === "string" && record !== void 0 && session.deliveryToken.get(m.in_reply_to) !== void 0 && record.channel_id === m.channel_id && !agent.isRuntimeMessageRetired(m.in_reply_to);
+    if (m.credit !== void 0 && (m.a2a !== void 0 || !isReplyCredit(m.credit))) {
+      writeServiceLog("error", "reply.credit_unknown");
+      replyFailed(new ReplyCreditUnknownError(), m.in_reply_to);
+      return;
+    }
     const sendOpts = {
       agentTurn: isAgentTurn(agent, m),
+      ...isReplyCredit(m.credit) ? { credit: m.credit } : {},
       ...typeof m.in_reply_to === "string" ? { inReplyTo: m.in_reply_to } : {},
       ...typeof m.idempotency_key === "string" ? { idempotencyKey: m.idempotency_key } : {},
       ...callBufferReply ? { callBufferReply: true } : {}
@@ -45741,18 +46103,18 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
 var LOWER_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 // src/bin.ts
-import { readFileSync as readFileSync17, mkdirSync as mkdirSync8, writeFileSync as writeFileSync5, rmSync as rmSync8, existsSync as existsSync7, realpathSync as realpathSync3, readdirSync as readdirSync4, statSync as statSync8, chmodSync as chmodSync6 } from "node:fs";
-import { join as join25, dirname as dirname13, isAbsolute as isAbsolute3, resolve as resolve3 } from "node:path";
+import { readFileSync as readFileSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5, rmSync as rmSync8, existsSync as existsSync7, realpathSync as realpathSync4, readdirSync as readdirSync4, statSync as statSync8, chmodSync as chmodSync7 } from "node:fs";
+import { join as join26, dirname as dirname14, isAbsolute as isAbsolute3, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { homedir as homedir5, userInfo } from "node:os";
 import { spawnSync } from "node:child_process";
 import { createServer as netCreateServer } from "node:net";
 
 // src/service/install.ts
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname9 } from "node:path";
 
 // src/service/config.ts
-import { basename as basename5, extname, isAbsolute as isAbsolute2, resolve } from "node:path";
+import { basename as basename6, extname, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 
 // src/service/resolve-node.ts
 var REQUIRED_NODE_MAJOR = 24;
@@ -45830,11 +46192,11 @@ function deriveServiceConfig(input) {
       `The Node at ${input.execPath} moves when it is upgraded, so the background service can't use it. Install Node ${REQUIRED_NODE_MAJOR} from https://nodejs.org, then run the install command again.`
     );
   }
-  const stem = input.label ?? basename5(input.credentialPath, extname(input.credentialPath));
+  const stem = input.label ?? basename6(input.credentialPath, extname(input.credentialPath));
   const slug = slugify(stem);
-  const cred = isAbsolute2(input.credentialPath) ? input.credentialPath : resolve(input.credentialPath);
+  const cred = isAbsolute2(input.credentialPath) ? input.credentialPath : resolve2(input.credentialPath);
   const args2 = ["--credential", cred];
-  if (input.storePath) args2.push("--store", isAbsolute2(input.storePath) ? input.storePath : resolve(input.storePath));
+  if (input.storePath) args2.push("--store", isAbsolute2(input.storePath) ? input.storePath : resolve2(input.storePath));
   if (input.port != null) args2.push("--port", String(input.port));
   return {
     slug,
@@ -45929,7 +46291,7 @@ function waitForPreviousExit(deps, pid) {
   }
 }
 function tokenHint(input) {
-  return `${dirname8(input.credentialPath)}/bridge-token`;
+  return `${dirname9(input.credentialPath)}/bridge-token`;
 }
 function requireOk(r, what) {
   if (r.status !== 0) throw new Error(`${what} failed (exit ${r.status})${r.stderr ? `: ${r.stderr.trim()}` : ""}`);
@@ -45937,8 +46299,8 @@ function requireOk(r, what) {
 function installService(input, deps) {
   const cfg = deriveServiceConfig(input);
   if (deps.platform === "darwin") {
-    deps.mkdirp(dirname8(cfg.plistPath));
-    deps.mkdirp(dirname8(cfg.logPath));
+    deps.mkdirp(dirname9(cfg.plistPath));
+    deps.mkdirp(dirname9(cfg.logPath));
     deps.writeFile(cfg.plistPath, renderLaunchdPlist(cfg));
     const target = `gui/${cfg.uid}/${cfg.label}`;
     const previousPid = launchdPid(deps, target);
@@ -45950,7 +46312,7 @@ function installService(input, deps) {
     return { label: cfg.label, filePath: cfg.plistPath, logHint: cfg.logPath, tokenHint: tokenHint(input) };
   }
   if (deps.platform === "linux") {
-    deps.mkdirp(dirname8(cfg.unitPath));
+    deps.mkdirp(dirname9(cfg.unitPath));
     deps.writeFile(cfg.unitPath, renderSystemdUnit(cfg));
     deps.run("systemctl", ["--user", "daemon-reload"]);
     deps.run("loginctl", ["enable-linger", deps.user]);
@@ -45979,10 +46341,10 @@ function uninstallService(input, deps) {
 }
 
 // src/service/install-prep.ts
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 
 // src/service/wire.ts
-import { join as join20, dirname as dirname9 } from "node:path";
+import { join as join21, dirname as dirname10 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/service/hermes-config.ts
@@ -46157,8 +46519,8 @@ function checkBindingConflict(prev, next, allowRebind) {
   };
 }
 function connectorsSrcDir(importMetaUrl, harness) {
-  const pkgRoot = dirname9(dirname9(fileURLToPath3(importMetaUrl)));
-  return join20(pkgRoot, "connectors", harness);
+  const pkgRoot = dirname10(dirname10(fileURLToPath3(importMetaUrl)));
+  return join21(pkgRoot, "connectors", harness);
 }
 function hermesConfigPath(home) {
   return `${home}/.hermes/config.yaml`;
@@ -46420,10 +46782,10 @@ function assertReadableCredential(absPath, deps) {
   return { deviceId: json2.device_id, identityId: json2.identity_id, issuedAt };
 }
 function durableDir(home, slug) {
-  return join21(home, `securecoms-agent-${slug}`);
+  return join22(home, `securecoms-agent-${slug}`);
 }
 function durableCredentialPath(home, slug) {
-  return join21(durableDir(home, slug), `${slug}.json`);
+  return join22(durableDir(home, slug), `${slug}.json`);
 }
 var DURABLE_PREFIX = "securecoms-agent-";
 var InstallRefusedError = class extends Error {
@@ -46444,8 +46806,8 @@ function refuseExistingIdentity(args2, deps) {
   const others = names.filter((n) => n.startsWith(DURABLE_PREFIX) && n !== destName).sort();
   for (const name of [destName, ...others]) {
     const slug = name.slice(DURABLE_PREFIX.length);
-    const dir = join21(args2.home, name);
-    const credPath = join21(dir, `${slug}.json`);
+    const dir = join22(args2.home, name);
+    const credPath = join22(dir, `${slug}.json`);
     if (!deps.fileExists(credPath)) continue;
     let existing = null;
     try {
@@ -46454,7 +46816,7 @@ function refuseExistingIdentity(args2, deps) {
     } catch {
     }
     if (!existing || typeof existing.identity_id !== "string" || !existing.identity_id) {
-      if (deps.fileExists(join21(dir, "bridge-state.db"))) throw existingIdentityError(dir, slug);
+      if (deps.fileExists(join22(dir, "bridge-state.db"))) throw existingIdentityError(dir, slug);
       continue;
     }
     if (existing.identity_id !== args2.parsed.identityId) continue;
@@ -46509,7 +46871,7 @@ function readSiblingDefs(dir, prefix, deps) {
   for (const n of names) {
     if (!n.startsWith(prefix)) continue;
     try {
-      out.push(deps.readFile(join21(dir, n)));
+      out.push(deps.readFile(join22(dir, n)));
     } catch {
     }
   }
@@ -46590,7 +46952,7 @@ async function orchestrateInstall(ctx) {
 }
 
 // src/service/fleet.ts
-import { dirname as dirname10 } from "node:path";
+import { dirname as dirname11 } from "node:path";
 function parseArgFromDef(def, flag) {
   const esc = flag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`${esc}(?:<\\/string>\\s*<string>|\\s+)([^<\\s]+)`);
@@ -46634,7 +46996,7 @@ function readFleet(deps) {
       let identityId = `unknown:${slug}`, deviceId = "", label = slug, env = "unknown";
       let credDir = null;
       if (credPath) {
-        credDir = dirname10(credPath);
+        credDir = dirname11(credPath);
         try {
           const c = JSON.parse(deps.readFile(credPath));
           if (c.identity_id) identityId = c.identity_id;
@@ -46702,31 +47064,31 @@ function renderStatusTable(rows) {
 
 // src/service/connection-file.ts
 import {
-  chmodSync as chmodSync5,
-  mkdirSync as mkdirSync6,
+  chmodSync as chmodSync6,
+  mkdirSync as mkdirSync7,
   readFileSync as readFileSync13,
   renameSync as renameSync4,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var REAL_FS2 = {
-  mkdir: (p, mode) => mkdirSync6(p, { recursive: true, mode }),
-  chmod: (p, mode) => chmodSync5(p, mode),
+  mkdir: (p, mode) => mkdirSync7(p, { recursive: true, mode }),
+  chmod: (p, mode) => chmodSync6(p, mode),
   writeFile: (p, data, mode) => writeFileSync3(p, data, { mode }),
   rename: (a, b) => renameSync4(a, b),
   readFile: (p) => readFileSync13(p, "utf8"),
   unlink: (p) => unlinkSync2(p)
 };
 function securecomsDir(home) {
-  return join22(home, ".securecoms");
+  return join23(home, ".securecoms");
 }
 function connectionsDir(home) {
-  return join22(securecomsDir(home), "connections");
+  return join23(securecomsDir(home), "connections");
 }
 function connectionFilePath(home, identityId) {
-  return join22(connectionsDir(home), `${identityId}.json`);
+  return join23(connectionsDir(home), `${identityId}.json`);
 }
 function newInstanceId() {
   return randomUUID2();
@@ -46765,9 +47127,9 @@ function removeConnectionFileIfOwned(home, identityId, instanceId, deps = REAL_F
 
 // src/service/instance-lock.ts
 import { execFileSync } from "node:child_process";
-import { closeSync as closeSync4, fsyncSync, mkdirSync as mkdirSync7, openSync as openSync4, readFileSync as readFileSync14, statSync as statSync6, unlinkSync as unlinkSync3, utimesSync, writeSync as writeSync2 } from "node:fs";
+import { closeSync as closeSync4, fsyncSync, mkdirSync as mkdirSync8, openSync as openSync4, readFileSync as readFileSync14, statSync as statSync6, unlinkSync as unlinkSync3, utimesSync, writeSync as writeSync2 } from "node:fs";
 import { hostname, uptime as uptime2 } from "node:os";
-import { dirname as dirname11 } from "node:path";
+import { dirname as dirname12 } from "node:path";
 var LOCK_PARTIAL_WRITE_GRACE_MS = 1e4;
 var LOCK_TAKEOVER_GUARD_STALE_MS = 3e4;
 var BOOT_TOLERANCE_SEC = 120;
@@ -46996,7 +47358,7 @@ var InstanceLock = class {
   create() {
     let fd;
     try {
-      mkdirSync7(dirname11(this.path), { recursive: true, mode: 448 });
+      mkdirSync8(dirname12(this.path), { recursive: true, mode: 448 });
       fd = openSync4(this.path, "wx", 384);
     } catch (error) {
       if (errno(error) === "EEXIST") return "exists";
@@ -47087,15 +47449,15 @@ import {
   closeSync as closeSync5,
   fchmodSync,
   fsyncSync as fsyncSync2,
-  lstatSync as lstatSync8,
+  lstatSync as lstatSync9,
   openSync as openSync5,
   readFileSync as readFileSync15,
-  realpathSync as realpathSync2,
+  realpathSync as realpathSync3,
   renameSync as renameSync5,
   unlinkSync as unlinkSync4,
   writeSync as writeSync3
 } from "node:fs";
-import { dirname as dirname12, join as join23, resolve as resolve2 } from "node:path";
+import { dirname as dirname13, join as join24, resolve as resolve3 } from "node:path";
 var PIN_COPY = Object.freeze({
   saved: "pin saved. Restart the Connector to use it.",
   // [COPY, approved by Eric 2026-10-12]
@@ -47119,7 +47481,7 @@ var PIN_COPY = Object.freeze({
 var refuse2 = (reason) => ({ ok: false, reason });
 function isSymlink(path) {
   try {
-    return lstatSync8(path).isSymbolicLink();
+    return lstatSync9(path).isSymbolicLink();
   } catch (e) {
     if (e?.code === "ENOENT") return null;
     throw e;
@@ -47143,10 +47505,10 @@ function writeTemp(path, bytes) {
   }
 }
 function runPinCommand(opts) {
-  const credDir = dirname12(resolve2(opts.credentialPath));
-  const target = join23(credDir, PIN_FILE_NAME);
+  const credDir = dirname13(resolve3(opts.credentialPath));
+  const target = join24(credDir, PIN_FILE_NAME);
   try {
-    if (realpathSync2(dirname12(resolve2(opts.pinSourcePath))) !== realpathSync2(credDir)) return refuse2("directory_mismatch");
+    if (realpathSync3(dirname13(resolve3(opts.pinSourcePath))) !== realpathSync3(credDir)) return refuse2("directory_mismatch");
   } catch {
     return refuse2("io_error");
   }
@@ -47188,7 +47550,7 @@ function runPinCommand(opts) {
   const pinBytes = JSON.stringify(pinObject, null, 2) + "\n";
   const credBytes = JSON.stringify({ ...cred, owner_signing_key: pinObject }, null, 2) + "\n";
   const pinTmp = `${target}.tmp-${process.pid}`;
-  const credTmp = `${resolve2(opts.credentialPath)}.tmp-${process.pid}`;
+  const credTmp = `${resolve3(opts.credentialPath)}.tmp-${process.pid}`;
   const created = [];
   const fail = () => {
     for (const p of created) {
@@ -47222,7 +47584,7 @@ function runPinCommand(opts) {
   created.splice(created.indexOf(pinTmp), 1);
   step("pin_renamed");
   try {
-    renameSync5(credTmp, resolve2(opts.credentialPath));
+    renameSync5(credTmp, resolve3(opts.credentialPath));
   } catch {
     return fail();
   }
@@ -47303,7 +47665,7 @@ function parseVerb(argv) {
   return v === "install" || v === "uninstall" || v === "status" || v === "wire" || v === "unwire" || v === "models" || v === "pin" ? v : null;
 }
 function slugFromCredentialPath(credentialPath) {
-  const dir = dirname13(credentialPath);
+  const dir = dirname14(credentialPath);
   const base = dir.split(/[\\/]/).pop() ?? "";
   const m = base.match(/^securecoms-agent-(.+)$/);
   if (m) return m[1];
@@ -47319,7 +47681,7 @@ function realServiceDeps() {
     },
     writeFile: (p, data) => writeFileSync5(p, data, { mode: 420 }),
     removeFile: (p) => rmSync8(p, { force: true }),
-    mkdirp: (p) => mkdirSync8(p, { recursive: true }),
+    mkdirp: (p) => mkdirSync9(p, { recursive: true }),
     fileExists: (p) => existsSync7(p),
     user: userInfo().username,
     pidAlive: pidAliveByKill,
@@ -47349,7 +47711,7 @@ function realResolveNodeDeps() {
     return m ? Number(m[1]) : null;
   };
   return {
-    realpath: (p) => realpathSync3(p),
+    realpath: (p) => realpathSync4(p),
     fileExists: (p) => existsSync7(p),
     nodeMajorOf: majorOf,
     arch: () => process.arch,
@@ -47373,10 +47735,10 @@ function realPrepDeps() {
     readFile: (p) => readFileSync17(p, "utf8"),
     writeFileMode: (p, data, mode) => writeFileSync5(p, data, { mode }),
     mkdirp: (p, mode) => {
-      mkdirSync8(p, { recursive: true, mode: mode ?? 493 });
+      mkdirSync9(p, { recursive: true, mode: mode ?? 493 });
     },
     fileExists: (p) => existsSync7(p),
-    realpath: (p) => realpathSync3(p),
+    realpath: (p) => realpathSync4(p),
     listDir: (p) => {
       try {
         return readdirSync4(p);
@@ -47438,33 +47800,33 @@ function runStatus() {
 }
 function realCopyConnector(srcDir, dstDir, harness) {
   const allowedExt = CONNECTOR_FILE_EXTENSIONS[harness];
-  mkdirSync8(dstDir, { recursive: true });
+  mkdirSync9(dstDir, { recursive: true });
   for (const name of readdirSync4(srcDir)) {
-    const srcPath = join25(srcDir, name);
+    const srcPath = join26(srcDir, name);
     if (statSync8(srcPath).isDirectory()) {
       if (CONNECTOR_SKIP_DIRS.has(name)) continue;
-      realCopyConnector(srcPath, join25(dstDir, name), harness);
+      realCopyConnector(srcPath, join26(dstDir, name), harness);
       continue;
     }
     if (name.includes(".test.")) continue;
     if (!allowedExt.some((ext) => name.endsWith(ext))) continue;
-    writeFileSync5(join25(dstDir, name), readFileSync17(srcPath));
+    writeFileSync5(join26(dstDir, name), readFileSync17(srcPath));
   }
 }
 function realWriteBinding(dstDir, identityId) {
-  mkdirSync8(dstDir, { recursive: true });
-  writeFileSync5(join25(dstDir, "securecoms.binding.json"), JSON.stringify({ identity_id: identityId }) + "\n", { mode: 384 });
+  mkdirSync9(dstDir, { recursive: true });
+  writeFileSync5(join26(dstDir, "securecoms.binding.json"), JSON.stringify({ identity_id: identityId }) + "\n", { mode: 384 });
 }
 function realReadBinding(dstDir) {
   try {
-    const parsed = JSON.parse(readFileSync17(join25(dstDir, "securecoms.binding.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync17(join26(dstDir, "securecoms.binding.json"), "utf8"));
     return parsed.identity_id ?? null;
   } catch {
     return null;
   }
 }
 function realRemoveBinding(dstDir) {
-  rmSync8(join25(dstDir, "securecoms.binding.json"), { force: true });
+  rmSync8(join26(dstDir, "securecoms.binding.json"), { force: true });
 }
 function realStatDir(p) {
   try {
@@ -47540,7 +47902,7 @@ async function runServiceVerb(verb) {
   }
   try {
     if (verb === "install") {
-      const credAbs = isAbsolute3(credentialPath) ? credentialPath : resolve3(credentialPath);
+      const credAbs = isAbsolute3(credentialPath) ? credentialPath : resolve4(credentialPath);
       const installExecPath = chooseInstallExecPath(
         process.execPath,
         argOrEnv("--exec-path", "SECURECOMS_EXEC_PATH"),
@@ -47751,11 +48113,11 @@ async function runMode(deps) {
     refuse3("identity_id_invalid", { field: "identity_id" });
     return deps.exit(1);
   }
-  const lockDir = join25(deps.home, ".securecoms", "locks");
-  const lockPath = join25(lockDir, `${cfg.identityId.toLowerCase()}.lock`);
+  const lockDir = join26(deps.home, ".securecoms", "locks");
+  const lockPath = join26(lockDir, `${cfg.identityId.toLowerCase()}.lock`);
   try {
-    mkdirSync8(lockDir, { recursive: true, mode: 448 });
-    chmodSync6(lockDir, 448);
+    mkdirSync9(lockDir, { recursive: true, mode: 448 });
+    chmodSync7(lockDir, 448);
   } catch (e) {
     log("error", "startup.instance_lock_failed", {}, e);
     return deps.exit(1);
@@ -47802,7 +48164,7 @@ async function runMode(deps) {
       return deps.exit(1);
   }
   deps.onExit(() => lock.release());
-  const tokenFile = daemon.tokenFile ?? join25(dirname13(credentialPath), "bridge-token");
+  const tokenFile = daemon.tokenFile ?? join26(dirname14(credentialPath), "bridge-token");
   const token = resolveToken({ tokenFile, token: daemon.token });
   const preBound = deps.net.createServer((sock) => sock.destroy());
   const bindError = await new Promise((resolveBind) => {
@@ -47951,7 +48313,7 @@ async function main() {
   await runMode(realRunModeDeps(credentialPath, storePath));
 }
 var here = fileURLToPath4(import.meta.url);
-var isMain = !!process.argv[1] && refersToSameFile(here, process.argv[1], realpathSync3);
+var isMain = !!process.argv[1] && refersToSameFile(here, process.argv[1], realpathSync4);
 if (isMain) {
   main().catch((e) => {
     writeServiceLog("error", "startup.fatal", {}, e);