@securecoms/agent-bridge 0.33.1 → 0.35.0

package/dist/bridge-agent.d.ts

@@ -45,7 +45,8 @@ import { type CallBufferTurn } from "./voice/call-buffer.js";
 import { type VaultListNode, type VaultReadExpectations } from "./vault.js";
 import type { AgentActionNodeType, AgentActionNodeStatus, AgentActionNodeDetail } from "@agentvault/connect-core";
 import { removeManagedLlmSource, writeManagedFiles, writeManifestPolicy } from "./service/runtime-config-dir.js";
-import { bindRuntimeConfig } from "./grants/binding.js";
+import { type ReplyCredit } from "./reply-credit.js";
+import { bindRuntimeConfig, type FeatureSet } from "./grants/binding.js";
 import type { RuntimeReplyReceipt } from "./reply-receipts.js";
 import type { SearchProvider } from "./grants/search-providers.js";
 export type AgentAudience = "owner_dm" | "team_room" | "partner_room" | "other_human_dm" | "agent_to_agent" | "unknown";
@@ -506,6 +507,13 @@ export interface BridgeAgentDeps {
      * tests to avoid real file IO / assert pin persistence directly.
      */
     vaultOwnerStore?: OwnerAuthorityStore;
+    /**
+     * Security fix 2026-10-30 (option A): the ONLY directory `/v1/vault-write`
+     * and `/v1/send-attachment` read from. Defaults to
+     * `join(dirname(cfg.storePath), "vault-outbox")`, or null (every upload
+     * refused) for an in-memory store. Override in tests.
+     */
+    vaultOutboxDir?: string | null;
 }
 /**
  * Voice repeats (a), owner report 2026-10-02: one spoken question reached the
@@ -692,6 +700,11 @@ export interface SendOptions {
      * enter the call buffer. `POST /v1/send`, SSE and harness replies never set it.
      */
     callBufferReply?: true;
+    /**
+     * Weather/currency Task 17 (OQ-P1): set only by the ws send handler from a frame whose credit is the closed value.
+     * The published text gets the U-25 suffix; history, unified memory and the call buffer get the text without it.
+     */
+    credit?: ReplyCredit;
 }
 /**
  * Task 4b (spec §2.2 A-6): a voice-scoped turn's history, read ONCE at ingest, the buffer seq it ends at and the
@@ -1514,6 +1527,9 @@ export declare class BridgeAgent {
     private readonly uploadBlobImpl;
     /** Track 5: directory where received attachments are saved. */
     private readonly attachmentsDirImpl;
+    private readonly vaultOutboxDirImpl;
+    /** Audit 2026-10-30 HIGH 2: the outbox pinned at start(); null = every upload refused. */
+    private outboxPin;
     /** B7: persistence for the vault kekset's owner-pin TOFU state. */
     private readonly vaultOwnerStoreImpl;
     /** B7: last-seen kekset generation per enclave, enforced monotonic across
@@ -2047,7 +2063,12 @@ export declare class BridgeAgent {
      */
     private reclassifyForReply;
     private enforceBodyRateFloor;
-    /** Bookkeeping after a CONFIRMED publish of `body` under `id`. */
+    /**
+     * Bookkeeping after a CONFIRMED publish of `body` under `id`. `recordText` (weather/currency Task 17) is what a text
+     * reply is RECORDED as: the published text minus any credit line. Every record site below reads `recorded`, never
+     * `body.text`. Every production caller passes it (pinned by reply-credit.test.ts: text, or null for an a2a body);
+     * undefined is left only for direct test calls of an uncredited body, where the published and record texts are equal.
+     */
     private afterPublish;
     /**
      * Final review bridge I-1 (ledger T25): the agent reply's U11 capture, taken BEFORE the publish await. The clear generation
@@ -2103,6 +2124,12 @@ export declare class BridgeAgent {
      * scope and part, and its body matches its MAC (which binds id and channel).
      */
     private intentVerifies;
+    /**
+     * Weather/currency Task 17: what a verified row's reply is RECORDED as. Null credit: the decoded text unchanged (null
+     * for an a2a body). "weatherapi": the text minus the exact credit suffix. Undefined: the row is refused (an unknown
+     * credit, a credited a2a body, or a credited text without the exact suffix).
+     */
+    private recordTextOf;
     /**
      * SEC-06 #18 item 3: a rate-limited reply retries the PUBLISH in-process
      * with backoff, never the model turn; so does an exact resend whose
@@ -2317,12 +2344,17 @@ export declare class BridgeAgent {
      * checks, so the HTTP boundary maps ALL vault trust failures to one code.
      */
     private getVaultSession;
-    /** Read `path` off local disk, encrypt + wrap its DEK under the vault's
+    /** Read `path` from the vault outbox (security fix 2026-10-30; see
+     *  ./outbox.ts), encrypt + wrap its DEK under the vault's
      *  current KEK generation, and create+upload+commit it as a new vault
      *  file node named `name` (which may differ from `path`'s basename). */
     vaultWrite(enclaveId: string, vaultChannelId: string | null | undefined, path: string, name: string): Promise<{
         node_id: string;
     }>;
+    /** Audit 2026-10-30 MED 5: an uploaded file leaves the outbox (no plaintext lingers). Content-free log. */
+    private consumeUploaded;
+    /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
+    vaultOutboxPath(): string | null;
     /** Download + verify + decrypt a vault file node. Returns the plaintext
      *  base64-encoded (the loopback boundary is JSON-only, mirroring how
      *  useVault.downloadFile returns `{name, bytes}` in-memory — here the
@@ -3504,17 +3536,31 @@ export declare class BridgeAgent {
      */
     private readonly searchProvidersSockets;
     /**
-     * The D28 value the files were last recomputed for; null until the first socket observation, so that observation
-     * always recomputes (final review I-1), even when it is non-capable.
+     * Weather/currency U6 (H-1): the same AND-over-sockets state for utility_tools_v1, kept separately per socket, so a
+     * runtime that declares search_providers_v2 but not utility_tools_v1 (0.14.0, 0.14.1) keeps web_extract and never
+     * sees a utility name.
+     */
+    private readonly utilityToolsSockets;
+    /**
+     * The (search, utility) tuple the files were last recomputed for; null until the first socket observation, so that
+     * observation always recomputes (final review I-1), even when it is non-capable. One trigger keyed on BOTH values.
      */
-    private searchProvidersState;
+    private capabilityState;
     private searchCapabilityRefetchTimer;
     /** When the current burst's first change happened (valid while the timer is set). */
     private searchCapabilityBurstStart;
     /** The D28 value in the last report posted (null until one is); a change needs a refetch to reach the web. */
     private lastReportedSearchProviders;
+    /** U6: the utility_tools_v1 value in the last report posted (null until one is). */
+    private lastReportedUtilityTools;
     noteSearchProvidersSocket(token: object, declared: boolean): void;
     clearSearchProvidersSocket(token: object): void;
+    noteUtilityToolsSocket(token: object, declared: boolean): void;
+    clearUtilityToolsSocket(token: object): void;
+    /** U6: every attached runtime socket declared utility_tools_v1; no socket attached means absent (false). */
+    utilityToolsCapable(): boolean;
+    /** U6: the features every attached runtime socket declared, for the policy functions. */
+    capabilityFeatures(): FeatureSet;
     /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
     searchProvidersCapable(): boolean;
     /**
@@ -3529,7 +3575,7 @@ export declare class BridgeAgent {
      * D35 (P-4): on a capability change, rewrite manifest-policy.json at once from the stored manifest, the kill
      * switches and the new capability, then a debounced refetch (one per burst) only when needed.
      */
-    private onSearchProvidersMaybeChanged;
+    private onCapabilityMaybeChanged;
     /**
      * A refetch re-renders skills.json (owner_dm_search_cap counts web_extract only with the capability, D39) and posts
      * the report. Needed under a manifest in force, or when the reported value is stale. Never before the boot fetch.

package/dist/consumer-grants.d.ts

@@ -26,6 +26,8 @@ export declare function withConsumerGrants(m: BridgeMessage, perToolConsumer: bo
 export declare const MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
 /** The /v1/ws hello feature of a runtime that supports the five signed search providers and web_extract (spec D3, D28). Pinned to the runtime's by capability-parity.test.ts. */
 export declare const SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
+/** Weather/currency spec §8.1 (U6): the /v1/ws hello feature of a runtime that knows weather_forecast and currency_convert. Pinned to the runtime's by capability-parity.test.ts. */
+export declare const UTILITY_TOOLS_FEATURE = "utility_tools_v1";
 export declare const CONSTANT_TOOL_NAMES: Readonly<Record<"owner_dm" | "team_room", readonly string[]>>;
 /**
  * Spec §7.9: a consumer that did not declare manifest_grants_v1 (runtime 0.12.2, a harness,
@@ -55,3 +57,10 @@ export declare function withHarnessGrants(m: BridgeMessage, withheld: boolean):
  * Every other grant and field is unchanged. Returns `m` by reference when nothing is dropped; never mutates `m`.
  */
 export declare function withSearchCapability(m: BridgeMessage, consumerHasFeature: boolean, signedProvider: SearchProvider | undefined): BridgeMessage;
+/**
+ * Weather/currency spec §8.1 U6 item 3: the per-delivery utility filter, on every delivery path, judged by the
+ * consumer's OWN hello. A consumer that did not declare utility_tools_v1 (0.14.x and older runtimes, a harness, every
+ * HTTP path) never receives weather_forecast or currency_convert, marked or unmarked. Defence in depth beside the
+ * policy file and TOOL_FEATURE. Returns `m` by reference when nothing drops; never mutates `m`.
+ */
+export declare function withUtilityCapability(m: BridgeMessage, consumerHasFeature: boolean): BridgeMessage;

package/dist/errors.d.ts

@@ -6,7 +6,7 @@
  * WebSocket returns `{type:"error", error, message, detail?}`. A client gets the
  * same `error` code regardless of which transport it used. (A2A §9.5/§10.6 pattern.)
  */
-export type BridgeErrorCode = "unauthorized" | "forbidden_origin" | "not_found" | "invalid_request" | "invalid_json" | "body_too_large" | "channel_pending" | "rate_limited" | "agent_paused" | "send_forbidden" | "group_superseded" | "unknown_action_run" | "vault_integrity_failed" | "vault_ref_changed" | "session_superseded" | "internal";
+export type BridgeErrorCode = "unauthorized" | "forbidden_origin" | "not_found" | "invalid_request" | "invalid_json" | "body_too_large" | "channel_pending" | "rate_limited" | "agent_paused" | "send_forbidden" | "group_superseded" | "unknown_action_run" | "vault_integrity_failed" | "vault_ref_changed" | "session_superseded" | "reply_credit_unknown" | "path_outside_outbox" | "internal";
 export interface BridgeErrorSpec {
     /** HTTP status this code maps to (the WS binding ignores it). */
     http: number;

package/dist/grants/binding.d.ts

@@ -64,8 +64,21 @@ export declare function legacyAssignToken(d: {
     fact_hash: string;
     channel_id: string;
 }): string;
-/** The manifest's signed tools for one audience, inside the code ceiling; web_extract only with the capability (D19 item 1, D28). */
-export declare function signedManifestTools(manifest: ToolGrantManifest, audience: "owner_dm" | "team_room", searchProvidersCapable: boolean): string[];
+/**
+ * Weather/currency spec §8.1 (U6, H-1): a runtime hello feature that a manifest tool needs. An older runtime reads an
+ * unknown name in manifest-policy.json as an unreadable file and drops EVERY manifest grant, so a tool listed here is
+ * written to the policy file (and delivered) only when every attached runtime socket declared its feature.
+ */
+export type Feature = "search_providers_v2" | "utility_tools_v1";
+export type FeatureSet = ReadonlySet<Feature>;
+/** No socket attached, or none declared anything: fail closed. */
+export declare const NO_FEATURES: FeatureSet;
+/** The tool to feature table. A tool absent from it needs no feature. */
+export declare const TOOL_FEATURE: Readonly<Record<string, Feature>>;
+/** True when `tool` needs no feature, or its feature is in `features`. */
+export declare function toolAllowedByFeatures(tool: string, features: FeatureSet): boolean;
+/** The manifest's signed tools for one audience, inside the code ceiling; a TOOL_FEATURE tool only with its feature (D19 item 1, D28, U6). */
+export declare function signedManifestTools(manifest: ToolGrantManifest, audience: "owner_dm" | "team_room", features: FeatureSet): string[];
 /**
  * manifest-policy.json from the stored manifest, the kill switches and the capability alone (D35): the bridge
  * recomputes it locally on a capability change, without a refetch or a cached BindResult. An audience switched off
@@ -74,13 +87,13 @@ export declare function signedManifestTools(manifest: ToolGrantManifest, audienc
 export declare function manifestPolicyFor(manifest: ToolGrantManifest, switches: {
     readonly ownerDm: boolean;
     readonly room: boolean;
-}, searchProvidersCapable: boolean): ManifestPolicyDoc;
+}, features: FeatureSet): ManifestPolicyDoc;
 export declare function bindRuntimeConfig(manifest: ToolGrantManifest, payload: BindPayload, prior: BindPrior, 
 /** Review H-1: the two manifest kill switches; an audience switched off contributes no tool to the policy file. */
 switches?: {
     readonly ownerDm: boolean;
     readonly room: boolean;
 }, 
-/** D19 item 1, D28: every attached runtime socket declared search_providers_v2. Default false = fail closed:
+/** D19 item 1, D28, U6: the features every attached runtime socket declared. Default empty = fail closed:
  *  an older runtime reads an unknown tool in manifest-policy.json as an unreadable file and drops every grant. */
-searchProvidersCapable?: boolean): BindResult;
+features?: FeatureSet): BindResult;

package/dist/http-server.d.ts

@@ -58,47 +58,21 @@ export declare function capabilities(opts: {
     webhook_push: boolean;
     vault_ref: number;
 };
-export declare const memoryRecordSchema: z.ZodEffects<z.ZodObject<{
+export declare const memoryRecordSchema: z.ZodObject<{
     conversation_id: z.ZodString;
-    role: z.ZodEnum<["peer", "agent"]>;
+    role: z.ZodEnum<{
+        agent: "agent";
+        peer: "peer";
+    }>;
     peer_id: z.ZodOptional<z.ZodString>;
     text: z.ZodString;
-    modality: z.ZodEnum<["text", "voice"]>;
+    modality: z.ZodEnum<{
+        text: "text";
+        voice: "voice";
+    }>;
     message_id: z.ZodOptional<z.ZodString>;
     idempotency_key: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    text: string;
-    role: "agent" | "peer";
-    conversation_id: string;
-    modality: "text" | "voice";
-    message_id?: string | undefined;
-    idempotency_key?: string | undefined;
-    peer_id?: string | undefined;
-}, {
-    text: string;
-    role: "agent" | "peer";
-    conversation_id: string;
-    modality: "text" | "voice";
-    message_id?: string | undefined;
-    idempotency_key?: string | undefined;
-    peer_id?: string | undefined;
-}>, {
-    text: string;
-    role: "agent" | "peer";
-    conversation_id: string;
-    modality: "text" | "voice";
-    message_id?: string | undefined;
-    idempotency_key?: string | undefined;
-    peer_id?: string | undefined;
-}, {
-    text: string;
-    role: "agent" | "peer";
-    conversation_id: string;
-    modality: "text" | "voice";
-    message_id?: string | undefined;
-    idempotency_key?: string | undefined;
-    peer_id?: string | undefined;
-}>;
+}, z.core.$strip>;
 export declare function createHttpServer(agent: BridgeAgent, opts: HttpServerOptions): {
     server: Server;
     closeAllSseStreams: () => void;