@securecoms/agent-bridge 0.34.0 → 0.35.0

package/dist/bridge-agent.d.ts

@@ -507,6 +507,13 @@ export interface BridgeAgentDeps {
      * tests to avoid real file IO / assert pin persistence directly.
      */
     vaultOwnerStore?: OwnerAuthorityStore;
+    /**
+     * Security fix 2026-10-30 (option A): the ONLY directory `/v1/vault-write`
+     * and `/v1/send-attachment` read from. Defaults to
+     * `join(dirname(cfg.storePath), "vault-outbox")`, or null (every upload
+     * refused) for an in-memory store. Override in tests.
+     */
+    vaultOutboxDir?: string | null;
 }
 /**
  * Voice repeats (a), owner report 2026-10-02: one spoken question reached the
@@ -1520,6 +1527,9 @@ export declare class BridgeAgent {
     private readonly uploadBlobImpl;
     /** Track 5: directory where received attachments are saved. */
     private readonly attachmentsDirImpl;
+    private readonly vaultOutboxDirImpl;
+    /** Audit 2026-10-30 HIGH 2: the outbox pinned at start(); null = every upload refused. */
+    private outboxPin;
     /** B7: persistence for the vault kekset's owner-pin TOFU state. */
     private readonly vaultOwnerStoreImpl;
     /** B7: last-seen kekset generation per enclave, enforced monotonic across
@@ -2334,12 +2344,17 @@ export declare class BridgeAgent {
      * checks, so the HTTP boundary maps ALL vault trust failures to one code.
      */
     private getVaultSession;
-    /** Read `path` off local disk, encrypt + wrap its DEK under the vault's
+    /** Read `path` from the vault outbox (security fix 2026-10-30; see
+     *  ./outbox.ts), encrypt + wrap its DEK under the vault's
      *  current KEK generation, and create+upload+commit it as a new vault
      *  file node named `name` (which may differ from `path`'s basename). */
     vaultWrite(enclaveId: string, vaultChannelId: string | null | undefined, path: string, name: string): Promise<{
         node_id: string;
     }>;
+    /** Audit 2026-10-30 MED 5: an uploaded file leaves the outbox (no plaintext lingers). Content-free log. */
+    private consumeUploaded;
+    /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
+    vaultOutboxPath(): string | null;
     /** Download + verify + decrypt a vault file node. Returns the plaintext
      *  base64-encoded (the loopback boundary is JSON-only, mirroring how
      *  useVault.downloadFile returns `{name, bytes}` in-memory — here the

package/dist/errors.d.ts

@@ -6,7 +6,7 @@
  * WebSocket returns `{type:"error", error, message, detail?}`. A client gets the
  * same `error` code regardless of which transport it used. (A2A §9.5/§10.6 pattern.)
  */
-export type BridgeErrorCode = "unauthorized" | "forbidden_origin" | "not_found" | "invalid_request" | "invalid_json" | "body_too_large" | "channel_pending" | "rate_limited" | "agent_paused" | "send_forbidden" | "group_superseded" | "unknown_action_run" | "vault_integrity_failed" | "vault_ref_changed" | "session_superseded" | "reply_credit_unknown" | "internal";
+export type BridgeErrorCode = "unauthorized" | "forbidden_origin" | "not_found" | "invalid_request" | "invalid_json" | "body_too_large" | "channel_pending" | "rate_limited" | "agent_paused" | "send_forbidden" | "group_superseded" | "unknown_action_run" | "vault_integrity_failed" | "vault_ref_changed" | "session_superseded" | "reply_credit_unknown" | "path_outside_outbox" | "internal";
 export interface BridgeErrorSpec {
     /** HTTP status this code maps to (the WS binding ignores it). */
     http: number;