@securecoms/agent-bridge 0.34.0 → 0.35.0

package/dist/index.js

@@ -24728,8 +24728,8 @@ function openDeliveryPings(o) {
             return Promise.resolve({ value: void 0, done: true });
           if (queue.length)
             return Promise.resolve({ value: queue.shift(), done: false });
-          return new Promise((resolve) => {
-            waiter = resolve;
+          return new Promise((resolve2) => {
+            waiter = resolve2;
           });
         }
       };
@@ -25049,8 +25049,8 @@ var PingSubscriber = class {
             return Promise.resolve({ value: void 0, done: true });
           if (this.queue.length)
             return Promise.resolve({ value: this.queue.shift(), done: false });
-          return new Promise((resolve) => {
-            this.waiter = resolve;
+          return new Promise((resolve2) => {
+            this.waiter = resolve2;
           });
         }
       };
@@ -29706,8 +29706,96 @@ function loadPackageMeta(importMetaUrl) {
 }
 
 // src/bridge-agent.ts
-import { existsSync as existsSync5, promises as fsp, readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
-import { join as join17, dirname as dirname5 } from "node:path";
+import { existsSync as existsSync5, promises as fsp2, readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
+
+// src/outbox.ts
+import { constants, mkdirSync, lstatSync, chmodSync, realpathSync, promises as fsp } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+var VAULT_OUTBOX_DIRNAME = "vault-outbox";
+var PathOutsideOutboxError = class extends Error {
+  constructor() {
+    super("path_outside_outbox");
+    this.name = "PathOutsideOutboxError";
+  }
+};
+var POSIX = process.platform !== "win32";
+function ownedPrivateDir(st) {
+  if (st.isSymbolicLink() || !st.isDirectory()) return false;
+  if (!POSIX) return true;
+  const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
+  if (uid !== void 0 && st.uid !== uid) return false;
+  return (st.mode & 511) === 448;
+}
+function ensureOutbox(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  let st = lstatSync(dir);
+  if (st.isSymbolicLink() || !st.isDirectory()) throw new PathOutsideOutboxError();
+  const uid = POSIX && typeof process.getuid === "function" ? process.getuid() : void 0;
+  if (uid !== void 0 && st.uid !== uid) throw new PathOutsideOutboxError();
+  if (POSIX && (st.mode & 511) !== 448) {
+    chmodSync(dir, 448);
+    st = lstatSync(dir);
+  }
+  if (!ownedPrivateDir(st)) throw new PathOutsideOutboxError();
+  return { dir, real: realpathSync(dir), dev: st.dev, ino: st.ino };
+}
+var NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+var NONBLOCK = constants.O_NONBLOCK ?? 0;
+async function readOutboxFile(pin, callerPath) {
+  if (!pin) throw new PathOutsideOutboxError();
+  try {
+    const st = await fsp.lstat(pin.dir);
+    if (!ownedPrivateDir(st) || st.dev !== pin.dev || st.ino !== pin.ino) throw new PathOutsideOutboxError();
+  } catch {
+    throw new PathOutsideOutboxError();
+  }
+  const requested = resolve(pin.dir, callerPath);
+  const name = basename(requested);
+  let realParent;
+  try {
+    realParent = await fsp.realpath(dirname(requested));
+  } catch {
+    throw new PathOutsideOutboxError();
+  }
+  if (realParent !== pin.real) throw new PathOutsideOutboxError();
+  const target = join(pin.real, name);
+  const pre = await fsp.lstat(target);
+  if (pre.isSymbolicLink() || !pre.isFile()) throw new PathOutsideOutboxError();
+  let handle;
+  try {
+    handle = await fsp.open(target, constants.O_RDONLY | NOFOLLOW | NONBLOCK);
+  } catch (e) {
+    if (e.code === "ENOENT") throw e;
+    throw new PathOutsideOutboxError();
+  }
+  try {
+    const st = await handle.stat();
+    if (!st.isFile() || st.dev !== pre.dev || st.ino !== pre.ino || st.nlink !== 1) {
+      throw new PathOutsideOutboxError();
+    }
+    return { bytes: new Uint8Array(await handle.readFile()), path: target, dev: st.dev, ino: st.ino };
+  } finally {
+    await handle.close().catch(() => {
+    });
+  }
+}
+async function consumeOutboxFile(pin, read) {
+  try {
+    const dir = await fsp.lstat(pin.dir);
+    if (!ownedPrivateDir(dir) || dir.dev !== pin.dev || dir.ino !== pin.ino) return false;
+    if (await fsp.realpath(pin.dir) !== pin.real) return false;
+    const target = join(pin.real, basename(read.path));
+    const st = await fsp.lstat(target);
+    if (st.isSymbolicLink() || st.dev !== read.dev || st.ino !== read.ino) return false;
+    await fsp.unlink(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/bridge-agent.ts
+import { join as join18, dirname as dirname6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/latency.ts
@@ -30205,11 +30293,21 @@ function pinCoverage(pinStripped, ownerMessage, coverTexts) {
 }
 
 // src/attachments.ts
-import { basename } from "node:path";
+import { basename as basename2 } from "node:path";
 var VAULT_REF_MAX_SIZE_HINT = 100 * 1024 * 1024 - 16;
 var VAULT_REF_MAX_NAME = 255;
 var VAULT_REF_MAX_MIME = 127;
 var CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var InvalidBlobIdError = class extends Error {
+  constructor() {
+    super("invalid_blob_id");
+    this.name = "InvalidBlobIdError";
+  }
+};
+function assertBlobId(blobId) {
+  if (typeof blobId !== "string" || !CANONICAL_UUID.test(blobId)) throw new InvalidBlobIdError();
+  return blobId;
+}
 var VAULT_PIN = /^blake2b:[0-9a-f]{64}$/;
 var HINT_FORBIDDEN = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/;
 var MIME_TYPE = /^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*$/;
@@ -30248,7 +30346,7 @@ function toVaultRefEntry(body) {
   return entry;
 }
 function sanitizeFilename(name, fallback) {
-  const base = basename(name ?? "");
+  const base = basename2(name ?? "");
   const cleaned = base.replace(/[/\\]/g, "").replace(/^\.+$/, "");
   return cleaned.length > 0 ? cleaned : fallback;
 }
@@ -30278,7 +30376,7 @@ function mimeForName(name) {
 async function prepareAttachment(filePath2, caption, channelId, deps) {
   await deps.ready();
   const bytes = await deps.readFile(filePath2);
-  const name = basename(filePath2);
+  const name = basename2(filePath2);
   const { encryptedData, fileKey, fileNonce, digest } = await deps.encryptFile(bytes);
   const blobId = await deps.uploadBlob(encryptedData, channelId);
   const body = {
@@ -30296,8 +30394,9 @@ async function prepareAttachment(filePath2, caption, channelId, deps) {
   return body;
 }
 async function materializeAttachment(body, ctx, deps) {
+  const blobId = assertBlobId(body.blobId);
   await deps.ready();
-  const ciphertext = await deps.downloadBlob(body.blobId);
+  const ciphertext = await deps.downloadBlob(blobId);
   const sha25612 = await deps.computeFileDigest(ciphertext);
   if (sha25612 !== body.digest) {
     throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
@@ -30323,13 +30422,13 @@ function ensureSodiumReady2() {
 // src/memory/hermes-session-map.ts
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 function expandHome(p) {
-  return p === "~" || p.startsWith("~/") ? join(homedir(), p.slice(1)) : p;
+  return p === "~" || p.startsWith("~/") ? join2(homedir(), p.slice(1)) : p;
 }
 function resolveHermesSession(baseDir, conversationId) {
   try {
-    const path = join(expandHome(baseDir), "sessions", "sessions.json");
+    const path = join2(expandHome(baseDir), "sessions", "sessions.json");
     const map = JSON.parse(readFileSync(path, "utf8"));
     const entry = map[`agent:main:securecoms:dm:${conversationId}`];
     const sid = entry?.session_id;
@@ -30341,11 +30440,11 @@ function resolveHermesSession(baseDir, conversationId) {
 
 // src/memory/hermes-store.ts
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 var HermesStore = class {
   dbPath;
   constructor(baseDir) {
-    this.dbPath = join2(expandHome(baseDir), "state.db");
+    this.dbPath = join3(expandHome(baseDir), "state.db");
   }
   /** Recent-K conversational turns for a session, chronological. Fail-safe → []. */
   readRecent(sessionId, limit) {
@@ -30487,10 +30586,10 @@ var HermesMemoryProvider = class {
 
 // src/memory/openclaw-session-map.ts
 import { readFileSync as readFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 function resolveOwnerDmSession(baseDir, agent) {
   try {
-    const path = join3(expandHome(baseDir), "agents", agent, "sessions", "sessions.json");
+    const path = join4(expandHome(baseDir), "agents", agent, "sessions", "sessions.json");
     const map = JSON.parse(readFileSync2(path, "utf8"));
     let best = null;
     for (const [key, entry] of Object.entries(map)) {
@@ -30508,11 +30607,11 @@ function resolveOwnerDmSession(baseDir, agent) {
 
 // src/memory/openclaw-session-log.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 function readRecentTurns(baseDir, agent, sessionId, k) {
   let raw;
   try {
-    raw = readFileSync3(join4(expandHome(baseDir), "agents", agent, "sessions", `${sessionId}.jsonl`), "utf8");
+    raw = readFileSync3(join5(expandHome(baseDir), "agents", agent, "sessions", `${sessionId}.jsonl`), "utf8");
   } catch {
     return [];
   }
@@ -30543,7 +30642,7 @@ function readRecentTurns(baseDir, agent, sessionId, k) {
 
 // src/memory/openclaw-workspace-facts.ts
 import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var DEFAULT_FACTS_BUDGET = 8e3;
 var MEMORY_MD_CAP = 6e3;
 var MIN_FRAGMENT = 200;
@@ -30554,7 +30653,7 @@ function resolveWorkspaceDir(baseDir, agent, override) {
   const base = expandHome(baseDir);
   const isMain = agent === "" || agent === "main";
   try {
-    const cfg = JSON.parse(readFileSync4(join5(base, "openclaw.json"), "utf8"));
+    const cfg = JSON.parse(readFileSync4(join6(base, "openclaw.json"), "utf8"));
     const agents = cfg?.agents;
     if (agents && typeof agents === "object") {
       const list = Array.isArray(agents.list) ? agents.list : [];
@@ -30567,7 +30666,7 @@ function resolveWorkspaceDir(baseDir, agent, override) {
     }
   } catch {
   }
-  return isMain ? join5(base, "workspace") : join5(base, `workspace-${agent}`);
+  return isMain ? join6(base, "workspace") : join6(base, `workspace-${agent}`);
 }
 var TRUNC = "\u2026[truncated]";
 function headSlice(s, n) {
@@ -30597,7 +30696,7 @@ function readWorkspaceFacts(baseDir, agent, opts) {
   let truncated = false;
   let remaining = budget;
   try {
-    const r = readBounded(join5(dir, "MEMORY.md"));
+    const r = readBounded(join6(dir, "MEMORY.md"));
     if (r.oversize) truncated = true;
     else if (r.text && r.text.trim()) {
       const { text, clipped } = headSlice(r.text, Math.min(MEMORY_MD_CAP, budget));
@@ -30610,7 +30709,7 @@ ${TRUNC}` : ""}`);
   } catch {
   }
   try {
-    const dailies = readdirSync(join5(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
+    const dailies = readdirSync(join6(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
     for (const f of dailies) {
       if (remaining < MIN_FRAGMENT) {
         truncated = true;
@@ -30618,7 +30717,7 @@ ${TRUNC}` : ""}`);
       }
       let r;
       try {
-        r = readBounded(join5(dir, "memory", f));
+        r = readBounded(join6(dir, "memory", f));
       } catch {
         continue;
       }
@@ -31357,21 +31456,21 @@ function parsePayloadMemory(raw) {
 
 // src/memory/embedder/client.ts
 import { connect } from "node:net";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync7, rmSync as rmSync6, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync6, statSync as statSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 // src/memory/embedder/download.ts
 import { createHash as createHash2, randomBytes as randomBytes6 } from "node:crypto";
-import { chmodSync as chmodSync2, rmSync as rmSync2 } from "node:fs";
+import { chmodSync as chmodSync3, rmSync as rmSync2 } from "node:fs";
 import { open } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 
 // src/memory/embedder/layout.ts
-import { chmodSync, lstatSync, mkdirSync, renameSync, rmSync } from "node:fs";
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync2, renameSync, rmSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, dirname, join as join6 } from "node:path";
-var defaultModelsRoot = (home = homedir2()) => join6(home, ".securecoms", "models", "embeddings");
-var filePath = (root3, modelId, f) => join6(root3, modelId, f.sha256, f.name);
+import { basename as basename3, dirname as dirname2, join as join7 } from "node:path";
+var defaultModelsRoot = (home = homedir2()) => join7(home, ".securecoms", "models", "embeddings");
+var filePath = (root3, modelId, f) => join7(root3, modelId, f.sha256, f.name);
 var LayoutRefused = class extends Error {
   constructor() {
     super("the model directory is not a plain directory");
@@ -31379,32 +31478,32 @@ var LayoutRefused = class extends Error {
 };
 function kind(p) {
   try {
-    return lstatSync(p).isDirectory() ? "dir" : "other";
+    return lstatSync2(p).isDirectory() ? "dir" : "other";
   } catch (e) {
     if (e.code === "ENOENT") return "absent";
     throw e;
   }
 }
 function plainDirChain(root3, parts, opts) {
-  const modelsDir = dirname(root3);
+  const modelsDir = dirname2(root3);
   for (const part of parts) if (!part || part === "." || part === ".." || part.includes("/") || part.includes("\\")) throw new LayoutRefused();
   const k = kind(modelsDir);
   if (k === "other") throw new LayoutRefused();
   if (k === "absent") {
     if (!opts.create) return null;
-    mkdirSync(modelsDir, { recursive: true, mode: 448 });
+    mkdirSync2(modelsDir, { recursive: true, mode: 448 });
     if (kind(modelsDir) !== "dir") throw new LayoutRefused();
   }
-  const chain = opts.fromModelsDir ? parts : [basename2(root3), ...parts];
+  const chain = opts.fromModelsDir ? parts : [basename3(root3), ...parts];
   let p = modelsDir;
   for (let i = 0; i < chain.length; i++) {
-    p = join6(p, chain[i]);
+    p = join7(p, chain[i]);
     const c = kind(p);
     if (c === "other") throw new LayoutRefused();
     if (c === "absent") {
       if (!opts.create) return null;
       try {
-        mkdirSync(p, { mode: i === chain.length - 1 && opts.mode !== void 0 ? opts.mode : 493 });
+        mkdirSync2(p, { mode: i === chain.length - 1 && opts.mode !== void 0 ? opts.mode : 493 });
       } catch (e) {
         if (e.code !== "EEXIST") throw e;
       }
@@ -31415,7 +31514,7 @@ function plainDirChain(root3, parts, opts) {
 }
 function presentWithSize(p, size) {
   try {
-    const s = lstatSync(p);
+    const s = lstatSync2(p);
     return s.isFile() && s.size === size;
   } catch {
     return false;
@@ -31423,7 +31522,7 @@ function presentWithSize(p, size) {
 }
 function wrongTypeAt(p) {
   try {
-    const s = lstatSync(p);
+    const s = lstatSync2(p);
     return !s.isFile() && !s.isSymbolicLink();
   } catch {
     return false;
@@ -31436,16 +31535,16 @@ function installVerified(root3, modelId, f, partial, opts) {
     dir = plainDirChain(root3, [modelId, f.sha256], { create: true });
     if (!dir) throw new LayoutRefused();
     if (!opts.replace && presentWithSize(dest, f.size)) return;
-    chmodSync(dir, 493);
+    chmodSync2(dir, 493);
     try {
       renameSync(partial, dest);
     } catch (e) {
       if (!presentWithSize(dest, f.size)) throw e;
       return;
     }
-    chmodSync(dest, 292);
+    chmodSync2(dest, 292);
   } finally {
-    if (dir) chmodSync(dir, 365);
+    if (dir) chmodSync2(dir, 365);
     rmSync(partial, { force: true });
   }
 }
@@ -31465,8 +31564,8 @@ function removeModelFiles(root3, m) {
   for (const f of m.files) {
     const dir = plainDirChain(root3, [m.modelId, f.sha256], { create: false });
     if (!dir) continue;
-    chmodSync2(dir, 493);
-    rmSync2(join7(dir, f.name), { force: true });
+    chmodSync3(dir, 493);
+    rmSync2(join8(dir, f.name), { force: true });
   }
 }
 var VerifyFailed = class extends Error {
@@ -31513,7 +31612,7 @@ async function fetchSameOrigin(url, origin, fetchImpl, signal, stallMs, abort) {
 async function downloadOne(f, o) {
   if (wrongTypeAt(filePath(o.root, o.modelId, f))) throw new WrongType("wrong type at model path");
   const pdir = plainDirChain(o.root, [".partial"], { create: true, fromModelsDir: true, mode: 448 });
-  const partial = join7(pdir, randomBytes6(12).toString("hex"));
+  const partial = join8(pdir, randomBytes6(12).toString("hex"));
   const fh = await open(partial, "wx", 384);
   const ac = new AbortController();
   const abort = () => ac.abort();
@@ -31589,17 +31688,17 @@ async function ensureModelFiles(o) {
 }
 
 // src/memory/embedder/gc.ts
-import { chmodSync as chmodSync3, closeSync, constants, fstatSync, futimesSync, lstatSync as lstatSync2, openSync, readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
-import { join as join8 } from "node:path";
+import { chmodSync as chmodSync4, closeSync, constants as constants2, fstatSync, futimesSync, lstatSync as lstatSync3, openSync, readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
+import { join as join9 } from "node:path";
 var THIRTY_DAYS = 30 * 864e5;
 var SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
 function touchUserMarker(root3, modelId, identityId) {
   if (!SAFE_ID.test(identityId)) throw new Error("invalid identity id for the model marker");
   const dir = plainDirChain(root3, [modelId, ".users"], { create: true });
-  const p = join8(dir, identityId);
+  const p = join9(dir, identityId);
   let fd;
   try {
-    fd = openSync(p, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK, 420);
+    fd = openSync(p, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_NOFOLLOW | constants2.O_NONBLOCK, 420);
   } catch {
     throw new Error("the model marker is not a regular file");
   }
@@ -31613,22 +31712,22 @@ function touchUserMarker(root3, modelId, identityId) {
 }
 function isRealDir(p) {
   try {
-    return lstatSync2(p).isDirectory();
+    return lstatSync3(p).isDirectory();
   } catch {
     return false;
   }
 }
 function makeWritable(p) {
   if (!isRealDir(p)) return;
-  chmodSync3(p, 493);
-  for (const e of readdirSync2(p)) makeWritable(join8(p, e));
+  chmodSync4(p, 493);
+  for (const e of readdirSync2(p)) makeWritable(join9(p, e));
 }
 function newestMarkerMs(users) {
   if (!isRealDir(users)) return void 0;
   let newest;
   for (const u of readdirSync2(users)) {
     try {
-      const s = lstatSync2(join8(users, u));
+      const s = lstatSync3(join9(users, u));
       if (!s.isFile()) continue;
       newest = newest === void 0 ? s.mtimeMs : Math.max(newest, s.mtimeMs);
     } catch {
@@ -31641,9 +31740,9 @@ function gcModels(root3, keepModelIds, now, maxAgeMs = THIRTY_DAYS) {
   const removed = [];
   for (const modelId of readdirSync2(root3).sort()) {
     if (modelId.startsWith(".") || keepModelIds.includes(modelId)) continue;
-    const tree = join8(root3, modelId);
+    const tree = join9(root3, modelId);
     if (!isRealDir(tree)) continue;
-    const lastUse = newestMarkerMs(join8(tree, ".users")) ?? lstatSync2(tree).mtimeMs;
+    const lastUse = newestMarkerMs(join9(tree, ".users")) ?? lstatSync3(tree).mtimeMs;
     if (now - lastUse <= maxAgeMs) continue;
     makeWritable(tree);
     rmSync3(tree, { recursive: true, force: true });
@@ -31776,44 +31875,44 @@ var SealedChannel = class {
 // src/memory/embedder/embedder-paths.ts
 import { createHash as createHash3 } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function embedderKey(m) {
   const model = m.files.find((f) => f.name === "model.onnx");
   return createHash3("sha256").update(`${EMBEDDER_PROTOCOL}\0${m.modelId}\0${model.sha256}\0${m.wasmSha256}`).digest("hex").slice(0, 16);
 }
-var embedderRunDir = (home = homedir3()) => join9(home, ".securecoms", "run", "embedder");
+var embedderRunDir = (home = homedir3()) => join10(home, ".securecoms", "run", "embedder");
 var embedderPaths = (dir, key) => ({
-  sock: join9(dir, `${key}.sock`),
-  token: join9(dir, `${key}.token`),
-  lock: join9(dir, `${key}.spawn.lock`),
-  status: join9(dir, `${key}.status`),
-  pid: join9(dir, `${key}.pid`)
+  sock: join10(dir, `${key}.sock`),
+  token: join10(dir, `${key}.token`),
+  lock: join10(dir, `${key}.spawn.lock`),
+  status: join10(dir, `${key}.status`),
+  pid: join10(dir, `${key}.pid`)
   // E1 delta H1: the instance's lifetime lock
 });
 var SOCKET_PATH_MAX = 103;
 var windowsRunDir = (env = process.env) => {
   if (!env.LOCALAPPDATA) throw new Error("LOCALAPPDATA unset");
-  return join9(env.LOCALAPPDATA, "SecureComs", "run", "embedder");
+  return join10(env.LOCALAPPDATA, "SecureComs", "run", "embedder");
 };
 
 // src/memory/embedder/spawn.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, realpathSync } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync4, realpathSync as realpathSync2 } from "node:fs";
 
 // src/memory/embedder/run-dir.ts
-import { existsSync, lstatSync as lstatSync3, mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { existsSync, lstatSync as lstatSync4, mkdirSync as mkdirSync3 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
 var RunDirRefused = class extends Error {
 };
-function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync3) {
-  const parent3 = dirname2(dir);
-  if (!existsSync(parent3)) mkdirSync2(parent3, { recursive: true, mode: 448 });
+function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync4) {
+  const parent3 = dirname3(dir);
+  if (!existsSync(parent3)) mkdirSync3(parent3, { recursive: true, mode: 448 });
   const ps = lstat(parent3);
   if (ps.isSymbolicLink() || !ps.isDirectory()) throw new RunDirRefused("run directory parent is not a real directory");
   if (ps.uid !== uid) throw new RunDirRefused("run directory parent is not owned by this user");
   if ((ps.mode & 18) !== 0) throw new RunDirRefused("run directory parent is group or world writable");
   try {
-    mkdirSync2(dir, { mode: 448 });
+    mkdirSync3(dir, { mode: 448 });
   } catch (e) {
     if (e.code !== "EEXIST") throw e;
   }
@@ -31824,10 +31923,10 @@ function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync3) {
 }
 
 // src/memory/embedder/spawn.ts
-import { basename as basename3, dirname as dirname3, join as join10 } from "node:path";
+import { basename as basename4, dirname as dirname4, join as join11 } from "node:path";
 
 // src/memory/embedder/locks.ts
-import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, linkSync, openSync as openSync2, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync4, writeSync } from "node:fs";
+import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, linkSync, openSync as openSync2, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync4, writeSync } from "node:fs";
 import { randomBytes as randomBytes9 } from "node:crypto";
 import { uptime } from "node:os";
 var LOCK_STALE_MS = 1e4;
@@ -31849,7 +31948,7 @@ var PROCESS_LOCK_ENV = {
 function inspect(path) {
   let fd;
   try {
-    fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    fd = openSync2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
   } catch {
     return null;
   }
@@ -31873,7 +31972,7 @@ function takeLock(path, now = Date.now, env = PROCESS_LOCK_ENV) {
   const id = `${env.pid} ${env.bootTime()} ${env.startTime()} ${randomBytes9(8).toString("hex")}`;
   for (let attempt = 0; attempt < 3; attempt++) {
     try {
-      const fd = openSync2(path, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+      const fd = openSync2(path, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
       try {
         writeSync(fd, id);
       } finally {
@@ -31934,7 +32033,7 @@ function embedderEnv(env = process.env, platform = process.platform) {
 }
 var withReal = (p) => {
   try {
-    const r = realpathSync(p);
+    const r = realpathSync2(p);
     return r === p ? [p] : [p, r];
   } catch {
     return [p];
@@ -31942,10 +32041,10 @@ var withReal = (p) => {
 };
 var realish = (p) => {
   try {
-    return realpathSync(p);
+    return realpathSync2(p);
   } catch {
-    const up = dirname3(p);
-    return up === p ? p : join10(realish(up), basename3(p));
+    const up = dirname4(p);
+    return up === p ? p : join11(realish(up), basename4(p));
   }
 };
 var both = (p) => {
@@ -31957,7 +32056,7 @@ function spawnEmbedder(o) {
   const run = o.runDir ?? embedderRunDir(o.home);
   const win = (o.platform ?? process.platform) === "win32";
   if (o.createRunDir !== false) {
-    if (win) mkdirSync3(run, { recursive: true, mode: 448 });
+    if (win) mkdirSync4(run, { recursive: true, mode: 448 });
     else ensureRunDir(run);
   }
   const perm = permissionFlags();
@@ -31966,13 +32065,13 @@ function spawnEmbedder(o) {
     o.onNoPermissionModel?.();
   }
   const reads = perm.length === 0 ? [] : [
-    ...withReal(dirname3(o.distDir)),
+    ...withReal(dirname4(o.distDir)),
     ...existsSync2(defaultModelsRoot(o.home)) ? withReal(defaultModelsRoot(o.home)) : [defaultModelsRoot(o.home)],
-    ...both(dirname3(run)),
-    ...win ? both(join10(o.home, ".securecoms", "run")) : []
+    ...both(dirname4(run)),
+    ...win ? both(join11(o.home, ".securecoms", "run")) : []
     // the voice-call heartbeats (the run dir lives elsewhere)
   ];
-  const script = withReal(join10(o.distDir, "embedder.js")).at(-1);
+  const script = withReal(join11(o.distDir, "embedder.js")).at(-1);
   const net = (o.nodeFlags ?? process.allowedNodeEnvironmentFlags).has("--allow-net") ? ["--allow-net"] : [];
   const flags = perm.length === 0 ? [] : [...perm, ...reads.map((r) => `--allow-fs-read=${r}`), ...both(run).map((w) => `--allow-fs-write=${w}`), "--allow-worker", ...net];
   const child = (o.spawnFn ?? spawn)(
@@ -31981,7 +32080,7 @@ function spawnEmbedder(o) {
     // 11c review LOW 3, fixed by the Task 12 Mini gate: cwd is the run directory's PARENT, which the bridge created (0700)
     // before spawning; the run directory itself is created by the embedder, so on a first start it does not exist yet and
     // a cwd there fails the spawn with ENOENT. Never the bridge's working directory.
-    { detached: true, stdio: "ignore", windowsHide: true, cwd: dirname3(run), env: win ? { ...embedderEnv(process.env, "win32"), USERPROFILE: o.home, LOCALAPPDATA: dirname3(dirname3(dirname3(run))) } : { ...embedderEnv(), HOME: o.home } }
+    { detached: true, stdio: "ignore", windowsHide: true, cwd: dirname4(run), env: win ? { ...embedderEnv(process.env, "win32"), USERPROFILE: o.home, LOCALAPPDATA: dirname4(dirname4(dirname4(run))) } : { ...embedderEnv(), HOME: o.home } }
   );
   child.unref();
   child.on("error", () => {
@@ -31993,8 +32092,8 @@ function spawnEmbedder(o) {
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { randomBytes as randomBytes10 } from "node:crypto";
-import { lstatSync as lstatSync4, readFileSync as readFileSync6, rmSync as rmSync5 } from "node:fs";
-import { join as join11, win32 } from "node:path";
+import { lstatSync as lstatSync5, readFileSync as readFileSync6, rmSync as rmSync5 } from "node:fs";
+import { join as join12, win32 } from "node:path";
 var WINDOWS_SEMANTIC_ENABLED = false;
 var windowsSemanticOn = (platform, enabled = WINDOWS_SEMANTIC_ENABLED) => platform !== "win32" || enabled;
 function parseSaveSddl(saveFile) {
@@ -32022,7 +32121,7 @@ function aclAllows(sddl, ownerSid) {
   if (aces.length === 0 || rest !== "" && !rest.startsWith("S:")) return false;
   return aces.every((a) => a[0] === "A" && allowed.has(a[5] ?? "") || a[0] === "D");
 }
-function hasReparsePoint(path, lstat = lstatSync4) {
+function hasReparsePoint(path, lstat = lstatSync5) {
   const root3 = win32.parse(path).root;
   let cur = root3;
   for (const part of path.slice(root3.length).split(/[\\/]/).filter(Boolean)) {
@@ -32041,7 +32140,7 @@ async function currentUserSid(run = defaultRunner) {
 }
 async function verifyRunDirAcl(path, deps = {}, sid) {
   const run = deps.run ?? defaultRunner;
-  const out = join11(deps.tmp ?? process.env.TEMP ?? process.env.TMP ?? ".", `sc-acl-${randomBytes10(8).toString("hex")}.txt`);
+  const out = join12(deps.tmp ?? process.env.TEMP ?? process.env.TMP ?? ".", `sc-acl-${randomBytes10(8).toString("hex")}.txt`);
   try {
     if (hasReparsePoint(path, deps.lstat)) return false;
     const user = await (sid ? sid() : currentUserSid(run));
@@ -32122,12 +32221,12 @@ var EmbedderClient = class {
   ready(ms) {
     if (this.st.state === "ready") return Promise.resolve(true);
     if (this.st.state !== "preparing" || !(ms > 0)) return Promise.resolve(false);
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       let t;
       const w = (ok) => {
         clearTimeout(t);
         this.readyWaiters.delete(w);
-        resolve(ok);
+        resolve2(ok);
       };
       this.readyWaiters.add(w);
       t = setTimeout(() => w(false), ms);
@@ -32236,7 +32335,7 @@ var EmbedderClient = class {
     const p = this.paths();
     if (!this.tcp() && Buffer.byteLength(`${p.sock}.00000000`) > SOCKET_PATH_MAX) return this.fail("run_dir_refused");
     if (this.tcp()) {
-      mkdirSync4(this.runDir(), { recursive: true, mode: 448 });
+      mkdirSync5(this.runDir(), { recursive: true, mode: 448 });
       if (!await this.aclOk(true)) return this.fail("acl_unverified");
     }
     if (!this.tcp()) {
@@ -32372,7 +32471,7 @@ var EmbedderClient = class {
       }
       if (this.closed) return false;
     }
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const s = this.tcp() ? connect({ host: "127.0.0.1", port: pub.port }) : connect(p.sock);
       const nc = nonce();
       let ns = "";
@@ -32385,7 +32484,7 @@ var EmbedderClient = class {
         if (!settled) {
           settled = true;
           clearTimeout(t);
-          resolve(ok);
+          resolve2(ok);
         }
       }
       const refuse2 = (reason) => {
@@ -32950,12 +33049,12 @@ var ReembedQueue = class {
 };
 
 // src/memory/recall/call-heartbeat.ts
-import { closeSync as closeSync3, constants as constants3, fstatSync as fstatSync3, futimesSync as futimesSync2, openSync as openSync3, rmSync as rmSync7 } from "node:fs";
-import { join as join13 } from "node:path";
+import { closeSync as closeSync3, constants as constants4, fstatSync as fstatSync3, futimesSync as futimesSync2, openSync as openSync3, rmSync as rmSync7 } from "node:fs";
+import { join as join14 } from "node:path";
 
 // src/memory/embedder/heartbeats.ts
-import { lstatSync as lstatSync5, readdirSync as readdirSync3 } from "node:fs";
-import { join as join12 } from "node:path";
+import { lstatSync as lstatSync6, readdirSync as readdirSync3 } from "node:fs";
+import { join as join13 } from "node:path";
 var HEARTBEAT_FUTURE_SKEW_MS = 6e4;
 var HEARTBEAT_STALE_MS = 3e4;
 function heartbeatAgeFresh(ageMs, staleMs = HEARTBEAT_STALE_MS) {
@@ -32970,7 +33069,7 @@ function anyHeartbeatFresh(dir, now, staleMs = HEARTBEAT_STALE_MS) {
   }
   return names.some((n) => {
     try {
-      const st = lstatSync5(join12(dir, n));
+      const st = lstatSync6(join13(dir, n));
       return st.isFile() && heartbeatAgeFresh(now - st.mtimeMs, staleMs);
     } catch {
       return false;
@@ -33036,7 +33135,7 @@ var CallHeartbeat = class {
     if (dir === null) return;
     let fd;
     try {
-      fd = openSync3(join13(dir, this.identityId), constants3.O_WRONLY | constants3.O_CREAT | constants3.O_NOFOLLOW | constants3.O_NONBLOCK, 384);
+      fd = openSync3(join14(dir, this.identityId), constants4.O_WRONLY | constants4.O_CREAT | constants4.O_NOFOLLOW | constants4.O_NONBLOCK, 384);
       if (!fstatSync3(fd).isFile()) return;
       const t = new Date(this.now());
       futimesSync2(fd, t, t);
@@ -33051,7 +33150,7 @@ var CallHeartbeat = class {
     const dir = SAFE_ID2.test(this.identityId) ? this.dirOk() : null;
     if (dir === null) return;
     try {
-      rmSync7(join13(dir, this.identityId), { force: true });
+      rmSync7(join14(dir, this.identityId), { force: true });
       this.wrote = false;
     } catch (e) {
       this.log("warn", "memory.call_heartbeat_failed", {}, e);
@@ -33114,9 +33213,9 @@ function queryTokenMacs(key, text, max = QUERY_MACS_MAX) {
 
 // src/memory/unified/ranking-client.ts
 import { Worker } from "node:worker_threads";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function workerTransport(init, distDir) {
-  const w = new Worker(join14(distDir, "memory-worker.js"), { workerData: init });
+  const w = new Worker(join15(distDir, "memory-worker.js"), { workerData: init });
   return {
     post: (m) => w.postMessage(m),
     onMessage: (cb) => {
@@ -33176,15 +33275,15 @@ var RankingClient = class {
   ask(build, deadlineAt) {
     const id = ++this.seq;
     if (this.closed) return Promise.resolve("failed");
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const timer = setTimeout(() => {
         this.waiting.delete(id);
         this.misses++;
-        resolve("late");
+        resolve2("late");
       }, Math.max(0, deadlineAt - Date.now()));
       this.waiting.set(id, { resolve: (m) => {
         clearTimeout(timer);
-        resolve(m);
+        resolve2(m);
       } });
       try {
         this.transport().post(build(id));
@@ -33193,7 +33292,7 @@ var RankingClient = class {
         this.waiting.delete(id);
         this.misses++;
         (this.d.log ?? writeServiceLog2)("warn", "memory.ranking_worker_spawn_failed", void 0, e);
-        resolve("failed");
+        resolve2("failed");
       }
     });
   }
@@ -34787,17 +34886,17 @@ async function runSummarize(opts) {
 // src/service/runtime-config-dir.ts
 import { createHash as createHash5, randomUUID } from "node:crypto";
 import {
-  chmodSync as chmodSync4,
+  chmodSync as chmodSync5,
   existsSync as existsSync4,
-  lstatSync as lstatSync6,
-  mkdirSync as mkdirSync5,
+  lstatSync as lstatSync7,
+  mkdirSync as mkdirSync6,
   readFileSync as readFileSync8,
   renameSync as renameSync3,
   statSync as statSync3,
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { basename as basename4, isAbsolute, join as join15 } from "node:path";
+import { basename as basename5, isAbsolute, join as join16 } from "node:path";
 
 // src/grants/search-providers.ts
 var SEARCH_PROVIDERS = /* @__PURE__ */ new Set(["brave", "tavily", "parallel", "exa", "firecrawl"]);
@@ -34809,18 +34908,18 @@ function isSearchProvider(value) {
 // src/service/runtime-config-dir.ts
 var MEMORY_FILE = "MEMORY.md";
 var REAL_FS = {
-  mkdir: (p, mode) => mkdirSync5(p, { recursive: true, mode }),
-  chmod: (p, mode) => chmodSync4(p, mode),
+  mkdir: (p, mode) => mkdirSync6(p, { recursive: true, mode }),
+  chmod: (p, mode) => chmodSync5(p, mode),
   writeFile: (p, data, mode) => writeFileSync(p, data, { mode }),
   rename: (a, b) => renameSync3(a, b),
   readFile: (p) => readFileSync8(p, "utf8"),
   unlink: (p) => unlinkSync(p)
 };
 function runtimeConfigDir(home, identityId) {
-  return join15(home, ".securecoms", "runtime-config", identityId);
+  return join16(home, ".securecoms", "runtime-config", identityId);
 }
 function assertManagedName(name) {
-  if (!name || name.includes("/") || name.includes("\\") || name === "." || name === ".." || name !== basename4(name)) {
+  if (!name || name.includes("/") || name.includes("\\") || name === "." || name === ".." || name !== basename5(name)) {
     throw new Error(`refusing managed config file name ${JSON.stringify(name)}: not a plain filename`);
   }
   if (isLocalOnlyName(name)) {
@@ -34834,19 +34933,19 @@ function isLocalOnlyName(name) {
 var MANIFEST_POLICY_FILE = "manifest-policy.json";
 function removeManagedLlmSource(home, identityId, deps = REAL_FS) {
   try {
-    deps.unlink(join15(runtimeConfigDir(home, identityId), "llm-source.json"));
+    deps.unlink(join16(runtimeConfigDir(home, identityId), "llm-source.json"));
   } catch (e) {
     if (e?.code !== "ENOENT") throw e;
   }
 }
 function writeManifestPolicy(home, identityId, policy, deps = REAL_FS) {
-  const parent3 = join15(home, ".securecoms", "runtime-config");
+  const parent3 = join16(home, ".securecoms", "runtime-config");
   const dir = runtimeConfigDir(home, identityId);
-  for (const d of [join15(home, ".securecoms"), parent3, dir]) {
+  for (const d of [join16(home, ".securecoms"), parent3, dir]) {
     deps.mkdir(d, 448);
     deps.chmod(d, 448);
   }
-  atomicWrite(join15(dir, MANIFEST_POLICY_FILE), JSON.stringify(policy) + "\n", deps);
+  atomicWrite(join16(dir, MANIFEST_POLICY_FILE), JSON.stringify(policy) + "\n", deps);
 }
 function atomicWrite(path, body, deps) {
   const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -34865,13 +34964,13 @@ function atomicWrite(path, body, deps) {
 function writeManagedFiles(home, identityId, files, deps = REAL_FS) {
   const entries = Object.entries(files);
   for (const [name] of entries) assertManagedName(name);
-  const parent3 = join15(home, ".securecoms", "runtime-config");
+  const parent3 = join16(home, ".securecoms", "runtime-config");
   const dir = runtimeConfigDir(home, identityId);
-  for (const d of [join15(home, ".securecoms"), parent3, dir]) {
+  for (const d of [join16(home, ".securecoms"), parent3, dir]) {
     deps.mkdir(d, 448);
     deps.chmod(d, 448);
   }
-  for (const [name, body] of entries) atomicWrite(join15(dir, name), body, deps);
+  for (const [name, body] of entries) atomicWrite(join16(dir, name), body, deps);
 }
 function checkConfiguredPaths(skillsJson, statFn = (p) => {
   const s = statSync3(p);
@@ -34950,7 +35049,7 @@ function localLegacySources(doc) {
     const channelId = source.channelId;
     if (kind2 !== "global-memory" && kind2 !== "conversation-history" && kind2 !== "captured-memory" || typeof path !== "string" || !isAbsolute(path) || channelId !== void 0 && typeof channelId !== "string") continue;
     try {
-      const st = lstatSync6(path);
+      const st = lstatSync7(path);
       if (!st.isFile() || st.isSymbolicLink()) continue;
       if (st.size <= LEGACY_MEMORY_SOURCE_MAX_BYTES && st.size > contentBudget) continue;
       const oversize = st.size > LEGACY_MEMORY_SOURCE_MAX_BYTES;
@@ -34978,7 +35077,7 @@ function localLegacySources(doc) {
   return out;
 }
 function readLocalReport(home, identityId) {
-  const p = join15(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const p = join16(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(p)) return null;
   let doc;
   try {
@@ -35013,7 +35112,7 @@ function readLocalReport(home, identityId) {
 }
 function deleteLegacyMemorySources(home, identityId, ids) {
   if (ids.length === 0) return 0;
-  const p = join15(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const p = join16(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(p)) return 0;
   let doc;
   try {
@@ -35056,7 +35155,7 @@ async function applyLegacyMemoryFactDecisions(home, identityId, rawDecisions, re
     group.set(decision.fact_hash, decision);
     bySource.set(decision.source_id, group);
   }
-  const reportPath = join15(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const reportPath = join16(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(reportPath)) return { sourcesDeleted: 0, factsAssigned: 0 };
   let doc;
   try {
@@ -35094,7 +35193,7 @@ async function applyLegacyMemoryFactDecisions(home, identityId, rawDecisions, re
 }
 function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
   const dir = runtimeConfigDir(home, identityId);
-  const path = join15(dir, MEMORY_FILE);
+  const path = join16(dir, MEMORY_FILE);
   if (!existsSync4(path)) return 0;
   const drop = new Set(hashes);
   const before = deps.readFile(path).split("\n");
@@ -35127,9 +35226,9 @@ import { sha256 as sha25611 } from "@noble/hashes/sha256";
 import { ed25519 as ed255195 } from "@noble/curves/ed25519";
 
 // src/grants/pin.ts
-import { lstatSync as lstatSync7, readFileSync as readFileSync9 } from "node:fs";
+import { lstatSync as lstatSync8, readFileSync as readFileSync9 } from "node:fs";
 import { ed25519 as ed255194 } from "@noble/curves/ed25519";
-import { dirname as dirname4, join as join16 } from "node:path";
+import { dirname as dirname5, join as join17 } from "node:path";
 var PIN_FILE_NAME = "owner-signing-key.json";
 var UUID_LOWER = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var PIN_KEYS = ["key_algo", "owner_identity_id", "public_key"];
@@ -35159,7 +35258,7 @@ function parsePinObject(v) {
     pin: Object.freeze({ ownerIdentityId: o.owner_identity_id, keyAlgo: "ed25519", publicKey, publicKeyB64: o.public_key })
   };
 }
-var NODE_FS = { lstat: (p) => lstatSync7(p), readFile: (p) => readFileSync9(p, "utf8") };
+var NODE_FS = { lstat: (p) => lstatSync8(p), readFile: (p) => readFileSync9(p, "utf8") };
 function fromValue(v) {
   const r = parsePinObject(v);
   return r.ok ? { kind: "ok", pin: r.pin } : { kind: "bad", state: r.state };
@@ -35193,7 +35292,7 @@ function samePin(a, b) {
 }
 function loadOwnerGrantPin(opts) {
   const fs = opts.fs ?? NODE_FS;
-  const file2 = readPinFile(join16(dirname4(opts.credentialPath), PIN_FILE_NAME), fs);
+  const file2 = readPinFile(join17(dirname5(opts.credentialPath), PIN_FILE_NAME), fs);
   const field = "owner_signing_key" in opts.credentialJson && opts.credentialJson.owner_signing_key !== void 0 ? fromValue(opts.credentialJson.owner_signing_key) : { kind: "absent" };
   if (file2.kind === "bad") return { state: file2.state, pin: null };
   if (field.kind === "bad") return { state: field.state, pin: null };
@@ -36217,8 +36316,8 @@ function voiceWindowEligible(t) {
 }
 function waitMs(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve) => {
-    const t = setTimeout(resolve, ms);
+  return new Promise((resolve2) => {
+    const t = setTimeout(resolve2, ms);
     t.unref?.();
   });
 }
@@ -36355,7 +36454,7 @@ var FileOwnerAuthorityStore = class {
   }
   async readAll() {
     try {
-      return JSON.parse(await fsp.readFile(this.path, "utf8"));
+      return JSON.parse(await fsp2.readFile(this.path, "utf8"));
     } catch (e) {
       if (e.code === "ENOENT") return {};
       throw e;
@@ -36368,8 +36467,8 @@ var FileOwnerAuthorityStore = class {
   async save(enclaveId, pin) {
     const all = await this.readAll();
     all[enclaveId] = pin;
-    await fsp.mkdir(dirname5(this.path), { recursive: true });
-    await fsp.writeFile(this.path, JSON.stringify(all), "utf8");
+    await fsp2.mkdir(dirname6(this.path), { recursive: true });
+    await fsp2.writeFile(this.path, JSON.stringify(all), "utf8");
   }
 };
 var AgentPausedSendError = class extends Error {
@@ -36576,7 +36675,7 @@ var BridgeAgent = class _BridgeAgent {
           threshold: EMBEDDING_MANIFEST.similarityThreshold,
           warm: windowsSemanticOn(this.platform)
         };
-        return deps.rankingTransport ? deps.rankingTransport(init) : workerTransport(init, dirname5(fileURLToPath2(import.meta.url)));
+        return deps.rankingTransport ? deps.rankingTransport(init) : workerTransport(init, dirname6(fileURLToPath2(import.meta.url)));
       }
     });
     this.embedder = deps.embedder ?? (deps.hostMachine === true && deps.home === void 0 ? new EmbedderClient({ identityId: cfg.identityId, home: homedir4(), source: cfg.modelSource, fetchImpl: this.fetchImpl, platform: this.platform }) : INERT_EMBEDDER);
@@ -36587,7 +36686,7 @@ var BridgeAgent = class _BridgeAgent {
       modelId: EMBEDDING_MANIFEST.modelId,
       threshold: EMBEDDING_MANIFEST.similarityThreshold
     });
-    this.heartbeat = new CallHeartbeat(this.machinePaths ? join17(this.home, ".securecoms", "run", "voice-call") : null, cfg.identityId, VOICE_LIVE_WINDOW_MS);
+    this.heartbeat = new CallHeartbeat(this.machinePaths ? join18(this.home, ".securecoms", "run", "voice-call") : null, cfg.identityId, VOICE_LIVE_WINDOW_MS);
     this.reembed = new ReembedQueue({
       store: this.store,
       embedder: this.embedder,
@@ -36646,15 +36745,15 @@ var BridgeAgent = class _BridgeAgent {
     this.bootDrainWaitMs = deps.bootDrainWaitMs ?? BOOT_DRAIN_WAIT_MS_DEFAULT;
     this.searchCapabilityRefetchDebounceMs = deps.searchCapabilityRefetchDebounceMs ?? SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS;
     this.searchCapabilityRefetchMaxWaitMs = deps.searchCapabilityRefetchMaxWaitMs ?? SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS;
-    this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve) => {
-      const t = setTimeout(resolve, ms);
+    this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve2) => {
+      const t = setTimeout(resolve2, ms);
       t.unref?.();
     }));
     this.actionRateFloor = new TokenBucketFloor({ capacity: 1, refillPerMinute: 30, now: this.actionClock });
     this.globalActionRateFloor = new TokenBucketFloor({ capacity: 1, refillPerMinute: 30, now: this.actionClock });
     const self = this;
     this.downloadBlobImpl = deps.downloadBlob ?? async function(blobId) {
-      const url = `${cfg.apiBase}/api/v1/attachments/${encodeURIComponent(blobId)}?caller_identity_id=${encodeURIComponent(cfg.identityId)}`;
+      const url = `${cfg.apiBase}/api/v1/attachments/${encodeURIComponent(assertBlobId(blobId))}?caller_identity_id=${encodeURIComponent(cfg.identityId)}`;
       const res = await fetchWithDeadline(self.fetchImpl, url, { headers: { authorization: `Bearer ${cfg.apiKey}` } }, {
         op: "attachment_download",
         timeoutMs: FETCH_DEADLINE_MS.blobBase,
@@ -36674,8 +36773,9 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join17(dirname5(cfg.storePath), "attachments");
-    this.vaultOwnerStoreImpl = deps.vaultOwnerStore ?? new FileOwnerAuthorityStore(join17(dirname5(cfg.storePath), "vault-owner-pins.json"));
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join18(dirname6(cfg.storePath), "attachments");
+    this.vaultOutboxDirImpl = deps.vaultOutboxDir !== void 0 ? deps.vaultOutboxDir : cfg.storePath === ":memory:" ? null : join18(dirname6(cfg.storePath), VAULT_OUTBOX_DIRNAME);
+    this.vaultOwnerStoreImpl = deps.vaultOwnerStore ?? new FileOwnerAuthorityStore(join18(dirname6(cfg.storePath), "vault-owner-pins.json"));
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -37406,6 +37506,9 @@ var BridgeAgent = class _BridgeAgent {
   uploadBlobImpl;
   /** Track 5: directory where received attachments are saved. */
   attachmentsDirImpl;
+  vaultOutboxDirImpl;
+  /** Audit 2026-10-30 HIGH 2: the outbox pinned at start(); null = every upload refused. */
+  outboxPin = null;
   /** B7: persistence for the vault kekset's owner-pin TOFU state. */
   vaultOwnerStoreImpl;
   /** B7: last-seen kekset generation per enclave, enforced monotonic across
@@ -37682,7 +37785,7 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** No manifest in force: a manifest-policy.json left by an earlier one is replaced by an empty tool list. */
   overwriteStalePolicy() {
-    if (!existsSync5(join17(runtimeConfigDir(this.home, this.cfg.identityId), "manifest-policy.json"))) return;
+    if (!existsSync5(join18(runtimeConfigDir(this.home, this.cfg.identityId), "manifest-policy.json"))) return;
     this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, { v: 1, manifest_tools: [], secret_path_mode: "enforce" });
   }
   /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
@@ -37849,6 +37952,13 @@ var BridgeAgent = class _BridgeAgent {
   }
   async startBody() {
     this.startedAt = Date.now();
+    if (this.vaultOutboxDirImpl) {
+      try {
+        this.outboxPin = ensureOutbox(this.vaultOutboxDirImpl);
+      } catch (e) {
+        writeServiceLog2("warn", "vault_outbox.unavailable", {}, e);
+      }
+    }
     await this.restoreRuntimeInbox();
     await this.loadToolGrantState();
     this.recomputeManifestPolicy(NO_FEATURES);
@@ -37874,8 +37984,8 @@ var BridgeAgent = class _BridgeAgent {
     const drain = this.ingestOnce().then(() => true, () => true);
     const drainedInTime = await Promise.race([
       drain,
-      new Promise((resolve) => {
-        const t = setTimeout(() => resolve(false), this.bootDrainWaitMs);
+      new Promise((resolve2) => {
+        const t = setTimeout(() => resolve2(false), this.bootDrainWaitMs);
         t.unref?.();
         void drain.then(() => clearTimeout(t));
       })
@@ -37885,7 +37995,7 @@ var BridgeAgent = class _BridgeAgent {
       await this.bootReconcileKeyPackage();
     } else {
       writeServiceLog2("warn", "boot.drain_slow", { wait_ms: this.bootDrainWaitMs });
-      const settled = new Promise((resolve) => this.ingestSettledWaiters.push(resolve));
+      const settled = new Promise((resolve2) => this.ingestSettledWaiters.push(resolve2));
       this.deferredBootPublish = settled.then(async () => {
         this.bootDrainPending = false;
         if (this.closingDown) return;
@@ -39392,7 +39502,8 @@ var BridgeAgent = class _BridgeAgent {
       uploadBlob: (ciphertext, channelId) => this.uploadBlobImpl(ciphertext, channelId),
       encryptFile,
       bytesToBase64: bytesToBase642,
-      readFile: (p) => fsp.readFile(p).then((b) => new Uint8Array(b))
+      // Security fix 2026-10-30: attachments upload only from the outbox.
+      readFile: (p) => readOutboxFile(this.outboxPin, p).then((r) => r.bytes)
     };
   }
   receiveDeps() {
@@ -39402,8 +39513,8 @@ var BridgeAgent = class _BridgeAgent {
       decryptFile,
       computeFileDigest,
       base64ToBytes: base64ToBytes2,
-      mkdirp: (d) => fsp.mkdir(d, { recursive: true }).then(() => void 0),
-      writeFile: (p, data) => fsp.writeFile(p, data)
+      mkdirp: (d) => fsp2.mkdir(d, { recursive: true }).then(() => void 0),
+      writeFile: (p, data) => fsp2.writeFile(p, data)
     };
   }
   async sendAttachment(channelId, filePath2, caption) {
@@ -39411,8 +39522,11 @@ var BridgeAgent = class _BridgeAgent {
     const joined = await this.reconcileJoin(channelId);
     if (!joined) throw new ChannelPendingError(channelId);
     let body;
+    let read;
     try {
-      body = await prepareAttachment(filePath2, caption, channelId, this.sendDeps());
+      read = await readOutboxFile(this.outboxPin, filePath2);
+      const bytes = read.bytes;
+      body = await prepareAttachment(filePath2, caption, channelId, { ...this.sendDeps(), readFile: async () => bytes });
     } catch (e) {
       if (e.code === "ENOENT" || e.code === "EACCES" || e.code === "ENOTDIR" || e.code === "EISDIR") {
         throw new InvalidPathError(filePath2, e);
@@ -39453,6 +39567,7 @@ var BridgeAgent = class _BridgeAgent {
     );
     this.latency.record("send.total", performance.now() - sendStart);
     this.agentHops.noteOwnSend(channelId);
+    await this.consumeUploaded(read);
     return { message_id: id, status: "sent" };
   }
   // ── B7: FileSafe vault commands (loopback boundary) ──────────────────────
@@ -39978,25 +40093,26 @@ var BridgeAgent = class _BridgeAgent {
       }
     };
   }
-  /** Read `path` off local disk, encrypt + wrap its DEK under the vault's
+  /** Read `path` from the vault outbox (security fix 2026-10-30; see
+   *  ./outbox.ts), encrypt + wrap its DEK under the vault's
    *  current KEK generation, and create+upload+commit it as a new vault
    *  file node named `name` (which may differ from `path`'s basename). */
   async vaultWrite(enclaveId, vaultChannelId, path, name) {
-    const session = await this.getVaultSession(enclaveId, await this.resolveVaultChannelId(enclaveId, vaultChannelId));
-    let bytes;
+    let read;
     try {
-      bytes = new Uint8Array(await fsp.readFile(path));
+      read = await readOutboxFile(this.outboxPin, path);
     } catch (e) {
       const code = e.code;
       if (code === "ENOENT" || code === "EACCES" || code === "ENOTDIR" || code === "EISDIR") throw new InvalidPathError(path, e);
       throw e;
     }
+    const session = await this.getVaultSession(enclaveId, await this.resolveVaultChannelId(enclaveId, vaultChannelId));
     const nodeId = crypto.randomUUID();
-    return vaultWriteImpl({
+    const written = await vaultWriteImpl({
       enclaveId,
       nodeId,
       name,
-      bytes,
+      bytes: read.bytes,
       deps: {
         exporterKekForGeneration: session.kekForGeneration,
         currentGeneration: session.currentGeneration,
@@ -40005,6 +40121,16 @@ var BridgeAgent = class _BridgeAgent {
         commitNode: (committedNodeId) => this.vaultCommitNode(enclaveId, committedNodeId)
       }
     });
+    await this.consumeUploaded(read);
+    return written;
+  }
+  /** Audit 2026-10-30 MED 5: an uploaded file leaves the outbox (no plaintext lingers). Content-free log. */
+  async consumeUploaded(read) {
+    if (!this.outboxPin || !await consumeOutboxFile(this.outboxPin, read)) writeServiceLog2("warn", "vault_outbox.consume_failed");
+  }
+  /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
+  vaultOutboxPath() {
+    return this.outboxPin?.dir ?? null;
   }
   /** Download + verify + decrypt a vault file node. Returns the plaintext
    *  base64-encoded (the loopback boundary is JSON-only, mirroring how
@@ -42437,13 +42563,13 @@ var BridgeAgent = class _BridgeAgent {
       throw new Error("summarize_no_runtime");
     }
     const messages = [{ role: "user", content: prompt }];
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => reject(new Error("aborted"));
       signal.addEventListener("abort", onAbort);
       this.fastLlm.complete(messages).then(
         (text) => {
           signal.removeEventListener("abort", onAbort);
-          resolve(text);
+          resolve2(text);
         },
         (err) => {
           signal.removeEventListener("abort", onAbort);
@@ -43391,7 +43517,7 @@ var BridgeAgent = class _BridgeAgent {
       return got;
     }
     const cap = Math.min(waitSeconds, 50) * 1e3;
-    await new Promise((resolve) => {
+    await new Promise((resolve2) => {
       let fired = false;
       let timer;
       const wake = () => {
@@ -43400,7 +43526,7 @@ var BridgeAgent = class _BridgeAgent {
         clearTimeout(timer);
         const i = this.waiters.indexOf(wake);
         if (i >= 0) this.waiters.splice(i, 1);
-        resolve();
+        resolve2();
       };
       timer = setTimeout(wake, cap);
       this.waiters.push(wake);
@@ -43443,13 +43569,13 @@ var BridgeAgent = class _BridgeAgent {
     const bound = b !== null && b.state === "bound" && b.counter === this.toolGrantCounter;
     const switchOn = audience === "owner_dm" ? this.ownerDmManifestGrants : audience === "team_room" ? this.roomManifestGrants : false;
     const signedNow = new Set(audience && manifest ? manifest.grants[audience] ?? [] : []);
-    const constants4 = new Set(audience === "owner_dm" ? OWNER_DM_DEFAULT_READ_GRANTS.map((g) => g.tool) : audience === "team_room" ? ROOM_DEFAULT_READ_GRANTS.map((g) => g.tool) : []);
+    const constants5 = new Set(audience === "owner_dm" ? OWNER_DM_DEFAULT_READ_GRANTS.map((g) => g.tool) : audience === "team_room" ? ROOM_DEFAULT_READ_GRANTS.map((g) => g.tool) : []);
     let changed = false;
     const out = a.tool_grants.flatMap((g) => {
       if (!(g.mode === "read" && g.source === "manifest")) return [g];
       if (switchOn && bound && signedNow.has(g.tool)) return [g];
       changed = true;
-      return constants4.has(g.tool) && signedNow.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+      return constants5.has(g.tool) && signedNow.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
     });
     if (!changed) return m;
     return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(out) }) };
@@ -44266,7 +44392,7 @@ ${channelId}`;
       }
       const withheld = new Set(Object.keys(TOOL_FEATURE).filter((t) => !toolAllowedByFeatures(t, features)));
       if (withheld.size === 0) return;
-      const path = join17(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
+      const path = join18(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
       if (!existsSync5(path)) return;
       let doc;
       try {
@@ -44491,8 +44617,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         ingest.released,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44502,8 +44628,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         starting,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44512,8 +44638,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.membershipSweepWork,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44523,8 +44649,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallPruneWork,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44534,8 +44660,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallMaintenanceWork,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44547,8 +44673,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.recallTapWork]),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44557,8 +44683,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.unifiedWork]),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44567,8 +44693,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallPrewarmWork,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44578,8 +44704,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.replyWork]),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44592,7 +44718,7 @@ ${channelId}`;
 
 // src/config.ts
 import { readFileSync as readFileSync11, statSync as statSync5 } from "node:fs";
-import { dirname as dirname6, join as join18 } from "node:path";
+import { dirname as dirname7, join as join19 } from "node:path";
 var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 var CONFIG_ERROR_MESSAGE = {
   credential_not_found: "credential file not found",
@@ -44630,7 +44756,7 @@ function loadConfig(opts) {
     throw new ConfigError("credential_not_json");
   }
   for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new ConfigError("credential_missing_field", k);
-  const storePath = opts.storePath ?? join18(dirname6(opts.credentialPath), "bridge-state.db");
+  const storePath = opts.storePath ?? join19(dirname7(opts.credentialPath), "bridge-state.db");
   const ownerGrantPin = loadOwnerGrantPin({ credentialPath: opts.credentialPath, credentialJson: json2 });
   writeServiceLog2(ownerGrantPin.state === "ok" || ownerGrantPin.state === "no_pin" ? "info" : "warn", "authz.pin", {
     state: ServiceLogEnum.of(ownerGrantPin.state, ["ok", "no_pin", "pin_conflict", "malformed", "unsupported_algo", "symlink_refused", "unreadable"])
@@ -44818,6 +44944,10 @@ var BRIDGE_ERRORS = {
   // Weather/currency Task 17 (OQ-P1): a send frame's credit is not the closed value, or rides an a2a frame. TERMINAL:
   // the inbound is retired, so the model (and the weather call) never runs again for it.
   reply_credit_unknown: { http: 400, message: "reply credit not recognised; not sent" },
+  // Security fix 2026-10-30: an upload route was given a path that is not a
+  // regular file directly inside the bridge's vault outbox (`vault_outbox` on
+  // /healthz). Fixed and content-free: the path is never echoed or logged.
+  path_outside_outbox: { http: 400, message: "uploads must come from the bridge vault outbox; copy the file there first" },
   internal: { http: 500, message: "internal error" }
 };
 function errorBody(code, detail) {
@@ -44857,10 +44987,10 @@ function withManifestCapability(m, manifestConsumer) {
   if (manifestConsumer) return m;
   const a = m.authorization;
   if (!a || !a.tool_grants.some(isManifestGrant)) return m;
-  const constants4 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
+  const constants5 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
   const narrowed = a.tool_grants.flatMap((g) => {
     if (!isManifestGrant(g)) return [g];
-    return constants4.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+    return constants5.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
   });
   return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(narrowed) }) };
 }
@@ -45018,7 +45148,7 @@ function jsonError(res, code, detail) {
   json(res, httpStatus(code), errorBody(code, detail));
 }
 function readBody(req, cap) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let size = 0;
     let done = false;
     const chunks = [];
@@ -45038,7 +45168,7 @@ function readBody(req, cap) {
     req.on("end", () => {
       if (!done) {
         done = true;
-        resolve(Buffer.concat(chunks).toString("utf8"));
+        resolve2(Buffer.concat(chunks).toString("utf8"));
       }
     });
     req.on("error", (e) => {
@@ -45116,6 +45246,9 @@ function createHttpServer(agent, opts) {
         }
         return json(res, 200, r);
       }
+      if (method === "GET" && path === "/v1/vault-outbox") {
+        return json(res, 200, { path: agent.vaultOutboxPath() });
+      }
       if (method === "POST" && path === "/v1/send-attachment") {
         const parsed = sendAttachmentSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
@@ -45227,6 +45360,10 @@ function createHttpServer(agent, opts) {
       if (e instanceof SendForbiddenError) return jsonError(res, "send_forbidden");
       if (e instanceof GroupSupersededSendError) return jsonError(res, "group_superseded");
       if (e instanceof IdempotencyConflictError) return jsonError(res, "invalid_request", e.message);
+      if (e instanceof PathOutsideOutboxError) {
+        writeServiceLog2("warn", "vault_outbox.refused");
+        return jsonError(res, "path_outside_outbox");
+      }
       if (e instanceof InvalidPathError) return jsonError(res, "invalid_request", e.message);
       if (e instanceof VaultPinMismatchError) return jsonError(res, "vault_ref_changed", { pin: e.pin });
       if (e instanceof VaultIntegrityError) return jsonError(res, "vault_integrity_failed", e.message);