@securecoms/agent-bridge 0.34.0 → 0.36.0

package/dist/index.js

@@ -3083,7 +3083,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     if (outputLen !== expectedLen)
       throw new Error(`hash.outputLen must be ${expectedLen}, got ${outputLen}`);
   }
-  const randomBytes12 = opts.randomBytes === void 0 ? randomBytes4 : opts.randomBytes;
+  const randomBytes13 = opts.randomBytes === void 0 ? randomBytes4 : opts.randomBytes;
   const adjustScalarBytes3 = opts.adjustScalarBytes === void 0 ? (bytes) => bytes : opts.adjustScalarBytes;
   const domain = opts.domain === void 0 ? (data, ctx, phflag) => {
     abool2(phflag, "phflag");
@@ -3169,7 +3169,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     seed: _size
   };
   function randomSecretKey(seed) {
-    seed = seed === void 0 ? randomBytes12(lengths.seed) : seed;
+    seed = seed === void 0 ? randomBytes13(lengths.seed) : seed;
     return abytes3(seed, lengths.seed, "seed");
   }
   function isValidSecretKey(key) {
@@ -6418,7 +6418,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes12 = ecdsaOpts.randomBytes === void 0 ? randomBytes4 : ecdsaOpts.randomBytes;
+  const randomBytes13 = ecdsaOpts.randomBytes === void 0 ? randomBytes4 : ecdsaOpts.randomBytes;
   const hmac5 = ecdsaOpts.hmac === void 0 ? (key, msg) => hmac(hash_, key, msg) : ecdsaOpts.hmac;
   const { Fp: Fp3, Fn: Fn3 } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn3;
@@ -6564,7 +6564,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e = extraEntropy === true ? randomBytes12(lengths.secretKey) : extraEntropy;
+      const e = extraEntropy === true ? randomBytes13(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes3(e, void 0, "extraEntropy"));
     }
     const seed = concatBytes4(...seedArgs);
@@ -18415,8 +18415,8 @@ function sameRef(a, b) {
 // ../connect-sdk-ts/dist/groupkey/own-removal.js
 async function probeOwnRemoval(mgr, commitBytes) {
   try {
-    const own = mgr.state?.privatePath?.leafIndex;
-    if (typeof own !== "number")
+    const own2 = mgr.state?.privatePath?.leafIndex;
+    if (typeof own2 !== "number")
       return null;
     if (!hoistedTsMlsMatchesCrypto(mgr))
       return null;
@@ -18441,7 +18441,7 @@ async function probeOwnRemoval(mgr, commitBytes) {
         committer = typeof incoming.senderLeafIndex === "number" ? Number(incoming.senderLeafIndex) : null;
         for (const p of incoming.proposals) {
           const prop = p.proposal;
-          if (prop.proposalType === "remove" && Number(prop.remove?.removed) === own)
+          if (prop.proposalType === "remove" && Number(prop.remove?.removed) === own2)
             removesOwn = true;
         }
       }
@@ -18449,7 +18449,7 @@ async function probeOwnRemoval(mgr, commitBytes) {
     }, cs);
     if (!sawCommit || !removesOwn)
       return null;
-    return { ownLeafIndex: own, committerLeafIndex: committer };
+    return { ownLeafIndex: own2, committerLeafIndex: committer };
   } catch {
     return null;
   }
@@ -19311,6 +19311,33 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     }
     return { ownLeafIndex: this.ownLeafIndex(mgr), leaves };
   }
+  /**
+   * MCP client (bridge Task 16; audit H-2, round 2 H-D): a SYNCHRONOUS, read-only snapshot of the WARM in-memory
+   * manager for `channelId`: its group id, its epoch and EVERY non-blank leaf, reported exactly as
+   * {@link leafTreeSummary} reports them (non-basic credentials included, identity null, #771 HIGH-B). All three are
+   * read from ONE `state` object (MLSGroupManager replaces `state` whole on every commit), with no await, so they belong
+   * to the same epoch and no commit can land between them.
+   *
+   * `null` when no manager is warm: it never loads from the store, never takes the channel lock, never touches the
+   * network and never mutates. A caller treating `null` as "cannot tell" fails closed.
+   */
+  leafSnapshotCached(channelId) {
+    const state = this.managers.get(channelId)?.state;
+    const tree = state?.ratchetTree;
+    if (!state || !tree)
+      return null;
+    const leaves = [];
+    const numLeaves = Math.floor((tree.length + 1) / 2);
+    for (let i = 0; i < numLeaves; i++) {
+      const node = tree[i * 2];
+      if (!node || node.nodeType !== "leaf")
+        continue;
+      const cred = getCredentialFromLeafIndex(tree, toLeafIndex2(i));
+      const basic = cred.credentialType === "basic";
+      leaves.push({ leafIndex: i, basic, identity: basic ? new TextDecoder().decode(cred.identity) : null });
+    }
+    return { groupId: new TextDecoder().decode(state.groupContext.groupId), epoch: Number(state.groupContext.epoch), leaves };
+  }
   async fetchDeviceLeafCredential(deviceId) {
     const kps = await this.o.backend.fetchKeyPackages([deviceId]);
     const hex = kps[deviceId];
@@ -24728,8 +24755,8 @@ function openDeliveryPings(o) {
             return Promise.resolve({ value: void 0, done: true });
           if (queue.length)
             return Promise.resolve({ value: queue.shift(), done: false });
-          return new Promise((resolve) => {
-            waiter = resolve;
+          return new Promise((resolve2) => {
+            waiter = resolve2;
           });
         }
       };
@@ -25049,8 +25076,8 @@ var PingSubscriber = class {
             return Promise.resolve({ value: void 0, done: true });
           if (this.queue.length)
             return Promise.resolve({ value: this.queue.shift(), done: false });
-          return new Promise((resolve) => {
-            this.waiter = resolve;
+          return new Promise((resolve2) => {
+            this.waiter = resolve2;
           });
         }
       };
@@ -26644,10 +26671,12 @@ function openSchema(db) {
   ensureRuntimeReplyIntent(db);
   ensureRuntimeReplyIntentEnvelopeGroup(db);
   ensureRuntimeReplyIntentCredit(db);
+  ensureRuntimeReplyIntentMcpTurn(db);
   ensureGroupLink(db);
   ensureMlsCustody(db);
   ensureToolGrantTables(db);
   ensureToolGrantAppliedTable(db);
+  ensureToolGrantMcpSeenTable(db);
   ensureRoomSearchCapTable(db);
   ensureVoiceChannelParentTable(db);
   db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
@@ -26737,6 +26766,19 @@ function ensureRuntimeReplyIntentCredit(db) {
     throw e;
   }
 }
+function ensureRuntimeReplyIntentMcpTurn(db) {
+  const hasColumn = () => db.prepare("PRAGMA table_info(runtime_reply_intent)").all().some((c) => c.name === "mcp_turn");
+  const cols = db.prepare("PRAGMA table_info(runtime_reply_intent)").all();
+  if (cols.length === 0 || cols.some((c) => c.name === "mcp_turn"))
+    return;
+  try {
+    db.exec("ALTER TABLE runtime_reply_intent ADD COLUMN mcp_turn INTEGER NOT NULL DEFAULT 0");
+  } catch (e) {
+    if (hasColumn())
+      return;
+    throw e;
+  }
+}
 var RECALL_STATE_COLUMNS = [
   ["recall_enabled", "INTEGER NOT NULL DEFAULT 0"],
   ["recall_mode_epoch", "INTEGER NOT NULL DEFAULT 0"],
@@ -26848,6 +26890,15 @@ function ensureToolGrantAppliedTable(db) {
     );
   `);
 }
+function ensureToolGrantMcpSeenTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS tool_grant_mcp_seen (
+      identity_id  TEXT PRIMARY KEY,
+      sealed_state BLOB NOT NULL,
+      updated_at   INTEGER NOT NULL
+    );
+  `);
+}
 function ensureVoiceChannelParentTable(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS voice_channel_parent (
@@ -27788,8 +27839,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
     this.db.prepare("DELETE FROM runtime_reply_intent WHERE identity_id=? AND updated_at < ?").run(this.id, now - RUNTIME_REPLY_INTENT_RETENTION_MS);
     const info = this.db.prepare(`INSERT OR IGNORE INTO runtime_reply_intent
          (identity_id, scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-          sealed_body, sealed_envelope, state, created_at, updated_at, reply_credit)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?)`).run(this.id, input.scope, input.part, input.inReplyTo, input.channelId, input.replyMessageId, input.bodyMac, sealed, now, now, input.replyCredit ?? null);
+          sealed_body, sealed_envelope, state, created_at, updated_at, reply_credit, mcp_turn)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?, ?)`).run(this.id, input.scope, input.part, input.inReplyTo, input.channelId, input.replyMessageId, input.bodyMac, sealed, now, now, input.replyCredit ?? null, input.mcpTurn === true ? 1 : 0);
     const count = this.db.prepare("SELECT COUNT(*) AS n FROM runtime_reply_intent WHERE identity_id=?").get(this.id);
     if (count.n > RUNTIME_REPLY_INTENT_MAX) {
       this.db.prepare(`DELETE FROM runtime_reply_intent
@@ -27799,7 +27850,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
          )`).run(this.id, this.id, RUNTIME_REPLY_INTENT_MAX);
     }
     const row = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit, mcp_turn
        FROM runtime_reply_intent WHERE identity_id=? AND scope=? AND part=?`).get(this.id, input.scope, input.part);
     if (!row)
       throw new Error("reply intent vanished after claim");
@@ -27808,7 +27859,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   /** SEC-06 #18: every intent answering `inReplyTo`, in claim order. */
   async listReplyIntents(inReplyTo) {
     const rows = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit, mcp_turn
        FROM runtime_reply_intent WHERE identity_id=? AND in_reply_to=?
        ORDER BY created_at ASC, rowid ASC`).all(this.id, inReplyTo);
     const out = [];
@@ -27819,7 +27870,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   /** SEC-06 #18: re-read one intent by its key (null when absent). */
   async getReplyIntent(scope, part) {
     const row = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit, mcp_turn
        FROM runtime_reply_intent WHERE identity_id=? AND scope=? AND part=?`).get(this.id, scope, part);
     return row ? this.openReplyIntent(row) : null;
   }
@@ -27894,7 +27945,9 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       envelopeGroupId: envelopeGroupFor(envelope, await openOrNull(row.sealed_envelope_group)),
       state: row.state === "sent" ? "sent" : row.state === "skipped" ? "skipped" : "pending",
       createdAt: Number(row.created_at),
-      replyCredit: typeof row.reply_credit === "string" ? row.reply_credit : null
+      replyCredit: typeof row.reply_credit === "string" ? row.reply_credit : null,
+      // Any value other than exactly 1 (0, NULL, a missing column) is false; the bridge's MAC decides what a 1 means.
+      mcpTurn: Number(row.mcp_turn ?? 0) === 1
     };
   }
   async recordMemory(input) {
@@ -28466,10 +28519,10 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
     const r = this.db.prepare("SELECT owner_size_bytes AS b, owner_item_count AS n FROM agent_memory_state WHERE identity_id=?").get(this.id);
     if (r && Number(r.b) >= 0 && Number(r.n) >= 0)
       return { items: Number(r.n), bytes: Number(r.b) };
-    const own = this.scopeLoad("i.scope_kind='owner_dm'");
+    const own2 = this.scopeLoad("i.scope_kind='owner_dm'");
     this.ensureStateRow();
-    this.db.prepare("UPDATE agent_memory_state SET owner_size_bytes=?, owner_item_count=? WHERE identity_id=?").run(own.bytes, own.items, this.id);
-    return own;
+    this.db.prepare("UPDATE agent_memory_state SET owner_size_bytes=?, owner_item_count=? WHERE identity_id=?").run(own2.bytes, own2.items, this.id);
+    return own2;
   }
   /** Inside a transaction: delete one origin group (the row, or the parent and its chunks) and its token rows; returns the ids and the accounts it held. */
   deleteItemGroup(firstItemId) {
@@ -28643,8 +28696,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       const o2 = this.overCap();
       if (!o2.overItems && !o2.overBytes)
         break;
-      const own = this.ownerLoad();
-      const protectOwner = (!o2.overItems || own.items < this.itemCap * OWNER_DM_FLOOR_SHARE) && (!o2.overBytes || own.bytes < this.byteCap * OWNER_DM_FLOOR_SHARE);
+      const own2 = this.ownerLoad();
+      const protectOwner = (!o2.overItems || own2.items < this.itemCap * OWNER_DM_FLOOR_SHARE) && (!o2.overBytes || own2.bytes < this.byteCap * OWNER_DM_FLOOR_SHARE);
       const v = (protectOwner ? this.oldestAutoGroup({ notOwnerDm: true }) : void 0) ?? this.oldestAutoGroup({});
       if (v === void 0 || !drop(v))
         break;
@@ -28671,8 +28724,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
        FROM agent_memory_item i WHERE identity_id=?`).get(this.id);
     const tk = this.db.prepare("SELECT COUNT(*) AS n FROM agent_memory_token WHERE identity_id=?").get(this.id);
     const size = Number(it.b) + Number(it.rows) * ITEM_ROW_OVERHEAD_BYTES + Number(tk.n) * TOKEN_ROW_OVERHEAD_BYTES;
-    const own = this.scopeLoad("i.scope_kind='owner_dm'");
-    this.db.prepare("UPDATE agent_memory_state SET size_bytes=?, item_count=?, owner_size_bytes=?, owner_item_count=? WHERE identity_id=?").run(size, Number(it.n), own.bytes, own.items, this.id);
+    const own2 = this.scopeLoad("i.scope_kind='owner_dm'");
+    this.db.prepare("UPDATE agent_memory_state SET size_bytes=?, item_count=?, owner_size_bytes=?, owner_item_count=? WHERE identity_id=?").run(size, Number(it.n), own2.bytes, own2.items, this.id);
   }
   /** Inside a transaction: delete every unified row of the identity and move each channel's content epoch. */
   deleteAllItems() {
@@ -29488,9 +29541,40 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   dropToolGrantAppliedExcept(pinKeyB64) {
     return Number(this.db.prepare("DELETE FROM tool_grant_applied WHERE identity_id=? AND pin_key_b64<>?").run(this.id, pinKeyB64).changes);
   }
+  // MCP client Phase 1, Task 14 (OQ-3 ruling item 3): the sticky R-3 flag, per agent identity.
+  /**
+   * False when never written. A row that does not open, or opens to anything but this identity's own record, THROWS:
+   * the bridge then holds R-3 (fail closed). Never returns false for an unreadable row.
+   */
+  async loadMcpSeen() {
+    const row = this.db.prepare("SELECT sealed_state FROM tool_grant_mcp_seen WHERE identity_id=?").get(this.id);
+    if (!row)
+      return false;
+    const v = await this.unsealJson(row.sealed_state);
+    if (v === null || typeof v !== "object" || v.identity_id !== this.id || typeof v.seen !== "boolean") {
+      throw new MlsStoreSealError("tool_grant_mcp_seen: unexpected record");
+    }
+    return v.seen;
+  }
+  /** The sealed value names its identity, so a blob copied to another agent's row does not read as that agent's. */
+  async saveMcpSeen(seen) {
+    const sealed = await this.sealJson({ identity_id: this.id, seen });
+    this.db.prepare(`INSERT INTO tool_grant_mcp_seen (identity_id, sealed_state, updated_at) VALUES (?, ?, ?)
+       ON CONFLICT(identity_id) DO UPDATE SET sealed_state = excluded.sealed_state, updated_at = excluded.updated_at`).run(this.id, sealed, Date.now());
+  }
   hasOwnerMessage(channelId, messageId) {
     return this.db.prepare("SELECT 1 FROM owner_replay WHERE identity_id=? AND channel_id=? AND message_id=?").get(this.id, channelId, messageId) !== void 0;
   }
+  /**
+   * MCP client Phase 1, Task 18 (audit M-3): the owner replay row for a verified owner message that is NEVER staged for
+   * the runtime (an `mcp_catalog_request`), so a redelivery of it is classed `replay`, after a restart too. The same row
+   * stageRuntimeInbox writes in its staging transaction; insert-if-absent; pruned by pruneOwnerReplay like any other.
+   */
+  recordOwnerMessage(channelId, messageId, groupId, epoch, processedAt = Date.now()) {
+    this.db.prepare(`INSERT OR IGNORE INTO owner_replay
+         (identity_id, channel_id, message_id, group_id, epoch, processed_at)
+       VALUES (?, ?, ?, ?, ?, ?)`).run(this.id, channelId, messageId, groupId, epoch, processedAt);
+  }
   isOwnerEpochClosed(channelId, groupId, epoch) {
     return this.db.prepare("SELECT 1 FROM owner_replay_closed_epoch WHERE identity_id=? AND channel_id=? AND group_id=? AND epoch=?").get(this.id, channelId, groupId, epoch) !== void 0;
   }
@@ -29664,8 +29748,9 @@ function decodeReplyBody(bytes) {
   if (b?.kind === "a2a" && b.a2a && typeof b.a2a === "object") return b;
   throw new Error("reply intent body is malformed");
 }
-function replyBodyMac(key, replyId, channelId, body, credit) {
-  return createHmac("sha256", key).update(JSON.stringify(credit === void 0 ? ["reply-body", replyId, channelId] : ["reply-body", replyId, channelId, credit])).update("\0").update(body).digest("hex");
+function replyBodyMac(key, replyId, channelId, body, credit, mcpTurn) {
+  const label = mcpTurn === true ? ["reply-body", replyId, channelId, credit ?? null, "mcp_turn"] : credit === void 0 ? ["reply-body", replyId, channelId] : ["reply-body", replyId, channelId, credit];
+  return createHmac("sha256", key).update(JSON.stringify(label)).update("\0").update(body).digest("hex");
 }
 function partOrdinal(part) {
   const m = /^p:(\d+)$/.exec(part);
@@ -29706,8 +29791,96 @@ function loadPackageMeta(importMetaUrl) {
 }
 
 // src/bridge-agent.ts
-import { existsSync as existsSync5, promises as fsp, readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
-import { join as join17, dirname as dirname5 } from "node:path";
+import { existsSync as existsSync5, promises as fsp2, readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
+
+// src/outbox.ts
+import { constants, mkdirSync, lstatSync, chmodSync, realpathSync, promises as fsp } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+var VAULT_OUTBOX_DIRNAME = "vault-outbox";
+var PathOutsideOutboxError = class extends Error {
+  constructor() {
+    super("path_outside_outbox");
+    this.name = "PathOutsideOutboxError";
+  }
+};
+var POSIX = process.platform !== "win32";
+function ownedPrivateDir(st) {
+  if (st.isSymbolicLink() || !st.isDirectory()) return false;
+  if (!POSIX) return true;
+  const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
+  if (uid !== void 0 && st.uid !== uid) return false;
+  return (st.mode & 511) === 448;
+}
+function ensureOutbox(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  let st = lstatSync(dir);
+  if (st.isSymbolicLink() || !st.isDirectory()) throw new PathOutsideOutboxError();
+  const uid = POSIX && typeof process.getuid === "function" ? process.getuid() : void 0;
+  if (uid !== void 0 && st.uid !== uid) throw new PathOutsideOutboxError();
+  if (POSIX && (st.mode & 511) !== 448) {
+    chmodSync(dir, 448);
+    st = lstatSync(dir);
+  }
+  if (!ownedPrivateDir(st)) throw new PathOutsideOutboxError();
+  return { dir, real: realpathSync(dir), dev: st.dev, ino: st.ino };
+}
+var NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+var NONBLOCK = constants.O_NONBLOCK ?? 0;
+async function readOutboxFile(pin, callerPath) {
+  if (!pin) throw new PathOutsideOutboxError();
+  try {
+    const st = await fsp.lstat(pin.dir);
+    if (!ownedPrivateDir(st) || st.dev !== pin.dev || st.ino !== pin.ino) throw new PathOutsideOutboxError();
+  } catch {
+    throw new PathOutsideOutboxError();
+  }
+  const requested = resolve(pin.dir, callerPath);
+  const name = basename(requested);
+  let realParent;
+  try {
+    realParent = await fsp.realpath(dirname(requested));
+  } catch {
+    throw new PathOutsideOutboxError();
+  }
+  if (realParent !== pin.real) throw new PathOutsideOutboxError();
+  const target = join(pin.real, name);
+  const pre = await fsp.lstat(target);
+  if (pre.isSymbolicLink() || !pre.isFile()) throw new PathOutsideOutboxError();
+  let handle;
+  try {
+    handle = await fsp.open(target, constants.O_RDONLY | NOFOLLOW | NONBLOCK);
+  } catch (e) {
+    if (e.code === "ENOENT") throw e;
+    throw new PathOutsideOutboxError();
+  }
+  try {
+    const st = await handle.stat();
+    if (!st.isFile() || st.dev !== pre.dev || st.ino !== pre.ino || st.nlink !== 1) {
+      throw new PathOutsideOutboxError();
+    }
+    return { bytes: new Uint8Array(await handle.readFile()), path: target, dev: st.dev, ino: st.ino };
+  } finally {
+    await handle.close().catch(() => {
+    });
+  }
+}
+async function consumeOutboxFile(pin, read) {
+  try {
+    const dir = await fsp.lstat(pin.dir);
+    if (!ownedPrivateDir(dir) || dir.dev !== pin.dev || dir.ino !== pin.ino) return false;
+    if (await fsp.realpath(pin.dir) !== pin.real) return false;
+    const target = join(pin.real, basename(read.path));
+    const st = await fsp.lstat(target);
+    if (st.isSymbolicLink() || st.dev !== read.dev || st.ino !== read.ino) return false;
+    await fsp.unlink(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/bridge-agent.ts
+import { join as join18, dirname as dirname6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/latency.ts
@@ -30205,11 +30378,21 @@ function pinCoverage(pinStripped, ownerMessage, coverTexts) {
 }
 
 // src/attachments.ts
-import { basename } from "node:path";
+import { basename as basename2 } from "node:path";
 var VAULT_REF_MAX_SIZE_HINT = 100 * 1024 * 1024 - 16;
 var VAULT_REF_MAX_NAME = 255;
 var VAULT_REF_MAX_MIME = 127;
 var CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var InvalidBlobIdError = class extends Error {
+  constructor() {
+    super("invalid_blob_id");
+    this.name = "InvalidBlobIdError";
+  }
+};
+function assertBlobId(blobId) {
+  if (typeof blobId !== "string" || !CANONICAL_UUID.test(blobId)) throw new InvalidBlobIdError();
+  return blobId;
+}
 var VAULT_PIN = /^blake2b:[0-9a-f]{64}$/;
 var HINT_FORBIDDEN = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/;
 var MIME_TYPE = /^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*$/;
@@ -30248,7 +30431,7 @@ function toVaultRefEntry(body) {
   return entry;
 }
 function sanitizeFilename(name, fallback) {
-  const base = basename(name ?? "");
+  const base = basename2(name ?? "");
   const cleaned = base.replace(/[/\\]/g, "").replace(/^\.+$/, "");
   return cleaned.length > 0 ? cleaned : fallback;
 }
@@ -30278,7 +30461,7 @@ function mimeForName(name) {
 async function prepareAttachment(filePath2, caption, channelId, deps) {
   await deps.ready();
   const bytes = await deps.readFile(filePath2);
-  const name = basename(filePath2);
+  const name = basename2(filePath2);
   const { encryptedData, fileKey, fileNonce, digest } = await deps.encryptFile(bytes);
   const blobId = await deps.uploadBlob(encryptedData, channelId);
   const body = {
@@ -30296,8 +30479,9 @@ async function prepareAttachment(filePath2, caption, channelId, deps) {
   return body;
 }
 async function materializeAttachment(body, ctx, deps) {
+  const blobId = assertBlobId(body.blobId);
   await deps.ready();
-  const ciphertext = await deps.downloadBlob(body.blobId);
+  const ciphertext = await deps.downloadBlob(blobId);
   const sha25612 = await deps.computeFileDigest(ciphertext);
   if (sha25612 !== body.digest) {
     throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
@@ -30323,13 +30507,13 @@ function ensureSodiumReady2() {
 // src/memory/hermes-session-map.ts
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 function expandHome(p) {
-  return p === "~" || p.startsWith("~/") ? join(homedir(), p.slice(1)) : p;
+  return p === "~" || p.startsWith("~/") ? join2(homedir(), p.slice(1)) : p;
 }
 function resolveHermesSession(baseDir, conversationId) {
   try {
-    const path = join(expandHome(baseDir), "sessions", "sessions.json");
+    const path = join2(expandHome(baseDir), "sessions", "sessions.json");
     const map = JSON.parse(readFileSync(path, "utf8"));
     const entry = map[`agent:main:securecoms:dm:${conversationId}`];
     const sid = entry?.session_id;
@@ -30341,11 +30525,11 @@ function resolveHermesSession(baseDir, conversationId) {
 
 // src/memory/hermes-store.ts
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 var HermesStore = class {
   dbPath;
   constructor(baseDir) {
-    this.dbPath = join2(expandHome(baseDir), "state.db");
+    this.dbPath = join3(expandHome(baseDir), "state.db");
   }
   /** Recent-K conversational turns for a session, chronological. Fail-safe → []. */
   readRecent(sessionId, limit) {
@@ -30487,10 +30671,10 @@ var HermesMemoryProvider = class {
 
 // src/memory/openclaw-session-map.ts
 import { readFileSync as readFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 function resolveOwnerDmSession(baseDir, agent) {
   try {
-    const path = join3(expandHome(baseDir), "agents", agent, "sessions", "sessions.json");
+    const path = join4(expandHome(baseDir), "agents", agent, "sessions", "sessions.json");
     const map = JSON.parse(readFileSync2(path, "utf8"));
     let best = null;
     for (const [key, entry] of Object.entries(map)) {
@@ -30508,11 +30692,11 @@ function resolveOwnerDmSession(baseDir, agent) {
 
 // src/memory/openclaw-session-log.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 function readRecentTurns(baseDir, agent, sessionId, k) {
   let raw;
   try {
-    raw = readFileSync3(join4(expandHome(baseDir), "agents", agent, "sessions", `${sessionId}.jsonl`), "utf8");
+    raw = readFileSync3(join5(expandHome(baseDir), "agents", agent, "sessions", `${sessionId}.jsonl`), "utf8");
   } catch {
     return [];
   }
@@ -30543,7 +30727,7 @@ function readRecentTurns(baseDir, agent, sessionId, k) {
 
 // src/memory/openclaw-workspace-facts.ts
 import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var DEFAULT_FACTS_BUDGET = 8e3;
 var MEMORY_MD_CAP = 6e3;
 var MIN_FRAGMENT = 200;
@@ -30554,7 +30738,7 @@ function resolveWorkspaceDir(baseDir, agent, override) {
   const base = expandHome(baseDir);
   const isMain = agent === "" || agent === "main";
   try {
-    const cfg = JSON.parse(readFileSync4(join5(base, "openclaw.json"), "utf8"));
+    const cfg = JSON.parse(readFileSync4(join6(base, "openclaw.json"), "utf8"));
     const agents = cfg?.agents;
     if (agents && typeof agents === "object") {
       const list = Array.isArray(agents.list) ? agents.list : [];
@@ -30567,7 +30751,7 @@ function resolveWorkspaceDir(baseDir, agent, override) {
     }
   } catch {
   }
-  return isMain ? join5(base, "workspace") : join5(base, `workspace-${agent}`);
+  return isMain ? join6(base, "workspace") : join6(base, `workspace-${agent}`);
 }
 var TRUNC = "\u2026[truncated]";
 function headSlice(s, n) {
@@ -30597,7 +30781,7 @@ function readWorkspaceFacts(baseDir, agent, opts) {
   let truncated = false;
   let remaining = budget;
   try {
-    const r = readBounded(join5(dir, "MEMORY.md"));
+    const r = readBounded(join6(dir, "MEMORY.md"));
     if (r.oversize) truncated = true;
     else if (r.text && r.text.trim()) {
       const { text, clipped } = headSlice(r.text, Math.min(MEMORY_MD_CAP, budget));
@@ -30610,7 +30794,7 @@ ${TRUNC}` : ""}`);
   } catch {
   }
   try {
-    const dailies = readdirSync(join5(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
+    const dailies = readdirSync(join6(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
     for (const f of dailies) {
       if (remaining < MIN_FRAGMENT) {
         truncated = true;
@@ -30618,7 +30802,7 @@ ${TRUNC}` : ""}`);
       }
       let r;
       try {
-        r = readBounded(join5(dir, "memory", f));
+        r = readBounded(join6(dir, "memory", f));
       } catch {
         continue;
       }
@@ -31281,8 +31465,8 @@ var MembershipPurgeSweeper = class {
       const dms = /* @__PURE__ */ new Set();
       for (const c of this.d.conversations()) {
         if (stopping()) return { purged: [], held: 0, absent: 0 };
-        const own = this.d.enclaveOf(c);
-        const channels = own === void 0 ? void 0 : listed.get(own);
+        const own2 = this.d.enclaveOf(c);
+        const channels = own2 === void 0 ? void 0 : listed.get(own2);
         if (channels === void 0) continue;
         if (channels.has(c)) {
           this.d.clearAbsence(c);
@@ -31357,21 +31541,21 @@ function parsePayloadMemory(raw) {
 
 // src/memory/embedder/client.ts
 import { connect } from "node:net";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync7, rmSync as rmSync6, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync6, statSync as statSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 // src/memory/embedder/download.ts
 import { createHash as createHash2, randomBytes as randomBytes6 } from "node:crypto";
-import { chmodSync as chmodSync2, rmSync as rmSync2 } from "node:fs";
+import { chmodSync as chmodSync3, rmSync as rmSync2 } from "node:fs";
 import { open } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 
 // src/memory/embedder/layout.ts
-import { chmodSync, lstatSync, mkdirSync, renameSync, rmSync } from "node:fs";
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync2, renameSync, rmSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, dirname, join as join6 } from "node:path";
-var defaultModelsRoot = (home = homedir2()) => join6(home, ".securecoms", "models", "embeddings");
-var filePath = (root3, modelId, f) => join6(root3, modelId, f.sha256, f.name);
+import { basename as basename3, dirname as dirname2, join as join7 } from "node:path";
+var defaultModelsRoot = (home = homedir2()) => join7(home, ".securecoms", "models", "embeddings");
+var filePath = (root3, modelId, f) => join7(root3, modelId, f.sha256, f.name);
 var LayoutRefused = class extends Error {
   constructor() {
     super("the model directory is not a plain directory");
@@ -31379,32 +31563,32 @@ var LayoutRefused = class extends Error {
 };
 function kind(p) {
   try {
-    return lstatSync(p).isDirectory() ? "dir" : "other";
+    return lstatSync2(p).isDirectory() ? "dir" : "other";
   } catch (e) {
     if (e.code === "ENOENT") return "absent";
     throw e;
   }
 }
 function plainDirChain(root3, parts, opts) {
-  const modelsDir = dirname(root3);
+  const modelsDir = dirname2(root3);
   for (const part of parts) if (!part || part === "." || part === ".." || part.includes("/") || part.includes("\\")) throw new LayoutRefused();
   const k = kind(modelsDir);
   if (k === "other") throw new LayoutRefused();
   if (k === "absent") {
     if (!opts.create) return null;
-    mkdirSync(modelsDir, { recursive: true, mode: 448 });
+    mkdirSync2(modelsDir, { recursive: true, mode: 448 });
     if (kind(modelsDir) !== "dir") throw new LayoutRefused();
   }
-  const chain = opts.fromModelsDir ? parts : [basename2(root3), ...parts];
+  const chain = opts.fromModelsDir ? parts : [basename3(root3), ...parts];
   let p = modelsDir;
   for (let i = 0; i < chain.length; i++) {
-    p = join6(p, chain[i]);
+    p = join7(p, chain[i]);
     const c = kind(p);
     if (c === "other") throw new LayoutRefused();
     if (c === "absent") {
       if (!opts.create) return null;
       try {
-        mkdirSync(p, { mode: i === chain.length - 1 && opts.mode !== void 0 ? opts.mode : 493 });
+        mkdirSync2(p, { mode: i === chain.length - 1 && opts.mode !== void 0 ? opts.mode : 493 });
       } catch (e) {
         if (e.code !== "EEXIST") throw e;
       }
@@ -31415,7 +31599,7 @@ function plainDirChain(root3, parts, opts) {
 }
 function presentWithSize(p, size) {
   try {
-    const s = lstatSync(p);
+    const s = lstatSync2(p);
     return s.isFile() && s.size === size;
   } catch {
     return false;
@@ -31423,7 +31607,7 @@ function presentWithSize(p, size) {
 }
 function wrongTypeAt(p) {
   try {
-    const s = lstatSync(p);
+    const s = lstatSync2(p);
     return !s.isFile() && !s.isSymbolicLink();
   } catch {
     return false;
@@ -31436,16 +31620,16 @@ function installVerified(root3, modelId, f, partial, opts) {
     dir = plainDirChain(root3, [modelId, f.sha256], { create: true });
     if (!dir) throw new LayoutRefused();
     if (!opts.replace && presentWithSize(dest, f.size)) return;
-    chmodSync(dir, 493);
+    chmodSync2(dir, 493);
     try {
       renameSync(partial, dest);
     } catch (e) {
       if (!presentWithSize(dest, f.size)) throw e;
       return;
     }
-    chmodSync(dest, 292);
+    chmodSync2(dest, 292);
   } finally {
-    if (dir) chmodSync(dir, 365);
+    if (dir) chmodSync2(dir, 365);
     rmSync(partial, { force: true });
   }
 }
@@ -31465,8 +31649,8 @@ function removeModelFiles(root3, m) {
   for (const f of m.files) {
     const dir = plainDirChain(root3, [m.modelId, f.sha256], { create: false });
     if (!dir) continue;
-    chmodSync2(dir, 493);
-    rmSync2(join7(dir, f.name), { force: true });
+    chmodSync3(dir, 493);
+    rmSync2(join8(dir, f.name), { force: true });
   }
 }
 var VerifyFailed = class extends Error {
@@ -31513,7 +31697,7 @@ async function fetchSameOrigin(url, origin, fetchImpl, signal, stallMs, abort) {
 async function downloadOne(f, o) {
   if (wrongTypeAt(filePath(o.root, o.modelId, f))) throw new WrongType("wrong type at model path");
   const pdir = plainDirChain(o.root, [".partial"], { create: true, fromModelsDir: true, mode: 448 });
-  const partial = join7(pdir, randomBytes6(12).toString("hex"));
+  const partial = join8(pdir, randomBytes6(12).toString("hex"));
   const fh = await open(partial, "wx", 384);
   const ac = new AbortController();
   const abort = () => ac.abort();
@@ -31589,17 +31773,17 @@ async function ensureModelFiles(o) {
 }
 
 // src/memory/embedder/gc.ts
-import { chmodSync as chmodSync3, closeSync, constants, fstatSync, futimesSync, lstatSync as lstatSync2, openSync, readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
-import { join as join8 } from "node:path";
+import { chmodSync as chmodSync4, closeSync, constants as constants2, fstatSync, futimesSync, lstatSync as lstatSync3, openSync, readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
+import { join as join9 } from "node:path";
 var THIRTY_DAYS = 30 * 864e5;
 var SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
 function touchUserMarker(root3, modelId, identityId) {
   if (!SAFE_ID.test(identityId)) throw new Error("invalid identity id for the model marker");
   const dir = plainDirChain(root3, [modelId, ".users"], { create: true });
-  const p = join8(dir, identityId);
+  const p = join9(dir, identityId);
   let fd;
   try {
-    fd = openSync(p, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK, 420);
+    fd = openSync(p, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_NOFOLLOW | constants2.O_NONBLOCK, 420);
   } catch {
     throw new Error("the model marker is not a regular file");
   }
@@ -31613,22 +31797,22 @@ function touchUserMarker(root3, modelId, identityId) {
 }
 function isRealDir(p) {
   try {
-    return lstatSync2(p).isDirectory();
+    return lstatSync3(p).isDirectory();
   } catch {
     return false;
   }
 }
 function makeWritable(p) {
   if (!isRealDir(p)) return;
-  chmodSync3(p, 493);
-  for (const e of readdirSync2(p)) makeWritable(join8(p, e));
+  chmodSync4(p, 493);
+  for (const e of readdirSync2(p)) makeWritable(join9(p, e));
 }
 function newestMarkerMs(users) {
   if (!isRealDir(users)) return void 0;
   let newest;
   for (const u of readdirSync2(users)) {
     try {
-      const s = lstatSync2(join8(users, u));
+      const s = lstatSync3(join9(users, u));
       if (!s.isFile()) continue;
       newest = newest === void 0 ? s.mtimeMs : Math.max(newest, s.mtimeMs);
     } catch {
@@ -31641,9 +31825,9 @@ function gcModels(root3, keepModelIds, now, maxAgeMs = THIRTY_DAYS) {
   const removed = [];
   for (const modelId of readdirSync2(root3).sort()) {
     if (modelId.startsWith(".") || keepModelIds.includes(modelId)) continue;
-    const tree = join8(root3, modelId);
+    const tree = join9(root3, modelId);
     if (!isRealDir(tree)) continue;
-    const lastUse = newestMarkerMs(join8(tree, ".users")) ?? lstatSync2(tree).mtimeMs;
+    const lastUse = newestMarkerMs(join9(tree, ".users")) ?? lstatSync3(tree).mtimeMs;
     if (now - lastUse <= maxAgeMs) continue;
     makeWritable(tree);
     rmSync3(tree, { recursive: true, force: true });
@@ -31776,44 +31960,44 @@ var SealedChannel = class {
 // src/memory/embedder/embedder-paths.ts
 import { createHash as createHash3 } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function embedderKey(m) {
   const model = m.files.find((f) => f.name === "model.onnx");
   return createHash3("sha256").update(`${EMBEDDER_PROTOCOL}\0${m.modelId}\0${model.sha256}\0${m.wasmSha256}`).digest("hex").slice(0, 16);
 }
-var embedderRunDir = (home = homedir3()) => join9(home, ".securecoms", "run", "embedder");
+var embedderRunDir = (home = homedir3()) => join10(home, ".securecoms", "run", "embedder");
 var embedderPaths = (dir, key) => ({
-  sock: join9(dir, `${key}.sock`),
-  token: join9(dir, `${key}.token`),
-  lock: join9(dir, `${key}.spawn.lock`),
-  status: join9(dir, `${key}.status`),
-  pid: join9(dir, `${key}.pid`)
+  sock: join10(dir, `${key}.sock`),
+  token: join10(dir, `${key}.token`),
+  lock: join10(dir, `${key}.spawn.lock`),
+  status: join10(dir, `${key}.status`),
+  pid: join10(dir, `${key}.pid`)
   // E1 delta H1: the instance's lifetime lock
 });
 var SOCKET_PATH_MAX = 103;
 var windowsRunDir = (env = process.env) => {
   if (!env.LOCALAPPDATA) throw new Error("LOCALAPPDATA unset");
-  return join9(env.LOCALAPPDATA, "SecureComs", "run", "embedder");
+  return join10(env.LOCALAPPDATA, "SecureComs", "run", "embedder");
 };
 
 // src/memory/embedder/spawn.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, realpathSync } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync4, realpathSync as realpathSync2 } from "node:fs";
 
 // src/memory/embedder/run-dir.ts
-import { existsSync, lstatSync as lstatSync3, mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { existsSync, lstatSync as lstatSync4, mkdirSync as mkdirSync3 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
 var RunDirRefused = class extends Error {
 };
-function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync3) {
-  const parent3 = dirname2(dir);
-  if (!existsSync(parent3)) mkdirSync2(parent3, { recursive: true, mode: 448 });
+function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync4) {
+  const parent3 = dirname3(dir);
+  if (!existsSync(parent3)) mkdirSync3(parent3, { recursive: true, mode: 448 });
   const ps = lstat(parent3);
   if (ps.isSymbolicLink() || !ps.isDirectory()) throw new RunDirRefused("run directory parent is not a real directory");
   if (ps.uid !== uid) throw new RunDirRefused("run directory parent is not owned by this user");
   if ((ps.mode & 18) !== 0) throw new RunDirRefused("run directory parent is group or world writable");
   try {
-    mkdirSync2(dir, { mode: 448 });
+    mkdirSync3(dir, { mode: 448 });
   } catch (e) {
     if (e.code !== "EEXIST") throw e;
   }
@@ -31824,10 +32008,10 @@ function ensureRunDir(dir, uid = process.getuid?.() ?? -1, lstat = lstatSync3) {
 }
 
 // src/memory/embedder/spawn.ts
-import { basename as basename3, dirname as dirname3, join as join10 } from "node:path";
+import { basename as basename4, dirname as dirname4, join as join11 } from "node:path";
 
 // src/memory/embedder/locks.ts
-import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, linkSync, openSync as openSync2, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync4, writeSync } from "node:fs";
+import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, linkSync, openSync as openSync2, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync4, writeSync } from "node:fs";
 import { randomBytes as randomBytes9 } from "node:crypto";
 import { uptime } from "node:os";
 var LOCK_STALE_MS = 1e4;
@@ -31849,7 +32033,7 @@ var PROCESS_LOCK_ENV = {
 function inspect(path) {
   let fd;
   try {
-    fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    fd = openSync2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
   } catch {
     return null;
   }
@@ -31873,7 +32057,7 @@ function takeLock(path, now = Date.now, env = PROCESS_LOCK_ENV) {
   const id = `${env.pid} ${env.bootTime()} ${env.startTime()} ${randomBytes9(8).toString("hex")}`;
   for (let attempt = 0; attempt < 3; attempt++) {
     try {
-      const fd = openSync2(path, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+      const fd = openSync2(path, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
       try {
         writeSync(fd, id);
       } finally {
@@ -31934,7 +32118,7 @@ function embedderEnv(env = process.env, platform = process.platform) {
 }
 var withReal = (p) => {
   try {
-    const r = realpathSync(p);
+    const r = realpathSync2(p);
     return r === p ? [p] : [p, r];
   } catch {
     return [p];
@@ -31942,10 +32126,10 @@ var withReal = (p) => {
 };
 var realish = (p) => {
   try {
-    return realpathSync(p);
+    return realpathSync2(p);
   } catch {
-    const up = dirname3(p);
-    return up === p ? p : join10(realish(up), basename3(p));
+    const up = dirname4(p);
+    return up === p ? p : join11(realish(up), basename4(p));
   }
 };
 var both = (p) => {
@@ -31957,7 +32141,7 @@ function spawnEmbedder(o) {
   const run = o.runDir ?? embedderRunDir(o.home);
   const win = (o.platform ?? process.platform) === "win32";
   if (o.createRunDir !== false) {
-    if (win) mkdirSync3(run, { recursive: true, mode: 448 });
+    if (win) mkdirSync4(run, { recursive: true, mode: 448 });
     else ensureRunDir(run);
   }
   const perm = permissionFlags();
@@ -31966,13 +32150,13 @@ function spawnEmbedder(o) {
     o.onNoPermissionModel?.();
   }
   const reads = perm.length === 0 ? [] : [
-    ...withReal(dirname3(o.distDir)),
+    ...withReal(dirname4(o.distDir)),
     ...existsSync2(defaultModelsRoot(o.home)) ? withReal(defaultModelsRoot(o.home)) : [defaultModelsRoot(o.home)],
-    ...both(dirname3(run)),
-    ...win ? both(join10(o.home, ".securecoms", "run")) : []
+    ...both(dirname4(run)),
+    ...win ? both(join11(o.home, ".securecoms", "run")) : []
     // the voice-call heartbeats (the run dir lives elsewhere)
   ];
-  const script = withReal(join10(o.distDir, "embedder.js")).at(-1);
+  const script = withReal(join11(o.distDir, "embedder.js")).at(-1);
   const net = (o.nodeFlags ?? process.allowedNodeEnvironmentFlags).has("--allow-net") ? ["--allow-net"] : [];
   const flags = perm.length === 0 ? [] : [...perm, ...reads.map((r) => `--allow-fs-read=${r}`), ...both(run).map((w) => `--allow-fs-write=${w}`), "--allow-worker", ...net];
   const child = (o.spawnFn ?? spawn)(
@@ -31981,7 +32165,7 @@ function spawnEmbedder(o) {
     // 11c review LOW 3, fixed by the Task 12 Mini gate: cwd is the run directory's PARENT, which the bridge created (0700)
     // before spawning; the run directory itself is created by the embedder, so on a first start it does not exist yet and
     // a cwd there fails the spawn with ENOENT. Never the bridge's working directory.
-    { detached: true, stdio: "ignore", windowsHide: true, cwd: dirname3(run), env: win ? { ...embedderEnv(process.env, "win32"), USERPROFILE: o.home, LOCALAPPDATA: dirname3(dirname3(dirname3(run))) } : { ...embedderEnv(), HOME: o.home } }
+    { detached: true, stdio: "ignore", windowsHide: true, cwd: dirname4(run), env: win ? { ...embedderEnv(process.env, "win32"), USERPROFILE: o.home, LOCALAPPDATA: dirname4(dirname4(dirname4(run))) } : { ...embedderEnv(), HOME: o.home } }
   );
   child.unref();
   child.on("error", () => {
@@ -31993,8 +32177,8 @@ function spawnEmbedder(o) {
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { randomBytes as randomBytes10 } from "node:crypto";
-import { lstatSync as lstatSync4, readFileSync as readFileSync6, rmSync as rmSync5 } from "node:fs";
-import { join as join11, win32 } from "node:path";
+import { lstatSync as lstatSync5, readFileSync as readFileSync6, rmSync as rmSync5 } from "node:fs";
+import { join as join12, win32 } from "node:path";
 var WINDOWS_SEMANTIC_ENABLED = false;
 var windowsSemanticOn = (platform, enabled = WINDOWS_SEMANTIC_ENABLED) => platform !== "win32" || enabled;
 function parseSaveSddl(saveFile) {
@@ -32022,7 +32206,7 @@ function aclAllows(sddl, ownerSid) {
   if (aces.length === 0 || rest !== "" && !rest.startsWith("S:")) return false;
   return aces.every((a) => a[0] === "A" && allowed.has(a[5] ?? "") || a[0] === "D");
 }
-function hasReparsePoint(path, lstat = lstatSync4) {
+function hasReparsePoint(path, lstat = lstatSync5) {
   const root3 = win32.parse(path).root;
   let cur = root3;
   for (const part of path.slice(root3.length).split(/[\\/]/).filter(Boolean)) {
@@ -32041,7 +32225,7 @@ async function currentUserSid(run = defaultRunner) {
 }
 async function verifyRunDirAcl(path, deps = {}, sid) {
   const run = deps.run ?? defaultRunner;
-  const out = join11(deps.tmp ?? process.env.TEMP ?? process.env.TMP ?? ".", `sc-acl-${randomBytes10(8).toString("hex")}.txt`);
+  const out = join12(deps.tmp ?? process.env.TEMP ?? process.env.TMP ?? ".", `sc-acl-${randomBytes10(8).toString("hex")}.txt`);
   try {
     if (hasReparsePoint(path, deps.lstat)) return false;
     const user = await (sid ? sid() : currentUserSid(run));
@@ -32122,12 +32306,12 @@ var EmbedderClient = class {
   ready(ms) {
     if (this.st.state === "ready") return Promise.resolve(true);
     if (this.st.state !== "preparing" || !(ms > 0)) return Promise.resolve(false);
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       let t;
       const w = (ok) => {
         clearTimeout(t);
         this.readyWaiters.delete(w);
-        resolve(ok);
+        resolve2(ok);
       };
       this.readyWaiters.add(w);
       t = setTimeout(() => w(false), ms);
@@ -32236,7 +32420,7 @@ var EmbedderClient = class {
     const p = this.paths();
     if (!this.tcp() && Buffer.byteLength(`${p.sock}.00000000`) > SOCKET_PATH_MAX) return this.fail("run_dir_refused");
     if (this.tcp()) {
-      mkdirSync4(this.runDir(), { recursive: true, mode: 448 });
+      mkdirSync5(this.runDir(), { recursive: true, mode: 448 });
       if (!await this.aclOk(true)) return this.fail("acl_unverified");
     }
     if (!this.tcp()) {
@@ -32372,7 +32556,7 @@ var EmbedderClient = class {
       }
       if (this.closed) return false;
     }
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const s = this.tcp() ? connect({ host: "127.0.0.1", port: pub.port }) : connect(p.sock);
       const nc = nonce();
       let ns = "";
@@ -32385,7 +32569,7 @@ var EmbedderClient = class {
         if (!settled) {
           settled = true;
           clearTimeout(t);
-          resolve(ok);
+          resolve2(ok);
         }
       }
       const refuse2 = (reason) => {
@@ -32950,12 +33134,12 @@ var ReembedQueue = class {
 };
 
 // src/memory/recall/call-heartbeat.ts
-import { closeSync as closeSync3, constants as constants3, fstatSync as fstatSync3, futimesSync as futimesSync2, openSync as openSync3, rmSync as rmSync7 } from "node:fs";
-import { join as join13 } from "node:path";
+import { closeSync as closeSync3, constants as constants4, fstatSync as fstatSync3, futimesSync as futimesSync2, openSync as openSync3, rmSync as rmSync7 } from "node:fs";
+import { join as join14 } from "node:path";
 
 // src/memory/embedder/heartbeats.ts
-import { lstatSync as lstatSync5, readdirSync as readdirSync3 } from "node:fs";
-import { join as join12 } from "node:path";
+import { lstatSync as lstatSync6, readdirSync as readdirSync3 } from "node:fs";
+import { join as join13 } from "node:path";
 var HEARTBEAT_FUTURE_SKEW_MS = 6e4;
 var HEARTBEAT_STALE_MS = 3e4;
 function heartbeatAgeFresh(ageMs, staleMs = HEARTBEAT_STALE_MS) {
@@ -32970,7 +33154,7 @@ function anyHeartbeatFresh(dir, now, staleMs = HEARTBEAT_STALE_MS) {
   }
   return names.some((n) => {
     try {
-      const st = lstatSync5(join12(dir, n));
+      const st = lstatSync6(join13(dir, n));
       return st.isFile() && heartbeatAgeFresh(now - st.mtimeMs, staleMs);
     } catch {
       return false;
@@ -33036,7 +33220,7 @@ var CallHeartbeat = class {
     if (dir === null) return;
     let fd;
     try {
-      fd = openSync3(join13(dir, this.identityId), constants3.O_WRONLY | constants3.O_CREAT | constants3.O_NOFOLLOW | constants3.O_NONBLOCK, 384);
+      fd = openSync3(join14(dir, this.identityId), constants4.O_WRONLY | constants4.O_CREAT | constants4.O_NOFOLLOW | constants4.O_NONBLOCK, 384);
       if (!fstatSync3(fd).isFile()) return;
       const t = new Date(this.now());
       futimesSync2(fd, t, t);
@@ -33051,7 +33235,7 @@ var CallHeartbeat = class {
     const dir = SAFE_ID2.test(this.identityId) ? this.dirOk() : null;
     if (dir === null) return;
     try {
-      rmSync7(join13(dir, this.identityId), { force: true });
+      rmSync7(join14(dir, this.identityId), { force: true });
       this.wrote = false;
     } catch (e) {
       this.log("warn", "memory.call_heartbeat_failed", {}, e);
@@ -33114,9 +33298,9 @@ function queryTokenMacs(key, text, max = QUERY_MACS_MAX) {
 
 // src/memory/unified/ranking-client.ts
 import { Worker } from "node:worker_threads";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function workerTransport(init, distDir) {
-  const w = new Worker(join14(distDir, "memory-worker.js"), { workerData: init });
+  const w = new Worker(join15(distDir, "memory-worker.js"), { workerData: init });
   return {
     post: (m) => w.postMessage(m),
     onMessage: (cb) => {
@@ -33176,15 +33360,15 @@ var RankingClient = class {
   ask(build, deadlineAt) {
     const id = ++this.seq;
     if (this.closed) return Promise.resolve("failed");
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const timer = setTimeout(() => {
         this.waiting.delete(id);
         this.misses++;
-        resolve("late");
+        resolve2("late");
       }, Math.max(0, deadlineAt - Date.now()));
       this.waiting.set(id, { resolve: (m) => {
         clearTimeout(timer);
-        resolve(m);
+        resolve2(m);
       } });
       try {
         this.transport().post(build(id));
@@ -33193,7 +33377,7 @@ var RankingClient = class {
         this.waiting.delete(id);
         this.misses++;
         (this.d.log ?? writeServiceLog2)("warn", "memory.ranking_worker_spawn_failed", void 0, e);
-        resolve("failed");
+        resolve2("failed");
       }
     });
   }
@@ -34787,17 +34971,17 @@ async function runSummarize(opts) {
 // src/service/runtime-config-dir.ts
 import { createHash as createHash5, randomUUID } from "node:crypto";
 import {
-  chmodSync as chmodSync4,
+  chmodSync as chmodSync5,
   existsSync as existsSync4,
-  lstatSync as lstatSync6,
-  mkdirSync as mkdirSync5,
+  lstatSync as lstatSync7,
+  mkdirSync as mkdirSync6,
   readFileSync as readFileSync8,
   renameSync as renameSync3,
   statSync as statSync3,
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { basename as basename4, isAbsolute, join as join15 } from "node:path";
+import { basename as basename5, isAbsolute, join as join16 } from "node:path";
 
 // src/grants/search-providers.ts
 var SEARCH_PROVIDERS = /* @__PURE__ */ new Set(["brave", "tavily", "parallel", "exa", "firecrawl"]);
@@ -34809,18 +34993,18 @@ function isSearchProvider(value) {
 // src/service/runtime-config-dir.ts
 var MEMORY_FILE = "MEMORY.md";
 var REAL_FS = {
-  mkdir: (p, mode) => mkdirSync5(p, { recursive: true, mode }),
-  chmod: (p, mode) => chmodSync4(p, mode),
+  mkdir: (p, mode) => mkdirSync6(p, { recursive: true, mode }),
+  chmod: (p, mode) => chmodSync5(p, mode),
   writeFile: (p, data, mode) => writeFileSync(p, data, { mode }),
   rename: (a, b) => renameSync3(a, b),
   readFile: (p) => readFileSync8(p, "utf8"),
   unlink: (p) => unlinkSync(p)
 };
 function runtimeConfigDir(home, identityId) {
-  return join15(home, ".securecoms", "runtime-config", identityId);
+  return join16(home, ".securecoms", "runtime-config", identityId);
 }
 function assertManagedName(name) {
-  if (!name || name.includes("/") || name.includes("\\") || name === "." || name === ".." || name !== basename4(name)) {
+  if (!name || name.includes("/") || name.includes("\\") || name === "." || name === ".." || name !== basename5(name)) {
     throw new Error(`refusing managed config file name ${JSON.stringify(name)}: not a plain filename`);
   }
   if (isLocalOnlyName(name)) {
@@ -34829,24 +35013,46 @@ function assertManagedName(name) {
 }
 function isLocalOnlyName(name) {
   const n = name.toLowerCase().replace(/[. ]+$/, "");
-  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets" || n === MANIFEST_POLICY_FILE;
+  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets" || n === MANIFEST_POLICY_FILE || n === MCP_POLICY_FILE;
 }
 var MANIFEST_POLICY_FILE = "manifest-policy.json";
 function removeManagedLlmSource(home, identityId, deps = REAL_FS) {
   try {
-    deps.unlink(join15(runtimeConfigDir(home, identityId), "llm-source.json"));
+    deps.unlink(join16(runtimeConfigDir(home, identityId), "llm-source.json"));
   } catch (e) {
     if (e?.code !== "ENOENT") throw e;
   }
 }
 function writeManifestPolicy(home, identityId, policy, deps = REAL_FS) {
-  const parent3 = join15(home, ".securecoms", "runtime-config");
+  const parent3 = join16(home, ".securecoms", "runtime-config");
+  const dir = runtimeConfigDir(home, identityId);
+  for (const d of [join16(home, ".securecoms"), parent3, dir]) {
+    deps.mkdir(d, 448);
+    deps.chmod(d, 448);
+  }
+  atomicWrite(join16(dir, MANIFEST_POLICY_FILE), JSON.stringify(policy) + "\n", deps);
+}
+var MCP_POLICY_FILE = "mcp-policy.json";
+var MCP_POLICY_TOP_STATES = Object.freeze([
+  "ok",
+  "not_entitled",
+  "kill_switch",
+  "suspended",
+  "no_config",
+  "switch_off",
+  "no_manifest",
+  "malformed",
+  "no_capability",
+  "section_absent"
+]);
+function writeMcpPolicy(home, identityId, doc, deps = REAL_FS) {
+  const parent3 = join16(home, ".securecoms", "runtime-config");
   const dir = runtimeConfigDir(home, identityId);
-  for (const d of [join15(home, ".securecoms"), parent3, dir]) {
+  for (const d of [join16(home, ".securecoms"), parent3, dir]) {
     deps.mkdir(d, 448);
     deps.chmod(d, 448);
   }
-  atomicWrite(join15(dir, MANIFEST_POLICY_FILE), JSON.stringify(policy) + "\n", deps);
+  atomicWrite(join16(dir, MCP_POLICY_FILE), JSON.stringify(doc) + "\n", deps);
 }
 function atomicWrite(path, body, deps) {
   const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -34865,13 +35071,13 @@ function atomicWrite(path, body, deps) {
 function writeManagedFiles(home, identityId, files, deps = REAL_FS) {
   const entries = Object.entries(files);
   for (const [name] of entries) assertManagedName(name);
-  const parent3 = join15(home, ".securecoms", "runtime-config");
+  const parent3 = join16(home, ".securecoms", "runtime-config");
   const dir = runtimeConfigDir(home, identityId);
-  for (const d of [join15(home, ".securecoms"), parent3, dir]) {
+  for (const d of [join16(home, ".securecoms"), parent3, dir]) {
     deps.mkdir(d, 448);
     deps.chmod(d, 448);
   }
-  for (const [name, body] of entries) atomicWrite(join15(dir, name), body, deps);
+  for (const [name, body] of entries) atomicWrite(join16(dir, name), body, deps);
 }
 function checkConfiguredPaths(skillsJson, statFn = (p) => {
   const s = statSync3(p);
@@ -34950,7 +35156,7 @@ function localLegacySources(doc) {
     const channelId = source.channelId;
     if (kind2 !== "global-memory" && kind2 !== "conversation-history" && kind2 !== "captured-memory" || typeof path !== "string" || !isAbsolute(path) || channelId !== void 0 && typeof channelId !== "string") continue;
     try {
-      const st = lstatSync6(path);
+      const st = lstatSync7(path);
       if (!st.isFile() || st.isSymbolicLink()) continue;
       if (st.size <= LEGACY_MEMORY_SOURCE_MAX_BYTES && st.size > contentBudget) continue;
       const oversize = st.size > LEGACY_MEMORY_SOURCE_MAX_BYTES;
@@ -34978,7 +35184,7 @@ function localLegacySources(doc) {
   return out;
 }
 function readLocalReport(home, identityId) {
-  const p = join15(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const p = join16(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(p)) return null;
   let doc;
   try {
@@ -35013,7 +35219,7 @@ function readLocalReport(home, identityId) {
 }
 function deleteLegacyMemorySources(home, identityId, ids) {
   if (ids.length === 0) return 0;
-  const p = join15(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const p = join16(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(p)) return 0;
   let doc;
   try {
@@ -35056,7 +35262,7 @@ async function applyLegacyMemoryFactDecisions(home, identityId, rawDecisions, re
     group.set(decision.fact_hash, decision);
     bySource.set(decision.source_id, group);
   }
-  const reportPath = join15(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
+  const reportPath = join16(runtimeConfigDir(home, identityId), LOCAL_REPORT_FILE);
   if (!existsSync4(reportPath)) return { sourcesDeleted: 0, factsAssigned: 0 };
   let doc;
   try {
@@ -35094,7 +35300,7 @@ async function applyLegacyMemoryFactDecisions(home, identityId, rawDecisions, re
 }
 function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
   const dir = runtimeConfigDir(home, identityId);
-  const path = join15(dir, MEMORY_FILE);
+  const path = join16(dir, MEMORY_FILE);
   if (!existsSync4(path)) return 0;
   const drop = new Set(hashes);
   const before = deps.readFile(path).split("\n");
@@ -35127,9 +35333,9 @@ import { sha256 as sha25611 } from "@noble/hashes/sha256";
 import { ed25519 as ed255195 } from "@noble/curves/ed25519";
 
 // src/grants/pin.ts
-import { lstatSync as lstatSync7, readFileSync as readFileSync9 } from "node:fs";
+import { lstatSync as lstatSync8, readFileSync as readFileSync9 } from "node:fs";
 import { ed25519 as ed255194 } from "@noble/curves/ed25519";
-import { dirname as dirname4, join as join16 } from "node:path";
+import { dirname as dirname5, join as join17 } from "node:path";
 var PIN_FILE_NAME = "owner-signing-key.json";
 var UUID_LOWER = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var PIN_KEYS = ["key_algo", "owner_identity_id", "public_key"];
@@ -35159,7 +35365,7 @@ function parsePinObject(v) {
     pin: Object.freeze({ ownerIdentityId: o.owner_identity_id, keyAlgo: "ed25519", publicKey, publicKeyB64: o.public_key })
   };
 }
-var NODE_FS = { lstat: (p) => lstatSync7(p), readFile: (p) => readFileSync9(p, "utf8") };
+var NODE_FS = { lstat: (p) => lstatSync8(p), readFile: (p) => readFileSync9(p, "utf8") };
 function fromValue(v) {
   const r = parsePinObject(v);
   return r.ok ? { kind: "ok", pin: r.pin } : { kind: "bad", state: r.state };
@@ -35193,7 +35399,7 @@ function samePin(a, b) {
 }
 function loadOwnerGrantPin(opts) {
   const fs = opts.fs ?? NODE_FS;
-  const file2 = readPinFile(join16(dirname4(opts.credentialPath), PIN_FILE_NAME), fs);
+  const file2 = readPinFile(join17(dirname5(opts.credentialPath), PIN_FILE_NAME), fs);
   const field = "owner_signing_key" in opts.credentialJson && opts.credentialJson.owner_signing_key !== void 0 ? fromValue(opts.credentialJson.owner_signing_key) : { kind: "absent" };
   if (file2.kind === "bad") return { state: file2.state, pin: null };
   if (field.kind === "bad") return { state: field.state, pin: null };
@@ -35205,6 +35411,193 @@ function loadOwnerGrantPin(opts) {
   return { state: "ok", pin: one };
 }
 
+// src/grants/mcp-section.ts
+var MCP_MAX_SERVERS = 8;
+var MCP_MAX_TOOLS_PER_SERVER = 64;
+var MCP_MAX_SIGNED_TOOLS = 160;
+var MCP_MAX_REMOVED = 8;
+var SECURECOMS_CIMD_CLIENT_ID = "https://app.securecoms.ai/oauth/securecoms-agent-client.json";
+var MCP_SERVER_ID = /^[a-z0-9-]{1,24}$/;
+var MCP_TOOL_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+var VENDOR_KEY = /^[a-z0-9_]{1,32}$/;
+var MCP_RESERVED_NAMES = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var HEX64 = /^[0-9a-f]{64}$/;
+var PRINTABLE_ASCII = /^[\x21-\x7e]{1,256}$/;
+var MCP_GRANT = /^mcp:([a-z0-9-]{1,24})\/([A-Za-z0-9_.-]{1,64})$/;
+var isBag = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var keysExactly = (o, keys) => {
+  const have = Object.keys(o);
+  return have.length === keys.length && keys.every((k) => Object.prototype.hasOwnProperty.call(o, k));
+};
+function canonicalHttpsUrl(v) {
+  if (typeof v !== "string" || !PRINTABLE_ASCII.test(v) || !URL.canParse(v)) return false;
+  const u = new URL(v);
+  return u.protocol === "https:" && u.username === "" && u.password === "" && u.href === v;
+}
+function httpsIssuer(v) {
+  if (typeof v !== "string" || !PRINTABLE_ASCII.test(v) || !URL.canParse(v)) return false;
+  const u = new URL(v);
+  return u.protocol === "https:" && u.username === "" && u.password === "" && u.search === "" && u.hash === "" && (u.href === v || u.href === `${v}/`);
+}
+var MCP_AUTH_KEYS = Object.freeze({
+  oauth_securecoms_cimd: Object.freeze(["mode", "issuer", "client"]),
+  oauth_customer: Object.freeze(["mode", "issuer", "client", "client_id"]),
+  key: Object.freeze(["mode"])
+});
+function parseAuth(v) {
+  if (!isBag(v)) return null;
+  if (v.mode === "key") return keysExactly(v, MCP_AUTH_KEYS.key) ? Object.freeze({ mode: "key" }) : null;
+  if (v.mode !== "oauth" || !httpsIssuer(v.issuer)) return null;
+  if (v.client === "securecoms_cimd") {
+    if (!keysExactly(v, MCP_AUTH_KEYS.oauth_securecoms_cimd)) return null;
+    return Object.freeze({ mode: "oauth", issuer: v.issuer, client: "securecoms_cimd" });
+  }
+  if (v.client === "customer") {
+    if (!keysExactly(v, MCP_AUTH_KEYS.oauth_customer)) return null;
+    if (typeof v.client_id !== "string" || !PRINTABLE_ASCII.test(v.client_id)) return null;
+    return Object.freeze({ mode: "oauth", issuer: v.issuer, client: "customer", client_id: v.client_id });
+  }
+  return null;
+}
+function parseTools(v) {
+  if (!isBag(v)) return null;
+  const entries = Object.entries(v);
+  if (entries.length > MCP_MAX_TOOLS_PER_SERVER) return null;
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [name, t] of entries) {
+    if (!MCP_TOOL_NAME.test(name) || MCP_RESERVED_NAMES.has(name) || !isBag(t) || !keysExactly(t, ["sha256", "class"])) return null;
+    if (typeof t.sha256 !== "string" || !HEX64.test(t.sha256) || t.class !== "read") return null;
+    out[name] = Object.freeze({ sha256: t.sha256, class: "read" });
+  }
+  return out;
+}
+function parseServer(v) {
+  if (!isBag(v) || !keysExactly(v, ["vendor", "url", "auth", "tools"])) return null;
+  if (typeof v.vendor !== "string" || !VENDOR_KEY.test(v.vendor) || !canonicalHttpsUrl(v.url)) return null;
+  const auth = parseAuth(v.auth);
+  const tools = parseTools(v.tools);
+  if (auth === null || tools === null) return null;
+  return Object.freeze({ vendor: v.vendor, url: v.url, auth, tools: Object.freeze(tools) });
+}
+function parseRemoved(v, servers) {
+  if (v === "*") return Object.keys(servers).length === 0 ? "*" : null;
+  if (!Array.isArray(v) || v.length < 1 || v.length > MCP_MAX_REMOVED) return null;
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of v) {
+    if (typeof id !== "string" || !MCP_SERVER_ID.test(id) || MCP_RESERVED_NAMES.has(id)) return null;
+    if (seen.has(id) || Object.prototype.hasOwnProperty.call(servers, id)) return null;
+    seen.add(id);
+  }
+  return Object.freeze([...seen]);
+}
+var NOT_REMOVED = Object.freeze([]);
+function parseMcp(v) {
+  if (!isBag(v) || !(keysExactly(v, ["servers"]) || keysExactly(v, ["servers", "removed"])) || !isBag(v.servers)) return null;
+  const entries = Object.entries(v.servers);
+  if (entries.length > MCP_MAX_SERVERS) return null;
+  const servers = /* @__PURE__ */ Object.create(null);
+  let signedTools = 0;
+  for (const [id, raw] of entries) {
+    if (!MCP_SERVER_ID.test(id) || MCP_RESERVED_NAMES.has(id)) return null;
+    const s = parseServer(raw);
+    if (s === null) return null;
+    signedTools += Object.keys(s.tools).length;
+    if (signedTools > MCP_MAX_SIGNED_TOOLS) return null;
+    servers[id] = s;
+  }
+  let removed = NOT_REMOVED;
+  if (Object.prototype.hasOwnProperty.call(v, "removed")) {
+    const r = parseRemoved(v.removed, servers);
+    if (r === null) return null;
+    removed = r;
+  }
+  return Object.freeze({ servers: Object.freeze(servers), removed });
+}
+function mcpServerCatalogRow(s, catalog) {
+  if (!Object.prototype.hasOwnProperty.call(catalog, s.vendor)) return null;
+  const row = catalog[s.vendor];
+  if (s.url !== row.readOnlyUrl) return null;
+  if (s.auth.mode === "oauth" && s.auth.issuer !== row.issuer) return null;
+  return row;
+}
+function parseMcpGrant(name) {
+  const g = MCP_GRANT.exec(name);
+  return g === null ? null : { serverId: g[1], tool: g[2] };
+}
+function mcpGrantWithinCeiling(name, mcp, catalog) {
+  const g = parseMcpGrant(name);
+  if (g === null || mcp === null || !Object.prototype.hasOwnProperty.call(mcp.servers, g.serverId)) return false;
+  const s = mcp.servers[g.serverId];
+  if (!Object.prototype.hasOwnProperty.call(s.tools, g.tool)) return false;
+  const row = mcpServerCatalogRow(s, catalog);
+  return row !== null && row.readTools.includes(g.tool);
+}
+
+// src/grants/mcp-catalog.ts
+var LINEAR = Object.freeze({
+  displayName: "Linear",
+  host: "mcp.linear.app",
+  readOnlyUrl: "https://mcp.linear.app/mcp/readonly",
+  readTools: Object.freeze([
+    "get_attachment",
+    "list_agent_skills",
+    "get_agent_skill",
+    "list_comments",
+    "list_cycles",
+    "list_custom_views",
+    "get_document",
+    "list_documents",
+    "extract_images",
+    "get_issue",
+    "list_issue_statuses",
+    "get_issue_status",
+    "list_issue_labels",
+    "list_projects",
+    "get_project",
+    "list_project_labels",
+    "list_release_pipelines",
+    "list_releases",
+    "get_release",
+    "list_release_notes",
+    "get_release_note",
+    "list_milestones",
+    "get_milestone",
+    "get_notifications",
+    "list_teams",
+    "get_team",
+    "get_triage_responsibility",
+    "list_templates",
+    "get_template",
+    "list_users",
+    "get_user",
+    "get_workspace",
+    "search_documentation",
+    "get_diff",
+    "list_diffs",
+    "get_diff_threads",
+    "list_initiatives",
+    "get_initiative",
+    "list_initiative_labels",
+    "get_status_updates"
+  ]),
+  scopes: Object.freeze(["read"]),
+  issuer: "https://mcp.linear.app",
+  authorizationEndpoint: "https://mcp.linear.app/authorize",
+  tokenEndpoint: "https://mcp.linear.app/token",
+  revocationEndpoint: "https://mcp.linear.app/token",
+  docs: Object.freeze({
+    host: "https://linear.app/docs/mcp",
+    readOnlyUrl: "https://linear.app/docs/mcp",
+    readTools: "https://linear.app/docs/mcp",
+    scopes: "https://linear.app/docs/mcp",
+    issuer: "https://mcp.linear.app/.well-known/oauth-authorization-server",
+    authorizationEndpoint: "https://mcp.linear.app/.well-known/oauth-authorization-server",
+    tokenEndpoint: "https://mcp.linear.app/.well-known/oauth-authorization-server",
+    revocationEndpoint: "https://mcp.linear.app/.well-known/oauth-authorization-server"
+  })
+});
+var MCP_CATALOG = Object.freeze({ linear: LINEAR });
+
 // src/grants/manifest.ts
 var TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
 var MANIFEST_KNOWN_TOOLS = Object.freeze({
@@ -35230,9 +35623,9 @@ function wellTyped(v) {
   return false;
 }
 var WRAPPER_KEYS = ["algo", "manifest", "signature"];
-var HEX64 = /^[0-9a-f]{64}$/;
-var PRINTABLE_ASCII = /^[\x21-\x7e]+$/;
-var absolutePath = (v) => typeof v === "string" && v.startsWith("/") && PRINTABLE_ASCII.test(v);
+var HEX642 = /^[0-9a-f]{64}$/;
+var PRINTABLE_ASCII2 = /^[\x21-\x7e]+$/;
+var absolutePath = (v) => typeof v === "string" && v.startsWith("/") && PRINTABLE_ASCII2.test(v);
 var exactKeys = (o, required, optional = []) => required.every((k) => k in o) && Object.keys(o).every((k) => required.includes(k) || optional.includes(k));
 var isStringArray = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 function parseEndpoints(v) {
@@ -35244,7 +35637,7 @@ function parseEndpoints(v) {
     const e = { ...raw };
     if (e.headersFile === "") delete e.headersFile;
     if (!exactKeys(e, ["baseUrl"], ["headersFile"])) return null;
-    if (typeof e.baseUrl !== "string" || e.baseUrl === "" || !PRINTABLE_ASCII.test(e.baseUrl)) return null;
+    if (typeof e.baseUrl !== "string" || e.baseUrl === "" || !PRINTABLE_ASCII2.test(e.baseUrl)) return null;
     let url;
     try {
       url = new URL(e.baseUrl);
@@ -35275,8 +35668,8 @@ function parseDatabases(v) {
 function parseConfig(v) {
   if (!isPlainObject(v)) return null;
   if (!exactKeys(v, ["persona_sha256", "flags", "memory", "legacy_assign_sha256"], ["llm", "search", "tools_allow"])) return null;
-  if (typeof v.persona_sha256 !== "string" || !HEX64.test(v.persona_sha256)) return null;
-  if (typeof v.legacy_assign_sha256 !== "string" || !HEX64.test(v.legacy_assign_sha256)) return null;
+  if (typeof v.persona_sha256 !== "string" || !HEX642.test(v.persona_sha256)) return null;
+  if (typeof v.legacy_assign_sha256 !== "string" || !HEX642.test(v.legacy_assign_sha256)) return null;
   if (!isStringArray(v.flags)) return null;
   if ("tools_allow" in v && !isStringArray(v.tools_allow)) return null;
   if ("llm" in v) {
@@ -35320,7 +35713,7 @@ function verifyToolGrantManifest(raw, ctx) {
   const m = raw.manifest;
   if (!isPlainObject(m)) return { state: "malformed" };
   if (m.type !== "securecoms.tool-grants" || m.v !== 1) return { state: "malformed" };
-  if (!wellTyped(m)) return { state: "malformed" };
+  if (!wellTyped(Object.fromEntries(Object.entries(m).filter(([k]) => k !== "mcp")))) return { state: "malformed" };
   if (typeof m.agent_identity_id !== "string" || typeof m.owner_identity_id !== "string") return { state: "malformed" };
   for (const k of ["owner_dm_channel_id", "owner_dm_relay_identity_id"]) {
     if (k in m && typeof m[k] !== "string") return { state: "malformed" };
@@ -35350,6 +35743,11 @@ function verifyToolGrantManifest(raw, ctx) {
     if (counter === ctx.storedCounter) return { state: "unchanged" };
     if (counter < ctx.storedCounter) return { state: "rollback" };
   }
+  const rawOwnerDm = m.grants.owner_dm;
+  const signedMcpPresent = Array.isArray(rawOwnerDm) && rawOwnerDm.some((t) => t.startsWith("mcp:"));
+  const mcpKey = "mcp" in m ? "present" : "absent";
+  const mcp = mcpKey === "present" ? parseMcp(m.mcp) : null;
+  const catalog = ctx.mcpCatalog ?? MCP_CATALOG;
   let droppedUnknown = false;
   const grants = {};
   for (const [audience, list] of Object.entries(m.grants)) {
@@ -35358,7 +35756,7 @@ function verifyToolGrantManifest(raw, ctx) {
       continue;
     }
     const known = MANIFEST_KNOWN_TOOLS[audience];
-    const kept = list.filter((t) => known.includes(t));
+    const kept = list.filter((t) => known.includes(t) || audience === "owner_dm" && mcpGrantWithinCeiling(t, mcp, catalog));
     if (kept.length !== list.length) droppedUnknown = true;
     grants[audience] = Object.freeze(kept);
   }
@@ -35373,7 +35771,10 @@ function verifyToolGrantManifest(raw, ctx) {
     grants: Object.freeze(grants),
     endpoints: Object.freeze(endpoints),
     databases: Object.freeze(databases),
-    config
+    config,
+    mcp,
+    mcpKey,
+    signedMcpPresent
   });
   return { state: "ok", manifest, droppedUnknown, wrapper: raw };
 }
@@ -35694,21 +36095,32 @@ var AGENT_TOTAL_KEY = "agent-total";
 // src/grants/effective.ts
 var TOOL_GRANT_CODE_CEILING = MANIFEST_KNOWN_TOOLS;
 var CURRENT_TIME = Object.freeze({ tool: "current_time", mode: "read" });
+var NO_WITHHELD = Object.freeze([]);
 function effectiveToolGrants(i) {
-  if (i.base.length === 0) return { grants: i.base, source: "none", withheldBySearchCap: false };
-  if (i.manifest === null) return { grants: i.base, source: "constant", withheldBySearchCap: false };
+  if (i.base.length === 0) return { grants: i.base, source: "none", withheldBySearchCap: false, withheld: NO_WITHHELD };
+  if (i.manifest === null) return { grants: i.base, source: "constant", withheldBySearchCap: false, withheld: NO_WITHHELD };
   const ceiling = TOOL_GRANT_CODE_CEILING[i.audience];
   const listed = new Set(i.manifest.grants[i.audience] ?? []);
   const signed = ceiling.filter((t) => listed.has(t));
   if (!i.eligible || !i.manifestSwitchOn) {
     const fallback = i.base.filter((g) => g.tool !== "current_time" && signed.includes(g.tool));
-    return { grants: Object.freeze([CURRENT_TIME, ...fallback]), source: "fallback", withheldBySearchCap: false };
+    return { grants: Object.freeze([CURRENT_TIME, ...fallback]), source: "fallback", withheldBySearchCap: false, withheld: NO_WITHHELD };
   }
   let withheld = false;
+  const dropped = [];
   const tools = signed.filter((t) => {
-    if (i.disabled.has(t)) return false;
-    if (t === "http_request" && i.signedTargets.endpoints === 0) return false;
-    if (t === "sql_query" && i.signedTargets.databases === 0) return false;
+    if (i.disabled.has(t)) {
+      dropped.push(Object.freeze({ tool: t, why: "disabled_by_owner" }));
+      return false;
+    }
+    if (t === "http_request" && i.signedTargets.endpoints === 0) {
+      dropped.push(Object.freeze({ tool: t, why: "no_endpoint" }));
+      return false;
+    }
+    if (t === "sql_query" && i.signedTargets.databases === 0) {
+      dropped.push(Object.freeze({ tool: t, why: "no_database" }));
+      return false;
+    }
     if (i.audience === "team_room" && t === "web_search" && i.roomSearchCapped) {
       withheld = true;
       return false;
@@ -35718,7 +36130,8 @@ function effectiveToolGrants(i) {
   return {
     grants: Object.freeze([CURRENT_TIME, ...tools.map((tool) => Object.freeze({ tool, mode: "read", source: "manifest" }))]),
     source: "manifest",
-    withheldBySearchCap: withheld
+    withheldBySearchCap: withheld,
+    withheld: Object.freeze(dropped)
   };
 }
 
@@ -36023,6 +36436,200 @@ function classifyVoiceFrame(f) {
   return b.text.trim() === VOICE_CALL_START_MARKER ? "greeting" : "drop";
 }
 
+// src/grants/tool-status.ts
+var TOOL_STATUS_ALLOWLIST = [
+  "current_time",
+  "web_search",
+  "web_extract",
+  "fetch_url",
+  "http_request",
+  "sql_query",
+  "weather_forecast",
+  "currency_convert"
+];
+var ALLOW2 = new Set(TOOL_STATUS_ALLOWLIST);
+var TOOL_STATUS_BUCKET_MS = 9e5;
+function bucketStartAt(ms) {
+  return new Date(Math.floor(ms / TOOL_STATUS_BUCKET_MS) * TOOL_STATUS_BUCKET_MS).toISOString().slice(0, 16) + "Z";
+}
+function bucketEndMs(at) {
+  return Date.parse(at) + TOOL_STATUS_BUCKET_MS;
+}
+var SIGNATURE_FAILURES = /* @__PURE__ */ new Set(["bad_signature", "malformed", "unknown_algo", "no_signature"]);
+function ownerDmCause(i) {
+  try {
+    const v = i.verdict;
+    if (v.kind === "failed" && v.reason === "replay") return null;
+    if (v.kind !== "verified" && v.kind !== "constants_only" && v.kind !== "failed") return null;
+    const failedReason = v.kind === "failed" ? v.reason : void 0;
+    const blocked = i.killSwitchOff || i.pinMissingOrAnomalous || i.senderNotOwner || i.stale || v.kind === "failed";
+    const eligible = v.kind === "verified" && i.signedDmChannel === i.channelId && i.boundNow && i.consumerAttached;
+    const source = blocked ? "none" : !i.manifestPresent ? "constant" : !eligible || i.manifestSwitchOff ? "fallback" : "manifest";
+    const at = (cause, sub) => sub === void 0 ? { source, cause } : { source, cause, sub };
+    if (i.killSwitchOff) return at("owner_dm_unavailable", "kill_switch");
+    if (i.manifestSwitchOff) return at("manifest_switch_off");
+    if (i.pinMissingOrAnomalous) return at("owner_dm_unavailable", "pin");
+    if (i.senderNotOwner) return at("owner_dm_unavailable", "sender_not_owner");
+    if (i.stale) return at("owner_dm_unavailable", "stale");
+    if (failedReason === "not_owner_dm_leaves") return at("unexpected_member_in_dm");
+    if (failedReason !== void 0 && SIGNATURE_FAILURES.has(failedReason)) return at("owner_turn_failed");
+    if (failedReason === "verify_error") return at("agent_state_error");
+    if (failedReason === "wrong_dm_channel" || v.kind === "verified" && i.manifestPresent && i.signedDmChannel !== void 0 && i.signedDmChannel !== i.channelId) {
+      return at("dm_channel_mismatch");
+    }
+    if (failedReason !== void 0) return null;
+    if (i.manifestPresent && i.signedDmChannel === void 0) return at("dm_not_linked");
+    if (v.kind === "constants_only") return at("unsigned_relay_in_dm");
+    if (!i.manifestPresent || !i.boundNow) return at("manifest_not_bound");
+    if (!i.consumerAttached) return at("no_runtime_consumer");
+    return source === "manifest" ? { source } : null;
+  } catch {
+    return null;
+  }
+}
+function sameTuple(a, b) {
+  if (!a || !b) return false;
+  return a.source === b.source && a.cause === b.cause && a.sub === b.sub && a.relay === b.relay && a.mcp_issued === b.mcp_issued && a.counter === b.counter && a.issued.length === b.issued.length && a.issued.every((t, k) => t === b.issued[k]) && a.withheld.length === b.withheld.length && a.withheld.every((w, k) => w.tool === b.withheld[k].tool && w.why === b.withheld[k].why);
+}
+function sanitizeIssued(names) {
+  return [...new Set(names.filter((n) => ALLOW2.has(n)))].sort();
+}
+
+// src/tool-status-sender.ts
+var TOOL_STATUS_JITTER_MS = 6e4;
+var RETRY_AFTER_FLOOR_MS = 6e4;
+function defaultToolStatusSetTimer(fn, ms) {
+  const t = setTimeout(fn, ms);
+  t.unref?.();
+  return t;
+}
+function defaultToolStatusClearTimer(h) {
+  clearTimeout(h);
+}
+function retryAfterMs(raw) {
+  if (typeof raw !== "string" || !/^\d{1,9}$/.test(raw.trim())) return RETRY_AFTER_FLOOR_MS;
+  return Math.max(RETRY_AFTER_FLOOR_MS, Number(raw.trim()) * 1e3);
+}
+var ToolStatusSender = class {
+  postFn;
+  now;
+  setTimer;
+  clearTimer;
+  random;
+  onFailure;
+  /** The latest noted record while its bucket is still open. */
+  open = null;
+  /** The latest noted record whose bucket has closed: the only record an attempt or carry() may send. */
+  closed = null;
+  lastPosted = null;
+  terminalFor = null;
+  notBefore = Number.NEGATIVE_INFINITY;
+  timer = null;
+  inFlight = false;
+  shut = false;
+  constructor(o) {
+    this.postFn = o.post;
+    this.now = o.now ?? (() => Date.now());
+    this.setTimer = o.setTimer ?? defaultToolStatusSetTimer;
+    this.clearTimer = o.clearTimer ?? defaultToolStatusClearTimer;
+    this.random = o.random ?? Math.random;
+    this.onFailure = o.onFailure ?? (() => {
+    });
+  }
+  note(rec) {
+    if (this.shut) return;
+    try {
+      this.promote(this.now());
+      this.open = rec;
+      this.schedule();
+    } catch {
+    }
+  }
+  /** Ruling M-2: what the apply-time report carries. The closed record only; an open bucket is never revealed early. */
+  carry() {
+    try {
+      this.promote(this.now());
+    } catch {
+    }
+    return this.closed;
+  }
+  /** R2-M1: the record belongs to an owner who is no longer the manifest's; forget it and what was posted. */
+  drop() {
+    this.open = null;
+    this.closed = null;
+    this.lastPosted = null;
+    this.terminalFor = null;
+    this.cancelTimer();
+  }
+  close() {
+    this.shut = true;
+    this.cancelTimer();
+  }
+  cancelTimer() {
+    if (this.timer !== null) this.clearTimer(this.timer);
+    this.timer = null;
+  }
+  promote(t) {
+    if (this.open !== null && bucketEndMs(this.open.at) <= t) {
+      this.closed = this.open;
+      this.open = null;
+    }
+  }
+  pending() {
+    return this.closed !== null && !sameTuple(this.closed, this.lastPosted) && !sameTuple(this.closed, this.terminalFor);
+  }
+  schedule() {
+    if (this.shut || this.inFlight || this.timer !== null) return;
+    if (this.open === null && !this.pending()) return;
+    const t = this.now();
+    let b = (Math.floor(t / TOOL_STATUS_BUCKET_MS) + 1) * TOOL_STATUS_BUCKET_MS;
+    while (b < this.notBefore) b += TOOL_STATUS_BUCKET_MS;
+    const jitter = Math.floor(this.random() * TOOL_STATUS_JITTER_MS);
+    this.timer = this.setTimer(() => {
+      this.timer = null;
+      this.fire();
+    }, b - t + jitter);
+  }
+  fire() {
+    try {
+      if (this.shut) return;
+      this.promote(this.now());
+      if (this.pending()) {
+        void this.attempt(this.closed);
+        return;
+      }
+      this.schedule();
+    } catch {
+    }
+  }
+  async attempt(rec) {
+    this.inFlight = true;
+    const attemptAt = this.now();
+    let result;
+    try {
+      result = await this.postFn(rec);
+    } catch {
+      result = "network";
+    }
+    this.inFlight = false;
+    try {
+      if (typeof result === "object" && result.status >= 200 && result.status < 300) {
+        this.lastPosted = rec;
+      } else if (typeof result === "object" && result.status === 429) {
+        this.notBefore = attemptAt + retryAfterMs(result.retryAfter);
+        this.onFailure("http_error");
+      } else if (typeof result === "object" && result.status >= 400 && result.status < 500) {
+        this.terminalFor = rec;
+        this.onFailure("http_error");
+      } else {
+        this.onFailure(typeof result === "object" ? "http_error" : result);
+      }
+      this.schedule();
+    } catch {
+    }
+  }
+};
+
 // src/grants/owner-turn.ts
 import { ed25519 as ed255196 } from "@noble/curves/ed25519";
 var HEX = /^(?:[0-9a-fA-F]{2})+$/;
@@ -36066,6 +36673,310 @@ function classifyOwnerDmLeaves(leaves, allowed) {
   }
   return "foreign";
 }
+function ownerDmLeavesRelayFree(leaves, ids) {
+  let owner = false;
+  let agent = false;
+  for (const l of leaves) {
+    if (!l.basic || l.identity === null) return false;
+    if (l.identity === ids.ownerIdentityId) owner = true;
+    else if (l.identity === ids.agentIdentityId) agent = true;
+    else return false;
+  }
+  return owner && agent;
+}
+function relayLeafFromPhase0Relay(relay) {
+  return relay !== "none";
+}
+function ownerDmRelayOf(leafClass, leaves, ids) {
+  if (leafClass === "unsigned_relay") return "unsigned";
+  if (ownerDmLeavesRelayFree(leaves, ids)) return "none";
+  if (ids.relayIdentityId !== void 0 && leaves.some((l) => l.identity === ids.relayIdentityId)) return "signed";
+  return void 0;
+}
+
+// src/grants/mcp-policy.ts
+var MCP_POLICY_WRITER_FEATURE = "mcp_policy_writer_v1";
+function mcpEntitlementReading(mcpEntitled, mcpCause) {
+  if (mcpEntitled === true && mcpCause === "entitled") return "entitled";
+  if (mcpEntitled === false && mcpCause === "not_entitled") return "not_entitled";
+  return "suspended";
+}
+function mcpGrantsHostSwitch(env, log = writeServiceLog2) {
+  const v = env.SECURECOMS_MCP_GRANTS;
+  if (v === void 0 || v === "on") return "on";
+  if (v === "off") return "off";
+  log("warn", "config.mcp_grants_switch_suspended", { state: ServiceLogEnum.of("suspended", ["suspended"]) });
+  return "suspended";
+}
+var empty = (state, r3Hold) => Object.freeze({ v: 1, state, r3_hold: r3Hold, servers: Object.freeze({}), remove: NO_REMOVE });
+var NO_REMOVE = Object.freeze([]);
+function policyAuth(s) {
+  if (s.auth.mode === "key") return Object.freeze({ mode: "key" });
+  const clientId = s.auth.client === "customer" ? s.auth.client_id : SECURECOMS_CIMD_CLIENT_ID;
+  return Object.freeze({ mode: "oauth", issuer: s.auth.issuer, client: s.auth.client, client_id: clientId });
+}
+function mcpPolicyFor(i) {
+  const m = i.manifest;
+  const r3Hold = m?.signedMcpPresent === true || i.mcpSeen;
+  if (i.hostSwitch === "off") return empty("kill_switch", r3Hold);
+  if (i.hostSwitch !== "on") return empty("suspended", r3Hold);
+  if (!i.config.fetched) return empty("no_config", r3Hold);
+  const ent = mcpEntitlementReading(i.config.mcp_entitled, i.config.mcp_cause);
+  if (ent !== "entitled") return empty(ent, r3Hold);
+  if (!i.ownerDmManifestSwitchOn) return empty("switch_off", r3Hold);
+  if (m === null) return empty("no_manifest", r3Hold);
+  if (m.mcpKey === "absent") return empty("section_absent", r3Hold);
+  if (m.mcp === null) return empty("malformed", r3Hold);
+  if (!i.capability) return empty("no_capability", r3Hold);
+  const catalog = i.catalog ?? MCP_CATALOG;
+  const granted = /* @__PURE__ */ new Map();
+  for (const name of m.grants.owner_dm ?? []) {
+    const g = parseMcpGrant(name);
+    if (g === null) continue;
+    if (!granted.has(g.serverId)) granted.set(g.serverId, /* @__PURE__ */ new Set());
+    granted.get(g.serverId).add(g.tool);
+  }
+  const servers = {};
+  for (const id of Object.keys(m.mcp.servers).sort()) {
+    const s = m.mcp.servers[id];
+    const row = mcpServerCatalogRow(s, catalog);
+    if (row === null) {
+      servers[id] = Object.freeze({ state: "refused" });
+      continue;
+    }
+    const tools = {};
+    for (const t of Object.keys(s.tools).sort()) {
+      if (granted.get(id)?.has(t) === true && row.readTools.includes(t)) tools[t] = Object.freeze({ sha256: s.tools[t].sha256, class: "read" });
+    }
+    servers[id] = Object.freeze({ state: "ok", vendor: s.vendor, url: row.readOnlyUrl, auth: policyAuth(s), tools: Object.freeze(tools) });
+  }
+  const remove = m.mcp.removed === "*" ? "*" : Object.freeze([...m.mcp.removed]);
+  return Object.freeze({ v: 1, state: "ok", r3_hold: r3Hold, servers: Object.freeze(servers), remove });
+}
+
+// src/grants/mcp-issuance.ts
+var NONE = Object.freeze([]);
+var own = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
+function mcpPolicyAllows(policy, serverId, tool) {
+  if (policy === null || policy.state !== "ok" || !own(policy.servers, serverId)) return false;
+  const s = policy.servers[serverId];
+  return s.state === "ok" && own(s.tools, tool);
+}
+function mcpIssuance(i) {
+  if (i.source !== "manifest") return NONE;
+  if (i.verdict?.kind !== "verified" || i.verdict.relayLeaf !== false) return NONE;
+  if (i.entitlement !== "entitled" || i.hostSwitch !== "on" || !i.ownerDmManifestSwitchOn) return NONE;
+  if (i.manifest === null || i.policy === null || i.policy.state !== "ok") return NONE;
+  const out = [];
+  for (const name of i.manifest.grants.owner_dm ?? []) {
+    const g = parseMcpGrant(name);
+    if (g === null || i.disabled.has(name) || !mcpPolicyAllows(i.policy, g.serverId, g.tool)) continue;
+    out.push(Object.freeze({ tool: name, mode: "read", source: "manifest" }));
+  }
+  return out.length === 0 ? NONE : Object.freeze(out);
+}
+
+// src/consumer-grants.ts
+var NO_GRANTS = Object.freeze([]);
+var PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
+function withConsumerGrants(m, perToolConsumer) {
+  if (perToolConsumer) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const stripGrants = !(a.tool_grants.length === 0 || a.audience === "owner_dm" || a.relay_speaker === "owner");
+  const stripMemory = "memory_write" in a;
+  if (!stripGrants && !stripMemory) return m;
+  const { memory_write: _dropped, ...rest } = a;
+  return { ...m, authorization: Object.freeze({ ...rest, ...stripGrants ? { tool_grants: NO_GRANTS } : {} }) };
+}
+var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
+var UTILITY_TOOLS_FEATURE = "utility_tools_v1";
+var MCP_CLIENT_FEATURE = "mcp_client_v1";
+var CONSTANT_TOOL_NAMES = Object.freeze({
+  owner_dm: Object.freeze(["current_time", "web_search"]),
+  team_room: Object.freeze(["current_time"])
+});
+var isManifestGrant = (g) => g.mode === "read" && g.source === "manifest";
+function withManifestCapability(m, manifestConsumer) {
+  if (manifestConsumer) return m;
+  const a = m.authorization;
+  if (!a || !a.tool_grants.some(isManifestGrant)) return m;
+  const constants5 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
+  const narrowed = a.tool_grants.flatMap((g) => {
+    if (!isManifestGrant(g)) return [g];
+    return constants5.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+  });
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(narrowed) }) };
+}
+function withHarnessGrants(m, withheld) {
+  if (!withheld) return m;
+  const a = m.authorization;
+  if (!a || a.tool_grants.length === 0) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
+}
+function withSearchCapability(m, consumerHasFeature, signedProvider) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const stripSearch = signedProvider !== void 0 && signedProvider !== "brave";
+  const kept = a.tool_grants.filter((g) => g.tool !== "web_extract" && !(stripSearch && g.tool === "web_search"));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
+var UTILITY_TOOL_NAMES = /* @__PURE__ */ new Set(["weather_forecast", "currency_convert"]);
+function withUtilityCapability(m, consumerHasFeature) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const kept = a.tool_grants.filter((g) => !UTILITY_TOOL_NAMES.has(g.tool));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
+var MCP_GRANT_PREFIX = "mcp:";
+var isMcpGrant = (g) => g.tool.startsWith(MCP_GRANT_PREFIX);
+function withMcpCapability(m, consumerHasFeature) {
+  const a = m.authorization;
+  if (!a) return m;
+  const { relay_free: _relayFree, ...rest } = a;
+  if (!a.tool_grants.some(isMcpGrant)) return "relay_free" in a ? { ...m, authorization: Object.freeze(rest) } : m;
+  if (consumerHasFeature && a.audience === "owner_dm" && a.relay_speaker === void 0) return m;
+  const kept = a.tool_grants.filter((g) => !isMcpGrant(g));
+  return { ...m, authorization: Object.freeze({ ...rest, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
+var R3_KEEP_TOOLS = /* @__PURE__ */ new Set(["current_time", "web_search", "weather_forecast", "currency_convert"]);
+function withR3Holds(m, hold) {
+  if (!hold) return m;
+  const a = m.authorization;
+  if (!a || !(a.audience === "owner_dm" || a.relay_speaker === "owner")) return m;
+  const kept = a.tool_grants.filter((g) => R3_KEEP_TOOLS.has(g.tool) || isMcpGrant(g));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
+
+// src/mcp-catalog-message.ts
+var MCP_CATALOG_MAX_BYTES = 384 * 1024;
+var MCP_CATALOG_MAX_TOOLS = 64;
+var MCP_CATALOG_LIST_TIMEOUT_MS = 5e4;
+var REQUEST_ID = /^[0-9a-f]{32}$/;
+var SERVER_ID = /^[a-z0-9-]{1,24}$/;
+var TOOL_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+var RESERVED = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ISO_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
+var MCP_CATALOG_REASONS = /* @__PURE__ */ new Set(["catalog", "write_name", "hint", "schema", "header_param", "too_large"]);
+var isBag2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var keysExactly2 = (o, keys) => {
+  const k = Object.keys(o);
+  return k.length === keys.length && keys.every((x) => Object.prototype.hasOwnProperty.call(o, x));
+};
+function parseMcpCatalogRequest(body) {
+  if (!isBag2(body) || !keysExactly2(body, ["v", "type", "server_id", "request_id"])) return null;
+  if (body.v !== 1 || body.type !== "mcp_catalog_request") return null;
+  const { server_id: serverId, request_id: requestId } = body;
+  if (typeof serverId !== "string" || !SERVER_ID.test(serverId) || RESERVED.has(serverId)) return null;
+  if (typeof requestId !== "string" || !REQUEST_ID.test(requestId)) return null;
+  return Object.freeze({ serverId, requestId });
+}
+var PROJECTION_KEYS = /* @__PURE__ */ new Set(["name", "title", "description", "inputSchema", "annotations"]);
+function validProjection(p, toolName) {
+  if (!Object.keys(p).every((k) => PROJECTION_KEYS.has(k))) return false;
+  if (p.name !== toolName || typeof p.description !== "string" || !isBag2(p.inputSchema)) return false;
+  if (Object.prototype.hasOwnProperty.call(p, "title") && typeof p.title !== "string") return false;
+  if (Object.prototype.hasOwnProperty.call(p, "annotations") && !isBag2(p.annotations)) return false;
+  return true;
+}
+function validTool(t) {
+  if (!isBag2(t) || typeof t.name !== "string" || typeof t.grantable !== "boolean") return null;
+  if (t.grantable) {
+    if (!TOOL_NAME.test(t.name) || t.reason !== null || !isBag2(t.projection) || !validProjection(t.projection, t.name)) return null;
+    return { name: t.name, projection: t.projection, grantable: true, reason: null };
+  }
+  if (t.projection !== void 0 || typeof t.reason !== "string" || !MCP_CATALOG_REASONS.has(t.reason)) return null;
+  if (t.name.length < 1 || t.name.length > 64 || !/^[\x20-\x7e]+$/.test(t.name)) return null;
+  return { name: t.name, grantable: false, reason: t.reason };
+}
+function validateCatalogListReply(frame, serverId, vendor) {
+  if (!isBag2(frame) || frame.ok !== true || frame.server_id !== serverId || frame.vendor !== vendor) return null;
+  if (typeof frame.listed_at !== "string" || !ISO_TIME.test(frame.listed_at) || typeof frame.truncated !== "boolean") return null;
+  if (!Array.isArray(frame.tools) || frame.tools.length > MCP_CATALOG_MAX_TOOLS) return null;
+  const tools = [];
+  const names = /* @__PURE__ */ new Set();
+  for (const t of frame.tools) {
+    const v = validTool(t);
+    if (v === null) return null;
+    if (names.has(v.name)) return null;
+    names.add(v.name);
+    tools.push(v);
+  }
+  return { listedAt: frame.listed_at, truncated: frame.truncated, tools };
+}
+var utf8 = (v) => Buffer.byteLength(JSON.stringify(v), "utf8");
+var mcpCatalogBodyBytes = (b) => utf8(b);
+function buildMcpCatalogBody(i) {
+  const head = { v: 1, type: "mcp_catalog", server_id: i.serverId, request_id: i.requestId, vendor: i.vendor, issuer: i.issuer, listed_at: i.reply.listedAt };
+  const full = { ...head, tools: [...i.reply.tools], truncated: i.reply.truncated };
+  if (mcpCatalogBodyBytes(full) <= MCP_CATALOG_MAX_BYTES) return full;
+  const stub = (t) => ({ name: t.name, grantable: false, reason: "too_large" });
+  const tools = i.reply.tools.map(stub);
+  const body = { ...head, tools, truncated: true };
+  let size = mcpCatalogBodyBytes(body);
+  for (let k = 0; k < tools.length; k++) {
+    const want = i.reply.tools[k];
+    const delta = utf8(want) - utf8(tools[k]);
+    if (size + delta <= MCP_CATALOG_MAX_BYTES) {
+      tools[k] = want;
+      size += delta;
+    }
+  }
+  return body;
+}
+
+// src/mcp-catalog-rate.ts
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var MCP_CATALOG_PER_SERVER_MINUTE = 3;
+var MCP_CATALOG_PER_SERVER_HOUR = 20;
+var MCP_CATALOG_PER_AGENT_HOUR = 40;
+var McpCatalogRateLimiter = class {
+  now;
+  onRateLimited;
+  inFlight = /* @__PURE__ */ new Set();
+  perServer = /* @__PURE__ */ new Map();
+  agent = [];
+  /** Per scope key: no further log until this time (the end of the window that was full when it last logged). */
+  quietUntil = /* @__PURE__ */ new Map();
+  constructor(deps = {}) {
+    this.now = deps.now ?? Date.now;
+    this.onRateLimited = deps.onRateLimited ?? (() => {
+    });
+  }
+  /** "ok" admits (and counts) the request and marks the server in flight; the caller MUST call release(serverId). */
+  admit(serverId) {
+    if (this.inFlight.has(serverId)) return "in_flight";
+    const t = this.now();
+    const server = (this.perServer.get(serverId) ?? []).filter((x) => t - x < HOUR_MS);
+    this.perServer.set(serverId, server);
+    this.agent = this.agent.filter((x) => t - x < HOUR_MS);
+    const lastMinute = server.filter((x) => t - x < MINUTE_MS);
+    if (lastMinute.length >= MCP_CATALOG_PER_SERVER_MINUTE) return this.limited(`m:${serverId}`, "server_minute", lastMinute[0] + MINUTE_MS, t);
+    if (server.length >= MCP_CATALOG_PER_SERVER_HOUR) return this.limited(`h:${serverId}`, "server_hour", server[0] + HOUR_MS, t);
+    if (this.agent.length >= MCP_CATALOG_PER_AGENT_HOUR) return this.limited("a", "agent_hour", this.agent[0] + HOUR_MS, t);
+    server.push(t);
+    this.agent.push(t);
+    this.inFlight.add(serverId);
+    return "ok";
+  }
+  release(serverId) {
+    this.inFlight.delete(serverId);
+  }
+  limited(key, scope, windowEnd, t) {
+    if (t >= (this.quietUntil.get(key) ?? -Infinity)) {
+      this.quietUntil.set(key, windowEnd);
+      this.onRateLimited(scope);
+    }
+    return "rate_limited";
+  }
+};
 
 // src/bridge-agent.ts
 function logSendSupersededAdoption(kind2) {
@@ -36205,6 +37116,7 @@ function selectVoiceGuidance(isDm, voiceDefaultResponder) {
   }
   return VOICE_MODE_GUIDANCE;
 }
+var MCP_INERT_STATES = /* @__PURE__ */ new Set(["suspended", "no_config", "switch_off", "no_manifest", "section_absent", "malformed", "no_capability"]);
 var VOICE_COALESCE_WINDOW_MS = 0;
 var VOICE_COALESCE_WINDOW_MAX_MS = 5e3;
 function voiceCoalesceWindowFromEnv(env = process.env) {
@@ -36217,8 +37129,8 @@ function voiceWindowEligible(t) {
 }
 function waitMs(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve) => {
-    const t = setTimeout(resolve, ms);
+  return new Promise((resolve2) => {
+    const t = setTimeout(resolve2, ms);
     t.unref?.();
   });
 }
@@ -36255,10 +37167,10 @@ var ChannelPendingError = class extends Error {
   }
 };
 var RateLimitedError = class extends Error {
-  constructor(channelId, retryAfterMs) {
-    super(`channel ${channelId} send rate limit exceeded (retry in ${retryAfterMs}ms)`);
+  constructor(channelId, retryAfterMs2) {
+    super(`channel ${channelId} send rate limit exceeded (retry in ${retryAfterMs2}ms)`);
     this.channelId = channelId;
-    this.retryAfterMs = retryAfterMs;
+    this.retryAfterMs = retryAfterMs2;
     this.name = "RateLimitedError";
   }
 };
@@ -36355,7 +37267,7 @@ var FileOwnerAuthorityStore = class {
   }
   async readAll() {
     try {
-      return JSON.parse(await fsp.readFile(this.path, "utf8"));
+      return JSON.parse(await fsp2.readFile(this.path, "utf8"));
     } catch (e) {
       if (e.code === "ENOENT") return {};
       throw e;
@@ -36368,8 +37280,8 @@ var FileOwnerAuthorityStore = class {
   async save(enclaveId, pin) {
     const all = await this.readAll();
     all[enclaveId] = pin;
-    await fsp.mkdir(dirname5(this.path), { recursive: true });
-    await fsp.writeFile(this.path, JSON.stringify(all), "utf8");
+    await fsp2.mkdir(dirname6(this.path), { recursive: true });
+    await fsp2.writeFile(this.path, JSON.stringify(all), "utf8");
   }
 };
 var AgentPausedSendError = class extends Error {
@@ -36386,6 +37298,31 @@ var SendForbiddenError = class extends Error {
     this.name = "SendForbiddenError";
   }
 };
+var MCP_POLICY_RETRY_DELAYS_MS = Object.freeze([1e3, 5e3, 3e4, 12e4, 3e5]);
+function logMcpCatalogRequest(state) {
+  writeServiceLog2(state === "sent" ? "info" : "warn", "mcp.catalog_request", { state: ServiceLogEnum.of(state, [
+    "malformed",
+    "not_owner_dm",
+    "not_verified",
+    "replay",
+    "relay_leaf",
+    "not_ready",
+    "in_flight",
+    "runtime_timeout",
+    "runtime_refused",
+    "withheld",
+    "send_failed",
+    "failed",
+    "sent"
+  ]) });
+}
+var McpReplyWithheldError = class extends SendForbiddenError {
+  constructor(channelId) {
+    super(channelId);
+    this.name = "McpReplyWithheldError";
+    this.message = "reply withheld: the chat is no longer private to the owner and the agent; no retry";
+  }
+};
 var RoomClassChangedSendError = class extends SendForbiddenError {
   constructor(channelId) {
     super(channelId);
@@ -36405,6 +37342,7 @@ function rosterFreshAt(entry, heldEpoch, heldGroupId) {
 var RoomGrantEpochMovedError = class extends Error {
 };
 var ROOM_GRANT_TRACK_MAX = 4096;
+var MCP_DELIVERED_TRACK_MAX = 4096;
 var VOICE_FRAME_PARENT_MAX = 4096;
 var SessionSupersededError = class extends Error {
   constructor() {
@@ -36556,8 +37494,12 @@ var BridgeAgent = class _BridgeAgent {
       onSupersedeUnopenable: (channelId, groupId) => this.healSupersedeUnopenable(channelId, groupId, this.drainExemptionAtCallIn())
     });
     this.home = deps.home ?? homedir4();
+    this.mcpCatalog = deps.mcpCatalog;
+    this.mcpDeliveredTrackMax = deps.mcpDeliveredTrackMax ?? MCP_DELIVERED_TRACK_MAX;
+    this.mcpPolicyRetryDelaysMs = deps.mcpPolicyRetryDelaysMs?.length ? deps.mcpPolicyRetryDelaysMs : MCP_POLICY_RETRY_DELAYS_MS;
     this.grantWriters = {
       writeManifestPolicy: deps.grantWriters?.writeManifestPolicy ?? writeManifestPolicy,
+      writeMcpPolicy: deps.grantWriters?.writeMcpPolicy ?? writeMcpPolicy,
       writeManagedFiles: deps.grantWriters?.writeManagedFiles ?? writeManagedFiles,
       bindRuntimeConfig: deps.grantWriters?.bindRuntimeConfig ?? bindRuntimeConfig,
       removeManagedLlmSource: deps.grantWriters?.removeManagedLlmSource ?? removeManagedLlmSource
@@ -36576,7 +37518,7 @@ var BridgeAgent = class _BridgeAgent {
           threshold: EMBEDDING_MANIFEST.similarityThreshold,
           warm: windowsSemanticOn(this.platform)
         };
-        return deps.rankingTransport ? deps.rankingTransport(init) : workerTransport(init, dirname5(fileURLToPath2(import.meta.url)));
+        return deps.rankingTransport ? deps.rankingTransport(init) : workerTransport(init, dirname6(fileURLToPath2(import.meta.url)));
       }
     });
     this.embedder = deps.embedder ?? (deps.hostMachine === true && deps.home === void 0 ? new EmbedderClient({ identityId: cfg.identityId, home: homedir4(), source: cfg.modelSource, fetchImpl: this.fetchImpl, platform: this.platform }) : INERT_EMBEDDER);
@@ -36587,7 +37529,7 @@ var BridgeAgent = class _BridgeAgent {
       modelId: EMBEDDING_MANIFEST.modelId,
       threshold: EMBEDDING_MANIFEST.similarityThreshold
     });
-    this.heartbeat = new CallHeartbeat(this.machinePaths ? join17(this.home, ".securecoms", "run", "voice-call") : null, cfg.identityId, VOICE_LIVE_WINDOW_MS);
+    this.heartbeat = new CallHeartbeat(this.machinePaths ? join18(this.home, ".securecoms", "run", "voice-call") : null, cfg.identityId, VOICE_LIVE_WINDOW_MS);
     this.reembed = new ReembedQueue({
       store: this.store,
       embedder: this.embedder,
@@ -36646,15 +37588,15 @@ var BridgeAgent = class _BridgeAgent {
     this.bootDrainWaitMs = deps.bootDrainWaitMs ?? BOOT_DRAIN_WAIT_MS_DEFAULT;
     this.searchCapabilityRefetchDebounceMs = deps.searchCapabilityRefetchDebounceMs ?? SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS;
     this.searchCapabilityRefetchMaxWaitMs = deps.searchCapabilityRefetchMaxWaitMs ?? SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS;
-    this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve) => {
-      const t = setTimeout(resolve, ms);
+    this.replySleep = deps.replySleep ?? ((ms) => new Promise((resolve2) => {
+      const t = setTimeout(resolve2, ms);
       t.unref?.();
     }));
     this.actionRateFloor = new TokenBucketFloor({ capacity: 1, refillPerMinute: 30, now: this.actionClock });
     this.globalActionRateFloor = new TokenBucketFloor({ capacity: 1, refillPerMinute: 30, now: this.actionClock });
     const self = this;
     this.downloadBlobImpl = deps.downloadBlob ?? async function(blobId) {
-      const url = `${cfg.apiBase}/api/v1/attachments/${encodeURIComponent(blobId)}?caller_identity_id=${encodeURIComponent(cfg.identityId)}`;
+      const url = `${cfg.apiBase}/api/v1/attachments/${encodeURIComponent(assertBlobId(blobId))}?caller_identity_id=${encodeURIComponent(cfg.identityId)}`;
       const res = await fetchWithDeadline(self.fetchImpl, url, { headers: { authorization: `Bearer ${cfg.apiKey}` } }, {
         op: "attachment_download",
         timeoutMs: FETCH_DEADLINE_MS.blobBase,
@@ -36674,8 +37616,9 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join17(dirname5(cfg.storePath), "attachments");
-    this.vaultOwnerStoreImpl = deps.vaultOwnerStore ?? new FileOwnerAuthorityStore(join17(dirname5(cfg.storePath), "vault-owner-pins.json"));
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join18(dirname6(cfg.storePath), "attachments");
+    this.vaultOutboxDirImpl = deps.vaultOutboxDir !== void 0 ? deps.vaultOutboxDir : cfg.storePath === ":memory:" ? null : join18(dirname6(cfg.storePath), VAULT_OUTBOX_DIRNAME);
+    this.vaultOwnerStoreImpl = deps.vaultOwnerStore ?? new FileOwnerAuthorityStore(join18(dirname6(cfg.storePath), "vault-owner-pins.json"));
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -37042,6 +37985,39 @@ var BridgeAgent = class _BridgeAgent {
   roomDefaultGrants = roomDefaultGrantsEnabled();
   /** Owner grants (spec §7.4): the two manifest switches, read once at construction. */
   ownerDmManifestGrants = ownerDmManifestGrantsEnabled();
+  /**
+   * MCP client Task 16 (OQ-16, coordinator ruling D-7): SECURECOMS_MCP_GRANTS, read ONCE at construction. "off" writes
+   * kill_switch (deleting); any value other than unset/"on"/"off" is suspended (non-deleting, one content-free warn).
+   */
+  mcpHostSwitch = mcpGrantsHostSwitch(process.env);
+  /** MCP Task 16 test seam (BridgeAgentDeps.mcpCatalog); undefined in production, so MCP_CATALOG decides. */
+  mcpCatalog;
+  /**
+   * MCP Task 16 (OQ-1; PR-B1 audit M-2): the two raw /files fields from the LAST fetch. Any failed or rejected fetch
+   * sets `fetched: false` (no_config, non-deleting): the last values are never kept to keep an `ok` document alive.
+   */
+  mcpConfig = Object.freeze({ fetched: false });
+  /**
+   * MCP Task 16: the mcp-policy.json document this process last WROTE (the file the runtime reads), or null before the
+   * first write and after a failed one (fail closed: issuance reads only a document known to be on disk).
+   */
+  mcpPolicyWritten = null;
+  mcpPolicyWrittenJson = null;
+  /** PR-B2 follow-up: a failed write is retried on this backoff (the last value repeats) until one lands or close(). */
+  mcpPolicyRetryDelaysMs;
+  mcpPolicyRetryTimer = null;
+  mcpPolicyRetryAttempt = 0;
+  /** MCP Task 18: the loopback catalog listers of the attached runtime sockets that declared mcp_client_v1 (ws-server.ts). */
+  mcpCatalogListers = /* @__PURE__ */ new Map();
+  /** MCP Task 18 (OQ-15): per server 1 in flight, 3 / 60 s, 20 / hour; per agent 40 / hour. Memory only. */
+  mcpCatalogRate = new McpCatalogRateLimiter({
+    onRateLimited: (scope) => writeServiceLog2("warn", "mcp.catalog_request", {
+      state: ServiceLogEnum.of("catalog_rate_limited", ["catalog_rate_limited"]),
+      scope: ServiceLogEnum.of(scope, ["server_minute", "server_hour", "agent_hour"])
+    })
+  });
+  /** MCP Task 18: answers in progress (outside the ingest cycle). Observable by tests; close() does not wait on them. */
+  mcpCatalogWork = /* @__PURE__ */ new Set();
   roomManifestGrants = roomManifestGrantsEnabled();
   /**
    * Audit M-B4: DM channels whose roster was epoch-fresh at THIS ingest
@@ -37052,6 +38028,39 @@ var BridgeAgent = class _BridgeAgent {
   // RECORDED here and in the sealed store; no grant code reads it in step 1.
   toolGrantManifest = null;
   toolGrantCounter = null;
+  /**
+   * Tool status Phase 0 (spec §3.1, §3.2; plan Task 8): the latest owner-DM last-turn record, in memory only (no store
+   * table: after a restart there is none until the next typed owner-DM turn). ADVISORY: nothing reads it to decide a
+   * grant. Content-free: enums, booleans, one 15-minute bucket `at` (ruling M-2), one counter, built-in names from the
+   * allowlist. This is the latest record, open bucket included; what leaves the host is the sender's closed record.
+   */
+  ownerDmLastTurn = null;
+  /**
+   * Test seams (Task 8; ruling M-2): the cause function, the bridge clock the record and the sender read, and the
+   * sender's timer and jitter source.
+   */
+  toolStatusCause = ownerDmCause;
+  toolStatusNow = () => Date.now();
+  toolStatusSetTimer = defaultToolStatusSetTimer;
+  toolStatusClearTimer = defaultToolStatusClearTimer;
+  toolStatusRandom = Math.random;
+  /**
+   * Phase 0 Task 9 (spec §3.5), ruling M-2: the post of the record to the narrow route, only just after a 15-minute
+   * UTC bucket boundary, and only a record whose bucket has closed.
+   */
+  toolStatusSender = new ToolStatusSender({
+    post: (rec) => this.postToolStatus(rec),
+    now: () => this.toolStatusNow(),
+    setTimer: (fn, ms) => this.toolStatusSetTimer(fn, ms),
+    clearTimer: (h) => this.toolStatusClearTimer(h),
+    random: () => this.toolStatusRandom(),
+    onFailure: (kind2) => writeServiceLog2("warn", "tool_status.post_failed", { status: ServiceLogEnum.of(kind2, ["http_error", "timeout", "network"]) })
+  });
+  /**
+   * MCP Phase 1 Task 14 (OQ-3 ruling item 3): the sticky R-3 flag, mirrored from the sealed store. Starts false and is
+   * set true at start() by the store (or by a failed read, fail closed). Only applyToolGrantManifest changes it after.
+   */
+  mcpSeen = false;
   manifestState = "no_manifest";
   /** Failed owner-turn checks since the last successful runtime-config report (§7.7). */
   ownerVerifyFailures = 0;
@@ -37406,6 +38415,9 @@ var BridgeAgent = class _BridgeAgent {
   uploadBlobImpl;
   /** Track 5: directory where received attachments are saved. */
   attachmentsDirImpl;
+  vaultOutboxDirImpl;
+  /** Audit 2026-10-30 HIGH 2: the outbox pinned at start(); null = every upload refused. */
+  outboxPin = null;
   /** B7: persistence for the vault kekset's owner-pin TOFU state. */
   vaultOwnerStoreImpl;
   /** B7: last-seen kekset generation per enclave, enforced monotonic across
@@ -37514,10 +38526,12 @@ var BridgeAgent = class _BridgeAgent {
       const payload = await res.json();
       if (!payload) {
         writeServiceLog2("warn", "runtime_config.empty_response");
+        this.noteMcpConfigUnfetched();
         return;
       }
       if (typeof payload.version !== "number") {
         writeServiceLog2("warn", "runtime_config.invalid_version");
+        this.noteMcpConfigUnfetched();
         return;
       }
       const version = payload.version;
@@ -37531,6 +38545,9 @@ var BridgeAgent = class _BridgeAgent {
         manifestStepThrew = true;
         writeServiceLog2("warn", "authz.config_binding", { state: ServiceLogEnum.of("bind_failed", ["bind_failed"]) }, e);
       }
+      const raw = payload;
+      this.mcpConfig = Object.freeze({ fetched: true, mcp_entitled: raw.mcp_entitled, mcp_cause: raw.mcp_cause });
+      this.recomputeMcpPolicy();
       const pin = this.cfg.ownerGrantPin?.pin ?? null;
       const inForce = pin !== null ? this.toolGrantManifest : null;
       if (inForce !== null && pin !== null) {
@@ -37597,8 +38614,81 @@ var BridgeAgent = class _BridgeAgent {
       await this.postRuntimeConfigReport(base, version, skillsJson);
     } catch (e) {
       writeServiceLog2("warn", "runtime_config.refetch_failed", {}, e);
+      this.noteMcpConfigUnfetched();
     }
   }
+  /** MCP Task 16 (OQ-1): the bridge's in-force entitlement reading; not fetched (or failed) is suspended. */
+  mcpEntitlementInForce() {
+    return this.mcpConfig.fetched ? mcpEntitlementReading(this.mcpConfig.mcp_entitled, this.mcpConfig.mcp_cause) : "suspended";
+  }
+  /** PR-B1 audit M-2: forget the last /files fields and rewrite mcp-policy.json (no_config: no grants, no deletion). */
+  noteMcpConfigUnfetched() {
+    this.mcpConfig = Object.freeze({ fetched: false });
+    this.recomputeMcpPolicy();
+  }
+  /** MCP Task 16: the live inputs of mcp-policy.json (the pinned manifest in force only). */
+  mcpPolicyInput() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    return {
+      hostSwitch: this.mcpHostSwitch,
+      config: this.mcpConfig,
+      ownerDmManifestSwitchOn: this.ownerDmManifestGrants,
+      manifest: pin !== null ? this.toolGrantManifest : null,
+      capability: this.mcpClientCapable(),
+      mcpSeen: this.mcpSeen,
+      ...this.mcpCatalog ? { catalog: this.mcpCatalog } : {}
+    };
+  }
+  /**
+   * MCP Task 16 (spec §12.1): recompute mcp-policy.json and write it when it changed. The written document is what MCP
+   * issuance and release-time re-narrowing read, so it is cleared BEFORE the write and set only after it lands: a failed
+   * write leaves no document in force here (no MCP grant), and the next trigger tries again. Never throws.
+   */
+  recomputeMcpPolicy() {
+    const doc = mcpPolicyFor(this.mcpPolicyInput());
+    const json2 = JSON.stringify(doc);
+    if (json2 === this.mcpPolicyWrittenJson) return;
+    if (MCP_INERT_STATES.has(doc.state) && !doc.r3_hold && Object.keys(doc.servers).length === 0 && !existsSync5(join18(runtimeConfigDir(this.home, this.cfg.identityId), MCP_POLICY_FILE))) {
+      this.mcpPolicyWritten = doc;
+      this.mcpPolicyWrittenJson = json2;
+      this.clearMcpPolicyRetry();
+      return;
+    }
+    this.mcpPolicyWritten = null;
+    this.mcpPolicyWrittenJson = null;
+    try {
+      this.grantWriters.writeMcpPolicy(this.home, this.cfg.identityId, doc);
+    } catch (e) {
+      writeServiceLog2("warn", "authz.mcp_policy", { state: ServiceLogEnum.of("write_failed", ["write_failed"]) }, e);
+      this.scheduleMcpPolicyRetry();
+      return;
+    }
+    this.mcpPolicyWritten = doc;
+    this.mcpPolicyWrittenJson = json2;
+    this.clearMcpPolicyRetry();
+  }
+  /** A document is in force: no pending retry, and the next failure starts the backoff from the first delay. */
+  clearMcpPolicyRetry() {
+    this.mcpPolicyRetryAttempt = 0;
+    if (this.mcpPolicyRetryTimer !== null) clearTimeout(this.mcpPolicyRetryTimer);
+    this.mcpPolicyRetryTimer = null;
+  }
+  /**
+   * PR-B2 follow-up: one pending retry at a time. The retry recomputes from the state THEN (never re-writes a stale
+   * document); any other trigger that writes successfully meanwhile cancels it. Nothing is in force on the bridge side
+   * until a write lands (mcpPolicyWritten stays null).
+   */
+  scheduleMcpPolicyRetry() {
+    if (this.closingDown || this.mcpPolicyRetryTimer !== null) return;
+    const d = this.mcpPolicyRetryDelaysMs;
+    const delay = d[Math.min(this.mcpPolicyRetryAttempt, d.length - 1)];
+    this.mcpPolicyRetryAttempt++;
+    this.mcpPolicyRetryTimer = setTimeout(() => {
+      this.mcpPolicyRetryTimer = null;
+      if (!this.closingDown) this.recomputeMcpPolicy();
+    }, delay);
+    this.mcpPolicyRetryTimer.unref?.();
+  }
   /**
    * Plan 4 Task 11: the refetch under a manifest in force. Returns false when the binding failed (H-4),
    * after the memory was applied; the caller then writes nothing else. Throws only from a file write, with
@@ -37682,7 +38772,7 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** No manifest in force: a manifest-policy.json left by an earlier one is replaced by an empty tool list. */
   overwriteStalePolicy() {
-    if (!existsSync5(join17(runtimeConfigDir(this.home, this.cfg.identityId), "manifest-policy.json"))) return;
+    if (!existsSync5(join18(runtimeConfigDir(this.home, this.cfg.identityId), "manifest-policy.json"))) return;
     this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, { v: 1, manifest_tools: [], secret_path_mode: "enforce" });
   }
   /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
@@ -37690,6 +38780,7 @@ var BridgeAgent = class _BridgeAgent {
     const local = readLocalReport(this.home, this.cfg.identityId);
     const reportedSearchProviders = this.searchProvidersCapable();
     const reportedUtilityTools = this.utilityToolsCapable();
+    const carriedOwnerDmTurn = this.toolStatusSender.carry();
     const report = {
       applied_version: version,
       paths: checkConfiguredPaths(skillsJson),
@@ -37759,8 +38850,17 @@ var BridgeAgent = class _BridgeAgent {
         // D19 item 4: content-free; the signed provider is one the attached runtime(s) cannot honour.
         search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders),
         // Weather/currency §8 item 5: a separate key, false with no runtime attached.
-        utility_tools_v1: reportedUtilityTools
-      }
+        utility_tools_v1: reportedUtilityTools,
+        // MCP Task 19 (spec §12.3): separate from `capability`; content-free enums and pattern tokens only.
+        mcp_capability: this.reportedMcpCapability(),
+        mcp_servers: this.reportedMcpServers(),
+        // Tool status Phase 0 (spec §3.5, round 2 H-5): an updated bridge, with or without a record yet.
+        tool_status_v1: true
+      },
+      // Tool status Phase 0 (spec §3.5): the record rides every apply-time report, so record_report's wholesale replace
+      // never erases it. Ruling M-2: the sender's CLOSED record, never the latest one, so a report sent inside a bucket
+      // never reveals that bucket's change early. Advisory and content-free.
+      ...carriedOwnerDmTurn ? { owner_dm_last_turn: carriedOwnerDmTurn } : {}
     };
     const reportedVerifyFailures = this.ownerVerifyFailures;
     const posted = await this.fetchBounded("runtime_config_report", "control", `${base}/report`, {
@@ -37849,8 +38949,16 @@ var BridgeAgent = class _BridgeAgent {
   }
   async startBody() {
     this.startedAt = Date.now();
+    if (this.vaultOutboxDirImpl) {
+      try {
+        this.outboxPin = ensureOutbox(this.vaultOutboxDirImpl);
+      } catch (e) {
+        writeServiceLog2("warn", "vault_outbox.unavailable", {}, e);
+      }
+    }
     await this.restoreRuntimeInbox();
     await this.loadToolGrantState();
+    this.recomputeMcpPolicy();
     this.recomputeManifestPolicy(NO_FEATURES);
     try {
       this.store.pruneRoomSearchCap(utcDayOf(Date.now()));
@@ -37874,8 +38982,8 @@ var BridgeAgent = class _BridgeAgent {
     const drain = this.ingestOnce().then(() => true, () => true);
     const drainedInTime = await Promise.race([
       drain,
-      new Promise((resolve) => {
-        const t = setTimeout(() => resolve(false), this.bootDrainWaitMs);
+      new Promise((resolve2) => {
+        const t = setTimeout(() => resolve2(false), this.bootDrainWaitMs);
         t.unref?.();
         void drain.then(() => clearTimeout(t));
       })
@@ -37885,7 +38993,7 @@ var BridgeAgent = class _BridgeAgent {
       await this.bootReconcileKeyPackage();
     } else {
       writeServiceLog2("warn", "boot.drain_slow", { wait_ms: this.bootDrainWaitMs });
-      const settled = new Promise((resolve) => this.ingestSettledWaiters.push(resolve));
+      const settled = new Promise((resolve2) => this.ingestSettledWaiters.push(resolve2));
       this.deferredBootPublish = settled.then(async () => {
         this.bootDrainPending = false;
         if (this.closingDown) return;
@@ -38868,7 +39976,9 @@ var BridgeAgent = class _BridgeAgent {
    * for every envelope built, BEFORE it is published (SEC-06 #18 persists it
    * there so a retry can resend the exact bytes).
    */
-  async publishBody(channelId, body, id, onEnvelope, sealCheck) {
+  async publishBody(channelId, body, id, onEnvelope, sealCheck, inReplyTo, mcpTurn) {
+    const mcpGuard = mcpTurn === true || this.mcpReplyGuarded(channelId, inReplyTo ?? void 0);
+    let attempt = 0;
     this.enforceBodyRateFloor(channelId, body);
     this.statusGate.replyStarted(channelId);
     const joined = await this.reconcileJoin(channelId);
@@ -38908,6 +40018,8 @@ var BridgeAgent = class _BridgeAgent {
         );
       },
       async (envelope) => {
+        attempt++;
+        if (mcpGuard) this.assertMcpReplyRelayFree(channelId, envelope, attempt);
         if (onEnvelope) await onEnvelope(envelope);
         return this.publishEnvelope(
           channelId,
@@ -38917,6 +40029,77 @@ var BridgeAgent = class _BridgeAgent {
     );
     this.latency.record("send.total", performance.now() - sendStart);
   }
+  /**
+   * MCP Task 16 (round 2 H-D): message ids whose DELIVERED authorization (after release-time re-narrowing) carried an
+   * `mcp:` grant, with their channel and whether the runtime acked them. Recorded at the buffer exit, the one place
+   * every consumer's copy leaves from (over-recording a turn a non-capable consumer then received without the grant only
+   * adds a check). Kept after the ack, so a late frame citing the turn is still checked. Bounded: the oldest ACKED entry
+   * goes first.
+   */
+  mcpDeliveredTurns = /* @__PURE__ */ new Map();
+  mcpDeliveredTrackMax;
+  /**
+   * Record `m` when its authorization carries an `mcp:` grant. Returns false ONLY when `m` is a new turn, the record is
+   * at its bound and no entry is acked: the caller (the buffer exit) must then issue no mcp: grant (audit M-2, fail
+   * closed). `rebuild` (PR-B2 audit C-1 (b): a restored runtime-inbox row, or a replayed turn) records unconditionally:
+   * those grants were issued before, so the record may exceed its bound by at most the runtime inbox's size.
+   */
+  noteMcpDelivered(m, rebuild = false) {
+    if (!m.authorization?.tool_grants.some((g) => g.tool.startsWith(MCP_GRANT_PREFIX))) return true;
+    if (!this.mcpDeliveredTurns.has(m.message_id) && this.mcpDeliveredTurns.size >= this.mcpDeliveredTrackMax) {
+      let victim;
+      for (const [id, r] of this.mcpDeliveredTurns) if (r.acked) {
+        victim = id;
+        break;
+      }
+      if (victim !== void 0) this.mcpDeliveredTurns.delete(victim);
+      else if (!rebuild) return false;
+    }
+    this.mcpDeliveredTurns.set(m.message_id, { channelId: m.channel_id, acked: false });
+    return true;
+  }
+  /**
+   * H-D: whether a frame to `channelId` must pass the relay-free check: it answers a recorded MCP turn (any channel:
+   * a frame of that turn sent elsewhere is checked against ITS channel), or it cites no turn while an MCP turn is
+   * unacked in the same channel.
+   */
+  mcpReplyGuarded(channelId, inReplyTo) {
+    if (inReplyTo !== void 0 && this.mcpDeliveredTurns.has(inReplyTo)) return true;
+    if (inReplyTo !== void 0) return false;
+    for (const r of this.mcpDeliveredTurns.values()) if (!r.acked && r.channelId === channelId) return true;
+    return false;
+  }
+  /**
+   * H-D, synchronous: read the channel's local leaves from the warm manager in one step and tie the read to the
+   * envelope's SEALED group and epoch, so the leaf set is exactly the membership that can open these bytes. Owner and
+   * agent only: pass. Anyone else: withhold. The tree moved past the seal on the first attempt: StaleEpochError, which
+   * sendWithSelfHeal answers with its one converge-and-re-seal (the existing semantics); still unprovable on the retry,
+   * or no warm manager, no pin, or any throw: withhold (fail closed). Read-only; never touches the group.
+   *
+   * Scope (PR-B2 audit item 5): this guards the `send` path (publishBody) only. `status` detail, the `action_*` run
+   * frames, `/v1/send-attachment` and summary frames are NOT checked; they are safe for MCP turns only because the
+   * runtime emits none of them (pinned by connect-agent-runtime/src/outbound-frames.arch.test.ts). A runtime that starts
+   * emitting any of them needs this guard extended to that frame first.
+   */
+  assertMcpReplyRelayFree(channelId, envelope, attempt) {
+    let verdict = "unknown";
+    try {
+      const pin = this.cfg.ownerGrantPin?.pin ?? null;
+      const snap = this.provider.leafSnapshotCached(channelId);
+      const sealedGroup = sealedGroupIdOf(envelope);
+      if (pin !== null && snap !== null && sealedGroup !== void 0 && snap.groupId === sealedGroup) {
+        if (snap.epoch === envelope.mls_group_epoch) {
+          verdict = ownerDmLeavesRelayFree(snap.leaves, { ownerIdentityId: pin.ownerIdentityId, agentIdentityId: this.cfg.identityId }) ? "free" : "relay";
+        } else if (snap.epoch > envelope.mls_group_epoch) verdict = "moved";
+      }
+    } catch {
+      verdict = "unknown";
+    }
+    if (verdict === "free") return;
+    if (verdict === "moved" && attempt === 1) throw new StaleEpochError(envelope.mls_group_epoch, envelope.mls_group_epoch + 1);
+    writeServiceLog2("warn", "mcp.reply_withheld", { state: ServiceLogEnum.of(verdict, ["relay", "moved", "unknown"]) });
+    throw new McpReplyWithheldError(channelId);
+  }
   /**
    * Audit M-B1 (controller ruling): a reply to a room-granted turn is sealed
    * only at the epoch the room was classified at. On a move, the room is
@@ -38928,9 +40111,9 @@ var BridgeAgent = class _BridgeAgent {
    * the redelivery replay (replayReplyIntents, which has no in_reply_to in its
    * options) is checked the same as a live send.
    */
-  async publishBodyForReply(channelId, body, id, inReplyTo, onEnvelope) {
+  async publishBodyForReply(channelId, body, id, inReplyTo, onEnvelope, mcpTurn) {
     const grant = inReplyTo !== null ? this.roomGrantEpochs.get(inReplyTo) : void 0;
-    if (grant === void 0) return this.publishBody(channelId, body, id, onEnvelope);
+    if (grant === void 0) return this.publishBody(channelId, body, id, onEnvelope, void 0, inReplyTo, mcpTurn);
     if (channelId !== grant.channelId) {
       writeServiceLog2("warn", "reply.room_class_changed");
       throw new RoomClassChangedSendError(channelId);
@@ -38952,7 +40135,9 @@ var BridgeAgent = class _BridgeAgent {
           },
           (epoch) => {
             if (epoch !== grant.epoch) throw new RoomGrantEpochMovedError();
-          }
+          },
+          inReplyTo,
+          mcpTurn
         );
       } catch (e) {
         if (!(e instanceof RoomGrantEpochMovedError)) throw e;
@@ -39087,14 +40272,15 @@ var BridgeAgent = class _BridgeAgent {
         const k = replyIntentKey({ inReplyTo: opts.inReplyTo, idempotencyKey: opts.idempotencyKey, ordinal: () => 0 });
         if (!k) throw new Error("idempotent send without a key");
         const id = replyMessageId(this.replyIdKey, this.cfg.identityId, channelId, k);
-        const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, opts.credit);
-        const { intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit: opts.credit ?? null });
-        if (intent.bodyMac !== mac2 || intent.channelId !== channelId || intent.state === "skipped") {
+        const mcpTurn = this.mcpReplyGuarded(channelId, opts.inReplyTo);
+        const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, opts.credit, mcpTurn);
+        const { intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit: opts.credit ?? null, mcpTurn });
+        if (intent.bodyMac !== replyBodyMac(this.replyIdKey, id, channelId, bytes, opts.credit, intent.mcpTurn) || intent.channelId !== channelId || intent.state === "skipped") {
           throw new IdempotencyConflictError();
         }
         return k;
       }
-      return this.claimUnkeyedPart(opts.inReplyTo, channelId, bytes, true, opts.credit ?? null);
+      return this.claimUnkeyedPart(opts.inReplyTo, channelId, bytes, true, opts.credit ?? null, false);
     });
     return this.publishIntent(key, opts);
   }
@@ -39103,25 +40289,26 @@ var BridgeAgent = class _BridgeAgent {
    * the reply to `inReplyTo`. Caller holds the scope lock. `matchRetry` false
    * after a slot collision: the body must go to a NEW part.
    */
-  async claimUnkeyedPart(inReplyTo, channelId, bytes, matchRetry, replyCredit) {
+  async claimUnkeyedPart(inReplyTo, channelId, bytes, matchRetry, replyCredit, inheritedMcpTurn) {
     const credit = replyCredit ?? void 0;
+    const mcpTurn = inheritedMcpTurn || this.mcpReplyGuarded(channelId, inReplyTo);
     const scope = `reply:${inReplyTo}`;
     let latest = null;
     for (const intent of await this.store.listReplyIntents(inReplyTo)) {
       const n = intent.scope === scope ? partOrdinal(intent.part) : null;
       if (n !== null && (latest === null || n > latest.ordinal)) latest = { ordinal: n, intent };
     }
-    if (matchRetry && latest && latest.intent.state !== "skipped" && latest.intent.channelId === channelId && latest.intent.bodyMac === replyBodyMac(this.replyIdKey, latest.intent.replyMessageId, channelId, bytes, credit)) {
+    if (matchRetry && latest && latest.intent.state !== "skipped" && latest.intent.channelId === channelId && latest.intent.bodyMac === replyBodyMac(this.replyIdKey, latest.intent.replyMessageId, channelId, bytes, credit, latest.intent.mcpTurn)) {
       return { scope, part: latest.intent.part, inReplyTo };
     }
     let ordinal = latest ? latest.ordinal + 1 : 0;
     for (let i = 0; i < REPLY_MAX_PART_ADVANCES; i++, ordinal++) {
       const k = { scope, part: `p:${ordinal}`, inReplyTo };
       const id = replyMessageId(this.replyIdKey, this.cfg.identityId, channelId, k);
-      const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, credit);
-      const { created, intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit });
+      const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, credit, mcpTurn);
+      const { created, intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit, mcpTurn });
       if (created) return k;
-      if (matchRetry && intent.state !== "skipped" && intent.bodyMac === mac2 && intent.channelId === channelId) return k;
+      if (matchRetry && intent.state !== "skipped" && intent.channelId === channelId && intent.bodyMac === replyBodyMac(this.replyIdKey, id, channelId, bytes, credit, intent.mcpTurn)) return k;
       writeServiceLog2("info", "reply.part_slot_taken", { attempt: i + 1 });
     }
     throw new Error("could not claim a reply part");
@@ -39173,7 +40360,7 @@ var BridgeAgent = class _BridgeAgent {
       const purgeEpochBeforePublish = this.store.conversationPurgeEpoch(intent.channelId);
       const replyCapture = this.unifiedReplyCapture(intent.channelId, intent.inReplyTo ?? void 0);
       try {
-        await this.publishIntentWithRetry(intent.channelId, body, intent.replyMessageId, key, intent.inReplyTo);
+        await this.publishIntentWithRetry(intent.channelId, body, intent.replyMessageId, key, intent.inReplyTo, intent.mcpTurn);
       } catch (e) {
         if (e instanceof AgentPausedSendError || e instanceof SendForbiddenError) {
           if (intent.inReplyTo !== null) this.store.deletePendingReplyIntents(intent.inReplyTo);
@@ -39200,7 +40387,7 @@ var BridgeAgent = class _BridgeAgent {
             JSON.stringify(["scope", key.scope]),
             () => (
               // r2 BLOCKER 1: the colliding row's OWN credit (verified above), never `opts`.
-              this.claimUnkeyedPart(inReplyTo, intent.channelId, bytes, false, isReplyCredit(intent.replyCredit) ? intent.replyCredit : null)
+              this.claimUnkeyedPart(inReplyTo, intent.channelId, bytes, false, isReplyCredit(intent.replyCredit) ? intent.replyCredit : null, intent.mcpTurn)
             )
           );
           return this.publishIntent(next, opts, advances + 1);
@@ -39222,7 +40409,7 @@ var BridgeAgent = class _BridgeAgent {
     if (credit !== null && !isReplyCredit(credit)) return false;
     const id = replyMessageId(this.replyIdKey, this.cfg.identityId, intent.channelId, intent);
     if (id !== intent.replyMessageId) return false;
-    return replyBodyMac(this.replyIdKey, intent.replyMessageId, intent.channelId, intent.body, credit ?? void 0) === intent.bodyMac;
+    return replyBodyMac(this.replyIdKey, intent.replyMessageId, intent.channelId, intent.body, credit ?? void 0, intent.mcpTurn === true) === intent.bodyMac;
   }
   /**
    * Weather/currency Task 17: what a verified row's reply is RECORDED as. Null credit: the decoded text unchanged (null
@@ -39243,12 +40430,12 @@ var BridgeAgent = class _BridgeAgent {
    * failure. Either way the intent stays pending, so the redelivery
    * republishes the same reply.
    */
-  async publishIntentWithRetry(channelId, body, id, key, inReplyTo) {
+  async publishIntentWithRetry(channelId, body, id, key, inReplyTo, mcpTurn) {
     let rateLimited = 0;
     let inFlight = 0;
     for (; ; ) {
       try {
-        await this.publishIntentOnce(channelId, body, id, key, inReplyTo);
+        await this.publishIntentOnce(channelId, body, id, key, inReplyTo, mcpTurn);
         return;
       } catch (e) {
         if (e instanceof ReplyInFlightError) {
@@ -39319,8 +40506,9 @@ var BridgeAgent = class _BridgeAgent {
    * original ack; a conflict can only mean the slot belongs to another
    * message (for example an old reply whose intent was pruned).
    */
-  async publishIntentOnce(channelId, body, id, key, inReplyTo) {
+  async publishIntentOnce(channelId, body, id, key, inReplyTo, mcpTurn) {
     const current = await this.store.getReplyIntent(key.scope, key.part);
+    const guardMcp = mcpTurn || current?.mcpTurn === true;
     try {
       if (current?.envelope) {
         const cached = JSON.parse(new TextDecoder().decode(current.envelope));
@@ -39370,7 +40558,8 @@ var BridgeAgent = class _BridgeAgent {
             key.part,
             new TextEncoder().encode(JSON.stringify(envelope)),
             sealedGroupIdOf(envelope)
-          )
+          ),
+          guardMcp
         );
       } catch (e) {
         if (publishConflictCode(e) === "message_id_conflict") throw new ReplyIdCollisionError();
@@ -39392,7 +40581,8 @@ var BridgeAgent = class _BridgeAgent {
       uploadBlob: (ciphertext, channelId) => this.uploadBlobImpl(ciphertext, channelId),
       encryptFile,
       bytesToBase64: bytesToBase642,
-      readFile: (p) => fsp.readFile(p).then((b) => new Uint8Array(b))
+      // Security fix 2026-10-30: attachments upload only from the outbox.
+      readFile: (p) => readOutboxFile(this.outboxPin, p).then((r) => r.bytes)
     };
   }
   receiveDeps() {
@@ -39402,8 +40592,8 @@ var BridgeAgent = class _BridgeAgent {
       decryptFile,
       computeFileDigest,
       base64ToBytes: base64ToBytes2,
-      mkdirp: (d) => fsp.mkdir(d, { recursive: true }).then(() => void 0),
-      writeFile: (p, data) => fsp.writeFile(p, data)
+      mkdirp: (d) => fsp2.mkdir(d, { recursive: true }).then(() => void 0),
+      writeFile: (p, data) => fsp2.writeFile(p, data)
     };
   }
   async sendAttachment(channelId, filePath2, caption) {
@@ -39411,8 +40601,11 @@ var BridgeAgent = class _BridgeAgent {
     const joined = await this.reconcileJoin(channelId);
     if (!joined) throw new ChannelPendingError(channelId);
     let body;
+    let read;
     try {
-      body = await prepareAttachment(filePath2, caption, channelId, this.sendDeps());
+      read = await readOutboxFile(this.outboxPin, filePath2);
+      const bytes = read.bytes;
+      body = await prepareAttachment(filePath2, caption, channelId, { ...this.sendDeps(), readFile: async () => bytes });
     } catch (e) {
       if (e.code === "ENOENT" || e.code === "EACCES" || e.code === "ENOTDIR" || e.code === "EISDIR") {
         throw new InvalidPathError(filePath2, e);
@@ -39453,6 +40646,7 @@ var BridgeAgent = class _BridgeAgent {
     );
     this.latency.record("send.total", performance.now() - sendStart);
     this.agentHops.noteOwnSend(channelId);
+    await this.consumeUploaded(read);
     return { message_id: id, status: "sent" };
   }
   // ── B7: FileSafe vault commands (loopback boundary) ──────────────────────
@@ -39978,25 +41172,26 @@ var BridgeAgent = class _BridgeAgent {
       }
     };
   }
-  /** Read `path` off local disk, encrypt + wrap its DEK under the vault's
+  /** Read `path` from the vault outbox (security fix 2026-10-30; see
+   *  ./outbox.ts), encrypt + wrap its DEK under the vault's
    *  current KEK generation, and create+upload+commit it as a new vault
    *  file node named `name` (which may differ from `path`'s basename). */
   async vaultWrite(enclaveId, vaultChannelId, path, name) {
-    const session = await this.getVaultSession(enclaveId, await this.resolveVaultChannelId(enclaveId, vaultChannelId));
-    let bytes;
+    let read;
     try {
-      bytes = new Uint8Array(await fsp.readFile(path));
+      read = await readOutboxFile(this.outboxPin, path);
     } catch (e) {
       const code = e.code;
       if (code === "ENOENT" || code === "EACCES" || code === "ENOTDIR" || code === "EISDIR") throw new InvalidPathError(path, e);
       throw e;
     }
+    const session = await this.getVaultSession(enclaveId, await this.resolveVaultChannelId(enclaveId, vaultChannelId));
     const nodeId = crypto.randomUUID();
-    return vaultWriteImpl({
+    const written = await vaultWriteImpl({
       enclaveId,
       nodeId,
       name,
-      bytes,
+      bytes: read.bytes,
       deps: {
         exporterKekForGeneration: session.kekForGeneration,
         currentGeneration: session.currentGeneration,
@@ -40005,6 +41200,16 @@ var BridgeAgent = class _BridgeAgent {
         commitNode: (committedNodeId) => this.vaultCommitNode(enclaveId, committedNodeId)
       }
     });
+    await this.consumeUploaded(read);
+    return written;
+  }
+  /** Audit 2026-10-30 MED 5: an uploaded file leaves the outbox (no plaintext lingers). Content-free log. */
+  async consumeUploaded(read) {
+    if (!this.outboxPin || !await consumeOutboxFile(this.outboxPin, read)) writeServiceLog2("warn", "vault_outbox.consume_failed");
+  }
+  /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
+  vaultOutboxPath() {
+    return this.outboxPin?.dir ?? null;
   }
   /** Download + verify + decrypt a vault file node. Returns the plaintext
    *  base64-encoded (the loopback boundary is JSON-only, mirroring how
@@ -41865,16 +43070,20 @@ var BridgeAgent = class _BridgeAgent {
       }
       if (v.sender_id !== pin.ownerIdentityId) return this.ownerTurnFailed(m, "malformed");
       let leafClass = "ok";
+      let relay = void 0;
       if (this.freshMeta(keyChannel)?.is_dm === true) {
         const signedDm = this.toolGrantManifest?.owner_dm_channel_id;
         if (signedDm !== void 0 && signedDm !== keyChannel) return this.ownerTurnFailed(m, "wrong_dm_channel");
-        leafClass = classifyOwnerDmLeaves((await this.provider.leafTreeSummary(m.channelId)).leaves, {
+        const leaves = (await this.provider.leafTreeSummary(m.channelId)).leaves;
+        const relayIdentityId = this.toolGrantManifest?.owner_dm_relay_identity_id;
+        leafClass = classifyOwnerDmLeaves(leaves, {
           ownerIdentityId: pin.ownerIdentityId,
           agentIdentityId: this.cfg.identityId,
-          relayIdentityId: this.toolGrantManifest?.owner_dm_relay_identity_id,
+          relayIdentityId,
           isServerRelay: (id) => this.freshRoster(m.channelId)?.get(id)?.is_relay === true
         });
         if (leafClass === "foreign") return this.ownerTurnFailed(m, "not_owner_dm_leaves");
+        relay = ownerDmRelayOf(leafClass, leaves, { ownerIdentityId: pin.ownerIdentityId, agentIdentityId: this.cfg.identityId, relayIdentityId });
       }
       const held = await this.heldPosition(m.channelId);
       if (held.groupId === null) return this.ownerTurnFailed(m, "verify_error");
@@ -41883,7 +43092,9 @@ var BridgeAgent = class _BridgeAgent {
       }
       const replay = Object.freeze({ channelId: m.channelId, groupId: held.groupId, epoch: v.mls_group_epoch });
       this.ownerReplayPending.set(m.messageId, replay);
-      return Object.freeze({ kind: leafClass === "unsigned_relay" ? "constants_only" : "verified", replay });
+      const relayField = relay !== void 0 ? { relay } : {};
+      if (leafClass === "unsigned_relay") return Object.freeze({ kind: "constants_only", replay, ...relayField });
+      return Object.freeze({ kind: "verified", replay, ...relayField, relayLeaf: relayLeafFromPhase0Relay(relay) });
     } catch {
       return this.ownerTurnFailed(m, "verify_error");
     }
@@ -41959,6 +43170,12 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** start(): drop other keys' manifest state, re-verify the stored one for the pinned key, and prune. */
   async loadToolGrantState() {
+    try {
+      this.mcpSeen = await this.store.loadMcpSeen();
+    } catch (e) {
+      this.mcpSeen = true;
+      writeServiceLog2("warn", "authz.mcp_seen_load_failed", {}, e);
+    }
     const pin = this.cfg.ownerGrantPin?.pin;
     if (!pin) return;
     try {
@@ -41966,9 +43183,10 @@ var BridgeAgent = class _BridgeAgent {
       this.store.dropToolGrantAppliedExcept(pin.publicKeyB64);
       const saved = await this.store.loadToolGrantManifest(pin.publicKeyB64);
       if (saved) {
-        const v = verifyToolGrantManifest(saved.wrapper, { pin, agentIdentityId: this.cfg.identityId, storedCounter: null });
+        const v = verifyToolGrantManifest(saved.wrapper, { pin, agentIdentityId: this.cfg.identityId, storedCounter: null, ...this.mcpCatalog ? { mcpCatalog: this.mcpCatalog } : {} });
         if (v.state === "ok") {
           this.toolGrantManifest = v.manifest;
+          if (v.manifest.signedMcpPresent && !this.mcpSeen) await this.setMcpSeen(true);
           this.toolGrantCounter = v.manifest.counter;
         } else {
           this.logManifest("malformed");
@@ -41993,8 +43211,9 @@ var BridgeAgent = class _BridgeAgent {
       this.logManifest("no_manifest");
       return;
     }
-    const v = verifyToolGrantManifest(raw, { pin, agentIdentityId: this.cfg.identityId, storedCounter: this.toolGrantCounter });
+    const v = verifyToolGrantManifest(raw, { pin, agentIdentityId: this.cfg.identityId, storedCounter: this.toolGrantCounter, ...this.mcpCatalog ? { mcpCatalog: this.mcpCatalog } : {} });
     if (v.state === "ok") {
+      if (v.manifest.signedMcpPresent) await this.setMcpSeen(true);
       try {
         await this.store.saveToolGrantManifest(pin.publicKeyB64, v.manifest.counter, v.wrapper);
       } catch {
@@ -42003,13 +43222,34 @@ var BridgeAgent = class _BridgeAgent {
       }
       this.toolGrantManifest = v.manifest;
       this.toolGrantCounter = v.manifest.counter;
+      this.recomputeMcpPolicy();
+      if (v.manifest.mcpKey === "present" && !v.manifest.signedMcpPresent && this.mcpSeen) await this.setMcpSeen(false);
       this.logManifest("ok");
       if (v.droppedUnknown) this.logManifest("unknown_entry");
       return;
     }
     this.logManifest(v.state);
+    if (v.state === "wrong_owner") this.dropOwnerDmLastTurn();
     if (v.state !== "unchanged" && this.toolGrantManifest) this.logManifest("kept_last_good");
   }
+  /**
+   * MCP Task 14: the R-3 hold Task 17 filters on and Task 15 writes as `r3_hold`. True while the manifest in force signs
+   * an owner_dm `mcp:` string, or while the sticky flag is set (an old client's re-sign cannot lift it, audit C-1).
+   */
+  r3Hold() {
+    return this.toolGrantManifest?.signedMcpPresent === true || this.mcpSeen;
+  }
+  /** Persist then mirror. Setting mirrors even on a failed write; clearing mirrors only after the write (fail closed). */
+  async setMcpSeen(seen) {
+    if (seen) this.mcpSeen = true;
+    try {
+      await this.store.saveMcpSeen(seen);
+    } catch (e) {
+      writeServiceLog2("warn", "authz.mcp_seen_save_failed", {}, e);
+      return;
+    }
+    this.mcpSeen = seen;
+  }
   logManifest(state) {
     this.manifestState = state;
     const quiet = state === "ok" || state === "unchanged" || state === "no_pin" || state === "no_manifest";
@@ -42106,6 +43346,7 @@ var BridgeAgent = class _BridgeAgent {
     let tool_grants = NO_TOOL_GRANTS;
     let relaySpeaker;
     let memoryWrite = false;
+    let relayFree = false;
     const epochFresh = rosterFreshAt(entry, heldEpoch, heldGroupId) && (opts.voice === void 0 || rosterFreshAt(vEntry, opts.voice.heldEpoch, opts.voice.heldGroupId));
     const ownerDmFresh = epochFresh || opts.voice === void 0 && this.ownerDmCycleFresh.has(channelId);
     if (ownerDmFresh && this.ownerDmDefaultGrants && meta?.is_dm === true && sender) {
@@ -42132,6 +43373,7 @@ var BridgeAgent = class _BridgeAgent {
       tool_grants = ROOM_DEFAULT_READ_GRANTS;
     }
     let grantSource = tool_grants.length ? "constant" : "none";
+    let ownerDmEffective = null;
     const manifest = this.cfg.ownerGrantPin?.pin ? this.toolGrantManifest : null;
     const binding = this.manifestBinding;
     const boundNow = binding !== null && binding.state === "bound" && binding.counter === this.toolGrantCounter;
@@ -42150,6 +43392,21 @@ var BridgeAgent = class _BridgeAgent {
       });
       tool_grants = r.grants;
       grantSource = r.source;
+      ownerDmEffective = r;
+      const mcp = mcpIssuance({
+        source: r.source,
+        verdict: opts.ownerVerdict,
+        entitlement: this.mcpEntitlementInForce(),
+        hostSwitch: this.mcpHostSwitch,
+        ownerDmManifestSwitchOn: this.ownerDmManifestGrants,
+        disabled: this.payloadToolDeny,
+        manifest,
+        policy: this.mcpPolicyWritten
+      });
+      if (mcp.length > 0) {
+        tool_grants = Object.freeze([...tool_grants, ...mcp]);
+        relayFree = true;
+      }
     } else if (tool_grants === ROOM_DEFAULT_READ_GRANTS) {
       const r = effectiveToolGrants({
         audience: "team_room",
@@ -42167,12 +43424,39 @@ var BridgeAgent = class _BridgeAgent {
     if (opts.ownerVerdict?.kind === "failed") {
       tool_grants = NO_TOOL_GRANTS;
       memoryWrite = false;
+      relayFree = false;
       relaySpeaker = void 0;
       grantSource = "none";
     }
     const roomClass = meta?.is_dm !== false ? "na" : entry?.crossOrg === false ? "internal" : entry?.crossOrg === true ? "cross_org" : "unknown";
     if (opts.log !== false) {
       this.logAuthzDecision(channelId, senderId, relaySpeakerId, audience, tool_grants.length, roomClass, epochFresh, memoryWrite, grantSource);
+      const pinOwner = this.cfg.ownerGrantPin?.pin?.ownerIdentityId;
+      const verdict = opts.ownerVerdict;
+      if (pinOwner !== void 0 && senderId === pinOwner && meta?.is_dm === true && relaySpeakerId === void 0 && opts.voiceScoped !== true && opts.voice === void 0 && verdict !== void 0 && verdict.kind !== "unchecked" && !(verdict.kind === "failed" && verdict.reason === "replay")) {
+        const pinned = this.channelOwner.get(channelId);
+        const ownerId = pinned && pinned !== "anomalous" ? pinned.identityId : void 0;
+        const ownerDirect = ownerId !== void 0 && audience === "owner_dm" && senderId === ownerId;
+        this.noteOwnerDmTurn({
+          cause: {
+            killSwitchOff: !this.ownerDmDefaultGrants,
+            manifestSwitchOff: !this.ownerDmManifestGrants,
+            pinMissingOrAnomalous: ownerId === void 0,
+            // OQ-5: only from a PRESENT roster entry; a missing (TTL-expired) entry is `stale` below.
+            senderNotOwner: entry !== void 0 && (sender === void 0 || !ownerDirect),
+            stale: !ownerDmFresh || entry === void 0,
+            verdict,
+            manifestPresent: manifest !== null,
+            signedDmChannel: manifest?.owner_dm_channel_id,
+            channelId,
+            boundNow,
+            consumerAttached: this.manifestConsumer !== null
+          },
+          grantSource,
+          toolGrants: tool_grants,
+          withheld: grantSource === "manifest" && ownerDmEffective !== null ? ownerDmEffective.withheld : []
+        });
+      }
     }
     return Object.freeze({
       version: 1,
@@ -42180,9 +43464,78 @@ var BridgeAgent = class _BridgeAgent {
       sender_membership: sender ? "active" : "unknown",
       tool_grants,
       ...relaySpeaker ? { relay_speaker: relaySpeaker } : {},
-      ...memoryWrite ? { memory_write: true } : {}
+      ...memoryWrite ? { memory_write: true } : {},
+      ...relayFree ? { relay_free: true } : {}
     });
   }
+  /**
+   * Tool status Phase 0 (spec §3.2, §3.5; plan Task 8; round 1 H-2, M-4; round 2 H-4): build the candidate record and
+   * keep the previous one (and its `at`) when the change tuple is the same, so `at` means "last changed". Never throws
+   * into the authorization path. Never logs a channel id, sender id or tool name.
+   */
+  noteOwnerDmTurn(t) {
+    try {
+      const v = t.cause.verdict;
+      const relay = (v.kind === "verified" || v.kind === "constants_only") && v.relay !== void 0 ? v.relay : "unknown";
+      let reason = {};
+      if (t.grantSource !== "manifest") {
+        const c = this.toolStatusCause(t.cause);
+        if (c !== null && c.source === t.grantSource && c.cause !== void 0) {
+          reason = c.sub !== void 0 ? { cause: c.cause, sub: c.sub } : { cause: c.cause };
+        } else {
+          writeServiceLog2("warn", "tool_status.source_mismatch");
+        }
+      } else {
+        const c = this.toolStatusCause(t.cause);
+        if (c === null || c.source !== "manifest") writeServiceLog2("warn", "tool_status.source_mismatch");
+      }
+      const names = t.toolGrants.map((g) => g.tool);
+      const candidate = Object.freeze({
+        at: bucketStartAt(this.toolStatusNow()),
+        // ruling M-2: the 15-minute UTC bucket, never the minute
+        counter: this.toolGrantCounter,
+        source: t.grantSource,
+        ...reason,
+        relay,
+        issued: Object.freeze(sanitizeIssued(names)),
+        withheld: Object.freeze(t.withheld.map((w) => Object.freeze({ tool: w.tool, why: w.why }))),
+        // A count only, never a name (content-free). 0 unless the MCP issuance above added mcp: grants.
+        mcp_issued: Math.min(160, names.filter((n) => n.startsWith("mcp:")).length)
+      });
+      if (sameTuple(this.ownerDmLastTurn, candidate)) return;
+      this.ownerDmLastTurn = candidate;
+      this.toolStatusSender.note(candidate);
+    } catch (e) {
+      writeServiceLog2("warn", "tool_status.record_failed", {}, e);
+    }
+  }
+  /** R2-M1: the served manifest names another owner than the pin; the held record belongs to the old owner. */
+  dropOwnerDmLastTurn() {
+    this.ownerDmLastTurn = null;
+    this.toolStatusSender.drop();
+  }
+  /**
+   * Phase 0 Task 9 (spec §3.5): POST the record, body = the record only, to the narrow agent-key route. The backend
+   * resolves the identity from the device credential; no identity, channel or sender id is in the URL or the body.
+   * Returns the status class only; never throws.
+   */
+  async postToolStatus(rec) {
+    try {
+      const res = await this.fetchBounded("runtime_config_tool_status", "control", `${this.cfg.apiBase}/api/v1/agents/me/runtime-config/tool-status`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${this.cfg.apiKey}`, "content-type": "application/json" },
+        body: JSON.stringify(rec)
+      });
+      const retryAfter = res.headers.get("retry-after");
+      try {
+        await res.body?.cancel();
+      } catch {
+      }
+      return { status: res.status, retryAfter };
+    } catch (e) {
+      return e?.name === "FetchDeadlineError" ? "timeout" : "network";
+    }
+  }
   /**
    * One content-free INFO line per authorization decision (every call site of
    * authorizationFor stages exactly one runtime turn). It says WHY a turn got
@@ -42406,6 +43759,111 @@ var BridgeAgent = class _BridgeAgent {
    * client's own wait already renders "Summary unavailable" — so there is
    * nothing to catch here besides the send itself.
    */
+  /**
+   * MCP client Task 18 (spec §8 item 2; audit M-3, H-3; OQ-2, OQ-15). Accept an `mcp_catalog_request` only when: its
+   * body is exactly the §8 shape; it is a direct frame (never a voice channel's) in a channel the server marks as a DM
+   * that IS the signed owner DM; verifyOwnerTurn says `verified` (the pinned owner's signature, the signed DM, the leaf
+   * check, not a replay) with `relayLeaf === false`; mcp-policy.json as written is `ok` with this server `ok`; a runtime
+   * socket that declared mcp_client_v1 is attached; and the rate limits admit it. The replay row is written HERE
+   * (M-3: the request never reaches stageRuntimeInbox, where it is otherwise written), for every verified request, before
+   * anything is answered; the ownerReplayPending entry is removed in `finally`. A failure to record answers nothing.
+   * Never throws. The answer runs outside the ingest cycle, so the row is acked now.
+   */
+  async acceptMcpCatalogRequest(m, body) {
+    try {
+      const req = parseMcpCatalogRequest(body);
+      if (req === null) return logMcpCatalogRequest("malformed");
+      const signedDm = this.toolGrantManifest?.owner_dm_channel_id;
+      if (this.keyChannelForFrame(m) !== m.channelId || this.freshMeta(m.channelId)?.is_dm !== true || signedDm === void 0 || signedDm !== m.channelId) {
+        return logMcpCatalogRequest("not_owner_dm");
+      }
+      const verdict = await this.verifyOwnerTurn(m);
+      if (verdict.kind !== "verified") return logMcpCatalogRequest(verdict.kind === "failed" && verdict.reason === "replay" ? "replay" : "not_verified");
+      this.store.recordOwnerMessage(verdict.replay.channelId, m.messageId, verdict.replay.groupId, verdict.replay.epoch, Date.now());
+      if (verdict.relayLeaf !== false) return logMcpCatalogRequest("relay_leaf");
+      const target = this.mcpCatalogTarget(req.serverId);
+      const lister = this.mcpClientCapable() ? this.mcpCatalogListers.values().next().value : void 0;
+      if (target === null || lister === void 0) return logMcpCatalogRequest("not_ready");
+      const admitted = this.mcpCatalogRate.admit(req.serverId);
+      if (admitted !== "ok") return admitted === "in_flight" ? logMcpCatalogRequest("in_flight") : void 0;
+      const work = this.outsideIngestCycle(() => this.answerMcpCatalogRequest(m.channelId, req, lister)).finally(() => {
+        this.mcpCatalogRate.release(req.serverId);
+        this.mcpCatalogWork.delete(work);
+      });
+      this.mcpCatalogWork.add(work);
+    } catch {
+      logMcpCatalogRequest("failed");
+    } finally {
+      this.ownerReplayPending.delete(m.messageId);
+    }
+  }
+  /** The signed server's vendor and the bridge catalog row's issuer, when mcp-policy.json as WRITTEN is `ok` with it `ok`. */
+  mcpCatalogTarget(serverId) {
+    const doc = this.mcpPolicyWritten;
+    if (doc === null || doc.state !== "ok" || !Object.prototype.hasOwnProperty.call(doc.servers, serverId)) return null;
+    const s = doc.servers[serverId];
+    if (s.state !== "ok" || s.vendor === void 0) return null;
+    const catalog = this.mcpCatalog ?? MCP_CATALOG;
+    if (!Object.prototype.hasOwnProperty.call(catalog, s.vendor)) return null;
+    return { vendor: s.vendor, issuer: catalog[s.vendor].issuer };
+  }
+  /** Ask the runtime, re-check, build (384 KB cap) and send. Never throws. */
+  async answerMcpCatalogRequest(channelId, req, lister) {
+    try {
+      const target = this.mcpCatalogTarget(req.serverId);
+      if (target === null) return logMcpCatalogRequest("not_ready");
+      const frame = await lister(req.serverId, MCP_CATALOG_LIST_TIMEOUT_MS);
+      if (frame === null || frame === void 0) return logMcpCatalogRequest("runtime_timeout");
+      const listed = validateCatalogListReply(frame, req.serverId, target.vendor);
+      if (listed === null) return logMcpCatalogRequest("runtime_refused");
+      const still = this.mcpCatalogTarget(req.serverId);
+      if (still === null || still.vendor !== target.vendor) return logMcpCatalogRequest("not_ready");
+      await this.sendMcpCatalog(channelId, buildMcpCatalogBody({ serverId: req.serverId, requestId: req.requestId, vendor: still.vendor, issuer: still.issuer, reply: listed }));
+      logMcpCatalogRequest("sent");
+    } catch (e) {
+      logMcpCatalogRequest(e instanceof McpReplyWithheldError ? "withheld" : "send_failed");
+    }
+  }
+  /**
+   * The `mcp_catalog` reply: a system_event envelope with a body-level type (the sendSummary shape), on the shared
+   * self-heal seam and the one publish chokepoint. H-D applies to EVERY attempt (it carries vendor-supplied tool
+   * descriptions): after the seal, before the POST, the leaves at the SEALED group and epoch must be exactly the owner
+   * and the agent, or the frame is withheld. One message id across the retry.
+   */
+  async sendMcpCatalog(channelId, body) {
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    const messageId = crypto.randomUUID();
+    let attempt = 0;
+    await this.sendWithSelfHealTerminal(
+      this.provider,
+      channelId,
+      (epoch) => buildOutboundEnvelope({
+        custody: this.custody,
+        groupKey: this.provider,
+        messageId,
+        channelId,
+        enclaveId: this.resolveEnclave(channelId),
+        senderId: this.cfg.identityId,
+        senderType: "agent",
+        type: "system_event",
+        bodyPlaintext: JSON.stringify(body),
+        bindingId: "",
+        bindingVersion: "0.0.0",
+        agentSkillId: null,
+        epoch,
+        traceparent: ZERO_TRACEPARENT,
+        references: [],
+        stage5Outcome: "allow",
+        stage5Evaluators: []
+      }),
+      async (envelope) => {
+        attempt++;
+        this.assertMcpReplyRelayFree(channelId, envelope, attempt);
+        return this.publishEnvelope(channelId, () => this.transport.publish(envelope));
+      }
+    );
+  }
   async handleSummarize(channelId, request) {
     const body = await runSummarize({
       request,
@@ -42437,13 +43895,13 @@ var BridgeAgent = class _BridgeAgent {
       throw new Error("summarize_no_runtime");
     }
     const messages = [{ role: "user", content: prompt }];
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => reject(new Error("aborted"));
       signal.addEventListener("abort", onAbort);
       this.fastLlm.complete(messages).then(
         (text) => {
           signal.removeEventListener("abort", onAbort);
-          resolve(text);
+          resolve2(text);
         },
         (err) => {
           signal.removeEventListener("abort", onAbort);
@@ -42916,6 +44374,11 @@ var BridgeAgent = class _BridgeAgent {
           new TextDecoder().decode(m.plaintext)
         );
         if (parsed.type && parsed.type !== "text") {
+          if (parsed.type === "mcp_catalog_request" || parsed.type === "mcp_catalog") {
+            if (parsed.type === "mcp_catalog_request") await this.acceptMcpCatalogRequest(m, parsed);
+            acked.push(m.queueId);
+            continue;
+          }
           if (parsed.type === "summarize") {
             const request = parseSummarizeBody(parsed, this.cfg.identityId, writeServiceLog2);
             if (request !== null) {
@@ -43391,7 +44854,7 @@ var BridgeAgent = class _BridgeAgent {
       return got;
     }
     const cap = Math.min(waitSeconds, 50) * 1e3;
-    await new Promise((resolve) => {
+    await new Promise((resolve2) => {
       let fired = false;
       let timer;
       const wake = () => {
@@ -43400,7 +44863,7 @@ var BridgeAgent = class _BridgeAgent {
         clearTimeout(timer);
         const i = this.waiters.indexOf(wake);
         if (i >= 0) this.waiters.splice(i, 1);
-        resolve();
+        resolve2();
       };
       timer = setTimeout(wake, cap);
       this.waiters.push(wake);
@@ -43424,7 +44887,11 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** Every buffer exit: re-narrow manifest grants (review H-1), then note the frame's attribution class (review H-3). */
   delivering(m) {
-    const out = this.renarrowManifestGrants(m);
+    let out = this.renarrowManifestGrants(m);
+    if (!this.noteMcpDelivered(out)) {
+      out = withMcpCapability(out, false);
+      writeServiceLog2("warn", "mcp.delivered_record_full");
+    }
     this.noteDeliveredFrame(out);
     return out;
   }
@@ -43435,6 +44902,50 @@ var BridgeAgent = class _BridgeAgent {
    * audience that is still signed, else dropped. Only narrows; an unchanged message is returned by reference.
    */
   renarrowManifestGrants(m) {
+    const narrowed = this.renarrowManifestGrantsBase(m);
+    return this.renarrowMcpGrants(narrowed);
+  }
+  /**
+   * MCP Task 16 (audit H-2; round 2 LOW), after the base re-narrowing: a buffered `mcp:` grant survives release only
+   * when, NOW, the turn is still a plain owner-DM turn in the signed DM channel, the host switch reads "on", the
+   * entitlement reading is in force, the name is not in skills.disabled, the mcp-policy.json document last written
+   * lists the server ok with the tool, and a FRESH synchronous read of the DM's local leaves holds exactly the pinned
+   * owner and the agent (MlsGroupKeyProvider.leafSnapshotCached: one `state` object, no await; null fails closed). Any
+   * other mcp: grant is dropped, never kept as a fallback. relay_free is dropped whenever no mcp: grant survives.
+   * Read-only: never touches the MLS group. Only narrows; returns `m` by reference when nothing changes.
+   */
+  renarrowMcpGrants(m) {
+    const a = m.authorization;
+    if (!a) return m;
+    const isMcp = (g) => g.tool.startsWith(MCP_GRANT_PREFIX);
+    if (!a.tool_grants.some(isMcp) && a.relay_free === void 0) return m;
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const manifest = pin !== null ? this.toolGrantManifest : null;
+    const turnOk = pin !== null && manifest !== null && a.audience === "owner_dm" && a.relay_speaker === void 0 && manifest.owner_dm_channel_id === m.channel_id && this.mcpHostSwitch === "on" && this.ownerDmManifestGrants && this.mcpEntitlementInForce() === "entitled" && this.ownerDmRelayFreeNow(m.channel_id, pin.ownerIdentityId);
+    const kept = a.tool_grants.filter((g) => {
+      if (!isMcp(g)) return true;
+      const parsed = parseMcpGrant(g.tool);
+      return turnOk && g.mode === "read" && g.source === "manifest" && parsed !== null && !this.payloadToolDeny.has(g.tool) && mcpPolicyAllows(this.mcpPolicyWritten, parsed.serverId, parsed.tool);
+    });
+    const keepRelayFree = a.relay_free === true && kept.some(isMcp);
+    if (kept.length === a.tool_grants.length && keepRelayFree === (a.relay_free === true)) return m;
+    const { relay_free: _relayFree, ...rest } = a;
+    return { ...m, authorization: Object.freeze({ ...rest, tool_grants: Object.freeze(kept), ...keepRelayFree ? { relay_free: true } : {} }) };
+  }
+  /**
+   * MCP Task 16 (OQ-2; audit H-2, round 2 H-D): a FRESH read of the channel's local leaf set holds exactly the pinned
+   * owner and this agent. Synchronous (one manager `state`, so the leaves belong to one epoch); a cold manager or any
+   * throw reads as NOT relay-free.
+   */
+  ownerDmRelayFreeNow(channelId, ownerIdentityId) {
+    try {
+      const snap = this.provider.leafSnapshotCached(channelId);
+      return snap !== null && ownerDmLeavesRelayFree(snap.leaves, { ownerIdentityId, agentIdentityId: this.cfg.identityId });
+    } catch {
+      return false;
+    }
+  }
+  renarrowManifestGrantsBase(m) {
     const a = m.authorization;
     if (!a || !a.tool_grants.some((g) => g.mode === "read" && g.source === "manifest")) return m;
     const audience = a.audience === "owner_dm" || a.audience === "team_room" ? a.audience : null;
@@ -43443,13 +44954,13 @@ var BridgeAgent = class _BridgeAgent {
     const bound = b !== null && b.state === "bound" && b.counter === this.toolGrantCounter;
     const switchOn = audience === "owner_dm" ? this.ownerDmManifestGrants : audience === "team_room" ? this.roomManifestGrants : false;
     const signedNow = new Set(audience && manifest ? manifest.grants[audience] ?? [] : []);
-    const constants4 = new Set(audience === "owner_dm" ? OWNER_DM_DEFAULT_READ_GRANTS.map((g) => g.tool) : audience === "team_room" ? ROOM_DEFAULT_READ_GRANTS.map((g) => g.tool) : []);
+    const constants5 = new Set(audience === "owner_dm" ? OWNER_DM_DEFAULT_READ_GRANTS.map((g) => g.tool) : audience === "team_room" ? ROOM_DEFAULT_READ_GRANTS.map((g) => g.tool) : []);
     let changed = false;
     const out = a.tool_grants.flatMap((g) => {
       if (!(g.mode === "read" && g.source === "manifest")) return [g];
       if (switchOn && bound && signedNow.has(g.tool)) return [g];
       changed = true;
-      return constants4.has(g.tool) && signedNow.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+      return constants5.has(g.tool) && signedNow.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
     });
     if (!changed) return m;
     return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(out) }) };
@@ -43530,6 +45041,7 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     if (!this.admitRuntimeDelivery(m)) return;
+    this.noteMcpDelivered(m, true);
     const ch = m.channel_id;
     this.replayingChannels.add(ch);
     this.replyIntentReplays++;
@@ -43880,11 +45392,11 @@ ${channelId}`;
       if (!res.ok) return void 0;
       const rows = await res.json();
       if (!Array.isArray(rows)) return void 0;
-      const own = rows.find(
+      const own2 = rows.find(
         (r) => r?.identity_id === this.cfg.identityId
       );
-      if (!own) return void 0;
-      return typeof own.paused_at === "string" && own.paused_at.length > 0;
+      if (!own2) return void 0;
+      return typeof own2.paused_at === "string" && own2.paused_at.length > 0;
     } catch (e) {
       writeServiceLog2("warn", "pause.probe_failed", {}, e);
       return void 0;
@@ -43917,6 +45429,10 @@ ${channelId}`;
   /** Complete the durable handoff only after the runtime explicitly acks. */
   ackRuntimeMessages(messageIds) {
     for (const id of messageIds) this.roomGrantEpochs.delete(id);
+    for (const id of messageIds) {
+      const r = this.mcpDeliveredTurns.get(id);
+      if (r) r.acked = true;
+    }
     for (const messageId of messageIds) {
       this.store.ackRuntimeInbox(messageId);
       this.runtimePendingIds.delete(messageId);
@@ -43998,6 +45514,7 @@ ${channelId}`;
       const message = rest;
       this.applyStagedMarks(message.message_id, marks);
       this.runtimePendingIds.add(message.message_id);
+      this.noteMcpDelivered(message, true);
       if (this.cfg.ownerGrantPin?.pin && this.isOwnerVerifyFailed(message.message_id)) {
         this.ownerVerifyFailedIds.set(message.message_id, message.channel_id);
       }
@@ -44178,6 +45695,67 @@ ${channelId}`;
   clearSearchProvidersSocket(token) {
     if (this.searchProvidersSockets.delete(token)) this.onCapabilityMaybeChanged();
   }
+  /** MCP Task 16 (spec §15): the same AND-over-sockets state for mcp_client_v1, kept per socket. */
+  mcpClientSockets = /* @__PURE__ */ new Map();
+  noteMcpClientSocket(token, declared) {
+    this.mcpClientSockets.set(token, declared);
+    this.onCapabilityMaybeChanged();
+  }
+  clearMcpClientSocket(token) {
+    if (this.mcpClientSockets.delete(token)) this.onCapabilityMaybeChanged();
+  }
+  /** MCP Task 18: ws-server registers (or, with null, removes) a socket's loopback catalog lister. */
+  noteMcpCatalogLister(token, lister) {
+    if (lister === null) this.mcpCatalogListers.delete(token);
+    else this.mcpCatalogListers.set(token, lister);
+  }
+  /**
+   * MCP Task 19 (spec §12.3): "ok" when every attached runtime socket declared mcp_client_v1 (the AND, which harness
+   * sockets hold false: a harness socket counts in the AND and never declares it); else "harness_consumer" when the
+   * latest hello was a harness; else "missing".
+   */
+  reportedMcpCapability() {
+    if (this.mcpClientCapable()) return "ok";
+    return this.lastConsumerCapability === "harness_consumer" ? "harness_consumer" : "missing";
+  }
+  /**
+   * MCP Task 19 (spec §12.3): at most 8 `{server_id, vendor, state}` for the signed servers of the manifest in force,
+   * from mcp-policy.json as WRITTEN. Only the states the bridge itself knows: top `kill_switch` and `not_entitled` give
+   * that state per server; top `ok` gives `ok` for a server the bridge lists `ok` and `malformed` for one it refused.
+   * Every other top state (no capability, suspended, no config, switch off, section absent, malformed section) gives no
+   * row. The runtime-only states (needs_login, login_expired, definition_changed, server_version_unsupported,
+   * server_unreachable) have no runtime-to-bridge report path in Phase 1. `vendor` is reported only when it is a key of
+   * the bridge's compiled catalog; a signed vendor outside it gives no row. Never a tool name, URL or issuer.
+   */
+  reportedMcpServers() {
+    const doc = this.mcpPolicyWritten;
+    const signed = (this.cfg.ownerGrantPin?.pin ?? null) !== null ? this.toolGrantManifest?.mcp?.servers : void 0;
+    if (doc === null || signed === void 0) return [];
+    const catalog = this.mcpCatalog ?? MCP_CATALOG;
+    const out = [];
+    for (const id of Object.keys(signed).sort()) {
+      if (out.length >= 8) break;
+      const vendor = signed[id].vendor;
+      if (!Object.prototype.hasOwnProperty.call(catalog, vendor)) continue;
+      let state;
+      if (doc.state === "kill_switch" || doc.state === "not_entitled") state = doc.state;
+      else if (doc.state === "ok") state = Object.prototype.hasOwnProperty.call(doc.servers, id) && doc.servers[id].state === "ok" ? "ok" : "malformed";
+      else continue;
+      out.push({ server_id: id, vendor, state });
+    }
+    return out;
+  }
+  /**
+   * MCP Task 16: every attached runtime socket declared mcp_client_v1; no socket attached means absent (false).
+   * PR-B2 follow-up (documented): a HARNESS socket counts in this AND. ws-server notes every socket that said hello,
+   * and a harness hello is always noted `false` (harnessClaimed never resets), so one attached harness connector holds
+   * the capability false for files, the report and mcp-policy.json (top `no_capability`) while it is attached.
+   */
+  mcpClientCapable() {
+    if (this.mcpClientSockets.size === 0) return false;
+    for (const v of this.mcpClientSockets.values()) if (!v) return false;
+    return true;
+  }
   noteUtilityToolsSocket(token, declared) {
     this.utilityToolsSockets.set(token, declared);
     this.onCapabilityMaybeChanged();
@@ -44196,6 +45774,7 @@ ${channelId}`;
     const out = /* @__PURE__ */ new Set();
     if (this.searchProvidersCapable()) out.add("search_providers_v2");
     if (this.utilityToolsCapable()) out.add("utility_tools_v1");
+    if (this.mcpClientCapable()) out.add("mcp_client_v1");
     return out;
   }
   /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
@@ -44224,11 +45803,12 @@ ${channelId}`;
    * switches and the new capability, then a debounced refetch (one per burst) only when needed.
    */
   onCapabilityMaybeChanged() {
-    const next = { search: this.searchProvidersCapable(), utility: this.utilityToolsCapable() };
+    const next = { search: this.searchProvidersCapable(), utility: this.utilityToolsCapable(), mcp: this.mcpClientCapable() };
     const prev = this.capabilityState;
-    if (prev !== null && prev.search === next.search && prev.utility === next.utility) return;
+    if (prev !== null && prev.search === next.search && prev.utility === next.utility && prev.mcp === next.mcp) return;
     this.capabilityState = next;
     this.recomputeManifestPolicy(this.capabilityFeatures());
+    this.recomputeMcpPolicy();
     if (this.closingDown) return;
     if (prev === null && !next.search && !next.utility) return;
     const now = Date.now();
@@ -44266,7 +45846,7 @@ ${channelId}`;
       }
       const withheld = new Set(Object.keys(TOOL_FEATURE).filter((t) => !toolAllowedByFeatures(t, features)));
       if (withheld.size === 0) return;
-      const path = join17(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
+      const path = join18(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
       if (!existsSync5(path)) return;
       let doc;
       try {
@@ -44474,6 +46054,7 @@ ${channelId}`;
   async closeOnce() {
     this.closingDown = true;
     this.statusGate.close();
+    this.toolStatusSender.close();
     for (const t of this.pauseRecheckTimers.values()) clearTimeout(t);
     this.pauseRecheckTimers.clear();
     for (const t of this.supersedeRecheckTimers.values()) clearTimeout(t);
@@ -44482,6 +46063,8 @@ ${channelId}`;
     this.redeliveryTimer = null;
     if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
     this.searchCapabilityRefetchTimer = null;
+    if (this.mcpPolicyRetryTimer !== null) clearTimeout(this.mcpPolicyRetryTimer);
+    this.mcpPolicyRetryTimer = null;
     this.pingHandle?.close();
     if (this.safetyTimer) clearInterval(this.safetyTimer);
     if (this.runtimeConfigTimer) clearInterval(this.runtimeConfigTimer);
@@ -44491,8 +46074,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         ingest.released,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44502,8 +46085,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         starting,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44512,8 +46095,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.membershipSweepWork,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44523,8 +46106,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallPruneWork,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44534,8 +46117,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallMaintenanceWork,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44547,8 +46130,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.recallTapWork]),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44557,8 +46140,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.unifiedWork]),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44567,8 +46150,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         this.recallPrewarmWork,
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44578,8 +46161,8 @@ ${channelId}`;
       let timer;
       await Promise.race([
         Promise.allSettled([...this.replyWork]),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        new Promise((resolve2) => {
+          timer = setTimeout(resolve2, _BridgeAgent.GRACEFUL_DRAIN_MS);
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -44592,7 +46175,7 @@ ${channelId}`;
 
 // src/config.ts
 import { readFileSync as readFileSync11, statSync as statSync5 } from "node:fs";
-import { dirname as dirname6, join as join18 } from "node:path";
+import { dirname as dirname7, join as join19 } from "node:path";
 var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 var CONFIG_ERROR_MESSAGE = {
   credential_not_found: "credential file not found",
@@ -44630,7 +46213,7 @@ function loadConfig(opts) {
     throw new ConfigError("credential_not_json");
   }
   for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new ConfigError("credential_missing_field", k);
-  const storePath = opts.storePath ?? join18(dirname6(opts.credentialPath), "bridge-state.db");
+  const storePath = opts.storePath ?? join19(dirname7(opts.credentialPath), "bridge-state.db");
   const ownerGrantPin = loadOwnerGrantPin({ credentialPath: opts.credentialPath, credentialJson: json2 });
   writeServiceLog2(ownerGrantPin.state === "ok" || ownerGrantPin.state === "no_pin" ? "info" : "warn", "authz.pin", {
     state: ServiceLogEnum.of(ownerGrantPin.state, ["ok", "no_pin", "pin_conflict", "malformed", "unsupported_algo", "symlink_refused", "unreadable"])
@@ -44818,6 +46401,10 @@ var BRIDGE_ERRORS = {
   // Weather/currency Task 17 (OQ-P1): a send frame's credit is not the closed value, or rides an a2a frame. TERMINAL:
   // the inbound is retired, so the model (and the weather call) never runs again for it.
   reply_credit_unknown: { http: 400, message: "reply credit not recognised; not sent" },
+  // Security fix 2026-10-30: an upload route was given a path that is not a
+  // regular file directly inside the bridge's vault outbox (`vault_outbox` on
+  // /healthz). Fixed and content-free: the path is never echoed or logged.
+  path_outside_outbox: { http: 400, message: "uploads must come from the bridge vault outbox; copy the file there first" },
   internal: { http: 500, message: "internal error" }
 };
 function errorBody(code, detail) {
@@ -44832,63 +46419,6 @@ function wsErrorFrame(code, detail) {
   return { type: "error", ...errorBody(code, detail) };
 }
 
-// src/consumer-grants.ts
-var NO_GRANTS = Object.freeze([]);
-var PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
-function withConsumerGrants(m, perToolConsumer) {
-  if (perToolConsumer) return m;
-  const a = m.authorization;
-  if (!a) return m;
-  const stripGrants = !(a.tool_grants.length === 0 || a.audience === "owner_dm" || a.relay_speaker === "owner");
-  const stripMemory = "memory_write" in a;
-  if (!stripGrants && !stripMemory) return m;
-  const { memory_write: _dropped, ...rest } = a;
-  return { ...m, authorization: Object.freeze({ ...rest, ...stripGrants ? { tool_grants: NO_GRANTS } : {} }) };
-}
-var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
-var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
-var UTILITY_TOOLS_FEATURE = "utility_tools_v1";
-var CONSTANT_TOOL_NAMES = Object.freeze({
-  owner_dm: Object.freeze(["current_time", "web_search"]),
-  team_room: Object.freeze(["current_time"])
-});
-var isManifestGrant = (g) => g.mode === "read" && g.source === "manifest";
-function withManifestCapability(m, manifestConsumer) {
-  if (manifestConsumer) return m;
-  const a = m.authorization;
-  if (!a || !a.tool_grants.some(isManifestGrant)) return m;
-  const constants4 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
-  const narrowed = a.tool_grants.flatMap((g) => {
-    if (!isManifestGrant(g)) return [g];
-    return constants4.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
-  });
-  return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(narrowed) }) };
-}
-function withHarnessGrants(m, withheld) {
-  if (!withheld) return m;
-  const a = m.authorization;
-  if (!a || a.tool_grants.length === 0) return m;
-  return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
-}
-function withSearchCapability(m, consumerHasFeature, signedProvider) {
-  if (consumerHasFeature) return m;
-  const a = m.authorization;
-  if (!a) return m;
-  const stripSearch = signedProvider !== void 0 && signedProvider !== "brave";
-  const kept = a.tool_grants.filter((g) => g.tool !== "web_extract" && !(stripSearch && g.tool === "web_search"));
-  if (kept.length === a.tool_grants.length) return m;
-  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
-}
-var UTILITY_TOOL_NAMES = /* @__PURE__ */ new Set(["weather_forecast", "currency_convert"]);
-function withUtilityCapability(m, consumerHasFeature) {
-  if (consumerHasFeature) return m;
-  const a = m.authorization;
-  if (!a) return m;
-  const kept = a.tool_grants.filter((g) => !UTILITY_TOOL_NAMES.has(g.tool));
-  if (kept.length === a.tool_grants.length) return m;
-  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
-}
-
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
   for (let i = 0; i < msgs.length; i++) {
@@ -44911,7 +46441,8 @@ data: ${JSON.stringify(msgs[i])}
 function deliverSseBatch(res, batch, agent, onWriteError) {
   const withheld = agent.harnessGrantsWithheld();
   const provider = agent.signedSearchProvider();
-  const left3 = writeSse(res, batch.map((m) => withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false)), onWriteError);
+  const hold = agent.r3Hold();
+  const left3 = writeSse(res, batch.map((m) => withR3Holds(withMcpCapability(withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false), false), hold)), onWriteError);
   const leftIds = new Set(left3.map((message) => message.message_id));
   agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
   if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
@@ -45018,7 +46549,7 @@ function jsonError(res, code, detail) {
   json(res, httpStatus(code), errorBody(code, detail));
 }
 function readBody(req, cap) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let size = 0;
     let done = false;
     const chunks = [];
@@ -45038,7 +46569,7 @@ function readBody(req, cap) {
     req.on("end", () => {
       if (!done) {
         done = true;
-        resolve(Buffer.concat(chunks).toString("utf8"));
+        resolve2(Buffer.concat(chunks).toString("utf8"));
       }
     });
     req.on("error", (e) => {
@@ -45116,6 +46647,9 @@ function createHttpServer(agent, opts) {
         }
         return json(res, 200, r);
       }
+      if (method === "GET" && path === "/v1/vault-outbox") {
+        return json(res, 200, { path: agent.vaultOutboxPath() });
+      }
       if (method === "POST" && path === "/v1/send-attachment") {
         const parsed = sendAttachmentSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
@@ -45185,7 +46719,8 @@ function createHttpServer(agent, opts) {
         const drained = await agent.drain(channel, wait);
         const withheld = agent.harnessGrantsWithheld();
         const provider = agent.signedSearchProvider();
-        return json(res, 200, drained.map((m) => withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false)));
+        const hold = agent.r3Hold();
+        return json(res, 200, drained.map((m) => withR3Holds(withMcpCapability(withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false), false), hold)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -45227,6 +46762,10 @@ function createHttpServer(agent, opts) {
       if (e instanceof SendForbiddenError) return jsonError(res, "send_forbidden");
       if (e instanceof GroupSupersededSendError) return jsonError(res, "group_superseded");
       if (e instanceof IdempotencyConflictError) return jsonError(res, "invalid_request", e.message);
+      if (e instanceof PathOutsideOutboxError) {
+        writeServiceLog2("warn", "vault_outbox.refused");
+        return jsonError(res, "path_outside_outbox");
+      }
       if (e instanceof InvalidPathError) return jsonError(res, "invalid_request", e.message);
       if (e instanceof VaultPinMismatchError) return jsonError(res, "vault_ref_changed", { pin: e.pin });
       if (e instanceof VaultIntegrityError) return jsonError(res, "vault_integrity_failed", e.message);
@@ -45251,6 +46790,7 @@ function parseHarnessReport(raw) {
 }
 
 // src/ws-server.ts
+import { randomBytes as randomBytes12 } from "node:crypto";
 import { WebSocketServer, WebSocket } from "ws";
 
 // src/memory/consumer-notes.ts
@@ -45361,6 +46901,8 @@ function attachAgentWebSocket(server, agent, opts) {
       manifestGrants: false,
       searchProviders: false,
       utilityTools: false,
+      mcpClient: false,
+      pendingCatalog: /* @__PURE__ */ new Map(),
       // helloWaitMs 0 keeps today's synchronous initial flush exactly (the opt-out the existing tests use).
       deliveryOpen: helloWaitMs <= 0,
       deliveryToken: /* @__PURE__ */ new Map(),
@@ -45414,14 +46956,14 @@ function attachAgentWebSocket(server, agent, opts) {
             continue;
           }
           const out = withConsumerNotes(
-            withUtilityCapability(withSearchCapability(
+            withR3Holds(withMcpCapability(withUtilityCapability(withSearchCapability(
               withManifestCapability(
                 withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
                 session.manifestGrants
               ),
               session.searchProviders,
               agent.signedSearchProvider()
-            ), session.utilityTools),
+            ), session.utilityTools), session.mcpClient), agent.r3Hold()),
             batch[i],
             session,
             agent
@@ -45479,6 +47021,10 @@ function attachAgentWebSocket(server, agent, opts) {
       if (session.manifestGrants) agent.clearManifestConsumer(session);
       agent.clearSearchProvidersSocket(session);
       agent.clearUtilityToolsSocket(session);
+      agent.clearMcpClientSocket(session);
+      agent.noteMcpCatalogLister(session, null);
+      for (const settle of session.pendingCatalog.values()) settle(null);
+      session.pendingCatalog.clear();
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -45512,6 +47058,32 @@ function attachAgentWebSocket(server, agent, opts) {
     }
   };
 }
+var MCP_CATALOG_PENDING_MAX = 8;
+function mcpCatalogLister(sock, session) {
+  return (serverId, timeoutMs) => new Promise((resolve2) => {
+    if (session.closed || sock.readyState !== WebSocket.OPEN || session.pendingCatalog.size >= MCP_CATALOG_PENDING_MAX) {
+      resolve2(null);
+      return;
+    }
+    const requestId = randomBytes12(16).toString("hex");
+    const timer = setTimeout(() => {
+      session.pendingCatalog.delete(requestId);
+      resolve2(null);
+    }, timeoutMs);
+    timer.unref?.();
+    session.pendingCatalog.set(requestId, (frame) => {
+      clearTimeout(timer);
+      resolve2(frame);
+    });
+    try {
+      sock.send(JSON.stringify({ type: "mcp_catalog_list", request_id: requestId, server_id: serverId }));
+    } catch {
+      session.pendingCatalog.delete(requestId);
+      clearTimeout(timer);
+      resolve2(null);
+    }
+  });
+}
 function sendJson(sock, body) {
   if (sock.readyState !== WebSocket.OPEN) return;
   try {
@@ -45585,6 +47157,9 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     agent.noteSearchProvidersSocket(session, session.searchProviders);
     session.utilityTools = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(UTILITY_TOOLS_FEATURE);
     agent.noteUtilityToolsSocket(session, session.utilityTools);
+    session.mcpClient = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(MANIFEST_GRANTS_FEATURE) && m.features.includes(MCP_CLIENT_FEATURE);
+    agent.noteMcpClientSocket(session, session.mcpClient);
+    agent.noteMcpCatalogLister(session, session.mcpClient ? mcpCatalogLister(sock, session) : null);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -45592,13 +47167,21 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE, MCP_POLICY_WRITER_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
     }
     return;
   }
+  if (m.type === "mcp_catalog_list_result") {
+    const id = m.request_id;
+    const settle = typeof id === "string" ? session.pendingCatalog.get(id) : void 0;
+    if (settle === void 0) return;
+    session.pendingCatalog.delete(id);
+    settle(m);
+    return;
+  }
   if (m.type === "nack") {
     if (typeof m.message_id !== "string" || !m.message_id) {
       sendJson(sock, wsErrorFrame("invalid_request"));