@securecoms/agent-bridge 0.36.0 → 0.37.0

package/README.md

@@ -973,6 +973,21 @@ copied after the owner's next typed message.
 
 ---
 
+## Release notes: 0.37.0
+
+<!-- [COPY, approved by Eric 2026-11-01 ("Notes ok"), connected apps removal confirmation] -->
+
+#### What's new
+- **Connected apps are ready on the agent side.** When you remove a connected app, your agent now confirms that it deleted the app's sign-in. SecureComs shows the removal as done only after your agent confirms it.
+- The agent sends this confirmation only after a message in your private chat with it. Like the tool status summary, it gives the time only to the 15-minute period. Only you can see it.
+- You still cannot turn connected apps on. That comes in a later SecureComs update.
+
+#### Upgrade
+
+Upgrade the bridge and the runtime together, then restart your agent. Connected apps need @securecoms/agent-runtime 0.17.0.
+
+If you go back to 0.36.0, your agent keeps working.
+
 ## Release notes: 0.36.0
 
 <!-- [COPY, approved by Eric 2026-10-31 ("notes OK, ship now"), tool status + connected apps groundwork] -->

package/dist/bin.js

@@ -7555,7 +7555,7 @@ __export(import_bundle_exports, {
   ModelImportError: () => ModelImportError,
   importModelBundle: () => importModelBundle
 });
-import { createHash as createHash6, randomBytes as randomBytes13 } from "node:crypto";
+import { createHash as createHash7, randomBytes as randomBytes13 } from "node:crypto";
 import { readFileSync as readFileSync16, statSync as statSync7, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join25 } from "node:path";
 async function importModelBundle(srcDir, root3, m) {
@@ -7578,7 +7578,7 @@ async function importModelBundle(srcDir, root3, m) {
     } catch {
       throw new ModelImportError(`${f.name} is missing from the import directory`);
     }
-    if (bytes.length !== f.size || createHash6("sha256").update(bytes).digest("hex") !== f.sha256) throw mismatch;
+    if (bytes.length !== f.size || createHash7("sha256").update(bytes).digest("hex") !== f.sha256) throw mismatch;
     verified.push({ f, bytes });
   }
   const imported = [];
@@ -30465,6 +30465,7 @@ function checkGroupLink(v) {
 }
 
 // src/bridge-agent.ts
+import { createHash as createHash6 } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 
 // src/reply-intent.ts
@@ -36982,6 +36983,8 @@ function ownerDmRelayOf(leafClass, leaves, ids) {
 
 // src/grants/mcp-policy.ts
 var MCP_POLICY_WRITER_FEATURE = "mcp_policy_writer_v1";
+var MCP_DELETION_ACK_FEATURE = "mcp_deletion_ack_v1";
+var MCP_ACK_STATES = /* @__PURE__ */ new Set(["ok", "not_entitled", "kill_switch"]);
 function mcpEntitlementReading(mcpEntitled, mcpCause) {
   if (mcpEntitled === true && mcpCause === "entitled") return "entitled";
   if (mcpEntitled === false && mcpCause === "not_entitled") return "not_entitled";
@@ -38289,6 +38292,29 @@ var BridgeAgent = class _BridgeAgent {
    */
   mcpPolicyWritten = null;
   mcpPolicyWrittenJson = null;
+  /** Deletion-ack ruling §3: the manifest counter in force when `mcpPolicyWrittenJson` was written (never read live). */
+  mcpPolicyWrittenCounter = null;
+  /** Ruling §3: newest counter whose written policy the runtime fully acted on. Memory only, monotonic, starts at 0. */
+  mcpDeletionsThrough = 0;
+  /** Ruling §3: the last `credentials_present` an accepted frame carried; null until one arrives. */
+  mcpCredentialsPresentValue = null;
+  /** Ruling §3: per attached socket, whether its latest hello declared mcp_deletion_ack_v1 (harness noted false). */
+  mcpDeletionAckSockets = /* @__PURE__ */ new Map();
+  /** Ruling §3 rate: the ack-derived report values in the last report posted (null until one is). */
+  lastReportedMcpAck = null;
+  /** #1351 round 2 M-1: bumped on every byte-changing policy write (and on the inert document being put in force). */
+  policyWriteSeq = 0;
+  /** M-1: per ack-capable socket, the policyWriteSeq at the dispatch of each owner-DM turn, by message id (bounded). */
+  mcpTurnSeq = /* @__PURE__ */ new Map();
+  /**
+   * #1351 round 2 H-1: the ack values the REPORT may carry. An ack lands seconds after an owner-DM turn and a report
+   * posted then would time the turn (record_report sets applied_at). So, as the tool-status sender: `open` holds a
+   * change while its 15-minute UTC bucket is open, `closed` what the report carries, and the only post is from one
+   * timer at the next bucket boundary plus jitter.
+   */
+  mcpAckOpen = null;
+  mcpAckClosed = { through: 0, credentials: null };
+  mcpAckTimer = null;
   /** PR-B2 follow-up: a failed write is retried on this backoff (the last value repeats) until one lands or close(). */
   mcpPolicyRetryDelaysMs;
   mcpPolicyRetryTimer = null;
@@ -38933,15 +38959,22 @@ var BridgeAgent = class _BridgeAgent {
   recomputeMcpPolicy() {
     const doc = mcpPolicyFor(this.mcpPolicyInput());
     const json2 = JSON.stringify(doc);
-    if (json2 === this.mcpPolicyWrittenJson) return;
+    if (json2 === this.mcpPolicyWrittenJson) {
+      if (this.mcpPolicyWritten !== null && this.mcpPolicyWrittenCounter !== null) this.mcpPolicyWrittenCounter = this.toolGrantCounter;
+      return;
+    }
     if (MCP_INERT_STATES.has(doc.state) && !doc.r3_hold && Object.keys(doc.servers).length === 0 && !existsSync5(join20(runtimeConfigDir(this.home, this.cfg.identityId), MCP_POLICY_FILE))) {
       this.mcpPolicyWritten = doc;
       this.mcpPolicyWrittenJson = json2;
+      this.mcpPolicyWrittenCounter = this.toolGrantCounter;
+      this.policyWriteSeq++;
       this.clearMcpPolicyRetry();
       return;
     }
     this.mcpPolicyWritten = null;
     this.mcpPolicyWrittenJson = null;
+    this.mcpPolicyWrittenCounter = null;
+    this.policyWriteSeq++;
     try {
       this.grantWriters.writeMcpPolicy(this.home, this.cfg.identityId, doc);
     } catch (e) {
@@ -38951,6 +38984,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     this.mcpPolicyWritten = doc;
     this.mcpPolicyWrittenJson = json2;
+    this.mcpPolicyWrittenCounter = this.toolGrantCounter;
     this.clearMcpPolicyRetry();
   }
   /** A document is in force: no pending retry, and the next failure starts the backoff from the first delay. */
@@ -39066,6 +39100,7 @@ var BridgeAgent = class _BridgeAgent {
     const local = readLocalReport(this.home, this.cfg.identityId);
     const reportedSearchProviders = this.searchProvidersCapable();
     const reportedUtilityTools = this.utilityToolsCapable();
+    const reportedMcpAck = this.mcpAckSignature();
     const carriedOwnerDmTurn = this.toolStatusSender.carry();
     const report = {
       applied_version: version,
@@ -39140,6 +39175,9 @@ var BridgeAgent = class _BridgeAgent {
         // MCP Task 19 (spec §12.3): separate from `capability`; content-free enums and pattern tokens only.
         mcp_capability: this.reportedMcpCapability(),
         mcp_servers: this.reportedMcpServers(),
+        // Deletion-ack ruling §5.3: content-free scalars. `mcp_deletions_through` only while EVERY attached runtime socket
+        // declared mcp_deletion_ack_v1 (absent = cannot acknowledge); `mcp_credentials_present` only once one reported.
+        ...this.reportedMcpAck(),
         // Tool status Phase 0 (spec §3.5, round 2 H-5): an updated bridge, with or without a record yet.
         tool_status_v1: true
       },
@@ -39168,6 +39206,7 @@ var BridgeAgent = class _BridgeAgent {
     this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
     this.lastReportedSearchProviders = reportedSearchProviders;
     this.lastReportedUtilityTools = reportedUtilityTools;
+    this.lastReportedMcpAck = reportedMcpAck;
     if (version) writeServiceLog("info", "runtime_config.applied", { version });
     else writeServiceLog("info", "runtime_config.legacy_memory_reported");
   }
@@ -43515,7 +43554,12 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.logManifest(v.state);
-    if (v.state === "wrong_owner") this.dropOwnerDmLastTurn();
+    if (v.state === "wrong_owner") {
+      this.dropOwnerDmLastTurn();
+      this.mcpDeletionsThrough = 0;
+      this.mcpPolicyWrittenCounter = null;
+      this.noteMcpAckChanged();
+    }
     if (v.state !== "unchanged" && this.toolGrantManifest) this.logManifest("kept_last_good");
   }
   /**
@@ -45990,6 +46034,118 @@ ${channelId}`;
   clearMcpClientSocket(token) {
     if (this.mcpClientSockets.delete(token)) this.onCapabilityMaybeChanged();
   }
+  /** Deletion-ack ruling §3: ws-server notes every runtime hello's mcp_deletion_ack_v1 declaration (harness: false). */
+  noteMcpDeletionAckSocket(token, declared) {
+    this.mcpDeletionAckSockets.set(token, declared);
+    if (!declared) this.mcpTurnSeq.delete(token);
+    this.forgetCredentialsIfNoAckSocket();
+    this.maybeReportMcpAck();
+  }
+  /** #1351 round 2 observation: with no ack-capable socket left (detached, or re-hello'd without the feature), the last
+   *  credentials value is no longer known: forget it, so a later socket does not inherit a stale value. */
+  forgetCredentialsIfNoAckSocket() {
+    if ([...this.mcpDeletionAckSockets.values()].some(Boolean)) return;
+    this.mcpCredentialsPresentValue = null;
+    this.mcpAckClosed = { ...this.mcpAckClosed, credentials: null };
+    if (this.mcpAckOpen !== null) this.mcpAckOpen = { ...this.mcpAckOpen, credentials: null };
+  }
+  clearMcpDeletionAckSocket(token) {
+    this.mcpTurnSeq.delete(token);
+    if (!this.mcpDeletionAckSockets.delete(token)) return;
+    this.forgetCredentialsIfNoAckSocket();
+    this.maybeReportMcpAck();
+  }
+  /** #1351 round 2 M-1: ws-server calls this when it sends an owner-DM turn to an ack-capable socket. Bounded. */
+  noteMcpTurnDispatch(token, messageId) {
+    let m = this.mcpTurnSeq.get(token);
+    if (m === void 0) this.mcpTurnSeq.set(token, m = /* @__PURE__ */ new Map());
+    m.set(messageId, this.policyWriteSeq);
+    while (m.size > 64) m.delete(m.keys().next().value);
+  }
+  /** Ruling §3 / §5.3: the AND over attached sockets, false with none attached (as mcpClientCapable). */
+  mcpDeletionAckCapable() {
+    if (this.mcpDeletionAckSockets.size === 0) return false;
+    for (const v of this.mcpDeletionAckSockets.values()) if (!v) return false;
+    return true;
+  }
+  /**
+   * Deletion-ack ruling (2026-10-31) §3 acceptance. ws-server has validated the frame shape and the socket (declared
+   * mcp_deletion_ack_v1 and mcp_client_v1, no harness). `credentials_present` is taken as is. `applied_sha256` advances
+   * `mcpDeletionsThrough` only when it is the SHA-256 of the bytes THIS bridge last wrote (JSON + newline) and still
+   * holds in force, and that document's top state is one whose deletion set covers the signed removal; then to the
+   * counter recorded at that write, never the live one. Anything else is ignored silently. Never throws.
+   */
+  noteMcpDeletionAck(token, frame) {
+    this.mcpCredentialsPresentValue = frame.credentials_present === true;
+    const json2 = this.mcpPolicyWrittenJson;
+    const doc = this.mcpPolicyWritten;
+    const counter = this.mcpPolicyWrittenCounter;
+    const turns = frame.message_id !== void 0 ? this.mcpTurnSeq.get(token) : void 0;
+    const seqAtDispatch = frame.message_id !== void 0 ? turns?.get(frame.message_id) : void 0;
+    if (frame.message_id !== void 0) turns?.delete(frame.message_id);
+    if (frame.applied_sha256 !== void 0 && seqAtDispatch !== void 0 && seqAtDispatch === this.policyWriteSeq && json2 !== null && doc !== null && counter !== null && MCP_ACK_STATES.has(doc.state) && frame.applied_sha256 === createHash6("sha256").update(json2 + "\n", "utf8").digest("hex")) {
+      this.mcpDeletionsThrough = Math.max(this.mcpDeletionsThrough, counter);
+    }
+    this.noteMcpAckChanged();
+  }
+  /** H-1: a change of the ack values goes into the open bucket; the report sees it only once the bucket has closed. */
+  noteMcpAckChanged() {
+    const now = this.toolStatusNow();
+    this.promoteMcpAck(now);
+    const live = { through: this.mcpDeletionsThrough, credentials: this.mcpCredentialsPresentValue };
+    const base = this.mcpAckOpen ?? this.mcpAckClosed;
+    if (base.through === live.through && base.credentials === live.credentials) return;
+    this.mcpAckOpen = { ...live, end: bucketEndMs(bucketStartAt(now)) };
+    this.scheduleMcpAckReport();
+  }
+  promoteMcpAck(now) {
+    if (this.mcpAckOpen !== null && this.mcpAckOpen.end <= now) {
+      this.mcpAckClosed = { through: this.mcpAckOpen.through, credentials: this.mcpAckOpen.credentials };
+      this.mcpAckOpen = null;
+    }
+  }
+  /** H-1: one timer, at the first bucket boundary strictly after now plus a jitter in [0, 60 s), as the tool-status sender. */
+  scheduleMcpAckReport() {
+    if (this.mcpAckTimer !== null || this.closingDown) return;
+    const now = this.toolStatusNow();
+    const boundary = (Math.floor(now / TOOL_STATUS_BUCKET_MS) + 1) * TOOL_STATUS_BUCKET_MS;
+    const at = boundary + Math.floor(this.toolStatusRandom() * TOOL_STATUS_JITTER_MS);
+    this.mcpAckTimer = this.toolStatusSetTimer(() => {
+      this.mcpAckTimer = null;
+      this.promoteMcpAck(this.toolStatusNow());
+      if (this.lastReportedMcpAck !== this.mcpAckSignature() && this.bootConfigSettled && !this.closingDown) void this.refetchRuntimeConfig();
+      if (this.mcpAckOpen !== null) this.scheduleMcpAckReport();
+    }, Math.max(0, at - now));
+  }
+  /**
+   * Ruling §5.3: the three keys. The two ack values come from the CLOSED bucket only (H-1), so no report, whatever
+   * posts it, reveals an owner-DM turn before its 15-minute bucket has closed. `mcp_r3_hold` is not DM timing: live.
+   */
+  reportedMcpAck() {
+    this.promoteMcpAck(this.toolStatusNow());
+    const ackCapable = this.mcpDeletionAckCapable();
+    const anyAck = [...this.mcpDeletionAckSockets.values()].some(Boolean);
+    const closed = this.mcpAckClosed;
+    return {
+      mcp_r3_hold: this.r3Hold(),
+      ...ackCapable ? { mcp_deletions_through: closed.through } : {},
+      // `anyAck` is an equivalent mutant today (forgetCredentialsIfNoAckSocket nulls the value whenever no ack socket is
+      // left), kept as defense in depth so the report never depends on that reset alone.
+      ...anyAck && closed.credentials !== null ? { mcp_credentials_present: closed.credentials } : {}
+    };
+  }
+  mcpAckSignature() {
+    return JSON.stringify(this.reportedMcpAck());
+  }
+  /**
+   * A SOCKET change (attach, detach, a hello) can change which keys the report carries; their values are the closed
+   * ones, so this is not owner-DM timing and may use the capability refetch. An ACK never comes here (H-1): it goes
+   * through noteMcpAckChanged and the bucket timer.
+   */
+  maybeReportMcpAck() {
+    if (this.lastReportedMcpAck === this.mcpAckSignature()) return;
+    this.scheduleCapabilityRefetch();
+  }
   /** MCP Task 18: ws-server registers (or, with null, removes) a socket's loopback catalog lister. */
   noteMcpCatalogLister(token, lister) {
     if (lister === null) this.mcpCatalogListers.delete(token);
@@ -46097,6 +46253,11 @@ ${channelId}`;
     this.recomputeMcpPolicy();
     if (this.closingDown) return;
     if (prev === null && !next.search && !next.utility) return;
+    this.scheduleCapabilityRefetch();
+  }
+  /** Debounced, with a max wait: a burst that never pauses still refetches at most maxWait after its first change. */
+  scheduleCapabilityRefetch() {
+    if (this.closingDown) return;
     const now = Date.now();
     if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
     else this.searchCapabilityBurstStart = now;
@@ -46114,7 +46275,7 @@ ${channelId}`;
   searchCapabilityRefetchNeeded() {
     if (!this.bootConfigSettled || this.closingDown) return false;
     const inForce = (this.cfg.ownerGrantPin?.pin ?? null) !== null && this.toolGrantManifest !== null;
-    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable() || this.lastReportedUtilityTools !== this.utilityToolsCapable();
+    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable() || this.lastReportedUtilityTools !== this.utilityToolsCapable() || this.lastReportedMcpAck !== this.mcpAckSignature();
   }
   /**
    * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
@@ -46341,6 +46502,10 @@ ${channelId}`;
     this.closingDown = true;
     this.statusGate.close();
     this.toolStatusSender.close();
+    if (this.mcpAckTimer !== null) {
+      this.toolStatusClearTimer(this.mcpAckTimer);
+      this.mcpAckTimer = null;
+    }
     for (const t of this.pauseRecheckTimers.values()) clearTimeout(t);
     this.pauseRecheckTimers.clear();
     for (const t of this.supersedeRecheckTimers.values()) clearTimeout(t);
@@ -47114,6 +47279,10 @@ function attachAgentWebSocket(server, agent, opts) {
           try {
             sock.send(JSON.stringify(frame));
             inflight.set(batch[i].message_id, batch[i]);
+            const a = frame.authorization;
+            if (session.mcpDeletionAck === true && (a?.audience === "owner_dm" || a?.relay_speaker === "owner")) {
+              agent.noteMcpTurnDispatch(session, batch[i].message_id);
+            }
             session.deliveryToken.set(batch[i].message_id, ++session.deliverySeq);
             session.shownRecall.set(batch[i].message_id, { token: session.deliverySeq, ids: recallOut.shown });
             session.shownUnified.set(batch[i].message_id, { token: session.deliverySeq, ids: unifiedOut.shown });
@@ -47162,6 +47331,7 @@ function attachAgentWebSocket(server, agent, opts) {
       agent.clearSearchProvidersSocket(session);
       agent.clearUtilityToolsSocket(session);
       agent.clearMcpClientSocket(session);
+      agent.clearMcpDeletionAckSocket(session);
       agent.noteMcpCatalogLister(session, null);
       for (const settle of session.pendingCatalog.values()) settle(null);
       session.pendingCatalog.clear();
@@ -47300,6 +47470,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     session.mcpClient = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(MANIFEST_GRANTS_FEATURE) && m.features.includes(MCP_CLIENT_FEATURE);
     agent.noteMcpClientSocket(session, session.mcpClient);
     agent.noteMcpCatalogLister(session, session.mcpClient ? mcpCatalogLister(sock, session) : null);
+    session.mcpDeletionAck = session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MCP_DELETION_ACK_FEATURE);
+    agent.noteMcpDeletionAckSocket(session, session.mcpDeletionAck);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -47307,7 +47479,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE, MCP_POLICY_WRITER_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE, MCP_POLICY_WRITER_FEATURE, MCP_DELETION_ACK_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
@@ -47538,6 +47710,20 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     }
     return;
   }
+  if (m.type === "mcp_deletion_ack") {
+    const keys = Object.keys(m).sort().join(",");
+    const valid = session.mcpDeletionAck === true && session.mcpClient === true && session.harnessClaimed !== true && (keys === "credentials_present,type" || keys === "credentials_present,message_id,type" || keys === "applied_sha256,credentials_present,message_id,type") && typeof m.credentials_present === "boolean" && (m.message_id === void 0 || typeof m.message_id === "string" && m.message_id.length > 0 && m.message_id.length <= 256) && (m.applied_sha256 === void 0 || typeof m.applied_sha256 === "string" && /^[0-9a-f]{64}$/.test(m.applied_sha256));
+    if (!valid) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    agent.noteMcpDeletionAck(session, {
+      credentials_present: m.credentials_present,
+      ...typeof m.message_id === "string" ? { message_id: m.message_id } : {},
+      ...typeof m.applied_sha256 === "string" ? { applied_sha256: m.applied_sha256 } : {}
+    });
+    return;
+  }
   if (m.type === "room_cap_reached") {
     if (!session.manifestGrants || typeof m.channel_id !== "string" || !LOWER_UUID.test(m.channel_id)) {
       sendJson(sock, wsErrorFrame("invalid_request"));

package/dist/bridge-agent.d.ts

@@ -1240,6 +1240,29 @@ export declare class BridgeAgent {
      */
     private mcpPolicyWritten;
     private mcpPolicyWrittenJson;
+    /** Deletion-ack ruling §3: the manifest counter in force when `mcpPolicyWrittenJson` was written (never read live). */
+    private mcpPolicyWrittenCounter;
+    /** Ruling §3: newest counter whose written policy the runtime fully acted on. Memory only, monotonic, starts at 0. */
+    private mcpDeletionsThrough;
+    /** Ruling §3: the last `credentials_present` an accepted frame carried; null until one arrives. */
+    private mcpCredentialsPresentValue;
+    /** Ruling §3: per attached socket, whether its latest hello declared mcp_deletion_ack_v1 (harness noted false). */
+    private readonly mcpDeletionAckSockets;
+    /** Ruling §3 rate: the ack-derived report values in the last report posted (null until one is). */
+    private lastReportedMcpAck;
+    /** #1351 round 2 M-1: bumped on every byte-changing policy write (and on the inert document being put in force). */
+    private policyWriteSeq;
+    /** M-1: per ack-capable socket, the policyWriteSeq at the dispatch of each owner-DM turn, by message id (bounded). */
+    private readonly mcpTurnSeq;
+    /**
+     * #1351 round 2 H-1: the ack values the REPORT may carry. An ack lands seconds after an owner-DM turn and a report
+     * posted then would time the turn (record_report sets applied_at). So, as the tool-status sender: `open` holds a
+     * change while its 15-minute UTC bucket is open, `closed` what the report carries, and the only post is from one
+     * timer at the next bucket boundary plus jitter.
+     */
+    private mcpAckOpen;
+    private mcpAckClosed;
+    private mcpAckTimer;
     /** PR-B2 follow-up: a failed write is retried on this backoff (the last value repeats) until one lands or close(). */
     private readonly mcpPolicyRetryDelaysMs;
     private mcpPolicyRetryTimer;
@@ -3744,6 +3767,45 @@ export declare class BridgeAgent {
     private readonly mcpClientSockets;
     noteMcpClientSocket(token: object, declared: boolean): void;
     clearMcpClientSocket(token: object): void;
+    /** Deletion-ack ruling §3: ws-server notes every runtime hello's mcp_deletion_ack_v1 declaration (harness: false). */
+    noteMcpDeletionAckSocket(token: object, declared: boolean): void;
+    /** #1351 round 2 observation: with no ack-capable socket left (detached, or re-hello'd without the feature), the last
+     *  credentials value is no longer known: forget it, so a later socket does not inherit a stale value. */
+    private forgetCredentialsIfNoAckSocket;
+    clearMcpDeletionAckSocket(token: object): void;
+    /** #1351 round 2 M-1: ws-server calls this when it sends an owner-DM turn to an ack-capable socket. Bounded. */
+    noteMcpTurnDispatch(token: object, messageId: string): void;
+    /** Ruling §3 / §5.3: the AND over attached sockets, false with none attached (as mcpClientCapable). */
+    private mcpDeletionAckCapable;
+    /**
+     * Deletion-ack ruling (2026-10-31) §3 acceptance. ws-server has validated the frame shape and the socket (declared
+     * mcp_deletion_ack_v1 and mcp_client_v1, no harness). `credentials_present` is taken as is. `applied_sha256` advances
+     * `mcpDeletionsThrough` only when it is the SHA-256 of the bytes THIS bridge last wrote (JSON + newline) and still
+     * holds in force, and that document's top state is one whose deletion set covers the signed removal; then to the
+     * counter recorded at that write, never the live one. Anything else is ignored silently. Never throws.
+     */
+    noteMcpDeletionAck(token: object, frame: {
+        credentials_present: boolean;
+        message_id?: string;
+        applied_sha256?: string;
+    }): void;
+    /** H-1: a change of the ack values goes into the open bucket; the report sees it only once the bucket has closed. */
+    private noteMcpAckChanged;
+    private promoteMcpAck;
+    /** H-1: one timer, at the first bucket boundary strictly after now plus a jitter in [0, 60 s), as the tool-status sender. */
+    private scheduleMcpAckReport;
+    /**
+     * Ruling §5.3: the three keys. The two ack values come from the CLOSED bucket only (H-1), so no report, whatever
+     * posts it, reveals an owner-DM turn before its 15-minute bucket has closed. `mcp_r3_hold` is not DM timing: live.
+     */
+    private reportedMcpAck;
+    private mcpAckSignature;
+    /**
+     * A SOCKET change (attach, detach, a hello) can change which keys the report carries; their values are the closed
+     * ones, so this is not owner-DM timing and may use the capability refetch. An ACK never comes here (H-1): it goes
+     * through noteMcpAckChanged and the bucket timer.
+     */
+    private maybeReportMcpAck;
     /** MCP Task 18: ws-server registers (or, with null, removes) a socket's loopback catalog lister. */
     noteMcpCatalogLister(token: object, lister: McpCatalogLister | null): void;
     /**
@@ -3790,6 +3852,8 @@ export declare class BridgeAgent {
      * switches and the new capability, then a debounced refetch (one per burst) only when needed.
      */
     private onCapabilityMaybeChanged;
+    /** Debounced, with a max wait: a burst that never pauses still refetches at most maxWait after its first change. */
+    private scheduleCapabilityRefetch;
     /**
      * A refetch re-renders skills.json (owner_dm_search_cap counts web_extract only with the capability, D39) and posts
      * the report. Needed under a manifest in force, or when the reported value is stale. Never before the boot fetch.

package/dist/grants/mcp-policy.d.ts

@@ -33,6 +33,13 @@ import { type ServiceLog } from "../service-log.js";
  * backend can write that name (ws-server.test.ts same-build row).
  */
 export declare const MCP_POLICY_WRITER_FEATURE = "mcp_policy_writer_v1";
+/**
+ * Deletion-ack ruling (2026-10-31) §3: declared in the hello reply and by the runtime in its hello. Only a socket that
+ * declared it (and mcp_client_v1, no harness) may send `mcp_deletion_ack`.
+ */
+export declare const MCP_DELETION_ACK_FEATURE = "mcp_deletion_ack_v1";
+/** Ruling §3: the top states whose deletion set covers the manifest's signed `removed` (ok), or everything on disk. */
+export declare const MCP_ACK_STATES: ReadonlySet<string>;
 export type McpEntitlementReading = "entitled" | "not_entitled" | "suspended";
 /**
  * OQ-1 ruling (ADR G). Only `true`/"entitled" is in force and only `false`/"not_entitled" is the deleting downgrade.

package/dist/index.js

@@ -29719,6 +29719,7 @@ function checkGroupLink(v) {
 }
 
 // src/bridge-agent.ts
+import { createHash as createHash6 } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 
 // src/reply-intent.ts
@@ -36696,6 +36697,8 @@ function ownerDmRelayOf(leafClass, leaves, ids) {
 
 // src/grants/mcp-policy.ts
 var MCP_POLICY_WRITER_FEATURE = "mcp_policy_writer_v1";
+var MCP_DELETION_ACK_FEATURE = "mcp_deletion_ack_v1";
+var MCP_ACK_STATES = /* @__PURE__ */ new Set(["ok", "not_entitled", "kill_switch"]);
 function mcpEntitlementReading(mcpEntitled, mcpCause) {
   if (mcpEntitled === true && mcpCause === "entitled") return "entitled";
   if (mcpEntitled === false && mcpCause === "not_entitled") return "not_entitled";
@@ -38003,6 +38006,29 @@ var BridgeAgent = class _BridgeAgent {
    */
   mcpPolicyWritten = null;
   mcpPolicyWrittenJson = null;
+  /** Deletion-ack ruling §3: the manifest counter in force when `mcpPolicyWrittenJson` was written (never read live). */
+  mcpPolicyWrittenCounter = null;
+  /** Ruling §3: newest counter whose written policy the runtime fully acted on. Memory only, monotonic, starts at 0. */
+  mcpDeletionsThrough = 0;
+  /** Ruling §3: the last `credentials_present` an accepted frame carried; null until one arrives. */
+  mcpCredentialsPresentValue = null;
+  /** Ruling §3: per attached socket, whether its latest hello declared mcp_deletion_ack_v1 (harness noted false). */
+  mcpDeletionAckSockets = /* @__PURE__ */ new Map();
+  /** Ruling §3 rate: the ack-derived report values in the last report posted (null until one is). */
+  lastReportedMcpAck = null;
+  /** #1351 round 2 M-1: bumped on every byte-changing policy write (and on the inert document being put in force). */
+  policyWriteSeq = 0;
+  /** M-1: per ack-capable socket, the policyWriteSeq at the dispatch of each owner-DM turn, by message id (bounded). */
+  mcpTurnSeq = /* @__PURE__ */ new Map();
+  /**
+   * #1351 round 2 H-1: the ack values the REPORT may carry. An ack lands seconds after an owner-DM turn and a report
+   * posted then would time the turn (record_report sets applied_at). So, as the tool-status sender: `open` holds a
+   * change while its 15-minute UTC bucket is open, `closed` what the report carries, and the only post is from one
+   * timer at the next bucket boundary plus jitter.
+   */
+  mcpAckOpen = null;
+  mcpAckClosed = { through: 0, credentials: null };
+  mcpAckTimer = null;
   /** PR-B2 follow-up: a failed write is retried on this backoff (the last value repeats) until one lands or close(). */
   mcpPolicyRetryDelaysMs;
   mcpPolicyRetryTimer = null;
@@ -38647,15 +38673,22 @@ var BridgeAgent = class _BridgeAgent {
   recomputeMcpPolicy() {
     const doc = mcpPolicyFor(this.mcpPolicyInput());
     const json2 = JSON.stringify(doc);
-    if (json2 === this.mcpPolicyWrittenJson) return;
+    if (json2 === this.mcpPolicyWrittenJson) {
+      if (this.mcpPolicyWritten !== null && this.mcpPolicyWrittenCounter !== null) this.mcpPolicyWrittenCounter = this.toolGrantCounter;
+      return;
+    }
     if (MCP_INERT_STATES.has(doc.state) && !doc.r3_hold && Object.keys(doc.servers).length === 0 && !existsSync5(join18(runtimeConfigDir(this.home, this.cfg.identityId), MCP_POLICY_FILE))) {
       this.mcpPolicyWritten = doc;
       this.mcpPolicyWrittenJson = json2;
+      this.mcpPolicyWrittenCounter = this.toolGrantCounter;
+      this.policyWriteSeq++;
       this.clearMcpPolicyRetry();
       return;
     }
     this.mcpPolicyWritten = null;
     this.mcpPolicyWrittenJson = null;
+    this.mcpPolicyWrittenCounter = null;
+    this.policyWriteSeq++;
     try {
       this.grantWriters.writeMcpPolicy(this.home, this.cfg.identityId, doc);
     } catch (e) {
@@ -38665,6 +38698,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     this.mcpPolicyWritten = doc;
     this.mcpPolicyWrittenJson = json2;
+    this.mcpPolicyWrittenCounter = this.toolGrantCounter;
     this.clearMcpPolicyRetry();
   }
   /** A document is in force: no pending retry, and the next failure starts the backoff from the first delay. */
@@ -38780,6 +38814,7 @@ var BridgeAgent = class _BridgeAgent {
     const local = readLocalReport(this.home, this.cfg.identityId);
     const reportedSearchProviders = this.searchProvidersCapable();
     const reportedUtilityTools = this.utilityToolsCapable();
+    const reportedMcpAck = this.mcpAckSignature();
     const carriedOwnerDmTurn = this.toolStatusSender.carry();
     const report = {
       applied_version: version,
@@ -38854,6 +38889,9 @@ var BridgeAgent = class _BridgeAgent {
         // MCP Task 19 (spec §12.3): separate from `capability`; content-free enums and pattern tokens only.
         mcp_capability: this.reportedMcpCapability(),
         mcp_servers: this.reportedMcpServers(),
+        // Deletion-ack ruling §5.3: content-free scalars. `mcp_deletions_through` only while EVERY attached runtime socket
+        // declared mcp_deletion_ack_v1 (absent = cannot acknowledge); `mcp_credentials_present` only once one reported.
+        ...this.reportedMcpAck(),
         // Tool status Phase 0 (spec §3.5, round 2 H-5): an updated bridge, with or without a record yet.
         tool_status_v1: true
       },
@@ -38882,6 +38920,7 @@ var BridgeAgent = class _BridgeAgent {
     this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
     this.lastReportedSearchProviders = reportedSearchProviders;
     this.lastReportedUtilityTools = reportedUtilityTools;
+    this.lastReportedMcpAck = reportedMcpAck;
     if (version) writeServiceLog2("info", "runtime_config.applied", { version });
     else writeServiceLog2("info", "runtime_config.legacy_memory_reported");
   }
@@ -43229,7 +43268,12 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.logManifest(v.state);
-    if (v.state === "wrong_owner") this.dropOwnerDmLastTurn();
+    if (v.state === "wrong_owner") {
+      this.dropOwnerDmLastTurn();
+      this.mcpDeletionsThrough = 0;
+      this.mcpPolicyWrittenCounter = null;
+      this.noteMcpAckChanged();
+    }
     if (v.state !== "unchanged" && this.toolGrantManifest) this.logManifest("kept_last_good");
   }
   /**
@@ -45704,6 +45748,118 @@ ${channelId}`;
   clearMcpClientSocket(token) {
     if (this.mcpClientSockets.delete(token)) this.onCapabilityMaybeChanged();
   }
+  /** Deletion-ack ruling §3: ws-server notes every runtime hello's mcp_deletion_ack_v1 declaration (harness: false). */
+  noteMcpDeletionAckSocket(token, declared) {
+    this.mcpDeletionAckSockets.set(token, declared);
+    if (!declared) this.mcpTurnSeq.delete(token);
+    this.forgetCredentialsIfNoAckSocket();
+    this.maybeReportMcpAck();
+  }
+  /** #1351 round 2 observation: with no ack-capable socket left (detached, or re-hello'd without the feature), the last
+   *  credentials value is no longer known: forget it, so a later socket does not inherit a stale value. */
+  forgetCredentialsIfNoAckSocket() {
+    if ([...this.mcpDeletionAckSockets.values()].some(Boolean)) return;
+    this.mcpCredentialsPresentValue = null;
+    this.mcpAckClosed = { ...this.mcpAckClosed, credentials: null };
+    if (this.mcpAckOpen !== null) this.mcpAckOpen = { ...this.mcpAckOpen, credentials: null };
+  }
+  clearMcpDeletionAckSocket(token) {
+    this.mcpTurnSeq.delete(token);
+    if (!this.mcpDeletionAckSockets.delete(token)) return;
+    this.forgetCredentialsIfNoAckSocket();
+    this.maybeReportMcpAck();
+  }
+  /** #1351 round 2 M-1: ws-server calls this when it sends an owner-DM turn to an ack-capable socket. Bounded. */
+  noteMcpTurnDispatch(token, messageId) {
+    let m = this.mcpTurnSeq.get(token);
+    if (m === void 0) this.mcpTurnSeq.set(token, m = /* @__PURE__ */ new Map());
+    m.set(messageId, this.policyWriteSeq);
+    while (m.size > 64) m.delete(m.keys().next().value);
+  }
+  /** Ruling §3 / §5.3: the AND over attached sockets, false with none attached (as mcpClientCapable). */
+  mcpDeletionAckCapable() {
+    if (this.mcpDeletionAckSockets.size === 0) return false;
+    for (const v of this.mcpDeletionAckSockets.values()) if (!v) return false;
+    return true;
+  }
+  /**
+   * Deletion-ack ruling (2026-10-31) §3 acceptance. ws-server has validated the frame shape and the socket (declared
+   * mcp_deletion_ack_v1 and mcp_client_v1, no harness). `credentials_present` is taken as is. `applied_sha256` advances
+   * `mcpDeletionsThrough` only when it is the SHA-256 of the bytes THIS bridge last wrote (JSON + newline) and still
+   * holds in force, and that document's top state is one whose deletion set covers the signed removal; then to the
+   * counter recorded at that write, never the live one. Anything else is ignored silently. Never throws.
+   */
+  noteMcpDeletionAck(token, frame) {
+    this.mcpCredentialsPresentValue = frame.credentials_present === true;
+    const json2 = this.mcpPolicyWrittenJson;
+    const doc = this.mcpPolicyWritten;
+    const counter = this.mcpPolicyWrittenCounter;
+    const turns = frame.message_id !== void 0 ? this.mcpTurnSeq.get(token) : void 0;
+    const seqAtDispatch = frame.message_id !== void 0 ? turns?.get(frame.message_id) : void 0;
+    if (frame.message_id !== void 0) turns?.delete(frame.message_id);
+    if (frame.applied_sha256 !== void 0 && seqAtDispatch !== void 0 && seqAtDispatch === this.policyWriteSeq && json2 !== null && doc !== null && counter !== null && MCP_ACK_STATES.has(doc.state) && frame.applied_sha256 === createHash6("sha256").update(json2 + "\n", "utf8").digest("hex")) {
+      this.mcpDeletionsThrough = Math.max(this.mcpDeletionsThrough, counter);
+    }
+    this.noteMcpAckChanged();
+  }
+  /** H-1: a change of the ack values goes into the open bucket; the report sees it only once the bucket has closed. */
+  noteMcpAckChanged() {
+    const now = this.toolStatusNow();
+    this.promoteMcpAck(now);
+    const live = { through: this.mcpDeletionsThrough, credentials: this.mcpCredentialsPresentValue };
+    const base = this.mcpAckOpen ?? this.mcpAckClosed;
+    if (base.through === live.through && base.credentials === live.credentials) return;
+    this.mcpAckOpen = { ...live, end: bucketEndMs(bucketStartAt(now)) };
+    this.scheduleMcpAckReport();
+  }
+  promoteMcpAck(now) {
+    if (this.mcpAckOpen !== null && this.mcpAckOpen.end <= now) {
+      this.mcpAckClosed = { through: this.mcpAckOpen.through, credentials: this.mcpAckOpen.credentials };
+      this.mcpAckOpen = null;
+    }
+  }
+  /** H-1: one timer, at the first bucket boundary strictly after now plus a jitter in [0, 60 s), as the tool-status sender. */
+  scheduleMcpAckReport() {
+    if (this.mcpAckTimer !== null || this.closingDown) return;
+    const now = this.toolStatusNow();
+    const boundary = (Math.floor(now / TOOL_STATUS_BUCKET_MS) + 1) * TOOL_STATUS_BUCKET_MS;
+    const at = boundary + Math.floor(this.toolStatusRandom() * TOOL_STATUS_JITTER_MS);
+    this.mcpAckTimer = this.toolStatusSetTimer(() => {
+      this.mcpAckTimer = null;
+      this.promoteMcpAck(this.toolStatusNow());
+      if (this.lastReportedMcpAck !== this.mcpAckSignature() && this.bootConfigSettled && !this.closingDown) void this.refetchRuntimeConfig();
+      if (this.mcpAckOpen !== null) this.scheduleMcpAckReport();
+    }, Math.max(0, at - now));
+  }
+  /**
+   * Ruling §5.3: the three keys. The two ack values come from the CLOSED bucket only (H-1), so no report, whatever
+   * posts it, reveals an owner-DM turn before its 15-minute bucket has closed. `mcp_r3_hold` is not DM timing: live.
+   */
+  reportedMcpAck() {
+    this.promoteMcpAck(this.toolStatusNow());
+    const ackCapable = this.mcpDeletionAckCapable();
+    const anyAck = [...this.mcpDeletionAckSockets.values()].some(Boolean);
+    const closed = this.mcpAckClosed;
+    return {
+      mcp_r3_hold: this.r3Hold(),
+      ...ackCapable ? { mcp_deletions_through: closed.through } : {},
+      // `anyAck` is an equivalent mutant today (forgetCredentialsIfNoAckSocket nulls the value whenever no ack socket is
+      // left), kept as defense in depth so the report never depends on that reset alone.
+      ...anyAck && closed.credentials !== null ? { mcp_credentials_present: closed.credentials } : {}
+    };
+  }
+  mcpAckSignature() {
+    return JSON.stringify(this.reportedMcpAck());
+  }
+  /**
+   * A SOCKET change (attach, detach, a hello) can change which keys the report carries; their values are the closed
+   * ones, so this is not owner-DM timing and may use the capability refetch. An ACK never comes here (H-1): it goes
+   * through noteMcpAckChanged and the bucket timer.
+   */
+  maybeReportMcpAck() {
+    if (this.lastReportedMcpAck === this.mcpAckSignature()) return;
+    this.scheduleCapabilityRefetch();
+  }
   /** MCP Task 18: ws-server registers (or, with null, removes) a socket's loopback catalog lister. */
   noteMcpCatalogLister(token, lister) {
     if (lister === null) this.mcpCatalogListers.delete(token);
@@ -45811,6 +45967,11 @@ ${channelId}`;
     this.recomputeMcpPolicy();
     if (this.closingDown) return;
     if (prev === null && !next.search && !next.utility) return;
+    this.scheduleCapabilityRefetch();
+  }
+  /** Debounced, with a max wait: a burst that never pauses still refetches at most maxWait after its first change. */
+  scheduleCapabilityRefetch() {
+    if (this.closingDown) return;
     const now = Date.now();
     if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
     else this.searchCapabilityBurstStart = now;
@@ -45828,7 +45989,7 @@ ${channelId}`;
   searchCapabilityRefetchNeeded() {
     if (!this.bootConfigSettled || this.closingDown) return false;
     const inForce = (this.cfg.ownerGrantPin?.pin ?? null) !== null && this.toolGrantManifest !== null;
-    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable() || this.lastReportedUtilityTools !== this.utilityToolsCapable();
+    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable() || this.lastReportedUtilityTools !== this.utilityToolsCapable() || this.lastReportedMcpAck !== this.mcpAckSignature();
   }
   /**
    * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
@@ -46055,6 +46216,10 @@ ${channelId}`;
     this.closingDown = true;
     this.statusGate.close();
     this.toolStatusSender.close();
+    if (this.mcpAckTimer !== null) {
+      this.toolStatusClearTimer(this.mcpAckTimer);
+      this.mcpAckTimer = null;
+    }
     for (const t of this.pauseRecheckTimers.values()) clearTimeout(t);
     this.pauseRecheckTimers.clear();
     for (const t of this.supersedeRecheckTimers.values()) clearTimeout(t);
@@ -46974,6 +47139,10 @@ function attachAgentWebSocket(server, agent, opts) {
           try {
             sock.send(JSON.stringify(frame));
             inflight.set(batch[i].message_id, batch[i]);
+            const a = frame.authorization;
+            if (session.mcpDeletionAck === true && (a?.audience === "owner_dm" || a?.relay_speaker === "owner")) {
+              agent.noteMcpTurnDispatch(session, batch[i].message_id);
+            }
             session.deliveryToken.set(batch[i].message_id, ++session.deliverySeq);
             session.shownRecall.set(batch[i].message_id, { token: session.deliverySeq, ids: recallOut.shown });
             session.shownUnified.set(batch[i].message_id, { token: session.deliverySeq, ids: unifiedOut.shown });
@@ -47022,6 +47191,7 @@ function attachAgentWebSocket(server, agent, opts) {
       agent.clearSearchProvidersSocket(session);
       agent.clearUtilityToolsSocket(session);
       agent.clearMcpClientSocket(session);
+      agent.clearMcpDeletionAckSocket(session);
       agent.noteMcpCatalogLister(session, null);
       for (const settle of session.pendingCatalog.values()) settle(null);
       session.pendingCatalog.clear();
@@ -47160,6 +47330,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     session.mcpClient = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(MANIFEST_GRANTS_FEATURE) && m.features.includes(MCP_CLIENT_FEATURE);
     agent.noteMcpClientSocket(session, session.mcpClient);
     agent.noteMcpCatalogLister(session, session.mcpClient ? mcpCatalogLister(sock, session) : null);
+    session.mcpDeletionAck = session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MCP_DELETION_ACK_FEATURE);
+    agent.noteMcpDeletionAckSocket(session, session.mcpDeletionAck);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -47167,7 +47339,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE, MCP_POLICY_WRITER_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE, MCP_POLICY_WRITER_FEATURE, MCP_DELETION_ACK_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
@@ -47398,6 +47570,20 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     }
     return;
   }
+  if (m.type === "mcp_deletion_ack") {
+    const keys = Object.keys(m).sort().join(",");
+    const valid = session.mcpDeletionAck === true && session.mcpClient === true && session.harnessClaimed !== true && (keys === "credentials_present,type" || keys === "credentials_present,message_id,type" || keys === "applied_sha256,credentials_present,message_id,type") && typeof m.credentials_present === "boolean" && (m.message_id === void 0 || typeof m.message_id === "string" && m.message_id.length > 0 && m.message_id.length <= 256) && (m.applied_sha256 === void 0 || typeof m.applied_sha256 === "string" && /^[0-9a-f]{64}$/.test(m.applied_sha256));
+    if (!valid) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    agent.noteMcpDeletionAck(session, {
+      credentials_present: m.credentials_present,
+      ...typeof m.message_id === "string" ? { message_id: m.message_id } : {},
+      ...typeof m.applied_sha256 === "string" ? { applied_sha256: m.applied_sha256 } : {}
+    });
+    return;
+  }
   if (m.type === "room_cap_reached") {
     if (!session.manifestGrants || typeof m.channel_id !== "string" || !LOWER_UUID.test(m.channel_id)) {
       sendJson(sock, wsErrorFrame("invalid_request"));

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.36.0";
+export declare const BRIDGE_VERSION = "0.37.0";

package/dist/ws-server.d.ts

@@ -51,7 +51,7 @@ export declare const MEMORY_UNIFIED_FEATURE = "memory_unified";
  * fake against this list at run time (7b gate fix: a member added here without
  * a fake made three tests throw "is not a function").
  */
-export declare const WS_AGENT_MEMBERS: readonly ["ackRuntimeMessages", "action", "admitRuntimeDelivery", "applyMemoryNote", "clearHarnessReport", "clearManifestConsumer", "clearPerToolConsumer", "clearSearchProvidersSocket", "clearUtilityToolsSocket", "clearMcpClientSocket", "harnessGrantsWithheld", "signedSearchProvider", "r3Hold", "isRuntimeMessageRetired", "noteConsumerCapability", "noteManifestConsumer", "noteRoomCapReached", "noteSearchProvidersSocket", "noteUtilityToolsSocket", "noteMcpClientSocket", "noteMcpCatalogLister", "noteNotesConsumer", "notePerToolConsumer", "noteRecallConsumer", "noteUnifiedConsumer", "noteSessionClose", "noteSessionEvicted", "noteSessionOpen", "notesAppliedGeneration", "notesForDelivery", "recallForDelivery", "unifiedFeatureOn", "unifiedForDelivery", "recordHarnessReport", "recordRuntimeReply", "reportStatusGated", "requeueFailedRuntimeDeliveries", "requeueFront", "runtimeReplyReceipt", "send", "sendA2A", "subscribe", "takeDeliverable", "wakeListeners"];
+export declare const WS_AGENT_MEMBERS: readonly ["ackRuntimeMessages", "action", "admitRuntimeDelivery", "applyMemoryNote", "clearHarnessReport", "clearManifestConsumer", "clearPerToolConsumer", "clearSearchProvidersSocket", "clearUtilityToolsSocket", "clearMcpClientSocket", "harnessGrantsWithheld", "signedSearchProvider", "r3Hold", "isRuntimeMessageRetired", "noteConsumerCapability", "noteManifestConsumer", "noteRoomCapReached", "noteSearchProvidersSocket", "noteUtilityToolsSocket", "noteMcpClientSocket", "noteMcpCatalogLister", "noteMcpDeletionAckSocket", "clearMcpDeletionAckSocket", "noteMcpDeletionAck", "noteMcpTurnDispatch", "noteNotesConsumer", "notePerToolConsumer", "noteRecallConsumer", "noteUnifiedConsumer", "noteSessionClose", "noteSessionEvicted", "noteSessionOpen", "notesAppliedGeneration", "notesForDelivery", "recallForDelivery", "unifiedFeatureOn", "unifiedForDelivery", "recordHarnessReport", "recordRuntimeReply", "reportStatusGated", "requeueFailedRuntimeDeliveries", "requeueFront", "runtimeReplyReceipt", "send", "sendA2A", "subscribe", "takeDeliverable", "wakeListeners"];
 export type WsAgent = Pick<BridgeAgent, (typeof WS_AGENT_MEMBERS)[number]>;
 export declare function attachAgentWebSocket(server: HttpServer, agent: WsAgent, opts: AgentWebSocketOptions): {
     close(): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "type": "module",
   "engines": {
     "node": ">=24"