@securecoms/agent-bridge 0.37.0 → 0.39.0

package/connectors/hermes/tests/test_securecoms_authz.py

@@ -258,3 +258,197 @@ class TestPreToolCallDecision:
             raise RuntimeError("no session")
 
         assert authz.pre_tool_call_decision(boom, authz.TurnAuthzLedger())["action"] == "block"
+
+
+# ---------------------------------------------------------------------------
+# H0 (audit r1 #3, r2 #1): an ungranted turn still in flight for a (chat,
+# user) key must block tools for that key, whatever a later grant records.
+# Before H0 the ledger kept only the LATEST decision, so a guest's relay turn
+# that was still running borrowed the owner's grant the moment the owner's
+# relay turn recorded True for the same key.
+# ---------------------------------------------------------------------------
+
+
+def _bound(chat_id, user_id, platform="securecoms"):
+    values = {
+        "HERMES_SESSION_PLATFORM": platform,
+        "HERMES_SESSION_CHAT_ID": chat_id,
+        "HERMES_SESSION_USER_ID": user_id,
+    }
+    return lambda name, default="": values.get(name, default)
+
+
+class TestUngrantedInFlight:
+    def test_a_guest_turn_in_flight_cannot_borrow_the_owners_grant(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("room", "relay", False)
+        ledger.begin_ungranted("room", "relay")  # the guest's relay turn is running
+        ledger.record("room", "relay", True)  # the owner's relay turn is dispatched
+        assert ledger.tools_allowed("room", "relay") is False
+        assert authz.pre_tool_call_decision(_bound("room", "relay"), ledger) == {
+            "action": "block",
+            "message": authz.TOOL_VETO_MESSAGE,
+        }
+        ledger.end_ungranted("room", "relay")
+        assert ledger.tools_allowed("room", "relay") is True
+        assert authz.pre_tool_call_decision(_bound("room", "relay"), ledger) is None
+
+    def test_two_concurrent_ungranted_turns_need_two_releases(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.begin_ungranted("room", "relay")
+        ledger.begin_ungranted("room", "relay")
+        ledger.record("room", "relay", True)
+        ledger.end_ungranted("room", "relay")
+        assert ledger.tools_allowed("room", "relay") is False
+        ledger.end_ungranted("room", "relay")
+        assert ledger.tools_allowed("room", "relay") is True
+
+    def test_a_release_never_goes_below_zero(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("room", "relay", True)
+        ledger.end_ungranted("room", "relay")  # stray release: nothing to release
+        ledger.begin_ungranted("room", "relay")
+        assert ledger.tools_allowed("room", "relay") is False
+
+    def test_a_later_grant_never_releases_an_in_flight_count(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.begin_ungranted("room", "relay")
+        for _ in range(3):
+            ledger.record("room", "relay", True)
+        assert ledger.tools_allowed("room", "relay") is False
+        assert ledger.ungranted_in_flight("room", "relay") == 1
+
+    def test_eviction_never_drops_an_in_flight_entry(self):
+        ledger = authz.TurnAuthzLedger(max_entries=2)
+        ledger.begin_ungranted("room", "relay")
+        ledger.record("room", "relay", True)
+        for i in range(10):  # fill well past max_entries
+            ledger.record(f"c{i}", "u", True)
+        ledger.record("room", "relay", True)
+        assert ledger.tools_allowed("room", "relay") is False
+        assert ledger.ungranted_in_flight("room", "relay") == 1
+
+    def test_an_owner_dm_key_is_unaffected_by_a_room_key(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "owner", True)
+        ledger.begin_ungranted("room", "owner")
+        ledger.begin_ungranted("room", "relay")
+        assert ledger.tools_allowed("dm", "owner") is True
+
+    def test_a_shared_room_session_count_blocks_every_sender_in_that_chat(self):
+        # H0.2b: with group_sessions_per_user off, one room session is shared
+        # by every sender, so a count blocks the whole chat.
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("room", "owner", True)
+        ledger.begin_ungranted("room", "guest", shared_session=True)
+        assert ledger.tools_allowed("room", "owner") is False
+        ledger.end_ungranted("room", "guest", shared_session=True)
+        assert ledger.tools_allowed("room", "owner") is True
+
+
+class TestNonOwnerThread:
+    """H0.2c (re-ruled): every non-owner DM turn runs in the sc-non-owner
+    thread session; the thread is part of the ledger key."""
+
+    def test_the_thread_is_part_of_the_key(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "relay", True)  # the owner's relayed voice
+        assert ledger.tools_allowed("dm", "relay") is True
+        assert ledger.tools_allowed("dm", "relay", authz.NON_OWNER_THREAD) is False
+        ledger.begin_ungranted("dm", "relay", authz.NON_OWNER_THREAD)  # a guest's relayed text
+        assert ledger.tools_allowed("dm", "relay") is True  # no chat-wide DM block
+        assert ledger.ungranted_in_flight("dm", "relay") == 0
+        assert ledger.ungranted_in_flight("dm", "relay", authz.NON_OWNER_THREAD) == 1
+
+    def test_a_record_under_the_non_owner_thread_is_never_a_grant(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "relay", True, authz.NON_OWNER_THREAD)
+        assert ledger.tools_allowed("dm", "relay", authz.NON_OWNER_THREAD) is False
+
+    def test_the_constant_has_no_key_separator(self):
+        assert authz.NON_OWNER_THREAD == "sc-non-owner" and ":" not in authz.NON_OWNER_THREAD
+
+    def test_a_guest_session_tool_call_is_blocked_even_with_an_owner_relay_grant(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "relay", True)
+        env = _bound_thread("dm", "relay", authz.NON_OWNER_THREAD)
+        assert authz.pre_tool_call_decision(env, ledger)["action"] == "block"
+        assert authz.pre_tool_call_decision(_bound_thread("dm", "relay", ""), ledger) is None
+
+    def test_an_unset_session_var_blocks(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "relay", True)
+        for missing in ("HERMES_SESSION_CHAT_ID", "HERMES_SESSION_USER_ID", "HERMES_SESSION_THREAD_ID"):
+            values = {"HERMES_SESSION_PLATFORM": "securecoms", "HERMES_SESSION_CHAT_ID": "dm",
+                      "HERMES_SESSION_USER_ID": "relay", "HERMES_SESSION_THREAD_ID": ""}
+            values[missing] = None  # unset in this task (direct ContextVar read)
+            assert authz.pre_tool_call_decision(lambda n, d="": values[n], ledger)["action"] == "block", missing
+
+    @staticmethod
+    def _frame(**kw):
+        block = auth(kw.pop("audience", "other_human_dm"), grants=[])
+        block.update(kw)
+        return frame(block)
+
+    def test_owner_turn_classification(self):
+        assert authz.is_owner_turn(frame(auth("owner_dm"))) is True
+        assert authz.is_owner_turn(frame(auth("owner_dm", grants=[]))) is True  # the owner's ungranted turn
+        assert authz.is_owner_turn(self._frame(relay_speaker="owner")) is True
+        assert authz.is_owner_turn(self._frame()) is False  # a guest's relayed voice
+        assert authz.is_owner_turn(frame(auth("agent_to_agent"))) is False
+        assert authz.is_owner_turn(frame()) is False  # no block
+        assert authz.is_owner_turn(frame(auth("owner_dm", version=2))) is False
+        assert authz.is_owner_turn(frame(auth("owner_dm", membership="unknown"))) is False
+        assert authz.is_owner_turn(self._frame(relay_speaker="Owner")) is False
+
+
+def _bound_thread(chat_id, user_id, thread_id):
+    values = {"HERMES_SESSION_PLATFORM": "securecoms", "HERMES_SESSION_CHAT_ID": chat_id,
+              "HERMES_SESSION_USER_ID": user_id, "HERMES_SESSION_THREAD_ID": thread_id}
+    return lambda name, default="": values.get(name, default)
+
+
+class TestUnclassifiedThread:
+    """Audit r2 (ruled): a DM frame whose block cannot be classified runs in a
+    THIRD session, sc-unclassified: never the owner's, never the guests'."""
+
+    def test_dm_thread_classification(self):
+        assert authz.dm_thread(frame(auth("owner_dm"))) is None
+        assert authz.dm_thread(frame(auth("other_human_dm", grants=[], ))) == authz.NON_OWNER_THREAD
+        stale = auth("owner_dm", membership="unknown")  # the owner during a stale roster
+        assert authz.dm_thread(frame(stale)) == authz.UNCLASSIFIED_THREAD
+        assert authz.dm_thread(frame()) == authz.UNCLASSIFIED_THREAD  # no block
+        assert authz.dm_thread(frame(auth("owner_dm", version=2))) == authz.UNCLASSIFIED_THREAD
+        assert authz.dm_thread(frame("not a block")) == authz.UNCLASSIFIED_THREAD
+
+    def test_the_constant_is_distinct_and_has_no_key_separator(self):
+        assert authz.UNCLASSIFIED_THREAD == "sc-unclassified"
+        assert authz.UNCLASSIFIED_THREAD not in (authz.NON_OWNER_THREAD, "")
+
+    def test_a_record_under_the_unclassified_thread_is_never_a_grant(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "owner", True, authz.UNCLASSIFIED_THREAD)
+        assert ledger.tools_allowed("dm", "owner", authz.UNCLASSIFIED_THREAD) is False
+
+
+class TestBlockSaysDm:
+    """Audit r2: the daemon's block marks a DM (owner_dm / other_human_dm are
+    set only when meta.is_dm, and so is relay_speaker), whatever the
+    connector's channel cache says."""
+
+    def test_dm_audiences_and_relay_mark(self):
+        assert authz.block_says_dm(frame(auth("owner_dm"))) is True
+        assert authz.block_says_dm(frame(auth("other_human_dm", grants=[]))) is True
+        relay = auth("agent_to_agent", grants=[])
+        relay["relay_speaker"] = "owner"
+        assert authz.block_says_dm(frame(relay)) is True
+
+    def test_room_audiences_and_no_block_say_nothing(self):
+        for aud in ("team_room", "partner_room", "agent_to_agent", "unknown"):
+            assert authz.block_says_dm(frame(auth(aud, grants=[]))) is False
+        assert authz.block_says_dm(frame()) is False
+
+    def test_a_stale_block_still_says_dm(self):
+        # The DM signal is a split signal only (never a grant), so it is read
+        # from the raw block even when the block is not valid for tools.
+        assert authz.block_says_dm(frame(auth("owner_dm", membership="unknown"))) is True

package/connectors/hermes/tests/test_securecoms_transport.py

@@ -10,9 +10,12 @@
 
 import json
 import os
+import subprocess
+import sys
 
 import pytest
 
+import securecoms_transport
 from securecoms_transport import (
     ChannelStatusManager,
     ResolvedTarget,
@@ -606,3 +609,156 @@ class TestChannelStatusManager:
         clock.advance(100.0)
         await mgr.on_typing("ch1")
         assert all(f["state"] != "idle" for f in send.frames)
+
+
+PNG = b"\x89PNG\r\n\x1a\n\x00\x00\x00\r"
+JPEG = b"\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01"
+GIF = b"GIF89a\x01\x00\x01\x00\x00\x00"
+WEBP = b"RIFF\x10\x00\x00\x00WEBPVP8 "
+
+
+class TestInboundAttachments:
+    @pytest.fixture(autouse=True)
+    def _dir(self, tmp_path):
+        self.root = tmp_path
+        self.dir = tmp_path / "attachments" / "chan"
+        self.dir.mkdir(parents=True)
+
+    def _att(self, name, data=JPEG, mime="image/jpeg", directory=None):
+        d = directory or self.dir
+        d.mkdir(parents=True, exist_ok=True)
+        p = d / f"m-{name}"
+        p.write_bytes(data)
+        return {"filename": name, "mime": mime, "size": len(data), "path": str(p), "sha256": "x"}
+
+    def _frame(self, attachments):
+        return {"type": "message", "channel_id": "chan", "attachments": attachments}
+
+    def test_each_allowed_image_type_passes_with_the_sniffed_lowercase_mime(self):
+        for name, data, mime in [("a.png", PNG, "image/png"), ("b.jpg", JPEG, "image/jpeg"),
+                                 ("c.gif", GIF, "image/gif"), ("d.webp", WEBP, "image/webp")]:
+            a = self._att(name, data, mime.upper())
+            assert securecoms_transport.inbound_attachments(self._frame([a])) == [(a["path"], mime)]
+
+    def test_non_images_mismatches_and_oversize_are_dropped(self):
+        big = PNG + b"\x00" * securecoms_transport.MAX_INBOUND_ATTACHMENT_BYTES
+        bad = [
+            self._att("v.mp3", b"ID3\x04\x00\x00\x00\x00\x00\x00\x00\x00", "audio/mpeg"),
+            self._att("d.pdf", b"%PDF-1.7\n....", "application/pdf"),
+            self._att("x.svg", b"<svg xmlns='http://www.w3.org/2000/svg'><script/></svg>", "image/svg+xml"),
+            self._att("png-as.jpg", PNG, "image/jpeg"),
+            self._att("t.png", b"just some text", "image/png"),
+            self._att("big.png", big, "image/png"),
+        ]
+        for b in bad:
+            assert securecoms_transport.inbound_attachments(self._frame([b])) == [], b["filename"]
+        assert securecoms_transport.scan_inbound_attachments(self._frame(bad)) == ([], len(bad))
+
+    def test_bad_paths_and_names_are_dropped(self):
+        good = self._att("ok.jpg")
+        outside = self._att("id.jpg", directory=self.root / "secrets" / "chan")
+        other = self._att("o.jpg", directory=self.root / "attachments" / "other")
+        bad = [
+            {**good, "path": "relative/attachments/chan/m-ok.jpg"},
+            {**good, "path": f"{self.dir}/../chan/m-ok.jpg"},
+            {**good, "path": f"{self.dir}/./m-ok.jpg"},
+            {**good, "path": f"{self.dir}/"},  # empty basename (normpath strips the "/")
+            {**good, "path": outside["path"]},
+            {**good, "path": other["path"]},
+            {**good, "path": f"{self.dir}/x\0.jpg"},
+            {**good, "path": self._att("rtl‮gpj.jpg")["path"]},
+            {**good, "path": self._att("nl\n.jpg")["path"]},
+            {**good, "filename": "inv‮fdp.jpg"},
+            {**good, "filename": 5},
+            {**good, "path": 42},
+            {**good, "mime": 7},
+            None,
+            "string",
+        ]
+        for b in bad:
+            assert securecoms_transport.inbound_attachments(self._frame([b])) == [], b
+        assert len(securecoms_transport.inbound_attachments(self._frame(bad + [good]))) == 1
+
+    def test_the_basename_guard_alone_rejects_an_empty_basename(self, monkeypatch):
+        # normpath already strips a trailing "/", so neutralize it to prove the
+        # basename guard is a real second check, not dead code.
+        good = self._att("ok.jpg")
+        monkeypatch.setattr(securecoms_transport.os.path, "normpath", lambda p: p)
+        assert securecoms_transport.inbound_attachments(self._frame([{**good, "path": f"{self.dir}/"}])) == []
+
+    def test_guards_only_normpath_or_isabs_catch(self, monkeypatch):
+        # Review r2 mutation survivors: a real image reachable through an
+        # unnormalized path whose literal parent is .../attachments/chan.
+        self._att("f.png", PNG, "image/png", directory=self.root / "y" / "attachments" / "chan")
+        dotted = f"{self.root}/attachments/chan/../../y/attachments/chan/m-f.png"
+        assert securecoms_transport.inbound_attachments(self._frame([{"path": dotted, "mime": "image/png"}])) == []
+        # A relative path that resolves to a real image from the cwd.
+        self._att("rel.png", PNG, "image/png")
+        monkeypatch.chdir(self.root)
+        rel = "attachments/chan/m-rel.png"
+        assert os.path.isfile(rel)
+        assert securecoms_transport.inbound_attachments(self._frame([{"path": rel, "mime": "image/png"}])) == []
+
+    def test_a_fifo_is_dropped_without_hanging(self):
+        # O_NONBLOCK: without it, open() on a FIFO with no writer blocks forever,
+        # so run the scan in a child with a hard timeout.
+        fifo = self.dir / "m-hang.png"
+        os.mkfifo(fifo)
+        frame = {"channel_id": "chan", "attachments": [{"path": str(fifo), "mime": "image/png"}]}
+        script = "import json, sys; import securecoms_transport as t; print(json.dumps(t.scan_inbound_attachments(json.loads(sys.stdin.read()))))"
+        hermes_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        r = subprocess.run([sys.executable, "-c", script], input=json.dumps(frame), capture_output=True, text=True,
+                           timeout=15, cwd=hermes_dir, env={**os.environ, "PYTHONPATH": hermes_dir})
+        assert r.returncode == 0, r.stderr
+        assert json.loads(r.stdout) == [[], 1]
+
+    def test_a_symlink_is_not_followed(self):
+        target = self._att("real.png", PNG, "image/png", directory=self.root / "elsewhere")
+        link = self.dir / "m-link.png"
+        os.symlink(target["path"], link)
+        assert securecoms_transport.inbound_attachments(self._frame([{"path": str(link), "mime": "image/png"}])) == []
+
+    def test_all_attachments_share_one_dir(self):
+        good = self._att("a.jpg")
+        other = self._att("b.jpg", directory=self.root / "x" / "attachments" / "chan")
+        assert [p for p, _ in securecoms_transport.inbound_attachments(self._frame([good, other]))] == [good["path"]]
+
+    def test_count_is_capped(self):
+        many = [self._att(f"p{i}.jpg") for i in range(20)]
+        assert len(securecoms_transport.inbound_attachments(self._frame(many))) == securecoms_transport.MAX_INBOUND_ATTACHMENTS == 8
+        assert securecoms_transport.MAX_INBOUND_ATTACHMENT_BYTES == 5 * 1024 * 1024
+
+    def test_no_list_or_no_channel_is_empty(self):
+        good = self._att("a.jpg")
+        assert securecoms_transport.inbound_attachments({"channel_id": "chan", "attachments": good}) == []
+        assert securecoms_transport.inbound_attachments({"attachments": [good]}) == []
+        assert securecoms_transport.inbound_attachments({"channel_id": "chan"}) == []
+
+
+# R3: display names are member-chosen strings that reach the LLM prompt. The
+# cases live in ONE fixture shared with the OpenClaw twin's vitest suite.
+_FIXTURES = json.load(open(os.path.join(
+    os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), "display-name-fixtures.json"),
+    encoding="utf-8"))
+
+
+class TestDisplayName:
+    @pytest.mark.parametrize("raw,expected", _FIXTURES["display_name"], ids=lambda v: ascii(v)[:40])
+    def test_shared_fixture(self, raw, expected):
+        assert securecoms_transport.display_name(raw) == expected
+
+    def test_cap(self):
+        assert securecoms_transport.DISPLAY_NAME_MAX == 64
+
+
+class TestSenderLabel:
+    @pytest.mark.parametrize("case,frame,expected", _FIXTURES["sender_label"], ids=[c[0] for c in _FIXTURES["sender_label"]])
+    def test_shared_fixture(self, case, frame, expected):
+        assert securecoms_transport.sender_label(frame) == expected
+
+    def test_own_label_ignores_the_speaker(self):
+        frame = {"sender_id": "relay-1234567890", "sender_name": "Room relay",
+                 "speaker": {"identityId": "human-1", "displayName": "Dana"}}
+        assert securecoms_transport.own_label(frame) == "Room relay (relay-12)"
+        assert securecoms_transport.speaker_label(frame) == "Dana (human-1)"
+        assert securecoms_transport.speaker_label({"sender_id": "x"}) == ""

package/connectors/openclaw/openclaw-entry.contract.test.ts

@@ -0,0 +1,96 @@
+// packages/connect-agent-bridge/connectors/openclaw/openclaw-entry.contract.test.ts
+//
+// Bridge -> connector contract (review r1 LOW): a file the daemon's REAL
+// materializeAttachment writes (real crypto, real fs writers) must pass BOTH
+// connector validators unchanged — the OpenClaw scanInboundAttachments and the
+// Hermes securecoms_transport.scan_inbound_attachments — including when the
+// daemon's attachmentsDir carries a trailing "/". A non-image the daemon saves
+// must be dropped by both.
+
+import { describe, expect, it } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { computeFileDigest, decryptFile, encryptFile, base64ToBytes } from "@agentvault/crypto";
+import {
+  materializeAttachment,
+  mkdirPrivateNoFollow,
+  writeFileExclusiveNoFollow,
+  type ArtifactShareBody,
+} from "../../src/attachments.js";
+import { inboundAttachmentsOf } from "./openclaw-entry.js";
+
+const CH = "3f2b6c1a-8d4e-4f7a-9b2c-1d3e5f7a9b0c";
+const PNG = Uint8Array.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13, 1, 2, 3]);
+const HERMES_DIR = join(__dirname, "..", "hermes");
+
+async function materialize(plain: Uint8Array, name: string, attachmentsDir: string, messageId: string) {
+  const { encryptedData, fileKey, fileNonce, digest } = await encryptFile(plain);
+  const b64 = (u: Uint8Array) => Buffer.from(u).toString("base64");
+  const body: ArtifactShareBody = {
+    v: 1, type: "artifact_share", name, mime: "image/png", size: plain.length,
+    blobId: "0f3c2a1e-5b6d-4c7e-8f90-a1b2c3d4e5f6", fileKey: b64(fileKey), fileNonce: b64(fileNonce), digest,
+  };
+  return materializeAttachment(body, { attachmentsDir, channelId: CH, messageId }, {
+    ready: async () => {},
+    downloadBlob: async () => encryptedData,
+    decryptFile, computeFileDigest, base64ToBytes,
+    mkdirp: mkdirPrivateNoFollow,
+    writeFile: writeFileExclusiveNoFollow,
+  });
+}
+
+// Visible skip (review r2): the Hermes half needs python3 on the runner.
+const HAS_PYTHON3 = spawnSync("python3", ["--version"]).status === 0;
+
+function hermesScan(frame: unknown): { kept: Array<[string, string]>; dropped: number } {
+  const script = [
+    "import json, sys",
+    "import securecoms_transport as t",
+    "kept, dropped = t.scan_inbound_attachments(json.loads(sys.stdin.read()))",
+    "print(json.dumps({'kept': kept, 'dropped': dropped}))",
+  ].join("\n");
+  const r = spawnSync("python3", ["-c", script], {
+    input: JSON.stringify(frame),
+    cwd: HERMES_DIR,
+    env: { ...process.env, PYTHONPATH: HERMES_DIR },
+    encoding: "utf8",
+  });
+  expect(r.status, r.stderr).toBe(0);
+  return JSON.parse(r.stdout);
+}
+
+describe("bridge materializeAttachment -> connector validators", () => {
+  for (const trailing of ["", "/"]) {
+    it(`a PNG the bridge writes passes both connectors (attachmentsDir trailing "${trailing}")`, async () => {
+      const dir = join(mkdtempSync(join(tmpdir(), "sc-contract-")), "attachments") + trailing;
+      const meta = await materialize(PNG, "IMG_3375.png", dir, "7c1d2e3f-4a5b-4c6d-8e9f-0a1b2c3d4e5f");
+      expect(meta.mime).toBe("image/png");
+      const frame = { channel_id: CH, attachments: [meta] };
+
+      expect(inboundAttachmentsOf(frame)).toEqual([{ path: meta.path, mime: "image/png", filename: "IMG_3375.png" }]);
+
+    });
+
+    it.skipIf(!HAS_PYTHON3)(`... and the Hermes validator (attachmentsDir trailing "${trailing}")`, async () => {
+      const dir = join(mkdtempSync(join(tmpdir(), "sc-contract-")), "attachments") + trailing;
+      const meta = await materialize(PNG, "IMG_3375.png", dir, "7c1d2e3f-4a5b-4c6d-8e9f-0a1b2c3d4e5f");
+      expect(hermesScan({ channel_id: CH, attachments: [meta] })).toEqual({ kept: [[meta.path, "image/png"]], dropped: 0 });
+    });
+  }
+
+  it("a non-image the bridge saves is dropped by both connectors", async () => {
+    const dir = join(mkdtempSync(join(tmpdir(), "sc-contract-")), "attachments");
+    const meta = await materialize(new TextEncoder().encode("%PDF-1.7\n...."), "r.pdf", dir, "8d2e3f4a-5b6c-4d7e-9f0a-1b2c3d4e5f6a");
+    expect(meta.mime).toBe("application/octet-stream");
+    const frame = { channel_id: CH, attachments: [meta] };
+    expect(inboundAttachmentsOf(frame)).toEqual([]);
+  });
+
+  it.skipIf(!HAS_PYTHON3)("... and the Hermes validator drops it too", async () => {
+    const dir = join(mkdtempSync(join(tmpdir(), "sc-contract-")), "attachments");
+    const meta = await materialize(new TextEncoder().encode("%PDF-1.7\n...."), "r.pdf", dir, "8d2e3f4a-5b6c-4d7e-9f0a-1b2c3d4e5f6a");
+    expect(hermesScan({ channel_id: CH, attachments: [meta] })).toEqual({ kept: [], dropped: 1 });
+  });
+});