@securecoms/agent-bridge 0.8.0 → 0.10.0

package/dist/index.js

@@ -1284,6 +1284,18 @@ var LeafRosterMismatchError = class extends Error {
     this.name = "LeafRosterMismatchError";
   }
 };
+var AmbiguousOwnLeafError = class extends Error {
+  deviceId;
+  totalLeaves;
+  candidateLeaves;
+  constructor(deviceId, totalLeaves, candidateLeaves) {
+    super(`removeDeviceFromLiveGroup: cannot identify device ${deviceId}'s leaf \u2014 the identity owns ${totalLeaves} leaves and ${candidateLeaves} remain after excluding this committer's own. Leaf credentials carry the identity, not the device, so the target is genuinely ambiguous. Refusing rather than evicting a device that was never revoked.`);
+    this.deviceId = deviceId;
+    this.totalLeaves = totalLeaves;
+    this.candidateLeaves = candidateLeaves;
+    this.name = "AmbiguousOwnLeafError";
+  }
+};
 var HealAddAfterRemoveError = class extends Error {
   constructor(cause) {
     super("healDivergedMember: Add failed after Remove already landed \u2014 member detached, re-run heal to recover");
@@ -1303,7 +1315,7 @@ var ForgedCredentialError = class extends Error {
     this.name = "ForgedCredentialError";
   }
 };
-var MlsGroupKeyProvider = class {
+var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   o;
   suite;
   managers = /* @__PURE__ */ new Map();
@@ -1453,9 +1465,25 @@ var MlsGroupKeyProvider = class {
    * Snapshot of per-channel decrypt-error / stuck state (ADR-0002 observability).
    * Surfaces a wedged channel that would otherwise "look idle": the daemon serves
    * it on GET /v1/metrics and the web shell reads it via a selector. A channel is
-   * `stuck` once it has had `stuckThreshold` consecutive decrypt failures with no
-   * intervening successful decrypt. Returns a plain object keyed by channelId;
-   * absence of a key means zero errors observed for that channel.
+   * `stuck` once it has had `stuckThreshold` GENUINELY-WEDGED decrypt failures
+   * with no intervening successful decrypt. Returns a plain object keyed by
+   * channelId; absence of a key means zero errors observed for that channel.
+   *
+   * `stuck` gates on `wedgedRun`, NOT `consecutiveErrors` — the same correction
+   * the quarantine gate already got (P0a). `consecutiveErrors` is bumped at the
+   * top of the catch for EVERY failure, INCLUDING the benign past-epoch
+   * duplicate-commit churn that the `permanentlyDead` path immediately and
+   * safely auto-drains. Deriving the user-visible health signal from it meant
+   * ordinary at-least-once / committer-race traffic painted a perfectly healthy
+   * channel red.
+   *
+   * That is the prod symptom of 2026-07-31: a freshly-welcomed federated partner
+   * was queued the very Add commit its Welcome already contained. It joined the
+   * correct group at the correct epoch, correctly identified the replayed commit
+   * as dead and drained it — and still showed "This channel is stuck", because
+   * the drain happened AFTER the error had been counted. `wedgedRun` counts only
+   * rows left UN-acked (actually stuck), and a clean decrypt clears it, so a
+   * genuine wedge still reports exactly as before.
    */
   errorStats() {
     const out = {};
@@ -1464,7 +1492,7 @@ var MlsGroupKeyProvider = class {
         decryptErrors: e.decryptErrors,
         consecutiveErrors: e.consecutiveErrors,
         lastErrorAt: e.lastErrorAt,
-        stuck: e.consecutiveErrors >= this.stuckThreshold,
+        stuck: e.wedgedRun >= this.stuckThreshold,
         quarantined: e.quarantined
       };
     }
@@ -2129,6 +2157,25 @@ var MlsGroupKeyProvider = class {
    * `removed_device_id` (instead of removed_identity_id); the server resolves the
    * device's identity, asserts it matches, and purges that ONE device.
    */
+  /**
+   * This committer's OWN leaf index in the given group's ratchet tree, or null
+   * when it cannot be read.
+   *
+   * `MLSGroupManager.state` is marked `@internal` but is a declared (non-private)
+   * field, and `state.privatePath.leafIndex` is the same value ts-mls itself uses
+   * as the sender leaf when protecting application data. Reading it here avoids a
+   * change to `@agentvault/crypto`; if a public accessor is added later this
+   * should delegate to it.
+   *
+   * Returns null rather than throwing so every caller must decide explicitly what
+   * an unknown own-leaf means. The one caller today FAILS CLOSED on null by
+   * falling back to the positional path only for FOREIGN identities — it never
+   * uses null to justify guessing among an own identity's leaves.
+   */
+  ownLeafIndex(mgr) {
+    const idx = mgr.state?.privatePath?.leafIndex;
+    return typeof idx === "number" ? idx : null;
+  }
   async removeDeviceFromLiveGroup(channelId, deviceId, opts) {
     return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, 0)));
   }
@@ -2141,7 +2188,17 @@ var MlsGroupKeyProvider = class {
     if (leaves.length !== opts.orderedDeviceIds.length) {
       throw new LeafRosterMismatchError();
     }
-    const leafIndex = leaves[pos];
+    let leafIndex;
+    const ownLeaf = this.ownLeafIndex(mgr);
+    if (ownLeaf !== null && leaves.includes(ownLeaf)) {
+      const others = leaves.filter((i) => i !== ownLeaf);
+      if (others.length !== 1) {
+        throw new AmbiguousOwnLeafError(deviceId, leaves.length, others.length);
+      }
+      leafIndex = others[0];
+    } else {
+      leafIndex = leaves[pos];
+    }
     const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
     const priorEpoch = Number(mgr.epoch);
     const { commit } = await mgr.removeMembers([leafIndex]);
@@ -2394,7 +2451,7 @@ var MlsGroupKeyProvider = class {
       });
       await this.o.store.save(channelId, mgr.exportState());
       this.managers.set(channelId, mgr);
-      await this.o.store.deletePendingBundle(this.o.deviceId);
+      return { staleMemberDeviceIds: reinit.stale_member_device_ids ?? [] };
     });
   }
   /** Returns true when an in-memory MLS manager is live for the channel.
@@ -2470,7 +2527,60 @@ var MlsGroupKeyProvider = class {
    * ⇒ refuse, never call verify), then structural signer check, then attestation
    * verify against the NON-EMPTY pinned key, then post-join group-id assertion.
    */
+  /** C4 (split-brain Task 4): back-off for REFUSED supersedes, keyed
+   * `${channelId}:${groupId}`. A refused supersede leaves its row un-acked by
+   * design (it is not a stray), but pre-back-off that meant a full re-verify —
+   * including a fetchResetAttestation HTTP round-trip — on EVERY receive poll,
+   * forever, for a request that can never succeed (the nine production split
+   * channels all carry NULL-attestation legacy groups).
+   *
+   * ⚠️ ONLY POST-FETCH refusals enter the back-off. The step-0 pin guard and
+   * the retired-group check run BEFORE fetchResetAttestation, so they
+   * contribute zero HTTP to the storm — and the pin guard's precondition is
+   * TRANSIENT (cold owner cache / momentarily anomalous roster; the bridge
+   * warms the cache before receiveOnce for exactly this reason). Backing a
+   * pre-fetch refusal off buys nothing and converts a one-cycle stall into a
+   * ten-minute outage on a valid recovery.
+   *
+   * Of the backed-off refusals: no-attestation, unparseable content,
+   * channel/group mismatch and post-join mismatch are DETERMINISTIC per
+   * (channel, group) — the attestation columns are written at group creation
+   * and never change. Signer-mismatch, signature-verify and no-bundle are
+   * ASSUMED stable for the window; they are pin- or bundle-dependent, but by
+   * the time they run the fetch has already been paid, so suppressing the
+   * window bounds the storm at the cost of a ≤10-minute delay if the pin or
+   * bundle changes. Note the suppression means the reason is not RE-OBSERVED
+   * during the window — the underlying precondition can change freely; the
+   * window is a cost bound, not a claim of immutability.
+   *
+   * The reason lives in the VALUE for observability; the clearing rule lives
+   * in the KEY: the owner minting a FIXED replacement group arrives with a
+   * NEW group id — a different key, tried immediately. The un-openable path
+   * (verified Welcome, KP mismatch) is EXEMPT: onSupersedeUnopenable's own
+   * cooldown governs it. In-memory only: a reload/restart costs one extra
+   * fetch per stranded row — reload-bounded, not poll-bounded. */
+  supersedeRefusals = /* @__PURE__ */ new Map();
+  static SUPERSEDE_REFUSAL_BACKOFF_MS = 10 * 6e4;
+  /** True while (channelId, groupId) is inside its refusal back-off window.
+   * @internal exposed for diagnostics only — not part of the stable surface. */
+  supersedeBackoffActive(channelId, groupId) {
+    const rec = this.supersedeRefusals.get(`${channelId}:${groupId}`);
+    return rec !== void 0 && Date.now() < rec.until;
+  }
   async trySupersede(channelId, row, heldGroupId) {
+    const refuse = (msg) => {
+      this.recordDecryptError(row, new Error(msg));
+      const now = Date.now();
+      for (const [k, v] of this.supersedeRefusals) {
+        if (now >= v.until)
+          this.supersedeRefusals.delete(k);
+      }
+      this.supersedeRefusals.set(`${channelId}:${row.group_id}`, {
+        reason: msg,
+        until: now + _MlsGroupKeyProvider.SUPERSEDE_REFUSAL_BACKOFF_MS
+      });
+      return false;
+    };
     const owner = this.o.onResolvePinnedOwner ? await this.o.onResolvePinnedOwner(channelId) : null;
     if (!owner || !owner.publicKeyHex) {
       this.recordDecryptError(row, new Error("supersede refused: no pinned owner key (step-0 guard)"));
@@ -2483,33 +2593,27 @@ var MlsGroupKeyProvider = class {
     }
     const att = await this.o.backend.fetchResetAttestation(row.group_id);
     if (!att) {
-      this.recordDecryptError(row, new Error(`supersede refused: no attestation for group ${row.group_id}`));
-      return false;
+      return refuse(`supersede refused: no attestation for group ${row.group_id}`);
     }
     if (att.signerIdentityId !== owner.identityId) {
-      this.recordDecryptError(row, new Error("supersede refused: signer is not the pinned owner"));
-      return false;
+      return refuse("supersede refused: signer is not the pinned owner");
     }
     let content;
     try {
       content = JSON.parse(att.signedContent);
     } catch {
-      this.recordDecryptError(row, new Error("supersede refused: unparseable signed_content"));
-      return false;
+      return refuse("supersede refused: unparseable signed_content");
     }
     if (content.channel_id !== row.connect_channel_id || content.new_group_id !== row.group_id) {
-      this.recordDecryptError(row, new Error("supersede refused: attestation channel/group mismatch"));
-      return false;
+      return refuse("supersede refused: attestation channel/group mismatch");
     }
     const ok = await verifyApprovalArtifact({ content, signature: att.signatureHex, signerPublicKey: owner.publicKeyHex, createdAt: "", version: 1 }, owner.publicKeyHex);
     if (!ok) {
-      this.recordDecryptError(row, new Error("supersede refused: signature does not verify against pinned owner key"));
-      return false;
+      return refuse("supersede refused: signature does not verify against pinned owner key");
     }
     const bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
     if (!bundle) {
-      this.recordDecryptError(row, new Error("supersede refused: no pending KeyPackage bundle to open the new Welcome"));
-      return false;
+      return refuse("supersede refused: no pending KeyPackage bundle to open the new Welcome");
     }
     return await this.locks.run(channelId, async () => {
       const mgr = new MLSGroupManager();
@@ -2534,14 +2638,14 @@ var MlsGroupKeyProvider = class {
         return false;
       }
       if (new TextDecoder().decode(mgr.groupId) !== row.group_id) {
-        this.recordDecryptError(row, new Error("supersede refused: post-join group id != attested new_group_id"));
-        return false;
+        return refuse("supersede refused: post-join group id != attested new_group_id");
       }
       this.evictChannelState(channelId);
       await this.o.store.delete(channelId);
       await this.o.store.discardStaging(channelId);
       await this.o.store.addRetiredGroupId(channelId, heldGroupId);
       this.errors.delete(channelId);
+      this.supersedeRefusals.delete(`${channelId}:${row.group_id}`);
       this.managers.set(channelId, mgr);
       await this.o.store.save(channelId, mgr.exportState());
       await this.o.backend.ackDelivery(this.o.deviceId, [row.queue_id]);
@@ -2578,9 +2682,15 @@ var MlsGroupKeyProvider = class {
               if (heldGroupId !== null && heldGroupId === row.group_id) {
                 handshakeAcked.push(row.queue_id);
               } else if (heldGroupId !== null && heldGroupId !== row.group_id) {
-                const ok = await this.trySupersede(wcid, row, heldGroupId);
-                if (ok)
-                  supersededChannelIds.push(wcid);
+                if (this.supersedeBackoffActive(wcid, row.group_id)) {
+                  if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
+                    console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} g=${row.group_id.slice(0, 8)} -> SKIP(refusal back-off)`);
+                  }
+                } else {
+                  const ok = await this.trySupersede(wcid, row, heldGroupId);
+                  if (ok)
+                    supersededChannelIds.push(wcid);
+                }
               }
             } else if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
               console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} rowGroup=${(row.group_id || "-").slice(0, 8)} -> NO-LOCAL-STATE (leave un-acked for join path)`);
@@ -3283,19 +3393,8 @@ var RestMlsBackend = class {
       created: j.created === void 0 ? true : Boolean(j.created)
     };
   }
-  async reinitConnectChannelGroup(channelId, memberDeviceIds) {
-    const committer = memberDeviceIds[0];
-    if (!committer)
-      throw new Error("reinitConnectChannelGroup: empty member set");
-    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/reinit`, {
-      member_device_ids: memberDeviceIds,
-      committer_device_id: committer
-    });
-    return {
-      group_id: String(j.group_id),
-      current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
-    };
+  async reinitConnectChannelGroup() {
+    throw new Error("reinitConnectChannelGroup was removed (it minted unattested MLS groups that orphaned channel members permanently). Use resetReinitConnectChannelGroup with an owner attestation.");
   }
   async resetReinitConnectChannelGroup(channelId, memberDeviceIds, att) {
     const committer = memberDeviceIds[0];
@@ -3313,7 +3412,11 @@ var RestMlsBackend = class {
     return {
       group_id: String(j.group_id),
       current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : [],
+      // Absent on a backend that predates the dropped-member report; an empty
+      // list is the correct read of "the server told us nothing", since the old
+      // server also never dropped anyone for an expired KeyPackage.
+      stale_member_device_ids: Array.isArray(j.stale_member_device_ids) ? j.stale_member_device_ids.map(String) : []
     };
   }
   async fetchKeyPackages(deviceIds) {
@@ -3811,7 +3914,7 @@ function loadPackageMeta(importMetaUrl) {
 
 // src/bridge-agent.ts
 import { promises as fsp } from "node:fs";
-import { join as join5, dirname } from "node:path";
+import { join as join6, dirname } from "node:path";
 
 // src/latency.ts
 var DEFAULT_CAPACITY = 1024;
@@ -4324,29 +4427,153 @@ function readRecentTurns(baseDir, agent, sessionId, k) {
   return k > 0 ? turns.slice(-k) : [];
 }
 
+// src/memory/openclaw-workspace-facts.ts
+import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
+import { join as join5 } from "node:path";
+var DEFAULT_FACTS_BUDGET = 8e3;
+var MEMORY_MD_CAP = 6e3;
+var MIN_FRAGMENT = 200;
+var MAX_SOURCE_BYTES = 1024 * 1024;
+var DAILY_RE = /^\d{4}-\d{2}-\d{2}\.md$/;
+function resolveWorkspaceDir(baseDir, agent, override) {
+  if (override) return expandHome(override);
+  const base = expandHome(baseDir);
+  const isMain = agent === "" || agent === "main";
+  try {
+    const cfg = JSON.parse(readFileSync4(join5(base, "openclaw.json"), "utf8"));
+    const agents = cfg?.agents;
+    if (agents && typeof agents === "object") {
+      const list = Array.isArray(agents.list) ? agents.list : [];
+      const wanted = isMain ? "main" : agent;
+      const entry = list.find((e) => e && typeof e === "object" && e.id === wanted);
+      const ws = entry?.workspace;
+      if (typeof ws === "string" && ws) return expandHome(ws);
+      const def = agents.defaults?.workspace;
+      if (typeof def === "string" && def) return expandHome(def);
+    }
+  } catch {
+  }
+  return isMain ? join5(base, "workspace") : join5(base, `workspace-${agent}`);
+}
+var TRUNC = "\u2026[truncated]";
+function headSlice(s, n) {
+  if (s.length <= n) return { text: s, clipped: false };
+  let out = s.slice(0, n);
+  const last = out.charCodeAt(out.length - 1);
+  if (last >= 55296 && last <= 56319) out = out.slice(0, -1);
+  return { text: out, clipped: true };
+}
+function tailSlice(s, n) {
+  if (s.length <= n) return { text: s, clipped: false };
+  let out = s.slice(s.length - n);
+  const first = out.charCodeAt(0);
+  if (first >= 56320 && first <= 57343) out = out.slice(1);
+  return { text: out, clipped: true };
+}
+function readBounded(path) {
+  if (statSync(path).size > MAX_SOURCE_BYTES) return { text: null, oversize: true };
+  return { text: readFileSync4(path, "utf8"), oversize: false };
+}
+function readWorkspaceFacts(baseDir, agent, opts) {
+  const raw = opts?.charBudget;
+  const budget = typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? raw : DEFAULT_FACTS_BUDGET;
+  if (budget === 0) return { facts: [], truncated: false, missing: false };
+  const dir = resolveWorkspaceDir(baseDir, agent, opts?.workspaceDir);
+  const facts = [];
+  let truncated = false;
+  let remaining = budget;
+  try {
+    const r = readBounded(join5(dir, "MEMORY.md"));
+    if (r.oversize) truncated = true;
+    else if (r.text && r.text.trim()) {
+      const { text, clipped } = headSlice(r.text, Math.min(MEMORY_MD_CAP, budget));
+      truncated ||= clipped;
+      facts.push(`workspace MEMORY.md:
+${text}${clipped ? `
+${TRUNC}` : ""}`);
+      remaining -= text.length;
+    }
+  } catch {
+  }
+  try {
+    const dailies = readdirSync(join5(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
+    for (const f of dailies) {
+      if (remaining < MIN_FRAGMENT) {
+        truncated = true;
+        break;
+      }
+      let r;
+      try {
+        r = readBounded(join5(dir, "memory", f));
+      } catch {
+        continue;
+      }
+      if (r.oversize) {
+        truncated = true;
+        continue;
+      }
+      if (!r.text || !r.text.trim()) continue;
+      const { text, clipped } = tailSlice(r.text, remaining);
+      truncated ||= clipped;
+      facts.push(`workspace memory/${f} (daily):
+${clipped ? `${TRUNC}
+` : ""}${text}`);
+      remaining -= text.length;
+    }
+  } catch {
+  }
+  return { facts, truncated, missing: facts.length === 0 };
+}
+
 // src/memory/openclaw-provider.ts
 var DEFAULT_K2 = 200;
 var OpenClawMemoryProvider = class {
-  constructor(store, baseDir, agent) {
+  // gauge: last successful returned total, including prefixes/markers
+  constructor(store, baseDir, agent, factsOpts) {
     this.store = store;
     this.baseDir = baseDir;
     this.agent = agent;
+    this.factsOpts = factsOpts;
   }
   noSession = 0;
   readFailed = 0;
+  factsMissing = 0;
+  // absence-shaped: resolved path missing or zero sources (per-call)
+  factsReadFailed = 0;
+  // anything THROWN out of the facts computation
+  factsTruncated = 0;
+  // budget clipped/dropped a source (incl. the 1MB skip)
+  factsChars = 0;
   async record(input) {
     if (input.modality !== "voice") return { seq: 0, deduped: true };
     return this.store.recordMemory({ ...input, text: `[voice] ${input.text}` });
   }
   async context(conversationId, limit) {
     const k = limit ?? DEFAULT_K2;
+    let wsFacts = [];
+    try {
+      const r = readWorkspaceFacts(this.baseDir, this.agent, {
+        workspaceDir: this.factsOpts?.workspaceDir,
+        charBudget: this.factsOpts?.factsCharBudget
+      });
+      wsFacts = r.facts;
+      if (r.missing) this.factsMissing++;
+      if (r.truncated) this.factsTruncated++;
+      this.factsChars = r.facts.reduce((n, f) => n + f.length, 0);
+    } catch {
+      this.factsReadFailed++;
+    }
+    const withFacts = (res) => ({
+      recent: res.recent,
+      facts: [...wsFacts, ...res.facts]
+    });
     const voice = await this.store.memoryContext(conversationId, k);
     let textTurns = [];
     try {
       const sid = resolveOwnerDmSession(this.baseDir, this.agent);
       if (!sid) {
         this.noSession++;
-        return voice;
+        return withFacts(voice);
       }
       textTurns = readRecentTurns(this.baseDir, this.agent, sid, k).map((t) => ({
         seq: 0,
@@ -4356,7 +4583,7 @@ var OpenClawMemoryProvider = class {
       }));
     } catch {
       this.readFailed++;
-      return voice;
+      return withFacts(voice);
     }
     const tagged = [
       ...textTurns.map((t, i) => ({ ...t, _src: 0, _i: i })),
@@ -4375,10 +4602,17 @@ var OpenClawMemoryProvider = class {
       text: t.text,
       ts: t.ts
     }));
-    return { recent, facts: voice.facts };
+    return withFacts({ recent, facts: voice.facts });
   }
   stats() {
-    return { openclaw_no_session: this.noSession, openclaw_read_failed: this.readFailed };
+    return {
+      openclaw_no_session: this.noSession,
+      openclaw_read_failed: this.readFailed,
+      openclaw_facts_missing: this.factsMissing,
+      openclaw_facts_read_failed: this.factsReadFailed,
+      openclaw_facts_truncated: this.factsTruncated,
+      openclaw_facts_chars: this.factsChars
+    };
   }
 };
 
@@ -4402,10 +4636,10 @@ var NullMemory = class {
     return { recent: [], facts: [] };
   }
 };
-function createMemoryProvider(provider, store, baseDir, agent) {
+function createMemoryProvider(provider, store, baseDir, agent, openclawFacts) {
   if (provider === "none") return new NullMemory();
   if (provider === "hermes") return new HermesMemoryProvider(baseDir ?? "~/.hermes");
-  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "");
+  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "", openclawFacts);
   return new SecureComsLocalMemory(store);
 }
 
@@ -4513,7 +4747,10 @@ var BridgeAgent = class _BridgeAgent {
       identityId: cfg.identityId,
       cipherFor: () => new KeyedInboxCipher(deriveMlsStoreKey(seed))
     });
-    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent);
+    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent, {
+      workspaceDir: this.cfg.memoryWorkspaceDir,
+      factsCharBudget: this.cfg.memoryFactsCharBudget
+    });
     this.provider = new MlsGroupKeyProvider({
       store: this.store,
       backend: this.backend,
@@ -4593,7 +4830,7 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join5(dirname(cfg.storePath), "attachments");
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join6(dirname(cfg.storePath), "attachments");
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -5077,11 +5314,33 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.providerCapabilityMissing = false;
-    let chans;
-    try {
-      chans = await this.listChannels();
-    } catch (e) {
-      console.warn("[bridge] selfHealSweep aborted: listChannels failed:", e);
+    const enclaves = await this.enclavesToCover();
+    this.enclaveListEverSucceeded.add(this.cfg.enclaveId);
+    const seen = /* @__PURE__ */ new Set();
+    const chans = [];
+    const failed = [];
+    let listedAny = false;
+    for (const encId of enclaves) {
+      try {
+        for (const c of await this.listChannels(encId)) {
+          if (seen.has(c.channel_id)) continue;
+          seen.add(c.channel_id);
+          chans.push(c);
+        }
+        listedAny = true;
+        this.enclaveListEverSucceeded.add(encId);
+        this.enclaveListWarned.delete(encId);
+      } catch (e) {
+        failed.push(encId);
+        if (!this.enclaveListWarned.has(encId)) {
+          this.enclaveListWarned.add(encId);
+          console.warn(`[bridge] selfHealSweep: listChannels failed for enclave ${encId}; skipping (warn-once per streak):`, e);
+        }
+      }
+    }
+    this.sweepEnclavesFailed = failed;
+    if (!listedAny) {
+      console.warn("[bridge] selfHealSweep aborted: every enclave listing failed");
       return;
     }
     for (const c of chans) {
@@ -5427,7 +5686,7 @@ var BridgeAgent = class _BridgeAgent {
    * the other enclaves in the set.
    */
   async refreshChannelMeta() {
-    const enclaves = /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.store.distinctEnclaveIds()]);
+    const enclaves = await this.enclavesToCover();
     const now = Date.now();
     for (const encId of enclaves) {
       try {
@@ -5440,6 +5699,89 @@ var BridgeAgent = class _BridgeAgent {
       }
     }
   }
+  /** Cache for the server-side enclave enumeration (see enclavesToCover). */
+  enclaveEnumCache = null;
+  /** Enclaves whose channel listing failed on the NEWEST sweep (audit HIGH:
+   * skip-one deleted the sweep's partial-coverage signal — observations_stale
+   * is a global max, so one healthy enclave masked a failed one). Surfaced on
+   * health() so partial coverage is never silent. */
+  sweepEnclavesFailed = [];
+  /** Enclave ids whose channel listing has EVER succeeded this process, seeded
+   * with HOME (home is always expected to list; without the seed, a home
+   * failure right after a restart would read as "never succeeded" and slip
+   * through the expected-gap branch — weaker than the old abort-on-failure).
+   * A failure of a member of this set is a REGRESSION and degrades health; a
+   * failure of a never-succeeded enclave (partner: tenant-scoped 404, permanent
+   * pending backend authz) is an EXPECTED gap — reported, not degrading, or
+   * every federated agent would peg degraded forever. */
+  enclaveListEverSucceeded = /* @__PURE__ */ new Set();
+  /** Warn-once-per-failure-streak, keyed by enclave id (cleared on success):
+   * a permanently-404ing partner enclave must not log 1440 lines a day. */
+  enclaveListWarned = /* @__PURE__ */ new Set();
+  static ENCLAVE_ENUM_TTL_MS = 5 * 6e4;
+  enclaveEnumWarned = false;
+  /**
+   * C1 (split-brain Task 3): every enclave this agent must COVER — for the
+   * self-heal sweep and for channel-meta refresh alike. ONE helper on purpose:
+   * these two call sites had drifted (refreshChannelMeta looped home+learned,
+   * selfHealSweep looped nothing), and the drift is exactly what left both
+   * production agents with zero recovery coverage in their second enclave.
+   *
+   * The set is SERVER enumeration ∪ home ∪ store-learned:
+   *
+   *  - SERVER (`GET /api/v1/enclaves`, membership-scoped, federated included)
+   *    is the authoritative source. The store CANNOT be: channel_meta's only
+   *    writers are listChannels itself (circular — you learn enclave B by
+   *    having already listed B) and the receive pump's successfully-decrypted
+   *    loop, and a FORKED agent decrypts nothing, so the agent that most needs
+   *    sweeping in enclave B is precisely the one whose store never learned B.
+   *  - home + learned stay in the union as the degraded-mode floor: if the
+   *    enumeration endpoint is down, we sweep what we can rather than nothing,
+   *    and we warn (once) so the gap is diagnosable.
+   *
+   * The server result is cached for ENCLAVE_ENUM_TTL_MS so per-ingest-cycle
+   * callers (refreshChannelMeta) do not add an HTTP round-trip per cycle;
+   * membership changes are picked up within one TTL, which matches the sweep
+   * cadence this exists to serve.
+   *
+   * ⚠️ Residual gap, stated: the enumeration RETURNS cross-tenant partner
+   * enclaves, but `list_channels_in_enclave` is tenant-scoped and 404s them
+   * under this agent's bearer — so a partner enclave in this set still yields
+   * no channels. Callers must treat a per-enclave listing failure as skip-one,
+   * never abort-all. Closing that needs backend authz work, not daemon work.
+   */
+  async enclavesToCover() {
+    const now = Date.now();
+    if (!this.enclaveEnumCache || now - this.enclaveEnumCache.at > _BridgeAgent.ENCLAVE_ENUM_TTL_MS) {
+      try {
+        const url = `${this.cfg.apiBase}/api/v1/enclaves?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+        const res = await this.fetchImpl(url, {
+          headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+        });
+        if (!res.ok) throw new Error(`list_enclaves failed: ${res.status}`);
+        const rows = await res.json();
+        this.enclaveEnumCache = { ids: rows.map((r) => r.enclave_id), at: Date.now() };
+        this.enclaveEnumWarned = false;
+      } catch (e) {
+        if (!this.enclaveEnumWarned) {
+          this.enclaveEnumWarned = true;
+          console.warn(
+            "[bridge] enclave enumeration failed; sweep coverage degraded to home+learned enclaves:",
+            e
+          );
+        }
+      }
+    }
+    const fresh = this.enclaveEnumCache && Date.now() - this.enclaveEnumCache.at <= _BridgeAgent.ENCLAVE_ENUM_TTL_MS;
+    if (fresh) {
+      return /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.enclaveEnumCache.ids]);
+    }
+    return /* @__PURE__ */ new Set([
+      this.cfg.enclaveId,
+      ...this.store.distinctEnclaveIds(),
+      ...this.enclaveEnumCache?.ids ?? []
+    ]);
+  }
   /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
   freshRoster(channelId) {
     const hit = this.channelRoster.get(channelId);
@@ -6036,6 +6378,9 @@ var BridgeAgent = class _BridgeAgent {
     const stalePeriodMs = _BridgeAgent.SELF_HEAL_SWEEP_INTERVAL_MS + _BridgeAgent.SELF_HEAL_SWEEP_JITTER_MS;
     const observationsStale = this.providerCapabilityMissing || channels.length === 0 || Date.now() - newest > stalePeriodMs;
     const divergedChannels = channels.filter((o) => o.diverged === true).length;
+    const sweepCoverageLost = this.sweepEnclavesFailed.some(
+      (id) => this.enclaveListEverSucceeded.has(id)
+    );
     const liveChannels = channels.map((o) => ({
       ...o,
       last_decrypt_at: this.provider.lastDecryptAtFor?.(o.channel_id) ?? o.last_decrypt_at
@@ -6050,8 +6395,9 @@ var BridgeAgent = class _BridgeAgent {
       observations_stale: observationsStale,
       diverged_channels: divergedChannels,
       // A2: the truthful roll-up gates read instead of `status` (D-3).
-      degraded: divergedChannels > 0 || observationsStale,
+      degraded: divergedChannels > 0 || observationsStale || sweepCoverageLost,
       channels: liveChannels,
+      sweep_enclaves_failed: [...this.sweepEnclavesFailed],
       identity_id: this.cfg.identityId,
       joined_channels: joined,
       buffered: this.buffer.length,
@@ -6120,13 +6466,13 @@ var BridgeAgent = class _BridgeAgent {
 };
 
 // src/config.ts
-import { readFileSync as readFileSync4, statSync } from "node:fs";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
+import { dirname as dirname2, join as join7 } from "node:path";
 var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 function loadConfig(opts) {
-  const raw = readFileSync4(opts.credentialPath, "utf8");
+  const raw = readFileSync5(opts.credentialPath, "utf8");
   try {
-    const mode = statSync(opts.credentialPath).mode & 511;
+    const mode = statSync2(opts.credentialPath).mode & 511;
     if (mode & 63) process.stderr.write(`[bridge] WARNING: credential file ${opts.credentialPath} permission ${mode.toString(8)} is not 0600 \u2014 tighten it (chmod 600).
 `);
   } catch {
@@ -6138,7 +6484,7 @@ function loadConfig(opts) {
     throw new Error("credential file is not valid JSON");
   }
   for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new Error(`credential file missing required field: ${k}`);
-  const storePath = opts.storePath ?? join6(dirname2(opts.credentialPath), "bridge-state.db");
+  const storePath = opts.storePath ?? join7(dirname2(opts.credentialPath), "bridge-state.db");
   const agentName = typeof json2.agent_name === "string" && json2.agent_name ? json2.agent_name : typeof json2.display_name === "string" && json2.display_name ? json2.display_name : void 0;
   const rateLimitCapacity = typeof json2.rate_limit_capacity === "number" ? json2.rate_limit_capacity : 20;
   const rateLimitRefillPerMinute = typeof json2.rate_limit_refill_per_minute === "number" ? json2.rate_limit_refill_per_minute : 20;
@@ -6146,6 +6492,8 @@ function loadConfig(opts) {
   let memoryProvider;
   let memoryBaseDir;
   let memoryAgent;
+  let memoryWorkspaceDir;
+  let memoryFactsCharBudget;
   if (memProvRaw === "none") {
     memoryProvider = "none";
   } else if (memProvRaw === "hermes") {
@@ -6159,6 +6507,10 @@ function loadConfig(opts) {
     memoryBaseDir = typeof bd === "string" && bd ? bd : "~/.openclaw";
     const ag = oc?.agent;
     memoryAgent = typeof ag === "string" && ag ? ag : void 0;
+    const wd = oc?.workspace_dir;
+    memoryWorkspaceDir = typeof wd === "string" && wd ? wd : void 0;
+    const fb = oc?.facts_char_budget;
+    memoryFactsCharBudget = typeof fb === "number" && Number.isInteger(fb) && fb >= 0 ? fb : void 0;
   } else {
     memoryProvider = "securecoms";
   }
@@ -6175,7 +6527,9 @@ function loadConfig(opts) {
     rateLimitRefillPerMinute,
     memoryProvider,
     memoryBaseDir,
-    memoryAgent
+    memoryAgent,
+    memoryWorkspaceDir,
+    memoryFactsCharBudget
   };
 }
 function arg(argv, flag) {
@@ -6219,11 +6573,11 @@ import { z } from "zod";
 
 // src/auth.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync as readFileSync5, writeFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync6, writeFileSync } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync(f)) return readFileSync5(f, "utf8").trim();
+  if (f && existsSync(f)) return readFileSync6(f, "utf8").trim();
   const tok = randomBytes3(32).toString("base64url");
   if (f) writeFileSync(f, tok, { mode: 384 });
   return tok;