@securecoms/agent-runtime 0.5.0 → 0.7.0

package/README.md

@@ -98,7 +98,7 @@ All configuration is via `SECURECOMS_*` environment variables (see
 | `SECURECOMS_DATA_DIR` | `~/.securecoms/agent-runtime` | Root directory for per-channel state |
 | `SECURECOMS_SKILLS_CONFIG` | `<dataDir>/skills.json` (or `--skills-config <path>`) | Path to `skills.json` — named endpoints, databases and flags |
 | `SECURECOMS_LOG_LEVEL` | `info` | One of `debug`, `info`, `warn`, `error` |
-| `SECURECOMS_TOOL_ALLOW` | `echo`, `web_search`, `fetch_url`, `http_request`, `sql_query`, `current_time`, `remember` | Comma-separated tool allow-list |
+| `SECURECOMS_TOOL_ALLOW` | `echo`, `web_search`, `fetch_url`, `http_request`, `sql_query`, `current_time` | Comma-separated tool allow-list |
 | `SECURECOMS_TOOL_DENY` | unset | Comma-separated tool deny-list (wins over allow) |
 | `SECURECOMS_TOOL_DEFAULT` | `deny` | Fallback policy for a tool matched by neither list |
 
@@ -205,7 +205,7 @@ the line — for example `requires: [endpoint:crm]` in
 
 ## Curated skills
 
-Seven built-in handlers ship with the runtime. All network built-ins refuse
+Six built-in handlers ship with the runtime. All network built-ins refuse
 `localhost` and any private, loopback or link-local resolved address, and
 every tool result is capped at 20 kB (truncated, not an error). A redirect to a
 different origin is followed without the caller's headers and without the
@@ -220,7 +220,6 @@ to a host the operator did not name.
 | `web_search` | `query`, `count` (1–10, default 5) | `requires: [search_provider]` — needs a readable, non-empty `SECURECOMS_BRAVE_KEY_FILE` or `SECURECOMS_TAVILY_KEY_FILE`; Brave is used first when both are set. |
 | `http_request` | `name` (a configured `endpoint:<name>`), `path` (a query string is kept, a `#fragment` is dropped), `method` (GET/POST/PUT/DELETE), `body` | `requires: [any_endpoint]`. The model names an endpoint and a path, never a host; a path that would leave the endpoint's `baseUrl` origin is refused. |
 | `sql_query` | `name` (a configured `database:<name>`), `sql` (read-only `SELECT` only; a `;` or a write keyword anywhere in the text — inside a string literal or a comment included — is refused) | `requires: [any_database]`. SQLite or Postgres (`pg` required separately for Postgres). Results capped at 200 rows. |
-| `remember` | `fact` (≤300 chars) | Appends a dated line to the agent-wide `MEMORY.md`. |
 
 ## skills.json
 
@@ -283,12 +282,16 @@ file that already exists, so a customized `IDENTITY.md` is safe to keep
 across a re-init. `securecoms-agent persona show` prints the assembled system
 prompt exactly as a turn would see it, useful for checking an edit landed.
 
-Separately, `MEMORY.md` in the data dir is **agent-wide** (not per-persona,
-not per-channel): the `remember` skill appends a dated, one-line fact to it,
-and its contents are injected as a system message on every turn across every
-channel. It is capped at 8 kB; once it overflows, the **oldest** lines are
-dropped first, on the theory that the newest remembered facts are the ones
-still likely to be true.
+Legacy `MEMORY.md` files are not active configuration. Earlier runtime versions
+injected one agent-wide file into every channel, which crossed channel
+audiences. On startup the runtime moves each legacy file to a mode-0600
+`MEMORY.quarantined*.md` file in the same directory without overwriting an
+existing quarantine. The quarantined content is never injected or writable by
+a tool. The runtime inventories that quarantine plus inactive per-channel JSON
+stores for the owner-review surface. Review offers a passphrase-encrypted
+export and exact-source deletion; the 90-day clock begins only after the
+machine successfully reports the source. Explicit fact-to-channel assignment
+is a separate migration step and never guesses or fans out an audience.
 
 ## Managed configuration (from the web app)
 
@@ -307,7 +310,7 @@ managed directory at all behaves exactly as it did before. `skills.json` is
 looked up the same way, and re-read on every turn — a new endpoint or a skill
 switched off in the app takes effect on the next message, with no restart.
 
-Two deliberate exceptions:
+One deliberate exception:
 
 - **The environment still wins for the tool policy.** `SECURECOMS_TOOL_ALLOW`
   overrides the `allow` list in the `tools` block of `skills.json`, so an
@@ -316,35 +319,55 @@ Two deliberate exceptions:
   rather than replacing it: deny is a safety mechanism, so one entry in the
   service unit must not silently un-deny every tool the owner switched off in
   the app. Everything the environment denies stays denied either way.
-- **Writes go to the data dir**, not the managed directory — except `MEMORY.md`,
-  which is written wherever the agent already keeps it. An existing
-  `<dataDir>/MEMORY.md` is copied into the managed directory once, at startup,
-  so the owner can read and prune it in the app.
 
-The runtime also writes `local-config.json` into the managed directory when one
-exists: what this agent's OWN persona files say, and a single boolean for
-whether it has a readable search key. It is written at startup and rewritten
-whenever the search-key answer changes, so a key file dropped in (or taken
-away) mid-run is reported without a restart. It is a report the daemon passes
-upward — nothing in the runtime reads it back, and it holds no key value.
+Runtime-owned writes go to the data directory, not the managed directory.
+Legacy `MEMORY.md` is handled only by the quarantine behavior described above.
 
-### A known limitation: the generated tool paragraph
+The runtime also writes mode-0600 `local-config.json` into the managed directory
+when one exists: what this agent's OWN persona files say, booleans for readable
+search/managed-LLM keys, and a bounded inventory of inert legacy-memory files.
+It is written at startup and rewritten whenever those answers or the inventory
+change. The daemon revalidates current regular-file bytes, removes local paths,
+and only then reports it upward. Nothing in the runtime reads the report back,
+and it holds no key value.
+
+### Per-turn channel authorization
+
+Installation configuration is only a ceiling. On every inbound message the
+bridge supplies an immutable, server-derived authorization claim containing
+the sender audience, membership state, and channel tool grants. The runtime
+intersects that claim with installed skills, configuration requirements, and
+the local allow/deny gate before showing tools to the model, then repeats the
+same channel-grant check immediately before execution. Missing or malformed
+claims, inactive/unknown membership, and absent grants all fail closed.
+
+This staged release issues no channel grants yet, so no generic tool is offered
+even when it is installed and enabled. Read grants can enable only the curated
+read-only tools; `http_request` is additionally limited to GET at execution.
+Side-effect grant fields are reserved in the protocol, but side-effect calls
+remain denied until exact-operation confirmation, expiry, and idempotency are
+implemented end to end.
+
+### The generated tool paragraph is an installation summary
 
 The `AGENTS.md` the app delivers ends in a generated paragraph naming the tools
-this agent has. The backend derives that list from the saved configuration plus
-the search-key boolean above; it does not see the running process. Three things
-can therefore make it diverge from what the runtime actually offers:
+configured for the installation, and explicitly tells the model that the
+per-turn offered list is authoritative. The backend derives the installation
+list from saved configuration plus the search-key boolean above; it does not
+see the running process or a turn's channel grants. These things can therefore
+make the installation summary differ from what the runtime offers:
 
 - a `SECURECOMS_TOOL_ALLOW` or `SECURECOMS_TOOL_DENY` set in the service unit,
   which the backend cannot see;
 - a customer skill folder whose `requires:` is narrower than the shipped one, so
   the runtime withholds a tool the backend counted;
-- a custom skill the backend knows nothing about, so it is offered but unnamed.
+- a custom skill the backend knows nothing about, so it can be eligible but
+  unnamed;
+- the current channel has no matching server-issued read grant.
 
-In any of those cases the paragraph is advisory rather than exact. The gate is
-still authoritative — a tool named in the paragraph but denied by policy is
-still refused at call time — so the risk is a wrong claim in conversation, not
-a wrong permission.
+The paragraph is therefore an advisory configuration summary, not an authority
+claim. Channel authorization and the local gate are both enforced at call
+time, so a configured but ungranted or denied tool is still refused.
 
 ## Provenance
 

package/dist/bin.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname4, join as join9 } from "node:path";
+import { dirname as dirname4, join as join8 } from "node:path";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, existsSync as existsSync7, mkdirSync as mkdirSync3, realpathSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync6, mkdirSync, realpathSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir4, userInfo } from "node:os";
 
 // src/config.ts
@@ -57,8 +57,7 @@ var DEFAULT_TOOL_ALLOW = [
   "fetch_url",
   "http_request",
   "sql_query",
-  "current_time",
-  "remember"
+  "current_time"
 ];
 function loadConfig(argv, env) {
   const identityId = parseIdentity(argv, env);
@@ -440,10 +439,16 @@ var LLMDispatcher = class {
   endpoint;
   model;
   apiKey;
+  chatPath;
+  chatAuth;
+  authHeaderName;
   constructor(endpoint, model, opts = {}) {
     this.endpoint = normalizeEndpoint(endpoint);
     this.model = model;
     this.apiKey = opts.apiKey;
+    this.chatPath = opts.chatPath ?? "/v1/chat/completions";
+    this.chatAuth = opts.chatAuth ?? "bearer";
+    this.authHeaderName = opts.authHeaderName ?? "x-api-key";
   }
   async complete(messages, tools) {
     const body = {
@@ -454,10 +459,12 @@ var LLMDispatcher = class {
     if (tools && tools.length > 0) {
       body.tools = tools;
     }
-    const url = `${this.endpoint}/v1/chat/completions`;
+    const url = `${this.endpoint}${this.chatPath}`;
     const headers = { "Content-Type": "application/json" };
-    if (this.apiKey) {
+    if (this.apiKey && this.chatAuth === "bearer") {
       headers.Authorization = `Bearer ${this.apiKey}`;
+    } else if (this.apiKey && this.chatAuth === "x-api-key") {
+      headers[this.authHeaderName] = this.apiKey;
     }
     const resp = await fetch(url, {
       method: "POST",
@@ -465,8 +472,8 @@ var LLMDispatcher = class {
       body: JSON.stringify(body)
     });
     if (!resp.ok) {
-      const text = await resp.text();
-      throw new Error(`LLM request failed (${resp.status}): ${text}`);
+      await resp.body?.cancel();
+      throw new Error(`LLM request failed (${resp.status})`);
     }
     const data = await resp.json();
     const choice = data.choices?.[0];
@@ -486,10 +493,13 @@ import { join as join2 } from "node:path";
 
 // src/llm-providers.json
 var llm_providers_default = {
-  openrouter: { chat_base: "https://openrouter.ai/api/v1", models_url: "https://openrouter.ai/api/v1/models", models_id_path: "data[].id", validate_url: "https://openrouter.ai/api/v1/key", needs_key: true },
-  anthropic: { chat_base: "https://openrouter.ai/api/v1", models_url: "https://openrouter.ai/api/v1/models", models_id_path: "data[].id", validate_url: "https://openrouter.ai/api/v1/key", needs_key: true },
-  openai: { chat_base: "https://api.openai.com/v1", models_url: "https://api.openai.com/v1/models", models_id_path: "data[].id", validate_url: "https://api.openai.com/v1/models", needs_key: true },
-  local: { chat_base: "http://127.0.0.1:11434", models_url: "http://127.0.0.1:11434/api/tags", models_id_path: "models[].name", validate_url: null, needs_key: false }
+  openrouter: { chat_base: "https://openrouter.ai/api/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://openrouter.ai/api/v1/models", models_id_path: "data[].id", validate_url: "https://openrouter.ai/api/v1/key", probe_auth: "bearer", extra_headers: null, catalog_prefix: "self", needs_key: true },
+  openai: { chat_base: "https://api.openai.com/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://api.openai.com/v1/models", models_id_path: "data[].id", validate_url: "https://api.openai.com/v1/models", probe_auth: "bearer", extra_headers: null, catalog_prefix: "openai/", needs_key: true },
+  anthropic: { chat_base: "https://api.anthropic.com/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://api.anthropic.com/v1/models", models_id_path: "data[].id", validate_url: "https://api.anthropic.com/v1/models", probe_auth: "x-api-key", extra_headers: { "anthropic-version": "2023-06-01" }, catalog_prefix: "anthropic/", needs_key: true },
+  gemini: { chat_base: "https://generativelanguage.googleapis.com/v1beta/openai", chat_path: "/chat/completions", chat_auth: "bearer", models_url: "https://generativelanguage.googleapis.com/v1beta/openai/models", models_id_path: "data[].id", validate_url: "https://generativelanguage.googleapis.com/v1beta/openai/models", probe_auth: "bearer", extra_headers: null, catalog_prefix: "google/", needs_key: true },
+  meta: { chat_base: "https://api.meta.ai/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://api.meta.ai/v1/models", models_id_path: "data[].id", validate_url: "https://api.meta.ai/v1/models", probe_auth: "bearer", extra_headers: null, catalog_prefix: null, needs_key: true },
+  xai: { chat_base: "https://api.x.ai/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://api.x.ai/v1/models", models_id_path: "data[].id", validate_url: "https://api.x.ai/v1/models", probe_auth: "bearer", extra_headers: null, catalog_prefix: "x-ai/", needs_key: true },
+  local: { chat_base: "http://127.0.0.1:11434", chat_path: "/v1/chat/completions", chat_auth: "none", models_url: "http://127.0.0.1:11434/api/tags", models_id_path: "models[].name", validate_url: null, probe_auth: "none", extra_headers: null, catalog_prefix: null, needs_key: false }
 };
 
 // src/llm-key.ts
@@ -513,7 +523,12 @@ function resolveLlmApiKey(cfg, readFile) {
 
 // src/llm-source.ts
 var PROVIDER_TABLE = Object.freeze(Object.fromEntries(
-  Object.entries(llm_providers_default).map(([p, e]) => [p, Object.freeze({ endpoint: e.chat_base, needsKey: e.needs_key })])
+  Object.entries(llm_providers_default).map(([p, e]) => [p, Object.freeze({
+    endpoint: e.chat_base,
+    needsKey: e.needs_key,
+    chatPath: e.chat_path,
+    chatAuth: e.chat_auth
+  })])
 ));
 var LlmSourceUnavailableError = class extends Error {
 };
@@ -523,6 +538,9 @@ function providerOrigin(provider) {
   const u = new URL(entry.endpoint);
   return `${u.protocol}//${u.host}`.toLowerCase();
 }
+function providerSlug(provider) {
+  return providerOrigin(provider).replace("://", "_").replace(/:/g, "-");
+}
 var explicitEndpointSet = (env) => Boolean(env.SECURECOMS_LLM_ENDPOINT || env.SECURECOMS_LLM_API_KEY_FILE || env.SECURECOMS_LLM_API_KEY);
 function isExplicitSource(cfg, env) {
   return explicitEndpointSet(env) || Boolean(cfg.llmApiKeyFile) || Boolean(cfg.llmApiKey);
@@ -539,7 +557,9 @@ function resolveLlmSource(cfg, explicit, deps) {
       model: cfg.llmModel,
       apiKey: resolveLlmApiKey(cfg, deps.readFile),
       provider: "env",
-      origin: "env"
+      origin: "env",
+      chatPath: "/v1/chat/completions",
+      chatAuth: "bearer"
     };
   }
   const managedDir = join2(deps.home, ".securecoms", "runtime-config", cfg.identityId);
@@ -567,6 +587,11 @@ function resolveLlmSource(cfg, explicit, deps) {
     if (typeof provider !== "string" || typeof model !== "string") {
       throw new LlmSourceUnavailableError(`${sourcePath} is missing "provider" or "model"`);
     }
+    if (!Object.hasOwn(llm_providers_default, provider)) {
+      throw new LlmSourceUnavailableError(
+        `unknown LLM provider ${JSON.stringify(provider)} in ${sourcePath}`
+      );
+    }
     const entry = PROVIDER_TABLE[provider];
     if (!entry) {
       throw new LlmSourceUnavailableError(
@@ -575,53 +600,63 @@ function resolveLlmSource(cfg, explicit, deps) {
     }
     let apiKey;
     if (entry.needsKey) {
-      const keyPath = join2(managedDir, "llm.key");
-      const hostPath = join2(managedDir, "llm.key.host");
-      if (!deps.exists(keyPath)) {
+      const expectedOrigin = providerOrigin(provider);
+      const slug = providerSlug(provider);
+      const keyPath = join2(managedDir, `llm.key.${slug}`);
+      const hostPath = join2(managedDir, `llm.key.${slug}.host`);
+      const legacyKey = join2(managedDir, "llm.key");
+      const legacyHost = join2(managedDir, "llm.key.host");
+      const useLegacy = !deps.exists(keyPath) && deps.exists(legacyKey) && deps.exists(legacyHost);
+      const boundKey = useLegacy ? legacyKey : keyPath;
+      const boundHost = useLegacy ? legacyHost : hostPath;
+      if (!deps.exists(boundKey)) {
         throw new LlmSourceUnavailableError(
           `${keyPath} does not exist \u2014 no key has been written for this managed source, refusing to read it`
         );
       }
       let mode;
       try {
-        ({ mode } = deps.statFile(keyPath));
+        ({ mode } = deps.statFile(boundKey));
       } catch (e) {
         throw new LlmSourceUnavailableError(
-          `cannot stat ${keyPath}: ${e instanceof Error ? e.message : String(e)}`
+          `cannot stat ${boundKey}: ${e instanceof Error ? e.message : String(e)}`
         );
       }
       if ((mode & 63) !== 0) {
         throw new LlmSourceUnavailableError(
-          `${keyPath} is readable by other users on this machine \u2014 tighten its permissions to owner-only`
+          `${boundKey} is readable by other users on this machine \u2014 tighten its permissions to owner-only`
         );
       }
-      const expectedOrigin = providerOrigin(provider);
-      if (!deps.exists(hostPath)) {
+      if (!deps.exists(boundHost)) {
         throw new LlmSourceUnavailableError(
-          `${keyPath} has no ${hostPath} sidecar recording which origin it belongs to \u2014 refusing to send it to ${expectedOrigin}`
+          `${boundKey} has no ${boundHost} sidecar recording which origin it belongs to \u2014 refusing to send it to ${expectedOrigin}`
         );
       }
-      const actualOrigin = deps.readFile(hostPath).trim();
+      const actualOrigin = deps.readFile(boundHost).trim();
       if (actualOrigin !== expectedOrigin) {
         throw new LlmSourceUnavailableError(
-          `${hostPath} is bound to ${actualOrigin}, but provider ${JSON.stringify(provider)} requires ${expectedOrigin} \u2014 refusing to send the key across origins`
+          `${boundHost} is bound to ${actualOrigin}, but provider ${JSON.stringify(provider)} requires ${expectedOrigin} \u2014 refusing to send the key across origins`
         );
       }
-      apiKey = resolveLlmApiKey({ llmApiKeyFile: keyPath }, deps.readFile);
+      apiKey = resolveLlmApiKey({ llmApiKeyFile: boundKey }, deps.readFile);
     }
     return {
       endpoint: entry.endpoint,
       model,
       ...apiKey !== void 0 ? { apiKey } : {},
       provider,
-      origin: "managed"
+      origin: "managed",
+      chatPath: entry.chatPath,
+      chatAuth: entry.chatAuth
     };
   }
   return {
     endpoint: cfg.llmEndpoint,
     model: cfg.llmModel,
     provider: "default",
-    origin: "default"
+    origin: "default",
+    chatPath: "/v1/chat/completions",
+    chatAuth: "bearer"
   };
 }
 
@@ -637,7 +672,11 @@ function buildLlmShim(cfg, explicit, deps) {
   return {
     async complete(messages, tools) {
       const src = resolveLlmSource(cfg, explicit, deps);
-      const dispatcher = new LLMDispatcher(src.endpoint, src.model, { apiKey: src.apiKey });
+      const dispatcher = new LLMDispatcher(src.endpoint, src.model, {
+        apiKey: src.apiKey,
+        chatPath: src.chatPath,
+        chatAuth: src.chatAuth
+      });
       return dispatcher.complete(messages, tools);
     }
   };
@@ -652,116 +691,59 @@ function bootLine(cfg, explicit, deps) {
 }
 
 // src/memory.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
-import { join as join3 } from "node:path";
 var MAX_HISTORY = 50;
+var MAX_FACTS = 200;
 var AgentMemory = class {
   history = [];
-  memories = [];
-  dataDir;
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-    this.loadHistory();
-    this.loadMemories();
-  }
-  /** Add a message to conversation history. */
+  facts = [];
+  constructor(snapshot) {
+    if (snapshot) this.replace(snapshot);
+  }
+  /** Replace the working view at the start of every authenticated turn. */
+  replace(snapshot) {
+    this.history = snapshot.recent.slice(-MAX_HISTORY).map((turn) => ({
+      role: turn.role === "peer" ? "user" : "assistant",
+      content: turn.text
+    }));
+    this.facts = snapshot.facts.slice(-MAX_FACTS);
+  }
+  /** Add a message to this turn's in-process history only. */
   addMessage(msg) {
     this.history.push(msg);
     if (this.history.length > MAX_HISTORY * 2) {
       this.history = this.history.slice(-MAX_HISTORY);
     }
-    this.saveHistory();
   }
   /** Get recent conversation history for LLM context. */
   getHistory() {
     return this.history.slice(-MAX_HISTORY);
   }
-  /** Clear conversation history. */
+  /** Clear this process-local view; durable deletion belongs to the bridge. */
   clear() {
     this.history = [];
-    this.saveHistory();
+    this.facts = [];
   }
-  /**
-   * Recall relevant memories to prepend to the LLM context.
-   * Case-insensitive keyword-overlap match over captured entries: query is
-   * split into words of length >= 3, entries are scored by number of
-   * matching words, and the top 5 with score > 0 are returned.
-   */
+  /** Case-insensitive keyword-overlap recall over protected channel facts. */
   async recall(query) {
-    const queryWords = query.toLowerCase().split(/\W+/).filter((w) => w.length >= 3);
+    const queryWords = query.toLowerCase().split(/\W+/).filter((word) => word.length >= 3);
     if (queryWords.length === 0) return null;
-    const scored = this.memories.map((m) => {
-      const contentLower = m.content.toLowerCase();
+    const scored = this.facts.map((content) => {
+      const contentLower = content.toLowerCase();
       const score = queryWords.reduce(
-        (acc, w) => contentLower.includes(w) ? acc + 1 : acc,
+        (acc, word) => contentLower.includes(word) ? acc + 1 : acc,
         0
       );
-      return { memory: m, score };
-    }).filter((s) => s.score > 0).sort((a, b) => b.score - a.score).slice(0, 5);
+      return { content, score };
+    }).filter((entry) => entry.score > 0).sort((a, b) => b.score - a.score).slice(0, 5);
     if (scored.length === 0) return null;
-    const memories = scored.map((s) => `- ${s.memory.content}`).join("\n");
     return `Relevant context from memory:
-${memories}`;
-  }
-  /**
-   * Capture a notable fact to local memory (best-effort).
-   */
-  async capture(content, kind) {
-    try {
-      this.memories.push({
-        content,
-        category: kind,
-        capturedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      this.saveMemories();
-    } catch {
-    }
-  }
-  get historyPath() {
-    return join3(this.dataDir, "conversation-history.json");
-  }
-  get memoriesPath() {
-    return join3(this.dataDir, "memories.json");
-  }
-  loadHistory() {
-    try {
-      if (existsSync(this.historyPath)) {
-        const raw = readFileSync(this.historyPath, "utf-8");
-        this.history = JSON.parse(raw);
-      }
-    } catch {
-      this.history = [];
-    }
-  }
-  saveHistory() {
-    try {
-      mkdirSync(this.dataDir, { recursive: true });
-      writeFileSync(this.historyPath, JSON.stringify(this.history));
-    } catch {
-    }
-  }
-  loadMemories() {
-    try {
-      if (existsSync(this.memoriesPath)) {
-        const raw = readFileSync(this.memoriesPath, "utf-8");
-        this.memories = JSON.parse(raw);
-      }
-    } catch {
-      this.memories = [];
-    }
-  }
-  saveMemories() {
-    try {
-      mkdirSync(this.dataDir, { recursive: true });
-      writeFileSync(this.memoriesPath, JSON.stringify(this.memories));
-    } catch {
-    }
+${scored.map((entry) => `- ${entry.content}`).join("\n")}`;
   }
 };
 
 // src/skill-invoker.ts
-import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5, statSync } from "node:fs";
-import { join as join6 } from "node:path";
+import { readFileSync as readFileSync4, readdirSync, existsSync as existsSync3, statSync } from "node:fs";
+import { join as join4 } from "node:path";
 
 // src/skill-md.ts
 var SkillMdError = class extends Error {
@@ -916,23 +898,23 @@ function resolveRequires(req, env) {
 }
 
 // src/skills-config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync2, readFileSync } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 
 // src/config-dirs.ts
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join3 } from "node:path";
 function managedConfigDir(identityId, home = homedir2()) {
-  return join4(home, ".securecoms", "runtime-config", identityId);
+  return join3(home, ".securecoms", "runtime-config", identityId);
 }
 function configSearchPath(identityId, dataDir, home = homedir2()) {
   return [managedConfigDir(identityId, home), dataDir];
 }
 function findConfigFile(name, dirs) {
   for (const dir of dirs) {
-    const path = join4(dir, name);
-    if (existsSync2(path)) return path;
+    const path = join3(dir, name);
+    if (existsSync(path)) return path;
   }
   return null;
 }
@@ -942,10 +924,10 @@ var EMPTY_SKILLS_CONFIG = { endpoints: {}, databases: {}, flags: [] };
 var empty = () => ({ endpoints: {}, databases: {}, flags: [] });
 var abs2 = (p, dataDir) => isAbsolute2(p) ? p : resolve2(dataDir, p);
 function loadSkillsConfigFile(path, dataDir) {
-  if (!existsSync3(path)) return empty();
+  if (!existsSync2(path)) return empty();
   let raw;
   try {
-    raw = JSON.parse(readFileSync2(path, "utf8"));
+    raw = JSON.parse(readFileSync(path, "utf8"));
   } catch (e) {
     console.warn(`[skills-config] ignoring ${path}: ${e instanceof Error ? e.message : String(e)}`);
     return empty();
@@ -1200,7 +1182,7 @@ var fetchUrl = async (args, ctx) => {
 };
 
 // src/builtins/http-request.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 var METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE"]);
 var httpRequest = async (args, ctx) => {
   const name = typeof args.name === "string" ? args.name : "";
@@ -1243,7 +1225,7 @@ var httpRequest = async (args, ctx) => {
   const headers = { accept: "application/json" };
   if (endpoint.headersFile) {
     try {
-      for (const [k, v] of Object.entries(JSON.parse(readFileSync3(endpoint.headersFile, "utf8")))) {
+      for (const [k, v] of Object.entries(JSON.parse(readFileSync2(endpoint.headersFile, "utf8")))) {
         if (typeof v === "string") headers[k] = v;
       }
     } catch {
@@ -1268,59 +1250,8 @@ var httpRequest = async (args, ctx) => {
   }
 };
 
-// src/long-term-memory.ts
-import { copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join5 } from "node:path";
-var MEMORY_FILE = "MEMORY.md";
-var MEMORY_MAX_BYTES = 8192;
-var FACT_MAX_CHARS = 300;
-function readLongTermMemory(dirs) {
-  const p = findConfigFile(MEMORY_FILE, dirs);
-  if (!p) return null;
-  const body = readFileSync4(p, "utf8").trim();
-  return body || null;
-}
-function memoryTarget(dirs) {
-  for (const d of dirs) if (existsSync4(join5(d, MEMORY_FILE))) return d;
-  for (const d of dirs) if (existsSync4(d)) return d;
-  return dirs[dirs.length - 1];
-}
-function migrateMemoryIntoManaged(managedDir, dataDir) {
-  const managed = join5(managedDir, MEMORY_FILE);
-  const local = join5(dataDir, MEMORY_FILE);
-  if (!existsSync4(managedDir) || existsSync4(managed) || !existsSync4(local)) return false;
-  copyFileSync(local, managed);
-  return true;
-}
-function rememberFact(dirs, fact, now) {
-  const clean = fact.replace(/\s+/g, " ").trim().slice(0, FACT_MAX_CHARS);
-  if (!clean) throw new Error("remember needs a non-empty fact");
-  const line = `- ${now.toISOString().slice(0, 10)} ${clean}`;
-  const dir = memoryTarget(dirs);
-  mkdirSync2(dir, { recursive: true });
-  const existing = readLongTermMemory(dirs);
-  let lines = existing ? existing.split("\n") : [];
-  lines.push(line);
-  while (Buffer.byteLength(`${lines.join("\n")}
-`, "utf8") > MEMORY_MAX_BYTES && lines.length > 1) {
-    lines = lines.slice(1);
-  }
-  writeFileSync2(join5(dir, MEMORY_FILE), `${lines.join("\n")}
-`, { mode: 384 });
-  return line;
-}
-
-// src/builtins/remember.ts
-var remember = async (args, ctx) => {
-  try {
-    return JSON.stringify({ remembered: rememberFact(ctx.configDirs, String(args.fact ?? ""), ctx.now()) });
-  } catch (e) {
-    return toolError(e instanceof Error ? e.message : String(e));
-  }
-};
-
 // src/builtins/sql-query.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 
 // src/sql-guard.ts
 var SqlNotReadOnlyError = class extends Error {
@@ -1421,7 +1352,7 @@ var sqlQuery = async (args, ctx) => {
     const Client = pg.Client ?? pg.default?.Client;
     if (!Client) return toolError(`the installed "pg" module does not export a Client`);
     const client = new Client({
-      connectionString: readFileSync5(db.postgresUrlFile, "utf8").trim(),
+      connectionString: readFileSync3(db.postgresUrlFile, "utf8").trim(),
       // never logged (D4)
       statement_timeout: SQL_TIMEOUT_MS
     });
@@ -1533,8 +1464,7 @@ var BUILTINS = {
   fetch_url: fetchUrl,
   web_search: webSearch,
   http_request: httpRequest,
-  sql_query: sqlQuery,
-  remember
+  sql_query: sqlQuery
 };
 
 // src/skill-invoker.ts
@@ -1560,19 +1490,19 @@ var SkillInvoker = class {
    * `<skillsDir>/<subdir>/manifest.json`.
    */
   loadSkills() {
-    if (!existsSync5(this.skillsDir)) {
+    if (!existsSync3(this.skillsDir)) {
       console.warn(`[SkillInvoker] Skills directory not found: ${this.skillsDir}`);
       return;
     }
     const flat = [], manifests = [], skillMds = [];
     for (const entry of readdirSync(this.skillsDir, { withFileTypes: true })) {
       if (entry.isFile() && entry.name.endsWith(".json")) {
-        flat.push(join6(this.skillsDir, entry.name));
+        flat.push(join4(this.skillsDir, entry.name));
       } else if (entry.isDirectory()) {
-        const m = join6(this.skillsDir, entry.name, "manifest.json");
-        if (existsSync5(m) && statSync(m).isFile()) manifests.push(m);
-        const s = join6(this.skillsDir, entry.name, "SKILL.md");
-        if (existsSync5(s) && statSync(s).isFile()) skillMds.push(s);
+        const m = join4(this.skillsDir, entry.name, "manifest.json");
+        if (existsSync3(m) && statSync(m).isFile()) manifests.push(m);
+        const s = join4(this.skillsDir, entry.name, "SKILL.md");
+        if (existsSync3(s) && statSync(s).isFile()) skillMds.push(s);
       }
     }
     for (const p of [...flat.sort(), ...manifests.sort()]) this.loadManifestFile(p);
@@ -1588,14 +1518,14 @@ var SkillInvoker = class {
   }
   loadSkillMdFile(path) {
     try {
-      this.register(parseSkillMd(readFileSync6(path, "utf-8"), path), path);
+      this.register(parseSkillMd(readFileSync4(path, "utf-8"), path), path);
     } catch (err) {
       console.warn(`[SkillInvoker] Skipping ${path}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   loadManifestFile(path) {
     try {
-      const raw = readFileSync6(path, "utf-8");
+      const raw = readFileSync4(path, "utf-8");
       const manifest = JSON.parse(raw);
       if (typeof manifest.handler !== "string" || !(manifest.handler.startsWith("builtin:") || manifest.handler.startsWith("script:"))) {
         console.warn(
@@ -1758,10 +1688,78 @@ function createDynamicToolGate(policyFor) {
 }
 
 // src/data-plane.ts
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { WebSocket } from "node:http";
 import { homedir as homedir3 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join5 } from "node:path";
+var NO_TURN_MEMORY = Object.freeze({
+  recent: Object.freeze([]),
+  facts: Object.freeze([])
+});
+function parseTurnMemory(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return NO_TURN_MEMORY;
+  const raw = value;
+  if (!Array.isArray(raw.recent) || !Array.isArray(raw.facts)) return NO_TURN_MEMORY;
+  const recent = [];
+  for (const value2 of raw.recent.slice(-50)) {
+    if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return NO_TURN_MEMORY;
+    const turn = value2;
+    if (turn.role !== "peer" && turn.role !== "agent" || typeof turn.text !== "string") {
+      return NO_TURN_MEMORY;
+    }
+    recent.push(Object.freeze({ role: turn.role, text: turn.text }));
+  }
+  const facts = [];
+  for (const fact of raw.facts.slice(-200)) {
+    if (typeof fact !== "string") return NO_TURN_MEMORY;
+    facts.push(fact);
+  }
+  return Object.freeze({ recent: Object.freeze(recent), facts: Object.freeze(facts) });
+}
+var AUDIENCES = /* @__PURE__ */ new Set([
+  "owner_dm",
+  "team_room",
+  "partner_room",
+  "other_human_dm",
+  "agent_to_agent",
+  "unknown"
+]);
+var NO_TURN_AUTHORIZATION = Object.freeze({
+  version: 1,
+  audience: "unknown",
+  sender_membership: "unknown",
+  tool_grants: Object.freeze([])
+});
+function parseTurnAuthorization(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return NO_TURN_AUTHORIZATION;
+  const raw = value;
+  if (raw.version !== 1 || typeof raw.audience !== "string" || !AUDIENCES.has(raw.audience) || raw.sender_membership !== "active" && raw.sender_membership !== "unknown" || !Array.isArray(raw.tool_grants)) return NO_TURN_AUTHORIZATION;
+  const grants = [];
+  for (const value2 of raw.tool_grants) {
+    if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return NO_TURN_AUTHORIZATION;
+    const grant = value2;
+    if (typeof grant.tool !== "string" || !grant.tool || grant.tool.length > 100) return NO_TURN_AUTHORIZATION;
+    if (grant.mode === "read") {
+      grants.push(Object.freeze({ tool: grant.tool, mode: "read" }));
+      continue;
+    }
+    if (grant.mode !== "side_effect" || typeof grant.operation_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(grant.operation_sha256) || typeof grant.confirmation_id !== "string" || !grant.confirmation_id || typeof grant.idempotency_key !== "string" || !grant.idempotency_key || typeof grant.expires_at !== "string" || !grant.expires_at) return NO_TURN_AUTHORIZATION;
+    grants.push(Object.freeze({
+      tool: grant.tool,
+      mode: "side_effect",
+      operation_sha256: grant.operation_sha256,
+      confirmation_id: grant.confirmation_id,
+      idempotency_key: grant.idempotency_key,
+      expires_at: grant.expires_at
+    }));
+  }
+  return Object.freeze({
+    version: 1,
+    audience: raw.audience,
+    sender_membership: raw.sender_membership,
+    tool_grants: Object.freeze(grants)
+  });
+}
 var SEEN_MAX = 5e3;
 function errText(e) {
   return e instanceof Error ? e.message : String(e);
@@ -1804,8 +1802,8 @@ var SecureComsDataPlane = class {
   generation = 0;
   constructor(cfg, onMessage) {
     this.identityId = cfg.identityId;
-    const dir = cfg.connectionsDir ?? join7(homedir3(), ".securecoms", "connections");
-    this.connectionPath = join7(dir, `${cfg.identityId}.json`);
+    const dir = cfg.connectionsDir ?? join5(homedir3(), ".securecoms", "connections");
+    this.connectionPath = join5(dir, `${cfg.identityId}.json`);
     this.establishedMs = cfg.establishedMs ?? 5e3;
     this.initialDelayMs = cfg.initialDelayMs ?? 250;
     this.maxDelayMs = cfg.maxDelayMs ?? 3e4;
@@ -1908,9 +1906,9 @@ var SecureComsDataPlane = class {
     if (this.generation === generation) this.running = false;
   }
   async attemptOnce() {
-    const conn = JSON.parse(readFileSync7(this.connectionPath, "utf8"));
+    const conn = JSON.parse(readFileSync5(this.connectionPath, "utf8"));
     const httpBase = conn.bridge_url.replace(/^ws/, "http").replace(/\/v1\/ws$/, "");
-    const token = readFileSync7(conn.token_file, "utf8").trim();
+    const token = readFileSync5(conn.token_file, "utf8").trim();
     const health = await (await fetch(`${httpBase}/healthz`)).json();
     if (conn.identity_id !== health.identity_id || this.identityId !== health.identity_id) {
       throw new Error(
@@ -1986,10 +1984,17 @@ var SecureComsDataPlane = class {
           text: String(frame.text ?? ""),
           senderId: String(frame.sender_id ?? ""),
           channelId,
-          messageId
+          messageId,
+          authorization: parseTurnAuthorization(frame.authorization),
+          memory: parseTurnMemory(frame.memory)
         });
         if (reply != null) {
-          ws.send(JSON.stringify({ type: "send", channel_id: channelId, text: String(reply) }));
+          ws.send(JSON.stringify({
+            type: "send",
+            channel_id: channelId,
+            text: String(reply),
+            in_reply_to: messageId
+          }));
         }
       }
     } catch (e) {
@@ -2034,6 +2039,33 @@ async function runToolCalls(toolCalls, skills, context) {
 // src/turn-loop.ts
 var DEFAULT_SYSTEM_PROMPT = "You are a SecureComs agent. Respond helpfully and concisely.";
 var DEFAULT_MAX_ITERATIONS = 5;
+var READ_ONLY_TOOLS = /* @__PURE__ */ new Set(["echo", "web_search", "fetch_url", "sql_query", "current_time"]);
+function hasReadGrant(auth, toolName) {
+  return auth.sender_membership === "active" && auth.tool_grants.some((grant) => grant.tool === toolName && grant.mode === "read");
+}
+function toolIsOffered(auth, toolName) {
+  return hasReadGrant(auth, toolName) && (READ_ONLY_TOOLS.has(toolName) || toolName === "http_request");
+}
+function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames) {
+  if (auth.sender_membership !== "active") {
+    return { allowed: false, reason: "Sender membership is not active" };
+  }
+  if (!offeredNames.has(toolName) || !toolIsOffered(auth, toolName)) {
+    return { allowed: false, reason: `Tool "${toolName}" has no active channel read grant` };
+  }
+  if (toolName === "http_request") {
+    try {
+      const args = JSON.parse(argumentsJson);
+      const method = typeof args.method === "string" ? args.method.toUpperCase() : "GET";
+      if (method !== "GET") {
+        return { allowed: false, reason: "State-changing HTTP calls require an exact confirmed operation grant" };
+      }
+    } catch {
+      return { allowed: false, reason: "Tool arguments are not valid JSON" };
+    }
+  }
+  return { allowed: true, reason: `Tool "${toolName}" has an active channel read grant` };
+}
 function buildHandler(deps) {
   const maxIterations = deps.maxIterations ?? DEFAULT_MAX_ITERATIONS;
   const log = deps.log ?? (() => {
@@ -2042,18 +2074,20 @@ function buildHandler(deps) {
   return async (m) => {
     const text = m.text?.trim() ? m.text : "";
     if (!text) return null;
-    log("info", `message from ${m.senderId.slice(0, 8)}: ${text.slice(0, 80)}`);
+    log(
+      "info",
+      `message received (sender=${m.senderId.slice(0, 8)}, channel=${m.channelId.slice(0, 8)}, chars=${text.length})`
+    );
     const memory = memoryFor(m.channelId);
+    memory.replace(m.memory);
     const messages = [{ role: "system", content: deps.systemPromptFor() }];
     const recalled = await memory.recall(text);
     if (recalled) messages.push({ role: "system", content: recalled });
-    const longTerm = deps.longTermMemory?.() ?? null;
-    if (longTerm) messages.push({ role: "system", content: `Things you have remembered:
-${longTerm}` });
     messages.push(...memory.getHistory());
     messages.push({ role: "user", content: text });
     memory.addMessage({ role: "user", content: text });
-    const tools = deps.tools();
+    const tools = deps.tools().filter((tool) => toolIsOffered(m.authorization, tool.function.name));
+    const offeredNames = new Set(tools.map((tool) => tool.function.name));
     let response = null;
     for (let iteration = 0; iteration < maxIterations; iteration++) {
       const result = await llm.complete(messages, tools.length > 0 ? tools : void 0);
@@ -2066,10 +2100,18 @@ ${longTerm}` });
         content: result.content ?? "",
         tool_calls: result.toolCalls
       });
-      const verdicts = result.toolCalls.map((call) => ({
-        call,
-        verdict: gate.gate(call.function.name)
-      }));
+      const verdicts = result.toolCalls.map((call) => {
+        const channelVerdict = authorizeToolExecution(
+          m.authorization,
+          call.function.name,
+          call.function.arguments,
+          offeredNames
+        );
+        return {
+          call,
+          verdict: channelVerdict.allowed ? gate.gate(call.function.name) : channelVerdict
+        };
+      });
       const allowed = verdicts.filter((v) => v.verdict.allowed).map((v) => v.call);
       for (const v of verdicts) {
         if (!v.verdict.allowed) {
@@ -2104,25 +2146,168 @@ ${longTerm}` });
       return null;
     }
     memory.addMessage({ role: "assistant", content: response });
-    if (response.length > 50) {
-      try {
-        await memory.capture(
-          `User asked: "${text.slice(0, 100)}". Agent responded: "${response.slice(0, 200)}"`,
-          "conversation"
-        );
-      } catch (e) {
-        log("warn", `memory capture failed: ${e instanceof Error ? e.message : String(e)}`);
-      }
-    }
-    log("info", `response: ${response.slice(0, 80)}`);
+    log("info", `response ready (chars=${response.length})`);
     return response;
   };
 }
 
 // src/persona.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join8 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync7, renameSync as renameSync2, unlinkSync, writeFileSync } from "node:fs";
+import { dirname as dirname3, join as join7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/long-term-memory.ts
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync as existsSync4, lstatSync, readFileSync as readFileSync6, readdirSync as readdirSync2, renameSync } from "node:fs";
+import { join as join6 } from "node:path";
+var MEMORY_FILE = "MEMORY.md";
+var QUARANTINE_MEMORY_FILE = "MEMORY.quarantined.md";
+var LEGACY_MEMORY_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
+var LEGACY_MEMORY_REPORT_MAX_BYTES = 4 * 1024 * 1024;
+var LEGACY_MEMORY_REPORT_MAX_SOURCES = 100;
+function quarantineOrder(a, b) {
+  const index = (name) => {
+    const match = /^MEMORY\.quarantined(?:\.(\d+))?\.md$/.exec(name);
+    return match?.[1] ? Number(match[1]) + 1 : 0;
+  };
+  return index(a) - index(b) || a.localeCompare(b);
+}
+function sourceId(kind, channelId, path, bytes) {
+  return createHash("sha256").update(kind).update("\0").update(channelId ?? "").update("\0").update(path).update("\0").update(bytes).digest("hex");
+}
+function readLegacySource(path, kind, contentBudget, channelId) {
+  try {
+    let st = lstatSync(path);
+    if (st.isSymbolicLink() || !st.isFile()) return null;
+    if ((st.mode & 511) !== 384) {
+      chmodSync(path, 384);
+      st = lstatSync(path);
+    }
+    if (st.size > LEGACY_MEMORY_SOURCE_MAX_BYTES) {
+      const marker = Buffer.from(`oversize:${st.size}:${st.mtimeMs}:${st.ctimeMs}`, "utf8");
+      return {
+        id: sourceId(kind, channelId, path, marker),
+        kind,
+        ...channelId ? { channelId } : {},
+        path,
+        content: null,
+        bytes: st.size,
+        exportable: false
+      };
+    }
+    if (st.size > contentBudget) return null;
+    const bytes = readFileSync6(path);
+    if (bytes.byteLength > LEGACY_MEMORY_SOURCE_MAX_BYTES || bytes.byteLength > contentBudget) return null;
+    return {
+      id: sourceId(kind, channelId, path, bytes),
+      kind,
+      ...channelId ? { channelId } : {},
+      path,
+      content: bytes.toString("utf8"),
+      bytes: bytes.byteLength,
+      exportable: true
+    };
+  } catch {
+    return null;
+  }
+}
+function collectLegacyMemorySources(managedDir, dataDir) {
+  const sources = [];
+  const seen = /* @__PURE__ */ new Set();
+  let contentBudget = LEGACY_MEMORY_REPORT_MAX_BYTES;
+  const add = (path, kind, channelId) => {
+    if (sources.length >= LEGACY_MEMORY_REPORT_MAX_SOURCES) return;
+    const source = readLegacySource(path, kind, contentBudget, channelId);
+    if (!source) return;
+    sources.push(source);
+    if (source.exportable) contentBudget -= source.bytes;
+  };
+  for (const dir of /* @__PURE__ */ new Set([managedDir, dataDir])) {
+    let names;
+    try {
+      names = readdirSync2(dir);
+    } catch {
+      continue;
+    }
+    for (const name of names.sort(quarantineOrder)) {
+      if (!/^MEMORY\.quarantined(?:\.\d+)?\.md$/.test(name)) continue;
+      const path = join6(dir, name);
+      if (seen.has(path)) continue;
+      seen.add(path);
+      add(path, "global-memory");
+    }
+  }
+  const channelsDir = join6(dataDir, "channels");
+  let channelNames;
+  try {
+    channelNames = readdirSync2(channelsDir);
+  } catch {
+    channelNames = [];
+  }
+  for (const channelId of channelNames.sort()) {
+    const channelDir = join6(channelsDir, channelId);
+    for (const [name, kind] of [
+      ["conversation-history.json", "conversation-history"],
+      ["memories.json", "captured-memory"]
+    ]) {
+      add(join6(channelDir, name), kind, channelId);
+    }
+  }
+  return sources;
+}
+function legacyMemoryFingerprint(managedDir, dataDir) {
+  const metadata = [];
+  const add = (path) => {
+    try {
+      const st = lstatSync(path);
+      if (!st.isFile() || st.isSymbolicLink()) return;
+      metadata.push(`${path}\0${st.size}\0${st.mtimeMs}\0${st.ctimeMs}`);
+    } catch {
+    }
+  };
+  for (const dir of /* @__PURE__ */ new Set([managedDir, dataDir])) {
+    try {
+      for (const name of readdirSync2(dir).sort(quarantineOrder)) {
+        if (/^MEMORY\.quarantined(?:\.\d+)?\.md$/.test(name)) add(join6(dir, name));
+      }
+    } catch {
+    }
+  }
+  try {
+    const channelsDir = join6(dataDir, "channels");
+    for (const channelId of readdirSync2(channelsDir).sort()) {
+      add(join6(channelsDir, channelId, "conversation-history.json"));
+      add(join6(channelsDir, channelId, "memories.json"));
+    }
+  } catch {
+  }
+  return createHash("sha256").update(metadata.join("\n")).digest("hex");
+}
+function nextQuarantinePath(dir) {
+  const first = join6(dir, QUARANTINE_MEMORY_FILE);
+  if (!existsSync4(first)) return first;
+  for (let n = 1; ; n++) {
+    const candidate = join6(dir, `MEMORY.quarantined.${n}.md`);
+    if (!existsSync4(candidate)) return candidate;
+  }
+}
+function quarantineLegacyMemory(managedDir, dataDir) {
+  const moved = [];
+  for (const dir of /* @__PURE__ */ new Set([managedDir, dataDir])) {
+    const source = join6(dir, MEMORY_FILE);
+    if (!existsSync4(source)) continue;
+    if (lstatSync(source).isSymbolicLink()) {
+      throw new Error(`refusing to quarantine symlinked legacy memory: ${source}`);
+    }
+    const target = nextQuarantinePath(dir);
+    renameSync(source, target);
+    chmodSync(target, 384);
+    moved.push(target);
+  }
+  return moved;
+}
+
+// src/persona.ts
 var PERSONA_MAX_BYTES = 8192;
 var PERSONA_SOURCES = [
   { file: "IDENTITY.md", heading: "## Identity" },
@@ -2137,7 +2322,7 @@ var SAFETY_PREAMBLE = [
   "- Only use the tools you were given; do not invent capabilities."
 ].join("\n");
 function defaultPersonaDir() {
-  return join8(dirname3(fileURLToPath2(import.meta.url)), "..", "persona");
+  return join7(dirname3(fileURLToPath2(import.meta.url)), "..", "persona");
 }
 function assemblePrompt(parts) {
   return parts.map((p) => `${p.heading}
@@ -2150,7 +2335,7 @@ function loadPersona(dirs) {
     if (!path) continue;
     let body;
     try {
-      body = readFileSync8(path, "utf8");
+      body = readFileSync7(path, "utf8");
     } catch {
       console.warn(`[persona] cannot read ${path}; ignoring it`);
       continue;
@@ -2170,29 +2355,32 @@ function systemPromptFor(dirs, fallback) {
 ${SAFETY_PREAMBLE}`;
 }
 function writeLocalConfigReport(managedDir, dataDir, now, flags) {
-  if (!existsSync6(managedDir)) return false;
+  if (!existsSync5(managedDir)) return false;
   const persona = {};
   for (const { file } of PERSONA_SOURCES) {
-    const path2 = join8(dataDir, file);
-    if (!existsSync6(path2)) continue;
+    const path2 = join7(dataDir, file);
+    if (!existsSync5(path2)) continue;
     try {
-      persona[file] = readFileSync8(path2, "utf8").slice(0, PERSONA_MAX_BYTES);
+      persona[file] = readFileSync7(path2, "utf8").slice(0, PERSONA_MAX_BYTES);
     } catch {
     }
   }
   const doc = {
-    schema: "securecoms.local-config/1",
+    schema: "securecoms.local-config/2",
     written_at: now.toISOString(),
     has_search_key: flags.hasSearchKey,
     has_llm_key: flags.hasLlmKey,
-    persona
+    persona,
+    // Paths stay in this owner-only local handoff file. The daemon validates
+    // each source again and strips `path` before reporting anything upstream.
+    legacy_memory: collectLegacyMemorySources(managedDir, dataDir)
   };
-  const path = join8(managedDir, "local-config.json");
+  const path = join7(managedDir, "local-config.json");
   const tmp = `${path}.${process.pid}.tmp`;
   try {
-    writeFileSync3(tmp, `${JSON.stringify(doc, null, 2)}
+    writeFileSync(tmp, `${JSON.stringify(doc, null, 2)}
 `, { mode: 384 });
-    renameSync(tmp, path);
+    renameSync2(tmp, path);
   } catch (e) {
     try {
       unlinkSync(tmp);
@@ -2206,12 +2394,12 @@ function personaInit(dataDir, defaultsDir, writeFile, exists) {
   const written = [];
   const skipped = [];
   for (const { file } of PERSONA_SOURCES) {
-    const target = join8(dataDir, file);
+    const target = join7(dataDir, file);
     if (exists(target)) {
       skipped.push(target);
       continue;
     }
-    writeFile(target, readFileSync8(join8(defaultsDir, file), "utf8"));
+    writeFile(target, readFileSync7(join7(defaultsDir, file), "utf8"));
     written.push(target);
   }
   return { written, skipped };
@@ -2219,11 +2407,17 @@ function personaInit(dataDir, defaultsDir, writeFile, exists) {
 function createLocalConfigReporter(managedDir, dataDir, now) {
   let lastWritten = null;
   return (flags) => {
-    if (lastWritten !== null && lastWritten.hasSearchKey === flags.hasSearchKey && lastWritten.hasLlmKey === flags.hasLlmKey) {
+    const legacyFingerprint = legacyMemoryFingerprint(managedDir, dataDir);
+    if (lastWritten !== null && lastWritten.hasSearchKey === flags.hasSearchKey && lastWritten.hasLlmKey === flags.hasLlmKey && lastWritten.legacyFingerprint === legacyFingerprint) {
       return false;
     }
     const wrote = writeLocalConfigReport(managedDir, dataDir, now(), flags);
-    if (wrote) lastWritten = { ...flags };
+    if (wrote) {
+      lastWritten = {
+        ...flags,
+        legacyFingerprint: legacyMemoryFingerprint(managedDir, dataDir)
+      };
+    }
     return wrote;
   };
 }
@@ -2244,7 +2438,7 @@ function installWarningFilter(proc = process) {
 
 // src/index.ts
 if (process.argv.includes("--version")) {
-  const pkg = JSON.parse(readFileSync9(join9(dirname4(dirname4(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync8(join8(dirname4(dirname4(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
   console.log(pkg.version);
   process.exit(0);
 }
@@ -2258,15 +2452,12 @@ function makeLogger(cfg) {
     else console.log(line);
   };
 }
-function safeChannelSegment(channelId) {
-  return channelId.replace(/[^A-Za-z0-9_-]/g, "_") || "_";
-}
 function realLlmSourceDeps() {
   return {
     home: homedir4(),
-    readFile: (p) => readFileSync9(p, "utf8"),
+    readFile: (p) => readFileSync8(p, "utf8"),
     statFile: (p) => ({ mode: statSync2(p).mode }),
-    exists: (p) => existsSync7(p)
+    exists: (p) => existsSync6(p)
   };
 }
 function realServiceDeps() {
@@ -2276,10 +2467,10 @@ function realServiceDeps() {
       const r = spawnSync(cmd, args, { encoding: "utf8" });
       return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
     },
-    writeFile: (p, data) => writeFileSync4(p, data, { mode: 420 }),
+    writeFile: (p, data) => writeFileSync2(p, data, { mode: 420 }),
     removeFile: (p) => rmSync(p, { force: true }),
-    mkdirp: (p) => mkdirSync3(p, { recursive: true }),
-    fileExists: (p) => existsSync7(p),
+    mkdirp: (p) => mkdirSync(p, { recursive: true }),
+    fileExists: (p) => existsSync6(p),
     canRead: (p) => {
       try {
         accessSync(p, constants.R_OK);
@@ -2294,7 +2485,7 @@ function realServiceDeps() {
 function realResolveNodeDeps() {
   return {
     realpath: (p) => realpathSync(p),
-    fileExists: (p) => existsSync7(p),
+    fileExists: (p) => existsSync6(p),
     nodeMajorOf: (p) => {
       const r = spawnSync(p, ["--version"], { encoding: "utf8" });
       if (r.status !== 0) return null;
@@ -2386,12 +2577,12 @@ async function main() {
       return;
     }
     if (personaVerb === "init") {
-      mkdirSync3(cfgForPersona.dataDir, { recursive: true });
+      mkdirSync(cfgForPersona.dataDir, { recursive: true });
       const r = personaInit(
         cfgForPersona.dataDir,
         defaultPersonaDir(),
-        (p, d) => writeFileSync4(p, d, { mode: 384 }),
-        (p) => existsSync7(p)
+        (p, d) => writeFileSync2(p, d, { mode: 384 }),
+        (p) => existsSync6(p)
       );
       for (const p of r.written) console.log(`wrote ${p}`);
       for (const p of r.skipped) console.log(`kept ${p} (already exists)`);
@@ -2419,7 +2610,7 @@ async function main() {
   const memoryFor = (channelId) => {
     let mem = memories.get(channelId);
     if (!mem) {
-      mem = new AgentMemory(join9(cfg.dataDir, "channels", safeChannelSegment(channelId)));
+      mem = new AgentMemory();
       memories.set(channelId, mem);
     }
     return mem;
@@ -2438,14 +2629,14 @@ async function main() {
     const path = keyFilePath(which);
     if (!path) return null;
     try {
-      return readFileSync9(path, "utf8").trim() || null;
+      return readFileSync8(path, "utf8").trim() || null;
     } catch {
       log("warn", `cannot read the ${which} key file ${path}`);
       return null;
     }
   };
   const configDirs = configSearchPath(cfg.identityId, cfg.dataDir);
-  const hasSearchKey = () => hasReadableKeyFile([keyFilePath("brave"), keyFilePath("tavily")], (p) => readFileSync9(p, "utf8"));
+  const hasSearchKey = () => hasReadableKeyFile([keyFilePath("brave"), keyFilePath("tavily")], (p) => readFileSync8(p, "utf8"));
   const hasLlmKey = () => {
     try {
       return hasLlmKeyFor(resolveLlmSource(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps()));
@@ -2453,7 +2644,7 @@ async function main() {
       return false;
     }
   };
-  migrateMemoryIntoManaged(managedDir, cfg.dataDir);
+  quarantineLegacyMemory(managedDir, cfg.dataDir);
   const reportLocalConfig = createLocalConfigReporter(managedDir, cfg.dataDir, () => /* @__PURE__ */ new Date());
   reportLocalConfig({ hasSearchKey: hasSearchKey(), hasLlmKey: hasLlmKey() });
   const builtinCtx = {
@@ -2475,7 +2666,7 @@ async function main() {
     allow: DEFAULT_TOOL_ALLOW
   });
   const gate = createDynamicToolGate(policyFor);
-  const offeredTools = () => {
+  const installationEligibleTools = () => {
     const sc = currentSkillsConfig();
     const g = createLocalToolGate(policyFor());
     const searchKey = hasSearchKey();
@@ -2493,16 +2684,15 @@ async function main() {
       skills,
       gate,
       log,
-      // All of these are read PER TURN: a persona edit, a new remembered fact, a
-      // key file dropped in, or configuration saved in the web app takes effect
-      // on the next message, with no restart.
+      // All of these are read PER TURN: a persona edit, a key file dropped in,
+      // or configuration saved in the web app takes effect on the next message,
+      // with no restart.
       systemPromptFor: () => systemPromptFor(configDirs, DEFAULT_SYSTEM_PROMPT),
-      longTermMemory: () => readLongTermMemory(configDirs),
-      tools: offeredTools
+      tools: installationEligibleTools
     })
   );
   console.log(
-    `${bootLine(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps())}, ${offeredTools().length} skills, tool gate default=${cfg.toolGate.default}`
+    `${bootLine(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps())}, ${installationEligibleTools().length} configured skills (channel grant required), tool gate default=${cfg.toolGate.default}`
   );
   await plane.start();
   const shutdown = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-runtime",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "type": "module",
   "bin": {
     "securecoms-agent": "dist/bin.js"
@@ -43,7 +43,7 @@
     "@types/ws": "^8.5.12",
     "esbuild": "0.24.0",
     "typescript": "^5.4.0",
-    "vitest": "^2.0.0",
+    "vitest": "^3.2.6",
     "ws": "^8.21.0"
   }
 }

package/skills/remember/SKILL.md

@@ -1,13 +0,0 @@
----
-name: remember
-description: Save a durable fact to the agent's long-term memory.
-handler: builtin:remember
-parameters:
-  type: object
-  properties:
-    fact: { type: string, description: One durable fact of at most 300 characters. }
-  required: [fact]
----
-Save a durable fact about the people or the business you work for — a renewal
-date, a preference, a name. Not a passing detail from this conversation, and
-never a password, key or token.