@agentvault/claude-bridge 0.3.3 → 0.4.0

package/dist/plan-c-crux-harness.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=plan-c-crux-harness.d.ts.map

package/dist/service/backend.d.ts

@@ -0,0 +1,25 @@
+import type { ServiceSpec } from "./spec.js";
+export interface ServiceBackend {
+    install(spec: ServiceSpec): void;
+    uninstall(label: string): void;
+    status(label: string): {
+        loaded: boolean;
+        detail: string;
+    };
+}
+export interface BackendDeps {
+    home: string;
+    uid: number;
+    user: string;
+    exec: (cmd: string, args: string[]) => {
+        code: number;
+        stdout: string;
+    };
+    writeFile: (path: string, data: string) => void;
+    mkdir: (path: string) => void;
+    rm: (path: string) => void;
+    exists: (path: string) => boolean;
+}
+export declare function defaultDeps(): BackendDeps;
+export declare function selectBackend(platform: NodeJS.Platform, deps?: BackendDeps): ServiceBackend;
+//# sourceMappingURL=backend.d.ts.map

package/dist/service/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/service/backend.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC;AAED,wBAAgB,WAAW,IAAI,WAAW,CAmBzC;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,cAAc,CAU3F"}

package/dist/service/launchd.d.ts

@@ -0,0 +1,17 @@
+import type { ServiceSpec } from "./spec.js";
+import type { BackendDeps, ServiceBackend } from "./backend.js";
+/** Render a launchd LaunchAgent plist for a bridge ServiceSpec. Pure string. */
+export declare function renderLaunchdPlist(spec: ServiceSpec): string;
+export declare class LaunchdBackend implements ServiceBackend {
+    private deps;
+    constructor(deps: BackendDeps);
+    private plistPath;
+    private domain;
+    install(spec: ServiceSpec): void;
+    uninstall(label: string): void;
+    status(label: string): {
+        loaded: boolean;
+        detail: string;
+    };
+}
+//# sourceMappingURL=launchd.d.ts.map

package/dist/service/launchd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd.d.ts","sourceRoot":"","sources":["../../src/service/launchd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAShE,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAkC5D;AAED,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAWhC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAM9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAI3D"}

package/dist/service/spec.d.ts

@@ -0,0 +1,18 @@
+import type { BridgeConfig } from "../config.js";
+export interface ServiceSpec {
+    label: string;
+    programArgs: string[];
+    env: Record<string, string>;
+    workingDir: string;
+    logOut: string;
+    logErr: string;
+    keepAliveUnlessCleanExit: boolean;
+    runAtLoad: boolean;
+}
+export interface BuildSpecOptions {
+    nodePath: string;
+    entrypoint: string;
+    home: string;
+}
+export declare function buildServiceSpec(cfg: BridgeConfig, opts: BuildSpecOptions): ServiceSpec;
+//# sourceMappingURL=spec.d.ts.map

package/dist/service/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/service/spec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB,EAAE,OAAO,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,GAAG,WAAW,CAwBvF"}

package/dist/service/subcommand.d.ts

@@ -0,0 +1,11 @@
+import { type ServiceBackend } from "./backend.js";
+export interface ServiceCmdDeps {
+    backend: ServiceBackend;
+    entrypoint: string;
+    log: (msg: string) => void;
+}
+/** Handle `agentvault-claude-bridge <install|uninstall|status|logs>` before boot.
+ *  Returns true when handled (caller should exit). Secrets are never placed on
+ *  the service command line — config flows via the plist env; the token is omitted. */
+export declare function maybeRunServiceSubcommand(argv: string[], env: NodeJS.ProcessEnv, deps?: ServiceCmdDeps): boolean;
+//# sourceMappingURL=subcommand.d.ts.map

package/dist/service/subcommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAQD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CA+CT"}

package/dist/service/systemd.d.ts

@@ -0,0 +1,19 @@
+import type { ServiceSpec } from "./spec.js";
+import type { BackendDeps, ServiceBackend } from "./backend.js";
+/** Render a systemd --user service unit for a bridge ServiceSpec. Pure string.
+ *  Restart=on-failure + SuccessExitStatus=0 is the KeepAlive={SuccessfulExit:false}
+ *  equivalent: a clean exit(0) (revoked device) is treated as success => NOT
+ *  restarted; a non-zero crash is restarted. WantedBy=default.target is RunAtLoad. */
+export declare function renderSystemdUnit(spec: ServiceSpec): string;
+export declare class SystemdBackend implements ServiceBackend {
+    private deps;
+    constructor(deps: BackendDeps);
+    private unitPath;
+    install(spec: ServiceSpec): void;
+    uninstall(label: string): void;
+    status(label: string): {
+        loaded: boolean;
+        detail: string;
+    };
+}
+//# sourceMappingURL=systemd.d.ts.map

package/dist/service/systemd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd.d.ts","sourceRoot":"","sources":["../../src/service/systemd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAkBhE;;;sFAGsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAsB3D;AAED,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAmBhC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAQ9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAQ3D"}

package/dist/session.d.ts

@@ -55,6 +55,22 @@ export interface SessionOpts {
     model?: string;
     systemPrompt?: string;
     queryImpl?: QueryFn;
+    /** When true, session runs as a worker agent: full toolset on owner DMs,
+     *  project context loaded, workspace cwd set, AV data dir fenced off. */
+    worker?: boolean;
+    /** Workspace directory to set as cwd in worker mode. */
+    workspaceDir?: string;
+    /** Claude permission mode for worker turns (default: "auto"). */
+    permissionMode?: "auto" | "acceptEdits" | "bypassPermissions";
+    /** AgentVault data directory — fenced off from worker tool access. */
+    dataDir?: string;
+    /** Slice 2 Plan B — audit self-report context. When present and the turn is
+     *  armed, each tool decision is fire-and-forget reported to /audit/entries. */
+    roomId?: string;
+    agentId?: string | null;
+    apiUrl?: string;
+    /** Lazy getter so a JWT refreshed after construction is still picked up. */
+    deviceJwt?: () => string | null;
 }
 export declare class PersistentClaudeSession {
     private opts;
@@ -63,10 +79,30 @@ export declare class PersistentClaudeSession {
     /** Reply sink bound to the message currently being processed. Set as each
      *  message is handed to the model so the say tool routes to the right place. */
     private activeReply?;
-    /** Per-turn state for the #416 DM auto-reply fallback. */
+    /**
+     * Per-turn state for the #416 DM auto-reply fallback and the worker tool gate.
+     *
+     * LOAD-BEARING (one of two tool-enabling signals): `currentAutoReply` is true
+     * ONLY on owner DM turns (`autoReplyOnText:true` from wireBridge) and false on
+     * room turns (`autoReplyOnText:false`). The gate allows tools when EITHER
+     * `currentAutoReply` (owner DM) OR `currentArmedGetter()` (armed room turn, Slice 2)
+     * is true. A room-origin turn MUST keep `currentAutoReply` false; an unarmed
+     * room turn's `currentArmedGetter()` MUST return false — or untrusted input gains full
+     * tool access. See worker-permission.test.ts for the covering assertion.
+     */
     private currentAutoReply;
+    /** Per-turn: a LIVE getter answering "is this turn's room armed right now?"
+     *  (Slice 2 Plan C D5). Independent of currentAutoReply (which is owner-DM-only
+     *  and also drives the #416 plain-text fallback). The gate allows tools when
+     *  EITHER currentAutoReply OR this getter is true. CRITICAL: the gate CALLS this
+     *  getter at each tool-call decision (not a boolean captured once), so a mid-turn
+     *  disarm denies the very next tool call. wireBridge binds it to the ArmingState
+     *  for this turn's room; an unarmed room turn's getter returns false. */
+    private currentArmedGetter;
     private saidThisTurn;
     private turnText;
+    /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
+    private roomServer;
     constructor(opts: SessionOpts);
     /**
      * Queue an inbound message for the model.
@@ -74,15 +110,28 @@ export declare class PersistentClaudeSession {
      *   reply): if the turn produces assistant text but never calls the say tool,
      *   send that text as the reply instead of silently dropping it (#416). Rooms
      *   omit this so the agent can still choose silence.
+     * @param opts.armed — for armed room turns (Slice 2 Plan C): a LIVE getter that
+     *   the gate calls at each tool-call decision. When it returns true this room
+     *   turn is granted full worker tool access (same as an owner DM turn). Reading
+     *   it live (not capturing a boolean) is what lets a mid-turn disarm deny the
+     *   next tool call. Bound by wireBridge to the ArmingState for this turn's room.
      */
     push(text: string, reply?: ReplySink, opts?: {
         autoReplyOnText?: boolean;
+        armed?: () => boolean;
     }): void;
     /** Route a say-tool message to the reply bound to the in-flight message, falling
      *  back to opts.onSay. This is what closes the DM→room leak: the destination is
      *  the one captured for the message being answered, not a live global target. */
     deliver(text: string): Promise<void>;
     private input;
+    /**
+     * Build the SDK options for this session. Locked mode (default) is safe for
+     * untrusted inbound room messages. Worker mode (opts.worker=true) enables full
+     * toolset on owner DMs, project context, workspace cwd, and an AV data-dir
+     * fence via canUseTool.
+     */
+    private buildSdkOptions;
     start(): Promise<void>;
 }
 export {};

package/dist/worker-permission.d.ts

@@ -0,0 +1,32 @@
+import type { CanUseTool, HookCallbackMatcher } from "@anthropic-ai/claude-agent-sdk";
+/**
+ * PRIMARY enforcement: a PreToolUse hook. Unlike canUseTool (the SDK's "ask"
+ * path, which `permissionMode:"auto"` BYPASSES by auto-approving benign tools via
+ * its classifier — verified live: the canUseTool gate never fired in auto mode),
+ * a PreToolUse `deny` fires on EVERY tool call regardless of permission mode.
+ * This is what actually enforces the gate at runtime.
+ */
+export declare function makeWorkerPreToolUseHook(opts: {
+    dataDir: string;
+    isToolTurn: () => boolean;
+    /** Slice 2 Plan B: true when this turn comes from an armed room. When set,
+     *  each tool decision (allow AND deny) is forwarded to onToolDecision for
+     *  audit self-reporting. room_say is always excluded (it is the reply
+     *  mechanism, not a user-initiated tool action). */
+    isArmedTurn?: () => boolean;
+    onToolDecision?: (d: {
+        tool: string;
+        decision: "allow" | "deny";
+        reason?: string;
+    }) => void;
+}): HookCallbackMatcher;
+/**
+ * SECONDARY (defense-in-depth): the canUseTool callback covers the SDK's "ask"
+ * path (permissionMode `"default"`/`"dontAsk"`). Shares gateDecision with the
+ * PreToolUse hook above, so a deny in one is a deny in the other.
+ */
+export declare function makeWorkerPermission(opts: {
+    dataDir: string;
+    isToolTurn: () => boolean;
+}): CanUseTool;
+//# sourceMappingURL=worker-permission.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",
@@ -8,6 +8,9 @@
   "bin": {
     "agentvault-claude-bridge": "dist/index.js"
   },
+  "engines": {
+    "node": ">=18"
+  },
   "files": [
     "dist",
     "README.md",