@agentvault/claude-bridge 0.5.10 → 0.6.1

package/dist/bridge.d.ts

@@ -26,6 +26,8 @@ export interface ArmingSnapshot {
      *  (backend `devices.work_allowed`, Task 2). Optional so older/test payloads
      *  without it don't break — treated as `false` (fail-closed) when absent. */
     workAllowed?: boolean;
+    /** #627: owner's "Remove all gates" grant. Absent ⇒ gates stay in place. */
+    gatesRemoved?: boolean;
 }
 /** Metadata SecureChannel attaches to a 1:1 `message` event. `roomId` is set only
  *  when the `message` actually originated in a room (handled by room_message), so
@@ -176,9 +178,16 @@ export declare function wireBridge(channel: RoomChannel, session: RoomSession, t
      * Task 4 (C2 shell-gate): true when this worker runs Bash unconfined
      * (AV_WORKER_OS_ISOLATED=1 — see config.ts/index.ts, threaded from the
      * session's `osIsolated`). When true, the `arming_snapshot` handler stays
-     * disarm-only regardless of B1/worker-capability — a shell worker must
-     * never be armed by a web-originated flag (RCE risk). Falls back to
-     * reading the env directly only if the caller doesn't thread this.
+     * disarm-only regardless of B1/worker-capability — a shell worker is not
+     * armed by a web-originated flag (RCE risk).
+     *
+     * #627 EXCEPTION: unless the owner has removed all gates. That grant is an
+     * explicit, recorded decision to accept exactly this risk, so it lifts C2;
+     * revoking it disarms the rooms the web armed under it. See the
+     * `applyArmingSnapshot` comment block for the full rationale. Without the
+     * grant, C2 is unchanged.
+     *
+     * Falls back to reading the env directly only if the caller doesn't thread this.
      */
     osIsolated?: boolean;
     /**
@@ -190,5 +199,13 @@ export declare function wireBridge(channel: RoomChannel, session: RoomSession, t
      * (index.ts, arming-authoritative.test.ts, bridge.test.ts) stays intact.
      */
     onWorkAllowed?: (getter: () => boolean) => void;
+    /**
+     * #627: out-param that receives the live `gatesRemoved()` getter once,
+     * synchronously, during wiring — same shape as `onWorkAllowed` above, and
+     * for the same reason (keeps wireBridge's return type stable so existing
+     * callers are untouched). index.ts captures it and threads it into the
+     * worker session's gate.
+     */
+    onGatesRemoved?: (getter: () => boolean) => void;
 }): ArmingState;
 //# sourceMappingURL=bridge.d.ts.map

package/dist/index.js

@@ -65555,7 +65555,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.7" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.8" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67172,7 +67172,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.7" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.8" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67251,6 +67251,10 @@ var init_channel = __esm2({
               await this._handleDeviceRevoked();
               return;
             }
+            if (data.event === "connection_rejected") {
+              await this._handleConnectionRejected(data);
+              return;
+            }
             if (data.event === "device_linked") {
               await this._handleDeviceLinked(data.data);
               return;
@@ -67424,6 +67428,7 @@ var init_channel = __esm2({
             if (data.event === "arming_snapshot") {
               this.emit("arming_snapshot", {
                 workAllowed: data.data?.work_allowed === true,
+                gatesRemoved: data.data?.gates_removed === true,
                 roomIds: data.data?.room_ids ?? []
               });
             }
@@ -67485,7 +67490,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.7" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.8" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -70677,6 +70682,37 @@ ${messageText}`;
        * re-enrollment, which SHOULD wipe creds, goes through setup --force /
        * _forceReEnroll in start().
        */
+      /**
+       * Handle a WS `connection_rejected` event.
+       *
+       * The server accepts the WS upgrade, then — for a device it will not serve —
+       * emits `{event:"connection_rejected", reason, retryable}` and closes with
+       * code 4403. `retryable:false` (e.g. `device_revoked`) is a TERMINAL
+       * credential failure: retrying can only reconnect, get rejected, and close
+       * again. Left unhandled, that generic close drove the reconnect classifier
+       * into "reconnect loop detected", which the bridge treats as a restartable
+       * exit — so launchd/systemd relaunched us every ~30s to hammer the backend
+       * with the same rejected handshake (empirically ~1150 rejects / 2h).
+       *
+       * So we route a non-retryable rejection to the SAME `auth_failed` surface the
+       * proactive/reactive reissue paths use (see channel.ts emit sites). The
+       * bridge wires `auth_failed` to a clean exit(0) (packages/claude-room-bridge
+       * /src/bridge.ts), so launchd stops relaunching. Mirrors those emitters:
+       * emit only + mark the session; the consumer decides how to stop. A
+       * `retryable` rejection is transient — fall through to a normal reconnect.
+       */
+      async _handleConnectionRejected(data) {
+        if (data?.retryable === true) {
+          this._scheduleReconnect();
+          return;
+        }
+        this._authFailedThisSession = true;
+        const authReason = data?.reason === "device_jwt_expired" ? "device_jwt_expired" : "device_revoked";
+        console.warn(
+          `[SecureChannel] connection_rejected (reason=${data?.reason ?? "unknown"}, retryable=false) \u2014 terminal; surfacing auth_failed`
+        );
+        this.emit("auth_failed", { reason: authReason });
+      }
       async _handleDeviceRevoked() {
         const now = Date.now();
         this._revokeRecoveries = this._revokeRecoveries.filter(
@@ -97232,7 +97268,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.7" : "0.0.0-dev";
+    VERSION = true ? "0.23.8" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -118580,6 +118616,12 @@ function gateDecision(toolName, input, opts) {
   if (!opts.isToolTurn()) {
     return { deny: true, reason: "tools are disabled on this turn; reply with the say tool only" };
   }
+  if (opts.gatesRemoved?.()) {
+    return { deny: false };
+  }
+  if (opts.isOwnerDmTurn?.()) {
+    return { deny: false };
+  }
   if (toolName === "Bash") {
     return opts.osIsolated ? { deny: false } : { deny: true, reason: "Bash is disabled in worker mode unless the process is OS-isolated (set AV_WORKER_OS_ISOLATED=1)" };
   }
@@ -132612,6 +132654,19 @@ var PersistentClaudeSession = class {
       // default (no getter ⇒ no tools). Read LIVE per tool decision so a Work-off
       // flip / fail-closed reconnect window denies the very next call.
       isToolTurn: () => (this.opts.workAllowed?.() ?? false) && (this.currentAutoReply || this.currentArmedGetter()),
+      // Full-access lane: a 1:1 owner DM, whose ephemeral worker is seeded with
+      // ONLY the owner's own message, so no third party can steer the turn.
+      // Conjoined with !currentArmedGetter() deliberately: if a room turn ever
+      // arrived with autoReplyOnText set, it must fall through to the allowlist
+      // rather than inherit full access. Fail-safe, not merely descriptive.
+      // Read LIVE per tool decision, like isToolTurn.
+      isOwnerDmTurn: () => this.currentAutoReply && !this.currentArmedGetter(),
+      // #627: the owner removed all gates for this device. Evaluated by
+      // gateDecision AFTER isToolTurn, so an unarmed room turn stays chat-only
+      // — this widens what a tool turn may do, never which turns get tools.
+      // Read LIVE per decision so a revoke (or a reconnect reset) denies the
+      // very next call, exactly like workAllowed above.
+      gatesRemoved: () => this.opts.gatesRemoved?.() ?? false,
       // Slice 2 Plan B: emit an audit self-report for each tool decision on an
       // armed-room turn (both allow and deny). room_say is excluded by the hook.
       isArmedTurn: () => this.currentArmedGetter(),
@@ -132627,7 +132682,7 @@ var PersistentClaudeSession = class {
       }
     };
     console.error(
-      `[worker-gate] allowlist active \u2014 workspace=${this.opts.workspaceDir ?? "(none: file tools disabled)"}, bash=${this.opts.osIsolated ? "enabled (OS-isolated)" : "disabled"}`
+      `[worker-gate] active \u2014 1:1 owner DM: FULL access, no allowlist, no workspace fence. Armed room: FULL access whenever "Remove all gates" is on (live, owner-controlled, off by default); otherwise allowlist, workspace=${this.opts.workspaceDir ?? "(none: file tools disabled)"}, bash=${this.opts.osIsolated ? "enabled (OS-isolated)" : "disabled"}`
     );
     return {
       ...base,
@@ -132764,7 +132819,7 @@ function makeRouter(deps) {
     push(text, reply, opts) {
       const replySink = reply ?? (() => {
       });
-      const isOwnerDm = opts?.autoReplyOnText === true && deps.workAllowed();
+      const isOwnerDm = opts?.autoReplyOnText === true && opts?.armed === void 0 && deps.workAllowed();
       const isArmedRoom = opts?.armed?.() === true && deps.workAllowed();
       if (isOwnerDm) {
         deps.queue.enqueue({
@@ -133068,8 +133123,15 @@ function wireBridge(channel, session, target, opts = {}) {
   let workAllowed = false;
   const workAllowedGetter = () => workAllowed;
   opts.onWorkAllowed?.(workAllowedGetter);
+  let gatesRemoved = false;
+  const gatesRemovedGetter = () => gatesRemoved;
+  opts.onGatesRemoved?.(gatesRemovedGetter);
+  const webArmedUnderGrant = /* @__PURE__ */ new Set();
   channel.on("state", (s10) => {
-    if (s10 !== "ready") workAllowed = false;
+    if (s10 !== "ready") {
+      workAllowed = false;
+      gatesRemoved = false;
+    }
   });
   const arming = new ArmingState();
   if (opts.armRoom === true && opts.roomFilter) {
@@ -133119,6 +133181,7 @@ function wireBridge(channel, session, target, opts = {}) {
   channel.on("ready", () => heartbeat());
   const applyArmingSnapshot = (s10) => {
     workAllowed = s10?.workAllowed === true;
+    gatesRemoved = s10?.gatesRemoved === true;
     if (!workerCapable) {
       log("arming_snapshot ignored \u2014 not worker-capable");
       return;
@@ -133126,7 +133189,20 @@ function wireBridge(channel, session, target, opts = {}) {
     const roomIds = s10?.roomIds ?? [];
     try {
       const before = new Set(arming.armedRooms());
-      if (osIsolated) {
+      if (osIsolated && gatesRemoved) {
+        arming.applyAuthoritative(roomIds);
+        for (const r7 of roomIds) if (!before.has(r7)) webArmedUnderGrant.add(r7);
+      } else if (osIsolated) {
+        if (webArmedUnderGrant.size > 0) {
+          const revoked = [...webArmedUnderGrant].filter((r7) => arming.isArmed(r7));
+          for (const r7 of revoked) arming.disarm(r7);
+          webArmedUnderGrant.clear();
+          if (revoked.length > 0) {
+            log(
+              `arming_snapshot: "Remove all gates" was revoked \u2014 disarming the rooms it had armed on this OS-isolated worker: [${revoked.map((r7) => r7.slice(0, 8)).join(", ")}]`
+            );
+          }
+        }
         const dropped = arming.reconcileDisarm(roomIds);
         if (dropped.length > 0) {
           log(
@@ -133205,7 +133281,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.5.10" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.6.1" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -133217,7 +133293,7 @@ async function main() {
     );
   } else {
     console.error(
-      '[bridge] tools run on owner DM turns only when Work is allowed (the dashboard "Work" switch). Rooms stay say-only unless armed (AV_ARM_ROOM=1 with a pinned AV_ROOM_ID). Cross-turn injection note: a persistent session mixes room context with DM turns \u2014 run DM-only or OS-isolated if you do not arm a room.'
+      '[bridge] 1:1 owner DMs run with FULL tool access when "Allow tools" is on for this agent (dashboard switch, default off): any command, any file this user account can reach, network, skills and subagents \u2014 equivalent to a terminal on this machine, with no per-action prompt. Rooms are NOT affected: they stay say-only unless armed (AV_ARM_ROOM=1 with a pinned AV_ROOM_ID), and an armed room keeps the confined allowlist. Each tool-enabled turn runs in a fresh session seeded with only that one message, so room text cannot leak into a DM turn.'
     );
   }
   const target = new ActiveTarget();
@@ -133236,6 +133312,8 @@ async function main() {
   };
   let liveWorkAllowed = () => false;
   const workAllowed = () => liveWorkAllowed();
+  let liveGatesRemoved = () => false;
+  const gatesRemoved = () => liveGatesRemoved();
   const listener = new PersistentClaudeSession({
     model: cfg.model,
     systemPrompt: agentSystemPrompt,
@@ -133259,6 +133337,11 @@ async function main() {
       // Task 4: the hard backstop — no tool runs on any worker turn (owner DM or
       // armed room) unless Work is on. Read live per tool decision.
       workAllowed,
+      // #627: only the WORKER session gets this. The listener is the locked
+      // tools:[] facet and must stay that way — a grant that widened the
+      // always-on listener would put an unrestricted shell behind every
+      // untrusted room message, not just tool turns.
+      gatesRemoved,
       ephemeral: true,
       maxTurns: WORKER_MAX_TURNS,
       workspaceDir: cfg.workspaceDir,
@@ -133291,6 +133374,9 @@ async function main() {
       // during wiring) into the indirection the router + worker session read live.
       onWorkAllowed: (getter) => {
         liveWorkAllowed = getter;
+      },
+      onGatesRemoved: (getter) => {
+        liveGatesRemoved = getter;
       }
     }
   );

package/dist/session.d.ts

@@ -86,6 +86,18 @@ export interface SessionOpts {
      * false, even if the router mis-routed. Read LIVE at each tool decision (never
      * snapshotted). Absent getter ⇒ `?? false` ⇒ fail-closed (no tools). */
     workAllowed?: () => boolean;
+    /**
+     * #627: live, fail-closed device-level "Remove all gates" grant. When this
+     * returns true the gate permits EVERY tool with no restrictions, in rooms
+     * and 1:1 alike — the owner's explicit decision, recorded in #627.
+     *
+     * NOT a replacement for `isToolTurn`: this is read AFTER it, so an UNARMED
+     * room turn is still chat-only. That ordering is what separates "a room you
+     * enabled" from "any room somebody added your agent to", and it costs
+     * nothing to keep. Read LIVE at each tool decision (never snapshotted);
+     * absent getter ⇒ `?? false` ⇒ gates stay in place.
+     */
+    gatesRemoved?: () => boolean;
 }
 export declare class PersistentClaudeSession {
     private opts;

package/dist/worker-permission.d.ts

@@ -13,6 +13,9 @@ export declare function makeWorkerPreToolUseHook(opts: {
     /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
     osIsolated: boolean;
     isToolTurn: () => boolean;
+    /** True when this turn is a 1:1 owner DM. That lane gets full access; rooms
+     *  keep the allowlist. Read live per tool call, like isToolTurn. */
+    isOwnerDmTurn?: () => boolean;
     /** Slice 2 Plan B: true when this turn comes from an armed room. When set,
      *  each tool decision (allow AND deny) is forwarded to onToolDecision for
      *  audit self-reporting. room_say is always excluded (it is the reply
@@ -36,5 +39,7 @@ export declare function makeWorkerPermission(opts: {
     /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
     osIsolated: boolean;
     isToolTurn: () => boolean;
+    /** True when this turn is a 1:1 owner DM (full access lane). */
+    isOwnerDmTurn?: () => boolean;
 }): CanUseTool;
 //# sourceMappingURL=worker-permission.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.5.10",
+  "version": "0.6.1",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",
@@ -23,10 +23,10 @@
     }
   },
   "scripts": {
-    "build": "tsc --emitDeclarationOnly && node build.mjs",
+    "build": "npm --prefix ../plugin run build && tsc --emitDeclarationOnly && node build.mjs",
     "start": "node dist/index.js",
     "test": "vitest run",
-    "prepublishOnly": "node build.mjs"
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.114",