@agentvault/claude-bridge 0.5.6 → 0.5.7

package/dist/config.d.ts

@@ -20,6 +20,9 @@ export interface BridgeConfig {
     /** Slice 2: arm the pinned room (roomFilter) for worker tools on room turns.
      *  Off by default. Valid only with worker + roomFilter + workspaceDir. */
     armRoom: boolean;
+    /** Operator attestation that the agent process runs OS-isolated (own user / jail).
+     *  Only when true is Bash permitted in worker mode (the OS boundary is the fence). */
+    osIsolated: boolean;
 }
 export declare function loadConfig(env: NodeJS.ProcessEnv, argv?: string[]): BridgeConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/index.js

@@ -40,6 +40,7 @@ function loadConfig(env, argv = []) {
   const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || "";
   const worker = env.AV_WORKER === "1" || env.AV_WORKER === "true";
   const workspaceDir = env.AV_WORKSPACE_DIR || void 0;
+  const osIsolated = env.AV_WORKER_OS_ISOLATED === "1" || env.AV_WORKER_OS_ISOLATED === "true";
   const PERMISSION_MODES = ["auto", "acceptEdits", "bypassPermissions"];
   const permissionMode = env.AV_PERMISSION_MODE ?? "auto";
   if (!PERMISSION_MODES.includes(permissionMode)) {
@@ -84,7 +85,8 @@ function loadConfig(env, argv = []) {
     worker,
     workspaceDir,
     permissionMode,
-    armRoom
+    armRoom,
+    osIsolated
   };
 }
 var CRED_FILES, BACKUP_FILE;
@@ -68293,13 +68295,13 @@ ${messageText}`;
        * Looks for OpenClaw workspace config, falls back to default path.
        */
       _resolveWorkspaceDir() {
-        const homedir2 = osHomedir();
+        const homedir = osHomedir();
         const agentName = this.config.agentName;
         if (this._persisted?.agentRole === "lead") {
-          return join4(homedir2, ".openclaw", "workspace");
+          return join4(homedir, ".openclaw", "workspace");
         }
         try {
-          const configPath = join4(homedir2, ".openclaw", "openclaw.json");
+          const configPath = join4(homedir, ".openclaw", "openclaw.json");
           const raw = readFileSync(configPath, "utf-8");
           const config22 = JSON.parse(raw);
           const agents = config22?.agents?.list;
@@ -68313,9 +68315,9 @@ ${messageText}`;
         } catch {
         }
         if (agentName && agentName !== "CLI Agent" && agentName !== "OpenClaw Agent") {
-          return join4(homedir2, ".openclaw", `workspace-${agentName}`);
+          return join4(homedir, ".openclaw", `workspace-${agentName}`);
         }
-        return join4(homedir2, ".openclaw", "workspace");
+        return join4(homedir, ".openclaw", "workspace");
       }
       /**
        * Send a structured JSON reply to a specific conversation.
@@ -118475,52 +118477,75 @@ function Z_($10, Q4) {
 
 // src/worker-permission.ts
 import { realpathSync as realpathSync2 } from "node:fs";
-import { resolve as resolve2, dirname, basename, sep } from "node:path";
-import { homedir } from "node:os";
+import { resolve as resolve2, dirname, basename, sep, isAbsolute } from "node:path";
 var PATH_FIELDS = ["file_path", "path", "notebook_path"];
 function canonical(p2) {
   const abs = resolve2(p2);
   try {
     return realpathSync2(abs);
   } catch {
-    try {
-      return resolve2(realpathSync2(dirname(abs)), basename(abs));
-    } catch {
-      return abs;
+    const suffix = [];
+    let dir = abs;
+    for (; ; ) {
+      const parent2 = dirname(dir);
+      suffix.unshift(basename(dir));
+      if (parent2 === dir) return abs;
+      try {
+        return resolve2(realpathSync2(parent2), ...suffix);
+      } catch {
+        dir = parent2;
+      }
     }
   }
 }
-function targetsDataDir(_toolName, input, dataDir) {
-  const canonDir = canonical(dataDir);
+var FILE_TOOLS = /* @__PURE__ */ new Set(["Read", "Write", "Edit", "MultiEdit", "NotebookEdit", "Glob", "Grep"]);
+function pathsOf(input) {
+  const out = [];
   for (const f7 of PATH_FIELDS) {
     const v5 = input[f7];
-    if (typeof v5 === "string") {
-      const canon = canonical(v5);
-      if (canon === canonDir || canon.startsWith(canonDir + sep)) return true;
-    }
+    if (typeof v5 === "string" && v5.length > 0) out.push(canonical(v5));
   }
-  const cmd = input.command;
-  if (typeof cmd === "string") {
-    if (cmd.includes(canonDir)) return true;
-    const home = process.env.HOME || homedir();
-    if (home && (canonDir === home || canonDir.startsWith(home + sep))) {
-      const rel = canonDir.slice(home.length);
-      for (const prefix of ["~", "$HOME", "${HOME}"]) {
-        if (cmd.includes(prefix + rel)) return true;
-      }
-    }
-  }
-  return false;
+  return out;
+}
+function within(canonTarget, canonRoot) {
+  return canonTarget === canonRoot || canonTarget.startsWith(canonRoot + sep);
+}
+function globPatternEscapes(pattern) {
+  if (typeof pattern !== "string" || pattern.length === 0) return true;
+  if (!/^[A-Za-z0-9 _./*?-]+$/.test(pattern)) return true;
+  if (isAbsolute(pattern)) return true;
+  return pattern.split("/").some((seg) => seg === ".." || seg === "");
 }
 function gateDecision(toolName, input, opts) {
   if (toolName === ROOM_SAY_TOOL_NAME) return { deny: false };
   if (!opts.isToolTurn()) {
     return { deny: true, reason: "tools are disabled on this turn; reply with the say tool only" };
   }
-  if (targetsDataDir(toolName, input, opts.dataDir)) {
-    return { deny: true, reason: "access to the AgentVault key directory is not permitted" };
+  if (toolName === "Bash") {
+    return opts.osIsolated ? { deny: false } : { deny: true, reason: "Bash is disabled in worker mode unless the process is OS-isolated (set AV_WORKER_OS_ISOLATED=1)" };
   }
-  return { deny: false };
+  if (FILE_TOOLS.has(toolName)) {
+    if (!opts.workspaceDir) {
+      return { deny: true, reason: "no workspace is configured; file tools are disabled" };
+    }
+    const paths = pathsOf(input);
+    if (paths.length === 0) {
+      return { deny: true, reason: "file tool call has no resolvable path; blocked (workspace-confined)" };
+    }
+    if (toolName === "Glob" && globPatternEscapes(input.pattern)) {
+      return { deny: true, reason: "glob pattern must be workspace-relative" };
+    }
+    const wsRoot = canonical(opts.workspaceDir);
+    if (!paths.every((p2) => within(p2, wsRoot))) {
+      return { deny: true, reason: "file access is restricted to the workspace directory" };
+    }
+    const dataRoot = canonical(opts.dataDir);
+    if (paths.some((p2) => within(p2, dataRoot))) {
+      return { deny: true, reason: "access to the AgentVault key directory is not permitted" };
+    }
+    return { deny: false };
+  }
+  return { deny: true, reason: `tool ${toolName} is not permitted in worker mode` };
 }
 function makeWorkerPreToolUseHook(opts) {
   return {
@@ -132484,6 +132509,8 @@ var PersistentClaudeSession = class {
     }
     const gateOpts = {
       dataDir: this.opts.dataDir ?? "",
+      workspaceDir: this.opts.workspaceDir,
+      osIsolated: this.opts.osIsolated ?? false,
       // LOAD-BEARING: tools are allowed when this is an owner DM turn
       // (currentAutoReply) OR an armed-room turn (currentArmedGetter()). An UNARMED
       // room turn keeps both false → the gate denies all tools but room_say.
@@ -132505,6 +132532,9 @@ var PersistentClaudeSession = class {
         });
       }
     };
+    console.error(
+      `[worker-gate] allowlist active \u2014 workspace=${this.opts.workspaceDir ?? "(none: file tools disabled)"}, bash=${this.opts.osIsolated ? "enabled (OS-isolated)" : "disabled"}`
+    );
     return {
       ...base,
       permissionMode: this.opts.permissionMode ?? "auto",
@@ -132913,7 +132943,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.5.6" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.5.7" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   if (cfg.worker) {
     console.error(`[bridge] WORKER MODE \u2014 workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
@@ -132951,6 +132981,7 @@ async function main() {
     onObserve: (text) => console.error(`[bridge] observed (${text.length} chars, not sent)`),
     worker: cfg.worker,
     workspaceDir: cfg.workspaceDir,
+    osIsolated: cfg.osIsolated,
     permissionMode: cfg.permissionMode,
     dataDir: cfg.dataDir,
     // Slice 2 Plan B: audit self-report context (only used on armed-room turns).

package/dist/session.d.ts

@@ -60,6 +60,8 @@ export interface SessionOpts {
     worker?: boolean;
     /** Workspace directory to set as cwd in worker mode. */
     workspaceDir?: string;
+    /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
+    osIsolated?: boolean;
     /** Claude permission mode for worker turns (default: "auto"). */
     permissionMode?: "auto" | "acceptEdits" | "bypassPermissions";
     /** AgentVault data directory — fenced off from worker tool access. */

package/dist/worker-permission.d.ts

@@ -8,6 +8,10 @@ import type { CanUseTool, HookCallbackMatcher } from "@anthropic-ai/claude-agent
  */
 export declare function makeWorkerPreToolUseHook(opts: {
     dataDir: string;
+    /** The confined workspace root; file tools are denied entirely when unset. */
+    workspaceDir?: string;
+    /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
+    osIsolated: boolean;
     isToolTurn: () => boolean;
     /** Slice 2 Plan B: true when this turn comes from an armed room. When set,
      *  each tool decision (allow AND deny) is forwarded to onToolDecision for
@@ -27,6 +31,10 @@ export declare function makeWorkerPreToolUseHook(opts: {
  */
 export declare function makeWorkerPermission(opts: {
     dataDir: string;
+    /** The confined workspace root; file tools are denied entirely when unset. */
+    workspaceDir?: string;
+    /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
+    osIsolated: boolean;
     isToolTurn: () => boolean;
 }): CanUseTool;
 //# sourceMappingURL=worker-permission.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",