@agentvault/claude-bridge 0.5.6 → 0.5.8

package/dist/config.d.ts

@@ -20,6 +20,9 @@ export interface BridgeConfig {
     /** Slice 2: arm the pinned room (roomFilter) for worker tools on room turns.
      *  Off by default. Valid only with worker + roomFilter + workspaceDir. */
     armRoom: boolean;
+    /** Operator attestation that the agent process runs OS-isolated (own user / jail).
+     *  Only when true is Bash permitted in worker mode (the OS boundary is the fence). */
+    osIsolated: boolean;
 }
 export declare function loadConfig(env: NodeJS.ProcessEnv, argv?: string[]): BridgeConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/index.js

@@ -40,6 +40,7 @@ function loadConfig(env, argv = []) {
   const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || "";
   const worker = env.AV_WORKER === "1" || env.AV_WORKER === "true";
   const workspaceDir = env.AV_WORKSPACE_DIR || void 0;
+  const osIsolated = env.AV_WORKER_OS_ISOLATED === "1" || env.AV_WORKER_OS_ISOLATED === "true";
   const PERMISSION_MODES = ["auto", "acceptEdits", "bypassPermissions"];
   const permissionMode = env.AV_PERMISSION_MODE ?? "auto";
   if (!PERMISSION_MODES.includes(permissionMode)) {
@@ -84,7 +85,8 @@ function loadConfig(env, argv = []) {
     worker,
     workspaceDir,
     permissionMode,
-    armRoom
+    armRoom,
+    osIsolated
   };
 }
 var CRED_FILES, BACKUP_FILE;
@@ -68293,13 +68295,13 @@ ${messageText}`;
        * Looks for OpenClaw workspace config, falls back to default path.
        */
       _resolveWorkspaceDir() {
-        const homedir2 = osHomedir();
+        const homedir = osHomedir();
         const agentName = this.config.agentName;
         if (this._persisted?.agentRole === "lead") {
-          return join4(homedir2, ".openclaw", "workspace");
+          return join4(homedir, ".openclaw", "workspace");
         }
         try {
-          const configPath = join4(homedir2, ".openclaw", "openclaw.json");
+          const configPath = join4(homedir, ".openclaw", "openclaw.json");
           const raw = readFileSync(configPath, "utf-8");
           const config22 = JSON.parse(raw);
           const agents = config22?.agents?.list;
@@ -68313,9 +68315,9 @@ ${messageText}`;
         } catch {
         }
         if (agentName && agentName !== "CLI Agent" && agentName !== "OpenClaw Agent") {
-          return join4(homedir2, ".openclaw", `workspace-${agentName}`);
+          return join4(homedir, ".openclaw", `workspace-${agentName}`);
         }
-        return join4(homedir2, ".openclaw", "workspace");
+        return join4(homedir, ".openclaw", "workspace");
       }
       /**
        * Send a structured JSON reply to a specific conversation.
@@ -118475,52 +118477,75 @@ function Z_($10, Q4) {
 
 // src/worker-permission.ts
 import { realpathSync as realpathSync2 } from "node:fs";
-import { resolve as resolve2, dirname, basename, sep } from "node:path";
-import { homedir } from "node:os";
+import { resolve as resolve2, dirname, basename, sep, isAbsolute } from "node:path";
 var PATH_FIELDS = ["file_path", "path", "notebook_path"];
 function canonical(p2) {
   const abs = resolve2(p2);
   try {
     return realpathSync2(abs);
   } catch {
-    try {
-      return resolve2(realpathSync2(dirname(abs)), basename(abs));
-    } catch {
-      return abs;
+    const suffix = [];
+    let dir = abs;
+    for (; ; ) {
+      const parent2 = dirname(dir);
+      suffix.unshift(basename(dir));
+      if (parent2 === dir) return abs;
+      try {
+        return resolve2(realpathSync2(parent2), ...suffix);
+      } catch {
+        dir = parent2;
+      }
     }
   }
 }
-function targetsDataDir(_toolName, input, dataDir) {
-  const canonDir = canonical(dataDir);
+var FILE_TOOLS = /* @__PURE__ */ new Set(["Read", "Write", "Edit", "MultiEdit", "NotebookEdit", "Glob", "Grep"]);
+function pathsOf(input) {
+  const out = [];
   for (const f7 of PATH_FIELDS) {
     const v5 = input[f7];
-    if (typeof v5 === "string") {
-      const canon = canonical(v5);
-      if (canon === canonDir || canon.startsWith(canonDir + sep)) return true;
-    }
+    if (typeof v5 === "string" && v5.length > 0) out.push(canonical(v5));
   }
-  const cmd = input.command;
-  if (typeof cmd === "string") {
-    if (cmd.includes(canonDir)) return true;
-    const home = process.env.HOME || homedir();
-    if (home && (canonDir === home || canonDir.startsWith(home + sep))) {
-      const rel = canonDir.slice(home.length);
-      for (const prefix of ["~", "$HOME", "${HOME}"]) {
-        if (cmd.includes(prefix + rel)) return true;
-      }
-    }
-  }
-  return false;
+  return out;
+}
+function within(canonTarget, canonRoot) {
+  return canonTarget === canonRoot || canonTarget.startsWith(canonRoot + sep);
+}
+function globPatternEscapes(pattern) {
+  if (typeof pattern !== "string" || pattern.length === 0) return true;
+  if (!/^[A-Za-z0-9 _./*?-]+$/.test(pattern)) return true;
+  if (isAbsolute(pattern)) return true;
+  return pattern.split("/").some((seg) => seg === ".." || seg === "");
 }
 function gateDecision(toolName, input, opts) {
   if (toolName === ROOM_SAY_TOOL_NAME) return { deny: false };
   if (!opts.isToolTurn()) {
     return { deny: true, reason: "tools are disabled on this turn; reply with the say tool only" };
   }
-  if (targetsDataDir(toolName, input, opts.dataDir)) {
-    return { deny: true, reason: "access to the AgentVault key directory is not permitted" };
+  if (toolName === "Bash") {
+    return opts.osIsolated ? { deny: false } : { deny: true, reason: "Bash is disabled in worker mode unless the process is OS-isolated (set AV_WORKER_OS_ISOLATED=1)" };
+  }
+  if (FILE_TOOLS.has(toolName)) {
+    if (!opts.workspaceDir) {
+      return { deny: true, reason: "no workspace is configured; file tools are disabled" };
+    }
+    const paths = pathsOf(input);
+    if (paths.length === 0) {
+      return { deny: true, reason: "file tool call has no resolvable path; blocked (workspace-confined)" };
+    }
+    if (toolName === "Glob" && globPatternEscapes(input.pattern)) {
+      return { deny: true, reason: "glob pattern must be workspace-relative" };
+    }
+    const wsRoot = canonical(opts.workspaceDir);
+    if (!paths.every((p2) => within(p2, wsRoot))) {
+      return { deny: true, reason: "file access is restricted to the workspace directory" };
+    }
+    const dataRoot = canonical(opts.dataDir);
+    if (paths.some((p2) => within(p2, dataRoot))) {
+      return { deny: true, reason: "access to the AgentVault key directory is not permitted" };
+    }
+    return { deny: false };
   }
-  return { deny: false };
+  return { deny: true, reason: `tool ${toolName} is not permitted in worker mode` };
 }
 function makeWorkerPreToolUseHook(opts) {
   return {
@@ -132412,6 +132437,8 @@ var PersistentClaudeSession = class {
   turnText = "";
   /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
   roomServer;
+  /** AbortController for the in-flight query(); abort() triggers it (queue timeout). */
+  _abort;
   /**
    * Queue an inbound message for the model.
    * @param opts.autoReplyOnText — for 1:1 DMs (where the owner always expects a
@@ -132448,11 +132475,22 @@ var PersistentClaudeSession = class {
     if (this.activeReply) await this.activeReply(text);
     else if (this.opts.onSay) await this.opts.onSay(text);
   }
+  /** Abort the in-flight query() — used by the worker queue on a per-task timeout. */
+  abort() {
+    this._abort?.abort();
+  }
   async *input() {
     while (true) {
-      const item = this.pending.length > 0 ? this.pending.shift() : await new Promise((resolve3) => {
-        this.waiting = resolve3;
-      });
+      let item;
+      if (this.pending.length > 0) {
+        item = this.pending.shift();
+      } else if (this.opts.ephemeral) {
+        return;
+      } else {
+        item = await new Promise((resolve3) => {
+          this.waiting = resolve3;
+        });
+      }
       this.activeReply = item.reply;
       this.currentAutoReply = item.autoReplyOnText ?? false;
       this.currentArmedGetter = item.armed ?? (() => false);
@@ -132484,6 +132522,8 @@ var PersistentClaudeSession = class {
     }
     const gateOpts = {
       dataDir: this.opts.dataDir ?? "",
+      workspaceDir: this.opts.workspaceDir,
+      osIsolated: this.opts.osIsolated ?? false,
       // LOAD-BEARING: tools are allowed when this is an owner DM turn
       // (currentAutoReply) OR an armed-room turn (currentArmedGetter()). An UNARMED
       // room turn keeps both false → the gate denies all tools but room_say.
@@ -132505,11 +132545,34 @@ var PersistentClaudeSession = class {
         });
       }
     };
+    console.error(
+      `[worker-gate] allowlist active \u2014 workspace=${this.opts.workspaceDir ?? "(none: file tools disabled)"}, bash=${this.opts.osIsolated ? "enabled (OS-isolated)" : "disabled"}`
+    );
     return {
       ...base,
       permissionMode: this.opts.permissionMode ?? "auto",
-      settingSources: ["user", "project"],
+      // FACET B (disk isolation). The workspace is writable under the Facet-A
+      // allowlist, so a prior worker/armed turn could plant config files in it that
+      // a later worker would otherwise ingest. We close each disk surface explicitly
+      // (they are governed SEPARATELY by the SDK, so one flag is not enough):
+      //   - settingSources:[] — "disable filesystem settings (SDK isolation mode)":
+      //     no ~/.claude or project settings.json (⇒ no settings-defined hooks, the
+      //     RCE-grade vector: a hook is a shell command run OUTSIDE the Bash gate),
+      //     no CLAUDE.md. It also means no .mcp.json APPROVAL state is loaded — and
+      //     enableAllProjectMcpServers/enabledMcpjsonServers live only in Settings —
+      //     so an unapproved project .mcp.json server is never spawned in headless
+      //     mode. Any MCP tool that WERE discovered is still denied by the Facet-A
+      //     allowlist (mcp__* is not room_say/a file tool/Bash → final deny).
+      //   - skills:[] — settingSources does NOT gate skills discovery; [] enables
+      //     zero skills, so a planted <ws>/.claude/skills/*/SKILL.md description
+      //     cannot be injected into the worker's context.
+      // Project context, if needed, is injected via the bridge-controlled systemPrompt,
+      // never auto-loaded from the mutable workspace.
+      settingSources: [],
+      skills: [],
       cwd: this.opts.workspaceDir,
+      ...this.opts.maxTurns != null ? { maxTurns: this.opts.maxTurns } : {},
+      abortController: this._abort,
       // PRIMARY gate: a PreToolUse hook fires on EVERY tool call regardless of
       // permissionMode. canUseTool alone is bypassed in "auto" mode (the SDK's
       // classifier auto-approves without hitting the "ask" path) — verified live.
@@ -132519,6 +132582,7 @@ var PersistentClaudeSession = class {
     };
   }
   async start() {
+    this._abort = new AbortController();
     this.roomServer = _s({
       name: "room",
       version: "0.2.0",
@@ -132550,6 +132614,96 @@ var PersistentClaudeSession = class {
   }
 };
 
+// src/worker-queue.ts
+var GENERIC_ERROR = "Sorry \u2014 I couldn't complete that request.";
+var WorkerQueue = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  q = [];
+  loop = Promise.resolve();
+  running = false;
+  enqueue(task) {
+    this.q.push(task);
+    if (!this.running) {
+      this.running = true;
+      this.loop = this.drain();
+    }
+  }
+  /** Resolves when the queue has processed everything enqueued so far. */
+  whenDrained() {
+    return this.loop;
+  }
+  async drain() {
+    try {
+      while (this.q.length > 0) {
+        const task = this.q.shift();
+        await this.runOne(task);
+      }
+    } finally {
+      this.running = false;
+    }
+  }
+  async runOne(task) {
+    let session;
+    let timer;
+    try {
+      session = this.deps.makeSession(task);
+      session.push(task.instruction, task.reply, {
+        autoReplyOnText: task.autoReplyOnText,
+        armed: task.armed
+      });
+      const currentSession = session;
+      const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+          currentSession.abort();
+          reject(new Error("worker task timeout"));
+        }, this.deps.timeoutMs);
+      });
+      await Promise.race([session.start(), timeout]);
+    } catch (e7) {
+      this.deps.log(`[worker-queue] task failed: ${e7.message}`);
+      session?.abort();
+      try {
+        await task.reply(GENERIC_ERROR);
+      } catch (replyErr) {
+        this.deps.log(`[worker-queue] failed to deliver error reply: ${replyErr.message}`);
+      }
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+};
+
+// src/router.ts
+function makeRouter(deps) {
+  return {
+    push(text, reply, opts) {
+      const replySink = reply ?? (() => {
+      });
+      if (deps.worker) {
+        const isOwnerDm = opts?.autoReplyOnText === true;
+        const isArmedRoom = opts?.armed?.() === true;
+        if (isOwnerDm) {
+          deps.queue.enqueue({ instruction: text, reply: replySink, autoReplyOnText: true });
+          return;
+        }
+        if (isArmedRoom) {
+          deps.queue.enqueue({
+            instruction: text,
+            reply: replySink,
+            autoReplyOnText: false,
+            armed: opts.armed
+          });
+          return;
+        }
+      }
+      deps.listener.push(text, reply, opts);
+    }
+  };
+}
+
 // src/arming.ts
 var ArmingState = class {
   armed = /* @__PURE__ */ new Set();
@@ -132913,7 +133067,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.5.6" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.5.8" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   if (cfg.worker) {
     console.error(`[bridge] WORKER MODE \u2014 workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
@@ -132939,9 +133093,14 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node"
   });
-  const session = new PersistentClaudeSession({
+  const agentSystemPrompt = cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`;
+  const deviceJwt = () => {
+    const c4 = channel;
+    return c4._deviceJwt ?? c4._persisted?.deviceJwt ?? null;
+  };
+  const listener = new PersistentClaudeSession({
     model: cfg.model,
-    systemPrompt: cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`,
+    systemPrompt: agentSystemPrompt,
     // Claude speaks by calling the say tool → the session routes it to the reply
     // bound to the message being answered (wireBridge captures that per inbound via
     // ActiveTarget.snapshotReply, which also logs the "said to …" line). This
@@ -132949,22 +133108,35 @@ async function main() {
     // room when room traffic arrives mid-compose.
     // Assistant reasoning that wasn't sent — log a short trace only.
     onObserve: (text) => console.error(`[bridge] observed (${text.length} chars, not sent)`),
-    worker: cfg.worker,
-    workspaceDir: cfg.workspaceDir,
-    permissionMode: cfg.permissionMode,
-    dataDir: cfg.dataDir,
-    // Slice 2 Plan B: audit self-report context (only used on armed-room turns).
-    roomId: cfg.roomFilter,
-    agentId: channel.deviceId,
-    apiUrl: cfg.apiUrl,
-    deviceJwt: () => {
-      const c4 = channel;
-      return c4._deviceJwt ?? c4._persisted?.deviceJwt ?? null;
-    }
+    worker: false
   });
+  const WORKER_MAX_TURNS = 20;
+  const WORKER_TIMEOUT_MS = 5 * 6e4;
+  const workerQueue = new WorkerQueue({
+    makeSession: (task) => new PersistentClaudeSession({
+      model: cfg.model,
+      systemPrompt: agentSystemPrompt,
+      onObserve: (text) => console.error(`[worker] observed (${text.length} chars, not sent)`),
+      worker: true,
+      ephemeral: true,
+      maxTurns: WORKER_MAX_TURNS,
+      workspaceDir: cfg.workspaceDir,
+      osIsolated: cfg.osIsolated,
+      permissionMode: cfg.permissionMode,
+      dataDir: cfg.dataDir,
+      // Slice 2 Plan B audit self-report — only fires on armed-room tasks (isArmedTurn).
+      roomId: cfg.roomFilter,
+      agentId: channel.deviceId,
+      apiUrl: cfg.apiUrl,
+      deviceJwt
+    }),
+    timeoutMs: WORKER_TIMEOUT_MS,
+    log: (m6) => console.error(m6)
+  });
+  const router = makeRouter({ worker: !!cfg.worker, listener, queue: workerQueue });
   wireBridge(
     channel,
-    { push: (t7, reply, opts) => session.push(t7, reply, opts) },
+    { push: (t7, reply, opts) => router.push(t7, reply, opts) },
     target,
     {
       roomFilter: cfg.roomFilter,
@@ -132984,7 +133156,11 @@ async function main() {
     "room_joined",
     (e7) => console.error(`[bridge] joined room ${e7.name} (${e7.roomId})`)
   );
-  await Promise.all([channel.start(), session.start()]);
+  listener.start().catch((err) => {
+    console.error("[bridge] fatal:", err);
+    process.exit(1);
+  });
+  await channel.start();
 }
 main().catch((err) => {
   console.error("[bridge] fatal:", err);

package/dist/router.d.ts

@@ -0,0 +1,30 @@
+import type { ReplySink } from "./session.js";
+import type { WorkerTask } from "./worker-queue.js";
+/** The push interface wireBridge drives (matches PersistentClaudeSession.push). */
+export interface PushLike {
+    push(text: string, reply?: ReplySink, opts?: {
+        autoReplyOnText?: boolean;
+        armed?: () => boolean;
+    }): void;
+}
+export interface RouterDeps {
+    /** AV_WORKER=1 → tool-eligible turns run in isolated workers; false → no worker ever. */
+    worker: boolean;
+    /** Always-on locked listener (tools:[]) for untrusted/non-tool turns. */
+    listener: PushLike;
+    /** Serial queue of tool-eligible turns. */
+    queue: {
+        enqueue(task: WorkerTask): void;
+    };
+}
+/**
+ * Route each inbound turn to EXACTLY ONE lane (facet B). Tool-eligible turns —
+ * owner DMs (autoReplyOnText) and armed room turns — go to an isolated ephemeral
+ * worker via the queue; everything else stays on the locked listener. A room
+ * turn's `armed` getter is read once here at routing time to pick the lane; the
+ * same live getter is threaded to the worker task so a mid-turn disarm still
+ * denies the next tool call (Facet A D5). Locked agents (worker=false) always
+ * route to the listener — a strict no-op vs today.
+ */
+export declare function makeRouter(deps: RouterDeps): PushLike;
+//# sourceMappingURL=router.d.ts.map

package/dist/session.d.ts

@@ -45,7 +45,7 @@ export type QueryFn = (args: {
     type: string;
     [k: string]: unknown;
 }>;
-type ReplySink = (text: string) => void | Promise<void>;
+export type ReplySink = (text: string) => void | Promise<void>;
 export interface SessionOpts {
     /** Fallback reply sink when a message carries no per-message reply (e.g. a
      *  proactive say). Per-message replies passed to push() take precedence. */
@@ -60,6 +60,8 @@ export interface SessionOpts {
     worker?: boolean;
     /** Workspace directory to set as cwd in worker mode. */
     workspaceDir?: string;
+    /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
+    osIsolated?: boolean;
     /** Claude permission mode for worker turns (default: "auto"). */
     permissionMode?: "auto" | "acceptEdits" | "bypassPermissions";
     /** AgentVault data directory — fenced off from worker tool access. */
@@ -71,6 +73,12 @@ export interface SessionOpts {
     apiUrl?: string;
     /** Lazy getter so a JWT refreshed after construction is still picked up. */
     deviceJwt?: () => string | null;
+    /** Single-shot ephemeral worker: process exactly the pushed message(s) then
+     *  terminate the input stream so start() resolves. Used by the worker queue so
+     *  a per-task query() completes and its state is discarded. */
+    ephemeral?: boolean;
+    /** Turn cap for a worker query() (bounds a runaway tool loop). */
+    maxTurns?: number;
 }
 export declare class PersistentClaudeSession {
     private opts;
@@ -103,6 +111,8 @@ export declare class PersistentClaudeSession {
     private turnText;
     /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
     private roomServer;
+    /** AbortController for the in-flight query(); abort() triggers it (queue timeout). */
+    private _abort?;
     constructor(opts: SessionOpts);
     /**
      * Queue an inbound message for the model.
@@ -124,6 +134,8 @@ export declare class PersistentClaudeSession {
      *  back to opts.onSay. This is what closes the DM→room leak: the destination is
      *  the one captured for the message being answered, not a live global target. */
     deliver(text: string): Promise<void>;
+    /** Abort the in-flight query() — used by the worker queue on a per-task timeout. */
+    abort(): void;
     private input;
     /**
      * Build the SDK options for this session. Locked mode (default) is safe for
@@ -134,5 +146,4 @@ export declare class PersistentClaudeSession {
     private buildSdkOptions;
     start(): Promise<void>;
 }
-export {};
 //# sourceMappingURL=session.d.ts.map

package/dist/worker-permission.d.ts

@@ -8,6 +8,10 @@ import type { CanUseTool, HookCallbackMatcher } from "@anthropic-ai/claude-agent
  */
 export declare function makeWorkerPreToolUseHook(opts: {
     dataDir: string;
+    /** The confined workspace root; file tools are denied entirely when unset. */
+    workspaceDir?: string;
+    /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
+    osIsolated: boolean;
     isToolTurn: () => boolean;
     /** Slice 2 Plan B: true when this turn comes from an armed room. When set,
      *  each tool decision (allow AND deny) is forwarded to onToolDecision for
@@ -27,6 +31,10 @@ export declare function makeWorkerPreToolUseHook(opts: {
  */
 export declare function makeWorkerPermission(opts: {
     dataDir: string;
+    /** The confined workspace root; file tools are denied entirely when unset. */
+    workspaceDir?: string;
+    /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
+    osIsolated: boolean;
     isToolTurn: () => boolean;
 }): CanUseTool;
 //# sourceMappingURL=worker-permission.d.ts.map

package/dist/worker-queue.d.ts

@@ -0,0 +1,41 @@
+import type { PersistentClaudeSession, ReplySink } from "./session.js";
+/** One tool-eligible turn to run in an isolated ephemeral worker. */
+export type WorkerTask = {
+    /** The single instruction that seeds the worker's conversation. */
+    instruction: string;
+    /** Where this task's reply (room_say / #416 fallback) is sent. Per-task. */
+    reply: ReplySink;
+    /** Owner-DM turns want a plain-text reply fallback (#416). */
+    autoReplyOnText: boolean;
+    /** Armed-room turns: live getter the gate reads per tool decision (mid-turn
+     *  disarm denies the next call). Absent for owner DMs. */
+    armed?: () => boolean;
+};
+export interface WorkerQueueDeps {
+    /** Build a fresh ephemeral worker session for this task (not yet started). */
+    makeSession: (task: WorkerTask) => PersistentClaudeSession;
+    /** Per-task wall-clock cap; on breach the worker is aborted and the queue advances. */
+    timeoutMs: number;
+    log: (m: string) => void;
+}
+/**
+ * Serial FIFO of tool-eligible turns. One worker runs at a time (concurrent tool
+ * calls against one device/workspace can interleave destructively; the owner is a
+ * single actor). Each task runs in a fresh ephemeral worker seeded with only its
+ * instruction; on error or timeout the worker is torn down, a generic message is
+ * sent to the task's reply, and the queue advances — a task can never wedge the
+ * queue (which would starve the owner's DM lane).
+ */
+export declare class WorkerQueue {
+    private deps;
+    private q;
+    private loop;
+    private running;
+    constructor(deps: WorkerQueueDeps);
+    enqueue(task: WorkerTask): void;
+    /** Resolves when the queue has processed everything enqueued so far. */
+    whenDrained(): Promise<void>;
+    private drain;
+    private runOne;
+}
+//# sourceMappingURL=worker-queue.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",