@agentvault/claude-bridge 0.5.7 → 0.5.10

package/dist/arming.d.ts

@@ -10,24 +10,54 @@ export declare class ArmingState {
     private pending;
     private consumed;
     /**
-     * Replace the armed set. Use ONLY for the launch-env seed (AV_ARM_ROOM), which
-     * is itself a host-local action and is therefore allowed to arm.
+     * Replace the armed set. Use for the host-local launch seed (AV_ARM_ROOM) —
+     * itself a host-local action and therefore allowed to arm — and as the
+     * primitive `applyAuthoritative` below delegates to for non-shell workers.
      *
-     * Do NOT use this for the backend connect `arming_snapshot`: that snapshot
-     * reflects owner *intent* (set at web-request time, before any local approval),
-     * so arming from it would let a web-session compromise arm a worker on reconnect
-     * without host access — defeating the 2-of-2 local-approval model. The channel
-     * snapshot path uses `reconcileDisarm` (disarm-only) instead.
+     * The B-pure posture (Task 4) treats the backend connect/live
+     * `arming_snapshot` the same way — see `applyAuthoritative`'s docstring for
+     * the current arm-from-snapshot rationale. Shell-capable (OS-isolated)
+     * workers do NOT use this path; they stay on `reconcileDisarm` (disarm-only,
+     * see below) until #20.
      */
     applySnapshot(roomIds: string[]): void;
     /**
-     * Disarm-only reconciliation from the backend connect snapshot. Disarms any
-     * currently-armed room whose intent is no longer armed (i.e. NOT in
-     * `intendedArmed`) — so a disarm issued while the bridge was offline still takes
-     * effect on reconnect — but NEVER arms a room. Arming stays exclusively behind a
-     * local `approve-arm`. Returns the rooms that were disarmed. In-memory arming
-     * survives a WS reconnect, so a genuinely-approved arm is unaffected here; only a
-     * full process restart (which clears this state) requires re-approval on the host.
+     * Set the armed set to EXACTLY `intendedArmed`: arms every room in the list
+     * that isn't already armed, and disarms every currently-armed room that is
+     * absent from it. This is the AUTHORITATIVE arm-from-snapshot path (Task 4,
+     * reversing the prior disarm-only safeguard for non-shell workers).
+     *
+     * Why arming from the snapshot is now safe: `intendedArmed` is derived
+     * server-side from `devices.work_allowed`, and that flag can only be flipped
+     * by `PUT /devices/{id}/work_allowed`, which REJECTS any device-bound caller
+     * outright (C1 guard — a human account owner only; an agent, including a
+     * compromised one, cannot self-authorize). So "arm from snapshot" no longer
+     * means "a web session can arm a worker" in the old adversarial sense — it
+     * means "the verified owner's grant is applied end-to-end, live, without
+     * requiring a separate host-local approval step for every reconnect." This is
+     * the accepted B-pure posture; see #20 to harden it further with local
+     * approval for non-shell workers too. Shell-capable (OS-isolated) workers are
+     * carved out of this path entirely (C2) — see the shell-gate in bridge.ts —
+     * because a shell worker armed by a web flag is a live RCE surface even under
+     * an honest owner (a compromised owner web session, or a compromised backend,
+     * would get arbitrary code execution). Those workers stay on `reconcileDisarm`
+     * (disarm-only) until #20 delivers local approval for them as well.
+     */
+    applyAuthoritative(intendedArmed: string[]): void;
+    /**
+     * Disarm-only reconciliation from the backend connect/live snapshot. Disarms
+     * any currently-armed room whose intent is no longer armed (i.e. NOT in
+     * `intendedArmed`) — so a disarm issued while the bridge was offline still
+     * takes effect on reconnect — but NEVER arms a room. Used for OS-isolated
+     * (shell-capable) workers ONLY (C2): a shell worker must never be armed by a
+     * web-originated flag, because a compromised owner session or backend would
+     * translate directly into host code execution. Those workers can be armed
+     * only by the host-local launch seed (`AV_ARM_ROOM`, via `applySnapshot`)
+     * until #20 delivers a local-approval path for them too. Non-shell workers
+     * use `applyAuthoritative` instead (Task 4) — see its docstring. Returns the
+     * rooms that were disarmed. In-memory arming survives a WS reconnect, so a
+     * genuinely-armed room is unaffected here; only a full process restart
+     * (which clears this state) requires re-arming.
      */
     reconcileDisarm(intendedArmed: string[]): string[];
     isArmed(roomId: string): boolean;

package/dist/bridge.d.ts

@@ -3,6 +3,13 @@ export interface RoomMessage {
     roomId: string;
     senderName: string;
     plaintext: string;
+    /** True when the sender is another agent (SecureChannel derives this from the
+     *  room roster). Used to decide reply expectation: a human/owner speaking in a
+     *  room always expects a reply; agent-authored traffic does not (the agent may
+     *  stay silent, and it prevents agent↔agent reply loops). Absent on older
+     *  payloads / tests → treated as "not an agent" is NOT assumed: replyExpected is
+     *  set only when we affirmatively know the sender is a human (=== false). */
+    senderIsAgent?: boolean;
 }
 /** Slice 2 Plan C arming events (SecureChannel re-emits these from the backend). */
 export interface ArmRequested {
@@ -15,6 +22,10 @@ export interface DisarmEvent {
 }
 export interface ArmingSnapshot {
     roomIds: string[];
+    /** Task 3 (P1 bridge): the device-level owner grant this snapshot carries
+     *  (backend `devices.work_allowed`, Task 2). Optional so older/test payloads
+     *  without it don't break — treated as `false` (fail-closed) when absent. */
+    workAllowed?: boolean;
 }
 /** Metadata SecureChannel attaches to a 1:1 `message` event. `roomId` is set only
  *  when the `message` actually originated in a room (handled by room_message), so
@@ -37,6 +48,11 @@ export interface RoomChannel {
     on(ev: "arm_requested", cb: (e: ArmRequested) => void): unknown;
     on(ev: "disarm", cb: (e: DisarmEvent) => void): unknown;
     on(ev: "arming_snapshot", cb: (e: ArmingSnapshot) => void): unknown;
+    /** Task 3: SecureChannel's connection lifecycle signal. It never emits a
+     *  bare `"close"` — a WS drop is reported as `state` moving to
+     *  `"disconnected"` (or `"error"`), and a completed reconnect as `"ready"`
+     *  (both the dedicated `state` value AND the separate `"ready"` event). */
+    on(ev: "state", cb: (s: string) => void): unknown;
     sendToRoom(roomId: string, text: string): Promise<void>;
     send(text: string): Promise<void>;
     /** Optional so legacy/test fakes without arming support don't break wiring. */
@@ -59,9 +75,12 @@ export interface RoomSession {
     /** `reply` is the immutable reply sink captured for THIS message (see
      *  ActiveTarget.snapshotReply) — the session invokes it when Claude answers.
      *  `opts.autoReplyOnText` (set for 1:1 DMs) makes the session fall back to
-     *  sending plain assistant text when the model never calls the say tool (#416). */
+     *  sending plain assistant text when the model never calls the say tool (#416).
+     *  `opts.replyExpected` requests that same fallback for a room turn (a human/owner
+     *  sender) WITHOUT enabling tools — decoupled from autoReplyOnText on purpose. */
     push(text: string, reply?: (text: string) => Promise<void>, opts?: {
         autoReplyOnText?: boolean;
+        replyExpected?: boolean;
         armed?: () => boolean;
     }): void;
 }
@@ -148,11 +167,28 @@ export declare function wireBridge(channel: RoomChannel, session: RoomSession, t
     roomFilter?: string;
     armRoom?: boolean;
     log?: (msg: string) => void;
-    /** Slice 2 Plan C (T11): worker capability + local-approval marker dir. */
-    worker?: boolean;
+    /** Slice 2 Plan C (T11): worker capability (derived from workspaceDir) + local-approval marker dir. */
     workspaceDir?: string;
     dataDir?: string;
     /** Override the approval poll interval (ms) — for tests. */
     approvalPollMs?: number;
+    /**
+     * Task 4 (C2 shell-gate): true when this worker runs Bash unconfined
+     * (AV_WORKER_OS_ISOLATED=1 — see config.ts/index.ts, threaded from the
+     * session's `osIsolated`). When true, the `arming_snapshot` handler stays
+     * disarm-only regardless of B1/worker-capability — a shell worker must
+     * never be armed by a web-originated flag (RCE risk). Falls back to
+     * reading the env directly only if the caller doesn't thread this.
+     */
+    osIsolated?: boolean;
+    /**
+     * Task 3 (P1 bridge): out-param that receives the live `workAllowed()`
+     * getter once, synchronously, during wiring. Callers (index.ts, Task 4)
+     * capture it to thread device-level tool-capability into the router +
+     * session gate. Kept as an out-param rather than changing wireBridge's
+     * return type so every existing `const arming = wireBridge(...)` caller
+     * (index.ts, arming-authoritative.test.ts, bridge.test.ts) stays intact.
+     */
+    onWorkAllowed?: (getter: () => boolean) => void;
 }): ArmingState;
 //# sourceMappingURL=bridge.d.ts.map

package/dist/config.d.ts

@@ -14,8 +14,9 @@ export interface BridgeConfig {
     roomFilter?: string;
     model?: string;
     systemPrompt?: string;
-    worker: boolean;
-    workspaceDir?: string;
+    /** Per-agent filesystem sandbox (Facet-A fence). Always set: auto-defaults
+     *  to a sibling of the key/data dir (H-2) unless AV_WORKSPACE_DIR overrides it. */
+    workspaceDir: string;
     permissionMode: "auto" | "acceptEdits" | "bypassPermissions";
     /** Slice 2: arm the pinned room (roomFilter) for worker tools on room turns.
      *  Off by default. Valid only with worker + roomFilter + workspaceDir. */