@agentvault/claude-bridge 0.5.7 → 0.5.10

package/dist/index.js

@@ -10,8 +10,8 @@ var __export = (target, all) => {
 };
 
 // src/config.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync, readFileSync as readFileSync2, mkdirSync, chmodSync } from "node:fs";
+import { join as join5, resolve as resolve2, sep, dirname } from "node:path";
 function hasRecoverableBackup(dataDir) {
   try {
     const parsed = JSON.parse(readFileSync2(join5(dataDir, BACKUP_FILE), "utf-8"));
@@ -38,8 +38,22 @@ function resolveDataDir(env) {
 function loadConfig(env, argv = []) {
   const { dataDir, source: dataDirSource } = resolveDataDir(env);
   const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || "";
-  const worker = env.AV_WORKER === "1" || env.AV_WORKER === "true";
-  const workspaceDir = env.AV_WORKSPACE_DIR || void 0;
+  const workspaceDir = env.AV_WORKSPACE_DIR || join5(dirname(dataDir), "workspaces", slugify2(env.AV_AGENT_NAME ?? "claude"));
+  const wsReal = resolve2(workspaceDir);
+  const ddReal = resolve2(dataDir);
+  if (wsReal === ddReal || wsReal.startsWith(ddReal + sep) || ddReal.startsWith(wsReal + sep)) {
+    throw new Error(
+      `AV_WORKSPACE_DIR (${workspaceDir}) must be disjoint from the data dir (${dataDir})`
+    );
+  }
+  try {
+    mkdirSync(workspaceDir, { recursive: true, mode: 448 });
+    chmodSync(workspaceDir, 448);
+  } catch (e7) {
+    throw new Error(
+      `Failed to create/secure the agent workspace at ${workspaceDir} (override with AV_WORKSPACE_DIR): ${e7.message}`
+    );
+  }
   const osIsolated = env.AV_WORKER_OS_ISOLATED === "1" || env.AV_WORKER_OS_ISOLATED === "true";
   const PERMISSION_MODES = ["auto", "acceptEdits", "bypassPermissions"];
   const permissionMode = env.AV_PERMISSION_MODE ?? "auto";
@@ -48,16 +62,8 @@ function loadConfig(env, argv = []) {
       `invalid AV_PERMISSION_MODE: ${env.AV_PERMISSION_MODE} (expected one of ${PERMISSION_MODES.join(", ")})`
     );
   }
-  if (worker && !workspaceDir) {
-    throw new Error(
-      "worker mode requires AV_WORKSPACE_DIR (the project directory the agent works in)"
-    );
-  }
   const armRoom = env.AV_ARM_ROOM === "1" || env.AV_ARM_ROOM === "true";
   if (armRoom) {
-    if (!worker) {
-      throw new Error("AV_ARM_ROOM requires worker mode (AV_WORKER=1)");
-    }
     if (!env.AV_ROOM_ID) {
       throw new Error("AV_ARM_ROOM requires a pinned room (AV_ROOM_ID) \u2014 the armed collaboration room");
     }
@@ -82,7 +88,6 @@ function loadConfig(env, argv = []) {
     roomFilter: env.AV_ROOM_ID || void 0,
     model: env.AV_CLAUDE_MODEL || void 0,
     systemPrompt: env.AV_SYSTEM_PROMPT || void 0,
-    worker,
     workspaceDir,
     permissionMode,
     armRoom,
@@ -99,7 +104,7 @@ var init_config = __esm({
 });
 
 // src/service/launcher.ts
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 function sq2(s10) {
   return `'${s10.replace(/'/g, `'\\''`)}'`;
 }
@@ -124,7 +129,7 @@ function renderLauncher(opts) {
   return lines.join("\n") + "\n";
 }
 function writeLauncher(deps, spec) {
-  deps.mkdir(dirname2(spec.launcherPath));
+  deps.mkdir(dirname3(spec.launcherPath));
   deps.writeFile(spec.launcherPath, spec.launcherScript);
   deps.chmod(spec.launcherPath, 493);
 }
@@ -158,7 +163,6 @@ function buildServiceSpec(cfg, opts) {
     AV_API_URL: cfg.apiUrl,
     AV_PERMISSION_MODE: cfg.permissionMode
   };
-  if (cfg.worker) env.AV_WORKER = "1";
   if (cfg.workspaceDir) env.AV_WORKSPACE_DIR = cfg.workspaceDir;
   if (cfg.roomFilter) env.AV_ROOM_ID = cfg.roomFilter;
   if (cfg.armRoom) env.AV_ARM_ROOM = "1";
@@ -171,7 +175,7 @@ function buildServiceSpec(cfg, opts) {
     launcherPath,
     launcherScript: renderLauncher({ installPath: opts.path, entrypoint: opts.entrypoint }),
     env,
-    workingDir: cfg.worker && cfg.workspaceDir ? cfg.workspaceDir : opts.home,
+    workingDir: cfg.workspaceDir ? cfg.workspaceDir : opts.home,
     logOut: join7(cfg.dataDir, "logs", "bridge.log"),
     logErr: join7(cfg.dataDir, "logs", "bridge.error.log"),
     keepAliveUnlessCleanExit: true,
@@ -187,7 +191,7 @@ var init_spec = __esm({
 });
 
 // src/service/launchd.ts
-import { dirname as dirname3, join as join8 } from "node:path";
+import { dirname as dirname4, join as join8 } from "node:path";
 function esc3(s10) {
   return s10.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -241,9 +245,9 @@ var init_launchd = __esm({
       }
       install(spec) {
         const path2 = this.plistPath(spec.label);
-        this.deps.mkdir(dirname3(spec.logOut));
+        this.deps.mkdir(dirname4(spec.logOut));
         writeLauncher(this.deps, spec);
-        this.deps.mkdir(dirname3(path2));
+        this.deps.mkdir(dirname4(path2));
         this.deps.writeFile(path2, renderLaunchdPlist(spec));
         const svc = `${this.domain()}/${spec.label}`;
         this.deps.exec("launchctl", ["bootout", svc]);
@@ -277,7 +281,7 @@ var init_launchd = __esm({
 });
 
 // src/service/systemd.ts
-import { dirname as dirname4, join as join9 } from "node:path";
+import { dirname as dirname5, join as join9 } from "node:path";
 function q5(s10) {
   const esc4 = s10.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/%/g, "%%");
   return `"${esc4}"`;
@@ -318,9 +322,9 @@ var init_systemd = __esm({
       }
       install(spec) {
         const path2 = this.unitPath(spec.label);
-        this.deps.mkdir(dirname4(spec.logOut));
+        this.deps.mkdir(dirname5(spec.logOut));
         writeLauncher(this.deps, spec);
-        this.deps.mkdir(dirname4(path2));
+        this.deps.mkdir(dirname5(path2));
         this.deps.writeFile(path2, renderSystemdUnit(spec));
         this.deps.exec("loginctl", ["enable-linger", this.deps.user]);
         this.deps.exec("systemctl", ["--user", "daemon-reload"]);
@@ -345,7 +349,7 @@ var init_systemd = __esm({
 
 // src/service/backend.ts
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, rmSync as rmSync3, existsSync as existsSync4, chmodSync } from "node:fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, rmSync as rmSync3, existsSync as existsSync4, chmodSync as chmodSync2 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -357,8 +361,8 @@ function defaultDeps() {
       return { code: r7.status ?? 1, stdout: r7.stdout ?? "" };
     },
     writeFile: (p2, d10) => writeFileSync2(p2, d10),
-    mkdir: (p2) => mkdirSync3(p2, { recursive: true }),
-    chmod: (p2, m6) => chmodSync(p2, m6),
+    mkdir: (p2) => mkdirSync4(p2, { recursive: true }),
+    chmod: (p2, m6) => chmodSync2(p2, m6),
     rm: (p2) => rmSync3(p2, { force: true }),
     exists: (p2) => existsSync4(p2)
   };
@@ -589,7 +593,7 @@ var init_libsodium_sumo = __esm2({
       }
     }
     _Module = Module;
-    Module.ready = new Promise(function(resolve3, reject) {
+    Module.ready = new Promise(function(resolve32, reject) {
       var Module2 = _Module;
       Module2.onAbort = reject;
       Module2.print = function(what) {
@@ -601,7 +605,7 @@ var init_libsodium_sumo = __esm2({
       Module2.onRuntimeInitialized = function() {
         try {
           Module2._crypto_secretbox_keybytes();
-          resolve3();
+          resolve32();
         } catch (err2) {
           reject(err2);
         }
@@ -54446,8 +54450,8 @@ var init_mutex = __esm2({
       }
       async lock() {
         let releaseLock;
-        const nextLock = new Promise((resolve3) => {
-          releaseLock = resolve3;
+        const nextLock = new Promise((resolve32) => {
+          releaseLock = resolve32;
         });
         const previousLock = __classPrivateFieldGet(this, _Mutex_locked, "f");
         __classPrivateFieldSet(this, _Mutex_locked, nextLock, "f");
@@ -65246,6 +65250,58 @@ var init_channel = __esm2({
         }
         return void 0;
       }
+      /**
+       * True when a conversation is NOT a genuine 1:1 owner DM — i.e. it belongs to a
+       * room OR an A2A channel — and therefore must NEVER surface to the native worker
+       * tool-gate as a no-roomId `message` (the gate treats that as an authenticated
+       * owner DM, tool-enabled, bypassing arming). This is the predicate every fallback
+       * emit guard uses (MLS 1:1, DR-delivery queue, HTTP poll).
+       *
+       * Resolves from LOCAL persisted state — BOTH `_persisted.rooms[*].conversationIds`
+       * and `_persisted.a2aChannels[*].conversationId` — and accepts EITHER the
+       * conversation id or the conversation-group id, so a convGroupId-only room/A2A
+       * payload is still caught while a genuine convGroupId-only 1:1 shared-group DM
+       * (present in neither map) still returns false and emits.
+       *
+       * Some fallback guards additionally honor an AUTHORITATIVE server routing field as
+       * a backstop for the cold-local-state window — but WHICH field each carries differs
+       * per endpoint, so do NOT assume a blanket "backend always populates room_id/
+       * a2a_channel_id" at a new call site:
+       *   - HTTP poll (`/devices/{id}/messages`): server `room_id` populated for room-backed
+       *     convs (conv_room_map). No `a2a_channel_id` on this endpoint → A2A caught locally.
+       *   - DR-delivery (`/dr/delivery` -> dr_delivery_service.pull_pending): server `room_id`
+       *     populated (from the conversation); NO `a2a_channel_id` (DrDeliveryQueue is
+       *     1:1-only, never A2A). room_id is null in practice today but real for any future
+       *     room-over-DR row.
+       *   - MLS 1:1 (`_handleMessageMLS`): room/A2A are routed away UPSTREAM at the
+       *     MLS-delivery dispatcher (authoritative `room_id`/`a2a_channel_id`) before this
+       *     handler; the fields are absent on `data` here, so this predicate is the belt.
+       * The MLS-delivery *queue* endpoint (mls_delivery_service.pull_pending) is the one that
+       * returns all of room_id/a2a_channel_id/conversation_group_id — but that feeds the
+       * dispatcher, not these emit guards directly.
+       *
+       * No fail-closed drop-unknown guard is used: that would risk dropping a legitimate
+       * 1:1 owner DM that arrives before room/A2A hydration (a North-Star violation). The
+       * reachable residual (truly-cold local state AND the server omitting its routing field
+       * on a room/A2A row) is empty today because the only paths that carry room/A2A rows
+       * (poll + MLS dispatcher) always populate the field; DR-delivery and sync are
+       * structurally 1:1-only.
+       */
+      _isNonDmConversation(convId, convGroupId) {
+        const ids = [convId, convGroupId].filter((x22) => !!x22);
+        if (ids.length === 0) return false;
+        if (this._persisted?.rooms) {
+          for (const room of Object.values(this._persisted.rooms)) {
+            if (room.conversationIds?.some((c22) => ids.includes(c22))) return true;
+          }
+        }
+        if (this._persisted?.a2aChannels) {
+          for (const ch2 of Object.values(this._persisted.a2aChannels)) {
+            if (ch2.conversationId && ids.includes(ch2.conversationId)) return true;
+          }
+        }
+        return false;
+      }
       /**
        * Get recent message history for a specific room, for LLM context injection.
        * Returns the last N messages tagged with `room:{roomId}`.
@@ -65499,7 +65555,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.3" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.7" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -65575,7 +65631,7 @@ var init_channel = __esm2({
        * Optional timeout rejects with an Error.
        */
       waitForDecision(decisionId, timeoutMs) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve32, reject) => {
           let timer = null;
           const handler = (plaintext, metadata) => {
             if (metadata.messageType !== "decision_response") return;
@@ -65584,7 +65640,7 @@ var init_channel = __esm2({
               if (parsed.decision?.decision_id === decisionId) {
                 if (timer) clearTimeout(timer);
                 this.removeListener("message", handler);
-                resolve3({
+                resolve32({
                   decision_id: parsed.decision.decision_id,
                   selected_option_id: parsed.decision.selected_option_id,
                   resolved_at: parsed.decision.resolved_at,
@@ -67116,7 +67172,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.3" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.7" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67366,7 +67422,10 @@ var init_channel = __esm2({
               this.emit("disarm", { roomId: data.data?.room_id });
             }
             if (data.event === "arming_snapshot") {
-              this.emit("arming_snapshot", { roomIds: data.data?.room_ids ?? [] });
+              this.emit("arming_snapshot", {
+                workAllowed: data.data?.work_allowed === true,
+                roomIds: data.data?.room_ids ?? []
+              });
             }
             if (data.event === "policy_blocked") {
               this.emit("policy_blocked", data.data);
@@ -67426,7 +67485,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.3" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.7" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -67886,6 +67945,10 @@ var init_channel = __esm2({
             return;
           }
           if (messageType === "history_catchup_response") return;
+          if (data.room_id || data.a2a_channel_id || this._isNonDmConversation(convId, convGroupId)) {
+            console.warn(`[SecureChannel] Dropped 1:1 MLS emit for non-DM conv ${(convId ?? convGroupId ?? "?").slice(0, 8)} (room/A2A guard)`);
+            return;
+          }
           if (convId) {
             const session = this._sessions.get(convId);
             if (session && !session.activated) {
@@ -68732,7 +68795,12 @@ ${messageText}`;
             senderName: senderLabel,
             plaintext: messageText,
             messageType,
-            timestamp: data.created_at ?? (/* @__PURE__ */ new Date()).toISOString()
+            timestamp: data.created_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+            // Native bridge (claude-room-bridge) consumes this to decide reply
+            // expectation: a human/owner speaking in a room always expects a reply,
+            // an agent does not. Derived from the room roster (line ~5394) — the same
+            // signal the OpenClaw mention-filter uses for loop prevention.
+            senderIsAgent
           });
           const contextualMessage = senderIsAgent ? messageText : `[${senderLabel}]: ${messageText}`;
           Promise.resolve(this.config.onMessage?.(contextualMessage, metadata)).catch((err) => {
@@ -69856,16 +69924,7 @@ ${messageText}`;
                 ackedIds.push(msg.queue_id);
                 continue;
               }
-              let isRoom = false;
-              if (this._persisted?.rooms) {
-                for (const room of Object.values(this._persisted.rooms)) {
-                  if (room.conversationIds?.includes(msg.conversation_id)) {
-                    isRoom = true;
-                    break;
-                  }
-                }
-              }
-              if (isRoom) {
+              if (msg.room_id || msg.a2a_channel_id || this._isNonDmConversation(msg.conversation_id, msg.conversation_group_id)) {
                 ackedIds.push(msg.queue_id);
                 continue;
               }
@@ -70508,7 +70567,7 @@ ${messageText}`;
               if (msg.sender_device_id === this._deviceId) continue;
               const session = this._sessions.get(msg.conversation_id);
               if (!session) continue;
-              if (this._roomIdForConversation(msg.conversation_id)) {
+              if (msg.room_id || this._isNonDmConversation(msg.conversation_id)) {
                 this._persisted.lastMessageTimestamp = msg.created_at;
                 continue;
               }
@@ -86826,7 +86885,7 @@ var init_protocol = __esm2({
               return;
             }
             const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-            await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
+            await new Promise((resolve32) => setTimeout(resolve32, pollInterval));
             options?.signal?.throwIfAborted();
           }
         } catch (error210) {
@@ -86843,7 +86902,7 @@ var init_protocol = __esm2({
        */
       request(request, resultSchema, options) {
         const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve32, reject) => {
           const earlyReject = (error210) => {
             reject(error210);
           };
@@ -86921,7 +86980,7 @@ var init_protocol = __esm2({
               if (!parseResult.success) {
                 reject(parseResult.error);
               } else {
-                resolve3(parseResult.data);
+                resolve32(parseResult.data);
               }
             } catch (error210) {
               reject(error210);
@@ -87182,12 +87241,12 @@ var init_protocol = __esm2({
           }
         } catch {
         }
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve32, reject) => {
           if (signal.aborted) {
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
             return;
           }
-          const timeoutId = setTimeout(resolve3, interval);
+          const timeoutId = setTimeout(resolve32, interval);
           signal.addEventListener("abort", () => {
             clearTimeout(timeoutId);
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -90172,7 +90231,7 @@ var require_compile = __commonJS({
       const schOrFunc = root3.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve3.call(this, root3, ref);
+      let _sch = resolve32.call(this, root3, ref);
       if (_sch === void 0) {
         const schema = (_a32 = root3.localRefs) === null || _a32 === void 0 ? void 0 : _a32[ref];
         const { schemaId } = this.opts;
@@ -90199,7 +90258,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s22) {
       return s1.schema === s22.schema && s1.root === s22.root && s1.baseId === s22.baseId;
     }
-    function resolve3(root3, ref) {
+    function resolve32(root3, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -90766,7 +90825,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve3(baseURI, relativeURI, options) {
+    function resolve32(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse32(baseURI, schemelessOptions), parse32(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -90993,7 +91052,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve3,
+      resolve: resolve32,
       resolveComponent,
       equal,
       serialize,
@@ -95013,7 +95072,7 @@ var init_mcp = __esm2({
         let task = createTaskResult.task;
         const pollInterval = task.pollInterval ?? 5e3;
         while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-          await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
+          await new Promise((resolve32) => setTimeout(resolve32, pollInterval));
           const updatedTask = await extra.taskStore.getTask(taskId);
           if (!updatedTask) {
             throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -95954,7 +96013,7 @@ var init_dist2 = __esm2({
             });
             if (!chunk) {
               if (i2 === 1) {
-                await new Promise((resolve3) => setTimeout(resolve3));
+                await new Promise((resolve32) => setTimeout(resolve32));
                 maxReadCount = 3;
                 continue;
               }
@@ -96454,9 +96513,9 @@ data:
           const initRequest = messages.find((m22) => isInitializeRequest(m22));
           const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
           if (this._enableJsonResponse) {
-            return new Promise((resolve3) => {
+            return new Promise((resolve32) => {
               this._streamMapping.set(streamId, {
-                resolveJson: resolve3,
+                resolveJson: resolve32,
                 cleanup: () => {
                   this._streamMapping.delete(streamId);
                 }
@@ -97173,7 +97232,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.3" : "0.0.0-dev";
+    VERSION = true ? "0.23.7" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -118477,21 +118536,21 @@ function Z_($10, Q4) {
 
 // src/worker-permission.ts
 import { realpathSync as realpathSync2 } from "node:fs";
-import { resolve as resolve2, dirname, basename, sep, isAbsolute } from "node:path";
+import { resolve as resolve3, dirname as dirname2, basename, sep as sep2, isAbsolute } from "node:path";
 var PATH_FIELDS = ["file_path", "path", "notebook_path"];
 function canonical(p2) {
-  const abs = resolve2(p2);
+  const abs = resolve3(p2);
   try {
     return realpathSync2(abs);
   } catch {
     const suffix = [];
     let dir = abs;
     for (; ; ) {
-      const parent2 = dirname(dir);
+      const parent2 = dirname2(dir);
       suffix.unshift(basename(dir));
       if (parent2 === dir) return abs;
       try {
-        return resolve2(realpathSync2(parent2), ...suffix);
+        return resolve3(realpathSync2(parent2), ...suffix);
       } catch {
         dir = parent2;
       }
@@ -118508,7 +118567,7 @@ function pathsOf(input) {
   return out;
 }
 function within(canonTarget, canonRoot) {
-  return canonTarget === canonRoot || canonTarget.startsWith(canonRoot + sep);
+  return canonTarget === canonRoot || canonTarget.startsWith(canonRoot + sep2);
 }
 function globPatternEscapes(pattern) {
   if (typeof pattern !== "string" || pattern.length === 0) return true;
@@ -132433,10 +132492,21 @@ var PersistentClaudeSession = class {
    *  disarm denies the very next tool call. wireBridge binds it to the ArmingState
    *  for this turn's room; an unarmed room turn's getter returns false. */
   currentArmedGetter = () => false;
+  /** Per-turn: does this turn's sender expect a reply? DECOUPLED from
+   *  `currentAutoReply` on purpose — it drives ONLY the #416 plain-text fallback
+   *  (deliver assistant text when the model never calls say), NOT the tool gate.
+   *  True for owner 1:1 DMs (defaults from autoReplyOnText) AND for a HUMAN/owner
+   *  speaking in a room (wireBridge sets replyExpected from !senderIsAgent). An
+   *  agent-authored room turn keeps this false → the agent may still stay silent,
+   *  which also prevents agent↔agent reply loops. Tool access is unaffected: it
+   *  stays gated on currentAutoReply (owner DM) OR currentArmedGetter (armed room). */
+  currentReplyExpected = false;
   saidThisTurn = false;
   turnText = "";
   /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
   roomServer;
+  /** AbortController for the in-flight query(); abort() triggers it (queue timeout). */
+  _abort;
   /**
    * Queue an inbound message for the model.
    * @param opts.autoReplyOnText — for 1:1 DMs (where the owner always expects a
@@ -132456,7 +132526,13 @@ var PersistentClaudeSession = class {
       parent_tool_use_id: null,
       session_id: ""
     };
-    const item = { msg, reply, autoReplyOnText: opts?.autoReplyOnText, armed: opts?.armed };
+    const item = {
+      msg,
+      reply,
+      autoReplyOnText: opts?.autoReplyOnText,
+      replyExpected: opts?.replyExpected,
+      armed: opts?.armed
+    };
     if (this.waiting) {
       const w2 = this.waiting;
       this.waiting = null;
@@ -132473,13 +132549,25 @@ var PersistentClaudeSession = class {
     if (this.activeReply) await this.activeReply(text);
     else if (this.opts.onSay) await this.opts.onSay(text);
   }
+  /** Abort the in-flight query() — used by the worker queue on a per-task timeout. */
+  abort() {
+    this._abort?.abort();
+  }
   async *input() {
     while (true) {
-      const item = this.pending.length > 0 ? this.pending.shift() : await new Promise((resolve3) => {
-        this.waiting = resolve3;
-      });
+      let item;
+      if (this.pending.length > 0) {
+        item = this.pending.shift();
+      } else if (this.opts.ephemeral) {
+        return;
+      } else {
+        item = await new Promise((resolve4) => {
+          this.waiting = resolve4;
+        });
+      }
       this.activeReply = item.reply;
       this.currentAutoReply = item.autoReplyOnText ?? false;
+      this.currentReplyExpected = item.replyExpected ?? item.autoReplyOnText ?? false;
       this.currentArmedGetter = item.armed ?? (() => false);
       this.saidThisTurn = false;
       this.turnText = "";
@@ -132517,7 +132605,13 @@ var PersistentClaudeSession = class {
       // D5: currentArmedGetter() is called HERE on every tool decision, so a
       // mid-turn disarm denies the next call. See worker-permission.test.ts +
       // session.test.ts for the covering assertions.
-      isToolTurn: () => this.currentAutoReply || this.currentArmedGetter(),
+      //
+      // Task 4 (C-1/H-3) HARD BACKSTOP: device-level `workAllowed()` is a top-level
+      // AND over BOTH signals — NO tool runs (owner DM OR armed room) when Work is
+      // off, even if the router ever mis-routed. `?? false` is the fail-closed
+      // default (no getter ⇒ no tools). Read LIVE per tool decision so a Work-off
+      // flip / fail-closed reconnect window denies the very next call.
+      isToolTurn: () => (this.opts.workAllowed?.() ?? false) && (this.currentAutoReply || this.currentArmedGetter()),
       // Slice 2 Plan B: emit an audit self-report for each tool decision on an
       // armed-room turn (both allow and deny). room_say is excluded by the hook.
       isArmedTurn: () => this.currentArmedGetter(),
@@ -132538,8 +132632,28 @@ var PersistentClaudeSession = class {
     return {
       ...base,
       permissionMode: this.opts.permissionMode ?? "auto",
-      settingSources: ["user", "project"],
+      // FACET B (disk isolation). The workspace is writable under the Facet-A
+      // allowlist, so a prior worker/armed turn could plant config files in it that
+      // a later worker would otherwise ingest. We close each disk surface explicitly
+      // (they are governed SEPARATELY by the SDK, so one flag is not enough):
+      //   - settingSources:[] — "disable filesystem settings (SDK isolation mode)":
+      //     no ~/.claude or project settings.json (⇒ no settings-defined hooks, the
+      //     RCE-grade vector: a hook is a shell command run OUTSIDE the Bash gate),
+      //     no CLAUDE.md. It also means no .mcp.json APPROVAL state is loaded — and
+      //     enableAllProjectMcpServers/enabledMcpjsonServers live only in Settings —
+      //     so an unapproved project .mcp.json server is never spawned in headless
+      //     mode. Any MCP tool that WERE discovered is still denied by the Facet-A
+      //     allowlist (mcp__* is not room_say/a file tool/Bash → final deny).
+      //   - skills:[] — settingSources does NOT gate skills discovery; [] enables
+      //     zero skills, so a planted <ws>/.claude/skills/*/SKILL.md description
+      //     cannot be injected into the worker's context.
+      // Project context, if needed, is injected via the bridge-controlled systemPrompt,
+      // never auto-loaded from the mutable workspace.
+      settingSources: [],
+      skills: [],
       cwd: this.opts.workspaceDir,
+      ...this.opts.maxTurns != null ? { maxTurns: this.opts.maxTurns } : {},
+      abortController: this._abort,
       // PRIMARY gate: a PreToolUse hook fires on EVERY tool call regardless of
       // permissionMode. canUseTool alone is bypassed in "auto" mode (the SDK's
       // classifier auto-approves without hitting the "ask" path) — verified live.
@@ -132549,6 +132663,7 @@ var PersistentClaudeSession = class {
     };
   }
   async start() {
+    this._abort = new AbortController();
     this.roomServer = _s({
       name: "room",
       version: "0.2.0",
@@ -132572,7 +132687,7 @@ var PersistentClaudeSession = class {
         }
       } else if (m6.type === "result") {
         const reply = this.activeReply;
-        if (this.currentAutoReply && !this.saidThisTurn && this.turnText.trim() && reply) {
+        if (this.currentReplyExpected && !this.saidThisTurn && this.turnText.trim() && reply) {
           void reply(this.turnText);
         }
       }
@@ -132580,6 +132695,101 @@ var PersistentClaudeSession = class {
   }
 };
 
+// src/worker-queue.ts
+var GENERIC_ERROR = "Sorry \u2014 I couldn't complete that request.";
+var WorkerQueue = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  q = [];
+  loop = Promise.resolve();
+  running = false;
+  enqueue(task) {
+    this.q.push(task);
+    if (!this.running) {
+      this.running = true;
+      this.loop = this.drain();
+    }
+  }
+  /** Resolves when the queue has processed everything enqueued so far. */
+  whenDrained() {
+    return this.loop;
+  }
+  async drain() {
+    try {
+      while (this.q.length > 0) {
+        const task = this.q.shift();
+        await this.runOne(task);
+      }
+    } finally {
+      this.running = false;
+    }
+  }
+  async runOne(task) {
+    let session;
+    let timer;
+    try {
+      session = this.deps.makeSession(task);
+      session.push(task.instruction, task.reply, {
+        autoReplyOnText: task.autoReplyOnText,
+        replyExpected: task.replyExpected,
+        armed: task.armed
+      });
+      const currentSession = session;
+      const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+          currentSession.abort();
+          reject(new Error("worker task timeout"));
+        }, this.deps.timeoutMs);
+      });
+      await Promise.race([session.start(), timeout]);
+    } catch (e7) {
+      this.deps.log(`[worker-queue] task failed: ${e7.message}`);
+      session?.abort();
+      try {
+        await task.reply(GENERIC_ERROR);
+      } catch (replyErr) {
+        this.deps.log(`[worker-queue] failed to deliver error reply: ${replyErr.message}`);
+      }
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+};
+
+// src/router.ts
+function makeRouter(deps) {
+  return {
+    push(text, reply, opts) {
+      const replySink = reply ?? (() => {
+      });
+      const isOwnerDm = opts?.autoReplyOnText === true && deps.workAllowed();
+      const isArmedRoom = opts?.armed?.() === true && deps.workAllowed();
+      if (isOwnerDm) {
+        deps.queue.enqueue({
+          instruction: text,
+          reply: replySink,
+          autoReplyOnText: true,
+          replyExpected: opts?.replyExpected
+        });
+        return;
+      }
+      if (isArmedRoom) {
+        deps.queue.enqueue({
+          instruction: text,
+          reply: replySink,
+          autoReplyOnText: false,
+          replyExpected: opts?.replyExpected,
+          armed: opts.armed
+        });
+        return;
+      }
+      deps.listener.push(text, reply, opts);
+    }
+  };
+}
+
 // src/arming.ts
 var ArmingState = class {
   armed = /* @__PURE__ */ new Set();
@@ -132588,26 +132798,58 @@ var ArmingState = class {
   consumed = /* @__PURE__ */ new Set();
   // request-ids already approved (one-shot)
   /**
-   * Replace the armed set. Use ONLY for the launch-env seed (AV_ARM_ROOM), which
-   * is itself a host-local action and is therefore allowed to arm.
+   * Replace the armed set. Use for the host-local launch seed (AV_ARM_ROOM) —
+   * itself a host-local action and therefore allowed to arm — and as the
+   * primitive `applyAuthoritative` below delegates to for non-shell workers.
    *
-   * Do NOT use this for the backend connect `arming_snapshot`: that snapshot
-   * reflects owner *intent* (set at web-request time, before any local approval),
-   * so arming from it would let a web-session compromise arm a worker on reconnect
-   * without host access — defeating the 2-of-2 local-approval model. The channel
-   * snapshot path uses `reconcileDisarm` (disarm-only) instead.
+   * The B-pure posture (Task 4) treats the backend connect/live
+   * `arming_snapshot` the same way — see `applyAuthoritative`'s docstring for
+   * the current arm-from-snapshot rationale. Shell-capable (OS-isolated)
+   * workers do NOT use this path; they stay on `reconcileDisarm` (disarm-only,
+   * see below) until #20.
    */
   applySnapshot(roomIds) {
     this.armed = new Set(roomIds);
   }
   /**
-   * Disarm-only reconciliation from the backend connect snapshot. Disarms any
-   * currently-armed room whose intent is no longer armed (i.e. NOT in
-   * `intendedArmed`) — so a disarm issued while the bridge was offline still takes
-   * effect on reconnect — but NEVER arms a room. Arming stays exclusively behind a
-   * local `approve-arm`. Returns the rooms that were disarmed. In-memory arming
-   * survives a WS reconnect, so a genuinely-approved arm is unaffected here; only a
-   * full process restart (which clears this state) requires re-approval on the host.
+   * Set the armed set to EXACTLY `intendedArmed`: arms every room in the list
+   * that isn't already armed, and disarms every currently-armed room that is
+   * absent from it. This is the AUTHORITATIVE arm-from-snapshot path (Task 4,
+   * reversing the prior disarm-only safeguard for non-shell workers).
+   *
+   * Why arming from the snapshot is now safe: `intendedArmed` is derived
+   * server-side from `devices.work_allowed`, and that flag can only be flipped
+   * by `PUT /devices/{id}/work_allowed`, which REJECTS any device-bound caller
+   * outright (C1 guard — a human account owner only; an agent, including a
+   * compromised one, cannot self-authorize). So "arm from snapshot" no longer
+   * means "a web session can arm a worker" in the old adversarial sense — it
+   * means "the verified owner's grant is applied end-to-end, live, without
+   * requiring a separate host-local approval step for every reconnect." This is
+   * the accepted B-pure posture; see #20 to harden it further with local
+   * approval for non-shell workers too. Shell-capable (OS-isolated) workers are
+   * carved out of this path entirely (C2) — see the shell-gate in bridge.ts —
+   * because a shell worker armed by a web flag is a live RCE surface even under
+   * an honest owner (a compromised owner web session, or a compromised backend,
+   * would get arbitrary code execution). Those workers stay on `reconcileDisarm`
+   * (disarm-only) until #20 delivers local approval for them as well.
+   */
+  applyAuthoritative(intendedArmed) {
+    this.applySnapshot(intendedArmed);
+  }
+  /**
+   * Disarm-only reconciliation from the backend connect/live snapshot. Disarms
+   * any currently-armed room whose intent is no longer armed (i.e. NOT in
+   * `intendedArmed`) — so a disarm issued while the bridge was offline still
+   * takes effect on reconnect — but NEVER arms a room. Used for OS-isolated
+   * (shell-capable) workers ONLY (C2): a shell worker must never be armed by a
+   * web-originated flag, because a compromised owner session or backend would
+   * translate directly into host code execution. Those workers can be armed
+   * only by the host-local launch seed (`AV_ARM_ROOM`, via `applySnapshot`)
+   * until #20 delivers a local-approval path for them too. Non-shell workers
+   * use `applyAuthoritative` instead (Task 4) — see its docstring. Returns the
+   * rooms that were disarmed. In-memory arming survives a WS reconnect, so a
+   * genuinely-armed room is unaffected here; only a full process restart
+   * (which clears this state) requires re-arming.
    */
   reconcileDisarm(intendedArmed) {
     const keep = new Set(intendedArmed);
@@ -132661,7 +132903,7 @@ var ArmingState = class {
 };
 
 // src/approve-cli.ts
-import { mkdirSync as mkdirSync2, writeFileSync, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync as rmSync2, existsSync as existsSync3 } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync as rmSync2, existsSync as existsSync3 } from "node:fs";
 import { join as join6 } from "node:path";
 var APPROVALS_SUBDIR = "arm-approvals";
 var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
@@ -132683,7 +132925,7 @@ function writeApproval(dataDir, requestId, roomId) {
   const id = sanitizeRequestId(requestId);
   const room = sanitizeRoomId(roomId);
   const dir = join6(dataDir, APPROVALS_SUBDIR);
-  mkdirSync2(dir, { recursive: true });
+  mkdirSync3(dir, { recursive: true });
   writeFileSync(join6(dir, id), room);
 }
 function drainApprovals(dataDir) {
@@ -132823,6 +133065,12 @@ function pollApprovalsOnce(arming, dataDir, onArmed, log = () => {
 function wireBridge(channel, session, target, opts = {}) {
   const log = opts.log ?? (() => {
   });
+  let workAllowed = false;
+  const workAllowedGetter = () => workAllowed;
+  opts.onWorkAllowed?.(workAllowedGetter);
+  channel.on("state", (s10) => {
+    if (s10 !== "ready") workAllowed = false;
+  });
   const arming = new ArmingState();
   if (opts.armRoom === true && opts.roomFilter) {
     arming.applySnapshot([opts.roomFilter]);
@@ -132848,6 +133096,7 @@ function wireBridge(channel, session, target, opts = {}) {
     target.setRoom(e7.roomId);
     session.push(`[${e7.senderName}]: ${e7.plaintext}`, target.snapshotReply(channel, log), {
       autoReplyOnText: false,
+      replyExpected: e7.senderIsAgent === false,
       armed: () => arming.isArmed(e7.roomId)
     });
   });
@@ -132857,7 +133106,8 @@ function wireBridge(channel, session, target, opts = {}) {
     target.setDm();
     session.push(text, target.snapshotReply(channel, log), { autoReplyOnText: true });
   });
-  const workerCapable = !!(opts.worker && opts.workspaceDir);
+  const workerCapable = !!opts.workspaceDir;
+  const osIsolated = opts.osIsolated !== void 0 ? opts.osIsolated : process.env.AV_WORKER_OS_ISOLATED === "1" || process.env.AV_WORKER_OS_ISOLATED === "true";
   const heartbeat = () => {
     try {
       channel.sendWorkerHeartbeat?.({ workerCapable, armedRooms: arming.armedRooms() });
@@ -132867,21 +133117,33 @@ function wireBridge(channel, session, target, opts = {}) {
   };
   heartbeat();
   channel.on("ready", () => heartbeat());
-  channel.on("arming_snapshot", (s10) => {
+  const applyArmingSnapshot = (s10) => {
+    workAllowed = s10?.workAllowed === true;
     if (!workerCapable) {
       log("arming_snapshot ignored \u2014 not worker-capable");
       return;
     }
+    const roomIds = s10?.roomIds ?? [];
     try {
-      const dropped = arming.reconcileDisarm(s10?.roomIds ?? []);
-      if (dropped.length > 0) {
-        log(`arming snapshot reconcile \u2014 disarmed: [${dropped.map((r7) => r7.slice(0, 8)).join(", ")}]`);
-        heartbeat();
+      const before = new Set(arming.armedRooms());
+      if (osIsolated) {
+        const dropped = arming.reconcileDisarm(roomIds);
+        if (dropped.length > 0) {
+          log(
+            `arming_snapshot: OS-isolated worker \u2014 disarm-only until #20 (web cannot arm shell workers); disarmed: [${dropped.map((r7) => r7.slice(0, 8)).join(", ")}]`
+          );
+        }
+      } else {
+        arming.applyAuthoritative(roomIds);
       }
+      const after = arming.armedRooms();
+      const changed = after.length !== before.size || after.some((r7) => !before.has(r7));
+      if (changed) heartbeat();
     } catch (err) {
       log(`arming_snapshot handling failed (ignored): ${err instanceof Error ? err.message : String(err)}`);
     }
-  });
+  };
+  channel.on("arming_snapshot", applyArmingSnapshot);
   channel.on("disarm", (d10) => {
     if (!workerCapable) {
       log("disarm ignored \u2014 not worker-capable");
@@ -132943,22 +133205,20 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.5.7" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.5.10" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
-  if (cfg.worker) {
-    console.error(`[bridge] WORKER MODE \u2014 workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
-    if (cfg.armRoom) {
-      console.error(
-        `[bridge] ARMED ROOM ${cfg.roomFilter} \u2014 worker tools are enabled on this room's turns. The enclave key dir stays fenced; the workspace dir is ADVISORY (the SDK does not confine file ops to it \u2014 they root in $HOME). Blast radius = whatever this host/environment exposes.`
-      );
-      console.error(
-        "[bridge] ARMED ROOM WARNING: this room contains agents you do not control. A room peer's message can drive your agent's tools. The directory is NOT a sandbox \u2014 run this bridge in an owner-provisioned confined environment (dedicated droplet / container / OS-user) with no connected accounts or ambient credentials. See the Slice 2 hardening guide."
-      );
-    } else {
-      console.error(
-        "[bridge] WORKER MODE: tools run on owner DM turns only. Rooms stay say-only unless armed (AV_ARM_ROOM=1 with a pinned AV_ROOM_ID). Cross-turn injection note: a persistent session mixes room context with DM turns \u2014 run DM-only or OS-isolated if you do not arm a room."
-      );
-    }
+  console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
+  if (cfg.armRoom) {
+    console.error(
+      `[bridge] ARMED ROOM ${cfg.roomFilter} \u2014 worker tools are enabled on this room's turns. The enclave key dir stays fenced; the workspace dir is ADVISORY (the SDK does not confine file ops to it \u2014 they root in $HOME). Blast radius = whatever this host/environment exposes.`
+    );
+    console.error(
+      "[bridge] ARMED ROOM WARNING: this room contains agents you do not control. A room peer's message can drive your agent's tools. The directory is NOT a sandbox \u2014 run this bridge in an owner-provisioned confined environment (dedicated droplet / container / OS-user) with no connected accounts or ambient credentials. See the Slice 2 hardening guide."
+    );
+  } else {
+    console.error(
+      '[bridge] tools run on owner DM turns only when Work is allowed (the dashboard "Work" switch). Rooms stay say-only unless armed (AV_ARM_ROOM=1 with a pinned AV_ROOM_ID). Cross-turn injection note: a persistent session mixes room context with DM turns \u2014 run DM-only or OS-isolated if you do not arm a room.'
+    );
   }
   const target = new ActiveTarget();
   if (cfg.roomFilter) target.setRoom(cfg.roomFilter);
@@ -132969,9 +133229,16 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node"
   });
-  const session = new PersistentClaudeSession({
+  const agentSystemPrompt = cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`;
+  const deviceJwt = () => {
+    const c4 = channel;
+    return c4._deviceJwt ?? c4._persisted?.deviceJwt ?? null;
+  };
+  let liveWorkAllowed = () => false;
+  const workAllowed = () => liveWorkAllowed();
+  const listener = new PersistentClaudeSession({
     model: cfg.model,
-    systemPrompt: cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`,
+    systemPrompt: agentSystemPrompt,
     // Claude speaks by calling the say tool → the session routes it to the reply
     // bound to the message being answered (wireBridge captures that per inbound via
     // ActiveTarget.snapshotReply, which also logs the "said to …" line). This
@@ -132979,32 +133246,52 @@ async function main() {
     // room when room traffic arrives mid-compose.
     // Assistant reasoning that wasn't sent — log a short trace only.
     onObserve: (text) => console.error(`[bridge] observed (${text.length} chars, not sent)`),
-    worker: cfg.worker,
-    workspaceDir: cfg.workspaceDir,
-    osIsolated: cfg.osIsolated,
-    permissionMode: cfg.permissionMode,
-    dataDir: cfg.dataDir,
-    // Slice 2 Plan B: audit self-report context (only used on armed-room turns).
-    roomId: cfg.roomFilter,
-    agentId: channel.deviceId,
-    apiUrl: cfg.apiUrl,
-    deviceJwt: () => {
-      const c4 = channel;
-      return c4._deviceJwt ?? c4._persisted?.deviceJwt ?? null;
-    }
+    worker: false
+  });
+  const WORKER_MAX_TURNS = 20;
+  const WORKER_TIMEOUT_MS = 5 * 6e4;
+  const workerQueue = new WorkerQueue({
+    makeSession: (task) => new PersistentClaudeSession({
+      model: cfg.model,
+      systemPrompt: agentSystemPrompt,
+      onObserve: (text) => console.error(`[worker] observed (${text.length} chars, not sent)`),
+      worker: true,
+      // Task 4: the hard backstop — no tool runs on any worker turn (owner DM or
+      // armed room) unless Work is on. Read live per tool decision.
+      workAllowed,
+      ephemeral: true,
+      maxTurns: WORKER_MAX_TURNS,
+      workspaceDir: cfg.workspaceDir,
+      osIsolated: cfg.osIsolated,
+      permissionMode: cfg.permissionMode,
+      dataDir: cfg.dataDir,
+      // Slice 2 Plan B audit self-report — only fires on armed-room tasks (isArmedTurn).
+      roomId: cfg.roomFilter,
+      agentId: channel.deviceId,
+      apiUrl: cfg.apiUrl,
+      deviceJwt
+    }),
+    timeoutMs: WORKER_TIMEOUT_MS,
+    log: (m6) => console.error(m6)
   });
+  const router = makeRouter({ workAllowed, listener, queue: workerQueue });
   wireBridge(
     channel,
-    { push: (t7, reply, opts) => session.push(t7, reply, opts) },
+    { push: (t7, reply, opts) => router.push(t7, reply, opts) },
     target,
     {
       roomFilter: cfg.roomFilter,
       armRoom: cfg.armRoom,
       log: (m6) => console.error("[bridge] " + m6),
       // Slice 2 Plan C (T11): live arm/disarm + local-approval poll + heartbeat.
-      worker: cfg.worker,
       workspaceDir: cfg.workspaceDir,
-      dataDir: cfg.dataDir
+      dataDir: cfg.dataDir,
+      osIsolated: cfg.osIsolated,
+      // Task 4: capture the live fail-closed workAllowed getter (set synchronously
+      // during wiring) into the indirection the router + worker session read live.
+      onWorkAllowed: (getter) => {
+        liveWorkAllowed = getter;
+      }
     }
   );
   attachLifecycle2(channel, {
@@ -133015,7 +133302,11 @@ async function main() {
     "room_joined",
     (e7) => console.error(`[bridge] joined room ${e7.name} (${e7.roomId})`)
   );
-  await Promise.all([channel.start(), session.start()]);
+  listener.start().catch((err) => {
+    console.error("[bridge] fatal:", err);
+    process.exit(1);
+  });
+  await channel.start();
 }
 main().catch((err) => {
   console.error("[bridge] fatal:", err);