@agentvault/claude-bridge 0.5.7 → 0.5.10

package/dist/router.d.ts

@@ -0,0 +1,40 @@
+import type { ReplySink } from "./session.js";
+import type { WorkerTask } from "./worker-queue.js";
+/** The push interface wireBridge drives (matches PersistentClaudeSession.push). */
+export interface PushLike {
+    push(text: string, reply?: ReplySink, opts?: {
+        autoReplyOnText?: boolean;
+        replyExpected?: boolean;
+        armed?: () => boolean;
+    }): void;
+}
+export interface RouterDeps {
+    /**
+     * Task 4 (C-1/H-3): live, fail-closed device-level tool capability ("Work").
+     * MUST be read live at each push (never snapshotted) so a mid-connection flip
+     * and the fail-closed reconnect window both take effect immediately. Gates
+     * BOTH tool-eligible lanes — owner-DM and armed-room: Work off → the turn
+     * falls through to the tools-absent listener (structural fail-safe), making
+     * `work_allowed` the single on/off control for tool capability. The
+     * session-level isToolTurn AND remains the hard backstop for both lanes.
+     */
+    workAllowed: () => boolean;
+    /** Always-on locked listener (tools:[]) for untrusted/non-tool turns. */
+    listener: PushLike;
+    /** Serial queue of tool-eligible turns. */
+    queue: {
+        enqueue(task: WorkerTask): void;
+    };
+}
+/**
+ * Route each inbound turn to EXACTLY ONE lane (facet B). Tool-eligible turns —
+ * owner DMs (autoReplyOnText) and armed room turns — go to an isolated ephemeral
+ * worker via the queue; everything else stays on the locked listener. A room
+ * turn's `armed` getter is read once here at routing time to pick the lane; the
+ * same live getter is threaded to the worker task so a mid-turn disarm still
+ * denies the next tool call (Facet A D5). `work_allowed` is the single control
+ * gating BOTH lanes: an armed room turn is only routed to the worker queue when
+ * workAllowed() is also true, so Work off always falls through to the listener.
+ */
+export declare function makeRouter(deps: RouterDeps): PushLike;
+//# sourceMappingURL=router.d.ts.map

package/dist/service/spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/service/spec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB,EAAE,OAAO,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,GAAG,WAAW,CA2BvF"}
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/service/spec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB,EAAE,OAAO,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,GAAG,WAAW,CA0BvF"}

package/dist/session.d.ts

@@ -45,7 +45,7 @@ export type QueryFn = (args: {
     type: string;
     [k: string]: unknown;
 }>;
-type ReplySink = (text: string) => void | Promise<void>;
+export type ReplySink = (text: string) => void | Promise<void>;
 export interface SessionOpts {
     /** Fallback reply sink when a message carries no per-message reply (e.g. a
      *  proactive say). Per-message replies passed to push() take precedence. */
@@ -73,6 +73,19 @@ export interface SessionOpts {
     apiUrl?: string;
     /** Lazy getter so a JWT refreshed after construction is still picked up. */
     deviceJwt?: () => string | null;
+    /** Single-shot ephemeral worker: process exactly the pushed message(s) then
+     *  terminate the input stream so start() resolves. Used by the worker queue so
+     *  a per-task query() completes and its state is discarded. */
+    ephemeral?: boolean;
+    /** Turn cap for a worker query() (bounds a runaway tool loop). */
+    maxTurns?: number;
+    /**
+     * Task 4 (C-1/H-3): live, fail-closed device-level tool capability ("Work").
+     * Folded into `isToolTurn` as a top-level AND — the HARD backstop that makes
+     * the fail-safe real: NO tool runs (owner DM OR armed room) when this returns
+     * false, even if the router mis-routed. Read LIVE at each tool decision (never
+     * snapshotted). Absent getter ⇒ `?? false` ⇒ fail-closed (no tools). */
+    workAllowed?: () => boolean;
 }
 export declare class PersistentClaudeSession {
     private opts;
@@ -101,10 +114,21 @@ export declare class PersistentClaudeSession {
      *  disarm denies the very next tool call. wireBridge binds it to the ArmingState
      *  for this turn's room; an unarmed room turn's getter returns false. */
     private currentArmedGetter;
+    /** Per-turn: does this turn's sender expect a reply? DECOUPLED from
+     *  `currentAutoReply` on purpose — it drives ONLY the #416 plain-text fallback
+     *  (deliver assistant text when the model never calls say), NOT the tool gate.
+     *  True for owner 1:1 DMs (defaults from autoReplyOnText) AND for a HUMAN/owner
+     *  speaking in a room (wireBridge sets replyExpected from !senderIsAgent). An
+     *  agent-authored room turn keeps this false → the agent may still stay silent,
+     *  which also prevents agent↔agent reply loops. Tool access is unaffected: it
+     *  stays gated on currentAutoReply (owner DM) OR currentArmedGetter (armed room). */
+    private currentReplyExpected;
     private saidThisTurn;
     private turnText;
     /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
     private roomServer;
+    /** AbortController for the in-flight query(); abort() triggers it (queue timeout). */
+    private _abort?;
     constructor(opts: SessionOpts);
     /**
      * Queue an inbound message for the model.
@@ -120,12 +144,15 @@ export declare class PersistentClaudeSession {
      */
     push(text: string, reply?: ReplySink, opts?: {
         autoReplyOnText?: boolean;
+        replyExpected?: boolean;
         armed?: () => boolean;
     }): void;
     /** Route a say-tool message to the reply bound to the in-flight message, falling
      *  back to opts.onSay. This is what closes the DM→room leak: the destination is
      *  the one captured for the message being answered, not a live global target. */
     deliver(text: string): Promise<void>;
+    /** Abort the in-flight query() — used by the worker queue on a per-task timeout. */
+    abort(): void;
     private input;
     /**
      * Build the SDK options for this session. Locked mode (default) is safe for
@@ -136,5 +163,4 @@ export declare class PersistentClaudeSession {
     private buildSdkOptions;
     start(): Promise<void>;
 }
-export {};
 //# sourceMappingURL=session.d.ts.map

package/dist/worker-queue.d.ts

@@ -0,0 +1,46 @@
+import type { PersistentClaudeSession, ReplySink } from "./session.js";
+/** One tool-eligible turn to run in an isolated ephemeral worker. */
+export type WorkerTask = {
+    /** The single instruction that seeds the worker's conversation. */
+    instruction: string;
+    /** Where this task's reply (room_say / #416 fallback) is sent. Per-task. */
+    reply: ReplySink;
+    /** Owner-DM turns want a plain-text reply fallback (#416). */
+    autoReplyOnText: boolean;
+    /** A human/owner sender expects a reply: if the worker answers in plain text
+     *  without calling say, deliver that text instead of dropping it. Decoupled from
+     *  autoReplyOnText so it delivers on a tool-capable room turn WITHOUT enabling
+     *  tools (arming governs tools). Absent/false for agent-authored turns. */
+    replyExpected?: boolean;
+    /** Armed-room turns: live getter the gate reads per tool decision (mid-turn
+     *  disarm denies the next call). Absent for owner DMs. */
+    armed?: () => boolean;
+};
+export interface WorkerQueueDeps {
+    /** Build a fresh ephemeral worker session for this task (not yet started). */
+    makeSession: (task: WorkerTask) => PersistentClaudeSession;
+    /** Per-task wall-clock cap; on breach the worker is aborted and the queue advances. */
+    timeoutMs: number;
+    log: (m: string) => void;
+}
+/**
+ * Serial FIFO of tool-eligible turns. One worker runs at a time (concurrent tool
+ * calls against one device/workspace can interleave destructively; the owner is a
+ * single actor). Each task runs in a fresh ephemeral worker seeded with only its
+ * instruction; on error or timeout the worker is torn down, a generic message is
+ * sent to the task's reply, and the queue advances — a task can never wedge the
+ * queue (which would starve the owner's DM lane).
+ */
+export declare class WorkerQueue {
+    private deps;
+    private q;
+    private loop;
+    private running;
+    constructor(deps: WorkerQueueDeps);
+    enqueue(task: WorkerTask): void;
+    /** Resolves when the queue has processed everything enqueued so far. */
+    whenDrained(): Promise<void>;
+    private drain;
+    private runOne;
+}
+//# sourceMappingURL=worker-queue.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.5.7",
+  "version": "0.5.10",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",