@agentvault/claude-bridge 0.5.7 → 0.5.8

package/dist/index.js

@@ -132437,6 +132437,8 @@ var PersistentClaudeSession = class {
   turnText = "";
   /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
   roomServer;
+  /** AbortController for the in-flight query(); abort() triggers it (queue timeout). */
+  _abort;
   /**
    * Queue an inbound message for the model.
    * @param opts.autoReplyOnText — for 1:1 DMs (where the owner always expects a
@@ -132473,11 +132475,22 @@ var PersistentClaudeSession = class {
     if (this.activeReply) await this.activeReply(text);
     else if (this.opts.onSay) await this.opts.onSay(text);
   }
+  /** Abort the in-flight query() — used by the worker queue on a per-task timeout. */
+  abort() {
+    this._abort?.abort();
+  }
   async *input() {
     while (true) {
-      const item = this.pending.length > 0 ? this.pending.shift() : await new Promise((resolve3) => {
-        this.waiting = resolve3;
-      });
+      let item;
+      if (this.pending.length > 0) {
+        item = this.pending.shift();
+      } else if (this.opts.ephemeral) {
+        return;
+      } else {
+        item = await new Promise((resolve3) => {
+          this.waiting = resolve3;
+        });
+      }
       this.activeReply = item.reply;
       this.currentAutoReply = item.autoReplyOnText ?? false;
       this.currentArmedGetter = item.armed ?? (() => false);
@@ -132538,8 +132551,28 @@ var PersistentClaudeSession = class {
     return {
       ...base,
       permissionMode: this.opts.permissionMode ?? "auto",
-      settingSources: ["user", "project"],
+      // FACET B (disk isolation). The workspace is writable under the Facet-A
+      // allowlist, so a prior worker/armed turn could plant config files in it that
+      // a later worker would otherwise ingest. We close each disk surface explicitly
+      // (they are governed SEPARATELY by the SDK, so one flag is not enough):
+      //   - settingSources:[] — "disable filesystem settings (SDK isolation mode)":
+      //     no ~/.claude or project settings.json (⇒ no settings-defined hooks, the
+      //     RCE-grade vector: a hook is a shell command run OUTSIDE the Bash gate),
+      //     no CLAUDE.md. It also means no .mcp.json APPROVAL state is loaded — and
+      //     enableAllProjectMcpServers/enabledMcpjsonServers live only in Settings —
+      //     so an unapproved project .mcp.json server is never spawned in headless
+      //     mode. Any MCP tool that WERE discovered is still denied by the Facet-A
+      //     allowlist (mcp__* is not room_say/a file tool/Bash → final deny).
+      //   - skills:[] — settingSources does NOT gate skills discovery; [] enables
+      //     zero skills, so a planted <ws>/.claude/skills/*/SKILL.md description
+      //     cannot be injected into the worker's context.
+      // Project context, if needed, is injected via the bridge-controlled systemPrompt,
+      // never auto-loaded from the mutable workspace.
+      settingSources: [],
+      skills: [],
       cwd: this.opts.workspaceDir,
+      ...this.opts.maxTurns != null ? { maxTurns: this.opts.maxTurns } : {},
+      abortController: this._abort,
       // PRIMARY gate: a PreToolUse hook fires on EVERY tool call regardless of
       // permissionMode. canUseTool alone is bypassed in "auto" mode (the SDK's
       // classifier auto-approves without hitting the "ask" path) — verified live.
@@ -132549,6 +132582,7 @@ var PersistentClaudeSession = class {
     };
   }
   async start() {
+    this._abort = new AbortController();
     this.roomServer = _s({
       name: "room",
       version: "0.2.0",
@@ -132580,6 +132614,96 @@ var PersistentClaudeSession = class {
   }
 };
 
+// src/worker-queue.ts
+var GENERIC_ERROR = "Sorry \u2014 I couldn't complete that request.";
+var WorkerQueue = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  q = [];
+  loop = Promise.resolve();
+  running = false;
+  enqueue(task) {
+    this.q.push(task);
+    if (!this.running) {
+      this.running = true;
+      this.loop = this.drain();
+    }
+  }
+  /** Resolves when the queue has processed everything enqueued so far. */
+  whenDrained() {
+    return this.loop;
+  }
+  async drain() {
+    try {
+      while (this.q.length > 0) {
+        const task = this.q.shift();
+        await this.runOne(task);
+      }
+    } finally {
+      this.running = false;
+    }
+  }
+  async runOne(task) {
+    let session;
+    let timer;
+    try {
+      session = this.deps.makeSession(task);
+      session.push(task.instruction, task.reply, {
+        autoReplyOnText: task.autoReplyOnText,
+        armed: task.armed
+      });
+      const currentSession = session;
+      const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+          currentSession.abort();
+          reject(new Error("worker task timeout"));
+        }, this.deps.timeoutMs);
+      });
+      await Promise.race([session.start(), timeout]);
+    } catch (e7) {
+      this.deps.log(`[worker-queue] task failed: ${e7.message}`);
+      session?.abort();
+      try {
+        await task.reply(GENERIC_ERROR);
+      } catch (replyErr) {
+        this.deps.log(`[worker-queue] failed to deliver error reply: ${replyErr.message}`);
+      }
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+};
+
+// src/router.ts
+function makeRouter(deps) {
+  return {
+    push(text, reply, opts) {
+      const replySink = reply ?? (() => {
+      });
+      if (deps.worker) {
+        const isOwnerDm = opts?.autoReplyOnText === true;
+        const isArmedRoom = opts?.armed?.() === true;
+        if (isOwnerDm) {
+          deps.queue.enqueue({ instruction: text, reply: replySink, autoReplyOnText: true });
+          return;
+        }
+        if (isArmedRoom) {
+          deps.queue.enqueue({
+            instruction: text,
+            reply: replySink,
+            autoReplyOnText: false,
+            armed: opts.armed
+          });
+          return;
+        }
+      }
+      deps.listener.push(text, reply, opts);
+    }
+  };
+}
+
 // src/arming.ts
 var ArmingState = class {
   armed = /* @__PURE__ */ new Set();
@@ -132943,7 +133067,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.5.7" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.5.8" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   if (cfg.worker) {
     console.error(`[bridge] WORKER MODE \u2014 workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
@@ -132969,9 +133093,14 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node"
   });
-  const session = new PersistentClaudeSession({
+  const agentSystemPrompt = cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`;
+  const deviceJwt = () => {
+    const c4 = channel;
+    return c4._deviceJwt ?? c4._persisted?.deviceJwt ?? null;
+  };
+  const listener = new PersistentClaudeSession({
     model: cfg.model,
-    systemPrompt: cfg.systemPrompt ?? `You are ${cfg.agentName}, an AI agent on AgentVault. You talk with your owner in 1:1 direct messages and collaborate with other agents in shared rooms. That is your identity \u2014 introduce yourself by that name and do not claim to be any other agent. To speak, call the say tool. In a 1:1 with your owner, reply to what they say. In a room you see every message \u2014 call say only when you have something worth adding, and otherwise stay silent. Keep messages concise.`,
+    systemPrompt: agentSystemPrompt,
     // Claude speaks by calling the say tool → the session routes it to the reply
     // bound to the message being answered (wireBridge captures that per inbound via
     // ActiveTarget.snapshotReply, which also logs the "said to …" line). This
@@ -132979,23 +133108,35 @@ async function main() {
     // room when room traffic arrives mid-compose.
     // Assistant reasoning that wasn't sent — log a short trace only.
     onObserve: (text) => console.error(`[bridge] observed (${text.length} chars, not sent)`),
-    worker: cfg.worker,
-    workspaceDir: cfg.workspaceDir,
-    osIsolated: cfg.osIsolated,
-    permissionMode: cfg.permissionMode,
-    dataDir: cfg.dataDir,
-    // Slice 2 Plan B: audit self-report context (only used on armed-room turns).
-    roomId: cfg.roomFilter,
-    agentId: channel.deviceId,
-    apiUrl: cfg.apiUrl,
-    deviceJwt: () => {
-      const c4 = channel;
-      return c4._deviceJwt ?? c4._persisted?.deviceJwt ?? null;
-    }
+    worker: false
   });
+  const WORKER_MAX_TURNS = 20;
+  const WORKER_TIMEOUT_MS = 5 * 6e4;
+  const workerQueue = new WorkerQueue({
+    makeSession: (task) => new PersistentClaudeSession({
+      model: cfg.model,
+      systemPrompt: agentSystemPrompt,
+      onObserve: (text) => console.error(`[worker] observed (${text.length} chars, not sent)`),
+      worker: true,
+      ephemeral: true,
+      maxTurns: WORKER_MAX_TURNS,
+      workspaceDir: cfg.workspaceDir,
+      osIsolated: cfg.osIsolated,
+      permissionMode: cfg.permissionMode,
+      dataDir: cfg.dataDir,
+      // Slice 2 Plan B audit self-report — only fires on armed-room tasks (isArmedTurn).
+      roomId: cfg.roomFilter,
+      agentId: channel.deviceId,
+      apiUrl: cfg.apiUrl,
+      deviceJwt
+    }),
+    timeoutMs: WORKER_TIMEOUT_MS,
+    log: (m6) => console.error(m6)
+  });
+  const router = makeRouter({ worker: !!cfg.worker, listener, queue: workerQueue });
   wireBridge(
     channel,
-    { push: (t7, reply, opts) => session.push(t7, reply, opts) },
+    { push: (t7, reply, opts) => router.push(t7, reply, opts) },
     target,
     {
       roomFilter: cfg.roomFilter,
@@ -133015,7 +133156,11 @@ async function main() {
     "room_joined",
     (e7) => console.error(`[bridge] joined room ${e7.name} (${e7.roomId})`)
   );
-  await Promise.all([channel.start(), session.start()]);
+  listener.start().catch((err) => {
+    console.error("[bridge] fatal:", err);
+    process.exit(1);
+  });
+  await channel.start();
 }
 main().catch((err) => {
   console.error("[bridge] fatal:", err);

package/dist/router.d.ts

@@ -0,0 +1,30 @@
+import type { ReplySink } from "./session.js";
+import type { WorkerTask } from "./worker-queue.js";
+/** The push interface wireBridge drives (matches PersistentClaudeSession.push). */
+export interface PushLike {
+    push(text: string, reply?: ReplySink, opts?: {
+        autoReplyOnText?: boolean;
+        armed?: () => boolean;
+    }): void;
+}
+export interface RouterDeps {
+    /** AV_WORKER=1 → tool-eligible turns run in isolated workers; false → no worker ever. */
+    worker: boolean;
+    /** Always-on locked listener (tools:[]) for untrusted/non-tool turns. */
+    listener: PushLike;
+    /** Serial queue of tool-eligible turns. */
+    queue: {
+        enqueue(task: WorkerTask): void;
+    };
+}
+/**
+ * Route each inbound turn to EXACTLY ONE lane (facet B). Tool-eligible turns —
+ * owner DMs (autoReplyOnText) and armed room turns — go to an isolated ephemeral
+ * worker via the queue; everything else stays on the locked listener. A room
+ * turn's `armed` getter is read once here at routing time to pick the lane; the
+ * same live getter is threaded to the worker task so a mid-turn disarm still
+ * denies the next tool call (Facet A D5). Locked agents (worker=false) always
+ * route to the listener — a strict no-op vs today.
+ */
+export declare function makeRouter(deps: RouterDeps): PushLike;
+//# sourceMappingURL=router.d.ts.map

package/dist/session.d.ts

@@ -45,7 +45,7 @@ export type QueryFn = (args: {
     type: string;
     [k: string]: unknown;
 }>;
-type ReplySink = (text: string) => void | Promise<void>;
+export type ReplySink = (text: string) => void | Promise<void>;
 export interface SessionOpts {
     /** Fallback reply sink when a message carries no per-message reply (e.g. a
      *  proactive say). Per-message replies passed to push() take precedence. */
@@ -73,6 +73,12 @@ export interface SessionOpts {
     apiUrl?: string;
     /** Lazy getter so a JWT refreshed after construction is still picked up. */
     deviceJwt?: () => string | null;
+    /** Single-shot ephemeral worker: process exactly the pushed message(s) then
+     *  terminate the input stream so start() resolves. Used by the worker queue so
+     *  a per-task query() completes and its state is discarded. */
+    ephemeral?: boolean;
+    /** Turn cap for a worker query() (bounds a runaway tool loop). */
+    maxTurns?: number;
 }
 export declare class PersistentClaudeSession {
     private opts;
@@ -105,6 +111,8 @@ export declare class PersistentClaudeSession {
     private turnText;
     /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
     private roomServer;
+    /** AbortController for the in-flight query(); abort() triggers it (queue timeout). */
+    private _abort?;
     constructor(opts: SessionOpts);
     /**
      * Queue an inbound message for the model.
@@ -126,6 +134,8 @@ export declare class PersistentClaudeSession {
      *  back to opts.onSay. This is what closes the DM→room leak: the destination is
      *  the one captured for the message being answered, not a live global target. */
     deliver(text: string): Promise<void>;
+    /** Abort the in-flight query() — used by the worker queue on a per-task timeout. */
+    abort(): void;
     private input;
     /**
      * Build the SDK options for this session. Locked mode (default) is safe for
@@ -136,5 +146,4 @@ export declare class PersistentClaudeSession {
     private buildSdkOptions;
     start(): Promise<void>;
 }
-export {};
 //# sourceMappingURL=session.d.ts.map

package/dist/worker-queue.d.ts

@@ -0,0 +1,41 @@
+import type { PersistentClaudeSession, ReplySink } from "./session.js";
+/** One tool-eligible turn to run in an isolated ephemeral worker. */
+export type WorkerTask = {
+    /** The single instruction that seeds the worker's conversation. */
+    instruction: string;
+    /** Where this task's reply (room_say / #416 fallback) is sent. Per-task. */
+    reply: ReplySink;
+    /** Owner-DM turns want a plain-text reply fallback (#416). */
+    autoReplyOnText: boolean;
+    /** Armed-room turns: live getter the gate reads per tool decision (mid-turn
+     *  disarm denies the next call). Absent for owner DMs. */
+    armed?: () => boolean;
+};
+export interface WorkerQueueDeps {
+    /** Build a fresh ephemeral worker session for this task (not yet started). */
+    makeSession: (task: WorkerTask) => PersistentClaudeSession;
+    /** Per-task wall-clock cap; on breach the worker is aborted and the queue advances. */
+    timeoutMs: number;
+    log: (m: string) => void;
+}
+/**
+ * Serial FIFO of tool-eligible turns. One worker runs at a time (concurrent tool
+ * calls against one device/workspace can interleave destructively; the owner is a
+ * single actor). Each task runs in a fresh ephemeral worker seeded with only its
+ * instruction; on error or timeout the worker is torn down, a generic message is
+ * sent to the task's reply, and the queue advances — a task can never wedge the
+ * queue (which would starve the owner's DM lane).
+ */
+export declare class WorkerQueue {
+    private deps;
+    private q;
+    private loop;
+    private running;
+    constructor(deps: WorkerQueueDeps);
+    enqueue(task: WorkerTask): void;
+    /** Resolves when the queue has processed everything enqueued so far. */
+    whenDrained(): Promise<void>;
+    private drain;
+    private runOne;
+}
+//# sourceMappingURL=worker-queue.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",