@agentvault/claude-bridge 0.5.8 → 0.6.0

package/dist/arming.d.ts

@@ -10,24 +10,54 @@ export declare class ArmingState {
     private pending;
     private consumed;
     /**
-     * Replace the armed set. Use ONLY for the launch-env seed (AV_ARM_ROOM), which
-     * is itself a host-local action and is therefore allowed to arm.
+     * Replace the armed set. Use for the host-local launch seed (AV_ARM_ROOM) —
+     * itself a host-local action and therefore allowed to arm — and as the
+     * primitive `applyAuthoritative` below delegates to for non-shell workers.
      *
-     * Do NOT use this for the backend connect `arming_snapshot`: that snapshot
-     * reflects owner *intent* (set at web-request time, before any local approval),
-     * so arming from it would let a web-session compromise arm a worker on reconnect
-     * without host access — defeating the 2-of-2 local-approval model. The channel
-     * snapshot path uses `reconcileDisarm` (disarm-only) instead.
+     * The B-pure posture (Task 4) treats the backend connect/live
+     * `arming_snapshot` the same way — see `applyAuthoritative`'s docstring for
+     * the current arm-from-snapshot rationale. Shell-capable (OS-isolated)
+     * workers do NOT use this path; they stay on `reconcileDisarm` (disarm-only,
+     * see below) until #20.
      */
     applySnapshot(roomIds: string[]): void;
     /**
-     * Disarm-only reconciliation from the backend connect snapshot. Disarms any
-     * currently-armed room whose intent is no longer armed (i.e. NOT in
-     * `intendedArmed`) — so a disarm issued while the bridge was offline still takes
-     * effect on reconnect — but NEVER arms a room. Arming stays exclusively behind a
-     * local `approve-arm`. Returns the rooms that were disarmed. In-memory arming
-     * survives a WS reconnect, so a genuinely-approved arm is unaffected here; only a
-     * full process restart (which clears this state) requires re-approval on the host.
+     * Set the armed set to EXACTLY `intendedArmed`: arms every room in the list
+     * that isn't already armed, and disarms every currently-armed room that is
+     * absent from it. This is the AUTHORITATIVE arm-from-snapshot path (Task 4,
+     * reversing the prior disarm-only safeguard for non-shell workers).
+     *
+     * Why arming from the snapshot is now safe: `intendedArmed` is derived
+     * server-side from `devices.work_allowed`, and that flag can only be flipped
+     * by `PUT /devices/{id}/work_allowed`, which REJECTS any device-bound caller
+     * outright (C1 guard — a human account owner only; an agent, including a
+     * compromised one, cannot self-authorize). So "arm from snapshot" no longer
+     * means "a web session can arm a worker" in the old adversarial sense — it
+     * means "the verified owner's grant is applied end-to-end, live, without
+     * requiring a separate host-local approval step for every reconnect." This is
+     * the accepted B-pure posture; see #20 to harden it further with local
+     * approval for non-shell workers too. Shell-capable (OS-isolated) workers are
+     * carved out of this path entirely (C2) — see the shell-gate in bridge.ts —
+     * because a shell worker armed by a web flag is a live RCE surface even under
+     * an honest owner (a compromised owner web session, or a compromised backend,
+     * would get arbitrary code execution). Those workers stay on `reconcileDisarm`
+     * (disarm-only) until #20 delivers local approval for them as well.
+     */
+    applyAuthoritative(intendedArmed: string[]): void;
+    /**
+     * Disarm-only reconciliation from the backend connect/live snapshot. Disarms
+     * any currently-armed room whose intent is no longer armed (i.e. NOT in
+     * `intendedArmed`) — so a disarm issued while the bridge was offline still
+     * takes effect on reconnect — but NEVER arms a room. Used for OS-isolated
+     * (shell-capable) workers ONLY (C2): a shell worker must never be armed by a
+     * web-originated flag, because a compromised owner session or backend would
+     * translate directly into host code execution. Those workers can be armed
+     * only by the host-local launch seed (`AV_ARM_ROOM`, via `applySnapshot`)
+     * until #20 delivers a local-approval path for them too. Non-shell workers
+     * use `applyAuthoritative` instead (Task 4) — see its docstring. Returns the
+     * rooms that were disarmed. In-memory arming survives a WS reconnect, so a
+     * genuinely-armed room is unaffected here; only a full process restart
+     * (which clears this state) requires re-arming.
      */
     reconcileDisarm(intendedArmed: string[]): string[];
     isArmed(roomId: string): boolean;

package/dist/bridge.d.ts

@@ -3,6 +3,13 @@ export interface RoomMessage {
     roomId: string;
     senderName: string;
     plaintext: string;
+    /** True when the sender is another agent (SecureChannel derives this from the
+     *  room roster). Used to decide reply expectation: a human/owner speaking in a
+     *  room always expects a reply; agent-authored traffic does not (the agent may
+     *  stay silent, and it prevents agent↔agent reply loops). Absent on older
+     *  payloads / tests → treated as "not an agent" is NOT assumed: replyExpected is
+     *  set only when we affirmatively know the sender is a human (=== false). */
+    senderIsAgent?: boolean;
 }
 /** Slice 2 Plan C arming events (SecureChannel re-emits these from the backend). */
 export interface ArmRequested {
@@ -15,6 +22,12 @@ export interface DisarmEvent {
 }
 export interface ArmingSnapshot {
     roomIds: string[];
+    /** Task 3 (P1 bridge): the device-level owner grant this snapshot carries
+     *  (backend `devices.work_allowed`, Task 2). Optional so older/test payloads
+     *  without it don't break — treated as `false` (fail-closed) when absent. */
+    workAllowed?: boolean;
+    /** #627: owner's "Remove all gates" grant. Absent ⇒ gates stay in place. */
+    gatesRemoved?: boolean;
 }
 /** Metadata SecureChannel attaches to a 1:1 `message` event. `roomId` is set only
  *  when the `message` actually originated in a room (handled by room_message), so
@@ -37,6 +50,11 @@ export interface RoomChannel {
     on(ev: "arm_requested", cb: (e: ArmRequested) => void): unknown;
     on(ev: "disarm", cb: (e: DisarmEvent) => void): unknown;
     on(ev: "arming_snapshot", cb: (e: ArmingSnapshot) => void): unknown;
+    /** Task 3: SecureChannel's connection lifecycle signal. It never emits a
+     *  bare `"close"` — a WS drop is reported as `state` moving to
+     *  `"disconnected"` (or `"error"`), and a completed reconnect as `"ready"`
+     *  (both the dedicated `state` value AND the separate `"ready"` event). */
+    on(ev: "state", cb: (s: string) => void): unknown;
     sendToRoom(roomId: string, text: string): Promise<void>;
     send(text: string): Promise<void>;
     /** Optional so legacy/test fakes without arming support don't break wiring. */
@@ -59,9 +77,12 @@ export interface RoomSession {
     /** `reply` is the immutable reply sink captured for THIS message (see
      *  ActiveTarget.snapshotReply) — the session invokes it when Claude answers.
      *  `opts.autoReplyOnText` (set for 1:1 DMs) makes the session fall back to
-     *  sending plain assistant text when the model never calls the say tool (#416). */
+     *  sending plain assistant text when the model never calls the say tool (#416).
+     *  `opts.replyExpected` requests that same fallback for a room turn (a human/owner
+     *  sender) WITHOUT enabling tools — decoupled from autoReplyOnText on purpose. */
     push(text: string, reply?: (text: string) => Promise<void>, opts?: {
         autoReplyOnText?: boolean;
+        replyExpected?: boolean;
         armed?: () => boolean;
     }): void;
 }
@@ -148,11 +169,43 @@ export declare function wireBridge(channel: RoomChannel, session: RoomSession, t
     roomFilter?: string;
     armRoom?: boolean;
     log?: (msg: string) => void;
-    /** Slice 2 Plan C (T11): worker capability + local-approval marker dir. */
-    worker?: boolean;
+    /** Slice 2 Plan C (T11): worker capability (derived from workspaceDir) + local-approval marker dir. */
     workspaceDir?: string;
     dataDir?: string;
     /** Override the approval poll interval (ms) — for tests. */
     approvalPollMs?: number;
+    /**
+     * Task 4 (C2 shell-gate): true when this worker runs Bash unconfined
+     * (AV_WORKER_OS_ISOLATED=1 — see config.ts/index.ts, threaded from the
+     * session's `osIsolated`). When true, the `arming_snapshot` handler stays
+     * disarm-only regardless of B1/worker-capability — a shell worker is not
+     * armed by a web-originated flag (RCE risk).
+     *
+     * #627 EXCEPTION: unless the owner has removed all gates. That grant is an
+     * explicit, recorded decision to accept exactly this risk, so it lifts C2;
+     * revoking it disarms the rooms the web armed under it. See the
+     * `applyArmingSnapshot` comment block for the full rationale. Without the
+     * grant, C2 is unchanged.
+     *
+     * Falls back to reading the env directly only if the caller doesn't thread this.
+     */
+    osIsolated?: boolean;
+    /**
+     * Task 3 (P1 bridge): out-param that receives the live `workAllowed()`
+     * getter once, synchronously, during wiring. Callers (index.ts, Task 4)
+     * capture it to thread device-level tool-capability into the router +
+     * session gate. Kept as an out-param rather than changing wireBridge's
+     * return type so every existing `const arming = wireBridge(...)` caller
+     * (index.ts, arming-authoritative.test.ts, bridge.test.ts) stays intact.
+     */
+    onWorkAllowed?: (getter: () => boolean) => void;
+    /**
+     * #627: out-param that receives the live `gatesRemoved()` getter once,
+     * synchronously, during wiring — same shape as `onWorkAllowed` above, and
+     * for the same reason (keeps wireBridge's return type stable so existing
+     * callers are untouched). index.ts captures it and threads it into the
+     * worker session's gate.
+     */
+    onGatesRemoved?: (getter: () => boolean) => void;
 }): ArmingState;
 //# sourceMappingURL=bridge.d.ts.map

package/dist/config.d.ts

@@ -14,8 +14,9 @@ export interface BridgeConfig {
     roomFilter?: string;
     model?: string;
     systemPrompt?: string;
-    worker: boolean;
-    workspaceDir?: string;
+    /** Per-agent filesystem sandbox (Facet-A fence). Always set: auto-defaults
+     *  to a sibling of the key/data dir (H-2) unless AV_WORKSPACE_DIR overrides it. */
+    workspaceDir: string;
     permissionMode: "auto" | "acceptEdits" | "bypassPermissions";
     /** Slice 2: arm the pinned room (roomFilter) for worker tools on room turns.
      *  Off by default. Valid only with worker + roomFilter + workspaceDir. */

package/dist/index.js

@@ -10,8 +10,8 @@ var __export = (target, all) => {
 };
 
 // src/config.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync, readFileSync as readFileSync2, mkdirSync, chmodSync } from "node:fs";
+import { join as join5, resolve as resolve2, sep, dirname } from "node:path";
 function hasRecoverableBackup(dataDir) {
   try {
     const parsed = JSON.parse(readFileSync2(join5(dataDir, BACKUP_FILE), "utf-8"));
@@ -38,8 +38,22 @@ function resolveDataDir(env) {
 function loadConfig(env, argv = []) {
   const { dataDir, source: dataDirSource } = resolveDataDir(env);
   const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || "";
-  const worker = env.AV_WORKER === "1" || env.AV_WORKER === "true";
-  const workspaceDir = env.AV_WORKSPACE_DIR || void 0;
+  const workspaceDir = env.AV_WORKSPACE_DIR || join5(dirname(dataDir), "workspaces", slugify2(env.AV_AGENT_NAME ?? "claude"));
+  const wsReal = resolve2(workspaceDir);
+  const ddReal = resolve2(dataDir);
+  if (wsReal === ddReal || wsReal.startsWith(ddReal + sep) || ddReal.startsWith(wsReal + sep)) {
+    throw new Error(
+      `AV_WORKSPACE_DIR (${workspaceDir}) must be disjoint from the data dir (${dataDir})`
+    );
+  }
+  try {
+    mkdirSync(workspaceDir, { recursive: true, mode: 448 });
+    chmodSync(workspaceDir, 448);
+  } catch (e7) {
+    throw new Error(
+      `Failed to create/secure the agent workspace at ${workspaceDir} (override with AV_WORKSPACE_DIR): ${e7.message}`
+    );
+  }
   const osIsolated = env.AV_WORKER_OS_ISOLATED === "1" || env.AV_WORKER_OS_ISOLATED === "true";
   const PERMISSION_MODES = ["auto", "acceptEdits", "bypassPermissions"];
   const permissionMode = env.AV_PERMISSION_MODE ?? "auto";
@@ -48,16 +62,8 @@ function loadConfig(env, argv = []) {
       `invalid AV_PERMISSION_MODE: ${env.AV_PERMISSION_MODE} (expected one of ${PERMISSION_MODES.join(", ")})`
     );
   }
-  if (worker && !workspaceDir) {
-    throw new Error(
-      "worker mode requires AV_WORKSPACE_DIR (the project directory the agent works in)"
-    );
-  }
   const armRoom = env.AV_ARM_ROOM === "1" || env.AV_ARM_ROOM === "true";
   if (armRoom) {
-    if (!worker) {
-      throw new Error("AV_ARM_ROOM requires worker mode (AV_WORKER=1)");
-    }
     if (!env.AV_ROOM_ID) {
       throw new Error("AV_ARM_ROOM requires a pinned room (AV_ROOM_ID) \u2014 the armed collaboration room");
     }
@@ -82,7 +88,6 @@ function loadConfig(env, argv = []) {
     roomFilter: env.AV_ROOM_ID || void 0,
     model: env.AV_CLAUDE_MODEL || void 0,
     systemPrompt: env.AV_SYSTEM_PROMPT || void 0,
-    worker,
     workspaceDir,
     permissionMode,
     armRoom,
@@ -99,7 +104,7 @@ var init_config = __esm({
 });
 
 // src/service/launcher.ts
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 function sq2(s10) {
   return `'${s10.replace(/'/g, `'\\''`)}'`;
 }
@@ -124,7 +129,7 @@ function renderLauncher(opts) {
   return lines.join("\n") + "\n";
 }
 function writeLauncher(deps, spec) {
-  deps.mkdir(dirname2(spec.launcherPath));
+  deps.mkdir(dirname3(spec.launcherPath));
   deps.writeFile(spec.launcherPath, spec.launcherScript);
   deps.chmod(spec.launcherPath, 493);
 }
@@ -158,7 +163,6 @@ function buildServiceSpec(cfg, opts) {
     AV_API_URL: cfg.apiUrl,
     AV_PERMISSION_MODE: cfg.permissionMode
   };
-  if (cfg.worker) env.AV_WORKER = "1";
   if (cfg.workspaceDir) env.AV_WORKSPACE_DIR = cfg.workspaceDir;
   if (cfg.roomFilter) env.AV_ROOM_ID = cfg.roomFilter;
   if (cfg.armRoom) env.AV_ARM_ROOM = "1";
@@ -171,7 +175,7 @@ function buildServiceSpec(cfg, opts) {
     launcherPath,
     launcherScript: renderLauncher({ installPath: opts.path, entrypoint: opts.entrypoint }),
     env,
-    workingDir: cfg.worker && cfg.workspaceDir ? cfg.workspaceDir : opts.home,
+    workingDir: cfg.workspaceDir ? cfg.workspaceDir : opts.home,
     logOut: join7(cfg.dataDir, "logs", "bridge.log"),
     logErr: join7(cfg.dataDir, "logs", "bridge.error.log"),
     keepAliveUnlessCleanExit: true,
@@ -187,7 +191,7 @@ var init_spec = __esm({
 });
 
 // src/service/launchd.ts
-import { dirname as dirname3, join as join8 } from "node:path";
+import { dirname as dirname4, join as join8 } from "node:path";
 function esc3(s10) {
   return s10.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -241,9 +245,9 @@ var init_launchd = __esm({
       }
       install(spec) {
         const path2 = this.plistPath(spec.label);
-        this.deps.mkdir(dirname3(spec.logOut));
+        this.deps.mkdir(dirname4(spec.logOut));
         writeLauncher(this.deps, spec);
-        this.deps.mkdir(dirname3(path2));
+        this.deps.mkdir(dirname4(path2));
         this.deps.writeFile(path2, renderLaunchdPlist(spec));
         const svc = `${this.domain()}/${spec.label}`;
         this.deps.exec("launchctl", ["bootout", svc]);
@@ -277,7 +281,7 @@ var init_launchd = __esm({
 });
 
 // src/service/systemd.ts
-import { dirname as dirname4, join as join9 } from "node:path";
+import { dirname as dirname5, join as join9 } from "node:path";
 function q5(s10) {
   const esc4 = s10.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/%/g, "%%");
   return `"${esc4}"`;
@@ -318,9 +322,9 @@ var init_systemd = __esm({
       }
       install(spec) {
         const path2 = this.unitPath(spec.label);
-        this.deps.mkdir(dirname4(spec.logOut));
+        this.deps.mkdir(dirname5(spec.logOut));
         writeLauncher(this.deps, spec);
-        this.deps.mkdir(dirname4(path2));
+        this.deps.mkdir(dirname5(path2));
         this.deps.writeFile(path2, renderSystemdUnit(spec));
         this.deps.exec("loginctl", ["enable-linger", this.deps.user]);
         this.deps.exec("systemctl", ["--user", "daemon-reload"]);
@@ -345,7 +349,7 @@ var init_systemd = __esm({
 
 // src/service/backend.ts
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, rmSync as rmSync3, existsSync as existsSync4, chmodSync } from "node:fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, rmSync as rmSync3, existsSync as existsSync4, chmodSync as chmodSync2 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -357,8 +361,8 @@ function defaultDeps() {
       return { code: r7.status ?? 1, stdout: r7.stdout ?? "" };
     },
     writeFile: (p2, d10) => writeFileSync2(p2, d10),
-    mkdir: (p2) => mkdirSync3(p2, { recursive: true }),
-    chmod: (p2, m6) => chmodSync(p2, m6),
+    mkdir: (p2) => mkdirSync4(p2, { recursive: true }),
+    chmod: (p2, m6) => chmodSync2(p2, m6),
     rm: (p2) => rmSync3(p2, { force: true }),
     exists: (p2) => existsSync4(p2)
   };
@@ -589,7 +593,7 @@ var init_libsodium_sumo = __esm2({
       }
     }
     _Module = Module;
-    Module.ready = new Promise(function(resolve3, reject) {
+    Module.ready = new Promise(function(resolve32, reject) {
       var Module2 = _Module;
       Module2.onAbort = reject;
       Module2.print = function(what) {
@@ -601,7 +605,7 @@ var init_libsodium_sumo = __esm2({
       Module2.onRuntimeInitialized = function() {
         try {
           Module2._crypto_secretbox_keybytes();
-          resolve3();
+          resolve32();
         } catch (err2) {
           reject(err2);
         }
@@ -54446,8 +54450,8 @@ var init_mutex = __esm2({
       }
       async lock() {
         let releaseLock;
-        const nextLock = new Promise((resolve3) => {
-          releaseLock = resolve3;
+        const nextLock = new Promise((resolve32) => {
+          releaseLock = resolve32;
         });
         const previousLock = __classPrivateFieldGet(this, _Mutex_locked, "f");
         __classPrivateFieldSet(this, _Mutex_locked, nextLock, "f");
@@ -65246,6 +65250,58 @@ var init_channel = __esm2({
         }
         return void 0;
       }
+      /**
+       * True when a conversation is NOT a genuine 1:1 owner DM — i.e. it belongs to a
+       * room OR an A2A channel — and therefore must NEVER surface to the native worker
+       * tool-gate as a no-roomId `message` (the gate treats that as an authenticated
+       * owner DM, tool-enabled, bypassing arming). This is the predicate every fallback
+       * emit guard uses (MLS 1:1, DR-delivery queue, HTTP poll).
+       *
+       * Resolves from LOCAL persisted state — BOTH `_persisted.rooms[*].conversationIds`
+       * and `_persisted.a2aChannels[*].conversationId` — and accepts EITHER the
+       * conversation id or the conversation-group id, so a convGroupId-only room/A2A
+       * payload is still caught while a genuine convGroupId-only 1:1 shared-group DM
+       * (present in neither map) still returns false and emits.
+       *
+       * Some fallback guards additionally honor an AUTHORITATIVE server routing field as
+       * a backstop for the cold-local-state window — but WHICH field each carries differs
+       * per endpoint, so do NOT assume a blanket "backend always populates room_id/
+       * a2a_channel_id" at a new call site:
+       *   - HTTP poll (`/devices/{id}/messages`): server `room_id` populated for room-backed
+       *     convs (conv_room_map). No `a2a_channel_id` on this endpoint → A2A caught locally.
+       *   - DR-delivery (`/dr/delivery` -> dr_delivery_service.pull_pending): server `room_id`
+       *     populated (from the conversation); NO `a2a_channel_id` (DrDeliveryQueue is
+       *     1:1-only, never A2A). room_id is null in practice today but real for any future
+       *     room-over-DR row.
+       *   - MLS 1:1 (`_handleMessageMLS`): room/A2A are routed away UPSTREAM at the
+       *     MLS-delivery dispatcher (authoritative `room_id`/`a2a_channel_id`) before this
+       *     handler; the fields are absent on `data` here, so this predicate is the belt.
+       * The MLS-delivery *queue* endpoint (mls_delivery_service.pull_pending) is the one that
+       * returns all of room_id/a2a_channel_id/conversation_group_id — but that feeds the
+       * dispatcher, not these emit guards directly.
+       *
+       * No fail-closed drop-unknown guard is used: that would risk dropping a legitimate
+       * 1:1 owner DM that arrives before room/A2A hydration (a North-Star violation). The
+       * reachable residual (truly-cold local state AND the server omitting its routing field
+       * on a room/A2A row) is empty today because the only paths that carry room/A2A rows
+       * (poll + MLS dispatcher) always populate the field; DR-delivery and sync are
+       * structurally 1:1-only.
+       */
+      _isNonDmConversation(convId, convGroupId) {
+        const ids = [convId, convGroupId].filter((x22) => !!x22);
+        if (ids.length === 0) return false;
+        if (this._persisted?.rooms) {
+          for (const room of Object.values(this._persisted.rooms)) {
+            if (room.conversationIds?.some((c22) => ids.includes(c22))) return true;
+          }
+        }
+        if (this._persisted?.a2aChannels) {
+          for (const ch2 of Object.values(this._persisted.a2aChannels)) {
+            if (ch2.conversationId && ids.includes(ch2.conversationId)) return true;
+          }
+        }
+        return false;
+      }
       /**
        * Get recent message history for a specific room, for LLM context injection.
        * Returns the last N messages tagged with `room:{roomId}`.
@@ -65499,7 +65555,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.3" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.7" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -65575,7 +65631,7 @@ var init_channel = __esm2({
        * Optional timeout rejects with an Error.
        */
       waitForDecision(decisionId, timeoutMs) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve32, reject) => {
           let timer = null;
           const handler = (plaintext, metadata) => {
             if (metadata.messageType !== "decision_response") return;
@@ -65584,7 +65640,7 @@ var init_channel = __esm2({
               if (parsed.decision?.decision_id === decisionId) {
                 if (timer) clearTimeout(timer);
                 this.removeListener("message", handler);
-                resolve3({
+                resolve32({
                   decision_id: parsed.decision.decision_id,
                   selected_option_id: parsed.decision.selected_option_id,
                   resolved_at: parsed.decision.resolved_at,
@@ -67116,7 +67172,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.3" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.7" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67366,7 +67422,11 @@ var init_channel = __esm2({
               this.emit("disarm", { roomId: data.data?.room_id });
             }
             if (data.event === "arming_snapshot") {
-              this.emit("arming_snapshot", { roomIds: data.data?.room_ids ?? [] });
+              this.emit("arming_snapshot", {
+                workAllowed: data.data?.work_allowed === true,
+                gatesRemoved: data.data?.gates_removed === true,
+                roomIds: data.data?.room_ids ?? []
+              });
             }
             if (data.event === "policy_blocked") {
               this.emit("policy_blocked", data.data);
@@ -67426,7 +67486,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.3" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.7" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -67886,6 +67946,10 @@ var init_channel = __esm2({
             return;
           }
           if (messageType === "history_catchup_response") return;
+          if (data.room_id || data.a2a_channel_id || this._isNonDmConversation(convId, convGroupId)) {
+            console.warn(`[SecureChannel] Dropped 1:1 MLS emit for non-DM conv ${(convId ?? convGroupId ?? "?").slice(0, 8)} (room/A2A guard)`);
+            return;
+          }
           if (convId) {
             const session = this._sessions.get(convId);
             if (session && !session.activated) {
@@ -68732,7 +68796,12 @@ ${messageText}`;
             senderName: senderLabel,
             plaintext: messageText,
             messageType,
-            timestamp: data.created_at ?? (/* @__PURE__ */ new Date()).toISOString()
+            timestamp: data.created_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+            // Native bridge (claude-room-bridge) consumes this to decide reply
+            // expectation: a human/owner speaking in a room always expects a reply,
+            // an agent does not. Derived from the room roster (line ~5394) — the same
+            // signal the OpenClaw mention-filter uses for loop prevention.
+            senderIsAgent
           });
           const contextualMessage = senderIsAgent ? messageText : `[${senderLabel}]: ${messageText}`;
           Promise.resolve(this.config.onMessage?.(contextualMessage, metadata)).catch((err) => {
@@ -69856,16 +69925,7 @@ ${messageText}`;
                 ackedIds.push(msg.queue_id);
                 continue;
               }
-              let isRoom = false;
-              if (this._persisted?.rooms) {
-                for (const room of Object.values(this._persisted.rooms)) {
-                  if (room.conversationIds?.includes(msg.conversation_id)) {
-                    isRoom = true;
-                    break;
-                  }
-                }
-              }
-              if (isRoom) {
+              if (msg.room_id || msg.a2a_channel_id || this._isNonDmConversation(msg.conversation_id, msg.conversation_group_id)) {
                 ackedIds.push(msg.queue_id);
                 continue;
               }
@@ -70508,7 +70568,7 @@ ${messageText}`;
               if (msg.sender_device_id === this._deviceId) continue;
               const session = this._sessions.get(msg.conversation_id);
               if (!session) continue;
-              if (this._roomIdForConversation(msg.conversation_id)) {
+              if (msg.room_id || this._isNonDmConversation(msg.conversation_id)) {
                 this._persisted.lastMessageTimestamp = msg.created_at;
                 continue;
               }
@@ -86826,7 +86886,7 @@ var init_protocol = __esm2({
               return;
             }
             const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-            await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
+            await new Promise((resolve32) => setTimeout(resolve32, pollInterval));
             options?.signal?.throwIfAborted();
           }
         } catch (error210) {
@@ -86843,7 +86903,7 @@ var init_protocol = __esm2({
        */
       request(request, resultSchema, options) {
         const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve32, reject) => {
           const earlyReject = (error210) => {
             reject(error210);
           };
@@ -86921,7 +86981,7 @@ var init_protocol = __esm2({
               if (!parseResult.success) {
                 reject(parseResult.error);
               } else {
-                resolve3(parseResult.data);
+                resolve32(parseResult.data);
               }
             } catch (error210) {
               reject(error210);
@@ -87182,12 +87242,12 @@ var init_protocol = __esm2({
           }
         } catch {
         }
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve32, reject) => {
           if (signal.aborted) {
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
             return;
           }
-          const timeoutId = setTimeout(resolve3, interval);
+          const timeoutId = setTimeout(resolve32, interval);
           signal.addEventListener("abort", () => {
             clearTimeout(timeoutId);
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -90172,7 +90232,7 @@ var require_compile = __commonJS({
       const schOrFunc = root3.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve3.call(this, root3, ref);
+      let _sch = resolve32.call(this, root3, ref);
       if (_sch === void 0) {
         const schema = (_a32 = root3.localRefs) === null || _a32 === void 0 ? void 0 : _a32[ref];
         const { schemaId } = this.opts;
@@ -90199,7 +90259,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s22) {
       return s1.schema === s22.schema && s1.root === s22.root && s1.baseId === s22.baseId;
     }
-    function resolve3(root3, ref) {
+    function resolve32(root3, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -90766,7 +90826,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve3(baseURI, relativeURI, options) {
+    function resolve32(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse32(baseURI, schemelessOptions), parse32(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -90993,7 +91053,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve3,
+      resolve: resolve32,
       resolveComponent,
       equal,
       serialize,
@@ -95013,7 +95073,7 @@ var init_mcp = __esm2({
         let task = createTaskResult.task;
         const pollInterval = task.pollInterval ?? 5e3;
         while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-          await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
+          await new Promise((resolve32) => setTimeout(resolve32, pollInterval));
           const updatedTask = await extra.taskStore.getTask(taskId);
           if (!updatedTask) {
             throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -95954,7 +96014,7 @@ var init_dist2 = __esm2({
             });
             if (!chunk) {
               if (i2 === 1) {
-                await new Promise((resolve3) => setTimeout(resolve3));
+                await new Promise((resolve32) => setTimeout(resolve32));
                 maxReadCount = 3;
                 continue;
               }
@@ -96454,9 +96514,9 @@ data:
           const initRequest = messages.find((m22) => isInitializeRequest(m22));
           const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
           if (this._enableJsonResponse) {
-            return new Promise((resolve3) => {
+            return new Promise((resolve32) => {
               this._streamMapping.set(streamId, {
-                resolveJson: resolve3,
+                resolveJson: resolve32,
                 cleanup: () => {
                   this._streamMapping.delete(streamId);
                 }
@@ -97173,7 +97233,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.3" : "0.0.0-dev";
+    VERSION = true ? "0.23.7" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -118477,21 +118537,21 @@ function Z_($10, Q4) {
 
 // src/worker-permission.ts
 import { realpathSync as realpathSync2 } from "node:fs";
-import { resolve as resolve2, dirname, basename, sep, isAbsolute } from "node:path";
+import { resolve as resolve3, dirname as dirname2, basename, sep as sep2, isAbsolute } from "node:path";
 var PATH_FIELDS = ["file_path", "path", "notebook_path"];
 function canonical(p2) {
-  const abs = resolve2(p2);
+  const abs = resolve3(p2);
   try {
     return realpathSync2(abs);
   } catch {
     const suffix = [];
     let dir = abs;
     for (; ; ) {
-      const parent2 = dirname(dir);
+      const parent2 = dirname2(dir);
       suffix.unshift(basename(dir));
       if (parent2 === dir) return abs;
       try {
-        return resolve2(realpathSync2(parent2), ...suffix);
+        return resolve3(realpathSync2(parent2), ...suffix);
       } catch {
         dir = parent2;
       }
@@ -118508,7 +118568,7 @@ function pathsOf(input) {
   return out;
 }
 function within(canonTarget, canonRoot) {
-  return canonTarget === canonRoot || canonTarget.startsWith(canonRoot + sep);
+  return canonTarget === canonRoot || canonTarget.startsWith(canonRoot + sep2);
 }
 function globPatternEscapes(pattern) {
   if (typeof pattern !== "string" || pattern.length === 0) return true;
@@ -118521,6 +118581,12 @@ function gateDecision(toolName, input, opts) {
   if (!opts.isToolTurn()) {
     return { deny: true, reason: "tools are disabled on this turn; reply with the say tool only" };
   }
+  if (opts.gatesRemoved?.()) {
+    return { deny: false };
+  }
+  if (opts.isOwnerDmTurn?.()) {
+    return { deny: false };
+  }
   if (toolName === "Bash") {
     return opts.osIsolated ? { deny: false } : { deny: true, reason: "Bash is disabled in worker mode unless the process is OS-isolated (set AV_WORKER_OS_ISOLATED=1)" };
   }
@@ -132433,6 +132499,15 @@ var PersistentClaudeSession = class {
    *  disarm denies the very next tool call. wireBridge binds it to the ArmingState
    *  for this turn's room; an unarmed room turn's getter returns false. */
   currentArmedGetter = () => false;
+  /** Per-turn: does this turn's sender expect a reply? DECOUPLED from
+   *  `currentAutoReply` on purpose — it drives ONLY the #416 plain-text fallback
+   *  (deliver assistant text when the model never calls say), NOT the tool gate.
+   *  True for owner 1:1 DMs (defaults from autoReplyOnText) AND for a HUMAN/owner
+   *  speaking in a room (wireBridge sets replyExpected from !senderIsAgent). An
+   *  agent-authored room turn keeps this false → the agent may still stay silent,
+   *  which also prevents agent↔agent reply loops. Tool access is unaffected: it
+   *  stays gated on currentAutoReply (owner DM) OR currentArmedGetter (armed room). */
+  currentReplyExpected = false;
   saidThisTurn = false;
   turnText = "";
   /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
@@ -132458,7 +132533,13 @@ var PersistentClaudeSession = class {
       parent_tool_use_id: null,
       session_id: ""
     };
-    const item = { msg, reply, autoReplyOnText: opts?.autoReplyOnText, armed: opts?.armed };
+    const item = {
+      msg,
+      reply,
+      autoReplyOnText: opts?.autoReplyOnText,
+      replyExpected: opts?.replyExpected,
+      armed: opts?.armed
+    };
     if (this.waiting) {
       const w2 = this.waiting;
       this.waiting = null;
@@ -132487,12 +132568,13 @@ var PersistentClaudeSession = class {
       } else if (this.opts.ephemeral) {
         return;
       } else {
-        item = await new Promise((resolve3) => {
-          this.waiting = resolve3;
+        item = await new Promise((resolve4) => {
+          this.waiting = resolve4;
         });
       }
       this.activeReply = item.reply;
       this.currentAutoReply = item.autoReplyOnText ?? false;
+      this.currentReplyExpected = item.replyExpected ?? item.autoReplyOnText ?? false;
       this.currentArmedGetter = item.armed ?? (() => false);
       this.saidThisTurn = false;
       this.turnText = "";
@@ -132530,7 +132612,26 @@ var PersistentClaudeSession = class {
       // D5: currentArmedGetter() is called HERE on every tool decision, so a
       // mid-turn disarm denies the next call. See worker-permission.test.ts +
       // session.test.ts for the covering assertions.
-      isToolTurn: () => this.currentAutoReply || this.currentArmedGetter(),
+      //
+      // Task 4 (C-1/H-3) HARD BACKSTOP: device-level `workAllowed()` is a top-level
+      // AND over BOTH signals — NO tool runs (owner DM OR armed room) when Work is
+      // off, even if the router ever mis-routed. `?? false` is the fail-closed
+      // default (no getter ⇒ no tools). Read LIVE per tool decision so a Work-off
+      // flip / fail-closed reconnect window denies the very next call.
+      isToolTurn: () => (this.opts.workAllowed?.() ?? false) && (this.currentAutoReply || this.currentArmedGetter()),
+      // Full-access lane: a 1:1 owner DM, whose ephemeral worker is seeded with
+      // ONLY the owner's own message, so no third party can steer the turn.
+      // Conjoined with !currentArmedGetter() deliberately: if a room turn ever
+      // arrived with autoReplyOnText set, it must fall through to the allowlist
+      // rather than inherit full access. Fail-safe, not merely descriptive.
+      // Read LIVE per tool decision, like isToolTurn.
+      isOwnerDmTurn: () => this.currentAutoReply && !this.currentArmedGetter(),
+      // #627: the owner removed all gates for this device. Evaluated by
+      // gateDecision AFTER isToolTurn, so an unarmed room turn stays chat-only
+      // — this widens what a tool turn may do, never which turns get tools.
+      // Read LIVE per decision so a revoke (or a reconnect reset) denies the
+      // very next call, exactly like workAllowed above.
+      gatesRemoved: () => this.opts.gatesRemoved?.() ?? false,
       // Slice 2 Plan B: emit an audit self-report for each tool decision on an
       // armed-room turn (both allow and deny). room_say is excluded by the hook.
       isArmedTurn: () => this.currentArmedGetter(),
@@ -132546,7 +132647,7 @@ var PersistentClaudeSession = class {
       }
     };
     console.error(
-      `[worker-gate] allowlist active \u2014 workspace=${this.opts.workspaceDir ?? "(none: file tools disabled)"}, bash=${this.opts.osIsolated ? "enabled (OS-isolated)" : "disabled"}`
+      `[worker-gate] active \u2014 1:1 owner DM: FULL access, no allowlist, no workspace fence. Armed room: FULL access whenever "Remove all gates" is on (live, owner-controlled, off by default); otherwise allowlist, workspace=${this.opts.workspaceDir ?? "(none: file tools disabled)"}, bash=${this.opts.osIsolated ? "enabled (OS-isolated)" : "disabled"}`
     );
     return {
       ...base,
@@ -132606,7 +132707,7 @@ var PersistentClaudeSession = class {
         }
       } else if (m6.type === "result") {
         const reply = this.activeReply;
-        if (this.currentAutoReply && !this.saidThisTurn && this.turnText.trim() && reply) {
+        if (this.currentReplyExpected && !this.saidThisTurn && this.turnText.trim() && reply) {
           void reply(this.turnText);
         }
       }
@@ -132652,6 +132753,7 @@ var WorkerQueue = class {
       session = this.deps.makeSession(task);
       session.push(task.instruction, task.reply, {
         autoReplyOnText: task.autoReplyOnText,
+        replyExpected: task.replyExpected,
         armed: task.armed
       });
       const currentSession = session;
@@ -132682,22 +132784,26 @@ function makeRouter(deps) {
     push(text, reply, opts) {
       const replySink = reply ?? (() => {
       });
-      if (deps.worker) {
-        const isOwnerDm = opts?.autoReplyOnText === true;
-        const isArmedRoom = opts?.armed?.() === true;
-        if (isOwnerDm) {
-          deps.queue.enqueue({ instruction: text, reply: replySink, autoReplyOnText: true });
-          return;
-        }
-        if (isArmedRoom) {
-          deps.queue.enqueue({
-            instruction: text,
-            reply: replySink,
-            autoReplyOnText: false,
-            armed: opts.armed
-          });
-          return;
-        }
+      const isOwnerDm = opts?.autoReplyOnText === true && opts?.armed === void 0 && deps.workAllowed();
+      const isArmedRoom = opts?.armed?.() === true && deps.workAllowed();
+      if (isOwnerDm) {
+        deps.queue.enqueue({
+          instruction: text,
+          reply: replySink,
+          autoReplyOnText: true,
+          replyExpected: opts?.replyExpected
+        });
+        return;
+      }
+      if (isArmedRoom) {
+        deps.queue.enqueue({
+          instruction: text,
+          reply: replySink,
+          autoReplyOnText: false,
+          replyExpected: opts?.replyExpected,
+          armed: opts.armed
+        });
+        return;
       }
       deps.listener.push(text, reply, opts);
     }
@@ -132712,26 +132818,58 @@ var ArmingState = class {
   consumed = /* @__PURE__ */ new Set();
   // request-ids already approved (one-shot)
   /**
-   * Replace the armed set. Use ONLY for the launch-env seed (AV_ARM_ROOM), which
-   * is itself a host-local action and is therefore allowed to arm.
+   * Replace the armed set. Use for the host-local launch seed (AV_ARM_ROOM) —
+   * itself a host-local action and therefore allowed to arm — and as the
+   * primitive `applyAuthoritative` below delegates to for non-shell workers.
    *
-   * Do NOT use this for the backend connect `arming_snapshot`: that snapshot
-   * reflects owner *intent* (set at web-request time, before any local approval),
-   * so arming from it would let a web-session compromise arm a worker on reconnect
-   * without host access — defeating the 2-of-2 local-approval model. The channel
-   * snapshot path uses `reconcileDisarm` (disarm-only) instead.
+   * The B-pure posture (Task 4) treats the backend connect/live
+   * `arming_snapshot` the same way — see `applyAuthoritative`'s docstring for
+   * the current arm-from-snapshot rationale. Shell-capable (OS-isolated)
+   * workers do NOT use this path; they stay on `reconcileDisarm` (disarm-only,
+   * see below) until #20.
    */
   applySnapshot(roomIds) {
     this.armed = new Set(roomIds);
   }
   /**
-   * Disarm-only reconciliation from the backend connect snapshot. Disarms any
-   * currently-armed room whose intent is no longer armed (i.e. NOT in
-   * `intendedArmed`) — so a disarm issued while the bridge was offline still takes
-   * effect on reconnect — but NEVER arms a room. Arming stays exclusively behind a
-   * local `approve-arm`. Returns the rooms that were disarmed. In-memory arming
-   * survives a WS reconnect, so a genuinely-approved arm is unaffected here; only a
-   * full process restart (which clears this state) requires re-approval on the host.
+   * Set the armed set to EXACTLY `intendedArmed`: arms every room in the list
+   * that isn't already armed, and disarms every currently-armed room that is
+   * absent from it. This is the AUTHORITATIVE arm-from-snapshot path (Task 4,
+   * reversing the prior disarm-only safeguard for non-shell workers).
+   *
+   * Why arming from the snapshot is now safe: `intendedArmed` is derived
+   * server-side from `devices.work_allowed`, and that flag can only be flipped
+   * by `PUT /devices/{id}/work_allowed`, which REJECTS any device-bound caller
+   * outright (C1 guard — a human account owner only; an agent, including a
+   * compromised one, cannot self-authorize). So "arm from snapshot" no longer
+   * means "a web session can arm a worker" in the old adversarial sense — it
+   * means "the verified owner's grant is applied end-to-end, live, without
+   * requiring a separate host-local approval step for every reconnect." This is
+   * the accepted B-pure posture; see #20 to harden it further with local
+   * approval for non-shell workers too. Shell-capable (OS-isolated) workers are
+   * carved out of this path entirely (C2) — see the shell-gate in bridge.ts —
+   * because a shell worker armed by a web flag is a live RCE surface even under
+   * an honest owner (a compromised owner web session, or a compromised backend,
+   * would get arbitrary code execution). Those workers stay on `reconcileDisarm`
+   * (disarm-only) until #20 delivers local approval for them as well.
+   */
+  applyAuthoritative(intendedArmed) {
+    this.applySnapshot(intendedArmed);
+  }
+  /**
+   * Disarm-only reconciliation from the backend connect/live snapshot. Disarms
+   * any currently-armed room whose intent is no longer armed (i.e. NOT in
+   * `intendedArmed`) — so a disarm issued while the bridge was offline still
+   * takes effect on reconnect — but NEVER arms a room. Used for OS-isolated
+   * (shell-capable) workers ONLY (C2): a shell worker must never be armed by a
+   * web-originated flag, because a compromised owner session or backend would
+   * translate directly into host code execution. Those workers can be armed
+   * only by the host-local launch seed (`AV_ARM_ROOM`, via `applySnapshot`)
+   * until #20 delivers a local-approval path for them too. Non-shell workers
+   * use `applyAuthoritative` instead (Task 4) — see its docstring. Returns the
+   * rooms that were disarmed. In-memory arming survives a WS reconnect, so a
+   * genuinely-armed room is unaffected here; only a full process restart
+   * (which clears this state) requires re-arming.
    */
   reconcileDisarm(intendedArmed) {
     const keep = new Set(intendedArmed);
@@ -132785,7 +132923,7 @@ var ArmingState = class {
 };
 
 // src/approve-cli.ts
-import { mkdirSync as mkdirSync2, writeFileSync, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync as rmSync2, existsSync as existsSync3 } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync as rmSync2, existsSync as existsSync3 } from "node:fs";
 import { join as join6 } from "node:path";
 var APPROVALS_SUBDIR = "arm-approvals";
 var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
@@ -132807,7 +132945,7 @@ function writeApproval(dataDir, requestId, roomId) {
   const id = sanitizeRequestId(requestId);
   const room = sanitizeRoomId(roomId);
   const dir = join6(dataDir, APPROVALS_SUBDIR);
-  mkdirSync2(dir, { recursive: true });
+  mkdirSync3(dir, { recursive: true });
   writeFileSync(join6(dir, id), room);
 }
 function drainApprovals(dataDir) {
@@ -132947,6 +133085,19 @@ function pollApprovalsOnce(arming, dataDir, onArmed, log = () => {
 function wireBridge(channel, session, target, opts = {}) {
   const log = opts.log ?? (() => {
   });
+  let workAllowed = false;
+  const workAllowedGetter = () => workAllowed;
+  opts.onWorkAllowed?.(workAllowedGetter);
+  let gatesRemoved = false;
+  const gatesRemovedGetter = () => gatesRemoved;
+  opts.onGatesRemoved?.(gatesRemovedGetter);
+  const webArmedUnderGrant = /* @__PURE__ */ new Set();
+  channel.on("state", (s10) => {
+    if (s10 !== "ready") {
+      workAllowed = false;
+      gatesRemoved = false;
+    }
+  });
   const arming = new ArmingState();
   if (opts.armRoom === true && opts.roomFilter) {
     arming.applySnapshot([opts.roomFilter]);
@@ -132972,6 +133123,7 @@ function wireBridge(channel, session, target, opts = {}) {
     target.setRoom(e7.roomId);
     session.push(`[${e7.senderName}]: ${e7.plaintext}`, target.snapshotReply(channel, log), {
       autoReplyOnText: false,
+      replyExpected: e7.senderIsAgent === false,
       armed: () => arming.isArmed(e7.roomId)
     });
   });
@@ -132981,7 +133133,8 @@ function wireBridge(channel, session, target, opts = {}) {
     target.setDm();
     session.push(text, target.snapshotReply(channel, log), { autoReplyOnText: true });
   });
-  const workerCapable = !!(opts.worker && opts.workspaceDir);
+  const workerCapable = !!opts.workspaceDir;
+  const osIsolated = opts.osIsolated !== void 0 ? opts.osIsolated : process.env.AV_WORKER_OS_ISOLATED === "1" || process.env.AV_WORKER_OS_ISOLATED === "true";
   const heartbeat = () => {
     try {
       channel.sendWorkerHeartbeat?.({ workerCapable, armedRooms: arming.armedRooms() });
@@ -132991,21 +133144,47 @@ function wireBridge(channel, session, target, opts = {}) {
   };
   heartbeat();
   channel.on("ready", () => heartbeat());
-  channel.on("arming_snapshot", (s10) => {
+  const applyArmingSnapshot = (s10) => {
+    workAllowed = s10?.workAllowed === true;
+    gatesRemoved = s10?.gatesRemoved === true;
     if (!workerCapable) {
       log("arming_snapshot ignored \u2014 not worker-capable");
       return;
     }
+    const roomIds = s10?.roomIds ?? [];
     try {
-      const dropped = arming.reconcileDisarm(s10?.roomIds ?? []);
-      if (dropped.length > 0) {
-        log(`arming snapshot reconcile \u2014 disarmed: [${dropped.map((r7) => r7.slice(0, 8)).join(", ")}]`);
-        heartbeat();
+      const before = new Set(arming.armedRooms());
+      if (osIsolated && gatesRemoved) {
+        arming.applyAuthoritative(roomIds);
+        for (const r7 of roomIds) if (!before.has(r7)) webArmedUnderGrant.add(r7);
+      } else if (osIsolated) {
+        if (webArmedUnderGrant.size > 0) {
+          const revoked = [...webArmedUnderGrant].filter((r7) => arming.isArmed(r7));
+          for (const r7 of revoked) arming.disarm(r7);
+          webArmedUnderGrant.clear();
+          if (revoked.length > 0) {
+            log(
+              `arming_snapshot: "Remove all gates" was revoked \u2014 disarming the rooms it had armed on this OS-isolated worker: [${revoked.map((r7) => r7.slice(0, 8)).join(", ")}]`
+            );
+          }
+        }
+        const dropped = arming.reconcileDisarm(roomIds);
+        if (dropped.length > 0) {
+          log(
+            `arming_snapshot: OS-isolated worker \u2014 disarm-only until #20 (web cannot arm shell workers); disarmed: [${dropped.map((r7) => r7.slice(0, 8)).join(", ")}]`
+          );
+        }
+      } else {
+        arming.applyAuthoritative(roomIds);
       }
+      const after = arming.armedRooms();
+      const changed = after.length !== before.size || after.some((r7) => !before.has(r7));
+      if (changed) heartbeat();
     } catch (err) {
       log(`arming_snapshot handling failed (ignored): ${err instanceof Error ? err.message : String(err)}`);
     }
-  });
+  };
+  channel.on("arming_snapshot", applyArmingSnapshot);
   channel.on("disarm", (d10) => {
     if (!workerCapable) {
       log("disarm ignored \u2014 not worker-capable");
@@ -133067,22 +133246,20 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.5.8" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.6.0" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
-  if (cfg.worker) {
-    console.error(`[bridge] WORKER MODE \u2014 workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
-    if (cfg.armRoom) {
-      console.error(
-        `[bridge] ARMED ROOM ${cfg.roomFilter} \u2014 worker tools are enabled on this room's turns. The enclave key dir stays fenced; the workspace dir is ADVISORY (the SDK does not confine file ops to it \u2014 they root in $HOME). Blast radius = whatever this host/environment exposes.`
-      );
-      console.error(
-        "[bridge] ARMED ROOM WARNING: this room contains agents you do not control. A room peer's message can drive your agent's tools. The directory is NOT a sandbox \u2014 run this bridge in an owner-provisioned confined environment (dedicated droplet / container / OS-user) with no connected accounts or ambient credentials. See the Slice 2 hardening guide."
-      );
-    } else {
-      console.error(
-        "[bridge] WORKER MODE: tools run on owner DM turns only. Rooms stay say-only unless armed (AV_ARM_ROOM=1 with a pinned AV_ROOM_ID). Cross-turn injection note: a persistent session mixes room context with DM turns \u2014 run DM-only or OS-isolated if you do not arm a room."
-      );
-    }
+  console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
+  if (cfg.armRoom) {
+    console.error(
+      `[bridge] ARMED ROOM ${cfg.roomFilter} \u2014 worker tools are enabled on this room's turns. The enclave key dir stays fenced; the workspace dir is ADVISORY (the SDK does not confine file ops to it \u2014 they root in $HOME). Blast radius = whatever this host/environment exposes.`
+    );
+    console.error(
+      "[bridge] ARMED ROOM WARNING: this room contains agents you do not control. A room peer's message can drive your agent's tools. The directory is NOT a sandbox \u2014 run this bridge in an owner-provisioned confined environment (dedicated droplet / container / OS-user) with no connected accounts or ambient credentials. See the Slice 2 hardening guide."
+    );
+  } else {
+    console.error(
+      '[bridge] 1:1 owner DMs run with FULL tool access when "Allow tools" is on for this agent (dashboard switch, default off): any command, any file this user account can reach, network, skills and subagents \u2014 equivalent to a terminal on this machine, with no per-action prompt. Rooms are NOT affected: they stay say-only unless armed (AV_ARM_ROOM=1 with a pinned AV_ROOM_ID), and an armed room keeps the confined allowlist. Each tool-enabled turn runs in a fresh session seeded with only that one message, so room text cannot leak into a DM turn.'
+    );
   }
   const target = new ActiveTarget();
   if (cfg.roomFilter) target.setRoom(cfg.roomFilter);
@@ -133098,6 +133275,10 @@ async function main() {
     const c4 = channel;
     return c4._deviceJwt ?? c4._persisted?.deviceJwt ?? null;
   };
+  let liveWorkAllowed = () => false;
+  const workAllowed = () => liveWorkAllowed();
+  let liveGatesRemoved = () => false;
+  const gatesRemoved = () => liveGatesRemoved();
   const listener = new PersistentClaudeSession({
     model: cfg.model,
     systemPrompt: agentSystemPrompt,
@@ -133118,6 +133299,14 @@ async function main() {
       systemPrompt: agentSystemPrompt,
       onObserve: (text) => console.error(`[worker] observed (${text.length} chars, not sent)`),
       worker: true,
+      // Task 4: the hard backstop — no tool runs on any worker turn (owner DM or
+      // armed room) unless Work is on. Read live per tool decision.
+      workAllowed,
+      // #627: only the WORKER session gets this. The listener is the locked
+      // tools:[] facet and must stay that way — a grant that widened the
+      // always-on listener would put an unrestricted shell behind every
+      // untrusted room message, not just tool turns.
+      gatesRemoved,
       ephemeral: true,
       maxTurns: WORKER_MAX_TURNS,
       workspaceDir: cfg.workspaceDir,
@@ -133133,7 +133322,7 @@ async function main() {
     timeoutMs: WORKER_TIMEOUT_MS,
     log: (m6) => console.error(m6)
   });
-  const router = makeRouter({ worker: !!cfg.worker, listener, queue: workerQueue });
+  const router = makeRouter({ workAllowed, listener, queue: workerQueue });
   wireBridge(
     channel,
     { push: (t7, reply, opts) => router.push(t7, reply, opts) },
@@ -133143,9 +133332,17 @@ async function main() {
       armRoom: cfg.armRoom,
       log: (m6) => console.error("[bridge] " + m6),
       // Slice 2 Plan C (T11): live arm/disarm + local-approval poll + heartbeat.
-      worker: cfg.worker,
       workspaceDir: cfg.workspaceDir,
-      dataDir: cfg.dataDir
+      dataDir: cfg.dataDir,
+      osIsolated: cfg.osIsolated,
+      // Task 4: capture the live fail-closed workAllowed getter (set synchronously
+      // during wiring) into the indirection the router + worker session read live.
+      onWorkAllowed: (getter) => {
+        liveWorkAllowed = getter;
+      },
+      onGatesRemoved: (getter) => {
+        liveGatesRemoved = getter;
+      }
     }
   );
   attachLifecycle2(channel, {

package/dist/router.d.ts

@@ -4,12 +4,21 @@ import type { WorkerTask } from "./worker-queue.js";
 export interface PushLike {
     push(text: string, reply?: ReplySink, opts?: {
         autoReplyOnText?: boolean;
+        replyExpected?: boolean;
         armed?: () => boolean;
     }): void;
 }
 export interface RouterDeps {
-    /** AV_WORKER=1 → tool-eligible turns run in isolated workers; false → no worker ever. */
-    worker: boolean;
+    /**
+     * Task 4 (C-1/H-3): live, fail-closed device-level tool capability ("Work").
+     * MUST be read live at each push (never snapshotted) so a mid-connection flip
+     * and the fail-closed reconnect window both take effect immediately. Gates
+     * BOTH tool-eligible lanes — owner-DM and armed-room: Work off → the turn
+     * falls through to the tools-absent listener (structural fail-safe), making
+     * `work_allowed` the single on/off control for tool capability. The
+     * session-level isToolTurn AND remains the hard backstop for both lanes.
+     */
+    workAllowed: () => boolean;
     /** Always-on locked listener (tools:[]) for untrusted/non-tool turns. */
     listener: PushLike;
     /** Serial queue of tool-eligible turns. */
@@ -23,8 +32,9 @@ export interface RouterDeps {
  * worker via the queue; everything else stays on the locked listener. A room
  * turn's `armed` getter is read once here at routing time to pick the lane; the
  * same live getter is threaded to the worker task so a mid-turn disarm still
- * denies the next tool call (Facet A D5). Locked agents (worker=false) always
- * route to the listener — a strict no-op vs today.
+ * denies the next tool call (Facet A D5). `work_allowed` is the single control
+ * gating BOTH lanes: an armed room turn is only routed to the worker queue when
+ * workAllowed() is also true, so Work off always falls through to the listener.
  */
 export declare function makeRouter(deps: RouterDeps): PushLike;
 //# sourceMappingURL=router.d.ts.map

package/dist/service/spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/service/spec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB,EAAE,OAAO,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,GAAG,WAAW,CA2BvF"}
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/service/spec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB,EAAE,OAAO,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,GAAG,WAAW,CA0BvF"}

package/dist/session.d.ts

@@ -79,6 +79,25 @@ export interface SessionOpts {
     ephemeral?: boolean;
     /** Turn cap for a worker query() (bounds a runaway tool loop). */
     maxTurns?: number;
+    /**
+     * Task 4 (C-1/H-3): live, fail-closed device-level tool capability ("Work").
+     * Folded into `isToolTurn` as a top-level AND — the HARD backstop that makes
+     * the fail-safe real: NO tool runs (owner DM OR armed room) when this returns
+     * false, even if the router mis-routed. Read LIVE at each tool decision (never
+     * snapshotted). Absent getter ⇒ `?? false` ⇒ fail-closed (no tools). */
+    workAllowed?: () => boolean;
+    /**
+     * #627: live, fail-closed device-level "Remove all gates" grant. When this
+     * returns true the gate permits EVERY tool with no restrictions, in rooms
+     * and 1:1 alike — the owner's explicit decision, recorded in #627.
+     *
+     * NOT a replacement for `isToolTurn`: this is read AFTER it, so an UNARMED
+     * room turn is still chat-only. That ordering is what separates "a room you
+     * enabled" from "any room somebody added your agent to", and it costs
+     * nothing to keep. Read LIVE at each tool decision (never snapshotted);
+     * absent getter ⇒ `?? false` ⇒ gates stay in place.
+     */
+    gatesRemoved?: () => boolean;
 }
 export declare class PersistentClaudeSession {
     private opts;
@@ -107,6 +126,15 @@ export declare class PersistentClaudeSession {
      *  disarm denies the very next tool call. wireBridge binds it to the ArmingState
      *  for this turn's room; an unarmed room turn's getter returns false. */
     private currentArmedGetter;
+    /** Per-turn: does this turn's sender expect a reply? DECOUPLED from
+     *  `currentAutoReply` on purpose — it drives ONLY the #416 plain-text fallback
+     *  (deliver assistant text when the model never calls say), NOT the tool gate.
+     *  True for owner 1:1 DMs (defaults from autoReplyOnText) AND for a HUMAN/owner
+     *  speaking in a room (wireBridge sets replyExpected from !senderIsAgent). An
+     *  agent-authored room turn keeps this false → the agent may still stay silent,
+     *  which also prevents agent↔agent reply loops. Tool access is unaffected: it
+     *  stays gated on currentAutoReply (owner DM) OR currentArmedGetter (armed room). */
+    private currentReplyExpected;
     private saidThisTurn;
     private turnText;
     /** In-process room MCP server — hoisted so buildSdkOptions can reference it. */
@@ -128,6 +156,7 @@ export declare class PersistentClaudeSession {
      */
     push(text: string, reply?: ReplySink, opts?: {
         autoReplyOnText?: boolean;
+        replyExpected?: boolean;
         armed?: () => boolean;
     }): void;
     /** Route a say-tool message to the reply bound to the in-flight message, falling

package/dist/worker-permission.d.ts

@@ -13,6 +13,9 @@ export declare function makeWorkerPreToolUseHook(opts: {
     /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
     osIsolated: boolean;
     isToolTurn: () => boolean;
+    /** True when this turn is a 1:1 owner DM. That lane gets full access; rooms
+     *  keep the allowlist. Read live per tool call, like isToolTurn. */
+    isOwnerDmTurn?: () => boolean;
     /** Slice 2 Plan B: true when this turn comes from an armed room. When set,
      *  each tool decision (allow AND deny) is forwarded to onToolDecision for
      *  audit self-reporting. room_say is always excluded (it is the reply
@@ -36,5 +39,7 @@ export declare function makeWorkerPermission(opts: {
     /** True when the process is attested OS-isolated, gating whether Bash is allowed at all. */
     osIsolated: boolean;
     isToolTurn: () => boolean;
+    /** True when this turn is a 1:1 owner DM (full access lane). */
+    isOwnerDmTurn?: () => boolean;
 }): CanUseTool;
 //# sourceMappingURL=worker-permission.d.ts.map

package/dist/worker-queue.d.ts

@@ -7,6 +7,11 @@ export type WorkerTask = {
     reply: ReplySink;
     /** Owner-DM turns want a plain-text reply fallback (#416). */
     autoReplyOnText: boolean;
+    /** A human/owner sender expects a reply: if the worker answers in plain text
+     *  without calling say, deliver that text instead of dropping it. Decoupled from
+     *  autoReplyOnText so it delivers on a tool-capable room turn WITHOUT enabling
+     *  tools (arming governs tools). Absent/false for agent-authored turns. */
+    replyExpected?: boolean;
     /** Armed-room turns: live getter the gate reads per tool decision (mid-turn
      *  disarm denies the next call). Absent for owner DMs. */
     armed?: () => boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.5.8",
+  "version": "0.6.0",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",
@@ -23,10 +23,10 @@
     }
   },
   "scripts": {
-    "build": "tsc --emitDeclarationOnly && node build.mjs",
+    "build": "npm --prefix ../plugin run build && tsc --emitDeclarationOnly && node build.mjs",
     "start": "node dist/index.js",
     "test": "vitest run",
-    "prepublishOnly": "node build.mjs"
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.114",