@agentvault/claude-bridge 0.6.5 → 0.7.1

package/dist/approve-cli.d.ts

@@ -25,4 +25,13 @@ export declare function drainApprovals(dataDir: string): DrainedApproval[];
  *  Usage: `av-bridge approve-arm <request-id> <room-id>`. Both are shown to the
  *  operator in the bridge's arm-request log line and the web arm sheet. */
 export declare function maybeRunApproveArmSubcommand(argv: string[], dataDir: string): boolean;
+/**
+ * #20 — `av-bridge trust-host [--yes]` / `av-bridge untrust-host [--all]`.
+ *
+ * Headless like `approve-arm` (no channel, no network) so it works over a bare
+ * SSH session with no daemon running. The device-id is ALWAYS read from the
+ * persisted identity, never taken from argv — an operator-typed id is exactly
+ * the confused-deputy input F1 closed for approve-arm.
+ */
+export declare function maybeRunHostTrustSubcommand(argv: string[], dataDir: string, root?: string): boolean;
 //# sourceMappingURL=approve-cli.d.ts.map

package/dist/bridge.d.ts

@@ -61,7 +61,17 @@ export interface RoomChannel {
     sendWorkerHeartbeat?(h: {
         workerCapable: boolean;
         armedRooms: string[];
+        hostTrusted: boolean;
+        gatesEffective: boolean;
     }): void;
+    /**
+     * #20: this worker's own device-id, checked against the host-trust directory
+     * to decide whether a web-granted "Remove all gates" switch actually takes
+     * effect (see bsafe-arming.ts). Optional so legacy/test fakes without it
+     * don't break wiring — `decideArming` treats a missing id as untrusted
+     * (fail-closed), matching `channel.deviceId ?? ""`.
+     */
+    deviceId?: string | null;
 }
 /**
  * #392 cooperative quiet: tracks per-room hush windows so the native agent holds
@@ -207,5 +217,14 @@ export declare function wireBridge(channel: RoomChannel, session: RoomSession, t
      * worker session's gate.
      */
     onGatesRemoved?: (getter: () => boolean) => void;
+    /**
+     * #20 test-only injection point: overrides where `isTrusted` (via
+     * `decideArming`) looks for host-trust markers, mirroring `host-trust.ts`'s
+     * own `root?` parameter. Production callers never pass this, so
+     * `decideArming` receives `undefined` and `isTrusted` falls back to its
+     * default `~/.agentvault` — unchanged from today. Tests pass a `mkdtemp`
+     * dir so they can `grant(...)` into it without touching the real host.
+     */
+    trustRoot?: string;
 }): ArmingState;
 //# sourceMappingURL=bridge.d.ts.map

package/dist/bsafe-arming.d.ts

@@ -0,0 +1,30 @@
+export type ArmingMode = "authoritative-under-grant" | "authoritative-bsafe" | "c2-disarm-only" | "authoritative-bpure";
+export interface ArmingDecision {
+    /** The grant actually applied — web intent AND host trust. */
+    gatesRemoved: boolean;
+    mode: ArmingMode;
+    /**
+     * True when rooms armed from THIS snapshot must be remembered as revocable:
+     * the web armed them on an OS-isolated worker under an authority that can
+     * lapse. BOTH authorities qualify — the full-access grant AND host trust on
+     * its own — because both lapse into `c2-disarm-only`, which is the only place
+     * the record is ever consumed.
+     *
+     * This was `recordUnderGrant`, true for the grant alone, and that was the
+     * defect the 2026-07-27 whole-branch review found: rooms armed under
+     * `authoritative-bsafe` went unrecorded, so `av-bridge untrust-host` left them
+     * armed — and an armed room on an OS-isolated worker means Bash is allowed.
+     *
+     * `authoritative-bpure` stays false: a non-isolated worker never reaches
+     * `c2-disarm-only`, so the record would never be read.
+     */
+    recordWebArmed: boolean;
+    hostTrusted: boolean;
+}
+export declare function decideArming(opts: {
+    snapshotGatesRemoved: boolean;
+    osIsolated: boolean;
+    deviceId: string;
+    trustRoot?: string;
+}): ArmingDecision;
+//# sourceMappingURL=bsafe-arming.d.ts.map

package/dist/host-trust.d.ts

@@ -0,0 +1,53 @@
+export declare class HostTrustError extends Error {
+}
+export declare function trustDir(root?: string): string;
+/**
+ * Fail-closed in every direction: any doubt at all means untrusted.
+ *
+ * `lstatSync`, NOT `statSync`: a symlink must never count as a marker. This
+ * used `statSync`, which FOLLOWS symlinks, so `ln -s <any regular file>
+ * ~/.agentvault/host-trust/<device-id>` read as a grant. That was not
+ * exploitable under today's threat model — the stated adversary is web-only and
+ * cannot create files on the host, and an agent with Bash could write the real
+ * marker anyway — but it is precisely the bypass that would defeat the deferred
+ * Task 10 root-owned marker, whose whole claim is that an agent running as the
+ * user cannot forge one. The trust DIRECTORY is deliberately user-owned so that
+ * revocation needs no privilege, so an agent with a shell can plant a symlink
+ * there; pointed at any root-owned, non-group/other-writable file (`/etc/passwd`
+ * is uid 0, mode 644 on both macOS and Linux) it would satisfy every clause of
+ * that check against the TARGET. Rejecting symlinks here closes it in advance.
+ */
+export declare function isTrusted(deviceId: string, root?: string): boolean;
+export declare function grant(deviceId: string, root?: string): void;
+/**
+ * Returns true only if a real marker was actually removed.
+ *
+ * M1. This used `existsSync` + `rmSync(p, { force: true, recursive: true })`.
+ * `existsSync` is true for a DIRECTORY, so a directory squatting at a marker
+ * path was recursively deleted — contents and all — and reported as a
+ * successful revoke. Reached in practice through `untrust-host --all`
+ * (approve-cli.ts:131), which revokes everything `listTrusted()` returns.
+ *
+ * Only a regular file is a marker, which is already `isTrusted`'s rule; `lstat`
+ * so a symlink is never followed or counted. Anything else was never a grant,
+ * so removing it is not this function's job — and refusing keeps `recursive`
+ * out of this file entirely.
+ *
+ * The invariant callers actually depend on is preserved: after `revoke()`,
+ * `isTrusted()` is false, because it rejects non-files too.
+ */
+export declare function revoke(deviceId: string, root?: string): boolean;
+/**
+ * Filtered through `isTrusted` rather than the filename alone, so the listing
+ * cannot disagree with the decision. A name-only filter reported directories
+ * and symlinks as trusted devices, which both over-stated trust to an operator
+ * reading the list and fed non-markers to `revoke()` in the `--all` path.
+ */
+export declare function listTrusted(root?: string): string[];
+/**
+ * Resolve this agent's device-id from its persisted identity. `trust-host` runs
+ * headless with no channel and possibly no running bridge, so it cannot ask the
+ * backend who it is — and it must never accept an operator-typed id (F1).
+ */
+export declare function readDeviceId(dataDir: string): string;
+//# sourceMappingURL=host-trust.d.ts.map

package/dist/index.js

@@ -155,7 +155,7 @@ var init_launcher = __esm({
 });
 
 // src/service/spec.ts
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function buildServiceSpec(cfg, opts) {
   const env = {
     AV_AGENT_NAME: cfg.agentName,
@@ -168,7 +168,7 @@ function buildServiceSpec(cfg, opts) {
   if (cfg.armRoom) env.AV_ARM_ROOM = "1";
   if (cfg.model) env.AV_CLAUDE_MODEL = cfg.model;
   if (cfg.systemPrompt) env.AV_SYSTEM_PROMPT = cfg.systemPrompt;
-  const launcherPath = join7(cfg.dataDir, "launch-bridge.sh");
+  const launcherPath = join8(cfg.dataDir, "launch-bridge.sh");
   return {
     label: `dev.agentvault.bridge-${slugify2(cfg.agentName)}`,
     programArgs: [launcherPath],
@@ -176,8 +176,8 @@ function buildServiceSpec(cfg, opts) {
     launcherScript: renderLauncher({ installPath: opts.path, entrypoint: opts.entrypoint }),
     env,
     workingDir: cfg.workspaceDir ? cfg.workspaceDir : opts.home,
-    logOut: join7(cfg.dataDir, "logs", "bridge.log"),
-    logErr: join7(cfg.dataDir, "logs", "bridge.error.log"),
+    logOut: join8(cfg.dataDir, "logs", "bridge.log"),
+    logErr: join8(cfg.dataDir, "logs", "bridge.error.log"),
     keepAliveUnlessCleanExit: true,
     runAtLoad: true
   };
@@ -191,7 +191,7 @@ var init_spec = __esm({
 });
 
 // src/service/launchd.ts
-import { dirname as dirname4, join as join8 } from "node:path";
+import { dirname as dirname4, join as join9 } from "node:path";
 function esc3(s10) {
   return s10.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -238,7 +238,7 @@ var init_launchd = __esm({
       }
       deps;
       plistPath(label) {
-        return join8(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
+        return join9(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
       }
       domain() {
         return `gui/${this.deps.uid}`;
@@ -281,7 +281,7 @@ var init_launchd = __esm({
 });
 
 // src/service/systemd.ts
-import { dirname as dirname5, join as join9 } from "node:path";
+import { dirname as dirname5, join as join10 } from "node:path";
 function q5(s10) {
   const esc4 = s10.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/%/g, "%%");
   return `"${esc4}"`;
@@ -318,7 +318,7 @@ var init_systemd = __esm({
       }
       deps;
       unitPath(label) {
-        return join9(this.deps.home, ".config", "systemd", "user", `${label}.service`);
+        return join10(this.deps.home, ".config", "systemd", "user", `${label}.service`);
       }
       install(spec) {
         const path2 = this.unitPath(spec.label);
@@ -349,7 +349,7 @@ var init_systemd = __esm({
 
 // src/service/backend.ts
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, rmSync as rmSync3, existsSync as existsSync4, chmodSync as chmodSync2 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync4, existsSync as existsSync4, chmodSync as chmodSync3 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -360,10 +360,10 @@ function defaultDeps() {
       const r7 = spawnSync(cmd, args, { encoding: "utf8" });
       return { code: r7.status ?? 1, stdout: r7.stdout ?? "" };
     },
-    writeFile: (p2, d10) => writeFileSync2(p2, d10),
-    mkdir: (p2) => mkdirSync4(p2, { recursive: true }),
-    chmod: (p2, m6) => chmodSync2(p2, m6),
-    rm: (p2) => rmSync3(p2, { force: true }),
+    writeFile: (p2, d10) => writeFileSync3(p2, d10),
+    mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
+    chmod: (p2, m6) => chmodSync3(p2, m6),
+    rm: (p2) => rmSync4(p2, { force: true }),
     exists: (p2) => existsSync4(p2)
   };
 }
@@ -447,8 +447,8 @@ var init_subcommand = __esm({
 });
 
 // src/index.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5 } from "node:fs";
-import { join as join10 } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join11 } from "node:path";
 
 // ../plugin/dist/index.js
 import * as nc from "node:crypto";
@@ -65559,7 +65559,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.10" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.11" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -65593,7 +65593,16 @@ var init_channel = __esm2({
         this._ws.send(
           JSON.stringify({
             event: "worker_heartbeat",
-            data: { worker_capable: h22.workerCapable, armed_rooms: h22.armedRooms }
+            data: {
+              worker_capable: h22.workerCapable,
+              armed_rooms: h22.armedRooms,
+              // #20: OPTIONAL on the way in so an older bridge against a newer
+              // plugin still emits a shape the backend can read. `=== true` means
+              // absent/malformed becomes false — the fail-closed direction, and it
+              // never emits `undefined` (which would drop the key entirely).
+              host_trusted: h22.hostTrusted === true,
+              gates_effective: h22.gatesEffective === true
+            }
           })
         );
       }
@@ -67289,7 +67298,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.10" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.11" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67607,7 +67616,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.10" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.11" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68481,13 +68490,13 @@ ${messageText}`;
        * Looks for OpenClaw workspace config, falls back to default path.
        */
       _resolveWorkspaceDir() {
-        const homedir = osHomedir();
+        const homedir2 = osHomedir();
         const agentName = this.config.agentName;
         if (this._persisted?.agentRole === "lead") {
-          return join4(homedir, ".openclaw", "workspace");
+          return join4(homedir2, ".openclaw", "workspace");
         }
         try {
-          const configPath = join4(homedir, ".openclaw", "openclaw.json");
+          const configPath = join4(homedir2, ".openclaw", "openclaw.json");
           const raw = readFileSync(configPath, "utf-8");
           const config22 = JSON.parse(raw);
           const agents = config22?.agents?.list;
@@ -68501,9 +68510,9 @@ ${messageText}`;
         } catch {
         }
         if (agentName && agentName !== "CLI Agent" && agentName !== "OpenClaw Agent") {
-          return join4(homedir, ".openclaw", `workspace-${agentName}`);
+          return join4(homedir2, ".openclaw", `workspace-${agentName}`);
         }
-        return join4(homedir, ".openclaw", "workspace");
+        return join4(homedir2, ".openclaw", "workspace");
       }
       /**
        * Send a structured JSON reply to a specific conversation.
@@ -68702,20 +68711,20 @@ ${messageText}`;
         try {
           const payload = JSON.parse(plaintext);
           if (messageType === "credential_grant") {
-            const grant = payload;
-            if (grant.nonce && !this._credentialStore.checkNonce(roomId, grant.nonce)) {
+            const grant2 = payload;
+            if (grant2.nonce && !this._credentialStore.checkNonce(roomId, grant2.nonce)) {
               console.warn(`[SecureChannel] Credential grant replay detected for room ${roomId.slice(0, 8)}..., ignoring`);
               return;
             }
             const keys = [];
-            for (const cred of grant.credentials || []) {
+            for (const cred of grant2.credentials || []) {
               this._credentialStore.grant(roomId, {
                 key: cred.key,
                 value: cred.value,
                 type: cred.type,
                 scope: cred.scope,
-                grantedAt: grant.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
-                agreementId: grant.agreement_id,
+                grantedAt: grant2.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+                agreementId: grant2.agreement_id,
                 roomId
               });
               keys.push(cred.key);
@@ -68723,21 +68732,21 @@ ${messageText}`;
             console.log(
               `[SecureChannel] Credentials granted for room ${roomId.slice(0, 8)}...: ${keys.join(", ")} (${keys.length} keys)`
             );
-            this._sendCredentialAck(roomId, grant.agreement_id, keys, "stored");
-            this.emit("credentials_granted", { roomId, keys, agreementId: grant.agreement_id });
+            this._sendCredentialAck(roomId, grant2.agreement_id, keys, "stored");
+            this.emit("credentials_granted", { roomId, keys, agreementId: grant2.agreement_id });
           } else if (messageType === "credential_revoke") {
-            const revoke = payload;
+            const revoke2 = payload;
             const revoked = [];
-            for (const key of revoke.credential_keys || []) {
+            for (const key of revoke2.credential_keys || []) {
               if (this._credentialStore.revoke(roomId, key)) {
                 revoked.push(key);
               }
             }
             console.log(
-              `[SecureChannel] Credentials revoked for room ${roomId.slice(0, 8)}...: ${revoked.join(", ")} (reason: ${revoke.reason || "none"})`
+              `[SecureChannel] Credentials revoked for room ${roomId.slice(0, 8)}...: ${revoked.join(", ")} (reason: ${revoke2.reason || "none"})`
             );
-            this._sendCredentialAck(roomId, revoke.agreement_id, revoked, "revoked");
-            this.emit("credentials_revoked", { roomId, keys: revoked, agreementId: revoke.agreement_id });
+            this._sendCredentialAck(roomId, revoke2.agreement_id, revoked, "revoked");
+            this.emit("credentials_revoked", { roomId, keys: revoked, agreementId: revoke2.agreement_id });
           }
         } catch (err) {
           console.error("[SecureChannel] Error handling credential message:", err);
@@ -97386,7 +97395,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.10" : "0.0.0-dev";
+    VERSION = true ? "0.23.11" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -118691,6 +118700,84 @@ function Z_($10, Q4) {
 // src/worker-permission.ts
 import { realpathSync as realpathSync2 } from "node:fs";
 import { resolve as resolve3, dirname as dirname2, basename, sep as sep2, isAbsolute } from "node:path";
+
+// src/host-trust.ts
+import { mkdirSync as mkdirSync3, writeFileSync, rmSync as rmSync2, readdirSync as readdirSync2, lstatSync as lstatSync2, readFileSync as readFileSync4, chmodSync as chmodSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+import { homedir, hostname as hostname3 } from "node:os";
+var TRUST_SUBDIR = "host-trust";
+var DIR_MODE3 = 448;
+var FILE_MODE3 = 384;
+var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+var IDENTITY_FILES = ["agentvault.json", "secure-channel.json", "agentvault.json.bak"];
+var HostTrustError = class extends Error {
+};
+function trustDir(root3) {
+  return join6(root3 ?? join6(homedir(), ".agentvault"), TRUST_SUBDIR);
+}
+function sanitize(deviceId) {
+  if (typeof deviceId !== "string" || !ID_RE.test(deviceId)) {
+    throw new HostTrustError("invalid device-id");
+  }
+  return deviceId;
+}
+function isTrusted(deviceId, root3) {
+  try {
+    if (typeof deviceId !== "string" || !ID_RE.test(deviceId)) return false;
+    const p2 = join6(trustDir(root3), deviceId);
+    return lstatSync2(p2).isFile();
+  } catch {
+    return false;
+  }
+}
+function grant(deviceId, root3) {
+  const id = sanitize(deviceId);
+  const dir = trustDir(root3);
+  const p2 = join6(dir, id);
+  mkdirSync3(dir, { recursive: true, mode: DIR_MODE3 });
+  writeFileSync(
+    p2,
+    `granted_at=${(/* @__PURE__ */ new Date()).toISOString()} host=${hostname3()}
+`,
+    { mode: FILE_MODE3 }
+  );
+  chmodSync2(dir, DIR_MODE3);
+  chmodSync2(p2, FILE_MODE3);
+}
+function revoke(deviceId, root3) {
+  const id = sanitize(deviceId);
+  const p2 = join6(trustDir(root3), id);
+  try {
+    if (!lstatSync2(p2).isFile()) return false;
+  } catch {
+    return false;
+  }
+  rmSync2(p2, { force: true });
+  return true;
+}
+function listTrusted(root3) {
+  try {
+    return readdirSync2(trustDir(root3)).filter(
+      (n10) => ID_RE.test(n10) && isTrusted(n10, root3)
+    );
+  } catch {
+    return [];
+  }
+}
+function readDeviceId(dataDir) {
+  for (const f7 of IDENTITY_FILES) {
+    try {
+      const parsed = JSON.parse(readFileSync4(join6(dataDir, f7), "utf-8"));
+      if (parsed?.deviceId && ID_RE.test(parsed.deviceId)) return parsed.deviceId;
+    } catch {
+    }
+  }
+  throw new HostTrustError(
+    "no device identity found in the data dir \u2014 start the bridge once to enrol, then re-run"
+  );
+}
+
+// src/worker-permission.ts
 var PATH_FIELDS = ["file_path", "path", "notebook_path"];
 function canonical(p2) {
   const abs = resolve3(p2);
@@ -118734,6 +118821,12 @@ function gateDecision(toolName, input, opts) {
   if (!opts.isToolTurn()) {
     return { deny: true, reason: "tools are disabled on this turn; reply with the say tool only" };
   }
+  if (FILE_TOOLS.has(toolName)) {
+    const trustRoot = canonical(trustDir());
+    if (pathsOf(input).some((p2) => within(p2, trustRoot))) {
+      return { deny: true, reason: "the host-trust directory is not writable by the agent" };
+    }
+  }
   if (opts.gatesRemoved?.()) {
     return { deny: false };
   }
@@ -118973,7 +119066,7 @@ __export(external_exports, {
   guid: () => guid4,
   hash: () => hash2,
   hex: () => hex4,
-  hostname: () => hostname4,
+  hostname: () => hostname5,
   httpUrl: () => httpUrl2,
   includes: () => _includes2,
   instanceof: () => _instanceof2,
@@ -120360,7 +120453,7 @@ __export(regexes_exports2, {
   extendedDuration: () => extendedDuration2,
   guid: () => guid3,
   hex: () => hex3,
-  hostname: () => hostname3,
+  hostname: () => hostname4,
   html5Email: () => html5Email2,
   idnEmail: () => idnEmail2,
   integer: () => integer2,
@@ -120437,7 +120530,7 @@ var cidrv43 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5
 var cidrv63 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base643 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
 var base64url3 = /^[A-Za-z0-9_-]*$/;
-var hostname3 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+var hostname4 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 var domain2 = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
 var e1643 = /^\+[1-9]\d{6,14}$/;
 var dateSource2 = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
@@ -130807,7 +130900,7 @@ __export(schemas_exports2, {
   guid: () => guid4,
   hash: () => hash2,
   hex: () => hex4,
-  hostname: () => hostname4,
+  hostname: () => hostname5,
   httpUrl: () => httpUrl2,
   instanceof: () => _instanceof2,
   int: () => int2,
@@ -131311,7 +131404,7 @@ var ZodCustomStringFormat2 = /* @__PURE__ */ $constructor2("ZodCustomStringForma
 function stringFormat2(format, fnOrRegex, _params = {}) {
   return _stringFormat2(ZodCustomStringFormat2, format, fnOrRegex, _params);
 }
-function hostname4(_params) {
+function hostname5(_params) {
   return _stringFormat2(ZodCustomStringFormat2, "hostname", regexes_exports2.hostname, _params);
 }
 function hex4(_params) {
@@ -133146,20 +133239,20 @@ var ArmingState = class {
 };
 
 // src/approve-cli.ts
-import { mkdirSync as mkdirSync3, writeFileSync, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync as rmSync2, existsSync as existsSync3 } from "node:fs";
-import { join as join6 } from "node:path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, readFileSync as readFileSync5, readdirSync as readdirSync3, rmSync as rmSync3, existsSync as existsSync3 } from "node:fs";
+import { join as join7 } from "node:path";
 var APPROVALS_SUBDIR = "arm-approvals";
-var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+var ID_RE2 = /^[A-Za-z0-9_-]{1,128}$/;
 var ApproveArmError = class extends Error {
 };
 function sanitizeRequestId(requestId) {
-  if (!ID_RE.test(requestId)) {
+  if (!ID_RE2.test(requestId)) {
     throw new ApproveArmError("invalid request-id");
   }
   return requestId;
 }
 function sanitizeRoomId(roomId) {
-  if (!ID_RE.test(roomId)) {
+  if (!ID_RE2.test(roomId)) {
     throw new ApproveArmError("invalid room-id");
   }
   return roomId;
@@ -133167,24 +133260,24 @@ function sanitizeRoomId(roomId) {
 function writeApproval(dataDir, requestId, roomId) {
   const id = sanitizeRequestId(requestId);
   const room = sanitizeRoomId(roomId);
-  const dir = join6(dataDir, APPROVALS_SUBDIR);
-  mkdirSync3(dir, { recursive: true });
-  writeFileSync(join6(dir, id), room);
+  const dir = join7(dataDir, APPROVALS_SUBDIR);
+  mkdirSync4(dir, { recursive: true });
+  writeFileSync2(join7(dir, id), room);
 }
 function drainApprovals(dataDir) {
-  const dir = join6(dataDir, APPROVALS_SUBDIR);
+  const dir = join7(dataDir, APPROVALS_SUBDIR);
   if (!existsSync3(dir)) return [];
   const out = [];
-  for (const name of readdirSync2(dir)) {
-    if (!ID_RE.test(name)) continue;
+  for (const name of readdirSync3(dir)) {
+    if (!ID_RE2.test(name)) continue;
     let roomId = "";
     try {
-      roomId = readFileSync4(join6(dir, name), "utf8").trim();
+      roomId = readFileSync5(join7(dir, name), "utf8").trim();
     } catch {
     }
-    out.push({ requestId: name, roomId: ID_RE.test(roomId) ? roomId : "" });
+    out.push({ requestId: name, roomId: ID_RE2.test(roomId) ? roomId : "" });
     try {
-      rmSync2(join6(dir, name), { force: true, recursive: true });
+      rmSync3(join7(dir, name), { force: true, recursive: true });
     } catch {
     }
   }
@@ -133208,6 +133301,60 @@ function maybeRunApproveArmSubcommand(argv, dataDir) {
   }
   return true;
 }
+function maybeRunHostTrustSubcommand(argv, dataDir, root3) {
+  const cmd = argv[2];
+  if (cmd !== "trust-host" && cmd !== "untrust-host") return false;
+  const flags = argv.slice(3);
+  if (cmd === "untrust-host" && flags.includes("--all")) {
+    const ids = listTrusted(root3);
+    for (const id of ids) revoke(id, root3);
+    console.log(`[untrust-host] revoked ${ids.length} host-trust grant(s)`);
+    return true;
+  }
+  let deviceId;
+  try {
+    deviceId = readDeviceId(dataDir);
+  } catch (e7) {
+    console.error(`[${cmd}] ${e7.message}`);
+    process.exitCode = 1;
+    return true;
+  }
+  if (cmd === "untrust-host") {
+    const removed = revoke(deviceId, root3);
+    console.log(
+      removed ? `[untrust-host] revoked host trust for ${deviceId}` : `[untrust-host] no host-trust grant existed for ${deviceId}`
+    );
+    return true;
+  }
+  if (!flags.includes("--yes")) {
+    console.log(
+      `This machine will trust web-granted full access for device ${deviceId}.
+Writes:  ${trustDir(root3)}/${deviceId}
+Revoke:  av-bridge untrust-host
+Re-run with --yes to confirm.`
+    );
+    return true;
+  }
+  grant(deviceId, root3);
+  console.log(`[trust-host] host trust granted for ${deviceId}`);
+  return true;
+}
+
+// src/bsafe-arming.ts
+function decideArming(opts) {
+  const hostTrusted = isTrusted(opts.deviceId, opts.trustRoot);
+  const gatesRemoved = opts.snapshotGatesRemoved && hostTrusted;
+  if (!opts.osIsolated) {
+    return { gatesRemoved, mode: "authoritative-bpure", recordWebArmed: false, hostTrusted };
+  }
+  if (gatesRemoved) {
+    return { gatesRemoved, mode: "authoritative-under-grant", recordWebArmed: true, hostTrusted };
+  }
+  if (hostTrusted) {
+    return { gatesRemoved: false, mode: "authoritative-bsafe", recordWebArmed: true, hostTrusted };
+  }
+  return { gatesRemoved: false, mode: "c2-disarm-only", recordWebArmed: false, hostTrusted };
+}
 
 // src/bridge.ts
 var APPROVAL_POLL_MS = 1500;
@@ -133314,11 +133461,13 @@ function wireBridge(channel, session, target, opts = {}) {
   let gatesRemoved = false;
   const gatesRemovedGetter = () => gatesRemoved;
   opts.onGatesRemoved?.(gatesRemovedGetter);
-  const webArmedUnderGrant = /* @__PURE__ */ new Set();
+  let hostTrusted = false;
+  const webArmedRevocable = /* @__PURE__ */ new Set();
   channel.on("state", (s10) => {
     if (s10 !== "ready") {
       workAllowed = false;
       gatesRemoved = false;
+      hostTrusted = false;
     }
   });
   const arming = new ArmingState();
@@ -133336,7 +133485,14 @@ function wireBridge(channel, session, target, opts = {}) {
       e7.hushedUntil ? `room ${e7.roomId.slice(0, 8)} hushed until ${e7.hushedUntil} \u2014 holding` : `room ${e7.roomId.slice(0, 8)} hush cleared`
     );
   });
+  let warnedMissingSenderIsAgent = false;
   channel.on("room_message", (e7) => {
+    if (typeof e7.senderIsAgent !== "boolean" && !warnedMissingSenderIsAgent) {
+      warnedMissingSenderIsAgent = true;
+      log(
+        "WARNING: inbound room_message has no `senderIsAgent` \u2014 replies to humans in rooms will be DROPPED whenever the model answers in plain text instead of calling say (#630). Most likely cause: a stale bundled plugin dist. Rebuild the bridge (npm run build in packages/claude-room-bridge) and reinstall."
+      );
+    }
     if (opts.roomFilter && e7.roomId !== opts.roomFilter) return;
     if (hush.isHushed(e7.roomId)) {
       log(`inbound from ${e7.senderName} in ${e7.roomId.slice(0, 8)} \u2014 room hushed, holding (not replying)`);
@@ -133360,7 +133516,14 @@ function wireBridge(channel, session, target, opts = {}) {
   const osIsolated = opts.osIsolated !== void 0 ? opts.osIsolated : process.env.AV_WORKER_OS_ISOLATED === "1" || process.env.AV_WORKER_OS_ISOLATED === "true";
   const heartbeat = () => {
     try {
-      channel.sendWorkerHeartbeat?.({ workerCapable, armedRooms: arming.armedRooms() });
+      channel.sendWorkerHeartbeat?.({
+        workerCapable,
+        armedRooms: arming.armedRooms(),
+        hostTrusted,
+        // Already the conjunction: `gatesRemoved` is assigned from
+        // decideArming, which ANDs the web grant with host trust.
+        gatesEffective: gatesRemoved
+      });
     } catch (err) {
       log(`worker heartbeat send failed (ignored): ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -133369,40 +133532,56 @@ function wireBridge(channel, session, target, opts = {}) {
   channel.on("ready", () => heartbeat());
   const applyArmingSnapshot = (s10) => {
     workAllowed = s10?.workAllowed === true;
-    gatesRemoved = s10?.gatesRemoved === true;
+    const prevHostTrusted = hostTrusted;
+    const prevGatesEffective = gatesRemoved;
+    const decision = decideArming({
+      snapshotGatesRemoved: s10?.gatesRemoved === true,
+      osIsolated,
+      deviceId: channel.deviceId ?? "",
+      trustRoot: opts.trustRoot
+    });
+    gatesRemoved = decision.gatesRemoved;
+    hostTrusted = decision.hostTrusted;
+    const trustChanged = hostTrusted !== prevHostTrusted || gatesRemoved !== prevGatesEffective;
+    if (s10?.gatesRemoved === true && !decision.hostTrusted) {
+      log(
+        `"Remove all gates" is ON for this device but this HOST has not approved it. Full access is NOT in effect. Grant on this machine: av-bridge trust-host`
+      );
+    }
     if (!workerCapable) {
       log("arming_snapshot ignored \u2014 not worker-capable");
+      if (trustChanged) heartbeat();
       return;
     }
     const roomIds = s10?.roomIds ?? [];
     try {
       const before = new Set(arming.armedRooms());
-      if (osIsolated && gatesRemoved) {
-        arming.applyAuthoritative(roomIds);
-        for (const r7 of roomIds) if (!before.has(r7)) webArmedUnderGrant.add(r7);
-      } else if (osIsolated) {
-        if (webArmedUnderGrant.size > 0) {
-          const revoked = [...webArmedUnderGrant].filter((r7) => arming.isArmed(r7));
+      if (decision.mode === "c2-disarm-only") {
+        if (webArmedRevocable.size > 0) {
+          const revoked = [...webArmedRevocable].filter((r7) => arming.isArmed(r7));
           for (const r7 of revoked) arming.disarm(r7);
-          webArmedUnderGrant.clear();
+          webArmedRevocable.clear();
           if (revoked.length > 0) {
             log(
-              `arming_snapshot: "Remove all gates" was revoked \u2014 disarming the rooms it had armed on this OS-isolated worker: [${revoked.map((r7) => r7.slice(0, 8)).join(", ")}]`
+              `arming_snapshot: full access is not in effect \u2014 disarming the rooms it had armed on this OS-isolated worker: [${revoked.map((r7) => r7.slice(0, 8)).join(", ")}]`
             );
           }
         }
         const dropped = arming.reconcileDisarm(roomIds);
         if (dropped.length > 0) {
           log(
-            `arming_snapshot: OS-isolated worker \u2014 disarm-only until #20 (web cannot arm shell workers); disarmed: [${dropped.map((r7) => r7.slice(0, 8)).join(", ")}]`
+            `arming_snapshot: OS-isolated worker \u2014 disarm-only without host trust (av-bridge trust-host); disarmed: [${dropped.map((r7) => r7.slice(0, 8)).join(", ")}]`
           );
         }
       } else {
         arming.applyAuthoritative(roomIds);
+        if (decision.recordWebArmed) {
+          for (const r7 of roomIds) if (!before.has(r7)) webArmedRevocable.add(r7);
+        }
       }
       const after = arming.armedRooms();
       const changed = after.length !== before.size || after.some((r7) => !before.has(r7));
-      if (changed) heartbeat();
+      if (changed || trustChanged) heartbeat();
     } catch (err) {
       log(`arming_snapshot handling failed (ignored): ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -133458,6 +133637,9 @@ async function main() {
   if (maybeRunApproveArmSubcommand(process.argv, dataDirForSubcommand)) {
     process.exit(process.exitCode ?? 0);
   }
+  if (maybeRunHostTrustSubcommand(process.argv, dataDirForSubcommand)) {
+    process.exit(process.exitCode ?? 0);
+  }
   const { maybeRunServiceSubcommand: maybeRunServiceSubcommand2 } = await Promise.resolve().then(() => (init_subcommand(), subcommand_exports));
   if (maybeRunServiceSubcommand2(process.argv, process.env)) {
     process.exit(process.exitCode ?? 0);
@@ -133469,7 +133651,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.6.5" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.7.1" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -133555,9 +133737,9 @@ async function main() {
         `[worker-trap] ${rec.at} ${rec.outcome} after ${rec.ranMs}ms (waited ${rec.waitedMs}ms behind ${rec.queueDepthAtEnqueue}, ${rec.queueDepthAtStart} still queued)` + (rec.session ? ` composed=${rec.session.composedChars} result=${rec.session.sawResult} said=${rec.session.said}` : "")
       );
       try {
-        const dir = join10(cfg.dataDir, "logs");
-        mkdirSync5(dir, { recursive: true });
-        appendFileSync2(join10(dir, "worker-incidents.jsonl"), JSON.stringify(rec) + "\n");
+        const dir = join11(cfg.dataDir, "logs");
+        mkdirSync6(dir, { recursive: true });
+        appendFileSync2(join11(dir, "worker-incidents.jsonl"), JSON.stringify(rec) + "\n");
       } catch (err) {
         console.error(`[worker-trap] could not persist incident: ${err.message}`);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.6.5",
+  "version": "0.7.1",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",