@agentvault/claude-bridge 0.7.0 → 0.7.1

package/dist/host-trust.d.ts

@@ -19,8 +19,30 @@ export declare function trustDir(root?: string): string;
  */
 export declare function isTrusted(deviceId: string, root?: string): boolean;
 export declare function grant(deviceId: string, root?: string): void;
-/** Returns true only if a marker was actually removed. */
+/**
+ * Returns true only if a real marker was actually removed.
+ *
+ * M1. This used `existsSync` + `rmSync(p, { force: true, recursive: true })`.
+ * `existsSync` is true for a DIRECTORY, so a directory squatting at a marker
+ * path was recursively deleted — contents and all — and reported as a
+ * successful revoke. Reached in practice through `untrust-host --all`
+ * (approve-cli.ts:131), which revokes everything `listTrusted()` returns.
+ *
+ * Only a regular file is a marker, which is already `isTrusted`'s rule; `lstat`
+ * so a symlink is never followed or counted. Anything else was never a grant,
+ * so removing it is not this function's job — and refusing keeps `recursive`
+ * out of this file entirely.
+ *
+ * The invariant callers actually depend on is preserved: after `revoke()`,
+ * `isTrusted()` is false, because it rejects non-files too.
+ */
 export declare function revoke(deviceId: string, root?: string): boolean;
+/**
+ * Filtered through `isTrusted` rather than the filename alone, so the listing
+ * cannot disagree with the decision. A name-only filter reported directories
+ * and symlinks as trusted devices, which both over-stated trust to an operator
+ * reading the list and fed non-markers to `revoke()` in the `--all` path.
+ */
 export declare function listTrusted(root?: string): string[];
 /**
  * Resolve this agent's device-id from its persisted identity. `trust-host` runs

package/dist/index.js

@@ -349,7 +349,7 @@ var init_systemd = __esm({
 
 // src/service/backend.ts
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync4, existsSync as existsSync5, chmodSync as chmodSync2 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync4, existsSync as existsSync4, chmodSync as chmodSync3 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -362,9 +362,9 @@ function defaultDeps() {
     },
     writeFile: (p2, d10) => writeFileSync3(p2, d10),
     mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
-    chmod: (p2, m6) => chmodSync2(p2, m6),
+    chmod: (p2, m6) => chmodSync3(p2, m6),
     rm: (p2) => rmSync4(p2, { force: true }),
-    exists: (p2) => existsSync5(p2)
+    exists: (p2) => existsSync4(p2)
   };
 }
 function selectBackend(platform, deps) {
@@ -118702,10 +118702,12 @@ import { realpathSync as realpathSync2 } from "node:fs";
 import { resolve as resolve3, dirname as dirname2, basename, sep as sep2, isAbsolute } from "node:path";
 
 // src/host-trust.ts
-import { mkdirSync as mkdirSync3, writeFileSync, rmSync as rmSync2, existsSync as existsSync3, readdirSync as readdirSync2, lstatSync as lstatSync2, readFileSync as readFileSync4 } from "node:fs";
+import { mkdirSync as mkdirSync3, writeFileSync, rmSync as rmSync2, readdirSync as readdirSync2, lstatSync as lstatSync2, readFileSync as readFileSync4, chmodSync as chmodSync2 } from "node:fs";
 import { join as join6 } from "node:path";
 import { homedir, hostname as hostname3 } from "node:os";
 var TRUST_SUBDIR = "host-trust";
+var DIR_MODE3 = 448;
+var FILE_MODE3 = 384;
 var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 var IDENTITY_FILES = ["agentvault.json", "secure-channel.json", "agentvault.json.bak"];
 var HostTrustError = class extends Error {
@@ -118731,23 +118733,33 @@ function isTrusted(deviceId, root3) {
 function grant(deviceId, root3) {
   const id = sanitize(deviceId);
   const dir = trustDir(root3);
-  mkdirSync3(dir, { recursive: true });
+  const p2 = join6(dir, id);
+  mkdirSync3(dir, { recursive: true, mode: DIR_MODE3 });
   writeFileSync(
-    join6(dir, id),
+    p2,
     `granted_at=${(/* @__PURE__ */ new Date()).toISOString()} host=${hostname3()}
-`
+`,
+    { mode: FILE_MODE3 }
   );
+  chmodSync2(dir, DIR_MODE3);
+  chmodSync2(p2, FILE_MODE3);
 }
 function revoke(deviceId, root3) {
   const id = sanitize(deviceId);
   const p2 = join6(trustDir(root3), id);
-  if (!existsSync3(p2)) return false;
-  rmSync2(p2, { force: true, recursive: true });
+  try {
+    if (!lstatSync2(p2).isFile()) return false;
+  } catch {
+    return false;
+  }
+  rmSync2(p2, { force: true });
   return true;
 }
 function listTrusted(root3) {
   try {
-    return readdirSync2(trustDir(root3)).filter((n10) => ID_RE.test(n10));
+    return readdirSync2(trustDir(root3)).filter(
+      (n10) => ID_RE.test(n10) && isTrusted(n10, root3)
+    );
   } catch {
     return [];
   }
@@ -133227,7 +133239,7 @@ var ArmingState = class {
 };
 
 // src/approve-cli.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, readFileSync as readFileSync5, readdirSync as readdirSync3, rmSync as rmSync3, existsSync as existsSync4 } from "node:fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, readFileSync as readFileSync5, readdirSync as readdirSync3, rmSync as rmSync3, existsSync as existsSync3 } from "node:fs";
 import { join as join7 } from "node:path";
 var APPROVALS_SUBDIR = "arm-approvals";
 var ID_RE2 = /^[A-Za-z0-9_-]{1,128}$/;
@@ -133254,7 +133266,7 @@ function writeApproval(dataDir, requestId, roomId) {
 }
 function drainApprovals(dataDir) {
   const dir = join7(dataDir, APPROVALS_SUBDIR);
-  if (!existsSync4(dir)) return [];
+  if (!existsSync3(dir)) return [];
   const out = [];
   for (const name of readdirSync3(dir)) {
     if (!ID_RE2.test(name)) continue;
@@ -133473,7 +133485,14 @@ function wireBridge(channel, session, target, opts = {}) {
       e7.hushedUntil ? `room ${e7.roomId.slice(0, 8)} hushed until ${e7.hushedUntil} \u2014 holding` : `room ${e7.roomId.slice(0, 8)} hush cleared`
     );
   });
+  let warnedMissingSenderIsAgent = false;
   channel.on("room_message", (e7) => {
+    if (typeof e7.senderIsAgent !== "boolean" && !warnedMissingSenderIsAgent) {
+      warnedMissingSenderIsAgent = true;
+      log(
+        "WARNING: inbound room_message has no `senderIsAgent` \u2014 replies to humans in rooms will be DROPPED whenever the model answers in plain text instead of calling say (#630). Most likely cause: a stale bundled plugin dist. Rebuild the bridge (npm run build in packages/claude-room-bridge) and reinstall."
+      );
+    }
     if (opts.roomFilter && e7.roomId !== opts.roomFilter) return;
     if (hush.isHushed(e7.roomId)) {
       log(`inbound from ${e7.senderName} in ${e7.roomId.slice(0, 8)} \u2014 room hushed, holding (not replying)`);
@@ -133632,7 +133651,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.7.0" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.7.1" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "type": "module",
   "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",