@agentvault/claude-bridge 0.7.5 → 0.7.6

package/dist/bridge.d.ts

@@ -34,6 +34,9 @@ export interface ArmingSnapshot {
  *  its ABSENCE is how we identify a true owner↔agent 1:1 DM. */
 export interface MessageMeta {
     roomId?: string;
+    /** #621 — set by SecureChannel when the message decrypted under the owner's
+     *  1:1 material. Gates the full-access DM lane; see the `message` handler. */
+    ownerDm1to1?: boolean;
 }
 /** #392 room hush (advisory) — emitted by SecureChannel from the backend's
  *  `room_hushed` event. ``hushedUntil`` is an ISO string, or null when cleared. */

package/dist/index.js

@@ -452,12 +452,13 @@ import { join as join11 } from "node:path";
 
 // ../plugin/dist/index.js
 import * as nc from "node:crypto";
-import { mkdir, readFile, writeFile, rm } from "node:fs/promises";
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { readFile, rm } from "node:fs/promises";
 import { join } from "node:path";
-import { mkdir as mkdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { readFile as readFile2, rename, rm as rm2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { Readable } from "node:stream";
-import { readdir, readFile as readFile3, writeFile as writeFile3, rename as rename2, stat, unlink, mkdir as mkdir3 } from "node:fs/promises";
+import { readdir, readFile as readFile3, writeFile as writeFile2, rename as rename2, stat, unlink, mkdir as mkdir2 } from "node:fs/promises";
 import { join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
@@ -465,7 +466,7 @@ import { createServer } from "node:http";
 import { randomUUID as randomUUID2, createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { homedir as osHomedir } from "node:os";
-import { writeFile as writeFile4, mkdir as mkdir4 } from "node:fs/promises";
+import { writeFile as writeFile3, mkdir as mkdir3 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 import { readFile as readFile4 } from "node:fs/promises";
 import WebSocket2 from "ws";
@@ -63664,16 +63665,39 @@ var init_dist = __esm2({
     init_mls_delivery_order();
   }
 });
+async function ensureSecureDir(dir) {
+  await mkdir(dir, { recursive: true, mode: DIR_MODE });
+  try {
+    await chmod(dir, DIR_MODE);
+  } catch {
+  }
+}
+async function writeSecureFile(filePath, data, flag) {
+  await writeFile(filePath, data, { encoding: "utf-8", mode: FILE_MODE, ...flag ? { flag } : {} });
+  try {
+    await chmod(filePath, FILE_MODE);
+  } catch {
+  }
+}
+var DIR_MODE;
+var FILE_MODE;
+var init_secure_file = __esm2({
+  "src/secure-file.ts"() {
+    "use strict";
+    DIR_MODE = 448;
+    FILE_MODE = 384;
+  }
+});
 function syncLockPath(dataDir, channelId) {
   const safe = channelId.replace(/[^a-zA-Z0-9_-]/g, "_");
   return join(dataDir, `mls-a2a-sync-${safe}.lock`);
 }
 async function acquireA2ASyncLock(dataDir, channelId) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const lockFile = syncLockPath(dataDir, channelId);
   const content = JSON.stringify({ pid: process.pid, timestamp: Date.now() });
   try {
-    await writeFile(lockFile, content, { encoding: "utf-8", mode: FILE_MODE, flag: "wx" });
+    await writeSecureFile(lockFile, content, "wx");
     return true;
   } catch (err) {
     if (err.code !== "EEXIST") throw err;
@@ -63684,7 +63708,7 @@ async function acquireA2ASyncLock(dataDir, channelId) {
         await rm(lockFile).catch(() => {
         });
         try {
-          await writeFile(lockFile, content, { encoding: "utf-8", mode: FILE_MODE, flag: "wx" });
+          await writeSecureFile(lockFile, content, "wx");
           return true;
         } catch {
           return false;
@@ -63714,7 +63738,7 @@ async function hasPendingWelcome(dataDir, groupId) {
   }
 }
 async function savePendingKpBundle(dataDir, groupId, kp, serializePublicFn) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const serialized = {
     publicPackageBytes: Buffer.from(serializePublicFn(kp.publicPackage)).toString("base64"),
     privatePackage: {
@@ -63723,7 +63747,7 @@ async function savePendingKpBundle(dataDir, groupId, kp, serializePublicFn) {
       signaturePrivateKey: Buffer.from(kp.privatePackage.signaturePrivateKey).toString("base64")
     }
   };
-  await writeFile(pendingKpPath(dataDir, groupId), JSON.stringify(serialized), { encoding: "utf-8", mode: FILE_MODE });
+  await writeSecureFile(pendingKpPath(dataDir, groupId), JSON.stringify(serialized));
 }
 async function loadPendingKpBundle(dataDir, groupId) {
   try {
@@ -63748,9 +63772,9 @@ async function clearPendingWelcome(dataDir, groupId) {
   }
 }
 async function saveMlsState(dataDir, groupId, state) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const filePath = join(dataDir, mlsFileName(groupId));
-  await writeFile(filePath, state, { encoding: "utf-8", mode: FILE_MODE });
+  await writeSecureFile(filePath, state);
 }
 async function loadMlsState(dataDir, groupId) {
   try {
@@ -63767,15 +63791,12 @@ async function deleteMlsState(dataDir, groupId) {
   } catch {
   }
 }
-var FILE_MODE;
-var DIR_MODE;
 var SYNC_LOCK_STALE_MS;
 var pendingKpPath;
 var init_mls_state = __esm2({
   "src/mls-state.ts"() {
     "use strict";
-    FILE_MODE = 384;
-    DIR_MODE = 448;
+    init_secure_file();
     SYNC_LOCK_STALE_MS = 5 * 60 * 1e3;
     pendingKpPath = (dataDir, groupId) => join(dataDir, `mls-kp-pending-${groupId.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
   }
@@ -63926,9 +63947,9 @@ var init_crypto_helpers = __esm2({
   }
 });
 async function saveState(dataDir, state) {
-  await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
+  await ensureSecureDir(dataDir);
   const filePath = join2(dataDir, STATE_FILE);
-  await writeFile2(filePath, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: FILE_MODE2 });
+  await writeSecureFile(filePath, JSON.stringify(state, null, 2));
   try {
     await rm2(join2(dataDir, LEGACY_STATE_FILE));
   } catch {
@@ -63945,8 +63966,8 @@ async function loadState(dataDir) {
   try {
     const raw = await readFile2(legacyPath, "utf-8");
     const parsed = JSON.parse(raw);
-    await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
-    await writeFile2(filePath, JSON.stringify(parsed, null, 2), { encoding: "utf-8", mode: FILE_MODE2 });
+    await ensureSecureDir(dataDir);
+    await writeSecureFile(filePath, JSON.stringify(parsed, null, 2));
     await rm2(legacyPath);
     return parsed;
   } catch {
@@ -63969,7 +63990,7 @@ async function backupState(dataDir) {
   const tmp = join2(dataDir, `${STATE_FILE}.bak.tmp`);
   try {
     const data = await readFile2(src, "utf-8");
-    await writeFile2(tmp, data, { encoding: "utf-8", mode: FILE_MODE2 });
+    await writeSecureFile(tmp, data);
     await rename(tmp, bak);
   } catch {
   }
@@ -63984,8 +64005,8 @@ async function restoreState(dataDir) {
     if (!parsed || !parsed.deviceId || !parsed.deviceJwt || !parsed.sessions || Object.keys(parsed.sessions).length === 0) {
       return false;
     }
-    await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
-    await writeFile2(join2(dataDir, STATE_FILE), data, { encoding: "utf-8", mode: FILE_MODE2 });
+    await ensureSecureDir(dataDir);
+    await writeSecureFile(join2(dataDir, STATE_FILE), data);
     return true;
   } catch {
     return false;
@@ -64048,16 +64069,13 @@ async function clearState(dataDir) {
 }
 var STATE_FILE;
 var LEGACY_STATE_FILE;
-var DIR_MODE2;
-var FILE_MODE2;
 var init_state = __esm2({
   async "src/state.ts"() {
     "use strict";
     await init_dist();
+    init_secure_file();
     STATE_FILE = "agentvault.json";
     LEGACY_STATE_FILE = "secure-channel.json";
-    DIR_MODE2 = 448;
-    FILE_MODE2 = 384;
   }
 });
 async function enrollDevice(apiUrl, inviteToken, identityPkHex, ephemeralPkHex, proofHex, platform) {
@@ -64486,11 +64504,11 @@ async function handleWorkspaceUpload(data, workspaceDir) {
   if (!verified) {
     return { status: "error", error: "Invalid signature \u2014 file may have been tampered with" };
   }
-  await mkdir3(workspaceDir, { recursive: true });
+  await mkdir2(workspaceDir, { recursive: true });
   const targetPath = join3(workspaceDir, data.filename);
   const tempPath = join3(workspaceDir, `.tmp_${randomUUID()}_${data.filename}`);
   try {
-    await writeFile3(tempPath, data.content, "utf-8");
+    await writeFile2(tempPath, data.content, "utf-8");
     await rename2(tempPath, targetPath);
   } catch (err) {
     try {
@@ -65669,7 +65687,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.17" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.18" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67534,7 +67552,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.17" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.18" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67857,7 +67875,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.17" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.18" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68341,6 +68359,10 @@ var init_channel = __esm2({
             conversationId: convId ?? this._primaryConversationId,
             timestamp: data.created_at ?? (/* @__PURE__ */ new Date()).toISOString(),
             topicId,
+            // #621: positive attestation that this decrypted under the OWNER'S 1:1
+            // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+            // that a roomId was absent. The bridge's full-access DM lane requires it.
+            ownerDm1to1: true,
             messageType
           };
           this.emit("message", text, metadata);
@@ -68583,7 +68605,7 @@ ${messageText}`;
        */
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
-        await mkdir4(attachDir, { recursive: true });
+        await mkdir3(attachDir, { recursive: true });
         const url22 = `${this.config.apiUrl}${info.blobUrl}`;
         const res = await fetch(url22, {
           headers: { Authorization: `Bearer ${this._deviceJwt}` }
@@ -68601,7 +68623,7 @@ ${messageText}`;
         const fileNonce = base64ToBytes(info.fileNonce);
         const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
         const filePath = join4(attachDir, info.filename);
-        await writeFile4(filePath, decrypted);
+        await writeFile3(filePath, decrypted);
         console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
         return { filePath, decrypted };
       }
@@ -69621,7 +69643,7 @@ ${messageText}`;
             console.warn("[SecureChannel] KeyPackage pool replenish after join failed:", err);
           });
           console.log(`[SecureChannel] Welcome joined: group=${groupId?.slice(0, 8)} kpSource=${kpSource} welcomeLen=${welcomeBytes.length} candidates=${candidateCount} poolRemaining=${this._pendingKpBundles.length}`);
-          if (conversationGroupId) {
+          if (conversationGroupId && !data.room_id) {
             const key = `1to1-group:${conversationGroupId}`;
             this._mlsGroups.set(key, mgr);
             await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
@@ -70442,7 +70464,11 @@ ${messageText}`;
                   messageId: msg.message_id,
                   conversationId: msg.conversation_id,
                   timestamp: msg.created_at,
-                  topicId
+                  topicId,
+                  // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                  // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                  // that a roomId was absent. The bridge's full-access DM lane requires it.
+                  ownerDm1to1: true
                 };
                 this.emit("message", messageText, metadata);
                 Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -70774,7 +70800,11 @@ ${messageText}`;
                     messageId: msg.id,
                     conversationId: msg.conversation_id,
                     timestamp: msg.created_at,
-                    topicId
+                    topicId,
+                    // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                    // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                    // that a roomId was absent. The bridge's full-access DM lane requires it.
+                    ownerDm1to1: true
                   };
                   this.emit("message", messageText, metadata);
                   Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -71055,7 +71085,11 @@ ${messageText}`;
                     messageId: msg.id,
                     conversationId: msg.conversation_id,
                     timestamp: msg.created_at,
-                    topicId
+                    topicId,
+                    // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                    // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                    // that a roomId was absent. The bridge's full-access DM lane requires it.
+                    ownerDm1to1: true
                   };
                   this.emit("message", messageText, metadata);
                   Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -71658,6 +71692,11 @@ var init_fetch_interceptor = __esm2({
     traceStore = new AsyncLocalStorage();
   }
 });
+var init_tool_audit = __esm2({
+  "src/tool-audit.ts"() {
+    "use strict";
+  }
+});
 var isUsingManagedRoutes;
 var init_openclaw_entry = __esm2({
   "src/openclaw-entry.ts"() {
@@ -71667,6 +71706,7 @@ var init_openclaw_entry = __esm2({
     init_http_handlers();
     init_openclaw_compat();
     init_lifecycle();
+    init_tool_audit();
     init_types();
     isUsingManagedRoutes = false;
   }
@@ -97718,7 +97758,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.17" : "0.0.0-dev";
+    VERSION = true ? "0.23.18" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -119029,8 +119069,8 @@ import { mkdirSync as mkdirSync3, writeFileSync, rmSync as rmSync2, readdirSync
 import { join as join6 } from "node:path";
 import { homedir, hostname as hostname3 } from "node:os";
 var TRUST_SUBDIR = "host-trust";
-var DIR_MODE3 = 448;
-var FILE_MODE3 = 384;
+var DIR_MODE2 = 448;
+var FILE_MODE2 = 384;
 var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 var IDENTITY_FILES = ["agentvault.json", "secure-channel.json", "agentvault.json.bak"];
 var HostTrustError = class extends Error {
@@ -119057,15 +119097,15 @@ function grant(deviceId, root3) {
   const id = sanitize(deviceId);
   const dir = trustDir(root3);
   const p2 = join6(dir, id);
-  mkdirSync3(dir, { recursive: true, mode: DIR_MODE3 });
+  mkdirSync3(dir, { recursive: true, mode: DIR_MODE2 });
   writeFileSync(
     p2,
     `granted_at=${(/* @__PURE__ */ new Date()).toISOString()} host=${hostname3()}
 `,
-    { mode: FILE_MODE3 }
+    { mode: FILE_MODE2 }
   );
-  chmodSync2(dir, DIR_MODE3);
-  chmodSync2(p2, FILE_MODE3);
+  chmodSync2(dir, DIR_MODE2);
+  chmodSync2(p2, FILE_MODE2);
 }
 function revoke(deviceId, root3) {
   const id = sanitize(deviceId);
@@ -133839,9 +133879,14 @@ function wireBridge(channel, session, target, opts = {}) {
   });
   channel.on("message", (text, metadata) => {
     if (metadata?.roomId) return;
-    log("inbound 1:1 DM from owner");
+    const ownerAttested = metadata?.ownerDm1to1 === true;
+    if (!ownerAttested) {
+      log("inbound 1:1 DM WITHOUT owner attestation \u2014 delivering to the locked listener (no tools)");
+    } else {
+      log("inbound 1:1 DM from owner");
+    }
     target.setDm();
-    session.push(text, target.snapshotReply(channel, log), { autoReplyOnText: true });
+    session.push(text, target.snapshotReply(channel, log), { autoReplyOnText: ownerAttested });
   });
   const workerCapable = !!opts.workspaceDir;
   const osIsolated = opts.osIsolated !== void 0 ? opts.osIsolated : process.env.AV_WORKER_OS_ISOLATED === "1" || process.env.AV_WORKER_OS_ISOLATED === "true";
@@ -133982,7 +134027,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.7.5" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.7.6" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "type": "module",
-  "description": "AgentVault Claude Bridge \u2014 daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
+  "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {