@agentvault/claude-bridge 0.7.5 → 0.7.7

package/dist/bridge.d.ts

@@ -34,6 +34,9 @@ export interface ArmingSnapshot {
  *  its ABSENCE is how we identify a true owner↔agent 1:1 DM. */
 export interface MessageMeta {
     roomId?: string;
+    /** #621 — set by SecureChannel when the message decrypted under the owner's
+     *  1:1 material. Gates the full-access DM lane; see the `message` handler. */
+    ownerDm1to1?: boolean;
 }
 /** #392 room hush (advisory) — emitted by SecureChannel from the backend's
  *  `room_hushed` event. ``hushedUntil`` is an ISO string, or null when cleared. */

package/dist/index.js

@@ -452,12 +452,13 @@ import { join as join11 } from "node:path";
 
 // ../plugin/dist/index.js
 import * as nc from "node:crypto";
-import { mkdir, readFile, writeFile, rm } from "node:fs/promises";
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { readdir, readFile, rename, rm } from "node:fs/promises";
 import { join } from "node:path";
-import { mkdir as mkdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { readFile as readFile2, rename as rename2, rm as rm2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { Readable } from "node:stream";
-import { readdir, readFile as readFile3, writeFile as writeFile3, rename as rename2, stat, unlink, mkdir as mkdir3 } from "node:fs/promises";
+import { readdir as readdir2, readFile as readFile3, writeFile as writeFile2, rename as rename3, stat, unlink, mkdir as mkdir2 } from "node:fs/promises";
 import { join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
@@ -465,7 +466,7 @@ import { createServer } from "node:http";
 import { randomUUID as randomUUID2, createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { homedir as osHomedir } from "node:os";
-import { writeFile as writeFile4, mkdir as mkdir4 } from "node:fs/promises";
+import { writeFile as writeFile3, mkdir as mkdir3 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 import { readFile as readFile4 } from "node:fs/promises";
 import WebSocket2 from "ws";
@@ -63664,16 +63665,39 @@ var init_dist = __esm2({
     init_mls_delivery_order();
   }
 });
+async function ensureSecureDir(dir) {
+  await mkdir(dir, { recursive: true, mode: DIR_MODE });
+  try {
+    await chmod(dir, DIR_MODE);
+  } catch {
+  }
+}
+async function writeSecureFile(filePath, data, flag) {
+  await writeFile(filePath, data, { encoding: "utf-8", mode: FILE_MODE, ...flag ? { flag } : {} });
+  try {
+    await chmod(filePath, FILE_MODE);
+  } catch {
+  }
+}
+var DIR_MODE;
+var FILE_MODE;
+var init_secure_file = __esm2({
+  "src/secure-file.ts"() {
+    "use strict";
+    DIR_MODE = 448;
+    FILE_MODE = 384;
+  }
+});
 function syncLockPath(dataDir, channelId) {
   const safe = channelId.replace(/[^a-zA-Z0-9_-]/g, "_");
   return join(dataDir, `mls-a2a-sync-${safe}.lock`);
 }
 async function acquireA2ASyncLock(dataDir, channelId) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const lockFile = syncLockPath(dataDir, channelId);
   const content = JSON.stringify({ pid: process.pid, timestamp: Date.now() });
   try {
-    await writeFile(lockFile, content, { encoding: "utf-8", mode: FILE_MODE, flag: "wx" });
+    await writeSecureFile(lockFile, content, "wx");
     return true;
   } catch (err) {
     if (err.code !== "EEXIST") throw err;
@@ -63684,7 +63708,7 @@ async function acquireA2ASyncLock(dataDir, channelId) {
         await rm(lockFile).catch(() => {
         });
         try {
-          await writeFile(lockFile, content, { encoding: "utf-8", mode: FILE_MODE, flag: "wx" });
+          await writeSecureFile(lockFile, content, "wx");
           return true;
         } catch {
           return false;
@@ -63714,7 +63738,7 @@ async function hasPendingWelcome(dataDir, groupId) {
   }
 }
 async function savePendingKpBundle(dataDir, groupId, kp, serializePublicFn) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const serialized = {
     publicPackageBytes: Buffer.from(serializePublicFn(kp.publicPackage)).toString("base64"),
     privatePackage: {
@@ -63723,7 +63747,7 @@ async function savePendingKpBundle(dataDir, groupId, kp, serializePublicFn) {
       signaturePrivateKey: Buffer.from(kp.privatePackage.signaturePrivateKey).toString("base64")
     }
   };
-  await writeFile(pendingKpPath(dataDir, groupId), JSON.stringify(serialized), { encoding: "utf-8", mode: FILE_MODE });
+  await writeSecureFile(pendingKpPath(dataDir, groupId), JSON.stringify(serialized));
 }
 async function loadPendingKpBundle(dataDir, groupId) {
   try {
@@ -63748,9 +63772,9 @@ async function clearPendingWelcome(dataDir, groupId) {
   }
 }
 async function saveMlsState(dataDir, groupId, state) {
-  await mkdir(dataDir, { recursive: true, mode: DIR_MODE });
+  await ensureSecureDir(dataDir);
   const filePath = join(dataDir, mlsFileName(groupId));
-  await writeFile(filePath, state, { encoding: "utf-8", mode: FILE_MODE });
+  await writeSecureFile(filePath, state);
 }
 async function loadMlsState(dataDir, groupId) {
   try {
@@ -63767,15 +63791,12 @@ async function deleteMlsState(dataDir, groupId) {
   } catch {
   }
 }
-var FILE_MODE;
-var DIR_MODE;
 var SYNC_LOCK_STALE_MS;
 var pendingKpPath;
 var init_mls_state = __esm2({
   "src/mls-state.ts"() {
     "use strict";
-    FILE_MODE = 384;
-    DIR_MODE = 448;
+    init_secure_file();
     SYNC_LOCK_STALE_MS = 5 * 60 * 1e3;
     pendingKpPath = (dataDir, groupId) => join(dataDir, `mls-kp-pending-${groupId.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
   }
@@ -63926,9 +63947,9 @@ var init_crypto_helpers = __esm2({
   }
 });
 async function saveState(dataDir, state) {
-  await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
+  await ensureSecureDir(dataDir);
   const filePath = join2(dataDir, STATE_FILE);
-  await writeFile2(filePath, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: FILE_MODE2 });
+  await writeSecureFile(filePath, JSON.stringify(state, null, 2));
   try {
     await rm2(join2(dataDir, LEGACY_STATE_FILE));
   } catch {
@@ -63945,8 +63966,8 @@ async function loadState(dataDir) {
   try {
     const raw = await readFile2(legacyPath, "utf-8");
     const parsed = JSON.parse(raw);
-    await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
-    await writeFile2(filePath, JSON.stringify(parsed, null, 2), { encoding: "utf-8", mode: FILE_MODE2 });
+    await ensureSecureDir(dataDir);
+    await writeSecureFile(filePath, JSON.stringify(parsed, null, 2));
     await rm2(legacyPath);
     return parsed;
   } catch {
@@ -63969,8 +63990,8 @@ async function backupState(dataDir) {
   const tmp = join2(dataDir, `${STATE_FILE}.bak.tmp`);
   try {
     const data = await readFile2(src, "utf-8");
-    await writeFile2(tmp, data, { encoding: "utf-8", mode: FILE_MODE2 });
-    await rename(tmp, bak);
+    await writeSecureFile(tmp, data);
+    await rename2(tmp, bak);
   } catch {
   }
 }
@@ -63984,8 +64005,8 @@ async function restoreState(dataDir) {
     if (!parsed || !parsed.deviceId || !parsed.deviceJwt || !parsed.sessions || Object.keys(parsed.sessions).length === 0) {
       return false;
     }
-    await mkdir2(dataDir, { recursive: true, mode: DIR_MODE2 });
-    await writeFile2(join2(dataDir, STATE_FILE), data, { encoding: "utf-8", mode: FILE_MODE2 });
+    await ensureSecureDir(dataDir);
+    await writeSecureFile(join2(dataDir, STATE_FILE), data);
     return true;
   } catch {
     return false;
@@ -64048,16 +64069,13 @@ async function clearState(dataDir) {
 }
 var STATE_FILE;
 var LEGACY_STATE_FILE;
-var DIR_MODE2;
-var FILE_MODE2;
 var init_state = __esm2({
   async "src/state.ts"() {
     "use strict";
     await init_dist();
+    init_secure_file();
     STATE_FILE = "agentvault.json";
     LEGACY_STATE_FILE = "secure-channel.json";
-    DIR_MODE2 = 448;
-    FILE_MODE2 = 384;
   }
 });
 async function enrollDevice(apiUrl, inviteToken, identityPkHex, ephemeralPkHex, proofHex, platform) {
@@ -64108,19 +64126,30 @@ var init_transport2 = __esm2({
 });
 var openclaw_compat_exports = {};
 __export2(openclaw_compat_exports, {
+  AGENT_EVENT_CANDIDATES: () => AGENT_EVENT_CANDIDATES,
+  HEARTBEAT_CANDIDATES: () => HEARTBEAT_CANDIDATES,
+  TRANSCRIPT_CANDIDATES: () => TRANSCRIPT_CANDIDATES,
+  _resetCompatCacheForTest: () => _resetCompatCacheForTest,
   onAgentEvent: () => onAgentEvent,
   onSessionTranscriptUpdate: () => onSessionTranscriptUpdate,
-  requestHeartbeatNow: () => requestHeartbeatNow
+  requestHeartbeatNow: () => requestHeartbeatNow,
+  resolveSdkFn: () => resolveSdkFn
 });
-async function requestHeartbeatNow(opts) {
-  if (_heartbeatFn === null) {
+async function resolveSdkFn(candidates, importer = defaultImporter) {
+  for (const { specifier, symbol: symbol22 } of candidates) {
     try {
-      const mod4 = await import("openclaw/dist/plugin-sdk/infra/heartbeat-wake.js");
-      _heartbeatFn = mod4.requestHeartbeatNow ?? mod4.default?.requestHeartbeatNow ?? false;
+      const mod4 = await importer(specifier);
+      const found = mod4?.[symbol22] ?? mod4?.default?.[symbol22];
+      if (typeof found === "function") return found;
     } catch {
-      _heartbeatFn = false;
     }
   }
+  return false;
+}
+async function requestHeartbeatNow(opts) {
+  if (_heartbeatFn === null) {
+    _heartbeatFn = await resolveSdkFn(HEARTBEAT_CANDIDATES);
+  }
   if (typeof _heartbeatFn === "function") {
     try {
       await _heartbeatFn(opts);
@@ -64133,12 +64162,7 @@ async function requestHeartbeatNow(opts) {
 }
 async function onAgentEvent(callback) {
   if (_agentEventFn === null) {
-    try {
-      const mod4 = await import("openclaw/dist/plugin-sdk/infra/agent-events.js");
-      _agentEventFn = mod4.onAgentEvent ?? mod4.default?.onAgentEvent ?? false;
-    } catch {
-      _agentEventFn = false;
-    }
+    _agentEventFn = await resolveSdkFn(AGENT_EVENT_CANDIDATES);
   }
   if (typeof _agentEventFn === "function") {
     try {
@@ -64153,12 +64177,7 @@ async function onAgentEvent(callback) {
 }
 async function onSessionTranscriptUpdate(callback) {
   if (_transcriptFn === null) {
-    try {
-      const mod4 = await import("openclaw/dist/plugin-sdk/sessions/transcript-events.js");
-      _transcriptFn = mod4.onSessionTranscriptUpdate ?? mod4.default?.onSessionTranscriptUpdate ?? false;
-    } catch {
-      _transcriptFn = false;
-    }
+    _transcriptFn = await resolveSdkFn(TRANSCRIPT_CANDIDATES);
   }
   if (typeof _transcriptFn === "function") {
     try {
@@ -64171,12 +64190,45 @@ async function onSessionTranscriptUpdate(callback) {
   return () => {
   };
 }
+function _resetCompatCacheForTest() {
+  _heartbeatFn = null;
+  _agentEventFn = null;
+  _transcriptFn = null;
+}
+var defaultImporter;
+var HEARTBEAT_CANDIDATES;
+var AGENT_EVENT_CANDIDATES;
+var TRANSCRIPT_CANDIDATES;
 var _heartbeatFn;
 var _agentEventFn;
 var _transcriptFn;
 var init_openclaw_compat = __esm2({
   "src/openclaw-compat.ts"() {
     "use strict";
+    defaultImporter = (specifier) => import(
+      /* @vite-ignore */
+      specifier
+    );
+    HEARTBEAT_CANDIDATES = [
+      // 2026.7.x — exported subpath, and the symbol lost its `Now` suffix.
+      { specifier: "openclaw/plugin-sdk/heartbeat-runtime", symbol: "requestHeartbeat" },
+      // <=2026.6.x — deep dist path, original name.
+      { specifier: "openclaw/dist/plugin-sdk/infra/heartbeat-wake.js", symbol: "requestHeartbeatNow" }
+    ];
+    AGENT_EVENT_CANDIDATES = [
+      { specifier: "openclaw/plugin-sdk/agent-harness", symbol: "onAgentEvent" },
+      { specifier: "openclaw/dist/plugin-sdk/infra/agent-events.js", symbol: "onAgentEvent" }
+    ];
+    TRANSCRIPT_CANDIDATES = [
+      {
+        specifier: "openclaw/plugin-sdk/memory-core-host-engine-foundation",
+        symbol: "onSessionTranscriptUpdate"
+      },
+      {
+        specifier: "openclaw/dist/plugin-sdk/sessions/transcript-events.js",
+        symbol: "onSessionTranscriptUpdate"
+      }
+    ];
     _heartbeatFn = null;
     _agentEventFn = null;
     _transcriptFn = null;
@@ -64486,12 +64538,12 @@ async function handleWorkspaceUpload(data, workspaceDir) {
   if (!verified) {
     return { status: "error", error: "Invalid signature \u2014 file may have been tampered with" };
   }
-  await mkdir3(workspaceDir, { recursive: true });
+  await mkdir2(workspaceDir, { recursive: true });
   const targetPath = join3(workspaceDir, data.filename);
   const tempPath = join3(workspaceDir, `.tmp_${randomUUID()}_${data.filename}`);
   try {
-    await writeFile3(tempPath, data.content, "utf-8");
-    await rename2(tempPath, targetPath);
+    await writeFile2(tempPath, data.content, "utf-8");
+    await rename3(tempPath, targetPath);
   } catch (err) {
     try {
       await unlink(tempPath);
@@ -64508,7 +64560,7 @@ async function handleWorkspaceUpload(data, workspaceDir) {
 }
 async function handleWorkspaceList(workspaceDir) {
   try {
-    const entries = await readdir(workspaceDir);
+    const entries = await readdir2(workspaceDir);
     const files = [];
     for (const entry of entries) {
       if (!entry.endsWith(".md")) continue;
@@ -65669,7 +65721,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket2.OPEN) return;
-        const pluginVersion = true ? "0.23.17" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.19" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -67534,7 +67586,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.17" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.19" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -67857,7 +67909,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.17" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.19" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -68341,6 +68393,10 @@ var init_channel = __esm2({
             conversationId: convId ?? this._primaryConversationId,
             timestamp: data.created_at ?? (/* @__PURE__ */ new Date()).toISOString(),
             topicId,
+            // #621: positive attestation that this decrypted under the OWNER'S 1:1
+            // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+            // that a roomId was absent. The bridge's full-access DM lane requires it.
+            ownerDm1to1: true,
             messageType
           };
           this.emit("message", text, metadata);
@@ -68583,7 +68639,7 @@ ${messageText}`;
        */
       async _downloadAndDecryptAttachment(info) {
         const attachDir = join4(this.config.dataDir, "attachments");
-        await mkdir4(attachDir, { recursive: true });
+        await mkdir3(attachDir, { recursive: true });
         const url22 = `${this.config.apiUrl}${info.blobUrl}`;
         const res = await fetch(url22, {
           headers: { Authorization: `Bearer ${this._deviceJwt}` }
@@ -68601,7 +68657,7 @@ ${messageText}`;
         const fileNonce = base64ToBytes(info.fileNonce);
         const decrypted = decryptFile(encryptedData, fileKey, fileNonce);
         const filePath = join4(attachDir, info.filename);
-        await writeFile4(filePath, decrypted);
+        await writeFile3(filePath, decrypted);
         console.log(`[SecureChannel] Attachment saved: ${filePath} (${decrypted.length} bytes)`);
         return { filePath, decrypted };
       }
@@ -69621,7 +69677,7 @@ ${messageText}`;
             console.warn("[SecureChannel] KeyPackage pool replenish after join failed:", err);
           });
           console.log(`[SecureChannel] Welcome joined: group=${groupId?.slice(0, 8)} kpSource=${kpSource} welcomeLen=${welcomeBytes.length} candidates=${candidateCount} poolRemaining=${this._pendingKpBundles.length}`);
-          if (conversationGroupId) {
+          if (conversationGroupId && !data.room_id) {
             const key = `1to1-group:${conversationGroupId}`;
             this._mlsGroups.set(key, mgr);
             await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
@@ -70442,7 +70498,11 @@ ${messageText}`;
                   messageId: msg.message_id,
                   conversationId: msg.conversation_id,
                   timestamp: msg.created_at,
-                  topicId
+                  topicId,
+                  // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                  // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                  // that a roomId was absent. The bridge's full-access DM lane requires it.
+                  ownerDm1to1: true
                 };
                 this.emit("message", messageText, metadata);
                 Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -70774,7 +70834,11 @@ ${messageText}`;
                     messageId: msg.id,
                     conversationId: msg.conversation_id,
                     timestamp: msg.created_at,
-                    topicId
+                    topicId,
+                    // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                    // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                    // that a roomId was absent. The bridge's full-access DM lane requires it.
+                    ownerDm1to1: true
                   };
                   this.emit("message", messageText, metadata);
                   Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -71055,7 +71119,11 @@ ${messageText}`;
                     messageId: msg.id,
                     conversationId: msg.conversation_id,
                     timestamp: msg.created_at,
-                    topicId
+                    topicId,
+                    // #621: positive attestation that this decrypted under the OWNER'S 1:1
+                    // material (MLS 1to1-group map, or a Double Ratchet session), NOT merely
+                    // that a roomId was absent. The bridge's full-access DM lane requires it.
+                    ownerDm1to1: true
                   };
                   this.emit("message", messageText, metadata);
                   Promise.resolve(this.config.onMessage?.(messageText, metadata)).catch((err) => {
@@ -71658,6 +71726,16 @@ var init_fetch_interceptor = __esm2({
     traceStore = new AsyncLocalStorage();
   }
 });
+var init_tool_audit = __esm2({
+  "src/tool-audit.ts"() {
+    "use strict";
+  }
+});
+var init_harness_compat = __esm2({
+  "src/harness-compat.ts"() {
+    "use strict";
+  }
+});
 var isUsingManagedRoutes;
 var init_openclaw_entry = __esm2({
   "src/openclaw-entry.ts"() {
@@ -71667,6 +71745,8 @@ var init_openclaw_entry = __esm2({
     init_http_handlers();
     init_openclaw_compat();
     init_lifecycle();
+    init_tool_audit();
+    init_harness_compat();
     init_types();
     isUsingManagedRoutes = false;
   }
@@ -97718,7 +97798,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.17" : "0.0.0-dev";
+    VERSION = true ? "0.23.19" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -119029,8 +119109,8 @@ import { mkdirSync as mkdirSync3, writeFileSync, rmSync as rmSync2, readdirSync
 import { join as join6 } from "node:path";
 import { homedir, hostname as hostname3 } from "node:os";
 var TRUST_SUBDIR = "host-trust";
-var DIR_MODE3 = 448;
-var FILE_MODE3 = 384;
+var DIR_MODE2 = 448;
+var FILE_MODE2 = 384;
 var ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 var IDENTITY_FILES = ["agentvault.json", "secure-channel.json", "agentvault.json.bak"];
 var HostTrustError = class extends Error {
@@ -119057,15 +119137,15 @@ function grant(deviceId, root3) {
   const id = sanitize(deviceId);
   const dir = trustDir(root3);
   const p2 = join6(dir, id);
-  mkdirSync3(dir, { recursive: true, mode: DIR_MODE3 });
+  mkdirSync3(dir, { recursive: true, mode: DIR_MODE2 });
   writeFileSync(
     p2,
     `granted_at=${(/* @__PURE__ */ new Date()).toISOString()} host=${hostname3()}
 `,
-    { mode: FILE_MODE3 }
+    { mode: FILE_MODE2 }
   );
-  chmodSync2(dir, DIR_MODE3);
-  chmodSync2(p2, FILE_MODE3);
+  chmodSync2(dir, DIR_MODE2);
+  chmodSync2(p2, FILE_MODE2);
 }
 function revoke(deviceId, root3) {
   const id = sanitize(deviceId);
@@ -133358,6 +133438,16 @@ var WorkerQueue = class {
       this.running = false;
     }
   }
+  /**
+   * What the worker had produced, when the session can report it. Read on BOTH the
+   * clean and the failing path: on a clean turn `said: false` with a non-zero
+   * `composedChars` is the "composed but could never ship it" signature (agent-
+   * authored room traffic, where `replyExpected` is false), which is otherwise
+   * indistinguishable from a turn that did nothing.
+   */
+  snapshotOf(session) {
+    return session?.snapshot?.();
+  }
   /** Best-effort trap emit. A broken sink must never break the queue. */
   emitIncident(rec) {
     try {
@@ -133389,10 +133479,23 @@ var WorkerQueue = class {
         }, this.deps.timeoutMs);
       });
       await Promise.race([session.start(), timeout]);
+      const okSnap = this.snapshotOf(session);
+      this.emitIncident({
+        at: new Date(startedAt).toISOString(),
+        outcome: "ok",
+        waitedMs,
+        ranMs: Date.now() - startedAt,
+        timeoutMs: this.deps.timeoutMs,
+        queueDepthAtEnqueue: entry.queueDepthAtEnqueue,
+        queueDepthAtStart,
+        instructionChars: task.instruction.length,
+        replyExpected: task.replyExpected,
+        ...okSnap ? { session: okSnap } : {}
+      });
     } catch (e7) {
       const err = e7;
       this.deps.log(`[worker-queue] task failed: ${err.message}`);
-      const snap = session?.snapshot?.();
+      const snap = this.snapshotOf(session);
       this.emitIncident({
         at: new Date(startedAt).toISOString(),
         outcome: timedOut ? "timeout" : "error",
@@ -133403,6 +133506,7 @@ var WorkerQueue = class {
         queueDepthAtEnqueue: entry.queueDepthAtEnqueue,
         queueDepthAtStart,
         instructionChars: task.instruction.length,
+        replyExpected: task.replyExpected,
         ...snap ? { session: snap } : {}
       });
       session?.abort();
@@ -133424,7 +133528,7 @@ function makeRouter(deps) {
       const replySink = reply ?? (() => {
       });
       const isOwnerDm = opts?.autoReplyOnText === true && opts?.armed === void 0 && deps.workAllowed();
-      const isArmedRoom = opts?.armed?.() === true && deps.workAllowed();
+      const isArmedRoom = opts?.armed?.() === true && deps.workAllowed() && opts?.replyExpected !== false;
       if (isOwnerDm) {
         deps.queue.enqueue({
           instruction: text,
@@ -133839,9 +133943,14 @@ function wireBridge(channel, session, target, opts = {}) {
   });
   channel.on("message", (text, metadata) => {
     if (metadata?.roomId) return;
-    log("inbound 1:1 DM from owner");
+    const ownerAttested = metadata?.ownerDm1to1 === true;
+    if (!ownerAttested) {
+      log("inbound 1:1 DM WITHOUT owner attestation \u2014 delivering to the locked listener (no tools)");
+    } else {
+      log("inbound 1:1 DM from owner");
+    }
     target.setDm();
-    session.push(text, target.snapshotReply(channel, log), { autoReplyOnText: true });
+    session.push(text, target.snapshotReply(channel, log), { autoReplyOnText: ownerAttested });
   });
   const workerCapable = !!opts.workspaceDir;
   const osIsolated = opts.osIsolated !== void 0 ? opts.osIsolated : process.env.AV_WORKER_OS_ISOLATED === "1" || process.env.AV_WORKER_OS_ISOLATED === "true";
@@ -133982,7 +134091,7 @@ async function main() {
       "[bridge] warning: passing the invite token on the command line is visible to other local users via 'ps'. Prefer: AV_INVITE_TOKEN=\u2026 npx @agentvault/claude-bridge"
     );
   }
-  console.error(`[bridge] version: ${true ? "0.7.5" : "dev"}`);
+  console.error(`[bridge] version: ${true ? "0.7.7" : "dev"}`);
   console.error(`[bridge] data dir: ${cfg.dataDir} (${cfg.dataDirSource})`);
   console.error(`[bridge] workspace: ${cfg.workspaceDir} \xB7 permissions: ${cfg.permissionMode} \xB7 enclave dir fenced`);
   if (cfg.armRoom) {
@@ -134065,7 +134174,7 @@ async function main() {
     // incident is visible in bridge.error.log at the moment it happens.
     onIncident: (rec) => {
       console.error(
-        `[worker-trap] ${rec.at} ${rec.outcome} after ${rec.ranMs}ms (waited ${rec.waitedMs}ms behind ${rec.queueDepthAtEnqueue}, ${rec.queueDepthAtStart} still queued)` + (rec.session ? ` composed=${rec.session.composedChars} result=${rec.session.sawResult} said=${rec.session.said}` : "")
+        `[worker-trap] ${rec.at} ${rec.outcome} after ${rec.ranMs}ms (waited ${rec.waitedMs}ms behind ${rec.queueDepthAtEnqueue}, ${rec.queueDepthAtStart} still queued) replyExpected=${rec.replyExpected}` + (rec.session ? ` composed=${rec.session.composedChars} result=${rec.session.sawResult} said=${rec.session.said}` : "")
       );
       try {
         const dir = join11(cfg.dataDir, "logs");

package/dist/worker-queue.d.ts

@@ -17,19 +17,27 @@ export type WorkerTask = {
     armed?: () => boolean;
 };
 /**
- * Forensic record of a task that did NOT complete cleanly.
+ * Forensic record of EVERY task the queue runs — clean or not.
  *
  * Exists because the 2026-07-24 "loopita went quiet for 5 minutes" incident was
  * diagnosable only by coincidence: the drop-trap happened to capture that the
  * reply landed 300.016s after the ack, and 300s is `WORKER_TIMEOUT_MS` exactly.
  * Nothing in the bridge recorded WHY the worker hung, and the logs carry no
  * timestamps at all, so the evidence was gone by the time we looked.
+ *
+ * 2026-08-06: widened from failures-only to every turn. Recording only failures
+ * made the SLOW case unmeasurable, and slow is the common case: loopita answered
+ * Ballroom2 in 21s when the room was quiet and 81s when a second agent was
+ * talking, and nothing said whether the extra 60s was `waitedMs` or `ranMs`.
+ * Those are different bugs with identical symptoms. A trap that only reports
+ * when it breaks cannot tell you it is the reason things are slow.
  */
 export type WorkerIncident = {
     /** ISO timestamp — the bridge's own logs are unstamped, so this is the anchor. */
     at: string;
-    outcome: "timeout" | "error";
-    error: string;
+    outcome: "ok" | "timeout" | "error";
+    /** Absent on a clean turn — its presence is what marks a real incident. */
+    error?: string;
     /**
      * enqueue -> start. THE load-bearing field: it separates "this task hung" from
      * "this task was stuck behind one that hung". Both look identical to the owner
@@ -44,6 +52,15 @@ export type WorkerIncident = {
     /** Depth still waiting when this task began — the blast radius of this hang. */
     queueDepthAtStart: number;
     instructionChars: number;
+    /**
+     * Whether a reply was expected of this turn — mirrors `WorkerTask.replyExpected`,
+     * i.e. `senderIsAgent === false` upstream. Without it a silent turn
+     * (composed=0, said=false) is unattributable: it could be agent-authored traffic
+     * that was never going to answer, or a turn that waited so long the previous one
+     * already answered. Ballroom2 on 2026-08-06 produced both readings and the record
+     * could not separate them.
+     */
+    replyExpected?: boolean;
     /** What the worker had produced when it died, when the session can report it. */
     session?: {
         composedChars: number;
@@ -91,6 +108,14 @@ export declare class WorkerQueue {
     /** Resolves when the queue has processed everything enqueued so far. */
     whenDrained(): Promise<void>;
     private drain;
+    /**
+     * What the worker had produced, when the session can report it. Read on BOTH the
+     * clean and the failing path: on a clean turn `said: false` with a non-zero
+     * `composedChars` is the "composed but could never ship it" signature (agent-
+     * authored room traffic, where `replyExpected` is false), which is otherwise
+     * indistinguishable from a turn that did nothing.
+     */
+    private snapshotOf;
     /** Best-effort trap emit. A broken sink must never break the queue. */
     private emitIncident;
     private runOne;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@agentvault/claude-bridge",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "type": "module",
-  "description": "AgentVault Claude Bridge \u2014 daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
+  "description": "AgentVault Claude Bridge — daemon for bridging a Claude agent into secure E2E-encrypted AgentVault 1:1 direct messages and rooms.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {