@aiwg/cockpit 2026.7.15 → 2026.7.17

package/README.md

@@ -121,7 +121,7 @@ operator / CLI:  aiwg cockpit
 │  · user asset library: clone/import/delete (never writes AIWG)│
 │  · serves the built React app (token-injected)               │
 └─────────────────────────────────────────────────────────────┘
-       │ proxies / sources              ▲ loads /?token=…
+       │ authenticated proxy            ▲ loads the token-gated shell
        ▼                                │
   agentic-sandbox executor       ┌──────┴──────┬───────────────┐
                                  browser     VS Code webview   Tauri window
@@ -129,8 +129,10 @@ operator / CLI:  aiwg cockpit
 ```
 
 - **Control plane** (lifecycle, approvals, actions) goes through the gated Bridge.
-- **Data plane** (the pty session stream) connects browser→executor directly via the
-  `attach_url` the Bridge issues (WS masking differs per direction).
+- **Data plane** (the PTY session stream) also goes through a Bridge-owned
+  `attach_url`. The browser presents only its per-launch Cockpit token; the
+  Bridge keeps the long-lived executor credential and authenticates the upstream
+  WebSocket upgrade.
 
 ## Surfaces (tabs)
 
@@ -184,6 +186,19 @@ approval-response decisions (the web UI additionally records action injections
 as operator intents); bearer material and provider credentials are redacted
 before write.
 
+For an executor with operator bearer authentication enabled, store the selected
+least-privilege token in a mode-600 file and point the Bridge at the file:
+
+```bash
+AIWG_COCKPIT_EXECUTOR_TOKEN_FILE=/protected/path/cockpit-executor.token \
+AIWG_COCKPIT_EXECUTOR_URL=http://127.0.0.1:8122 \
+aiwg cockpit
+```
+
+The file contains one token. It is re-read for rotation, never copied into the
+browser, argv, URLs, reports, or audit records, and fails closed when its POSIX
+permissions allow group/other access.
+
 ## Run (dev/test, against a real agentic-sandbox executor)
 
 One command (#1634) — prefers a reachable real executor, builds the web UI if
@@ -300,6 +315,7 @@ Tests run **at stages** — committed harnesses, never `/tmp` rigs (#1635):
 |---|---|---|---|
 | **Unit / integration** | `npm --prefix apps/cockpit run check` · `npx vitest run test/integration/cockpit-bridge.test.js` | **mock** (automated-test-only) | always |
 | **Dev e2e** (full control-plane chain: health→inventory→create session→attach) | `npm run e2e:cockpit-dev` | **real**, safe-skip when absent | non-blocking |
+| **Daily Linux operator gate** (protected auth + host/container + recovery + upgrade/rollback, #1842) | `npm run uat:cockpit-daily` | **real**, required/fail-closed | operator-scheduled |
 | **Release matrix** (host/docker/vm + provider workload, #1621) | `npm run uat:cockpit-live:matrix` | **real**, all three families | release gate |
 
 ```bash
@@ -308,9 +324,17 @@ npx vitest run test/integration/cockpit-bridge.test.js   # Bridge contract + moc
 npx vitest run test/smoke/cockpit-base-footprint.test.js # base-npm guard (CI)
 npm run e2e:cockpit-dev                                  # dev full-system e2e — real executor, skips cleanly
 npm run uat:cockpit-live                                  # opt-in real sandbox posture gate
+npm run uat:cockpit-daily                                 # required Linux daily gate (#1842)
 npm run uat:cockpit-live:matrix                           # required host/docker/vm live matrix (#1621)
 ```
 
+The daily gate's approvals, immutable-version inputs, operator hook contract,
+host/container working-directory expectations, cleanup boundary, and report
+schema are documented in
+[Cockpit Daily Linux Operator Gate](../../docs/cockpit/daily-operator-gate.md).
+VM and Apple remain reported preview tiers and do not block the first Linux
+supported result.
+
 The React UI is also browser-verified per surface (see `.playwright-mcp/cockpit-*.png`).
 Conformance (`agentic-sandbox-conformance`) was 33 pass / 0 fail / 17 skip; the
 Bridge-only additions since (session-create, library) don't touch the conformant
@@ -322,7 +346,7 @@ reason when no live sandbox is reachable so ordinary CI stays deterministic. Set
 `AIWG_COCKPIT_LIVE_REQUIRED=1` for release/local validation where the live gate
 must be green. The command writes `test-results/cockpit-live-uat.json` and
 `test-results/cockpit-live-uat.md` by default; set
-`AIWG_COCKPIT_LIVE_REPORT=.aiwg/testing/cockpit-live-uat-<date>` when the report
+`AIWG_COCKPIT_LIVE_REPORT=.aiwg/testing/outputs/cockpit-live-uat-<date>` when the report
 should be kept as a project artifact. If the upstream
 `agentic-sandbox-conformance` harness is also run, set
 `AIWG_SANDBOX_CONFORMANCE_REPORT=<path>` so the Cockpit live report links the
@@ -346,10 +370,17 @@ The stricter matrix gate for #1621 is intentionally separate from the mock lane:
 
 ```bash
 AIWG_COCKPIT_EXECUTOR_URL=http://127.0.0.1:<real-executor-port> \
+AIWG_COCKPIT_EXECUTOR_TOKEN_FILE=/protected/path/cockpit-executor.token \
 AIWG_COCKPIT_LIVE_PROVIDER=codex \
 npm run uat:cockpit-live:matrix
 ```
 
+The token-file line is required when the executor has operator bearer auth
+enabled and may be omitted only for an explicitly unauthenticated local
+compatibility executor. The UAT uses the file for its direct readiness probes
+and passes the same reference to the Bridge; report output records only whether
+auth was configured, never the path or credential.
+
 Use `AIWG_COCKPIT_LIVE_PROVIDER=claude` instead when the live workload should
 exercise the pre-authenticated Claude session.
 
@@ -367,6 +398,9 @@ than only proving shell plumbing or provider login. Set
 `AIWG_COCKPIT_LIVE_DISCOVERY_EXPECT=<capability-name>` to validate a different
 discovered framework capability, or `AIWG_COCKPIT_LIVE_WORKLOAD=<prompt>` to
 replace the full prompt while still satisfying the marker and discovery checks.
+Custom prompts must request the `AIWG_COCKPIT` and `_LIVE_OK` fragments without
+containing the concatenated marker literally; this prevents terminal command
+echo from being mistaken for provider output.
 Set `AIWG_COCKPIT_LIVE_MATRIX_TARGETS=host` only for scoped rehearsal/evidence
 when Docker/container or VM are intentionally out of scope; the default remains
 `host,container,vm` for the release matrix. To prove controller-side PTY command
@@ -427,16 +461,16 @@ Known state as of the 2026-06-19 host live run:
   real mTLS-registered host agent and a managed `tmux` session.
 - Codex launched inside that managed host session and returned
   `AIWG_COCKPIT_LIVE_OK` plus `issue-audit`; evidence lives at
-  `.aiwg/testing/cockpit-real-codex-matrix-2026-06-19.md/.json`.
+  `.aiwg/testing/outputs/cockpit-real-codex-matrix-2026-06-19.md/.json`.
 - Cockpit also proved direct PTY command injection and mutation on the same real
   host path with `AIWG_COCKPIT_LIVE_MATRIX_TARGETS=host` and
   `AIWG_COCKPIT_LIVE_MUTATION_FILE`; evidence lives at
-  `.aiwg/testing/cockpit-real-codex-mutation-2026-06-19.md/.json`, and the
+  `.aiwg/testing/outputs/cockpit-real-codex-mutation-2026-06-19.md/.json`, and the
   verified mutation artifact is
-  `.aiwg/testing/cockpit-pty-mutation-2026-06-19.txt`.
+  `.aiwg/testing/outputs/cockpit-pty-mutation-2026-06-19.txt`.
 - Claude launched inside the same real host-session path and also returned
   `AIWG_COCKPIT_LIVE_OK` plus `issue-audit`; evidence lives at
-  `.aiwg/testing/cockpit-real-claude-matrix-2026-06-19.md/.json`.
+  `.aiwg/testing/outputs/cockpit-real-claude-matrix-2026-06-19.md/.json`.
 - The previous Claude login-required blocker remains linked as
   roctinam/agentic-sandbox#499 for upstream regression tracking, but it was not
   reproduced by this isolated host proof.
@@ -448,7 +482,7 @@ Known state as of the 2026-06-19 host live run:
   the #561 transport regression are closed. Re-validated Cockpit-side against
   `v2026.6.34`: VM matrix PASS — provision → vsock enroll → boot-ready → provider
   workload → clean destroy. Evidence:
-  `.aiwg/testing/cockpit-vm-vsock-2026-06-27.md/.json`.
+  `.aiwg/testing/outputs/cockpit-vm-vsock-2026-06-27.md/.json`.
 - Instance **transport posture + host-daemon** now surface from the sandbox side
   (`dd97529 fix(admin-v2): expose instance transport posture`, plus `#611`
   host-runtime session listing). Re-validated Cockpit-side against `v2026.7.4`
@@ -459,7 +493,7 @@ Known state as of the 2026-06-19 host live run:
   enrolled instance now renders real posture). Session-list returns
   cleanly (no 502 — the `#140`/`#611` endpoints are live). Runtime coverage
   banner `host ✓ · docker ✓ · vm ✓`. Evidence:
-  `.aiwg/testing/cockpit-7.4-transport-verify-2026-07-09.md` +
+  `.aiwg/testing/outputs/cockpit-7.4-transport-verify-2026-07-09.md` +
   `.aiwg/working/cockpit-7.4-inventory-2026-07-09.png`.
 - Stale Docker/container agent recovery is wired through the Bridge and UI
   (2026-07-11): stale running instances remain visible as `agent unreachable`,

package/bridge/src/server.mjs

@@ -6,10 +6,12 @@
 // Real Bridge grows: registry/discover/index binding, per-instance A2A, pty I/O,
 // per-launch token + OS-keychain (roctinam/aiwg#1595).
 import http from 'node:http';
+import https from 'node:https';
 import { spawn } from 'node:child_process';
 import { readFile, mkdir, writeFile, chmod, readdir, cp, rm, stat, appendFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, basename, extname, resolve, sep } from 'node:path';
@@ -26,6 +28,7 @@ const EXECUTOR_URL =
 const ALLOW_MOCK_EXECUTOR = process.env.AIWG_COCKPIT_ALLOW_MOCK_EXECUTOR === '1';
 const AUTOSTART_EXECUTOR = process.env.AIWG_COCKPIT_AUTOSTART_EXECUTOR !== '0';
 const EXECUTOR_COMMAND = process.env.AIWG_COCKPIT_EXECUTOR_COMMAND ?? '';
+const EXECUTOR_TOKEN_FILE = process.env.AIWG_COCKPIT_EXECUTOR_TOKEN_FILE ?? '';
 const RUNTIME_DIR = join(homedir(), '.aiwg', 'cockpit', 'runtime');
 const auditDir = () => process.env.AIWG_COCKPIT_AUDIT_DIR || join(homedir(), '.aiwg', 'cockpit', 'audit');
 const auditLog = () => join(auditDir(), 'events.jsonl');
@@ -35,6 +38,45 @@ const WEB_DIST = fileURLToPath(new URL('../../web/dist', import.meta.url));
 const MIME = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.svg': 'image/svg+xml', '.json': 'application/json', '.ico': 'image/x-icon', '.png': 'image/png', '.woff2': 'font/woff2', '.map': 'application/json' };
 const CAPABILITY_TYPES = new Set(['skill', 'agent', 'command', 'rule', 'flow']);
 const mcSessionsDir = () => join(process.cwd(), '.aiwg', 'ralph-external', 'mc', 'sessions');
+const executorRequestContext = new AsyncLocalStorage();
+
+function executorAuthError(code, message, cause) {
+  const err = new Error(message, cause ? { cause } : undefined);
+  err.code = code;
+  return err;
+}
+
+async function resolveExecutorBearer(tokenFile) {
+  if (!tokenFile) return '';
+  const path = expandHome(String(tokenFile));
+  let metadata;
+  try {
+    metadata = await stat(path);
+  } catch (cause) {
+    throw executorAuthError('executor_credential_unavailable', 'executor credential file is unavailable', cause);
+  }
+  if (!metadata.isFile()) {
+    throw executorAuthError('executor_credential_invalid', 'executor credential path is not a regular file');
+  }
+  if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
+    throw executorAuthError('executor_credential_permissions', 'executor credential file must not be accessible by group or other users');
+  }
+  const token = String(await readFile(path, 'utf8')).trim();
+  if (!token || /[\r\n]/.test(token)) {
+    throw executorAuthError('executor_credential_invalid', 'executor credential file must contain exactly one non-empty bearer token');
+  }
+  return token;
+}
+
+async function executorFetch(target, init = {}) {
+  const context = executorRequestContext.getStore();
+  const headers = new Headers(init.headers);
+  if (context && new URL(target).origin === context.executorOrigin && !headers.has('authorization')) {
+    const token = await resolveExecutorBearer(context.executorTokenFile);
+    if (token) headers.set('authorization', `Bearer ${token}`);
+  }
+  return fetch(target, { ...init, headers });
+}
 
 /** Serve a static file from the built web app, sandboxed to WEB_DIST. Returns true if served. */
 async function serveDistFile(res, relPath) {
@@ -352,8 +394,14 @@ async function readJsonBody(req) {
 
 /** Forward a control-plane call to the executor admin surface, relaying status + body. */
 async function proxy(res, method, target) {
-  const r = await fetch(target, { method });
+  const r = await executorFetch(target, { method });
   const body = await r.json().catch(() => ({}));
+  if (r.status === 401 || r.status === 403) {
+    const err = new Error(`executor ${r.status === 401 ? 'authentication' : 'authorization'} failed at ${new URL(target).pathname}`);
+    err.code = r.status === 401 ? 'executor_unauthenticated' : 'executor_forbidden';
+    err.upstreamStatus = r.status;
+    throw err;
+  }
   return json(res, r.status, body);
 }
 
@@ -373,6 +421,10 @@ function isConnectionRefusedError(err) {
   return /ECONNREFUSED|connection refused/i.test(text);
 }
 
+function rethrowExecutorSecurityError(err) {
+  if ([401, 403].includes(Number(err?.upstreamStatus)) || String(err?.code ?? '').startsWith('executor_credential_')) throw err;
+}
+
 export async function fetchJsonFirst(candidates, { method = 'GET', headers, body: requestBodyOption, timeoutMs = 0 } = {}) {
   const failures = [];
   for (const candidate of candidates) {
@@ -384,8 +436,9 @@ export async function fetchJsonFirst(candidates, { method = 'GET', headers, body
     const timeout = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
     let r;
     try {
-      r = await fetch(target, { method: requestMethod, headers: requestHeaders, body: requestBody, ...(controller ? { signal: controller.signal } : {}) });
+      r = await executorFetch(target, { method: requestMethod, headers: requestHeaders, body: requestBody, ...(controller ? { signal: controller.signal } : {}) });
     } catch (err) {
+      if (String(err?.code ?? '').startsWith('executor_credential_')) throw err;
       const failure = isAbortError(err) && timeoutMs > 0
         ? `${target} -> timeout after ${timeoutMs}ms`
         : `${target} -> ${String(err?.message ?? err)}`;
@@ -398,6 +451,12 @@ export async function fetchJsonFirst(candidates, { method = 'GET', headers, body
       if (timeout) clearTimeout(timeout);
     }
     const responseBody = await r.json().catch(() => ({}));
+    if (r.status === 401 || r.status === 403) {
+      const err = new Error(`executor ${r.status === 401 ? 'authentication' : 'authorization'} failed at ${new URL(target).pathname}`);
+      err.code = r.status === 401 ? 'executor_unauthenticated' : 'executor_forbidden';
+      err.upstreamStatus = r.status;
+      throw err;
+    }
     if (r.ok) return { target, status: r.status, body: responseBody };
     failures.push(`${target} -> ${r.status}`);
     if (r.status !== 404 && r.status !== 405) return { target, status: r.status, body: responseBody, failures };
@@ -435,7 +494,7 @@ async function assertRealExecutor(executorUrl, allowMockExecutor) {
 async function probeExecutor(executorUrl) {
   for (const path of ['/healthz/http', '/healthz', '/health']) {
     try {
-      const r = await fetch(`${executorUrl}${path}`, { signal: AbortSignal.timeout(1_500) });
+      const r = await executorFetch(`${executorUrl}${path}`, { signal: AbortSignal.timeout(1_500) });
       if (r.ok) return true;
     } catch {
       // Try the next health endpoint.
@@ -455,6 +514,7 @@ async function getExecutorCapabilities(executorUrl) {
       raw_status: body.status ?? body.state ?? 'unknown',
     };
   } catch (err) {
+    rethrowExecutorSecurityError(err);
     return {
       status: 'unreachable',
       source: null,
@@ -498,6 +558,10 @@ async function proxyFirst(res, candidates, options) {
     const { status, body } = await fetchJsonFirst(candidates, options);
     return json(res, status, body);
   } catch (err) {
+    if ([401, 403].includes(Number(err?.upstreamStatus))) {
+      return json(res, Number(err.upstreamStatus), { error: err.code, message: String(err.message) });
+    }
+    if (String(err?.code ?? '').startsWith('executor_credential_')) throw err;
     const message = String(err?.message ?? err);
     const notFound = / -> 404(?:;|$)/.test(message);
     const methodNotAllowed = / -> 405(?:;|$)/.test(message);
@@ -509,7 +573,9 @@ async function proxyFirst(res, candidates, options) {
 }
 
 async function destroyInstance(upstreamUrl, instanceId) {
-  const inventory = await getInventory(upstreamUrl).catch(() => ({ instances: [] }));
+  let inventory;
+  try { inventory = await getInventory(upstreamUrl); }
+  catch (err) { rethrowExecutorSecurityError(err); inventory = { instances: [] }; }
   const inst = inventory.instances.find((i) => String(i.id) === String(instanceId));
   const runtime = String(inst?.runtime ?? inst?.runtime_posture?.kind ?? '').toLowerCase();
   const dockerName = inst?.launch_context?.name;
@@ -540,6 +606,7 @@ async function destroyInstance(upstreamUrl, instanceId) {
       return result;
     }
   } catch (err) {
+    rethrowExecutorSecurityError(err);
     const message = String(err?.message ?? err);
     // A docker/container row with a resolvable name is still physically
     // removable even when admin-v2 has no instance record (404): fall through
@@ -634,7 +701,9 @@ async function signalVmAgentReconnect(domain) {
 const VM_RUNTIME_KINDS = ['vm', 'qemu', 'kvm'];
 
 async function reconnectInstance(upstreamUrl, instanceId) {
-  const inventory = await getInventory(upstreamUrl).catch(() => ({ instances: [] }));
+  let inventory;
+  try { inventory = await getInventory(upstreamUrl); }
+  catch (err) { rethrowExecutorSecurityError(err); inventory = { instances: [] }; }
   const inst = inventory.instances.find((i) => String(i.id) === String(instanceId));
   const runtime = String(inst?.runtime ?? inst?.runtime_posture?.kind ?? '').toLowerCase();
   const dockerName = inst?.launch_context?.name;
@@ -646,7 +715,8 @@ async function reconnectInstance(upstreamUrl, instanceId) {
   try {
     const result = await fetchJsonFirst(candidates, { timeoutMs: 5_000 });
     if (result.status < 400) return result;
-  } catch {
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
     // agentic-sandbox v2026.7.6 still exposes the container reconnect as an
     // in-image helper, not an HTTP endpoint. Fall through to the local-dev path.
   }
@@ -766,7 +836,8 @@ async function resolveSessionAgentId(executorUrl, instanceId) {
     const agents = await getAgentList(executorUrl);
     const agent = agents.find((a) => String(a.instance_id ?? a.instanceId ?? '') === String(instanceId));
     return agent?.id ?? agent?.agent_id ?? agent?.agentId ?? instanceId;
-  } catch {
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
     return instanceId;
   }
 }
@@ -1001,7 +1072,8 @@ async function enrichInstanceFromAgentCard(executorUrl, instance) {
       loadout: instance.loadout ?? runtimeExtension.loadout,
       image_ref: instance.image_ref ?? runtimeExtension.image_ref,
     };
-  } catch {
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
     return instance;
   }
 }
@@ -1009,7 +1081,8 @@ async function enrichInstanceFromAgentCard(executorUrl, instance) {
 async function getRegisteredAgents(executorUrl) {
   try {
     return await getAgentList(executorUrl);
-  } catch {
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
     return [];
   }
 }
@@ -1170,7 +1243,7 @@ async function getRunning(executorUrl) {
   await Promise.all(
     instances.filter((i) => i.state === 'running').map(async (inst) => {
       let tasks;
-      try { tasks = await listInstanceTasks(executorUrl, inst.id); } catch { return; }
+      try { tasks = await listInstanceTasks(executorUrl, inst.id); } catch (err) { rethrowExecutorSecurityError(err); return; }
       for (const t of tasks) {
         const state = taskState(t);
         if (!ACTIVE_TASK_STATES.has(state)) continue;
@@ -1250,7 +1323,7 @@ async function getApprovals(executorUrl, status) {
   await Promise.all(
     instances.filter((i) => i.state === 'running').map(async (inst) => {
       let tasks;
-      try { tasks = await listInstanceTasks(executorUrl, inst.id); } catch { return; }
+      try { tasks = await listInstanceTasks(executorUrl, inst.id); } catch (err) { rethrowExecutorSecurityError(err); return; }
       for (const t of tasks) {
         const approval = approvalFromTask(inst, t);
         if (!approval) continue;
@@ -1402,7 +1475,7 @@ async function getSessionEventRows(executorUrl, instances) {
   const rows = [];
   await Promise.all((instances ?? []).map(async (inst) => {
     let sessions;
-    try { sessions = (await getSessions(executorUrl, inst.id)).sessions; } catch { return; }
+    try { sessions = (await getSessions(executorUrl, inst.id)).sessions; } catch (err) { rethrowExecutorSecurityError(err); return; }
     for (const session of sessions) {
       rows.push({
         id: session.id,
@@ -1492,16 +1565,13 @@ async function respondApproval(executorUrl, approvalId, decision) {
     const { status, body } = await fetchJsonFirst(candidates);
     return { status, body };
   } catch (e) {
+    rethrowExecutorSecurityError(e);
     return { status: 409, body: { error: 'approval_response_failed', detail: String(e?.message ?? e) } };
   }
 }
 
-/**
- * Sessions for one instance, each with a direct attach_url. Control plane (this
- * list) goes through the Bridge; the data plane (the pty stream) connects direct
- * to the executor — masking differs per WS direction, so the Bridge issues the
- * URL rather than proxying frames.
- */
+/** Sessions for one instance. Executor attach targets are normalized here and
+ * replaced with Bridge-owned proxy URLs at the request boundary. */
 async function getSessions(executorUrl, instanceId) {
   const sessionAgentId = await resolveSessionAgentId(executorUrl, instanceId);
   const agentIds = unique([instanceId, sessionAgentId]);
@@ -1546,6 +1616,7 @@ async function getSessionScreen(executorUrl, instanceId, sessionId) {
     const { body, target, status } = await fetchJsonFirst(paths);
     return { status, body: normalizeScreenSnapshot(body, { instanceId, sessionId, source: target }) };
   } catch (e) {
+    rethrowExecutorSecurityError(e);
     return {
       status: 404,
       body: {
@@ -1663,7 +1734,8 @@ async function endSession(executorUrl, instanceId, sessionId) {
   let sessions = [];
   try {
     sessions = (await getSessions(executorUrl, instanceId)).sessions;
-  } catch {
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
     // Fall back to using the supplied id directly; older executors may not list
     // before delete, and delete should remain useful during recovery cleanup.
   }
@@ -1702,10 +1774,98 @@ function sessionResponseFromRow(row) {
   };
 }
 
-export function createBridge({ executorUrl = EXECUTOR_URL, allowMockExecutor = ALLOW_MOCK_EXECUTOR, token } = {}) {
+function websocketCockpitToken(req) {
+  const protocols = String(req.headers['sec-websocket-protocol'] ?? '')
+    .split(',')
+    .map((value) => value.trim())
+    .filter(Boolean);
+  const encoded = protocols.find((value) => value.startsWith('cockpit.'))?.slice('cockpit.'.length) ?? '';
+  try { return Buffer.from(encoded, 'base64url').toString('utf8'); } catch { return ''; }
+}
+
+function websocketAuthed(req, expected) {
+  const presented = websocketCockpitToken(req);
+  if (presented.length !== expected.length) return false;
+  try { return timingSafeEqual(Buffer.from(presented), Buffer.from(expected)); } catch { return false; }
+}
+
+function writeUpgradeHead(socket, response) {
+  socket.write(`HTTP/1.1 ${response.statusCode} ${response.statusMessage ?? 'Switching Protocols'}\r\n`);
+  for (let index = 0; index < response.rawHeaders.length; index += 2) {
+    socket.write(`${response.rawHeaders[index]}: ${response.rawHeaders[index + 1]}\r\n`);
+  }
+  socket.write('\r\n');
+}
+
+async function proxyExecutorWebsocket({ req, socket, head, target, executorTokenFile }) {
+  const token = await resolveExecutorBearer(executorTokenFile);
+  const requestedProtocols = String(req.headers['sec-websocket-protocol'] ?? '')
+    .split(',')
+    .map((value) => value.trim())
+    .filter((value) => value && !value.startsWith('cockpit.'));
+  const headers = {
+    connection: 'Upgrade',
+    upgrade: 'websocket',
+    host: target.host,
+    'sec-websocket-key': req.headers['sec-websocket-key'],
+    'sec-websocket-version': req.headers['sec-websocket-version'],
+    ...(req.headers['sec-websocket-extensions'] ? { 'sec-websocket-extensions': req.headers['sec-websocket-extensions'] } : {}),
+    ...(requestedProtocols.length ? { 'sec-websocket-protocol': requestedProtocols.join(', ') } : {}),
+    ...(token ? { authorization: `Bearer ${token}` } : {}),
+  };
+  const transport = target.protocol === 'wss:' ? https : http;
+  const requestTarget = new URL(target);
+  requestTarget.protocol = target.protocol === 'wss:' ? 'https:' : 'http:';
+  const upstreamRequest = transport.request(requestTarget, { method: 'GET', headers });
+  upstreamRequest.on('upgrade', (response, upstreamSocket, upstreamHead) => {
+    writeUpgradeHead(socket, response);
+    if (head.length) upstreamSocket.write(head);
+    if (upstreamHead.length) socket.write(upstreamHead);
+    socket.pipe(upstreamSocket);
+    upstreamSocket.pipe(socket);
+    const closeBoth = () => {
+      if (!socket.destroyed) socket.destroy();
+      if (!upstreamSocket.destroyed) upstreamSocket.destroy();
+    };
+    socket.on('error', closeBoth);
+    upstreamSocket.on('error', closeBoth);
+  });
+  upstreamRequest.on('response', (response) => {
+    socket.write(`HTTP/1.1 ${response.statusCode ?? 502} ${response.statusMessage ?? 'Upstream Error'}\r\nConnection: close\r\n\r\n`);
+    socket.destroy();
+    response.resume();
+  });
+  upstreamRequest.on('error', () => {
+    if (!socket.destroyed) socket.end('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n');
+  });
+  upstreamRequest.end();
+}
+
+export function createBridge({
+  executorUrl = EXECUTOR_URL,
+  allowMockExecutor = ALLOW_MOCK_EXECUTOR,
+  token,
+  executorTokenFile = EXECUTOR_TOKEN_FILE,
+} = {}) {
   const upstreamUrl = executorUrl;
   const TOKEN = token ?? randomBytes(24).toString('hex');
-  const server = http.createServer(async (req, res) => {
+  const executorOrigin = new URL(upstreamUrl).origin;
+  const executorAddress = new URL(upstreamUrl);
+  const attachTargets = new Map();
+  const issueAttachUrl = (req, value) => {
+    const target = new URL(String(value));
+    const sameHost = target.hostname === executorAddress.hostname ||
+      (isLocalHostName(target.hostname) && isLocalHostName(executorAddress.hostname));
+    if (!['ws:', 'wss:'].includes(target.protocol) || !sameHost || !/^\/agents\/[^/]+\/sessions\/[^/]+\/attach$/.test(target.pathname)) {
+      throw executorAuthError('executor_attach_target_refused', 'executor returned an attach URL outside the allowed PTY endpoint');
+    }
+    const id = randomBytes(18).toString('base64url');
+    attachTargets.set(id, target);
+    if (attachTargets.size > 1024) attachTargets.delete(attachTargets.keys().next().value);
+    const wsProtocol = req.socket.encrypted ? 'wss:' : 'ws:';
+    return `${wsProtocol}//${req.headers.host}/api/pty${target.pathname}/${id}`;
+  };
+  const handleRequest = async (req, res) => {
     const url = new URL(req.url, `http://${req.headers.host ?? 'localhost'}`);
     try {
       // unauthenticated liveness probe (no /api/ prefix) — for the shell to wait on
@@ -1818,7 +1978,12 @@ export function createBridge({ executorUrl = EXECUTOR_URL, allowMockExecutor = A
       if (url.pathname === '/api/sessions') {
         const inst = url.searchParams.get('instance');
         if (!inst) return json(res, 400, { error: 'instance_required' });
-        return json(res, 200, await getSessions(upstreamUrl, inst));
+        const result = await getSessions(upstreamUrl, inst);
+        result.sessions = result.sessions.map((session) => ({
+          ...session,
+          attach_url: issueAttachUrl(req, session.attach_url),
+        }));
+        return json(res, 200, result);
       }
       if ((m = url.pathname.match(/^\/api\/instances\/([^/]+)\/sessions\/([^/]+)$/)) && req.method === 'DELETE') {
         const { status, body } = await endSession(upstreamUrl, decodeURIComponent(m[1]), decodeURIComponent(m[2]));
@@ -1992,7 +2157,13 @@ export function createBridge({ executorUrl = EXECUTOR_URL, allowMockExecutor = A
         // Same as the list path (#1671): the attach segment must be the instance
         // id the executor's pty-ws route accepts, not the resolved agent name.
         await appendAudit('session.start.requested', { instance_id: id, mode: mode || 'managed', backend: backend || 'tmux', loadout, status, session_id: sessionId, session_name: sessionName });
-        return json(res, status, { ...body, id: sessionId, session_name: body.session_name ?? body.sessionName ?? sessionName, attach_url: attachUrl ?? `${wsBase}/agents/${encodeURIComponent(id)}/sessions/${encodeURIComponent(sessionId)}/attach` });
+        const executorAttachUrl = attachUrl ?? `${wsBase}/agents/${encodeURIComponent(id)}/sessions/${encodeURIComponent(sessionId)}/attach`;
+        return json(res, status, {
+          ...body,
+          id: sessionId,
+          session_name: body.session_name ?? body.sessionName ?? sessionName,
+          attach_url: issueAttachUrl(req, executorAttachUrl),
+        });
       }
 
       // --- management surface (UC-012): lifecycle + task cancel ---
@@ -2032,7 +2203,12 @@ export function createBridge({ executorUrl = EXECUTOR_URL, allowMockExecutor = A
       if (url.pathname === '/api/cost' && req.method === 'GET')
         return proxy(res, 'GET', `${upstreamUrl}/admin/cost`);
 
-      if (url.pathname === '/api/health') return json(res, 200, { status: 'ok', executor_url: upstreamUrl, mock_executor_allowed: allowMockExecutor });
+      if (url.pathname === '/api/health') return json(res, 200, {
+        status: 'ok',
+        executor_url: upstreamUrl,
+        mock_executor_allowed: allowMockExecutor,
+        executor_auth_configured: Boolean(executorTokenFile),
+      });
       if (url.pathname === '/' || url.pathname === '/index.html') {
         const distIndex = join(WEB_DIST, 'index.html');
         const src = existsSync(distIndex) ? distIndex : join(__dir, 'public', 'index.html');
@@ -2053,9 +2229,39 @@ export function createBridge({ executorUrl = EXECUTOR_URL, allowMockExecutor = A
       }
       json(res, 404, { error: 'not_found', path: url.pathname });
     } catch (err) {
-      json(res, 502, { error: 'bridge_upstream_error', message: String(err?.message ?? err) });
+      const status = Number(err?.upstreamStatus) || 502;
+      json(res, status, { error: err?.code ?? 'bridge_upstream_error', message: String(err?.message ?? err) });
     }
-  });
+  };
+  const server = http.createServer((req, res) => executorRequestContext.run(
+    { executorOrigin, executorTokenFile },
+    () => handleRequest(req, res),
+  ));
+  server.on('upgrade', (req, socket, head) => executorRequestContext.run(
+    { executorOrigin, executorTokenFile },
+    async () => {
+      try {
+        const url = new URL(req.url, `http://${req.headers.host ?? 'localhost'}`);
+        const match = url.pathname.match(/^\/api\/pty\/agents\/[^/]+\/sessions\/[^/]+\/attach\/([^/]+)$/);
+        if (!match || !validBrowserOrigin(req)) {
+          socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+          return;
+        }
+        if (!websocketAuthed(req, TOKEN)) {
+          socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
+          return;
+        }
+        const target = attachTargets.get(match[1]);
+        if (!target || url.pathname !== `/api/pty${target.pathname}/${match[1]}`) {
+          socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n');
+          return;
+        }
+        await proxyExecutorWebsocket({ req, socket, head, target, executorTokenFile });
+      } catch {
+        if (!socket.destroyed) socket.end('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n');
+      }
+    },
+  ));
   server.cockpitToken = TOKEN; // exposed for shells/tests
   return server;
 }

package/bridge/src/smoke.mjs

@@ -7,7 +7,8 @@ import { createBridge, normalizeSessionRows } from './server.mjs';
 
 const mock = createExecutor();
 await new Promise((r) => mock.listen(0, '127.0.0.1', r));
-const executorUrl = `http://127.0.0.1:${mock.address().port}`;
+const executorPort = mock.address().port;
+const executorUrl = `http://127.0.0.1:${executorPort}`;
 
 const bridge = createBridge({ executorUrl, allowMockExecutor: true });
 await new Promise((r) => bridge.listen(0, '127.0.0.1', r));
@@ -35,6 +36,16 @@ try {
   for (const k of ['id', 'runtime', 'loadout', 'state', 'tenant', 'card_url', 'runtime_posture', 'host_daemon', 'transport', 'launch_context', 'session_backends']) assert.ok(k in i0, `field ${k}`);
   assert.ok(['vm', 'container', 'host', 'wasm-edge'].includes(i0.runtime), 'runtime kind');
 
+  // A transient executor outage must not poison Bridge state or require a
+  // Bridge restart. Every poll is a fresh upstream request, so the same Bridge
+  // reports the gap and resumes inventory as soon as the executor returns.
+  await new Promise((resolve) => mock.close(resolve));
+  assert.equal((await f('/api/inventory')).status, 502, 'transient executor drop -> 502');
+  await new Promise((resolve) => mock.listen(executorPort, '127.0.0.1', resolve));
+  const recoveredInventory = await f('/api/inventory');
+  assert.equal(recoveredInventory.status, 200, 'same Bridge resumes after executor returns');
+  assert.equal((await recoveredInventory.json()).count, 4, 'recovered inventory is complete');
+
   // running board: seeded working tasks on the running instances
   const rr = await f("/api/running");
   assert.equal(rr.status, 200, 'running 200');
@@ -44,13 +55,13 @@ try {
   for (const k of ['runtime_posture', 'transport']) assert.ok(k in run.running[0], `running posture field ${k}`);
   assert.equal(run.running[0].state, 'working', 'running task is working');
 
-  // sessions: the demo pty session is listed with a direct ws attach_url
+  // sessions: the demo pty session is listed with a Bridge-owned ws attach_url
   const sr = await f("/api/sessions?instance=550e8400-e29b-41d4-a716-446655440000");
   assert.equal(sr.status, 200, 'sessions 200');
   const sess = await sr.json();
   const demo = sess.sessions.find((s) => s.id === 'demo-shell');
   assert.ok(demo, 'demo-shell session present');
-  assert.match(demo.attach_url, /^ws:\/\/.*\/agents\/.*\/sessions\/demo-shell\/attach$/, 'ws attach_url shape');
+  assert.match(demo.attach_url, /^ws:\/\/.*\/api\/pty\/agents\/.*\/sessions\/demo-shell\/attach\/[A-Za-z0-9_-]+$/, 'ws attach_url shape');
   assert.ok(demo.liveness.replay_newest_seq >= 3, 'demo session has a seeded transcript');
   assert.equal(demo.session_class, 'direct', 'demo session class');
   assert.equal(demo.session_backend, 'native', 'demo session backend');
@@ -168,7 +179,7 @@ try {
   // start a session (onboarding primary verb): create + issue a ws attach_url
   const started = await (await f('/api/instances/550e8400-e29b-41d4-a716-446655440000/sessions', { method: 'POST' })).json();
   assert.match(started.id ?? '', /^sess-/, 'start-session returns a new session id');
-  assert.match(started.attach_url ?? '', /\/sessions\/sess-[^/]+\/attach$/, 'start-session issues a ws attach_url');
+  assert.match(started.attach_url ?? '', /\/sessions\/sess-[^/]+\/attach\/[A-Za-z0-9_-]+$/, 'start-session issues a proxied ws attach_url');
 
   // app shell served with the per-launch token injected (React build if present, else
   // the legacy fallback — both carry the title + token)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cockpit",
-  "version": "2026.7.15",
+  "version": "2026.7.17",
   "description": "AIWG Cockpit — UX-first control plane over AIWG + multi-stack agentic sessions. Opt-in, separately published; NOT shipped in the base aiwg npm package (guarded by test/smoke/cockpit-base-footprint.test.js).",
   "type": "module",
   "license": "MIT",

package/web/src/App.test.tsx

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { render, screen, cleanup, waitFor, fireEvent } from '@testing-library/react';
+import { render, screen, cleanup, waitFor, fireEvent, act } from '@testing-library/react';
 import { App, waitForSessionReady } from './App';
 
 // Rendered-DOM coverage (the a11y assertions deferred from T2, and a guard against the
@@ -213,6 +213,49 @@ describe('App shell (rendered DOM)', () => {
     expect(screen.getByText(/host ✓ · docker - · vm -/)).toBeTruthy();
   });
 
+  it('shows reconnecting and restores all live views after a transient drop without a page refresh (#1763)', async () => {
+    vi.useFakeTimers();
+    try {
+      let executorAvailable = true;
+      globalThis.fetch = vi.fn(async (input: RequestInfo | URL) => {
+        const url = String(input);
+        if (url.includes('/api/health')) return jsonResponse({ executor_url: 'http://127.0.0.1:8122' });
+        if (url.includes('/api/inventory')) {
+          return executorAvailable
+            ? jsonResponse({ count: 1, fetched_at: new Date().toISOString(), instances: [instance('host-1', 'host', 'Codex host')] })
+            : errorResponse(502);
+        }
+        if (url.includes('/api/running')) return executorAvailable ? jsonResponse({ count: 1, running: [] }) : errorResponse(502);
+        if (url.includes('/api/approvals')) return jsonResponse({ approvals: [] });
+        if (url.includes('/api/cost')) return jsonResponse({ total: { input_tokens: 0, output_tokens: 0, usd: 0 }, per_instance: [] });
+        return jsonResponse({});
+      }) as typeof fetch;
+
+      render(<App />);
+      await act(async () => { await Promise.resolve(); await Promise.resolve(); });
+      expect(screen.getByText('Bridge live')).toBeTruthy();
+      expect(screen.getByText('1 stacks')).toBeTruthy();
+      const sessionCallsBeforeDrop = vi.mocked(globalThis.fetch).mock.calls
+        .filter(([input]) => String(input).includes('/api/sessions?instance=')).length;
+
+      executorAvailable = false;
+      await act(async () => { await vi.advanceTimersByTimeAsync(15_000); });
+      expect(screen.getByText('Reconnecting…')).toBeTruthy();
+      expect(screen.getByTitle(/showing last-known status/i)).toBeTruthy();
+      expect(screen.getByText('1 stacks')).toBeTruthy();
+
+      executorAvailable = true;
+      await act(async () => { await vi.advanceTimersByTimeAsync(1_000); });
+      expect(screen.getByText('Bridge live')).toBeTruthy();
+      expect(screen.queryByText('Reconnecting…')).toBeNull();
+      expect(globalThis.fetch).toHaveBeenCalledWith(expect.stringContaining('/api/running'), expect.anything());
+      expect(vi.mocked(globalThis.fetch).mock.calls
+        .filter(([input]) => String(input).includes('/api/sessions?instance=')).length).toBeGreaterThan(sessionCallsBeforeDrop);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('stays connected when the executor exposes no running/approvals admin surface (#1638)', async () => {
     // Real agentic-sandbox has no /running or /approvals admin route, so those
     // Bridge endpoints error. Inventory + health succeed. The header must stay

package/web/src/App.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState, type ReactNode } from 'react';
+import { useEffect, useRef, useState, type ReactNode } from 'react';
 import { useSession } from './useSession';
 import { api, TOKEN } from './api';
 import type { Approval, Instance, ResponseNeeded } from './types';
@@ -41,6 +41,7 @@ interface ChromeStatus {
   container: boolean;
   vm: boolean;
 }
+type ConnectionState = 'checking' | 'live' | 'reconnecting';
 
 const sleep = (ms: number) => new Promise((resolve) => window.setTimeout(resolve, ms));
 
@@ -54,6 +55,9 @@ export function App() {
   const registryResponses = registryResponseNeededItems(sessionRegistry).filter((response) => response.id !== `pty:${sessionRegistry.activeKey}`);
   const [composer, setComposer] = useState('');
   const [chrome, setChrome] = useState<ChromeStatus | null>(null);
+  const [connectionState, setConnectionState] = useState<ConnectionState>('checking');
+  const reconnectPendingRef = useRef(false);
+  const eventsDownRef = useRef(false);
   const [startOpen, setStartOpen] = useState(false);
   const [startInst, setStartInst] = useState<string | undefined>(undefined);
   const [launchOpen, setLaunchOpen] = useState(false);
@@ -61,6 +65,11 @@ export function App() {
 
   useEffect(() => {
     let cancelled = false;
+    let timer: number | undefined;
+    let retryMs = 1_000;
+    const schedule = (ms: number) => {
+      timer = window.setTimeout(load, ms);
+    };
     const load = async () => {
       try {
         // Health + inventory decide "Bridge live". Running + approvals are
@@ -87,20 +96,52 @@ export function App() {
           container: families.includes('container'),
           vm: families.includes('vm'),
         });
+        if (!eventsDownRef.current) {
+          const recovered = reconnectPendingRef.current;
+          reconnectPendingRef.current = false;
+          setConnectionState('live');
+          // One recovery pulse refreshes every mounted live-data view. This is
+          // deliberately separate from their own polling/backoff, so Running,
+          // Missions, Sessions, and Inventory converge together after a blip.
+          if (recovered) setRefreshTick((t) => t + 1);
+        }
+        retryMs = 1_000;
+        if (!cancelled) schedule(15_000);
       } catch {
-        if (!cancelled) setChrome(null);
+        if (!cancelled) {
+          // Preserve last-known chrome while making its staleness explicit.
+          // Retry quickly, then back off to the normal 15 s poll ceiling.
+          reconnectPendingRef.current = true;
+          setConnectionState('reconnecting');
+          schedule(retryMs);
+          retryMs = Math.min(retryMs * 2, 15_000);
+        }
       }
     };
     load();
-    const timer = window.setInterval(load, 15_000);
-    return () => { cancelled = true; window.clearInterval(timer); };
+    return () => {
+      cancelled = true;
+      if (timer !== undefined) window.clearTimeout(timer);
+    };
   }, [session.responseNeeded.needed, refreshTick, registryResponses.length]);
 
   useEffect(() => {
     if (typeof EventSource === 'undefined' || !TOKEN) return;
     const events = new EventSource(`/api/events?token=${encodeURIComponent(TOKEN)}`);
-    events.addEventListener('cockpit.refresh', () => setRefreshTick((t) => t + 1));
-    events.onerror = () => undefined;
+    const refresh = () => {
+      eventsDownRef.current = false;
+      setRefreshTick((t) => t + 1);
+    };
+    events.onopen = refresh;
+    events.addEventListener('cockpit.refresh', refresh);
+    events.onerror = () => {
+      eventsDownRef.current = true;
+      reconnectPendingRef.current = true;
+      setConnectionState('reconnecting');
+      // EventSource reconnects itself. Pulse the REST path now as well so a
+      // Bridge/executor drop does not wait for the normal poll interval.
+      setRefreshTick((t) => t + 1);
+    };
     return () => events.close();
   }, []);
 
@@ -162,8 +203,13 @@ export function App() {
           <span className="mark" aria-hidden="true">◆</span>
           <h1>AIWG&nbsp;Cockpit</h1>
         </div>
-        <div className="top-status" aria-label="Cockpit status">
-          <span className={`health-pill ${chrome ? 'ok' : 'warn'}`}>{chrome ? 'Bridge live' : 'Bridge checking'}</span>
+        <div className="top-status" aria-label="Cockpit status" aria-live="polite">
+          <span
+            className={`health-pill ${connectionState === 'live' ? 'ok' : 'warn'}`}
+            title={connectionState === 'reconnecting' && chrome ? 'Connection interrupted; showing last-known status while Cockpit retries.' : undefined}
+          >
+            {connectionState === 'live' ? 'Bridge live' : connectionState === 'reconnecting' ? 'Reconnecting…' : 'Bridge checking'}
+          </span>
           {chrome && (
             <>
               <span className="executor-pill" title={chrome.executor}>{chrome.executor}</span>
@@ -193,7 +239,7 @@ export function App() {
         <Panel id="missions" tab={tab}><Missions refreshTick={refreshTick} /></Panel>
         {/* Sessions stays mounted so the WebSocket survives tab switches */}
         <section id="panel-sessions" role="tabpanel" aria-labelledby="tab-sessions" hidden={tab !== 'sessions'}>
-          <Sessions session={session} composer={composer} setComposer={setComposer} onRequestStart={requestStart} />
+          <Sessions session={session} composer={composer} setComposer={setComposer} onRequestStart={requestStart} refreshTick={refreshTick} />
         </section>
         <Panel id="approvals" tab={tab}><Approvals refreshTick={refreshTick} responses={[...registryResponses, ...(session.responseNeeded.needed ? [sessionResponse(session)] : [])]} goSessions={() => setTab('sessions')} /></Panel>
         <Panel id="explore" tab={tab}><Explore /></Panel>

package/web/src/components/Sessions.tsx

@@ -7,7 +7,14 @@ import type { SessionApi } from '../useSession';
 import { markRegistrySessionViewed, sessionRegistryKeyFor, setRegistryActiveSession, upsertRegistrySessions, useSessionRegistry } from '../sessionRegistry';
 import { useSessionSnapshotMonitor } from '../sessionMonitor';
 
-export function Sessions({ session, composer, setComposer, onRequestStart, refreshMs = 5_000 }: { session: SessionApi; composer: string; setComposer: (v: string) => void; onRequestStart: (instanceId?: string) => void; refreshMs?: number }) {
+export function Sessions({ session, composer, setComposer, onRequestStart, refreshMs = 5_000, refreshTick = 0 }: {
+  session: SessionApi;
+  composer: string;
+  setComposer: (v: string) => void;
+  onRequestStart: (instanceId?: string) => void;
+  refreshMs?: number;
+  refreshTick?: number;
+}) {
   const [instances, setInstances] = useState<Instance[]>([]);
   const [sessions, setSessions] = useState<SessionInfo[]>([]);
   const [instId, setInstId] = useState('');
@@ -112,7 +119,7 @@ export function Sessions({ session, composer, setComposer, onRequestStart, refre
       cancelled = true;
       if (timer !== undefined) window.clearTimeout(timer);
     };
-  }, [endingSession, loadSessions, refreshInventory, refreshMs]);
+  }, [endingSession, loadSessions, refreshInventory, refreshMs, refreshTick]);
 
   useEffect(() => {
     if (!instId) return;

package/web/src/useSession.ts

@@ -2,10 +2,11 @@ import { useCallback, useEffect, useRef, useState } from 'react';
 import { Terminal } from '@xterm/xterm';
 import { FitAddon } from '@xterm/addon-fit';
 import type { Role } from './types';
+import { TOKEN } from './api';
 
 // The pty session connections, lifted to App so the Sessions tab renders them and the
-// Actions tab can inject into the active one. Data plane is browser→executor (the
-// attach_url the Bridge issues); control plane stays on the Bridge.
+// Actions tab can inject into the active one. Both planes terminate at the Bridge:
+// the Bridge proxies PTY upgrades so the browser never receives executor credentials.
 //
 // Each (instance, session) keeps its OWN persistent xterm Terminal + WebSocket, mounted
 // once and hidden (not torn down) when another session is shown. Switching sessions is a
@@ -38,6 +39,15 @@ const FIRST_FRAME_DEADLINE_MS = 4000;
 const textEnc = new TextEncoder();
 const textDec = new TextDecoder();
 
+function websocketProtocols(url: string): string[] | undefined {
+  if (!TOKEN || !/\/api\/pty\/agents\//.test(url)) return undefined;
+  const bytes = textEnc.encode(TOKEN);
+  let raw = '';
+  for (let index = 0; index < bytes.length; index += 1) raw += String.fromCharCode(bytes[index]);
+  const encoded = btoa(raw).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+  return ['pty-ws.v1', `cockpit.${encoded}`];
+}
+
 // base64 → raw bytes. xterm does its own UTF-8 decoding and escape-sequence parsing, so
 // it must receive bytes (Uint8Array) — a Latin-1 string renders escapes as literal text.
 const b64ToBytes = (b64: string): Uint8Array => {
@@ -230,7 +240,7 @@ class PtyConnection {
 
     const open = () => {
       if (this.connId !== connId || this.closedByUser || this.disposed) return;
-      const ws = new WebSocket(this.url);
+      const ws = new WebSocket(this.url, websocketProtocols(this.url));
       this.ws = ws;
       let gone = false;
       ws.addEventListener('open', () => {