@aiwg/cockpit 2026.7.24 → 2026.8.0

package/README.md

@@ -135,7 +135,7 @@ operator / CLI:  aiwg cockpit
 │    cost, sessions (create + attach_url), contributions       │
 │  · read-only catalog: aiwg discover / show (display only)    │
 │  · user asset library: clone/import/delete (never writes AIWG)│
-│  · serves the built React app (token-injected)               │
+│  · serves the React app (one-time nonce → HttpOnly session)  │
 └─────────────────────────────────────────────────────────────┘
        │ authenticated proxy            ▲ loads the token-gated shell
        ▼                                │
@@ -146,9 +146,9 @@ operator / CLI:  aiwg cockpit
 
 - **Control plane** (lifecycle, approvals, actions) goes through the gated Bridge.
 - **Data plane** (the PTY session stream) also goes through a Bridge-owned
-  `attach_url`. The browser presents only its per-launch Cockpit token; the
-  Bridge keeps the long-lived executor credential and authenticates the upstream
-  WebSocket upgrade.
+  `attach_url`. The browser presents only its HttpOnly Cockpit session; the
+  Bridge keeps the native-shell and executor credentials and authenticates the
+  upstream WebSocket upgrade.
 
 ## Surfaces (tabs)
 
@@ -343,7 +343,8 @@ Reconnect action never creates a replacement instance and never destroys the
 running container; it only attempts to restore the missing agent registration.
 
 `aiwg cockpit` (the operator command) will wrap this; the Bridge serves the built
-React app token-injected, falling back to a legacy page when no build is present.
+React app through the same one-time bootstrap/session contract, falling back to
+a legacy page when no build is present.
 
 ## Components
 
@@ -352,7 +353,7 @@ React app token-injected, falling back to a legacy page when no build is present
 | `web/` | React 19 + Vite + TS UI (the surfaces above) |
 | `mock-executor/` | **automated-test-only** wire-faithful agentic-sandbox A2A v2 stand-in (conformance 33/0/17). The Bridge refuses it for human launches (needs `AIWG_COCKPIT_ALLOW_MOCK_EXECUTOR=1`); a contract guard (#1636) pins its legacy `/admin/{running,approvals,cost}` divergence from real v2 so new drift fails CI. |
 | `bridge/` | the registry-bound control-plane server + static serving |
-| `shell-core/` | the cross-shell handshake (runtime token reference or fallback token → connect) |
+| `shell-core/` | the cross-shell handshake (native runtime credential → one-time browser bootstrap) |
 | `vscode/` · `desktop/` | VS Code extension + Tauri shells over the same Bridge |
 | `contrib/` | declarative UI contributions + schema (actions inject commands) |
 | `poc/` | Iteration-1 risk-gate PoCs (kill-bridge isolation, security) |
@@ -443,7 +444,8 @@ families in inventory. For each target it verifies inventory normalization,
 runtime and transport posture, session backend evidence, session create/list,
 observe attach, and a minimal provider-backed workload through a controller
 session when control is advertised. The selected provider is invoked through the
-attached session (`codex exec -s read-only ...`
+attached session (`codex exec --skip-git-repo-check -s read-only ...`
+for gate-owned non-repository workspaces,
 or `claude --print --permission-mode dontAsk --output-format text ...`) and must
 emit `AIWG_COCKPIT_LIVE_OK` and the expected discovery result (`issue-audit` by
 default). This proves a pre-authenticated agentic framework actually launched in
@@ -577,7 +579,9 @@ host-daemon surfacing (roctinam/aiwg#1615) and transport-trust visibility (#1618
 host-daemon now render per instance (a host-daemon *detail-status* payload
 remains a residual under #1615). Direct/managed PTY negotiation (#1616) and the
 live real-sandbox gate (#1617) continue. Secure transport details map back to agentic-sandbox#409/#410/#412; local
-Browser/Tauri/VS Code-to-Bridge auth remains roctinam/aiwg#1595.
+Browser/Tauri/VS Code-to-Bridge auth is implemented under #1595/#1968 with
+one-time audience-bound bootstrap, HttpOnly session custody, and credential-free
+REST/SSE/PTY URLs.
 
 ### Operator-wall review modes (#1622)
 

package/bridge/src/public/index.html

@@ -153,12 +153,32 @@
     const meta = document.getElementById('meta');
     const fmt = (id) => (id && id.length > 12) ? id.slice(0, 8) + '…' : id;
     const esc = (s) => String(s).replace(/[&<>]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]));
-    // per-launch token injected by the Bridge for the gated control surface
-    const TOKEN = window.__COCKPIT_TOKEN__ || '';
-    const api = (u, o = {}) => {
+    // Exchange a one-time URL-fragment nonce for an HttpOnly session. The
+    // fragment is removed before any control-surface request is made.
+    let CSRF = '';
+    const sessionReady = (async () => {
+      const params = new URLSearchParams(location.hash.replace(/^#/, ''));
+      const nonce = params.get('bootstrap') || '';
+      const next = params.get('next') || '';
+      const response = nonce
+        ? await fetch('/bootstrap/session', {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ nonce, audience: params.get('audience') || 'browser' }),
+          })
+        : await fetch('/bootstrap/session', { credentials: 'same-origin' });
+      if (!response.ok) throw new Error(`Cockpit session bootstrap failed (${response.status})`);
+      const body = await response.json();
+      if (!body.csrf) throw new Error('Cockpit session bootstrap returned no CSRF binding');
+      CSRF = body.csrf;
+      if (nonce) history.replaceState(null, '', location.pathname + location.search + (next ? '#' + next : ''));
+    })();
+    const api = async (u, o = {}) => {
+      await sessionReady;
       const method = String(o.method || 'GET').toUpperCase();
-      const csrf = ['GET', 'HEAD', 'OPTIONS'].includes(method) ? {} : { 'x-cockpit-csrf': TOKEN };
-      return fetch(u, { ...o, headers: { ...(o.headers || {}), ...csrf, authorization: 'Bearer ' + TOKEN } });
+      const csrf = ['GET', 'HEAD', 'OPTIONS'].includes(method) ? {} : { 'x-cockpit-csrf': CSRF };
+      return fetch(u, { ...o, credentials: 'same-origin', headers: { ...(o.headers || {}), ...csrf } });
     };
 
     // --- Inventory ---
@@ -400,9 +420,13 @@
       else discover();
     }
     document.getElementById('refresh').addEventListener('click', refreshActive);
-    if ('EventSource' in window && TOKEN) {
-      const events = new EventSource('/api/events?token=' + encodeURIComponent(TOKEN));
-      events.addEventListener('cockpit.refresh', refreshActive);
+    if ('EventSource' in window) {
+      sessionReady.then(() => {
+        const events = new EventSource('/api/events');
+        events.addEventListener('cockpit.refresh', refreshActive);
+      }).catch((error) => {
+        meta.textContent = error.message;
+      });
     }
 
     loadInventory();

package/bridge/src/server.mjs

@@ -10,7 +10,7 @@ import https from 'node:https';
 import { spawn } from 'node:child_process';
 import { readFile, mkdir, writeFile, chmod, readdir, cp, rm, stat, appendFile } from 'node:fs/promises';
 import { existsSync, realpathSync } from 'node:fs';
-import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -96,13 +96,29 @@ async function serveDistFile(res, relPath) {
 // First-party contribution manifests; AIWG-extension-sourced ones layer in via AIWG_COCKPIT_CONTRIB (#1591).
 const CONTRIB_DIRS = [fileURLToPath(new URL('../../contrib', import.meta.url)), ...(process.env.AIWG_COCKPIT_CONTRIB ? [process.env.AIWG_COCKPIT_CONTRIB] : [])];
 
-/** Constant-time bearer-token check (header or ?token=). */
-function authed(req, url, token) {
+function constantTimeEqual(presented, expected) {
+  if (presented.length !== expected.length) return false;
+  try { return timingSafeEqual(Buffer.from(presented), Buffer.from(expected)); } catch { return false; }
+}
+
+/** Constant-time bearer-token check. URL query credentials are never accepted. */
+function bearerAuthed(req, token) {
   const hdr = String(req.headers['authorization'] ?? '');
   const bearer = hdr.startsWith('Bearer ') ? hdr.slice(7) : '';
-  const presented = bearer || url.searchParams.get('token') || '';
-  if (presented.length !== token.length) return false;
-  try { return timingSafeEqual(Buffer.from(presented), Buffer.from(token)); } catch { return false; }
+  return constantTimeEqual(bearer, token);
+}
+
+function cookies(req) {
+  return Object.fromEntries(String(req.headers.cookie ?? '')
+    .split(';')
+    .map((part) => part.trim())
+    .filter(Boolean)
+    .map((part) => {
+      const split = part.indexOf('=');
+      if (split < 0) return [part, ''];
+      try { return [part.slice(0, split), decodeURIComponent(part.slice(split + 1))]; }
+      catch { return [part.slice(0, split), '']; }
+    }));
 }
 
 function isLocalHostName(hostname) {
@@ -115,21 +131,21 @@ function validBrowserOrigin(req) {
   try {
     const o = new URL(String(origin));
     const host = new URL(`http://${req.headers.host ?? 'localhost'}`);
-    return ['http:', 'https:'].includes(o.protocol) &&
+    return o.protocol === host.protocol &&
       isLocalHostName(o.hostname) &&
       isLocalHostName(host.hostname) &&
-      (!o.port || !host.port || o.port === host.port);
+      o.hostname === host.hostname &&
+      o.port === host.port;
   } catch {
     return false;
   }
 }
 
-function validCsrf(req, token) {
+function validCsrf(req, auth) {
   if (['GET', 'HEAD', 'OPTIONS'].includes(req.method ?? 'GET')) return true;
-  if (!req.headers.origin) return true;
+  if (auth?.kind === 'bearer' && !req.headers.origin) return true;
   const csrf = String(req.headers['x-cockpit-csrf'] ?? '');
-  if (csrf.length !== token.length) return false;
-  try { return timingSafeEqual(Buffer.from(csrf), Buffer.from(token)); } catch { return false; }
+  return constantTimeEqual(csrf, auth?.csrf ?? '');
 }
 
 /** Persist the per-launch token for the desktop/VS Code shells to read (mode 600). */
@@ -1409,7 +1425,11 @@ function defaultSessionLaunch(instance) {
     };
   }
   if (runtime === 'container' || runtime === 'docker' || runtime === 'vm' || runtime === 'qemu' || runtime === 'kvm') {
-    const home = runtime === 'container' || runtime === 'docker' ? '/root' : '/home/agent';
+    // Prefer the executor-reported target-local cwd. Current agentic-sandbox
+    // container and VM contracts report `/home/agent`; retain that value as a
+    // compatibility fallback for older inventory responses. `/root` is not
+    // readable by the mandatory uid 10001 container identity.
+    const home = instance?.launch_context?.cwd ?? '/home/agent';
     return {
       command: '/bin/bash',
       args: ['-lc', `cd ${shellSingleQuote(home)} && exec /bin/bash -l`],
@@ -2244,9 +2264,46 @@ export function createBridge({
   token,
   executorTokenFile = EXECUTOR_TOKEN_FILE,
   requireSandboxMtls = REQUIRE_SANDBOX_MTLS,
+  bootstrapTtlMs = 60_000,
+  sessionTtlMs = 12 * 60 * 60 * 1000,
 } = {}) {
   const upstreamUrl = executorUrl;
   const TOKEN = token ?? randomBytes(24).toString('hex');
+  const bootstrapNonces = new Map();
+  const browserSessions = new Map();
+  const digest = (value) => createHash('sha256').update(String(value)).digest('base64url');
+  const issueBootstrapNonce = (audience = 'browser') => {
+    if (!['browser', 'tauri', 'vscode'].includes(audience)) {
+      throw executorAuthError('invalid_bootstrap_audience', 'bootstrap audience must be browser, tauri, or vscode');
+    }
+    const nonce = randomBytes(24).toString('base64url');
+    bootstrapNonces.set(digest(nonce), { audience, expiresAt: Date.now() + bootstrapTtlMs });
+    return nonce;
+  };
+  const consumeBootstrapNonce = (nonce, audience) => {
+    const key = digest(nonce);
+    const pending = bootstrapNonces.get(key);
+    bootstrapNonces.delete(key);
+    return Boolean(
+      pending &&
+      pending.expiresAt >= Date.now() &&
+      pending.audience === audience &&
+      ['browser', 'tauri', 'vscode'].includes(audience),
+    );
+  };
+  const sessionAuth = (req) => {
+    const id = cookies(req).cockpit_session ?? '';
+    const session = browserSessions.get(digest(id));
+    if (!session) return null;
+    if (session.expiresAt < Date.now()) {
+      browserSessions.delete(digest(id));
+      return null;
+    }
+    return { kind: 'session', csrf: session.csrf };
+  };
+  const requestAuth = (req) => bearerAuthed(req, TOKEN)
+    ? { kind: 'bearer', csrf: TOKEN }
+    : sessionAuth(req);
   const executorOrigin = new URL(upstreamUrl).origin;
   const executorAddress = new URL(upstreamUrl);
   const attachTargets = new Map();
@@ -2268,14 +2325,62 @@ export function createBridge({
     try {
       // unauthenticated liveness probe (no /api/ prefix) — for the shell to wait on
       if (url.pathname === '/healthz') return json(res, 200, { status: 'ok' });
+      if (url.pathname === '/bootstrap/nonce' && req.method === 'POST') {
+        if (!validBrowserOrigin(req) || !bearerAuthed(req, TOKEN)) {
+          return json(res, 401, { error: 'unauthorized' });
+        }
+        const parsed = await readJsonBody(req);
+        if (parsed.error) return json(res, 400, { error: parsed.error });
+        try {
+          const payload = JSON.stringify({
+            nonce: issueBootstrapNonce(String(parsed.body.audience ?? 'browser')),
+            expires_in_ms: bootstrapTtlMs,
+          });
+          res.writeHead(201, {
+            'content-type': 'application/json',
+            'cache-control': 'no-store',
+            'content-length': Buffer.byteLength(payload),
+          });
+          return res.end(payload);
+        } catch (err) {
+          return json(res, 400, { error: err.code ?? 'invalid_bootstrap_audience' });
+        }
+      }
+      if (url.pathname === '/bootstrap/session' && req.method === 'POST') {
+        if (!validBrowserOrigin(req)) return json(res, 403, { error: 'forbidden_origin' });
+        const parsed = await readJsonBody(req);
+        if (parsed.error) return json(res, 400, { error: parsed.error });
+        const nonce = String(parsed.body.nonce ?? '');
+        const audience = String(parsed.body.audience ?? '');
+        if (!nonce || !consumeBootstrapNonce(nonce, audience)) {
+          return json(res, 401, { error: 'bootstrap_invalid_or_expired' });
+        }
+        const id = randomBytes(32).toString('base64url');
+        const csrf = randomBytes(24).toString('base64url');
+        browserSessions.set(digest(id), { csrf, audience, expiresAt: Date.now() + sessionTtlMs });
+        res.writeHead(201, {
+          'content-type': 'application/json',
+          'cache-control': 'no-store',
+          'set-cookie': `cockpit_session=${encodeURIComponent(id)}; HttpOnly; Path=/; SameSite=Strict; Max-Age=${Math.ceil(sessionTtlMs / 1000)}`,
+        });
+        return res.end(JSON.stringify({ csrf, expires_in_ms: sessionTtlMs }));
+      }
+      if (url.pathname === '/bootstrap/session' && req.method === 'GET') {
+        const auth = sessionAuth(req);
+        if (!auth) return json(res, 401, { error: 'unauthorized' });
+        res.setHeader('cache-control', 'no-store');
+        return json(res, 200, { csrf: auth.csrf });
+      }
       if (url.pathname.startsWith('/api/') && !validBrowserOrigin(req)) {
         return json(res, 403, { error: 'forbidden_origin' });
       }
-      // gate the control surface: per-launch bearer token on every /api/ call
-      if (url.pathname.startsWith('/api/') && !authed(req, url, TOKEN)) {
+      // Gate the control surface with either an explicit bearer for non-browser
+      // clients or the HttpOnly session established by a one-time bootstrap.
+      const auth = url.pathname.startsWith('/api/') ? requestAuth(req) : null;
+      if (url.pathname.startsWith('/api/') && !auth) {
         return json(res, 401, { error: 'unauthorized', detail: 'missing or invalid cockpit token' });
       }
-      if (url.pathname.startsWith('/api/') && !validCsrf(req, TOKEN)) {
+      if (url.pathname.startsWith('/api/') && !validCsrf(req, auth)) {
         return json(res, 403, { error: 'csrf_required' });
       }
       if (url.pathname.startsWith('/api/')) {
@@ -2642,13 +2747,15 @@ export function createBridge({
         const distIndex = join(WEB_DIST, 'index.html');
         const src = existsSync(distIndex) ? distIndex : join(__dir, 'public', 'index.html');
         const raw = await readFile(src, 'utf8');
-        // Inject the per-launch token so the same-origin app can call the gated API.
-        const html = raw.replace('</head>', `<script>window.__COCKPIT_TOKEN__=${JSON.stringify(TOKEN)}</script>\n</head>`);
-        // never cache the shell — it must always reference the latest hashed bundle
+        // The app exchanges a one-time nonce from the URL fragment for an
+        // HttpOnly session. No reusable credential is injected into HTML.
+        const html = raw;
+        // Never cache the shell or bootstrap-bearing navigation.
         res.writeHead(200, {
           'content-type': 'text/html; charset=utf-8',
-          'cache-control': 'no-cache',
-          'set-cookie': `cockpit_csrf=${TOKEN}; Path=/; SameSite=Strict`,
+          'cache-control': 'no-store',
+          'content-security-policy': `default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws://${req.headers.host} wss://${req.headers.host}; frame-ancestors 'self' vscode-webview: tauri:`,
+          'referrer-policy': 'no-referrer',
         });
         return res.end(html);
       }
@@ -2676,7 +2783,7 @@ export function createBridge({
           socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
           return;
         }
-        if (!websocketAuthed(req, TOKEN)) {
+        if (!websocketAuthed(req, TOKEN) && !sessionAuth(req)) {
           socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
           return;
         }
@@ -2692,6 +2799,7 @@ export function createBridge({
     },
   ));
   server.cockpitToken = TOKEN; // exposed for shells/tests
+  server.issueBootstrapNonce = issueBootstrapNonce;
   return server;
 }
 
@@ -2741,8 +2849,10 @@ if (isDirectExecution()) {
   server.listen(port, '127.0.0.1', async () => {
     try {
       const file = await writeRuntimeToken({ token: server.cockpitToken, port, pid: process.pid });
+      const browserNonce = server.issueBootstrapNonce('browser');
       console.log(`[cockpit-bridge] http://127.0.0.1:${port}  (executor ${EXECUTOR_URL})`);
-      console.log(`  token written ${file} (mode 600) — open the URL in a browser or attach a shell`);
+      console.log(`  runtime handshake ${file} (mode 600)`);
+      console.log(`  browser bootstrap http://127.0.0.1:${port}/#bootstrap=${browserNonce}&audience=browser (one-time, 60s)`);
     } catch (err) {
       console.error(`[cockpit-bridge] failed to persist runtime token: ${String(err?.message ?? err)}`);
       server.close(() => process.exit(1));

package/bridge/src/smoke.mjs

@@ -19,7 +19,7 @@ const f = (p, o = {}) => fetch(base + p, { ...o, headers: { ...(o.headers || {})
 try {
   // auth gate: /api/ without the token is 401; /healthz is open
   assert.equal((await fetch(`${base}/api/inventory`)).status, 401, 'gate: no token -> 401');
-  assert.equal((await fetch(`${base}/api/inventory?token=wrong`)).status, 401, 'gate: bad token -> 401');
+  assert.equal((await fetch(`${base}/api/inventory?token=${encodeURIComponent(bridge.cockpitToken)}`)).status, 401, 'gate: URL token is never accepted');
   assert.equal((await fetch(`${base}/healthz`)).status, 200, 'healthz open (no token)');
 
   // data path: Bridge reads the executor admin inventory
@@ -222,11 +222,11 @@ try {
   assert.match(started.id ?? '', /^sess-/, 'start-session returns a new session id');
   assert.match(started.attach_url ?? '', /\/sessions\/sess-[^/]+\/attach\/[A-Za-z0-9_-]+$/, 'start-session issues a proxied ws attach_url');
 
-  // app shell served with the per-launch token injected (React build if present, else
-  // the legacy fallback — both carry the title + token)
+  // app shell is served without reusable credential material.
   const html = await (await fetch(base + "/")).text();
   assert.match(html, /AIWG.?Cockpit/i, 'app title rendered');
-  assert.ok(html.includes(`window.__COCKPIT_TOKEN__=${JSON.stringify(bridge.cockpitToken)}`), 'token injected into the served app');
+  assert.ok(!html.includes(bridge.cockpitToken), 'root does not inject the control token');
+  assert.ok(!html.includes('__COCKPIT_TOKEN__'), 'root has no legacy token bootstrap global');
   // strip HTML comments BEFORE matching — a module script trapped inside a comment
   // (the Vite '</head>'-in-comment gotcha) must not count as "referenced".
   const live = html.replace(/<!--[\s\S]*?-->/g, '');

package/desktop/README.md

@@ -3,8 +3,9 @@
 A lightweight native window hosting the **same registry-bound Bridge UI** as the
 VS Code shell and the browser. The shell does not replace the CLI or reimplement
 the control plane — `src-tauri/src/main.rs` waits for the Bridge's per-launch
-runtime handshake file (`~/.aiwg/cockpit/runtime/bridge.json`) and opens a window
-at the Bridge UI with the resolved per-launch token on the query string.
+runtime handshake file (`~/.aiwg/cockpit/runtime/bridge.json`), exchanges the
+native credential for a one-time nonce, and opens the Bridge UI without a
+reusable credential in the URL.
 
 ## Architecture
 
@@ -14,7 +15,7 @@ operator/CLI: aiwg cockpit
       ▼
 Bridge (127.0.0.1:PORT, token-gated /api) ── proxies ──▶ agentic-sandbox executor
       ▲
-      │  loads http://127.0.0.1:PORT/?token=…
+      │  loads http://127.0.0.1:PORT/#bootstrap=…
 desktop window  (this app)   ◀── same UI ──▶   VS Code webview  /  browser
 ```
 

package/desktop/src-tauri/src/main.rs

@@ -2,13 +2,20 @@
 //
 // The desktop window hosts the SAME registry-bound Bridge UI as the VS Code shell
 // and the browser. It does not replace the CLI or reimplement the control plane:
-// it waits for the Bridge's per-launch runtime token file and opens a window at the
-// Bridge UI (token on the query string).
+// it waits for the Bridge runtime handshake, exchanges the native credential for
+// a one-time nonce, and opens a window without placing the credential in a URL.
 //
 // Build is toolchain-gated: requires the Rust toolchain + Tauri prerequisites
 // (on Linux, webkit2gtk + libsoup). Run `cargo tauri init` once to generate icons
 // and capabilities, then `cargo tauri build`. See README.md.
-use std::{fs, path::PathBuf, thread, time::Duration};
+use std::{
+    fs,
+    io::{Read, Write},
+    net::TcpStream,
+    path::PathBuf,
+    thread,
+    time::Duration,
+};
 use tauri::{WebviewUrl, WebviewWindowBuilder};
 
 fn runtime_file() -> PathBuf {
@@ -27,23 +34,53 @@ fn read_runtime() -> Option<(u16, String)> {
     Some((port, token))
 }
 
+fn issue_bootstrap_nonce(port: u16, token: &str) -> Option<String> {
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).ok()?;
+    stream.set_read_timeout(Some(Duration::from_secs(2))).ok()?;
+    let body = r#"{"audience":"tauri"}"#;
+    let request = format!(
+        "POST /bootstrap/nonce HTTP/1.1\r\nHost: 127.0.0.1:{port}\r\nAuthorization: Bearer {token}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+        body.len()
+    );
+    stream.write_all(request.as_bytes()).ok()?;
+    let mut response = String::new();
+    stream.read_to_string(&mut response).ok()?;
+    let (head, raw_body) = response.split_once("\r\n\r\n")?;
+    if !head.starts_with("HTTP/1.1 201 ") {
+        return None;
+    }
+    serde_json::from_str::<serde_json::Value>(raw_body)
+        .ok()?
+        .get("nonce")?
+        .as_str()
+        .map(ToOwned::to_owned)
+}
+
 fn main() {
     tauri::Builder::default()
         .setup(|app| {
             let handle = app.handle().clone();
             // Poll for the Bridge runtime file (operator/CLI launches `aiwg cockpit`),
-            // then open the window at the Bridge UI with the token.
+            // then exchange the native token for a one-time webview bootstrap.
             thread::spawn(move || {
                 for _ in 0..100 {
                     if let Some((port, token)) = read_runtime() {
-                        let url = format!("http://127.0.0.1:{port}/?token={token}");
-                        if let Ok(parsed) = url.parse() {
-                            let _ = WebviewWindowBuilder::new(&handle, "main", WebviewUrl::External(parsed))
+                        if let Some(nonce) = issue_bootstrap_nonce(port, &token) {
+                            let url = format!(
+                                "http://127.0.0.1:{port}/#bootstrap={nonce}&audience=tauri"
+                            );
+                            if let Ok(parsed) = url.parse() {
+                                let _ = WebviewWindowBuilder::new(
+                                    &handle,
+                                    "main",
+                                    WebviewUrl::External(parsed),
+                                )
                                 .title("AIWG Cockpit")
                                 .inner_size(1100.0, 760.0)
                                 .build();
+                            }
+                            return;
                         }
-                        return;
                     }
                     thread::sleep(Duration::from_millis(150));
                 }

package/desktop/src-tauri/tauri.conf.json

@@ -9,7 +9,7 @@
   "app": {
     "withGlobalTauri": false,
     "security": {
-      "csp": "default-src 'none'; frame-src http://127.0.0.1:* http://localhost:*; style-src 'unsafe-inline'"
+      "csp": "default-src 'none'; frame-src 'self'; style-src 'unsafe-inline'"
     }
   },
   "bundle": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cockpit",
-  "version": "2026.7.24",
+  "version": "2026.8.0",
   "description": "AIWG Cockpit — UX-first control plane over AIWG + multi-stack agentic sessions. Opt-in, separately published; NOT shipped in the base aiwg npm package (guarded by test/smoke/cockpit-base-footprint.test.js).",
   "type": "module",
   "license": "MIT",

package/runtime-docs/README.md

@@ -21,7 +21,9 @@ Every shell (browser, VS Code, Tauri) resolves the Bridge the same way — see
 1. read `bridge.json` → `{ token_ref, port }` or fallback `{ token, port }`
 2. resolve `token_ref` through `apps/cockpit/shell-core/keychain.mjs` when present
 3. wait for `http://127.0.0.1:<port>/healthz`
-4. load the UI at `http://127.0.0.1:<port>/?token=<token>`
+4. authenticate `POST /bootstrap/nonce` natively and load the UI with only the
+   returned one-time nonce in the URL fragment
+5. exchange the nonce for an HttpOnly `SameSite=Strict` browser session
 
 ## Security
 
@@ -35,8 +37,10 @@ Every shell (browser, VS Code, Tauri) resolves the Bridge the same way — see
   `AIWG_COCKPIT_KEYCHAIN_STRICT=1` to omit the inline token when keychain storage
   succeeds; set `AIWG_COCKPIT_REQUIRE_KEYCHAIN=1` to fail Bridge launch if no OS
   credential backend is usable.
-- `token` gates every `/api/*` call (constant-time bearer check); `tenant_id` elsewhere
-  is a **routing** token, never authentication.
+- The native `token` can authenticate non-browser `/api/*` calls and issue
+  one-time browser bootstraps. Browser REST, SSE, and PTY traffic use an
+  HttpOnly session; query-token authentication is not accepted. `tenant_id`
+  elsewhere is a **routing** token, never authentication.
 - Browser-origin `/api/*` calls are localhost-origin checked, and state-changing
   browser calls must include the CSRF double-submit header emitted by the web clients.
 

package/shell-core/runtime.mjs

@@ -1,9 +1,9 @@
 // Shell-core: the handshake every Cockpit shell (VS Code, Tauri, browser) shares.
 // The Bridge writes ~/.aiwg/cockpit/runtime/bridge.json (mode 600) on launch with
 // { token_ref, port } when OS-keychain storage is available, else { token, port }.
-// A shell resolves the token, waits for liveness, and loads the Bridge UI at
-// <url>/?token=<token>. Control plane is the gated Bridge API; data plane (pty) is
-// the executor URL the Bridge issues. This module is the one source of that contract.
+// A shell resolves the token, waits for liveness, then asks the Bridge for a
+// one-time bootstrap nonce. The reusable token stays in the native shell and
+// never enters the webview URL. This module is the one source of that contract.
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -40,9 +40,19 @@ export async function connect({ timeoutMs = 5000, file = RUNTIME_FILE } = {}) {
   }
 }
 
-/** The webview URL a shell loads — Bridge UI with the token on the query string. */
-export function webviewUrl(rt) {
-  return `${rt.url}/?token=${encodeURIComponent(rt.token)}`;
+/** Issue a short-lived, one-time browser bootstrap and place only that nonce in
+ * the URL fragment (fragments are not sent in HTTP requests or referrers). */
+export async function webviewUrl(rt, { audience = 'browser', next = '' } = {}) {
+  const response = await api(rt, '/bootstrap/nonce', {
+    method: 'POST',
+    body: JSON.stringify({ audience }),
+    headers: { 'content-type': 'application/json' },
+  });
+  if (!response.ok) throw new Error(`Bridge bootstrap refused (${response.status})`);
+  const { nonce } = await response.json();
+  if (!nonce) throw new Error('Bridge bootstrap returned no nonce');
+  const fragment = new URLSearchParams({ bootstrap: nonce, audience, ...(next ? { next } : {}) });
+  return `${rt.url}/#${fragment}`;
 }
 
 /** Authed fetch against the Bridge control surface, for shells that call the API directly. */

package/shell-core/smoke.mjs

@@ -29,7 +29,10 @@ try {
   const rt = await connect({ timeoutMs: 6000 });   // reads ~/.aiwg/cockpit/runtime/bridge.json + waits for /healthz
   assert.equal(rt.port, PORT, 'runtime port matches the launched Bridge');
   assert.ok(rt.token && rt.token.length >= 32, 'runtime carries a per-launch token');
-  assert.match(webviewUrl(rt), /\/\?token=/, 'webview url carries the token');
+  const launchUrl = await webviewUrl(rt, { audience: 'browser' });
+  assert.match(launchUrl, /\/#bootstrap=/, 'webview URL carries a one-time fragment bootstrap');
+  assert.ok(!launchUrl.includes(rt.token), 'webview URL does not carry the reusable token');
+  assert.ok(!launchUrl.includes('?token='), 'webview URL has no token query parameter');
 
   // the shell handshake: authed call succeeds, unauthed is gated
   assert.equal((await api(rt, '/api/health')).status, 200, 'authed /api/health 200');

package/vscode/README.md

@@ -8,7 +8,7 @@ contributed actions as command-palette entries. No build step (CommonJS
 
 | Command | Effect |
 |---|---|
-| **AIWG Cockpit: Open** | Opens the Cockpit UI in a webview (reads the Bridge runtime handshake, resolves the token, loads `http://127.0.0.1:PORT/?token=…`). |
+| **AIWG Cockpit: Open** | Opens the Cockpit UI in a webview after exchanging the native runtime credential for a one-time fragment bootstrap. |
 | **AIWG Cockpit: Audit Issues** | Opens Cockpit on the contributed Actions view; the action injects into an agentic session instead of running from the extension. |
 
 ## Run it
@@ -20,6 +20,9 @@ contributed actions as command-palette entries. No build step (CommonJS
 If the Bridge isn't running, the commands show a hint to start it — the shell
 never replaces the CLI; it fronts it.
 
+The wrapper CSP permits only the exact resolved Bridge origin and port. It
+does not allow arbitrary `localhost:*` or `127.0.0.1:*` frames.
+
 ## Settings
 
 - `aiwg-cockpit.bridgeRuntimeFile` — override the runtime file path (default `~/.aiwg/cockpit/runtime/bridge.json`).