@camerontaylor/paseo-client 0.9.0-beta.2.fork.1 → 0.10.1-fork.1

package/dist/connection/index.d.ts

@@ -22,6 +22,7 @@ export declare class ConnectionSubscriptions extends OwnedSubscriptions {
     };
 }
 export declare const DEFAULT_CLIENT_CAPABILITIES: {
+    hello_rejection: true;
     owned_subscriptions: true;
     all_providers: true;
     selective_agent_timeline: true;

package/dist/connection/index.js

@@ -90,6 +90,7 @@ export class ConnectionSubscriptions extends OwnedSubscriptions {
 // Protocol support belongs to the installed client. Only browser hosting needs
 // a resource supplied by the caller. Keep this exhaustive as the protocol evolves.
 export const DEFAULT_CLIENT_CAPABILITIES = {
+    [CLIENT_CAPS.helloRejection]: true,
     [CLIENT_CAPS.ownedSubscriptions]: true,
     [CLIENT_CAPS.allProviders]: true,
     [CLIENT_CAPS.selectiveAgentTimeline]: true,

package/dist/daemon-client-relay-e2ee-transport.d.ts

@@ -4,5 +4,6 @@ export declare function createRelayE2eeTransportFactory(args: {
     daemonPublicKeyB64: string;
     logger: TransportLogger;
 }): DaemonTransportFactory;
+export declare function createRelayTransportFactory(baseFactory: DaemonTransportFactory): DaemonTransportFactory;
 export declare function createEncryptedTransport(base: DaemonTransport, daemonPublicKeyB64: string, logger: TransportLogger): DaemonTransport;
 //# sourceMappingURL=daemon-client-relay-e2ee-transport.d.ts.map

package/dist/daemon-client-relay-e2ee-transport.js

@@ -1,11 +1,15 @@
 import { createClientChannel, } from "@camerontaylor/paseo-relay/e2ee";
 import { extractRelayMessage, normalizeTransportPayload } from "./daemon-client-transport-utils.js";
 export function createRelayE2eeTransportFactory(args) {
-    return ({ url, headers }) => {
-        const base = args.baseFactory({ url, headers });
+    return ({ url }) => {
+        const base = args.baseFactory({ url });
         return createEncryptedTransport(base, args.daemonPublicKeyB64, args.logger);
     };
 }
+export function createRelayTransportFactory(baseFactory) {
+    // The relay upgrade precedes E2EE. Only the encrypted hello may carry daemon credentials.
+    return ({ url }) => baseFactory({ url });
+}
 export function createEncryptedTransport(base, daemonPublicKeyB64, logger) {
     let channel = null;
     let opened = false;

package/dist/daemon-client-transport.d.ts

@@ -1,5 +1,5 @@
 export type { DaemonTransport, DaemonTransportFactory, TransportLogger, WebSocketFactory, WebSocketLike, } from "./daemon-client-transport-types.js";
 export { decodeMessageData, describeTransportClose, describeTransportError, encodeUtf8String, extractRelayMessage, normalizeTransportPayload, safeRandomId, } from "./daemon-client-transport-utils.js";
-export { createEncryptedTransport, createRelayE2eeTransportFactory, } from "./daemon-client-relay-e2ee-transport.js";
+export { createEncryptedTransport, createRelayE2eeTransportFactory, createRelayTransportFactory, } from "./daemon-client-relay-e2ee-transport.js";
 export { bindWsHandler, createWebSocketTransportFactory, defaultWebSocketFactory, } from "./daemon-client-websocket-transport.js";
 //# sourceMappingURL=daemon-client-transport.d.ts.map

package/dist/daemon-client-transport.js

@@ -1,4 +1,4 @@
 export { decodeMessageData, describeTransportClose, describeTransportError, encodeUtf8String, extractRelayMessage, normalizeTransportPayload, safeRandomId, } from "./daemon-client-transport-utils.js";
-export { createEncryptedTransport, createRelayE2eeTransportFactory, } from "./daemon-client-relay-e2ee-transport.js";
+export { createEncryptedTransport, createRelayE2eeTransportFactory, createRelayTransportFactory, } from "./daemon-client-relay-e2ee-transport.js";
 export { bindWsHandler, createWebSocketTransportFactory, defaultWebSocketFactory, } from "./daemon-client-websocket-transport.js";
 //# sourceMappingURL=daemon-client-transport.js.map

package/dist/daemon-client.d.ts

@@ -30,6 +30,12 @@ export type ImportAgentInput = (ImportAgentInputBase & {
     provider: AgentProvider;
     sessionId: string;
 });
+export type DaemonAuthFailureReason = "password_required" | "incorrect_password";
+export declare class DaemonAuthenticationError extends Error {
+    readonly reason: DaemonAuthFailureReason;
+    constructor(reason: DaemonAuthFailureReason);
+}
+export declare function getDaemonAuthFailureReason(error: unknown): DaemonAuthFailureReason | null;
 export type { DaemonTransport, DaemonTransportFactory, WebSocketFactory, WebSocketLike, } from "./daemon-client-transport.js";
 export type { TerminalStreamEvent };
 export type ConnectionState = {
@@ -114,6 +120,7 @@ export interface DaemonClientConfig {
     appVersion?: string;
     runtimeGeneration?: number | null;
     password?: string;
+    localCredential?: () => string | undefined | Promise<string | undefined>;
     authHeader?: string;
     suppressSendErrors?: boolean;
     transportFactory?: DaemonTransportFactory;
@@ -578,6 +585,7 @@ export declare class DaemonClient {
     private readonly providerSnapshotUpdates;
     private readonly owned;
     private transport;
+    private helloAuth;
     private transportCleanup;
     private rawMessageListeners;
     private messageHandlers;
@@ -594,6 +602,7 @@ export declare class DaemonClient {
     private connectResolve;
     private connectReject;
     private lastErrorValue;
+    private authFailureReasonValue;
     private connectionState;
     private readonly terminalStreams;
     private pendingBinaryFileReads;
@@ -616,6 +625,7 @@ export declare class DaemonClient {
     constructor(config: DaemonClientConfig);
     connect(): Promise<void>;
     private attemptConnect;
+    private assertEncryptedRelayAuth;
     private resolveConnect;
     private rejectConnect;
     close(): Promise<void>;
@@ -628,6 +638,7 @@ export declare class DaemonClient {
     get isConnected(): boolean;
     get isConnecting(): boolean;
     get lastError(): string | null;
+    get authFailureReason(): DaemonAuthFailureReason | null;
     getLastLivenessRttMs(): number | null;
     subscribe(handler: DaemonEventHandler): () => void;
     subscribeRawMessages(handler: (message: SessionOutboundMessage) => void): () => void;

package/dist/daemon-client.js

@@ -7,7 +7,7 @@ import { AgentCreateFailedStatusPayloadSchema, AgentCreatedStatusPayloadSchema,
 import { validateWSOutboundMessage } from "@camerontaylor/paseo-protocol/validation/ws-outbound";
 import { isRelayClientWebSocketUrl } from "@camerontaylor/paseo-protocol/daemon-endpoints";
 import { asUint8Array, decodeFileTransferFrame, encodeFileTransferFrame, decodeTerminalStreamFrame, FileTransferOpcode, TerminalStreamOpcode, } from "@camerontaylor/paseo-protocol/binary-frames/index";
-import { createRelayE2eeTransportFactory, createWebSocketTransportFactory, decodeMessageData, defaultWebSocketFactory, describeTransportClose, describeTransportError, } from "./daemon-client-transport.js";
+import { createRelayE2eeTransportFactory, createRelayTransportFactory, createWebSocketTransportFactory, decodeMessageData, defaultWebSocketFactory, describeTransportClose, describeTransportError, } from "./daemon-client-transport.js";
 import { DaemonClientRuntimeMetrics } from "./daemon-client-runtime-metrics.js";
 import { normalizeListProviderModelsPayload, normalizeProviderSnapshotUpdateMessage, normalizeProvidersSnapshotPayload, } from "./compat/normalize-provider-models.js";
 import { TerminalStreamRouter } from "./terminal-stream-router.js";
@@ -27,6 +27,55 @@ function normalizePassword(value) {
     }
     return value.length > 0 ? value : null;
 }
+function compatibleBearerPassword(password) {
+    return password && /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(password) ? password : null;
+}
+export class DaemonAuthenticationError extends Error {
+    constructor(reason) {
+        super(reason === "password_required" ? "Password required" : "Incorrect password");
+        this.name = "DaemonAuthenticationError";
+        this.reason = reason;
+    }
+}
+export function getDaemonAuthFailureReason(error) {
+    return error instanceof DaemonAuthenticationError ? error.reason : null;
+}
+function authFailureFromLegacyClose(event) {
+    if (!event || typeof event !== "object" || !("reason" in event))
+        return null;
+    if (event.reason === "Password required")
+        return "password_required";
+    if (event.reason === "Incorrect password")
+        return "incorrect_password";
+    return null;
+}
+function chooseConnectionAuth(config, localCredential) {
+    const password = normalizePassword(config.password);
+    let helloAuth;
+    if (localCredential)
+        helloAuth = { kind: "localCredential", token: localCredential };
+    else if (password)
+        helloAuth = { kind: "password", password };
+    const headers = {};
+    const compatibleBearer = localCredential ? null : compatibleBearerPassword(password);
+    // COMPAT(headerAuth): added in v0.9.1, remove after 2027-03-24.
+    if (compatibleBearer)
+        headers.Authorization = `Bearer ${compatibleBearer}`;
+    else if (!localCredential && config.authHeader)
+        headers.Authorization = config.authHeader;
+    return {
+        helloAuth,
+        headers,
+        ...(compatibleBearer ? { protocols: [`paseo.bearer.${compatibleBearer}`] } : {}),
+    };
+}
+function resolveConnectionAuth(config) {
+    const resolution = config.localCredential?.();
+    if (resolution instanceof Promise) {
+        return resolution.then((credential) => chooseConnectionAuth(config, credential));
+    }
+    return chooseConnectionAuth(config, resolution);
+}
 function extractCorrelatedResponseIdentity(input) {
     if (!input || typeof input !== "object") {
         return null;
@@ -279,6 +328,7 @@ export class DaemonClient {
         this.connectResolve = null;
         this.connectReject = null;
         this.lastErrorValue = null;
+        this.authFailureReasonValue = null;
         this.connectionState = { status: "idle" };
         this.terminalStreams = new TerminalStreamRouter();
         this.pendingBinaryFileReads = new Map();
@@ -393,7 +443,7 @@ export class DaemonClient {
         });
         return this.connectPromise;
     }
-    attemptConnect() {
+    async attemptConnect() {
         if (this.connectionState.status === "disposed") {
             this.rejectConnect(new Error("Daemon client is disposed"));
             return;
@@ -411,30 +461,30 @@ export class DaemonClient {
             clearTimeout(this.reconnectTimeout);
             this.reconnectTimeout = null;
         }
-        const headers = {};
-        const password = normalizePassword(this.config.password);
-        if (password) {
-            headers.Authorization = `Bearer ${password}`;
-        }
-        else if (this.config.authHeader) {
-            headers.Authorization = this.config.authHeader;
-        }
-        const protocols = password ? [`paseo.bearer.${password}`] : undefined;
         try {
+            const resolution = resolveConnectionAuth(this.config);
+            const selected = resolution instanceof Promise ? await resolution : resolution;
+            if (!this.shouldReconnect)
+                return;
+            this.helloAuth = selected.helloAuth;
             // Reconnect can overlap with browser close/error delivery ordering.
             // Always dispose previous transport before constructing the next one.
             this.disposeTransport();
             const baseTransportFactory = this.config.transportFactory ??
                 createWebSocketTransportFactory(this.config.webSocketFactory ?? defaultWebSocketFactory);
-            const shouldUseRelayE2ee = this.config.e2ee?.enabled === true && isRelayClientWebSocketUrl(this.config.url);
-            let transportFactory = baseTransportFactory;
+            const isRelayTransport = isRelayClientWebSocketUrl(this.config.url);
+            const shouldUseRelayE2ee = this.config.e2ee?.enabled === true && isRelayTransport;
+            this.assertEncryptedRelayAuth(selected.helloAuth, isRelayTransport);
+            let transportFactory = isRelayTransport
+                ? createRelayTransportFactory(baseTransportFactory)
+                : baseTransportFactory;
             if (shouldUseRelayE2ee) {
                 const daemonPublicKeyB64 = this.config.e2ee?.daemonPublicKeyB64;
                 if (!daemonPublicKeyB64) {
                     throw new Error("daemonPublicKeyB64 is required for relay E2EE");
                 }
                 transportFactory = createRelayE2eeTransportFactory({
-                    baseFactory: baseTransportFactory,
+                    baseFactory: transportFactory,
                     daemonPublicKeyB64,
                     logger: this.logger,
                 });
@@ -442,11 +492,12 @@ export class DaemonClient {
             const transportUrl = this.resolveTransportUrlForAttempt();
             const transport = transportFactory({
                 url: transportUrl,
-                headers,
-                ...(protocols ? { protocols } : {}),
+                headers: selected.headers,
+                ...(selected.protocols ? { protocols: selected.protocols } : {}),
             });
             this.transport = transport;
             this.lastServerInfoMessage = null;
+            this.authFailureReasonValue = null;
             this.updateConnectionState({
                 status: "connecting",
                 attempt: this.reconnectAttempt,
@@ -472,7 +523,7 @@ export class DaemonClient {
                         this.pendingGenericTransportErrorTimeout = null;
                     }
                     this.lastErrorValue = null;
-                    this.sendHelloMessage();
+                    void this.sendHelloMessage();
                 }),
                 transport.onClose((event) => {
                     this.resetConnectTimeout();
@@ -480,7 +531,10 @@ export class DaemonClient {
                         clearTimeout(this.pendingGenericTransportErrorTimeout);
                         this.pendingGenericTransportErrorTimeout = null;
                     }
-                    const reason = describeTransportClose(event);
+                    this.authFailureReasonValue ?? (this.authFailureReasonValue = authFailureFromLegacyClose(event));
+                    const reason = this.authFailureReasonValue
+                        ? new DaemonAuthenticationError(this.authFailureReasonValue).message
+                        : describeTransportClose(event);
                     if (reason) {
                         this.lastErrorValue = reason;
                     }
@@ -544,6 +598,12 @@ export class DaemonClient {
             this.rejectConnect(error instanceof Error ? error : new Error(message));
         }
     }
+    assertEncryptedRelayAuth(helloAuth, isRelayTransport) {
+        if (!isRelayTransport || !helloAuth || this.config.e2ee?.enabled === true)
+            return;
+        this.setReconnectEnabled(false);
+        throw new Error("Relay credentials require E2EE");
+    }
     resolveConnect() {
         if (this.connectResolve) {
             this.connectResolve();
@@ -653,6 +713,9 @@ export class DaemonClient {
     get lastError() {
         return this.lastErrorValue;
     }
+    get authFailureReason() {
+        return this.authFailureReasonValue;
+    }
     getLastLivenessRttMs() {
         return this.lastLivenessRttMs;
     }
@@ -4174,8 +4237,9 @@ export class DaemonClient {
     resolveTransportUrlForAttempt() {
         return this.config.url;
     }
-    sendHelloMessage() {
-        if (!this.transport) {
+    async sendHelloMessage() {
+        const transport = this.transport;
+        if (!transport) {
             this.scheduleReconnect({
                 reason: "Transport unavailable before hello",
                 event: "HELLO_TRANSPORT_MISSING",
@@ -4184,11 +4248,15 @@ export class DaemonClient {
             return;
         }
         try {
+            if (this.transport !== transport)
+                return;
+            const auth = this.helloAuth;
             this.sendJsonMessage("hello", "hello", {
                 type: "hello",
                 clientId: this.config.clientId,
                 clientType: this.config.clientType ?? "cli",
                 protocolVersion: 1,
+                ...(auth ? { auth } : {}),
                 capabilities: {
                     ...DEFAULT_CLIENT_CAPABILITIES,
                     // COMPAT(sideConversations): added in 0.7.0-beta.2.fork.1, fork-only.
@@ -4322,6 +4390,17 @@ export class DaemonClient {
             this.runtimeMetrics?.recordMessage("pong", bytes, perfNow() - startMs);
             return;
         }
+        if (parsed.data.type === "hello.rejected") {
+            const reasonMessage = {
+                password_required: "Password required",
+                incorrect_password: "Incorrect password",
+                incompatible_protocol: "Incompatible protocol version",
+            };
+            this.lastErrorValue = reasonMessage[parsed.data.reason];
+            this.authFailureReasonValue =
+                parsed.data.reason === "incompatible_protocol" ? null : parsed.data.reason;
+            return;
+        }
         this.traceInstant("paseo.ws.message.inbound", {
             envelopeType: "session",
             messageType: parsed.data.message.type,
@@ -4494,13 +4573,17 @@ export class DaemonClient {
         this.rejectPingProbe(new DaemonConnectionError(reason ?? "Connection lost"));
         this.terminalStreams.clearSlots();
         this.lastServerInfoMessage = null;
+        if (this.authFailureReasonValue)
+            this.setReconnectEnabled(false);
         if (wasDisposed) {
             this.rejectConnect(new Error(reason ?? "Daemon client is disposed"));
             return;
         }
         this.emitDisconnectedStateForReconnect(reason, input);
         if (!this.shouldReconnect || this.config.reconnect?.enabled === false) {
-            this.rejectConnect(new Error(reason ?? "Transport disconnected before connect"));
+            this.rejectConnect(this.authFailureReasonValue
+                ? new DaemonAuthenticationError(this.authFailureReasonValue)
+                : new Error(reason ?? "Transport disconnected before connect"));
             return;
         }
         this.armReconnectTimer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camerontaylor/paseo-client",
-  "version": "0.9.0-beta.2.fork.1",
+  "version": "0.10.1-fork.1",
   "description": "Paseo client SDK package",
   "files": [
     "dist",
@@ -39,8 +39,8 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@camerontaylor/paseo-protocol": "0.9.0-beta.2.fork.1",
-    "@camerontaylor/paseo-relay": "0.9.0-beta.2.fork.1",
+    "@camerontaylor/paseo-protocol": "0.10.1-fork.1",
+    "@camerontaylor/paseo-relay": "0.10.1-fork.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {