@code-partner/codepipe-hub 0.14.1-dev.422.gf90f06c4 → 0.14.1-dev.423.ga49d1f61

package/hub/dist/embedded.js

@@ -457,7 +457,7 @@ var PLATFORM_VERSION;
 var init_version_generated = __esm({
   "../packages/shared/dist/version.generated.js"() {
     "use strict";
-    PLATFORM_VERSION = "0.14.1-dev.422.gf90f06c4";
+    PLATFORM_VERSION = "0.14.1-dev.423.ga49d1f61";
   }
 });
 
@@ -467,7 +467,7 @@ var init_version = __esm({
   "../packages/shared/dist/version.js"() {
     "use strict";
     init_version_generated();
-    PROTOCOL_VERSION = 4;
+    PROTOCOL_VERSION = 5;
   }
 });
 
@@ -4983,6 +4983,8 @@ function createCommandOperations(deps) {
         throw errors.unprocessable({ details: { reason: outcome.reason } });
       case "not_found":
         throw errors.notFound();
+      case "rate_limited":
+        throw errors.rateLimited();
     }
   }
   function accountActorOf(actor) {
@@ -5572,6 +5574,14 @@ function createCommandOperations(deps) {
         return { value: run.result, replayed: run.replayed };
       });
     },
+    async issueWorkerRegistrationToken(actor) {
+      const subjectId = actor.principal.subjectId;
+      return await audited(actor, { operationId: "worker.issueRegistrationToken", aggregateType: "account", aggregateId: subjectId, projectId: null }, async (policy) => {
+        await require2(actor, "account.manage", { type: "account" }, policy);
+        const issued = unwrap(await write2.issueWorkerRegistrationToken({ owner: accountActorOf(actor) }));
+        return { value: { secret: issued.secret, expiresAt: toTimestamp(issued.expiresAt) }, replayed: false };
+      });
+    },
     async reportInitStatus(actor, command) {
       const { projectId, phase } = command;
       return await audited(actor, { operationId: "project.reportInitStatus", aggregateType: "project", aggregateId: projectId, projectId, data: { phase, failed: command.error !== void 0 } }, async (policy) => {
@@ -10972,7 +10982,20 @@ var init_auth = __esm({
 });
 
 // src/sandbox-reg-tokens.ts
+import { createHash as createHash2 } from "node:crypto";
 import { nanoid as nanoid7 } from "nanoid";
+function hashSandboxRegToken(secret) {
+  return createHash2("sha256").update(secret, "utf8").digest("hex");
+}
+async function issueEphemeralSandboxRegToken(db, email, ttlMs = EPHEMERAL_REG_TOKEN_TTL_MS) {
+  const normalized = email.trim().toLowerCase();
+  const secret = `sbxreg_${nanoid7(48)}`;
+  const now = Date.now();
+  const expiresAt = now + ttlMs;
+  await db.run(`INSERT INTO sandbox_reg_tokens (token_hash, email, user_id, created_at, expires_at)
+     VALUES (?, ?, (SELECT id FROM users WHERE email = ?), ?, ?)`, hashSandboxRegToken(secret), normalized, normalized, now, expiresAt);
+  return { secret, expiresAt };
+}
 var EPHEMERAL_REG_TOKEN_TTL_MS;
 var init_sandbox_reg_tokens = __esm({
   "src/sandbox-reg-tokens.ts"() {
@@ -11268,6 +11291,25 @@ var init_state_machine2 = __esm({
 });
 
 // src/abuse-throttle.ts
+function createAbuseThrottle(opts) {
+  const hits = /* @__PURE__ */ new Map();
+  return {
+    take(key) {
+      const now = Date.now();
+      const entry = hits.get(key);
+      if (!entry || entry.resetAt <= now) {
+        hits.set(key, { count: 1, resetAt: now + opts.windowMs });
+        return true;
+      }
+      if (entry.count >= opts.max) return false;
+      entry.count += 1;
+      return true;
+    },
+    reset() {
+      hits.clear();
+    }
+  };
+}
 var init_abuse_throttle = __esm({
   "src/abuse-throttle.ts"() {
     "use strict";
@@ -11298,11 +11340,11 @@ var init_sandbox2 = __esm({
     init_sealedbox();
     init_abuse_throttle();
     init_auth();
-    init_cli_auth();
     init_sandbox_reg_tokens();
     init_users();
     init_agent_auth_probe();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -11357,6 +11399,7 @@ var init_farm2 = __esm({
     init_sealedbox();
     init_abuse_throttle();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -11389,6 +11432,7 @@ var init_runner2 = __esm({
     init_users();
     init_runner_reg_tokens();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -12367,10 +12411,10 @@ __export(regimen_config_exports, {
   loadWorkflowSettings: () => loadWorkflowSettings,
   loadYouTrackWrites: () => loadYouTrackWrites
 });
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { parse as parseYaml2 } from "yaml";
 function contentSha2(content) {
-  return createHash2("sha1").update(content, "utf-8").digest("hex");
+  return createHash3("sha1").update(content, "utf-8").digest("hex");
 }
 async function applyRegimenContent(db, projectId, content, log, preParsed) {
   const previous = cache3.get(projectId) ?? null;
@@ -19186,9 +19230,9 @@ var init_cluster_order = __esm({
 });
 
 // src/prompts/prompt-cache.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function contentSha3(content) {
-  return createHash3("sha1").update(content, "utf-8").digest("hex");
+  return createHash4("sha1").update(content, "utf-8").digest("hex");
 }
 function getProjectPromptTemplate(projectId, role) {
   return cache4.get(projectId)?.get(role)?.content ?? null;
@@ -22786,7 +22830,7 @@ __export(lifecycle_exports, {
   taskRunsDirectImplement: () => taskRunsDirectImplement,
   triggerRework: () => triggerRework
 });
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 async function reconcileStuckTasks(db, log) {
   let recovered = 0;
   for (const task of await listTasks(db)) {
@@ -23381,7 +23425,7 @@ async function maybeAwaitingAnswer(db, task, log, blockingQuestions = []) {
   if (blocking.length === 0) return false;
   const now = Date.now();
   for (let i = 0; i < blocking.length; i++) {
-    const digest2 = createHash4("sha256").update(blocking[i]).digest("hex").slice(0, 12);
+    const digest2 = createHash5("sha256").update(blocking[i]).digest("hex").slice(0, 12);
     await ingestComment(db, {
       taskId: task.id,
       trackerCommentId: `agent:${task.phase.toLowerCase()}:${i}:${digest2}`,
@@ -28487,6 +28531,8 @@ function requestGhRunnersDelete(runnerId, projectId, sealedBundle, timeoutMs) {
 init_farm2();
 init_runner2();
 init_init_status();
+init_sandbox_reg_tokens();
+init_abuse_throttle();
 
 // src/projects/forget.ts
 init_legacy_cred_bundles();
@@ -28675,6 +28721,7 @@ function nodeUnavailable(capability, err) {
 function taskState(row) {
   return { ...row, revision: String(row.updatedAt) };
 }
+var WORKER_REG_TOKEN_MINTS = createAbuseThrottle({ windowMs: 60 * 6e4, max: 30 });
 function createWriteModel(db, log, hooks = {}) {
   async function readTaskRow(projectId, key) {
     const row = await db.get(
@@ -29357,6 +29404,16 @@ function createWriteModel(db, log, hooks = {}) {
       log.info({ projectId, jobId, kind }, kind === "backfill" ? "backfill job enqueued" : "index job enqueued");
       return ok({ jobId });
     },
+    async issueWorkerRegistrationToken({ owner }) {
+      if (owner.email === null) return { ok: false, refusal: "unprocessable", reason: "account_has_no_email" };
+      if (!WORKER_REG_TOKEN_MINTS.take(`email:${owner.email}`)) {
+        log.warn({ email: owner.email }, "ephemeral sandbox reg token mint throttled");
+        return { ok: false, refusal: "rate_limited" };
+      }
+      const issued = await issueEphemeralSandboxRegToken(db, owner.email);
+      log.info({ email: owner.email }, "ephemeral sandbox reg token issued for a client");
+      return ok(issued);
+    },
     async reportInitStatus({ projectId, phase, error }) {
       const recorded = await advanceInitPhase(db, projectId, phase);
       if (error !== null) {

package/hub/dist/index.js

@@ -13,7 +13,7 @@ var PLATFORM_VERSION;
 var init_version_generated = __esm({
   "../packages/shared/dist/version.generated.js"() {
     "use strict";
-    PLATFORM_VERSION = "0.14.1-dev.422.gf90f06c4";
+    PLATFORM_VERSION = "0.14.1-dev.423.ga49d1f61";
   }
 });
 
@@ -31,8 +31,8 @@ var init_version = __esm({
   "../packages/shared/dist/version.js"() {
     "use strict";
     init_version_generated();
-    PROTOCOL_VERSION = 4;
-    MIN_SUPPORTED_PROTOCOL = 4;
+    PROTOCOL_VERSION = 5;
+    MIN_SUPPORTED_PROTOCOL = 5;
   }
 });
 
@@ -2960,21 +2960,14 @@ var init_duration = __esm({
 });
 
 // ../packages/shared/dist/node-handshake.js
-function readNodeSocketSecrets(headers, query) {
-  const found = [];
+function readNodeSocketSecret(headers) {
   const raw = headers["authorization"];
   const header = Array.isArray(raw) ? raw[0] : raw;
-  if (typeof header === "string") {
-    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-    const token = match?.[1]?.trim();
-    if (token !== void 0 && token !== "")
-      found.push({ token, source: "header" });
-  }
-  const fromQuery = query?.token;
-  if (typeof fromQuery === "string" && fromQuery !== "") {
-    found.push({ token: fromQuery, source: "query" });
-  }
-  return found;
+  if (typeof header !== "string")
+    return null;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  const token = match?.[1]?.trim();
+  return token !== void 0 && token !== "" ? token : null;
 }
 function decideNodeHandshake(frame, hub, recognizedCapabilities, authenticatedAs) {
   const handshake = parseNodeHandshake(frame);
@@ -8716,7 +8709,12 @@ var init_route_definition = __esm({
       "bootstrap.request",
       "bootstrap.confirm",
       "bootstrap.authorizeEmail",
-      "bootstrap.authorizeConfirm"
+      "bootstrap.authorizeConfirm",
+      // DEV-927: a node registers with a registration token in the body — the
+      // token IS the credential, and there is no node identity yet to bear it.
+      "node.sandbox.register",
+      "node.farm.register",
+      "node.runner.register"
     ];
   }
 });
@@ -12239,6 +12237,8 @@ function createCommandOperations(deps) {
         throw errors.unprocessable({ details: { reason: outcome.reason } });
       case "not_found":
         throw errors.notFound();
+      case "rate_limited":
+        throw errors.rateLimited();
     }
   }
   function accountActorOf(actor) {
@@ -12828,6 +12828,14 @@ function createCommandOperations(deps) {
         return { value: run.result, replayed: run.replayed };
       });
     },
+    async issueWorkerRegistrationToken(actor) {
+      const subjectId = actor.principal.subjectId;
+      return await audited(actor, { operationId: "worker.issueRegistrationToken", aggregateType: "account", aggregateId: subjectId, projectId: null }, async (policy) => {
+        await require2(actor, "account.manage", { type: "account" }, policy);
+        const issued = unwrap(await write2.issueWorkerRegistrationToken({ owner: accountActorOf(actor) }));
+        return { value: { secret: issued.secret, expiresAt: toTimestamp(issued.expiresAt) }, replayed: false };
+      });
+    },
     async reportInitStatus(actor, command) {
       const { projectId, phase } = command;
       return await audited(actor, { operationId: "project.reportInitStatus", aggregateType: "project", aggregateId: projectId, projectId, data: { phase, failed: command.error !== void 0 } }, async (policy) => {
@@ -13125,8 +13133,8 @@ var init_cutover_preflight = __esm({
     SECRET_CONSUMERS = [
       { consumer: "agent credential in the job bundle (Claude / Codex)", purpose: "agent_execution", implemented: true, note: "issued per job from the project's auth mode" },
       { consumer: "repository clone tokens in the job bundle (GitHub / GitLab / Bitbucket)", purpose: "repository_read", implemented: true, note: "one grant for each host the job clones" },
-      { consumer: "Context Repo push of the delivery from the SANDBOX (contextWrite)", purpose: "context_write", implemented: false, note: "open: the delivery has to reach the holder of the materializer role without a write credential on the SANDBOX \u2014 the transport is an owner's decision" },
-      { consumer: "mirror clone token in the job bundle (mirrorWrite, read use)", purpose: "repository_read", implemented: false, note: "open: a read grant under the mirror's host, issued with the delivery transport" },
+      { consumer: "Context Repo push of the delivery from the SANDBOX (contextWrite)", purpose: "context_write", implemented: true, note: "the SANDBOX publishes the delivery over the host-local relay and the holder of the materializer role pushes it; no write credential on the SANDBOX" },
+      { consumer: "mirror clone token in the job bundle (mirrorWrite, read use)", purpose: "repository_read", implemented: true, note: "a read grant under the mirror's host, issued by the holder of the role with the other repository grants" },
       { consumer: "tracker writes (YouTrack) \u2014 CLI-side, never on the SANDBOX", purpose: "tracker_write", implemented: true, note: "nothing to move: the holder of the role already writes" },
       { consumer: "named project secrets in custom-action runs \u2014 CLI-side", purpose: "custom_action", implemented: true, note: "nothing to move until a tool-run executes on the SANDBOX" }
     ];
@@ -25805,10 +25813,16 @@ async function deleteSandboxRegistration(db, sandboxId) {
 async function sandboxRoutes(app, deps) {
   const { db, config } = deps;
   const registerByIp = createAbuseThrottle({ windowMs: 15 * 6e4, max: 30 });
-  const regTokenMintByEmail = createAbuseThrottle({ windowMs: 60 * 6e4, max: 30 });
   app.post(
-    "/sandbox/register",
+    "/node/v1/sandbox/register",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.sandbox.register",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Register a SANDBOX with a registration token"
+      }),
       schema: {
         body: {
           type: "object",
@@ -25849,14 +25863,29 @@ async function sandboxRoutes(app, deps) {
       return { sandboxId: id, token };
     }
   );
-  app.get("/sandbox/me", async (req, reply) => {
+  app.get("/node/v1/sandbox/me", routeMeta({
+    surface: "node",
+    operationId: "node.sandbox.me",
+    authPolicy: "node_actor",
+    resourcePolicy: "node.connect",
+    stability: "preview",
+    summary: "Is this SANDBOX registration still known"
+  }), async (req, reply) => {
     const sandbox = await authenticateSandboxByBearer(db, req.headers.authorization);
     if (!sandbox) return reply.status(401).send({ error: "unauthorized" });
     return { sandboxId: sandbox.id, name: sandbox.name };
   });
   app.post(
-    "/sandbox/agent-auth",
+    "/node/v1/sandbox/agent-auth",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.sandbox.agentAuth",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Report the host's agent login and ask whether to probe it"
+      }),
       schema: {
         body: {
           type: "object",
@@ -25892,8 +25921,16 @@ async function sandboxRoutes(app, deps) {
     }
   );
   app.post(
-    "/sandbox/agent-auth/result",
+    "/node/v1/sandbox/agent-auth/result",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.sandbox.agentAuthResult",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Report the verdict of an agent login probe"
+      }),
       schema: {
         body: {
           type: "object",
@@ -25943,19 +25980,6 @@ async function sandboxRoutes(app, deps) {
     app.log.info({ email: session.email, revoked }, "sandbox reg token revoked");
     return { revoked };
   });
-  app.post("/sandbox/reg-token/cli", async (req, reply) => {
-    const auth = await resolveCliAuth(db, config, req.headers.authorization);
-    if (!auth) {
-      return reply.status(401).send({ error: "bad_cli_token" });
-    }
-    if (!regTokenMintByEmail.take(`email:${auth.email}`)) {
-      app.log.warn({ email: auth.email }, "ephemeral sandbox reg token mint throttled");
-      return reply.status(429).send({ error: "too_many_requests" });
-    }
-    const { secret, expiresAt } = await issueEphemeralSandboxRegToken(db, auth.email);
-    app.log.info({ email: auth.email }, "ephemeral sandbox reg token issued for CLI");
-    return { secret, expiresAt };
-  });
   app.delete(
     "/sandbox/:sandboxId",
     async (req, reply) => {
@@ -25992,11 +26016,11 @@ var init_sandbox2 = __esm({
     init_sealedbox();
     init_abuse_throttle();
     init_auth();
-    init_cli_auth();
     init_sandbox_reg_tokens();
     init_users();
     init_agent_auth_probe();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -26060,8 +26084,15 @@ async function farmRoutes(app, deps) {
   const { db, config } = deps;
   const registerByIp = createAbuseThrottle({ windowMs: 15 * 6e4, max: 10 });
   app.post(
-    "/farm/register",
+    "/node/v1/farm/register",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.farm.register",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Register a FARM with the operator's registration token"
+      }),
       schema: {
         body: {
           type: "object",
@@ -26140,6 +26171,7 @@ var init_farm2 = __esm({
     init_sealedbox();
     init_abuse_throttle();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -26241,8 +26273,15 @@ async function runnerRoutes(app, deps) {
   const { db, config } = deps;
   const registerByIp = createAbuseThrottle({ windowMs: 15 * 6e4, max: 10 });
   app.post(
-    "/runner/register",
+    "/node/v1/runner/register",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.runner.register",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Register a RUNNER host with a personal registration token"
+      }),
       schema: {
         body: {
           type: "object",
@@ -26345,6 +26384,7 @@ var init_runner2 = __esm({
     init_users();
     init_runner_reg_tokens();
     init_ws();
+    init_route_registry();
   }
 });
 
@@ -27524,23 +27564,11 @@ function installSocketKeepalive(socket, periodMs) {
 }
 async function wsRoutes(app, deps) {
   const { db, config } = deps;
-  async function authenticateSocket(req, component, resolve4) {
-    for (const secret of readNodeSocketSecrets(req.headers, req.query)) {
-      const resolved = await resolve4(secret.token);
-      if (resolved === null || resolved === void 0) continue;
-      if (secret.source === "query") warnAboutQueryCredential(component, req.ip ?? null);
-      return resolved;
-    }
-    return null;
-  }
-  const warnedComponents = /* @__PURE__ */ new Set();
-  function warnAboutQueryCredential(component, remote) {
-    if (warnedComponents.has(component)) return;
-    warnedComponents.add(component);
-    app.log.warn(
-      { component, remote },
-      "node socket authenticated from the query string \u2014 the credential lands in proxy logs; update the component to send it in the Authorization header (this is logged once)"
-    );
+  async function authenticateSocket(req, resolve4) {
+    const token = readNodeSocketSecret(req.headers);
+    if (token === null) return null;
+    const resolved = await resolve4(token);
+    return resolved === null || resolved === void 0 ? null : resolved;
   }
   const cliSocket = async (socket, req) => {
     let boundProjectId = null;
@@ -27877,7 +27905,7 @@ async function wsRoutes(app, deps) {
         app.log.info({ remote: req.ip }, "CLI socket closed (never registered)");
       }
     });
-    auth = await authenticateSocket(req, "cli", (token) => authFromSecret(db, config, token));
+    auth = await authenticateSocket(req, (token) => authFromSecret(db, config, token));
     if (!auth) {
       socket.close(1008, "unauthorized");
       return;
@@ -27895,7 +27923,7 @@ async function wsRoutes(app, deps) {
     void pump();
   };
   const sandboxSocket = async (socket, req) => {
-    const sandbox = await authenticateSocket(req, "sandbox", (token) => findSandboxByToken(db, token));
+    const sandbox = await authenticateSocket(req, (token) => findSandboxByToken(db, token));
     if (!sandbox) {
       socket.close(1008, "unauthorized");
       return;
@@ -28013,7 +28041,7 @@ async function wsRoutes(app, deps) {
     });
   };
   const farmSocket = async (socket, req) => {
-    const farm = await authenticateSocket(req, "farm", (token) => findFarmByToken(db, token));
+    const farm = await authenticateSocket(req, (token) => findFarmByToken(db, token));
     if (!farm) {
       socket.close(1008, "unauthorized");
       return;
@@ -28105,7 +28133,7 @@ async function wsRoutes(app, deps) {
     });
   };
   const runnerSocket = async (socket, req) => {
-    const runner = await authenticateSocket(req, "runner", (token) => findRunnerByToken(db, token));
+    const runner = await authenticateSocket(req, (token) => findRunnerByToken(db, token));
     if (!runner) {
       socket.close(1008, "unauthorized");
       return;
@@ -28237,10 +28265,12 @@ async function wsRoutes(app, deps) {
         }
         const auth = parseNodeAuth(parsed);
         if (auth !== null) {
-          if (auth.component !== component || !await authenticate({ ...req, headers: { authorization: `Bearer ${auth.token}` } })) {
+          const withFrameCredential = { ...req, headers: { ...req.headers, authorization: `Bearer ${auth.token}` } };
+          if (auth.component !== component || !await authenticate(withFrameCredential)) {
             refuse("unauthenticated");
             return;
           }
+          effectiveReq = withFrameCredential;
           authenticated = true;
           return;
         }
@@ -28277,7 +28307,7 @@ async function wsRoutes(app, deps) {
         socket.off("message", listener);
         socket.pause();
         try {
-          await inner(socket, req);
+          await inner(socket, effectiveReq);
         } catch (err) {
           app.log.error({ err, component }, "node socket handler failed after handshake");
           socket.close(1011, "handler_failed");
@@ -28288,6 +28318,7 @@ async function wsRoutes(app, deps) {
         socket.resume();
       };
       let authenticated = false;
+      let effectiveReq = req;
       const ready = authenticate(req).then((ok2) => {
         authenticated = ok2;
       });
@@ -28321,7 +28352,6 @@ async function wsRoutes(app, deps) {
       });
     }
   }
-  app.get("/cli/connect", { websocket: true }, cliSocket);
   app.get(
     "/node/v1/cli/connect",
     {
@@ -28335,9 +28365,8 @@ async function wsRoutes(app, deps) {
         summary: "Control socket of a CLI instance"
       })
     },
-    withNodeHandshake("cli", async (r) => await authenticateSocket(r, "cli", (token) => authFromSecret(db, config, token)) !== null, cliSocket)
+    withNodeHandshake("cli", async (r) => await authenticateSocket(r, (token) => authFromSecret(db, config, token)) !== null, cliSocket)
   );
-  app.get("/sandbox/connect", { websocket: true }, sandboxSocket);
   app.get(
     "/node/v1/sandbox/connect",
     {
@@ -28351,9 +28380,8 @@ async function wsRoutes(app, deps) {
         summary: "Control socket of a SANDBOX instance"
       })
     },
-    withNodeHandshake("sandbox", async (r) => await authenticateSocket(r, "sandbox", (token) => findSandboxByToken(db, token)) !== null, sandboxSocket)
+    withNodeHandshake("sandbox", async (r) => await authenticateSocket(r, (token) => findSandboxByToken(db, token)) !== null, sandboxSocket)
   );
-  app.get("/farm/connect", { websocket: true }, farmSocket);
   app.get(
     "/node/v1/farm/connect",
     {
@@ -28367,9 +28395,8 @@ async function wsRoutes(app, deps) {
         summary: "Control socket of a FARM instance"
       })
     },
-    withNodeHandshake("farm", async (r) => await authenticateSocket(r, "farm", (token) => findFarmByToken(db, token)) !== null, farmSocket)
+    withNodeHandshake("farm", async (r) => await authenticateSocket(r, (token) => findFarmByToken(db, token)) !== null, farmSocket)
   );
-  app.get("/runner/connect", { websocket: true }, runnerSocket);
   app.get(
     "/node/v1/runner/connect",
     {
@@ -28383,7 +28410,7 @@ async function wsRoutes(app, deps) {
         summary: "Control socket of a RUNNER instance"
       })
     },
-    withNodeHandshake("runner", async (r) => await authenticateSocket(r, "runner", (token) => findRunnerByToken(db, token)) !== null, runnerSocket)
+    withNodeHandshake("runner", async (r) => await authenticateSocket(r, (token) => findRunnerByToken(db, token)) !== null, runnerSocket)
   );
 }
 var agentLoginProviders, deliveryFollowers, projectCliConnections, projectLastSeenAt, projectLastDuplicateRegisterAt, sandboxConnections, farmConnections, runnerConnections, cliMessageHandlers, cliRegisterHandlers, cliDisconnectHandlers, farmMessageHandlers, runnerMessageHandlers, providerMessageHandlers, RECOGNIZED_NODE_CAPABILITIES, NODE_HANDSHAKE_BACKLOG, NODE_HANDSHAKE_TIMEOUT_MS;
@@ -28978,9 +29005,22 @@ var RETIRED_SOCKET_PATHS = [
   "/farm/connect",
   "/runner/connect"
 ];
+var RETIRED_NODE_PATHS = [
+  "/jobs/claim",
+  "/jobs/heartbeat",
+  "/jobs/release",
+  "/jobs/result",
+  "/sandbox/register",
+  "/sandbox/me",
+  "/sandbox/agent-auth",
+  "/sandbox/agent-auth/result",
+  "/sandbox/reg-token/cli",
+  "/farm/register",
+  "/runner/register"
+];
 function isRetiredClientPath(url, registeredPaths = []) {
   const path = url.split("?")[0].split("#")[0];
-  if (RETIRED_SOCKET_PATHS.includes(path)) return !registeredPaths.includes(path);
+  if (RETIRED_SOCKET_PATHS.includes(path) || RETIRED_NODE_PATHS.includes(path)) return !registeredPaths.includes(path);
   const retired = RETIRED_ROOTS.find((root) => path === root || path.startsWith(`${root}/`));
   if (retired === void 0) return false;
   return !registeredPaths.some((p) => p === retired || p.startsWith(`${retired}/`));
@@ -31024,6 +31064,28 @@ async function apiV1MutationRoutes(app, deps) {
       }
     }
   );
+  app.post(
+    "/workers/registration-token",
+    routeMeta({
+      surface: "application",
+      operationId: "worker.issueRegistrationToken",
+      authPolicy: "application_actor",
+      resourcePolicy: "account.manage",
+      stability: "preview",
+      summary: "Mint a single-use registration token for a worker of this account"
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const issued = await commands.issueWorkerRegistrationToken(actor);
+        return reply.status(201).send(issued);
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
   app.post(
     "/projects/:projectId/init-status",
     routeMeta({
@@ -34145,6 +34207,8 @@ function requestGhRunnersDelete(runnerId, projectId, sealedBundle, timeoutMs) {
 init_farm2();
 init_runner2();
 init_init_status();
+init_sandbox_reg_tokens();
+init_abuse_throttle();
 
 // src/projects/forget.ts
 init_legacy_cred_bundles();
@@ -34426,6 +34490,7 @@ function nodeUnavailable(capability, err) {
 function taskState(row) {
   return { ...row, revision: String(row.updatedAt) };
 }
+var WORKER_REG_TOKEN_MINTS = createAbuseThrottle({ windowMs: 60 * 6e4, max: 30 });
 function createWriteModel(db, log, hooks = {}) {
   async function readTaskRow(projectId, key) {
     const row = await db.get(
@@ -35108,6 +35173,16 @@ function createWriteModel(db, log, hooks = {}) {
       log.info({ projectId, jobId, kind }, kind === "backfill" ? "backfill job enqueued" : "index job enqueued");
       return ok({ jobId });
     },
+    async issueWorkerRegistrationToken({ owner }) {
+      if (owner.email === null) return { ok: false, refusal: "unprocessable", reason: "account_has_no_email" };
+      if (!WORKER_REG_TOKEN_MINTS.take(`email:${owner.email}`)) {
+        log.warn({ email: owner.email }, "ephemeral sandbox reg token mint throttled");
+        return { ok: false, refusal: "rate_limited" };
+      }
+      const issued = await issueEphemeralSandboxRegToken(db, owner.email);
+      log.info({ email: owner.email }, "ephemeral sandbox reg token issued for a client");
+      return ok(issued);
+    },
     async reportInitStatus({ projectId, phase, error }) {
       const recorded = await advanceInitPhase(db, projectId, phase);
       if (error !== null) {
@@ -39522,10 +39597,18 @@ async function negotiateJobCredentials(db, spec, workerId, log, issuer) {
 // src/routes/jobs.ts
 init_sandbox2();
 init_ws();
+init_route_registry();
 async function jobsRoutes(app, deps) {
   const { db, config } = deps;
   const notifyDeps = deps.notify;
-  app.post("/jobs/claim", async (req, reply) => {
+  app.post("/node/v1/jobs/claim", routeMeta({
+    surface: "node",
+    operationId: "node.jobs.claim",
+    authPolicy: "node_actor",
+    resourcePolicy: "node.connect",
+    stability: "preview",
+    summary: "Claim the next job for this SANDBOX (long poll)"
+  }), async (req, reply) => {
     const sandbox = await authenticateSandboxByBearer(db, req.headers.authorization);
     if (!sandbox) {
       return reply.status(401).send({ error: "unauthorized" });
@@ -39579,8 +39662,16 @@ async function jobsRoutes(app, deps) {
     }
   });
   app.post(
-    "/jobs/heartbeat",
+    "/node/v1/jobs/heartbeat",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.jobs.heartbeat",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Keep a claimed job's lease alive"
+      }),
       schema: {
         body: {
           type: "object",
@@ -39642,8 +39733,16 @@ async function jobsRoutes(app, deps) {
     }
   );
   app.post(
-    "/jobs/release",
+    "/node/v1/jobs/release",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.jobs.release",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Hand a claimed job back to the queue"
+      }),
       schema: {
         body: {
           type: "object",
@@ -39679,8 +39778,16 @@ async function jobsRoutes(app, deps) {
     }
   );
   app.post(
-    "/jobs/result",
+    "/node/v1/jobs/result",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.jobs.result",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Report a finished job"
+      }),
       schema: {
         body: {
           type: "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@code-partner/codepipe-hub",
-  "version": "0.14.1-dev.422.gf90f06c4",
+  "version": "0.14.1-dev.423.ga49d1f61",
   "description": "The CodePipe hub, packaged for one machine: the CLI installs it on demand for the local profile.",
   "type": "module",
   "main": "./hub/dist/index.js",