@corenel/harness 0.18.0 → 0.19.0

package/dist/sidecar/server.js

@@ -1622,6 +1622,13 @@ export class SidecarServer {
             return false;
         }
     }
+    /** The issuer named on the identity challenge: the verifier's own, when it
+     * has one and it is a sane length. Explanation only (see the protocol's
+     * `identity-challenge.issuer`); never part of a verdict. */
+    challengeIssuer() {
+        const iss = this.opts.identity?.issuer;
+        return typeof iss === 'string' && iss.length > 0 && iss.length <= 512 ? iss : undefined;
+    }
     /** THE IDENTITY GATE (spec 2026-09-29-device-enrollment-design, Phase 2),
      * run inside the credential check once the device key is proven -- for an
      * enrollment, BEFORE the code is burned -- so a code alone never enrolls an
@@ -1642,7 +1649,7 @@ export class SidecarServer {
         }
         const nonce = makeNonce();
         const orgId = this.opts.admission?.orgId;
-        this.ch.send({ t: 'identity-challenge', nonce, sidecarId, ...(orgId ? { orgId } : {}) });
+        this.ch.send({ t: 'identity-challenge', nonce, sidecarId, ...(orgId ? { orgId } : {}), ...(this.challengeIssuer() ? { issuer: this.challengeIssuer() } : {}) });
         const verdict = await this.awaitAndVerifyIdentity(sidecarId, nonce, jkt, IDENTITY_TIMEOUT_MS);
         if (!verdict.ok) {
             this.opts.log?.(`identity: unverified (${verdict.reason})`);
@@ -1694,7 +1701,7 @@ export class SidecarServer {
         try {
             const nonce = makeNonce();
             const orgId = this.opts.admission?.orgId;
-            this.ch.send({ t: 'identity-challenge', nonce, sidecarId, ...(orgId ? { orgId } : {}) });
+            this.ch.send({ t: 'identity-challenge', nonce, sidecarId, ...(orgId ? { orgId } : {}), ...(this.challengeIssuer() ? { issuer: this.challengeIssuer() } : {}) });
             const verdict = await this.awaitAndVerifyIdentity(sidecarId, nonce, jkt, RECHECK_TIMEOUT_MS);
             if (this.closed)
                 return;
@@ -2198,7 +2205,6 @@ export class SidecarServer {
         await this.replayDrained();
         if (this.closed)
             return;
-        this.opts.log?.(`paired — ${this.tools.size} ${this.tools.size === 1 ? 'tool' : 'tools'} advertised (host dir: ${this.hostStateDir})`);
         if (!dirNamePending) {
             this.sendWelcome(null);
             return;
@@ -2352,6 +2358,11 @@ export class SidecarServer {
          * The browser re-pairs once approved. */
         const pending = this.memberPending();
         const tools = pending || this.peerDaemon ? [] : [...this.tools.values()].map(({ run: _run, ...decl }) => decl);
+        /* The count THIS connection is sent, not the daemon's total: a pending
+         * member gets none, and a log that said otherwise hid exactly that. */
+        const toolNote = `${tools.length} ${tools.length === 1 ? 'tool' : 'tools'}`;
+        const why = pending ? ' (pending member: nothing is shared until the admin approves)' : this.peerDaemon ? ' (peer daemon)' : '';
+        this.opts.log?.(`paired — ${toolNote} advertised${why} (host dir: ${this.hostStateDir})`);
         const full = this.opts.info;
         const info = !full ? undefined
             : pending ? { ...(full.id !== undefined ? { id: full.id } : {}), ...(full.name !== undefined ? { name: full.name } : {}) }
@@ -4562,6 +4573,7 @@ export class SidecarServer {
                 ...(reply.adminLabel !== undefined ? { adminLabel: reply.adminLabel } : {}),
                 ...(reply.adminId !== undefined ? { adminId: reply.adminId } : {}),
                 ...(reply.admin !== undefined ? { admin: reply.admin } : {}),
+                ...(reply.noAdmin === true ? { noAdmin: true } : {}),
                 ...(reply.members ? {
                     members: reply.members.map((r) => ({
                         userId: r.userId, status: r.status, firstSeen: r.firstSeen, label: r.label,