@dmsdc-ai/aigentry-telepty 0.1.54 → 0.1.56

package/BUS_EVENT_SCHEMA.md

@@ -53,6 +53,13 @@ Every session is uniquely identified by a locator triple:
 - Override: `TELEPTY_MACHINE_ID` env var
 - Exposed in: `GET /api/meta` (`machine_id` field), session `locator` object, bus event `source_host`
 
+### Global Session ID Uniqueness (P4)
+- Convention: `{project}-{NNN}` (e.g. `aigentry-devkit-001`)
+- Cross-machine uniqueness: guaranteed by `locator.machine_id` prefix in bus events
+- Collision resolution: `resolveSessionAlias` returns local session only; remote sessions discovered via `source_host` field
+- If two machines have `aigentry-devkit-001`, inject uses `target@host` to disambiguate
+- Short form `aigentry-devkit-001` resolves to LOCAL session; remote requires explicit `@host`
+
 ### Peer Auth
 - Localhost: always trusted
 - Tailscale (100.x.y.z): trusted by default

package/daemon.js

@@ -69,6 +69,24 @@ function relayToPeers(msg) {
   }
 }
 
+// JWT auth: set TELEPTY_JWT_SECRET to enable. Tokens in Authorization: Bearer <token>
+const JWT_SECRET = process.env.TELEPTY_JWT_SECRET || null;
+
+function verifyJwt(token) {
+  if (!JWT_SECRET || !token) return false;
+  try {
+    // Simple HS256 JWT verification (no external deps)
+    const [headerB64, payloadB64, sigB64] = token.split('.');
+    if (!headerB64 || !payloadB64 || !sigB64) return false;
+    const expected = crypto.createHmac('sha256', JWT_SECRET)
+      .update(`${headerB64}.${payloadB64}`).digest('base64url');
+    if (sigB64 !== expected) return false;
+    const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());
+    if (payload.exp && Date.now() / 1000 > payload.exp) return false;
+    return payload;
+  } catch { return false; }
+}
+
 function isAllowedPeer(ip) {
   if (!ip) return false;
   const cleanIp = ip.replace('::ffff:', '');
@@ -95,6 +113,12 @@ app.use((req, res, next) => {
     return next();
   }
 
+  // JWT Bearer token
+  const authHeader = req.headers['authorization'] || '';
+  if (authHeader.startsWith('Bearer ') && verifyJwt(authHeader.slice(7))) {
+    return next();
+  }
+
   console.warn(`[AUTH] Rejected unauthorized request from ${clientIp}`);
   res.status(401).json({ error: 'Unauthorized: Invalid or missing token.' });
 });
@@ -565,7 +589,7 @@ function sendViaKitty(sessionId, text) {
   }
 
   try {
-    // Split text and CR — send-text for content, send-key for Enter
+    // Split text and CR — send-text for both (send-key corrupts keyboard protocol)
     const hasCr = text.endsWith('\r') || text.endsWith('\n');
     const textOnly = hasCr ? text.slice(0, -1) : text;
     if (textOnly.length > 0) {
@@ -577,7 +601,7 @@ function sendViaKitty(sessionId, text) {
     if (hasCr) {
       // Delay before sending Return — CLI needs time to process text input
       execSync('sleep 0.5', { timeout: 2000 });
-      execSync(`kitty @ --to unix:${socket} send-key --match id:${windowId} Return`, {
+      execSync(`kitty @ --to unix:${socket} send-text --match id:${windowId} $'\\r'`, {
         timeout: 3000, stdio: ['pipe', 'pipe', 'pipe']
       });
     }
@@ -773,7 +797,7 @@ app.post('/api/sessions/:id/inject', (req, res) => {
         setTimeout(() => {
           if (wid && sock) {
             try {
-              require('child_process').execSync(`kitty @ --to unix:${sock} send-key --match id:${wid} Return`, {
+              require('child_process').execSync(`kitty @ --to unix:${sock} send-text --match id:${wid} $'\\r'`, {
                 timeout: 3000, stdio: ['pipe', 'pipe', 'pipe']
               });
               require('child_process').execSync(`kitty @ --to unix:${sock} set-tab-title --match id:${wid} '⚡ telepty :: ${id}'`, {
@@ -946,7 +970,7 @@ function busAutoRoute(msg) {
       });
       setTimeout(() => {
         try {
-          require('child_process').execSync(`kitty @ --to unix:${sock} send-key --match id:${wid} Return`, {
+          require('child_process').execSync(`kitty @ --to unix:${sock} send-text --match id:${wid} $'\\r'`, {
             timeout: 3000, stdio: ['pipe', 'pipe', 'pipe']
           });
         } catch {}
@@ -1435,7 +1459,9 @@ server.on('upgrade', (req, socket, head) => {
   const url = new URL(req.url, 'http://' + req.headers.host);
   const token = url.searchParams.get('token');
   
-  if (!isAllowedPeer(req.socket.remoteAddress) && token !== EXPECTED_TOKEN) {
+  const wsAuthHeader = req.headers['authorization'] || '';
+  const wsJwtValid = wsAuthHeader.startsWith('Bearer ') && verifyJwt(wsAuthHeader.slice(7));
+  if (!isAllowedPeer(req.socket.remoteAddress) && token !== EXPECTED_TOKEN && !wsJwtValid) {
     socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
     socket.destroy();
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dmsdc-ai/aigentry-telepty",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "main": "daemon.js",
   "bin": {
     "aigentry-telepty": "install.js",