@evalops/maestro 0.10.8 → 0.10.11

package/dist/server/approval-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-service.js","sourceRoot":"","sources":["../../src/server/approval-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,qBAAqB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAInE,MAAM,OAAO,kCAAmC,SAAQ,qBAAqB;IAC5E,YACC,IAA6D,EAC5C,iBAAqC;QAEtD,KAAK,CAAC,IAAI,CAAC,CAAC;QAFK,sBAAiB,GAAjB,iBAAiB,CAAoB;IAGvD,CAAC;IAEQ,KAAK,CAAC,eAAe,CAC7B,OAA8B,EAC9B,MAAoB;QAEpB,IAAI,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACpC,oBAAoB,CAAC,gBAAgB,CAAC;gBACrC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC9B,OAAO;gBACP,OAAO,EAAE,IAAI;aACb,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACJ,OAAO,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACV,oBAAoB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;IACF,CAAC;IAEO,YAAY;QACnB,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAC/B,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,kCAAkC;CAAG","sourcesContent":["import {\n\ttype ActionApprovalDecision,\n\ttype ActionApprovalRequest,\n\tActionApprovalService,\n} from \"../agent/action-approval.js\";\nimport { serverRequestManager } from \"./server-request-manager.js\";\n\ntype SessionIdProvider = string | (() => string | undefined);\n\nexport class ServerRequestActionApprovalService extends ActionApprovalService {\n\tconstructor(\n\t\tmode?: ConstructorParameters<typeof ActionApprovalService>[0],\n\t\tprivate readonly sessionIdProvider?: SessionIdProvider,\n\t) {\n\t\tsuper(mode);\n\t}\n\n\toverride async requestApproval(\n\t\trequest: ActionApprovalRequest,\n\t\tsignal?: AbortSignal,\n\t): Promise<ActionApprovalDecision> {\n\t\tif (this.requiresUserInteraction()) {\n\t\t\tserverRequestManager.registerApproval({\n\t\t\t\tsessionId: this.getSessionId(),\n\t\t\t\trequest,\n\t\t\t\tservice: this,\n\t\t\t});\n\t\t}\n\t\ttry {\n\t\t\treturn await super.requestApproval(request, signal);\n\t\t} finally {\n\t\t\tserverRequestManager.unregister(request.id);\n\t\t}\n\t}\n\n\tprivate getSessionId(): string | undefined {\n\t\tif (typeof this.sessionIdProvider === \"function\") {\n\t\t\treturn this.sessionIdProvider();\n\t\t}\n\t\treturn this.sessionIdProvider;\n\t}\n}\n\nexport class WebActionApprovalService extends ServerRequestActionApprovalService {}\n"]}
+{"version":3,"file":"approval-service.js","sourceRoot":"","sources":["../../src/server/approval-service.ts"],"names":[],"mappings":"AAIA,OAAO,EACN,mCAAmC,GAEnC,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,OAAO,kCAAmC,SAAQ,mCAAmC;IAC1F,YACC,IAAmB,EACnB,iBAAqC,EACrC,sBAAuD;QAEvD,KAAK,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC5D,CAAC;IAEkB,2BAA2B,CAC7C,SAA6B,EAC7B,OAA8B;QAE9B,oBAAoB,CAAC,gBAAgB,CAAC;YACrC,SAAS;YACT,OAAO;YACP,OAAO,EAAE,IAAI;SACb,CAAC,CAAC;IACJ,CAAC;IAEkB,wBAAwB,CAC1C,OAA8B;QAE9B,oBAAoB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,kCAAkC;CAAG","sourcesContent":["import type {\n\tActionApprovalRequest,\n\tApprovalMode,\n} from \"../agent/action-approval.js\";\nimport {\n\tPlatformBackedActionApprovalService,\n\ttype SessionIdProvider,\n} from \"../approvals/platform-action-approval.js\";\nimport type { ApprovalsServiceConfig } from \"../approvals/service-client.js\";\nimport { serverRequestManager } from \"./server-request-manager.js\";\n\nexport class ServerRequestActionApprovalService extends PlatformBackedActionApprovalService {\n\tconstructor(\n\t\tmode?: ApprovalMode,\n\t\tsessionIdProvider?: SessionIdProvider,\n\t\tapprovalsServiceConfig?: ApprovalsServiceConfig | false,\n\t) {\n\t\tsuper(mode, { sessionIdProvider, approvalsServiceConfig });\n\t}\n\n\tprotected override onPendingApprovalRegistered(\n\t\tsessionId: string | undefined,\n\t\trequest: ActionApprovalRequest,\n\t): void {\n\t\tserverRequestManager.registerApproval({\n\t\t\tsessionId,\n\t\t\trequest,\n\t\t\tservice: this,\n\t\t});\n\t}\n\n\tprotected override onPendingApprovalSettled(\n\t\trequest: ActionApprovalRequest,\n\t): void {\n\t\tserverRequestManager.unregister(request.id);\n\t}\n}\n\nexport class WebActionApprovalService extends ServerRequestActionApprovalService {}\n"]}

package/dist/server/authz.d.ts

@@ -1,10 +1,31 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-export declare function checkApiAuth(req: IncomingMessage): Promise<{
+export type AuthMethod = "anon" | "api_key" | "jwt" | "shared_token";
+export interface VerifiedRequestPrincipal {
+    authMethod: AuthMethod;
+    subject: string;
+    scopeKey: string;
+    userId?: string;
+    workspaceId?: string;
+    orgId?: string;
+    teamId?: string;
+    tokenId?: string;
+    keyId?: string;
+    roles: string[];
+    scopes: string[];
+    claims?: Record<string, unknown>;
+}
+interface CheckApiAuthOptions {
+    apiKey?: string | null;
+}
+export declare function getVerifiedRequestPrincipal(req: IncomingMessage): VerifiedRequestPrincipal | null;
+export declare function checkApiAuth(req: IncomingMessage, options?: CheckApiAuthOptions): Promise<{
     ok: boolean;
     error?: string;
+    principal?: VerifiedRequestPrincipal;
 }>;
-export declare function isApiAuthConfigured(): boolean;
 export declare function requireApiAuth(req: IncomingMessage, res: ServerResponse, corsHeaders: Record<string, string>): Promise<boolean>;
 export declare function requireCsrf(req: IncomingMessage, res: ServerResponse, corsHeaders: Record<string, string>): boolean;
 export declare function getAuthSubject(req: IncomingMessage): string;
+export declare function getAuthScopeKey(req: IncomingMessage): string;
+export {};
 //# sourceMappingURL=authz.d.ts.map

package/dist/server/authz.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/server/authz.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA8EjE,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;IACjE,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAgBD;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED,wBAAsB,cAAc,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,OAAO,CAAC,CAclB;AAED,wBAAgB,WAAW,CAC1B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAmCT;AAGD,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAU3D"}
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/server/authz.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAmBjE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,cAAc,CAAC;AAErE,MAAM,WAAW,wBAAwB;IACxC,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAMD,UAAU,mBAAmB;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA4KD,wBAAgB,2BAA2B,CAC1C,GAAG,EAAE,eAAe,GAClB,wBAAwB,GAAG,IAAI,CAEjC;AA+BD,wBAAsB,YAAY,CACjC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACrC,CAAC,CA0CD;AAED,wBAAsB,cAAc,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,OAAO,CAAC,CAclB;AAED,wBAAgB,WAAW,CAC1B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAmCT;AAGD,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAc3D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAM5D"}

package/dist/server/authz.js

@@ -9,7 +9,7 @@ const JWT_JWKS_URL = process.env.MAESTRO_JWT_JWKS_URL?.trim() || null;
 const JWT_AUDIENCE = process.env.MAESTRO_JWT_AUD?.trim() || undefined;
 const JWT_ISSUER = process.env.MAESTRO_JWT_ISS?.trim() || undefined;
 const JWT_ALG = process.env.MAESTRO_JWT_ALG?.trim() || "HS256";
-const API_AUTH_CONFIGURED = Boolean(WEB_API_KEY || SHARED_SECRET || JWT_SECRET || JWT_JWKS_URL);
+const REQUEST_PRINCIPAL = Symbol("maestro.requestPrincipal");
 function base64UrlDecode(input) {
     return Buffer.from(input.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf-8");
 }
@@ -37,6 +37,124 @@ function verifySharedToken(token) {
         return null;
     return userId;
 }
+function hasConfiguredAuth(apiKey = WEB_API_KEY) {
+    return Boolean(apiKey || SHARED_SECRET || JWT_SECRET || JWT_JWKS_URL);
+}
+function sanitizePrincipalPart(value) {
+    return value.trim().replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+function getStringClaim(payload, ...names) {
+    for (const name of names) {
+        const raw = payload[name];
+        if (typeof raw !== "string")
+            continue;
+        const trimmed = raw.trim();
+        if (trimmed)
+            return trimmed;
+    }
+    return undefined;
+}
+function getStringListClaim(payload, ...names) {
+    for (const name of names) {
+        const raw = payload[name];
+        if (Array.isArray(raw)) {
+            return raw
+                .filter((value) => typeof value === "string")
+                .map((value) => value.trim())
+                .filter(Boolean);
+        }
+        if (typeof raw === "string") {
+            return raw
+                .split(/[,\s]+/)
+                .map((value) => value.trim())
+                .filter(Boolean);
+        }
+    }
+    return [];
+}
+function buildScopeKey(parts) {
+    const normalized = parts
+        .map((value) => sanitizePrincipalPart(value))
+        .filter(Boolean);
+    if (normalized.length === 0) {
+        return "anon";
+    }
+    const joined = normalized.join("__");
+    if (joined.length <= 64) {
+        return joined;
+    }
+    const digest = createHash("sha256").update(joined).digest("hex").slice(0, 24);
+    return `principal_${digest}`;
+}
+function setVerifiedRequestPrincipal(req, principal) {
+    const request = req;
+    request[REQUEST_PRINCIPAL] = principal;
+    return principal;
+}
+function createAnonymousPrincipal() {
+    return {
+        authMethod: "anon",
+        subject: "anon",
+        scopeKey: "anon",
+        roles: [],
+        scopes: [],
+    };
+}
+function createSharedTokenPrincipal(userId) {
+    const subject = `user:${userId}`;
+    return {
+        authMethod: "shared_token",
+        subject,
+        scopeKey: buildScopeKey([subject]),
+        userId,
+        roles: [],
+        scopes: [],
+    };
+}
+function createApiKeyPrincipal(token) {
+    const keyId = createHash("sha256").update(token).digest("hex").slice(0, 16);
+    const subject = `key:${keyId}`;
+    return {
+        authMethod: "api_key",
+        subject,
+        scopeKey: buildScopeKey([subject]),
+        keyId,
+        roles: [],
+        scopes: [],
+    };
+}
+function createJwtPrincipal(payload) {
+    const userId = payload.sub?.trim();
+    if (!userId) {
+        throw new Error("JWT principal requires sub");
+    }
+    const workspaceId = getStringClaim(payload, "workspace_id", "workspaceId", "wid");
+    const orgId = getStringClaim(payload, "org_id", "orgId", "organization_id", "organizationId", "tenant_id", "tenantId");
+    const teamId = getStringClaim(payload, "team_id", "teamId");
+    const subject = `user:${userId}`;
+    const scopeParts = [
+        workspaceId ? `workspace_${workspaceId}` : null,
+        orgId ? `org_${orgId}` : null,
+        teamId ? `team_${teamId}` : null,
+        `user_${userId}`,
+    ].filter((value) => Boolean(value));
+    return {
+        authMethod: "jwt",
+        subject,
+        scopeKey: buildScopeKey(scopeParts),
+        userId,
+        workspaceId,
+        orgId,
+        teamId,
+        tokenId: getStringClaim(payload, "jti"),
+        roles: getStringListClaim(payload, "roles", "role"),
+        scopes: getStringListClaim(payload, "scopes", "scope"),
+        claims: { ...payload },
+    };
+}
+export function getVerifiedRequestPrincipal(req) {
+    return req[REQUEST_PRINCIPAL] ?? null;
+}
 async function verifyJwt(token) {
     if (!JWT_SECRET && !JWT_JWKS_URL)
         return null;
@@ -60,7 +178,7 @@ async function verifyJwt(token) {
             });
             payload = verified.payload;
         }
-        if (!payload.sub)
+        if (typeof payload.sub !== "string" || !payload.sub.trim())
             return null;
         // basic exp/nbf checks handled by jose
         return payload;
@@ -69,27 +187,34 @@ async function verifyJwt(token) {
         return null;
     }
 }
-export async function checkApiAuth(req) {
+export async function checkApiAuth(req, options = {}) {
+    const webApiKey = options.apiKey?.trim() || WEB_API_KEY;
+    const cachedPrincipal = getVerifiedRequestPrincipal(req);
+    if (cachedPrincipal &&
+        (!webApiKey || cachedPrincipal.authMethod !== "anon")) {
+        return { ok: true, principal: cachedPrincipal };
+    }
     const bearer = getRequestToken(req);
     const jwtPayload = bearer ? await verifyJwt(bearer) : null;
     const userId = bearer ? verifySharedToken(bearer) : null;
-    if (userId)
-        return { ok: true };
-    if (jwtPayload?.sub)
-        return { ok: true };
-    if (WEB_API_KEY) {
-        if (bearer && secureCompare(bearer, WEB_API_KEY)) {
-            return { ok: true };
-        }
-        return { ok: false, error: "Unauthorized" };
+    if (userId) {
+        const principal = setVerifiedRequestPrincipal(req, createSharedTokenPrincipal(userId));
+        return { ok: true, principal: principal ?? undefined };
+    }
+    if (jwtPayload?.sub) {
+        const principal = setVerifiedRequestPrincipal(req, createJwtPrincipal(jwtPayload));
+        return { ok: true, principal: principal ?? undefined };
     }
-    if (API_AUTH_CONFIGURED) {
+    if (webApiKey && bearer && secureCompare(bearer, webApiKey)) {
+        const principal = setVerifiedRequestPrincipal(req, createApiKeyPrincipal(bearer));
+        return { ok: true, principal: principal ?? undefined };
+    }
+    if (hasConfiguredAuth(webApiKey)) {
+        setVerifiedRequestPrincipal(req, null);
         return { ok: false, error: "Unauthorized" };
     }
-    return { ok: true };
-}
-export function isApiAuthConfigured() {
-    return API_AUTH_CONFIGURED;
+    const principal = setVerifiedRequestPrincipal(req, createAnonymousPrincipal());
+    return { ok: true, principal: principal ?? undefined };
 }
 export async function requireApiAuth(req, res, corsHeaders) {
     const result = await checkApiAuth(req);
@@ -120,6 +245,10 @@ export function requireCsrf(req, res, corsHeaders) {
 }
 // Derive a stable subject key from provided token (API key) for per-user scoping
 export function getAuthSubject(req) {
+    const principal = getVerifiedRequestPrincipal(req);
+    if (principal) {
+        return principal.subject;
+    }
     const token = getRequestToken(req);
     // Attempt JWT verification synchronously not possible; so use hash of token + prefix
     if (token && SHARED_SECRET) {
@@ -132,4 +261,11 @@ export function getAuthSubject(req) {
     const digest = createHash("sha256").update(token).digest("hex");
     return `key:${digest.slice(0, 16)}`;
 }
+export function getAuthScopeKey(req) {
+    const principal = getVerifiedRequestPrincipal(req);
+    if (principal) {
+        return principal.scopeKey;
+    }
+    return getAuthSubject(req);
+}
 //# sourceMappingURL=authz.js.map

package/dist/server/authz.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/server/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAmB,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EACN,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,QAAQ,GACR,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACtE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAClE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACtE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACtE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACpE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;AAC/D,MAAM,mBAAmB,GAAG,OAAO,CAClC,WAAW,IAAI,aAAa,IAAI,UAAU,IAAI,YAAY,CAC1D,CAAC;AAEF,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,IAAI,CACjB,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAC3C,QAAQ,CACR,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,sCAAsC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC9B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;IACD,qEAAqE;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,OAAO,GAAsB,IAAI,CAAC;QACtC,IAAI,YAAY,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC7C,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,UAAU;aAClB,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC5B,CAAC;aAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,UAAU;aAClB,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9B,uCAAuC;QACvC,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAItD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,EAAE,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,OAAO,mBAAmB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,GAAoB,EACpB,GAAmB,EACnB,WAAmC;IAEnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,QAAQ,CACP,GAAG,EACH,GAAG,EACH;QACC,KAAK,EACJ,iHAAiH;KAClH,EACD,WAAW,EACX,GAAG,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAC1B,GAAoB,EACpB,GAAmB,EACnB,WAAmC;IAEnC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,QAAQ,CACP,GAAG,EACH,GAAG,EACH;YACC,KAAK,EAAE,gEAAgE;SACvE,EACD,WAAW,EACX,GAAG,CACH,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAC7B,GAAG,EACH,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,cAAc,CACd,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;QACzD,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAC1C,WAAW,EACX,GAAG,CACH,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,GAAoB;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,qFAAqF;IACrF,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI;YAAE,OAAO,QAAQ,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACrC,CAAC","sourcesContent":["import { createHash, createHmac } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { type JWTPayload, createRemoteJWKSet, jwtVerify } from \"jose\";\nimport {\n\tgetRequestHeader,\n\tgetRequestToken,\n\tsecureCompare,\n\tsendJson,\n} from \"./server-utils.js\";\n\nconst WEB_API_KEY = process.env.MAESTRO_WEB_API_KEY?.trim() || null;\nconst CSRF_TOKEN = process.env.MAESTRO_WEB_CSRF_TOKEN?.trim() || null;\nconst SHARED_SECRET = process.env.MAESTRO_AUTH_SHARED_SECRET?.trim() || null;\nconst JWT_SECRET = process.env.MAESTRO_JWT_SECRET?.trim() || null;\nconst JWT_JWKS_URL = process.env.MAESTRO_JWT_JWKS_URL?.trim() || null;\nconst JWT_AUDIENCE = process.env.MAESTRO_JWT_AUD?.trim() || undefined;\nconst JWT_ISSUER = process.env.MAESTRO_JWT_ISS?.trim() || undefined;\nconst JWT_ALG = process.env.MAESTRO_JWT_ALG?.trim() || \"HS256\";\nconst API_AUTH_CONFIGURED = Boolean(\n\tWEB_API_KEY || SHARED_SECRET || JWT_SECRET || JWT_JWKS_URL,\n);\n\nfunction base64UrlDecode(input: string): string {\n\treturn Buffer.from(\n\t\tinput.replace(/-/g, \"+\").replace(/_/g, \"/\"),\n\t\t\"base64\",\n\t).toString(\"utf-8\");\n}\n\nfunction verifySharedToken(token: string): string | null {\n\tif (!SHARED_SECRET) return null;\n\t// Format: base64url(userId).signature\n\tconst parts = token.split(\".\");\n\tif (parts.length !== 2) return null;\n\tconst user = parts[0]!;\n\tconst providedSig = parts[1]!;\n\tlet userId: string;\n\ttry {\n\t\tuserId = base64UrlDecode(user);\n\t} catch {\n\t\treturn null;\n\t}\n\t// Use HMAC instead of plain hash to prevent length-extension attacks\n\tconst hmac = createHmac(\"sha256\", SHARED_SECRET);\n\thmac.update(userId);\n\tconst expected = hmac.digest(\"hex\");\n\tif (!secureCompare(providedSig, expected)) return null;\n\treturn userId;\n}\n\nasync function verifyJwt(token: string): Promise<JWTPayload | null> {\n\tif (!JWT_SECRET && !JWT_JWKS_URL) return null;\n\ttry {\n\t\tlet payload: JWTPayload | null = null;\n\t\tif (JWT_JWKS_URL?.length) {\n\t\t\tconst jwks = createRemoteJWKSet(new URL(JWT_JWKS_URL));\n\t\t\tconst verified = await jwtVerify(token, jwks, {\n\t\t\t\talgorithms: [JWT_ALG],\n\t\t\t\taudience: JWT_AUDIENCE,\n\t\t\t\tissuer: JWT_ISSUER,\n\t\t\t});\n\t\t\tpayload = verified.payload;\n\t\t} else {\n\t\t\tconst secret = new TextEncoder().encode(JWT_SECRET ?? \"\");\n\t\t\tconst verified = await jwtVerify(token, secret, {\n\t\t\t\talgorithms: [JWT_ALG],\n\t\t\t\taudience: JWT_AUDIENCE,\n\t\t\t\tissuer: JWT_ISSUER,\n\t\t\t});\n\t\t\tpayload = verified.payload;\n\t\t}\n\t\tif (!payload.sub) return null;\n\t\t// basic exp/nbf checks handled by jose\n\t\treturn payload;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nexport async function checkApiAuth(req: IncomingMessage): Promise<{\n\tok: boolean;\n\terror?: string;\n}> {\n\tconst bearer = getRequestToken(req);\n\tconst jwtPayload = bearer ? await verifyJwt(bearer) : null;\n\tconst userId = bearer ? verifySharedToken(bearer) : null;\n\tif (userId) return { ok: true };\n\tif (jwtPayload?.sub) return { ok: true };\n\tif (WEB_API_KEY) {\n\t\tif (bearer && secureCompare(bearer, WEB_API_KEY)) {\n\t\t\treturn { ok: true };\n\t\t}\n\t\treturn { ok: false, error: \"Unauthorized\" };\n\t}\n\tif (API_AUTH_CONFIGURED) {\n\t\treturn { ok: false, error: \"Unauthorized\" };\n\t}\n\treturn { ok: true };\n}\n\nexport function isApiAuthConfigured(): boolean {\n\treturn API_AUTH_CONFIGURED;\n}\n\nexport async function requireApiAuth(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcorsHeaders: Record<string, string>,\n): Promise<boolean> {\n\tconst result = await checkApiAuth(req);\n\tif (result.ok) return true;\n\tsendJson(\n\t\tres,\n\t\t401,\n\t\t{\n\t\t\terror:\n\t\t\t\t\"Authentication required. Provide JWT (MAESTRO_JWT_SECRET) or shared-secret bearer token or MAESTRO_WEB_API_KEY.\",\n\t\t},\n\t\tcorsHeaders,\n\t\treq,\n\t);\n\treturn false;\n}\n\nexport function requireCsrf(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcorsHeaders: Record<string, string>,\n): boolean {\n\tconst method = (req.method || \"GET\").toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n\t\treturn true;\n\t}\n\tif (!CSRF_TOKEN) {\n\t\tsendJson(\n\t\t\tres,\n\t\t\t403,\n\t\t\t{\n\t\t\t\terror: \"MAESTRO_WEB_CSRF_TOKEN is required for state-changing requests\",\n\t\t\t},\n\t\t\tcorsHeaders,\n\t\t\treq,\n\t\t);\n\t\treturn false;\n\t}\n\tconst value = getRequestHeader(\n\t\treq,\n\t\t\"x-composer-csrf\",\n\t\t\"x-maestro-csrf\",\n\t\t\"x-csrf-token\",\n\t\t\"x-xsrf-token\",\n\t);\n\tif (!value || !secureCompare(String(value), CSRF_TOKEN)) {\n\t\tsendJson(\n\t\t\tres,\n\t\t\t403,\n\t\t\t{ error: \"Forbidden: invalid CSRF token\" },\n\t\t\tcorsHeaders,\n\t\t\treq,\n\t\t);\n\t\treturn false;\n\t}\n\treturn true;\n}\n\n// Derive a stable subject key from provided token (API key) for per-user scoping\nexport function getAuthSubject(req: IncomingMessage): string {\n\tconst token = getRequestToken(req);\n\t// Attempt JWT verification synchronously not possible; so use hash of token + prefix\n\tif (token && SHARED_SECRET) {\n\t\tconst user = verifySharedToken(token);\n\t\tif (user) return `user:${user}`;\n\t}\n\tif (!token) return \"anon\";\n\tconst digest = createHash(\"sha256\").update(token).digest(\"hex\");\n\treturn `key:${digest.slice(0, 16)}`;\n}\n"]}
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/server/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAmB,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EACN,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,QAAQ,GACR,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACtE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAClE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACtE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACtE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACpE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;AAC/D,MAAM,iBAAiB,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;AA2B7D,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,IAAI,CACjB,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAC3C,QAAQ,CACR,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,sCAAsC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC9B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;IACD,qEAAqE;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAM,GAAG,WAAW;IAC9C,OAAO,OAAO,CAAC,MAAM,IAAI,aAAa,IAAI,UAAU,IAAI,YAAY,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CACtB,OAAmB,EACnB,GAAG,KAAe;IAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB,EAAE,GAAG,KAAe;IAClE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,GAAG;iBACR,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;iBAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,GAAG;iBACR,KAAK,CAAC,QAAQ,CAAC;iBACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;IACF,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAe;IACrC,MAAM,UAAU,GAAG,KAAK;SACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;SAC5C,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,aAAa,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,2BAA2B,CACnC,GAAoB,EACpB,SAA0C;IAE1C,MAAM,OAAO,GAAG,GAA2B,CAAC;IAC5C,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;IACvC,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB;IAChC,OAAO;QACN,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;KACV,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc;IACjD,MAAM,OAAO,GAAG,QAAQ,MAAM,EAAE,CAAC;IACjC,OAAO;QACN,UAAU,EAAE,cAAc;QAC1B,OAAO;QACP,QAAQ,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM;QACN,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;KACV,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC;IAC/B,OAAO;QACN,UAAU,EAAE,SAAS;QACrB,OAAO;QACP,QAAQ,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK;QACL,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;KACV,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CACjC,OAAO,EACP,cAAc,EACd,aAAa,EACb,KAAK,CACL,CAAC;IACF,MAAM,KAAK,GAAG,cAAc,CAC3B,OAAO,EACP,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,UAAU,CACV,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,MAAM,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG;QAClB,WAAW,CAAC,CAAC,CAAC,aAAa,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAC/C,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;QAC7B,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;QAChC,QAAQ,MAAM,EAAE;KAChB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,OAAO;QACN,UAAU,EAAE,KAAK;QACjB,OAAO;QACP,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC;QACnC,MAAM;QACN,WAAW;QACX,KAAK;QACL,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC;QACvC,KAAK,EAAE,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QACnD,MAAM,EAAE,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;QACtD,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE;KACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,GAAoB;IAEpB,OAAQ,GAA4B,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,OAAO,GAAsB,IAAI,CAAC;QACtC,IAAI,YAAY,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC7C,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,UAAU;aAClB,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC5B,CAAC;aAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,UAAU;aAClB,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACxE,uCAAuC;QACvC,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAoB,EACpB,UAA+B,EAAE;IAMjC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC;IACxD,MAAM,eAAe,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzD,IACC,eAAe;QACf,CAAC,CAAC,SAAS,IAAI,eAAe,CAAC,UAAU,KAAK,MAAM,CAAC,EACpD,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,2BAA2B,CAC5C,GAAG,EACH,0BAA0B,CAAC,MAAM,CAAC,CAClC,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,UAAU,EAAE,GAAG,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,2BAA2B,CAC5C,GAAG,EACH,kBAAkB,CAAC,UAAU,CAAC,CAC9B,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,2BAA2B,CAC5C,GAAG,EACH,qBAAqB,CAAC,MAAM,CAAC,CAC7B,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,2BAA2B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,CAC5C,GAAG,EACH,wBAAwB,EAAE,CAC1B,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,GAAoB,EACpB,GAAmB,EACnB,WAAmC;IAEnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,QAAQ,CACP,GAAG,EACH,GAAG,EACH;QACC,KAAK,EACJ,iHAAiH;KAClH,EACD,WAAW,EACX,GAAG,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAC1B,GAAoB,EACpB,GAAmB,EACnB,WAAmC;IAEnC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,QAAQ,CACP,GAAG,EACH,GAAG,EACH;YACC,KAAK,EAAE,gEAAgE;SACvE,EACD,WAAW,EACX,GAAG,CACH,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAC7B,GAAG,EACH,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,cAAc,CACd,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;QACzD,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAC1C,WAAW,EACX,GAAG,CACH,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,GAAoB;IAClD,MAAM,SAAS,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,OAAO,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,qFAAqF;IACrF,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI;YAAE,OAAO,QAAQ,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAoB;IACnD,MAAM,SAAS,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC3B,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC","sourcesContent":["import { createHash, createHmac } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { type JWTPayload, createRemoteJWKSet, jwtVerify } from \"jose\";\nimport {\n\tgetRequestHeader,\n\tgetRequestToken,\n\tsecureCompare,\n\tsendJson,\n} from \"./server-utils.js\";\n\nconst WEB_API_KEY = process.env.MAESTRO_WEB_API_KEY?.trim() || null;\nconst CSRF_TOKEN = process.env.MAESTRO_WEB_CSRF_TOKEN?.trim() || null;\nconst SHARED_SECRET = process.env.MAESTRO_AUTH_SHARED_SECRET?.trim() || null;\nconst JWT_SECRET = process.env.MAESTRO_JWT_SECRET?.trim() || null;\nconst JWT_JWKS_URL = process.env.MAESTRO_JWT_JWKS_URL?.trim() || null;\nconst JWT_AUDIENCE = process.env.MAESTRO_JWT_AUD?.trim() || undefined;\nconst JWT_ISSUER = process.env.MAESTRO_JWT_ISS?.trim() || undefined;\nconst JWT_ALG = process.env.MAESTRO_JWT_ALG?.trim() || \"HS256\";\nconst REQUEST_PRINCIPAL = Symbol(\"maestro.requestPrincipal\");\n\nexport type AuthMethod = \"anon\" | \"api_key\" | \"jwt\" | \"shared_token\";\n\nexport interface VerifiedRequestPrincipal {\n\tauthMethod: AuthMethod;\n\tsubject: string;\n\tscopeKey: string;\n\tuserId?: string;\n\tworkspaceId?: string;\n\torgId?: string;\n\tteamId?: string;\n\ttokenId?: string;\n\tkeyId?: string;\n\troles: string[];\n\tscopes: string[];\n\tclaims?: Record<string, unknown>;\n}\n\ntype RequestWithPrincipal = IncomingMessage & {\n\t[REQUEST_PRINCIPAL]?: VerifiedRequestPrincipal | null;\n};\n\ninterface CheckApiAuthOptions {\n\tapiKey?: string | null;\n}\n\nfunction base64UrlDecode(input: string): string {\n\treturn Buffer.from(\n\t\tinput.replace(/-/g, \"+\").replace(/_/g, \"/\"),\n\t\t\"base64\",\n\t).toString(\"utf-8\");\n}\n\nfunction verifySharedToken(token: string): string | null {\n\tif (!SHARED_SECRET) return null;\n\t// Format: base64url(userId).signature\n\tconst parts = token.split(\".\");\n\tif (parts.length !== 2) return null;\n\tconst user = parts[0]!;\n\tconst providedSig = parts[1]!;\n\tlet userId: string;\n\ttry {\n\t\tuserId = base64UrlDecode(user);\n\t} catch {\n\t\treturn null;\n\t}\n\t// Use HMAC instead of plain hash to prevent length-extension attacks\n\tconst hmac = createHmac(\"sha256\", SHARED_SECRET);\n\thmac.update(userId);\n\tconst expected = hmac.digest(\"hex\");\n\tif (!secureCompare(providedSig, expected)) return null;\n\treturn userId;\n}\n\nfunction hasConfiguredAuth(apiKey = WEB_API_KEY): boolean {\n\treturn Boolean(apiKey || SHARED_SECRET || JWT_SECRET || JWT_JWKS_URL);\n}\n\nfunction sanitizePrincipalPart(value: string): string {\n\treturn value.trim().replace(/[^a-zA-Z0-9._-]/g, \"_\");\n}\n\nfunction getStringClaim(\n\tpayload: JWTPayload,\n\t...names: string[]\n): string | undefined {\n\tfor (const name of names) {\n\t\tconst raw = payload[name];\n\t\tif (typeof raw !== \"string\") continue;\n\t\tconst trimmed = raw.trim();\n\t\tif (trimmed) return trimmed;\n\t}\n\treturn undefined;\n}\n\nfunction getStringListClaim(payload: JWTPayload, ...names: string[]): string[] {\n\tfor (const name of names) {\n\t\tconst raw = payload[name];\n\t\tif (Array.isArray(raw)) {\n\t\t\treturn raw\n\t\t\t\t.filter((value): value is string => typeof value === \"string\")\n\t\t\t\t.map((value) => value.trim())\n\t\t\t\t.filter(Boolean);\n\t\t}\n\t\tif (typeof raw === \"string\") {\n\t\t\treturn raw\n\t\t\t\t.split(/[,\\s]+/)\n\t\t\t\t.map((value) => value.trim())\n\t\t\t\t.filter(Boolean);\n\t\t}\n\t}\n\treturn [];\n}\n\nfunction buildScopeKey(parts: string[]): string {\n\tconst normalized = parts\n\t\t.map((value) => sanitizePrincipalPart(value))\n\t\t.filter(Boolean);\n\tif (normalized.length === 0) {\n\t\treturn \"anon\";\n\t}\n\tconst joined = normalized.join(\"__\");\n\tif (joined.length <= 64) {\n\t\treturn joined;\n\t}\n\tconst digest = createHash(\"sha256\").update(joined).digest(\"hex\").slice(0, 24);\n\treturn `principal_${digest}`;\n}\n\nfunction setVerifiedRequestPrincipal(\n\treq: IncomingMessage,\n\tprincipal: VerifiedRequestPrincipal | null,\n): VerifiedRequestPrincipal | null {\n\tconst request = req as RequestWithPrincipal;\n\trequest[REQUEST_PRINCIPAL] = principal;\n\treturn principal;\n}\n\nfunction createAnonymousPrincipal(): VerifiedRequestPrincipal {\n\treturn {\n\t\tauthMethod: \"anon\",\n\t\tsubject: \"anon\",\n\t\tscopeKey: \"anon\",\n\t\troles: [],\n\t\tscopes: [],\n\t};\n}\n\nfunction createSharedTokenPrincipal(userId: string): VerifiedRequestPrincipal {\n\tconst subject = `user:${userId}`;\n\treturn {\n\t\tauthMethod: \"shared_token\",\n\t\tsubject,\n\t\tscopeKey: buildScopeKey([subject]),\n\t\tuserId,\n\t\troles: [],\n\t\tscopes: [],\n\t};\n}\n\nfunction createApiKeyPrincipal(token: string): VerifiedRequestPrincipal {\n\tconst keyId = createHash(\"sha256\").update(token).digest(\"hex\").slice(0, 16);\n\tconst subject = `key:${keyId}`;\n\treturn {\n\t\tauthMethod: \"api_key\",\n\t\tsubject,\n\t\tscopeKey: buildScopeKey([subject]),\n\t\tkeyId,\n\t\troles: [],\n\t\tscopes: [],\n\t};\n}\n\nfunction createJwtPrincipal(payload: JWTPayload): VerifiedRequestPrincipal {\n\tconst userId = payload.sub?.trim();\n\tif (!userId) {\n\t\tthrow new Error(\"JWT principal requires sub\");\n\t}\n\tconst workspaceId = getStringClaim(\n\t\tpayload,\n\t\t\"workspace_id\",\n\t\t\"workspaceId\",\n\t\t\"wid\",\n\t);\n\tconst orgId = getStringClaim(\n\t\tpayload,\n\t\t\"org_id\",\n\t\t\"orgId\",\n\t\t\"organization_id\",\n\t\t\"organizationId\",\n\t\t\"tenant_id\",\n\t\t\"tenantId\",\n\t);\n\tconst teamId = getStringClaim(payload, \"team_id\", \"teamId\");\n\tconst subject = `user:${userId}`;\n\tconst scopeParts = [\n\t\tworkspaceId ? `workspace_${workspaceId}` : null,\n\t\torgId ? `org_${orgId}` : null,\n\t\tteamId ? `team_${teamId}` : null,\n\t\t`user_${userId}`,\n\t].filter((value): value is string => Boolean(value));\n\treturn {\n\t\tauthMethod: \"jwt\",\n\t\tsubject,\n\t\tscopeKey: buildScopeKey(scopeParts),\n\t\tuserId,\n\t\tworkspaceId,\n\t\torgId,\n\t\tteamId,\n\t\ttokenId: getStringClaim(payload, \"jti\"),\n\t\troles: getStringListClaim(payload, \"roles\", \"role\"),\n\t\tscopes: getStringListClaim(payload, \"scopes\", \"scope\"),\n\t\tclaims: { ...payload },\n\t};\n}\n\nexport function getVerifiedRequestPrincipal(\n\treq: IncomingMessage,\n): VerifiedRequestPrincipal | null {\n\treturn (req as RequestWithPrincipal)[REQUEST_PRINCIPAL] ?? null;\n}\n\nasync function verifyJwt(token: string): Promise<JWTPayload | null> {\n\tif (!JWT_SECRET && !JWT_JWKS_URL) return null;\n\ttry {\n\t\tlet payload: JWTPayload | null = null;\n\t\tif (JWT_JWKS_URL?.length) {\n\t\t\tconst jwks = createRemoteJWKSet(new URL(JWT_JWKS_URL));\n\t\t\tconst verified = await jwtVerify(token, jwks, {\n\t\t\t\talgorithms: [JWT_ALG],\n\t\t\t\taudience: JWT_AUDIENCE,\n\t\t\t\tissuer: JWT_ISSUER,\n\t\t\t});\n\t\t\tpayload = verified.payload;\n\t\t} else {\n\t\t\tconst secret = new TextEncoder().encode(JWT_SECRET ?? \"\");\n\t\t\tconst verified = await jwtVerify(token, secret, {\n\t\t\t\talgorithms: [JWT_ALG],\n\t\t\t\taudience: JWT_AUDIENCE,\n\t\t\t\tissuer: JWT_ISSUER,\n\t\t\t});\n\t\t\tpayload = verified.payload;\n\t\t}\n\t\tif (typeof payload.sub !== \"string\" || !payload.sub.trim()) return null;\n\t\t// basic exp/nbf checks handled by jose\n\t\treturn payload;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nexport async function checkApiAuth(\n\treq: IncomingMessage,\n\toptions: CheckApiAuthOptions = {},\n): Promise<{\n\tok: boolean;\n\terror?: string;\n\tprincipal?: VerifiedRequestPrincipal;\n}> {\n\tconst webApiKey = options.apiKey?.trim() || WEB_API_KEY;\n\tconst cachedPrincipal = getVerifiedRequestPrincipal(req);\n\tif (\n\t\tcachedPrincipal &&\n\t\t(!webApiKey || cachedPrincipal.authMethod !== \"anon\")\n\t) {\n\t\treturn { ok: true, principal: cachedPrincipal };\n\t}\n\tconst bearer = getRequestToken(req);\n\tconst jwtPayload = bearer ? await verifyJwt(bearer) : null;\n\tconst userId = bearer ? verifySharedToken(bearer) : null;\n\tif (userId) {\n\t\tconst principal = setVerifiedRequestPrincipal(\n\t\t\treq,\n\t\t\tcreateSharedTokenPrincipal(userId),\n\t\t);\n\t\treturn { ok: true, principal: principal ?? undefined };\n\t}\n\tif (jwtPayload?.sub) {\n\t\tconst principal = setVerifiedRequestPrincipal(\n\t\t\treq,\n\t\t\tcreateJwtPrincipal(jwtPayload),\n\t\t);\n\t\treturn { ok: true, principal: principal ?? undefined };\n\t}\n\tif (webApiKey && bearer && secureCompare(bearer, webApiKey)) {\n\t\tconst principal = setVerifiedRequestPrincipal(\n\t\t\treq,\n\t\t\tcreateApiKeyPrincipal(bearer),\n\t\t);\n\t\treturn { ok: true, principal: principal ?? undefined };\n\t}\n\tif (hasConfiguredAuth(webApiKey)) {\n\t\tsetVerifiedRequestPrincipal(req, null);\n\t\treturn { ok: false, error: \"Unauthorized\" };\n\t}\n\tconst principal = setVerifiedRequestPrincipal(\n\t\treq,\n\t\tcreateAnonymousPrincipal(),\n\t);\n\treturn { ok: true, principal: principal ?? undefined };\n}\n\nexport async function requireApiAuth(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcorsHeaders: Record<string, string>,\n): Promise<boolean> {\n\tconst result = await checkApiAuth(req);\n\tif (result.ok) return true;\n\tsendJson(\n\t\tres,\n\t\t401,\n\t\t{\n\t\t\terror:\n\t\t\t\t\"Authentication required. Provide JWT (MAESTRO_JWT_SECRET) or shared-secret bearer token or MAESTRO_WEB_API_KEY.\",\n\t\t},\n\t\tcorsHeaders,\n\t\treq,\n\t);\n\treturn false;\n}\n\nexport function requireCsrf(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcorsHeaders: Record<string, string>,\n): boolean {\n\tconst method = (req.method || \"GET\").toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n\t\treturn true;\n\t}\n\tif (!CSRF_TOKEN) {\n\t\tsendJson(\n\t\t\tres,\n\t\t\t403,\n\t\t\t{\n\t\t\t\terror: \"MAESTRO_WEB_CSRF_TOKEN is required for state-changing requests\",\n\t\t\t},\n\t\t\tcorsHeaders,\n\t\t\treq,\n\t\t);\n\t\treturn false;\n\t}\n\tconst value = getRequestHeader(\n\t\treq,\n\t\t\"x-composer-csrf\",\n\t\t\"x-maestro-csrf\",\n\t\t\"x-csrf-token\",\n\t\t\"x-xsrf-token\",\n\t);\n\tif (!value || !secureCompare(String(value), CSRF_TOKEN)) {\n\t\tsendJson(\n\t\t\tres,\n\t\t\t403,\n\t\t\t{ error: \"Forbidden: invalid CSRF token\" },\n\t\t\tcorsHeaders,\n\t\t\treq,\n\t\t);\n\t\treturn false;\n\t}\n\treturn true;\n}\n\n// Derive a stable subject key from provided token (API key) for per-user scoping\nexport function getAuthSubject(req: IncomingMessage): string {\n\tconst principal = getVerifiedRequestPrincipal(req);\n\tif (principal) {\n\t\treturn principal.subject;\n\t}\n\tconst token = getRequestToken(req);\n\t// Attempt JWT verification synchronously not possible; so use hash of token + prefix\n\tif (token && SHARED_SECRET) {\n\t\tconst user = verifySharedToken(token);\n\t\tif (user) return `user:${user}`;\n\t}\n\tif (!token) return \"anon\";\n\tconst digest = createHash(\"sha256\").update(token).digest(\"hex\");\n\treturn `key:${digest.slice(0, 16)}`;\n}\n\nexport function getAuthScopeKey(req: IncomingMessage): string {\n\tconst principal = getVerifiedRequestPrincipal(req);\n\tif (principal) {\n\t\treturn principal.scopeKey;\n\t}\n\treturn getAuthSubject(req);\n}\n"]}

package/dist/server/handlers/approvals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAsE1D,wBAAsB,eAAe,CACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,GAAG,qBAAqB,CAAC,iBA6HtE"}
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA8D1D,wBAAsB,eAAe,CACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,GAAG,qBAAqB,CAAC,iBA6HtE"}

package/dist/server/handlers/approvals.js

@@ -1,7 +1,7 @@
 import { getApprovalModeForSession, normalizeApprovalSessionId, setApprovalModeForSession, } from "../approval-mode-store.js";
 import { getAuthSubject } from "../authz.js";
 import { ApiError, sendJson } from "../server-utils.js";
-import { createSessionManagerForRequest } from "../session-scope.js";
+import { createWebSessionManagerForRequest } from "../session-scope.js";
 import { ApprovalsUpdateRequestSchema, parseAndValidateJson, } from "../validation.js";
 const approvalSessionIdPattern = /^[A-Za-z0-9._-]+$/;
 function verifySessionOwnership(session, subject) {
@@ -23,17 +23,10 @@ async function ensureApprovalSessionAccess(req, sessionId, subject) {
     if (sessionId === "default") {
         return null;
     }
-    const sessionManager = createSessionManagerForRequest(req, false);
-    const sessionFile = sessionManager.getSessionFileById(sessionId);
-    if (!sessionFile) {
-        return null;
-    }
+    const sessionManager = createWebSessionManagerForRequest(req, false);
     const session = await sessionManager.loadSession(sessionId);
     if (!session) {
-        return {
-            statusCode: 404,
-            error: "Session file exists but could not be loaded",
-        };
+        return null;
     }
     if (!verifySessionOwnership(session, subject)) {
         return {

package/dist/server/handlers/approvals.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../../src/server/handlers/approvals.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAEN,4BAA4B,EAC5B,oBAAoB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAErD,SAAS,sBAAsB,CAC9B,OAA+C,EAC/C,OAAe;IAEf,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5D,OAAO,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,OAAO,CAAC;IACzE,OAAO,CAAC,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB;IACjD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;AACF,CAAC;AAED,KAAK,UAAU,2BAA2B,CACzC,GAAoB,EACpB,SAAiB,EACjB,OAAe;IAEf,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,cAAc,GAAG,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO;YACN,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,6CAA6C;SACpD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO;YACN,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,gDAAgD;SACvD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,GAAoB,EACpB,GAAmB,EACnB,OAAsE;IAEtE,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAClB,GAAG,CAAC,GAAG,IAAI,gBAAgB,EAC3B,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAC5B,CAAC;IACF,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAEzD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;YAC7D,uBAAuB,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,2BAA2B,CACpD,GAAG,EACH,SAAS,EACT,OAAO,CACP,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBACjB,QAAQ,CACP,GAAG,EACH,WAAW,CAAC,UAAU,EACtB,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,EAC5B,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,IAAI,GAAG,yBAAyB,CACrC,SAAS,EACT,mBAAmB,EACnB,OAAO,CACP,CAAC;YAEF,QAAQ,CACP,GAAG,EACH,GAAG,EACH;gBACC,IAAI;gBACJ,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;aAC1C,EACD,WAAW,CACX,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACjE,WAAW,CACX,CAAC;QACH,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACtC,GAAG,EACH,4BAA4B,CAC5B,CAAC;YACF,MAAM,SAAS,GAAG,0BAA0B,CAC3C,IAAI,CAAC,SAAS,IAAI,cAAc,CAChC,CAAC;YACF,uBAAuB,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,2BAA2B,CACpD,GAAG,EACH,SAAS,EACT,OAAO,CACP,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBACjB,QAAQ,CACP,GAAG,EACH,WAAW,CAAC,UAAU,EACtB,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,EAC5B,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,aAAa,GAAG,yBAAyB,CAC9C,SAAS,EACT,IAAoB,EACpB;gBACC,OAAO;gBACP,mBAAmB;aACnB,CACD,CAAC;YAEF,QAAQ,CACP,GAAG,EACH,GAAG,EACH;gBACC,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,aAAa;gBACnB,OAAO,EACN,aAAa,KAAK,IAAI;oBACrB,CAAC,CAAC,wBAAwB,IAAI,EAAE;oBAChC,CAAC,CAAC,6BAA6B,aAAa,yCAAyC;aACvF,EACD,WAAW,CACX,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;gBACrD,QAAQ,CACP,GAAG,EACF,KAAgC,CAAC,UAAU,EAC5C,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EACxB,WAAW,CACX,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,QAAQ,CACP,GAAG,EACH,GAAG,EACH;oBACC,KAAK,EAAE,gCAAgC;oBACvC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC/D,EACD,WAAW,CACX,CAAC;YACH,CAAC;QACF,CAAC;QACD,OAAO;IACR,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { ApprovalMode } from \"../../agent/action-approval.js\";\nimport type { WebServerContext } from \"../app-context.js\";\nimport {\n\tgetApprovalModeForSession,\n\tnormalizeApprovalSessionId,\n\tsetApprovalModeForSession,\n} from \"../approval-mode-store.js\";\nimport { getAuthSubject } from \"../authz.js\";\nimport { ApiError, sendJson } from \"../server-utils.js\";\nimport { createSessionManagerForRequest } from \"../session-scope.js\";\nimport {\n\ttype ApprovalsUpdateRequestInput,\n\tApprovalsUpdateRequestSchema,\n\tparseAndValidateJson,\n} from \"../validation.js\";\n\nconst approvalSessionIdPattern = /^[A-Za-z0-9._-]+$/;\n\nfunction verifySessionOwnership(\n\tsession: { owner?: unknown; subject?: unknown },\n\tsubject: string,\n): boolean {\n\tif (typeof session.owner === \"string\" && session.owner) {\n\t\treturn session.owner === subject;\n\t}\n\tif (typeof session.subject === \"string\" && session.subject) {\n\t\treturn session.subject === subject;\n\t}\n\tconst strictMode = process.env.MAESTRO_STRICT_SESSION_ACCESS !== \"false\";\n\treturn !strictMode;\n}\n\nfunction assertApprovalSessionId(sessionId: string): void {\n\tif (!approvalSessionIdPattern.test(sessionId)) {\n\t\tthrow new ApiError(400, \"Invalid session id\");\n\t}\n}\n\nasync function ensureApprovalSessionAccess(\n\treq: IncomingMessage,\n\tsessionId: string,\n\tsubject: string,\n): Promise<{ statusCode: number; error: string } | null> {\n\tif (sessionId === \"default\") {\n\t\treturn null;\n\t}\n\n\tconst sessionManager = createSessionManagerForRequest(req, false);\n\tconst sessionFile = sessionManager.getSessionFileById(sessionId);\n\tif (!sessionFile) {\n\t\treturn null;\n\t}\n\n\tconst session = await sessionManager.loadSession(sessionId);\n\tif (!session) {\n\t\treturn {\n\t\t\tstatusCode: 404,\n\t\t\terror: \"Session file exists but could not be loaded\",\n\t\t};\n\t}\n\n\tif (!verifySessionOwnership(session, subject)) {\n\t\treturn {\n\t\t\tstatusCode: 403,\n\t\t\terror: \"Access denied: session belongs to another user\",\n\t\t};\n\t}\n\n\treturn null;\n}\n\nexport async function handleApprovals(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcontext: Pick<WebServerContext, \"corsHeaders\" | \"defaultApprovalMode\">,\n) {\n\tconst { corsHeaders, defaultApprovalMode } = context;\n\tconst subject = getAuthSubject(req);\n\tconst url = new URL(\n\t\treq.url || \"/api/approvals\",\n\t\t`http://${req.headers.host}`,\n\t);\n\tconst querySessionId = url.searchParams.get(\"sessionId\");\n\n\tif (req.method === \"GET\") {\n\t\ttry {\n\t\t\tconst sessionId = normalizeApprovalSessionId(querySessionId);\n\t\t\tassertApprovalSessionId(sessionId);\n\t\t\tconst accessError = await ensureApprovalSessionAccess(\n\t\t\t\treq,\n\t\t\t\tsessionId,\n\t\t\t\tsubject,\n\t\t\t);\n\t\t\tif (accessError) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\taccessError.statusCode,\n\t\t\t\t\t{ error: accessError.error },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst mode = getApprovalModeForSession(\n\t\t\t\tsessionId,\n\t\t\t\tdefaultApprovalMode,\n\t\t\t\tsubject,\n\t\t\t);\n\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t200,\n\t\t\t\t{\n\t\t\t\t\tmode,\n\t\t\t\t\tavailableModes: [\"auto\", \"prompt\", \"fail\"],\n\t\t\t\t},\n\t\t\t\tcorsHeaders,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t400,\n\t\t\t\t{ error: error instanceof Error ? error.message : String(error) },\n\t\t\t\tcorsHeaders,\n\t\t\t);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (req.method === \"POST\") {\n\t\ttry {\n\t\t\tconst data = await parseAndValidateJson<ApprovalsUpdateRequestInput>(\n\t\t\t\treq,\n\t\t\t\tApprovalsUpdateRequestSchema,\n\t\t\t);\n\t\t\tconst sessionId = normalizeApprovalSessionId(\n\t\t\t\tdata.sessionId ?? querySessionId,\n\t\t\t);\n\t\t\tassertApprovalSessionId(sessionId);\n\t\t\tconst accessError = await ensureApprovalSessionAccess(\n\t\t\t\treq,\n\t\t\t\tsessionId,\n\t\t\t\tsubject,\n\t\t\t);\n\t\t\tif (accessError) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\taccessError.statusCode,\n\t\t\t\t\t{ error: accessError.error },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst mode = data.mode;\n\t\t\tconst effectiveMode = setApprovalModeForSession(\n\t\t\t\tsessionId,\n\t\t\t\tmode as ApprovalMode,\n\t\t\t\t{\n\t\t\t\t\tsubject,\n\t\t\t\t\tdefaultApprovalMode,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t200,\n\t\t\t\t{\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\tmode: effectiveMode,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\teffectiveMode === mode\n\t\t\t\t\t\t\t? `Approval mode set to ${mode}`\n\t\t\t\t\t\t\t: `Approval mode resolved to ${effectiveMode} because the server default is stricter`,\n\t\t\t\t},\n\t\t\t\tcorsHeaders,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (error instanceof Error && \"statusCode\" in error) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t(error as { statusCode: number }).statusCode,\n\t\t\t\t\t{ error: error.message },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t500,\n\t\t\t\t\t{\n\t\t\t\t\t\terror: \"Failed to update approval mode\",\n\t\t\t\t\t\tdetails: error instanceof Error ? error.message : String(error),\n\t\t\t\t\t},\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn;\n\t}\n\n\tsendJson(res, 405, { error: \"Method not allowed\" }, corsHeaders);\n}\n"]}
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../../src/server/handlers/approvals.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAEN,4BAA4B,EAC5B,oBAAoB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAErD,SAAS,sBAAsB,CAC9B,OAA+C,EAC/C,OAAe;IAEf,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5D,OAAO,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,OAAO,CAAC;IACzE,OAAO,CAAC,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB;IACjD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;AACF,CAAC;AAED,KAAK,UAAU,2BAA2B,CACzC,GAAoB,EACpB,SAAiB,EACjB,OAAe;IAEf,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,cAAc,GAAG,iCAAiC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO;YACN,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,gDAAgD;SACvD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,GAAoB,EACpB,GAAmB,EACnB,OAAsE;IAEtE,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAClB,GAAG,CAAC,GAAG,IAAI,gBAAgB,EAC3B,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAC5B,CAAC;IACF,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAEzD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;YAC7D,uBAAuB,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,2BAA2B,CACpD,GAAG,EACH,SAAS,EACT,OAAO,CACP,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBACjB,QAAQ,CACP,GAAG,EACH,WAAW,CAAC,UAAU,EACtB,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,EAC5B,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,IAAI,GAAG,yBAAyB,CACrC,SAAS,EACT,mBAAmB,EACnB,OAAO,CACP,CAAC;YAEF,QAAQ,CACP,GAAG,EACH,GAAG,EACH;gBACC,IAAI;gBACJ,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;aAC1C,EACD,WAAW,CACX,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACjE,WAAW,CACX,CAAC;QACH,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACtC,GAAG,EACH,4BAA4B,CAC5B,CAAC;YACF,MAAM,SAAS,GAAG,0BAA0B,CAC3C,IAAI,CAAC,SAAS,IAAI,cAAc,CAChC,CAAC;YACF,uBAAuB,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,2BAA2B,CACpD,GAAG,EACH,SAAS,EACT,OAAO,CACP,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBACjB,QAAQ,CACP,GAAG,EACH,WAAW,CAAC,UAAU,EACtB,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,EAC5B,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,aAAa,GAAG,yBAAyB,CAC9C,SAAS,EACT,IAAoB,EACpB;gBACC,OAAO;gBACP,mBAAmB;aACnB,CACD,CAAC;YAEF,QAAQ,CACP,GAAG,EACH,GAAG,EACH;gBACC,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,aAAa;gBACnB,OAAO,EACN,aAAa,KAAK,IAAI;oBACrB,CAAC,CAAC,wBAAwB,IAAI,EAAE;oBAChC,CAAC,CAAC,6BAA6B,aAAa,yCAAyC;aACvF,EACD,WAAW,CACX,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;gBACrD,QAAQ,CACP,GAAG,EACF,KAAgC,CAAC,UAAU,EAC5C,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EACxB,WAAW,CACX,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,QAAQ,CACP,GAAG,EACH,GAAG,EACH;oBACC,KAAK,EAAE,gCAAgC;oBACvC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC/D,EACD,WAAW,CACX,CAAC;YACH,CAAC;QACF,CAAC;QACD,OAAO;IACR,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { ApprovalMode } from \"../../agent/action-approval.js\";\nimport type { WebServerContext } from \"../app-context.js\";\nimport {\n\tgetApprovalModeForSession,\n\tnormalizeApprovalSessionId,\n\tsetApprovalModeForSession,\n} from \"../approval-mode-store.js\";\nimport { getAuthSubject } from \"../authz.js\";\nimport { ApiError, sendJson } from \"../server-utils.js\";\nimport { createWebSessionManagerForRequest } from \"../session-scope.js\";\nimport {\n\ttype ApprovalsUpdateRequestInput,\n\tApprovalsUpdateRequestSchema,\n\tparseAndValidateJson,\n} from \"../validation.js\";\n\nconst approvalSessionIdPattern = /^[A-Za-z0-9._-]+$/;\n\nfunction verifySessionOwnership(\n\tsession: { owner?: unknown; subject?: unknown },\n\tsubject: string,\n): boolean {\n\tif (typeof session.owner === \"string\" && session.owner) {\n\t\treturn session.owner === subject;\n\t}\n\tif (typeof session.subject === \"string\" && session.subject) {\n\t\treturn session.subject === subject;\n\t}\n\tconst strictMode = process.env.MAESTRO_STRICT_SESSION_ACCESS !== \"false\";\n\treturn !strictMode;\n}\n\nfunction assertApprovalSessionId(sessionId: string): void {\n\tif (!approvalSessionIdPattern.test(sessionId)) {\n\t\tthrow new ApiError(400, \"Invalid session id\");\n\t}\n}\n\nasync function ensureApprovalSessionAccess(\n\treq: IncomingMessage,\n\tsessionId: string,\n\tsubject: string,\n): Promise<{ statusCode: number; error: string } | null> {\n\tif (sessionId === \"default\") {\n\t\treturn null;\n\t}\n\n\tconst sessionManager = createWebSessionManagerForRequest(req, false);\n\tconst session = await sessionManager.loadSession(sessionId);\n\tif (!session) {\n\t\treturn null;\n\t}\n\n\tif (!verifySessionOwnership(session, subject)) {\n\t\treturn {\n\t\t\tstatusCode: 403,\n\t\t\terror: \"Access denied: session belongs to another user\",\n\t\t};\n\t}\n\n\treturn null;\n}\n\nexport async function handleApprovals(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcontext: Pick<WebServerContext, \"corsHeaders\" | \"defaultApprovalMode\">,\n) {\n\tconst { corsHeaders, defaultApprovalMode } = context;\n\tconst subject = getAuthSubject(req);\n\tconst url = new URL(\n\t\treq.url || \"/api/approvals\",\n\t\t`http://${req.headers.host}`,\n\t);\n\tconst querySessionId = url.searchParams.get(\"sessionId\");\n\n\tif (req.method === \"GET\") {\n\t\ttry {\n\t\t\tconst sessionId = normalizeApprovalSessionId(querySessionId);\n\t\t\tassertApprovalSessionId(sessionId);\n\t\t\tconst accessError = await ensureApprovalSessionAccess(\n\t\t\t\treq,\n\t\t\t\tsessionId,\n\t\t\t\tsubject,\n\t\t\t);\n\t\t\tif (accessError) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\taccessError.statusCode,\n\t\t\t\t\t{ error: accessError.error },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst mode = getApprovalModeForSession(\n\t\t\t\tsessionId,\n\t\t\t\tdefaultApprovalMode,\n\t\t\t\tsubject,\n\t\t\t);\n\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t200,\n\t\t\t\t{\n\t\t\t\t\tmode,\n\t\t\t\t\tavailableModes: [\"auto\", \"prompt\", \"fail\"],\n\t\t\t\t},\n\t\t\t\tcorsHeaders,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t400,\n\t\t\t\t{ error: error instanceof Error ? error.message : String(error) },\n\t\t\t\tcorsHeaders,\n\t\t\t);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (req.method === \"POST\") {\n\t\ttry {\n\t\t\tconst data = await parseAndValidateJson<ApprovalsUpdateRequestInput>(\n\t\t\t\treq,\n\t\t\t\tApprovalsUpdateRequestSchema,\n\t\t\t);\n\t\t\tconst sessionId = normalizeApprovalSessionId(\n\t\t\t\tdata.sessionId ?? querySessionId,\n\t\t\t);\n\t\t\tassertApprovalSessionId(sessionId);\n\t\t\tconst accessError = await ensureApprovalSessionAccess(\n\t\t\t\treq,\n\t\t\t\tsessionId,\n\t\t\t\tsubject,\n\t\t\t);\n\t\t\tif (accessError) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\taccessError.statusCode,\n\t\t\t\t\t{ error: accessError.error },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst mode = data.mode;\n\t\t\tconst effectiveMode = setApprovalModeForSession(\n\t\t\t\tsessionId,\n\t\t\t\tmode as ApprovalMode,\n\t\t\t\t{\n\t\t\t\t\tsubject,\n\t\t\t\t\tdefaultApprovalMode,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t200,\n\t\t\t\t{\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\tmode: effectiveMode,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\teffectiveMode === mode\n\t\t\t\t\t\t\t? `Approval mode set to ${mode}`\n\t\t\t\t\t\t\t: `Approval mode resolved to ${effectiveMode} because the server default is stricter`,\n\t\t\t\t},\n\t\t\t\tcorsHeaders,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (error instanceof Error && \"statusCode\" in error) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t(error as { statusCode: number }).statusCode,\n\t\t\t\t\t{ error: error.message },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t500,\n\t\t\t\t\t{\n\t\t\t\t\t\terror: \"Failed to update approval mode\",\n\t\t\t\t\t\tdetails: error instanceof Error ? error.message : String(error),\n\t\t\t\t\t},\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn;\n\t}\n\n\tsendJson(res, 405, { error: \"Method not allowed\" }, corsHeaders);\n}\n"]}

package/dist/server/handlers/branch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/branch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA4CjE,wBAAsB,YAAY,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAmRnC"}
+{"version":3,"file":"branch.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/branch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA6CjE,wBAAsB,YAAY,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAoRnC"}

package/dist/server/handlers/branch.js

@@ -1,8 +1,9 @@
 import { Type } from "@sinclair/typebox";
 import { isUserMessage } from "../../agent/type-guards.js";
 import { getAuthSubject, requireApiAuth, requireCsrf } from "../authz.js";
+import { isHostedSessionManager } from "../hosted-session-manager.js";
 import { respondWithApiError, sendJson } from "../server-utils.js";
-import { createSessionManagerForRequest } from "../session-scope.js";
+import { createWebSessionManagerForRequest } from "../session-scope.js";
 import { checkSessionRateLimitAsync } from "../utils/session-rate-limit.js";
 import { parseAndValidateJson } from "../validation.js";
 const BranchRequestSchema = Type.Object({
@@ -52,15 +53,10 @@ export async function handleBranch(req, res, corsHeaders) {
                     sendJson(res, 429, { error: "Too many branch requests" }, corsHeaders);
                     return;
                 }
-                const sessionManager = createSessionManagerForRequest(req, false);
-                const sessionFile = sessionManager.getSessionFileById(sessionId);
-                if (!sessionFile) {
-                    sendJson(res, 404, { error: `Session not found: ${sessionId}` }, corsHeaders);
-                    return;
-                }
+                const sessionManager = createWebSessionManagerForRequest(req, false);
                 const session = await sessionManager.loadSession(sessionId);
                 if (!session) {
-                    sendJson(res, 404, { error: "Session file exists but could not be loaded" }, corsHeaders);
+                    sendJson(res, 404, { error: `Session not found: ${sessionId}` }, corsHeaders);
                     return;
                 }
                 const userMessages = session.messages
@@ -98,15 +94,10 @@ export async function handleBranch(req, res, corsHeaders) {
                 sendJson(res, 429, { error: "Too many branch requests" }, corsHeaders);
                 return;
             }
-            const sessionManager = createSessionManagerForRequest(req, false);
-            const sessionFile = sessionManager.getSessionFileById(data.sessionId);
-            if (!sessionFile) {
-                sendJson(res, 404, { error: `Session not found: ${data.sessionId}` }, corsHeaders);
-                return;
-            }
+            const sessionManager = createWebSessionManagerForRequest(req, false);
             const session = await sessionManager.loadSession(data.sessionId);
             if (!session) {
-                sendJson(res, 404, { error: "Session file exists but could not be loaded" }, corsHeaders);
+                sendJson(res, 404, { error: `Session not found: ${data.sessionId}` }, corsHeaders);
                 return;
             }
             const userMessages = session.messages
@@ -146,7 +137,17 @@ export async function handleBranch(req, res, corsHeaders) {
                 }, corsHeaders);
                 return;
             }
-            sessionManager.setSessionFile(sessionFile);
+            if (isHostedSessionManager(sessionManager)) {
+                await sessionManager.resumeSession(data.sessionId);
+            }
+            else {
+                const sessionFile = sessionManager.getSessionFileById(data.sessionId);
+                if (!sessionFile) {
+                    sendJson(res, 404, { error: `Session not found: ${data.sessionId}` }, corsHeaders);
+                    return;
+                }
+                sessionManager.setSessionFile(sessionFile);
+            }
             const modelKey = sessionManager.loadModel();
             const thinkingLevel = sessionManager.loadThinkingLevel();
             const messages = session.messages.slice(0, targetIndex);
@@ -175,10 +176,18 @@ export async function handleBranch(req, res, corsHeaders) {
                 streamMessage: null,
                 pendingToolCalls: new Map(),
             };
-            const newSessionFile = sessionManager.createBranchedSession(agentState, targetIndex);
-            const sessionManager2 = createSessionManagerForRequest(req, false);
-            sessionManager2.setSessionFile(newSessionFile);
-            const newSessionId = sessionManager2.getSessionId();
+            let newSessionId;
+            let newSessionFile;
+            if (isHostedSessionManager(sessionManager)) {
+                newSessionId = await sessionManager.createBranchedSessionFromState(agentState, targetIndex);
+                newSessionFile = `db:${newSessionId}`;
+            }
+            else {
+                newSessionFile = sessionManager.createBranchedSession(agentState, targetIndex);
+                const sessionManager2 = createWebSessionManagerForRequest(req, false);
+                sessionManager2.setSessionFile(newSessionFile);
+                newSessionId = sessionManager2.getSessionId();
+            }
             sendJson(res, 200, {
                 success: true,
                 newSessionId,

package/dist/server/handlers/branch.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch.js","sourceRoot":"","sources":["../../../src/server/handlers/branch.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACzD,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CAC9D,CAAC,CAAC;AAIH,SAAS,eAAe,CAAC,SAAiB;IACzC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7C,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,MAAM,GAAG,GAAG;IACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO;aAClB,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CACL,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC;YACD,MAAM,IAAI,CAAC;YACV,CAAsB,CAAC,IAAI,KAAK,MAAM,CACxC;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAuB,CAAC,IAAI,IAAI,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAoB,EACpB,GAAmB,EACnB,WAAmC;IAEnC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAClB,GAAG,CAAC,GAAG,IAAI,aAAa,EACxB,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC;YACJ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAClD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBAED,eAAe,CAAC,SAAS,CAAC,CAAC;gBAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;gBACpC,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;gBAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACnB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,0BAA0B,EAAE,EACrC,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBAED,MAAM,cAAc,GAAG,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClE,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,CAAC,WAAW,EAAE,CAAC;oBAClB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,sBAAsB,SAAS,EAAE,EAAE,EAC5C,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;oBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,6CAA6C,EAAE,EACxD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ;qBACnC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;qBACrC,MAAM,CACN,CACC,KAAK,EACyD,EAAE,CAChE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CACzB,CAAC;gBAEH,QAAQ,CACP,GAAG,EACH,GAAG,EACH;oBACC,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;wBACtD,MAAM,EAAE,CAAC,GAAG,CAAC;wBACb,KAAK;wBACL,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;qBACtC,CAAC,CAAC;iBACH,EACD,WAAW,CACX,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,WAAW,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO;QAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC;YAAE,OAAO;QAChD,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACtC,GAAG,EACH,mBAAmB,CACnB,CAAC;YACF,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,WAAW,CAAC,CAAC;gBACvE,OAAO;YACR,CAAC;YAED,MAAM,cAAc,GAAG,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,SAAS,EAAE,EAAE,EACjD,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,6CAA6C,EAAE,EACxD,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ;iBACnC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;iBACrC,MAAM,CACN,CACC,KAAK,EACyD,EAAE,CAChE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CACzB,CAAC;YAEH,IAAI,WAAmB,CAAC;YACxB,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC1C,IACC,IAAI,CAAC,iBAAiB,GAAG,CAAC;oBAC1B,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC,MAAM,EAC3C,CAAC;oBACF,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EAAE,gCAAgC,IAAI,CAAC,iBAAiB,kBAAkB,YAAY,CAAC,MAAM,EAAE;qBACpG,EACD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,MAAM,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC;gBACnE,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACxB,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EAAE,mCAAmC,IAAI,CAAC,iBAAiB,EAAE;qBAClE,EACD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACvC,CAAC;iBAAM,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC5C,IACC,IAAI,CAAC,YAAY,GAAG,CAAC;oBACrB,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAC3C,CAAC;oBACF,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EAAE,0BAA0B,IAAI,CAAC,YAAY,kBAAkB,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;qBACjG,EACD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACP,QAAQ,CACP,GAAG,EACH,GAAG,EACH;oBACC,KAAK,EAAE,2DAA2D;iBAClE,EACD,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YAED,cAAc,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAExD,2CAA2C;YAC3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;YAC/C,MAAM,eAAe,GAAG,QAAQ;gBAC/B,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAChE,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAEvB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACtB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAC3C,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YAED,sDAAsD;YACtD,kEAAkE;YAClE,MAAM,UAAU,GAAG;gBAClB,QAAQ;gBACR,KAAK,EAAE,eAAe;gBACtB,aAAa,EAAG,aAAwC,IAAI,KAAK;gBACjE,YAAY,EAAE,EAAE;gBAChB,KAAK,EAAE,EAAE;gBACT,YAAY,EAAE,KAAc;gBAC5B,YAAY,EAAE,KAAc;gBAC5B,SAAS,EAAE,KAAc;gBACzB,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,IAAI;gBACnB,gBAAgB,EAAE,IAAI,GAAG,EAAgC;aAazD,CAAC;YAEF,MAAM,cAAc,GAAG,cAAc,CAAC,qBAAqB,CAC1D,UAAU,EACV,WAAW,CACX,CAAC;YAEF,MAAM,eAAe,GAAG,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnE,eAAe,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YAC/C,MAAM,YAAY,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC;YAEpD,QAAQ,CACP,GAAG,EACH,GAAG,EACH;gBACC,OAAO,EAAE,IAAI;gBACb,YAAY;gBACZ,cAAc;gBACd,OAAO,EAAE,qCAAqC,WAAW,EAAE;aAC3D,EACD,WAAW,CACX,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,OAAO;IACR,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { isUserMessage } from \"../../agent/type-guards.js\";\nimport type { UserMessageWithAttachments } from \"../../agent/types.js\";\nimport { getAuthSubject, requireApiAuth, requireCsrf } from \"../authz.js\";\nimport { respondWithApiError, sendJson } from \"../server-utils.js\";\nimport { createSessionManagerForRequest } from \"../session-scope.js\";\nimport { checkSessionRateLimitAsync } from \"../utils/session-rate-limit.js\";\nimport { parseAndValidateJson } from \"../validation.js\";\n\nconst BranchRequestSchema = Type.Object({\n\tsessionId: Type.String({ minLength: 1 }),\n\tmessageIndex: Type.Optional(Type.Integer({ minimum: 0 })),\n\tuserMessageNumber: Type.Optional(Type.Integer({ minimum: 1 })),\n});\n\ntype BranchRequestInput = Static<typeof BranchRequestSchema>;\n\nfunction assertSessionId(sessionId: string): void {\n\tif (!/^[A-Za-z0-9._-]+$/.test(sessionId)) {\n\t\tthrow new Error(\"Invalid sessionId format\");\n\t}\n}\n\nfunction summarizeContent(content: unknown, maxLen = 160): string {\n\tif (typeof content === \"string\") {\n\t\treturn content.slice(0, maxLen);\n\t}\n\tif (Array.isArray(content)) {\n\t\tconst text = content\n\t\t\t.filter(\n\t\t\t\t(c) =>\n\t\t\t\t\ttypeof c === \"object\" &&\n\t\t\t\t\tc &&\n\t\t\t\t\t\"type\" in c &&\n\t\t\t\t\t(c as { type: string }).type === \"text\",\n\t\t\t)\n\t\t\t.map((c) => (c as { text?: string }).text || \"\")\n\t\t\t.join(\"\\n\");\n\t\treturn text.slice(0, maxLen);\n\t}\n\treturn \"\";\n}\n\nexport async function handleBranch(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcorsHeaders: Record<string, string>,\n) {\n\tif (req.method === \"GET\") {\n\t\tif (!(await requireApiAuth(req, res, corsHeaders))) return;\n\t\tconst url = new URL(\n\t\t\treq.url || \"/api/branch\",\n\t\t\t`http://${req.headers.host || \"localhost\"}`,\n\t\t);\n\t\tconst action = url.searchParams.get(\"action\") || \"list\";\n\t\tconst sessionId = url.searchParams.get(\"sessionId\");\n\n\t\ttry {\n\t\t\tif (action === \"list\") {\n\t\t\t\tif (!sessionId) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t400,\n\t\t\t\t\t\t{ error: \"sessionId query parameter is required\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tassertSessionId(sessionId);\n\t\t\t\tconst subject = getAuthSubject(req);\n\t\t\t\tconst sessionKey = `${subject}:${sessionId}`;\n\t\t\t\tconst rate = await checkSessionRateLimitAsync(sessionKey);\n\t\t\t\tif (!rate.allowed) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t429,\n\t\t\t\t\t\t{ error: \"Too many branch requests\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tconst sessionManager = createSessionManagerForRequest(req, false);\n\t\t\t\tconst sessionFile = sessionManager.getSessionFileById(sessionId);\n\t\t\t\tif (!sessionFile) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t404,\n\t\t\t\t\t\t{ error: `Session not found: ${sessionId}` },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tconst session = await sessionManager.loadSession(sessionId);\n\t\t\t\tif (!session) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t404,\n\t\t\t\t\t\t{ error: \"Session file exists but could not be loaded\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tconst userMessages = session.messages\n\t\t\t\t\t.map((msg, index) => ({ msg, index }))\n\t\t\t\t\t.filter(\n\t\t\t\t\t\t(\n\t\t\t\t\t\t\tentry,\n\t\t\t\t\t\t): entry is { msg: UserMessageWithAttachments; index: number } =>\n\t\t\t\t\t\t\tisUserMessage(entry.msg),\n\t\t\t\t\t);\n\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t200,\n\t\t\t\t\t{\n\t\t\t\t\t\tuserMessages: userMessages.map(({ msg, index }, i) => ({\n\t\t\t\t\t\t\tnumber: i + 1,\n\t\t\t\t\t\t\tindex,\n\t\t\t\t\t\t\tsnippet: summarizeContent(msg.content),\n\t\t\t\t\t\t})),\n\t\t\t\t\t},\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tsendJson(res, 400, { error: \"Invalid action. Use list.\" }, corsHeaders);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\trespondWithApiError(res, error, 500, corsHeaders, req);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (req.method === \"POST\") {\n\t\tif (!(await requireApiAuth(req, res, corsHeaders))) return;\n\t\tif (!requireCsrf(req, res, corsHeaders)) return;\n\t\ttry {\n\t\t\tconst data = await parseAndValidateJson<BranchRequestInput>(\n\t\t\t\treq,\n\t\t\t\tBranchRequestSchema,\n\t\t\t);\n\t\t\tassertSessionId(data.sessionId);\n\t\t\tconst subject = getAuthSubject(req);\n\t\t\tconst sessionKey = `${subject}:${data.sessionId}`;\n\t\t\tconst rate = await checkSessionRateLimitAsync(sessionKey);\n\t\t\tif (!rate.allowed) {\n\t\t\t\tsendJson(res, 429, { error: \"Too many branch requests\" }, corsHeaders);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst sessionManager = createSessionManagerForRequest(req, false);\n\t\t\tconst sessionFile = sessionManager.getSessionFileById(data.sessionId);\n\t\t\tif (!sessionFile) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t404,\n\t\t\t\t\t{ error: `Session not found: ${data.sessionId}` },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst session = await sessionManager.loadSession(data.sessionId);\n\t\t\tif (!session) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t404,\n\t\t\t\t\t{ error: \"Session file exists but could not be loaded\" },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst userMessages = session.messages\n\t\t\t\t.map((msg, index) => ({ msg, index }))\n\t\t\t\t.filter(\n\t\t\t\t\t(\n\t\t\t\t\t\tentry,\n\t\t\t\t\t): entry is { msg: UserMessageWithAttachments; index: number } =>\n\t\t\t\t\t\tisUserMessage(entry.msg),\n\t\t\t\t);\n\n\t\t\tlet targetIndex: number;\n\t\t\tif (data.userMessageNumber !== undefined) {\n\t\t\t\tif (\n\t\t\t\t\tdata.userMessageNumber < 1 ||\n\t\t\t\t\tdata.userMessageNumber > userMessages.length\n\t\t\t\t) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t400,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `Invalid user message number: ${data.userMessageNumber}. Available: 1-${userMessages.length}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst targetUserMessage = userMessages[data.userMessageNumber - 1];\n\t\t\t\tif (!targetUserMessage) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t400,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `User message not found at index ${data.userMessageNumber}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\ttargetIndex = targetUserMessage.index;\n\t\t\t} else if (data.messageIndex !== undefined) {\n\t\t\t\tif (\n\t\t\t\t\tdata.messageIndex < 0 ||\n\t\t\t\t\tdata.messageIndex >= session.messages.length\n\t\t\t\t) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t400,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `Invalid message index: ${data.messageIndex}. Available: 0-${session.messages.length - 1}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\ttargetIndex = data.messageIndex;\n\t\t\t} else {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t400,\n\t\t\t\t\t{\n\t\t\t\t\t\terror: \"Either messageIndex or userMessageNumber must be provided\",\n\t\t\t\t\t},\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tsessionManager.setSessionFile(sessionFile);\n\t\t\tconst modelKey = sessionManager.loadModel();\n\t\t\tconst thinkingLevel = sessionManager.loadThinkingLevel();\n\t\t\tconst messages = session.messages.slice(0, targetIndex);\n\n\t\t\t// Create minimal agent state for branching\n\t\t\tconst { getRegisteredModels } = await import(\"../../models/registry.js\");\n\t\t\tconst registeredModels = getRegisteredModels();\n\t\t\tconst registeredModel = modelKey\n\t\t\t\t? (registeredModels.find(\n\t\t\t\t\t\t(m) => `${m.provider}/${m.id}` === modelKey || m.id === modelKey,\n\t\t\t\t\t) ?? registeredModels[0])\n\t\t\t\t: registeredModels[0];\n\n\t\t\tif (!registeredModel) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t500,\n\t\t\t\t\t{ error: \"No registered models available\" },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Create minimal AgentState for createBranchedSession\n\t\t\t// createBranchedSession only uses: messages, model, thinkingLevel\n\t\t\tconst agentState = {\n\t\t\t\tmessages,\n\t\t\t\tmodel: registeredModel,\n\t\t\t\tthinkingLevel: (thinkingLevel as \"off\" | \"low\" | \"high\") ?? \"off\",\n\t\t\t\tsystemPrompt: \"\",\n\t\t\t\ttools: [],\n\t\t\t\tsteeringMode: \"all\" as const,\n\t\t\t\tfollowUpMode: \"all\" as const,\n\t\t\t\tqueueMode: \"all\" as const,\n\t\t\t\tisStreaming: false,\n\t\t\t\tstreamMessage: null,\n\t\t\t\tpendingToolCalls: new Map<string, { toolName: string }>(),\n\t\t\t} as {\n\t\t\t\tmessages: typeof messages;\n\t\t\t\tmodel: typeof registeredModel;\n\t\t\t\tthinkingLevel: \"off\" | \"low\" | \"high\";\n\t\t\t\tsystemPrompt: string;\n\t\t\t\ttools: never[];\n\t\t\t\tsteeringMode: \"all\";\n\t\t\t\tfollowUpMode: \"all\";\n\t\t\t\tqueueMode: \"all\";\n\t\t\t\tisStreaming: boolean;\n\t\t\t\tstreamMessage: null;\n\t\t\t\tpendingToolCalls: Map<string, { toolName: string }>;\n\t\t\t};\n\n\t\t\tconst newSessionFile = sessionManager.createBranchedSession(\n\t\t\t\tagentState,\n\t\t\t\ttargetIndex,\n\t\t\t);\n\n\t\t\tconst sessionManager2 = createSessionManagerForRequest(req, false);\n\t\t\tsessionManager2.setSessionFile(newSessionFile);\n\t\t\tconst newSessionId = sessionManager2.getSessionId();\n\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t200,\n\t\t\t\t{\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\tnewSessionId,\n\t\t\t\t\tnewSessionFile,\n\t\t\t\t\tmessage: `Created branch from message index ${targetIndex}`,\n\t\t\t\t},\n\t\t\t\tcorsHeaders,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\trespondWithApiError(res, error, 500, corsHeaders, req);\n\t\t}\n\t\treturn;\n\t}\n\n\tsendJson(res, 405, { error: \"Method not allowed\" }, corsHeaders);\n}\n"]}
+{"version":3,"file":"branch.js","sourceRoot":"","sources":["../../../src/server/handlers/branch.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACzD,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CAC9D,CAAC,CAAC;AAIH,SAAS,eAAe,CAAC,SAAiB;IACzC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7C,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,MAAM,GAAG,GAAG;IACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO;aAClB,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CACL,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC;YACD,MAAM,IAAI,CAAC;YACV,CAAsB,CAAC,IAAI,KAAK,MAAM,CACxC;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAuB,CAAC,IAAI,IAAI,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAoB,EACpB,GAAmB,EACnB,WAAmC;IAEnC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAClB,GAAG,CAAC,GAAG,IAAI,aAAa,EACxB,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC;YACJ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAClD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBAED,eAAe,CAAC,SAAS,CAAC,CAAC;gBAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;gBACpC,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;gBAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACnB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,0BAA0B,EAAE,EACrC,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBAED,MAAM,cAAc,GAAG,iCAAiC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACrE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;oBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,sBAAsB,SAAS,EAAE,EAAE,EAC5C,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ;qBACnC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;qBACrC,MAAM,CACN,CACC,KAAK,EACyD,EAAE,CAChE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CACzB,CAAC;gBAEH,QAAQ,CACP,GAAG,EACH,GAAG,EACH;oBACC,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;wBACtD,MAAM,EAAE,CAAC,GAAG,CAAC;wBACb,KAAK;wBACL,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;qBACtC,CAAC,CAAC;iBACH,EACD,WAAW,CACX,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,WAAW,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO;QAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC;YAAE,OAAO;QAChD,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACtC,GAAG,EACH,mBAAmB,CACnB,CAAC;YACF,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,WAAW,CAAC,CAAC;gBACvE,OAAO;YACR,CAAC;YAED,MAAM,cAAc,GAAG,iCAAiC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,SAAS,EAAE,EAAE,EACjD,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ;iBACnC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;iBACrC,MAAM,CACN,CACC,KAAK,EACyD,EAAE,CAChE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CACzB,CAAC;YAEH,IAAI,WAAmB,CAAC;YACxB,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC1C,IACC,IAAI,CAAC,iBAAiB,GAAG,CAAC;oBAC1B,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC,MAAM,EAC3C,CAAC;oBACF,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EAAE,gCAAgC,IAAI,CAAC,iBAAiB,kBAAkB,YAAY,CAAC,MAAM,EAAE;qBACpG,EACD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,MAAM,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC;gBACnE,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACxB,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EAAE,mCAAmC,IAAI,CAAC,iBAAiB,EAAE;qBAClE,EACD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACvC,CAAC;iBAAM,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC5C,IACC,IAAI,CAAC,YAAY,GAAG,CAAC;oBACrB,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAC3C,CAAC;oBACF,QAAQ,CACP,GAAG,EACH,GAAG,EACH;wBACC,KAAK,EAAE,0BAA0B,IAAI,CAAC,YAAY,kBAAkB,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;qBACjG,EACD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACP,QAAQ,CACP,GAAG,EACH,GAAG,EACH;oBACC,KAAK,EAAE,2DAA2D;iBAClE,EACD,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YAED,IAAI,sBAAsB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5C,MAAM,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACP,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtE,IAAI,CAAC,WAAW,EAAE,CAAC;oBAClB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,SAAS,EAAE,EAAE,EACjD,WAAW,CACX,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,cAAc,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAExD,2CAA2C;YAC3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;YAC/C,MAAM,eAAe,GAAG,QAAQ;gBAC/B,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAChE,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAEvB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACtB,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAC3C,WAAW,CACX,CAAC;gBACF,OAAO;YACR,CAAC;YAED,sDAAsD;YACtD,kEAAkE;YAClE,MAAM,UAAU,GAAG;gBAClB,QAAQ;gBACR,KAAK,EAAE,eAAe;gBACtB,aAAa,EAAG,aAAwC,IAAI,KAAK;gBACjE,YAAY,EAAE,EAAE;gBAChB,KAAK,EAAE,EAAE;gBACT,YAAY,EAAE,KAAc;gBAC5B,YAAY,EAAE,KAAc;gBAC5B,SAAS,EAAE,KAAc;gBACzB,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,IAAI;gBACnB,gBAAgB,EAAE,IAAI,GAAG,EAAgC;aAazD,CAAC;YAEF,IAAI,YAAoB,CAAC;YACzB,IAAI,cAAsB,CAAC;YAC3B,IAAI,sBAAsB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5C,YAAY,GAAG,MAAM,cAAc,CAAC,8BAA8B,CACjE,UAAU,EACV,WAAW,CACX,CAAC;gBACF,cAAc,GAAG,MAAM,YAAY,EAAE,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACP,cAAc,GAAG,cAAc,CAAC,qBAAqB,CACpD,UAAU,EACV,WAAW,CACX,CAAC;gBACF,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACtE,eAAe,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;gBAC/C,YAAY,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC;YAC/C,CAAC;YAED,QAAQ,CACP,GAAG,EACH,GAAG,EACH;gBACC,OAAO,EAAE,IAAI;gBACb,YAAY;gBACZ,cAAc;gBACd,OAAO,EAAE,qCAAqC,WAAW,EAAE;aAC3D,EACD,WAAW,CACX,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,OAAO;IACR,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { isUserMessage } from \"../../agent/type-guards.js\";\nimport type { UserMessageWithAttachments } from \"../../agent/types.js\";\nimport { getAuthSubject, requireApiAuth, requireCsrf } from \"../authz.js\";\nimport { isHostedSessionManager } from \"../hosted-session-manager.js\";\nimport { respondWithApiError, sendJson } from \"../server-utils.js\";\nimport { createWebSessionManagerForRequest } from \"../session-scope.js\";\nimport { checkSessionRateLimitAsync } from \"../utils/session-rate-limit.js\";\nimport { parseAndValidateJson } from \"../validation.js\";\n\nconst BranchRequestSchema = Type.Object({\n\tsessionId: Type.String({ minLength: 1 }),\n\tmessageIndex: Type.Optional(Type.Integer({ minimum: 0 })),\n\tuserMessageNumber: Type.Optional(Type.Integer({ minimum: 1 })),\n});\n\ntype BranchRequestInput = Static<typeof BranchRequestSchema>;\n\nfunction assertSessionId(sessionId: string): void {\n\tif (!/^[A-Za-z0-9._-]+$/.test(sessionId)) {\n\t\tthrow new Error(\"Invalid sessionId format\");\n\t}\n}\n\nfunction summarizeContent(content: unknown, maxLen = 160): string {\n\tif (typeof content === \"string\") {\n\t\treturn content.slice(0, maxLen);\n\t}\n\tif (Array.isArray(content)) {\n\t\tconst text = content\n\t\t\t.filter(\n\t\t\t\t(c) =>\n\t\t\t\t\ttypeof c === \"object\" &&\n\t\t\t\t\tc &&\n\t\t\t\t\t\"type\" in c &&\n\t\t\t\t\t(c as { type: string }).type === \"text\",\n\t\t\t)\n\t\t\t.map((c) => (c as { text?: string }).text || \"\")\n\t\t\t.join(\"\\n\");\n\t\treturn text.slice(0, maxLen);\n\t}\n\treturn \"\";\n}\n\nexport async function handleBranch(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcorsHeaders: Record<string, string>,\n) {\n\tif (req.method === \"GET\") {\n\t\tif (!(await requireApiAuth(req, res, corsHeaders))) return;\n\t\tconst url = new URL(\n\t\t\treq.url || \"/api/branch\",\n\t\t\t`http://${req.headers.host || \"localhost\"}`,\n\t\t);\n\t\tconst action = url.searchParams.get(\"action\") || \"list\";\n\t\tconst sessionId = url.searchParams.get(\"sessionId\");\n\n\t\ttry {\n\t\t\tif (action === \"list\") {\n\t\t\t\tif (!sessionId) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t400,\n\t\t\t\t\t\t{ error: \"sessionId query parameter is required\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tassertSessionId(sessionId);\n\t\t\t\tconst subject = getAuthSubject(req);\n\t\t\t\tconst sessionKey = `${subject}:${sessionId}`;\n\t\t\t\tconst rate = await checkSessionRateLimitAsync(sessionKey);\n\t\t\t\tif (!rate.allowed) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t429,\n\t\t\t\t\t\t{ error: \"Too many branch requests\" },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tconst sessionManager = createWebSessionManagerForRequest(req, false);\n\t\t\t\tconst session = await sessionManager.loadSession(sessionId);\n\t\t\t\tif (!session) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t404,\n\t\t\t\t\t\t{ error: `Session not found: ${sessionId}` },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tconst userMessages = session.messages\n\t\t\t\t\t.map((msg, index) => ({ msg, index }))\n\t\t\t\t\t.filter(\n\t\t\t\t\t\t(\n\t\t\t\t\t\t\tentry,\n\t\t\t\t\t\t): entry is { msg: UserMessageWithAttachments; index: number } =>\n\t\t\t\t\t\t\tisUserMessage(entry.msg),\n\t\t\t\t\t);\n\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t200,\n\t\t\t\t\t{\n\t\t\t\t\t\tuserMessages: userMessages.map(({ msg, index }, i) => ({\n\t\t\t\t\t\t\tnumber: i + 1,\n\t\t\t\t\t\t\tindex,\n\t\t\t\t\t\t\tsnippet: summarizeContent(msg.content),\n\t\t\t\t\t\t})),\n\t\t\t\t\t},\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tsendJson(res, 400, { error: \"Invalid action. Use list.\" }, corsHeaders);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\trespondWithApiError(res, error, 500, corsHeaders, req);\n\t\t}\n\t\treturn;\n\t}\n\n\tif (req.method === \"POST\") {\n\t\tif (!(await requireApiAuth(req, res, corsHeaders))) return;\n\t\tif (!requireCsrf(req, res, corsHeaders)) return;\n\t\ttry {\n\t\t\tconst data = await parseAndValidateJson<BranchRequestInput>(\n\t\t\t\treq,\n\t\t\t\tBranchRequestSchema,\n\t\t\t);\n\t\t\tassertSessionId(data.sessionId);\n\t\t\tconst subject = getAuthSubject(req);\n\t\t\tconst sessionKey = `${subject}:${data.sessionId}`;\n\t\t\tconst rate = await checkSessionRateLimitAsync(sessionKey);\n\t\t\tif (!rate.allowed) {\n\t\t\t\tsendJson(res, 429, { error: \"Too many branch requests\" }, corsHeaders);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst sessionManager = createWebSessionManagerForRequest(req, false);\n\t\t\tconst session = await sessionManager.loadSession(data.sessionId);\n\t\t\tif (!session) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t404,\n\t\t\t\t\t{ error: `Session not found: ${data.sessionId}` },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst userMessages = session.messages\n\t\t\t\t.map((msg, index) => ({ msg, index }))\n\t\t\t\t.filter(\n\t\t\t\t\t(\n\t\t\t\t\t\tentry,\n\t\t\t\t\t): entry is { msg: UserMessageWithAttachments; index: number } =>\n\t\t\t\t\t\tisUserMessage(entry.msg),\n\t\t\t\t);\n\n\t\t\tlet targetIndex: number;\n\t\t\tif (data.userMessageNumber !== undefined) {\n\t\t\t\tif (\n\t\t\t\t\tdata.userMessageNumber < 1 ||\n\t\t\t\t\tdata.userMessageNumber > userMessages.length\n\t\t\t\t) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t400,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `Invalid user message number: ${data.userMessageNumber}. Available: 1-${userMessages.length}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst targetUserMessage = userMessages[data.userMessageNumber - 1];\n\t\t\t\tif (!targetUserMessage) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t400,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `User message not found at index ${data.userMessageNumber}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\ttargetIndex = targetUserMessage.index;\n\t\t\t} else if (data.messageIndex !== undefined) {\n\t\t\t\tif (\n\t\t\t\t\tdata.messageIndex < 0 ||\n\t\t\t\t\tdata.messageIndex >= session.messages.length\n\t\t\t\t) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t400,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `Invalid message index: ${data.messageIndex}. Available: 0-${session.messages.length - 1}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\ttargetIndex = data.messageIndex;\n\t\t\t} else {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t400,\n\t\t\t\t\t{\n\t\t\t\t\t\terror: \"Either messageIndex or userMessageNumber must be provided\",\n\t\t\t\t\t},\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (isHostedSessionManager(sessionManager)) {\n\t\t\t\tawait sessionManager.resumeSession(data.sessionId);\n\t\t\t} else {\n\t\t\t\tconst sessionFile = sessionManager.getSessionFileById(data.sessionId);\n\t\t\t\tif (!sessionFile) {\n\t\t\t\t\tsendJson(\n\t\t\t\t\t\tres,\n\t\t\t\t\t\t404,\n\t\t\t\t\t\t{ error: `Session not found: ${data.sessionId}` },\n\t\t\t\t\t\tcorsHeaders,\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tsessionManager.setSessionFile(sessionFile);\n\t\t\t}\n\t\t\tconst modelKey = sessionManager.loadModel();\n\t\t\tconst thinkingLevel = sessionManager.loadThinkingLevel();\n\t\t\tconst messages = session.messages.slice(0, targetIndex);\n\n\t\t\t// Create minimal agent state for branching\n\t\t\tconst { getRegisteredModels } = await import(\"../../models/registry.js\");\n\t\t\tconst registeredModels = getRegisteredModels();\n\t\t\tconst registeredModel = modelKey\n\t\t\t\t? (registeredModels.find(\n\t\t\t\t\t\t(m) => `${m.provider}/${m.id}` === modelKey || m.id === modelKey,\n\t\t\t\t\t) ?? registeredModels[0])\n\t\t\t\t: registeredModels[0];\n\n\t\t\tif (!registeredModel) {\n\t\t\t\tsendJson(\n\t\t\t\t\tres,\n\t\t\t\t\t500,\n\t\t\t\t\t{ error: \"No registered models available\" },\n\t\t\t\t\tcorsHeaders,\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Create minimal AgentState for createBranchedSession\n\t\t\t// createBranchedSession only uses: messages, model, thinkingLevel\n\t\t\tconst agentState = {\n\t\t\t\tmessages,\n\t\t\t\tmodel: registeredModel,\n\t\t\t\tthinkingLevel: (thinkingLevel as \"off\" | \"low\" | \"high\") ?? \"off\",\n\t\t\t\tsystemPrompt: \"\",\n\t\t\t\ttools: [],\n\t\t\t\tsteeringMode: \"all\" as const,\n\t\t\t\tfollowUpMode: \"all\" as const,\n\t\t\t\tqueueMode: \"all\" as const,\n\t\t\t\tisStreaming: false,\n\t\t\t\tstreamMessage: null,\n\t\t\t\tpendingToolCalls: new Map<string, { toolName: string }>(),\n\t\t\t} as {\n\t\t\t\tmessages: typeof messages;\n\t\t\t\tmodel: typeof registeredModel;\n\t\t\t\tthinkingLevel: \"off\" | \"low\" | \"high\";\n\t\t\t\tsystemPrompt: string;\n\t\t\t\ttools: never[];\n\t\t\t\tsteeringMode: \"all\";\n\t\t\t\tfollowUpMode: \"all\";\n\t\t\t\tqueueMode: \"all\";\n\t\t\t\tisStreaming: boolean;\n\t\t\t\tstreamMessage: null;\n\t\t\t\tpendingToolCalls: Map<string, { toolName: string }>;\n\t\t\t};\n\n\t\t\tlet newSessionId: string;\n\t\t\tlet newSessionFile: string;\n\t\t\tif (isHostedSessionManager(sessionManager)) {\n\t\t\t\tnewSessionId = await sessionManager.createBranchedSessionFromState(\n\t\t\t\t\tagentState,\n\t\t\t\t\ttargetIndex,\n\t\t\t\t);\n\t\t\t\tnewSessionFile = `db:${newSessionId}`;\n\t\t\t} else {\n\t\t\t\tnewSessionFile = sessionManager.createBranchedSession(\n\t\t\t\t\tagentState,\n\t\t\t\t\ttargetIndex,\n\t\t\t\t);\n\t\t\t\tconst sessionManager2 = createWebSessionManagerForRequest(req, false);\n\t\t\t\tsessionManager2.setSessionFile(newSessionFile);\n\t\t\t\tnewSessionId = sessionManager2.getSessionId();\n\t\t\t}\n\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t200,\n\t\t\t\t{\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\tnewSessionId,\n\t\t\t\t\tnewSessionFile,\n\t\t\t\t\tmessage: `Created branch from message index ${targetIndex}`,\n\t\t\t\t},\n\t\t\t\tcorsHeaders,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\trespondWithApiError(res, error, 500, corsHeaders, req);\n\t\t}\n\t\treturn;\n\t}\n\n\tsendJson(res, 405, { error: \"Method not allowed\" }, corsHeaders);\n}\n"]}

package/dist/server/handlers/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAU1D,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,gBAAgB,GACvB,IAAI,CAsBN"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAe1D,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,gBAAgB,GACvB,IAAI,CAsBN"}