@ggui-ai/mcp-server 0.6.3 → 0.8.0

package/dist/api-renders-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-renders-routes.d.ts","sourceRoot":"","sources":["../src/api-renders-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAO9F,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAwU9D"}
+{"version":3,"file":"api-renders-routes.d.ts","sourceRoot":"","sources":["../src/api-renders-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAO9F,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAgV9D"}

package/dist/api-renders-routes.js

@@ -179,7 +179,15 @@ export function mountApiRendersRoutes(opts) {
                     renderCodeUrl = `${base}/code/${hash}.js`;
                 }
                 catch {
-                    // Silent — caller falls back to live-mode delivery.
+                    // Silent — the caller falls back to live-mode delivery, and
+                    // here that fallback is structural rather than hoped for:
+                    // `mintBootstrap` is optional on the options type, but these
+                    // routes mount only under `mcpAppsEnabled` + a render store
+                    // + a token secret, which are the same preconditions that
+                    // assign the minter. So a reader of THIS file cannot see the
+                    // guarantee — it lives at the mount site, and it is what
+                    // keeps the silence honest. Lose that pairing and this catch
+                    // becomes a swallow.
                 }
                 try {
                     const bundle = await deriveContractBundle(render);

package/dist/browser-cors.d.ts

@@ -0,0 +1,29 @@
+/**
+ * CORS for browser-resident MCP clients (ggui#438b).
+ *
+ * SCOPE: this is enablement, not conformance. No MCP spec layer requires
+ * CORS — the transport spec never mentions it, and the MCP Apps spec is
+ * fully host-mediated (the view postMessages its host; the host holds the
+ * MCP connection). claude.ai and ChatGPT connect to remote MCP servers
+ * from their BACKENDS, so they need none of this. It exists for clients
+ * where the browser itself holds the Streamable HTTP connection: guuey's
+ * browser host layer, local dev SPAs, Electron renderers.
+ *
+ * POSTURE: an origin ALLOWLIST, never `*`. The three existing `*` routes
+ * (runtime-bundle, code, api-renders) are credential-free or token-gated
+ * public reads; `/mcp` is different — `cookieAuthMiddleware` promotes the
+ * session cookie to a Bearer on it, so it belongs to the cookie-authed
+ * class. `Access-Control-Allow-Credentials` is NEVER set.
+ *
+ * LAYER RELATIONSHIP: origin-validation runs first and decides WHETHER a
+ * request executes at all (the spec-mandated 403); this layer decides HOW
+ * the browser is told it may read the response. A disallowed origin never
+ * reaches this layer's headers in production — its rejection branch is
+ * defense-in-depth. CORS is never the security boundary.
+ */
+import type { RequestHandler } from "express";
+import { type OriginHostPolicy } from "./origin-validation.js";
+export declare function createBrowserCorsMiddleware(opts: {
+    readonly policy: OriginHostPolicy;
+}): RequestHandler;
+//# sourceMappingURL=browser-cors.d.ts.map

package/dist/browser-cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-cors.d.ts","sourceRoot":"","sources":["../src/browser-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AA8BnF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GAAG,cAAc,CA+CjB"}

package/dist/browser-cors.js

@@ -0,0 +1,64 @@
+import { validateOriginHost } from "./origin-validation.js";
+/**
+ * Response headers the MCP client MUST be able to read.
+ *
+ * Both are silent-failure modes: the SDK client reads `Mcp-Session-Id`
+ * off every response and echoes it on subsequent requests — without
+ * exposure the browser hands back `null`, initialize appears to succeed,
+ * and every later request fails against a stateful server. It reads
+ * `WWW-Authenticate` off 401s to discover the OAuth resource metadata
+ * URL; without exposure, discovery silently degrades to guessing
+ * default well-known paths.
+ */
+const EXPOSE_HEADERS = "Mcp-Session-Id, WWW-Authenticate";
+/**
+ * Fallback allow-headers when the preflight omits
+ * `Access-Control-Request-Headers`. `Authorization` MUST be named
+ * explicitly — per the Fetch spec, `*` does not cover it.
+ */
+const DEFAULT_ALLOW_HEADERS = "Authorization, Content-Type, Accept, Mcp-Session-Id, MCP-Protocol-Version, Last-Event-ID";
+/** GET and DELETE are permitted even though ggui answers them 405: the
+ *  SDK client auto-attempts both and tolerates 405 — but only if the
+ *  browser lets it read the status. */
+const ALLOW_METHODS = "GET, POST, DELETE, OPTIONS";
+const MAX_AGE_SECONDS = "600";
+export function createBrowserCorsMiddleware(opts) {
+    const { policy } = opts;
+    return (req, res, next) => {
+        const origin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
+        // No Origin — a non-browser client. Nothing to negotiate.
+        if (origin === undefined || origin.length === 0) {
+            if (req.method === "OPTIONS") {
+                res.status(204).end();
+                return;
+            }
+            next();
+            return;
+        }
+        // The SAME allowlist that governs validation governs CORS, so an
+        // origin can never be CORS-allowed but Origin-rejected.
+        const allowed = validateOriginHost(req.headers.host, origin, policy) === null;
+        if (allowed) {
+            res.setHeader("Access-Control-Allow-Origin", origin);
+            // Echoing a specific origin makes the response origin-dependent.
+            res.setHeader("Vary", "Origin");
+            res.setHeader("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+            // NOTE: Access-Control-Allow-Credentials is deliberately never set.
+        }
+        if (req.method === "OPTIONS") {
+            if (allowed) {
+                res.setHeader("Access-Control-Allow-Methods", ALLOW_METHODS);
+                // Reflect the requested headers so host-injected extras (a
+                // request-id, say) do not require a code change here.
+                const requested = req.headers["access-control-request-headers"];
+                res.setHeader("Access-Control-Allow-Headers", typeof requested === "string" && requested.length > 0 ? requested : DEFAULT_ALLOW_HEADERS);
+                res.setHeader("Access-Control-Max-Age", MAX_AGE_SECONDS);
+            }
+            // A disallowed preflight gets a bare 204 with no CORS headers —
+            // the browser fails the request, which is the intended outcome.
+            res.status(204).end();
+            return;
+        }
+        next();
+    };
+}

package/dist/build-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-mcp.d.ts","sourceRoot":"","sources":["../src/build-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAK,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;CACtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAChE,UAAU,EAAE,MAAM,cAAc,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,qBAA0B,GAC/B,SAAS,CAiLX"}
+{"version":3,"file":"build-mcp.d.ts","sourceRoot":"","sources":["../src/build-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAK,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;CACtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAChE,UAAU,EAAE,MAAM,cAAc,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,qBAA0B,GAC/B,SAAS,CAqLX"}

package/dist/build-mcp.js

@@ -31,8 +31,12 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
     if (opts.mcpAppsOutbound) {
         installMcpAppsOutbound(server, {
             ...(opts.shellHtml !== undefined ? { shellHtml: opts.shellHtml } : {}),
+            // Thread the same per-request context accessor + logger the tool
+            // path uses (`getContext`, param 3 of `buildMcpServer`) so the
+            // per-session resource handler's render-read gate sees the
+            // caller (render-read-gate.ts).
             ...(opts.selfContained !== undefined
-                ? { selfContained: opts.selfContained }
+                ? { selfContained: { ...opts.selfContained, getContext, logger } }
                 : {}),
             ...(opts.publicBaseUrl !== undefined
                 ? { publicBaseUrl: opts.publicBaseUrl }

package/dist/code-store-fs.d.ts

@@ -8,12 +8,15 @@ export interface FileSystemCodeStoreOptions {
     readonly root?: string;
 }
 export declare class FileSystemCodeStore implements CodeStore {
+    /** Bodies live on disk under the cache root — restart-safe (#457). */
+    readonly durability: "durable";
     private readonly root;
     constructor(opts?: FileSystemCodeStoreOptions);
     /** Absolute on-disk path for a given hash. Two-level sharded layout. */
     private absPath;
     put(hash: string, code: string): Promise<void>;
     get(hash: string): Promise<string | null>;
+    delete(hash: string): Promise<void>;
     hashOf(code: string): string;
 }
 //# sourceMappingURL=code-store-fs.d.ts.map

package/dist/code-store-fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-store-fs.d.ts","sourceRoot":"","sources":["../src/code-store-fs.ts"],"names":[],"mappings":"AAmDA,OAAO,EAEL,KAAK,SAAS,EACf,MAAM,0BAA0B,CAAC;AAElC,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,mBAAoB,YAAW,SAAS;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,IAAI,GAAE,0BAA+B;IAIjD,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAMT,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB9C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAG7B"}
+{"version":3,"file":"code-store-fs.d.ts","sourceRoot":"","sources":["../src/code-store-fs.ts"],"names":[],"mappings":"AAuDA,OAAO,EAEL,KAAK,SAAS,EACf,MAAM,0BAA0B,CAAC;AAElC,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,mBAAoB,YAAW,SAAS;IACnD,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,IAAI,GAAE,0BAA+B;IAIjD,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAOT,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB9C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUzC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBzC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAG7B"}

package/dist/code-store-fs.js

@@ -29,7 +29,10 @@
  * The store grows unbounded. Operators who care can periodically
  * `rm -rf ~/.ggui/code-cache/` — every entry is content-addressable
  * and immutable, so a re-fetch will repopulate from upstream code on
- * next render. There is no eviction policy in the seam itself.
+ * next render. `delete(hash)` removes one entry (unlink, ENOENT
+ * tolerated) for operators who need to act on a single bundle rather
+ * than the whole root. There is no eviction policy in the seam itself
+ * — nothing here decides what to remove or when.
  *
  * ## Permissions
  *
@@ -39,11 +42,13 @@
  * tighter perms wrap with their own umask.
  */
 import { createHash } from 'node:crypto';
-import { access, constants as fsConstants, mkdir, readFile, rename, writeFile, } from 'node:fs/promises';
+import { access, constants as fsConstants, mkdir, readFile, rename, unlink, writeFile, } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { CODE_HASH_REGEX, } from '@ggui-ai/mcp-server-core';
 export class FileSystemCodeStore {
+    /** Bodies live on disk under the cache root — restart-safe (#457). */
+    durability = 'durable';
     root;
     constructor(opts = {}) {
         this.root = opts.root ?? join(homedir(), '.ggui', 'code-cache');
@@ -51,7 +56,8 @@ export class FileSystemCodeStore {
     /** Absolute on-disk path for a given hash. Two-level sharded layout. */
     absPath(hash) {
         // Sharding: `<root>/<hash[0..2]>/<hash[2..]>.js`. Validation on
-        // every put + get below means `hash` is always 64 lowercase hex.
+        // every put + get + delete below means `hash` is always 64
+        // lowercase hex.
         return join(this.root, hash.slice(0, 2), `${hash.slice(2)}.js`);
     }
     async put(hash, code) {
@@ -83,6 +89,24 @@ export class FileSystemCodeStore {
             throw err;
         }
     }
+    async delete(hash) {
+        // Validate before deriving a path: an unchecked hash could carry
+        // `..` segments and unlink a file outside the cache root. Same
+        // narrowing `get` applies, and like `get` a malformed key is not
+        // an error — there is simply nothing here under that name.
+        if (!CODE_HASH_REGEX.test(hash))
+            return;
+        try {
+            await unlink(this.absPath(hash));
+        }
+        catch (err) {
+            // Absent file = already removed. The shard directory is left in
+            // place; empty dirs cost one inode and the next put refills them.
+            if (err.code === 'ENOENT')
+                return;
+            throw err;
+        }
+    }
     hashOf(code) {
         return createHash('sha256').update(code, 'utf-8').digest('hex');
     }

package/dist/console-session-routes.d.ts

@@ -8,11 +8,16 @@
  *
  *   GET /ggui/console/session-resource?session=<sessionId>
  *     — production thin-shell HTML, wrapped as a ResourceContents
- *       blob (`text` IS `GGUI_RENDER_SHELL_HTML`, byte-identical to
- *       what Claude Desktop fetches via MCP `resources/read
- *       ui://ggui/render`). NO inlined bootstrap — console fetches
- *       the bootstrap separately (meta route below) and replies to
- *       the iframe's `ui/initialize` postMessage with it.
+ *       blob (`text` IS the `GGUI_RENDER_SHELL_HTML` constant). On a
+ *       default mount this matches what a host fetches via MCP
+ *       `resources/read ui://ggui/render`; a mount opted into
+ *       `mcpApps.inlineRuntimeShell` (or a custom `shellHtml`) serves
+ *       a different body on the MCP path while THIS route keeps the
+ *       thin shell — its first-party srcdoc/WebView consumers load
+ *       external scripts fine and rely on the pinned CSP hash. NO
+ *       inlined bootstrap — console fetches the bootstrap separately
+ *       (meta route below) and replies to the iframe's
+ *       `ui/initialize` postMessage with it.
  *
  *   GET /ggui/console/sessions/:sessionId/meta
  *     — slice-envelope JSON (`{ "ai.ggui/render": {...} }`, the same

package/dist/console-session-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"console-session-routes.d.ts","sourceRoot":"","sources":["../src/console-session-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAQ5F,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAQ1D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,uEAAuE;IACvE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,YAAY,GAAG,4BAA4B,CA0V1F"}
+{"version":3,"file":"console-session-routes.d.ts","sourceRoot":"","sources":["../src/console-session-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAQ5F,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAQ1D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,uEAAuE;IACvE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,YAAY,GAAG,4BAA4B,CA0V1F"}

package/dist/console-session-routes.js

@@ -8,11 +8,16 @@
  *
  *   GET /ggui/console/session-resource?session=<sessionId>
  *     — production thin-shell HTML, wrapped as a ResourceContents
- *       blob (`text` IS `GGUI_RENDER_SHELL_HTML`, byte-identical to
- *       what Claude Desktop fetches via MCP `resources/read
- *       ui://ggui/render`). NO inlined bootstrap — console fetches
- *       the bootstrap separately (meta route below) and replies to
- *       the iframe's `ui/initialize` postMessage with it.
+ *       blob (`text` IS the `GGUI_RENDER_SHELL_HTML` constant). On a
+ *       default mount this matches what a host fetches via MCP
+ *       `resources/read ui://ggui/render`; a mount opted into
+ *       `mcpApps.inlineRuntimeShell` (or a custom `shellHtml`) serves
+ *       a different body on the MCP path while THIS route keeps the
+ *       thin shell — its first-party srcdoc/WebView consumers load
+ *       external scripts fine and rely on the pinned CSP hash. NO
+ *       inlined bootstrap — console fetches the bootstrap separately
+ *       (meta route below) and replies to the iframe's
+ *       `ui/initialize` postMessage with it.
  *
  *   GET /ggui/console/sessions/:sessionId/meta
  *     — slice-envelope JSON (`{ "ai.ggui/render": {...} }`, the same

package/dist/ggui-session-channel/outbound.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,wBAAwB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,aAAa,CAAC;AAElB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;CAClF;AAED,+DAA+D;AAC/D,MAAM,WAAW,QAAQ;IACvB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjD,8DAA8D;IAC9D,SAAS,CACP,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,IAAI,CAAC;IACR;;;;;;;;;;OAUG;IACH,gBAAgB,CACd,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,IAAI,CAAC;IACR,sEAAsE;IACtE,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,4EAA4E;IAC5E,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F,oEAAoE;IACpE,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,iEAAiE;IACjE,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT,sEAAsE;IACtE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAsM3D"}
+{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,wBAAwB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,aAAa,CAAC;AAElB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;CAClF;AAED,+DAA+D;AAC/D,MAAM,WAAW,QAAQ;IACvB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjD,8DAA8D;IAC9D,SAAS,CACP,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,IAAI,CAAC;IACR;;;;;;;;;;OAUG;IACH,gBAAgB,CACd,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,IAAI,CAAC;IACR,sEAAsE;IACtE,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,4EAA4E;IAC5E,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F,oEAAoE;IACpE,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,iEAAiE;IACjE,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT,sEAAsE;IACtE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAoN3D"}

package/dist/ggui-session-channel/outbound.js

@@ -158,6 +158,18 @@ export function createOutbound(deps) {
         for (const sub of deps.wsSubscribers) {
             if (sub.sessionId !== sessionId)
                 continue;
+            // Mirror the in-process pump's replay-dedupe guard
+            // (subscriber-lifecycle.ts): a data frame whose per-session seq
+            // is <= the subscriber's replay snapshot was already delivered by
+            // subscribe-replay (policy 'all'/'latest') or is deliberately
+            // invisible to late subscribers (policy 'none') — never re-send.
+            // Unstamped frames were never buffered; replay cannot duplicate
+            // them, so they pass. Non-data frames carry no seq semantics.
+            if (frame.type === "data" &&
+                typeof frame.payload.seq === "number" &&
+                frame.payload.seq <= sub.replayCompletedSeq) {
+                continue;
+            }
             send(sub.ws, frame);
         }
     }

package/dist/ggui-session-channel/socket-router.d.ts

@@ -14,6 +14,35 @@ import type { Subscriber } from "./internal-types.js";
 import type { Outbound } from "./outbound.js";
 import type { SubscribeHandlers } from "./subscribe.js";
 import type { SubscriberLifecycle } from "./subscriber-lifecycle.js";
+/**
+ * Monotonic counters for pre-subscribe cap-driven closures/refusals.
+ * The channel server owns the object (so its health getter can read a
+ * live snapshot) and hands the same reference to the router, which
+ * increments a field on every enforced cap. See {@link PreSubscribeCaps}.
+ */
+export interface PreSubscribeRejectionCounters {
+    /** Oversized pre-subscribe frames rejected (1009). */
+    payload: number;
+    /** Pre-subscribe sockets closed for exceeding the idle window (1008). */
+    idle: number;
+    /** Upgrades refused for exceeding the pre-subscribe connection ceiling (1013). */
+    connection: number;
+}
+/**
+ * Resolved pre-subscribe cap thresholds (ggui#444). Each bounds only
+ * what a NOT-YET-SUBSCRIBED (unauthenticated / unregistered) socket can
+ * consume — a socket that has completed a valid `subscribe` is a
+ * legitimate long-lived subscriber and is exempt from all three. A
+ * value of `0` disables that cap.
+ */
+export interface PreSubscribeCaps {
+    /** Per-frame byte ceiling on pre-subscribe frames. 0 = disabled. */
+    readonly maxPayloadBytes: number;
+    /** Idle window (ms) a socket has to complete a valid subscribe. 0 = disabled. */
+    readonly idleMs: number;
+    /** Concurrent pending (pre-subscribe) socket ceiling. 0 = disabled. */
+    readonly maxConnections: number;
+}
 export interface SocketRouterDeps {
     readonly logger: Logger;
     /** GguiSession backing store — observation-message patches persist here. */
@@ -27,6 +56,10 @@ export interface SocketRouterDeps {
     readonly handleInboundAction: ActionIngress["handleInboundAction"];
     readonly handleChannelSubscribe: ChannelSubscriptions["handleChannelSubscribe"];
     readonly handleChannelUnsubscribe: ChannelSubscriptions["handleChannelUnsubscribe"];
+    /** Resolved pre-subscribe cap thresholds (ggui#444). */
+    readonly preSubscribeCaps: PreSubscribeCaps;
+    /** Shared monotonic counters incremented on each enforced cap. */
+    readonly preSubscribeRejections: PreSubscribeRejectionCounters;
 }
 /**
  * Wire the channel's `connection` handling onto `wss`. Reads the

package/dist/ggui-session-channel/socket-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"socket-router.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/socket-router.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAInF,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACzD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACvD,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACnE,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IAChF,QAAQ,CAAC,wBAAwB,EAAE,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;CACrF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAkQrF"}
+{"version":3,"file":"socket-router.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/socket-router.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAInF,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACzD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACvD,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACnE,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IAChF,QAAQ,CAAC,wBAAwB,EAAE,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IACpF,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,kEAAkE;IAClE,QAAQ,CAAC,sBAAsB,EAAE,6BAA6B,CAAC;CAChE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAmarF"}

package/dist/ggui-session-channel/socket-router.js

@@ -12,6 +12,65 @@
  * frame processing per socket.
  */
 export function attachSocketRouter(wss, deps) {
+    const { preSubscribeCaps: caps, preSubscribeRejections: rejections } = deps;
+    // --- Pre-subscribe cap state (ggui#444) -------------------------------
+    //
+    // These bound what a socket can consume BEFORE it completes a valid
+    // `subscribe`. The distinguishing signal is `subscribersByWs.get(ws)`:
+    // unset = pre-subscribe (bounded), set = registered subscriber
+    // (exempt). All three caps target the pre-subscribe window only.
+    /** Live count of PENDING (pre-subscribe) sockets — never counts subscribers. */
+    let preSubscribeCount = 0;
+    /** Sockets currently counted against {@link preSubscribeCount}. */
+    const countedPending = new WeakSet();
+    /** Per-socket idle-timeout handle, cleared on subscribe or close. */
+    const idleTimers = new WeakMap();
+    /**
+     * Sockets already closed for the pre-subscribe payload cap. A single
+     * abusive burst can deliver several oversized frames in one read
+     * before `ws.close()` settles the connection (each already-parsed
+     * frame still fires its own `message` event); without this guard
+     * every one of them would re-run the payload branch and re-increment
+     * `rejections.payload` for what is really one abusive socket. Holds
+     * no resource of its own, so it needs no explicit cleanup — the
+     * entry is collected once the socket is.
+     */
+    const payloadRejected = new WeakSet();
+    /**
+     * Deduped cap-hit log keys. Capped so a flood cannot grow the set
+     * without bound; after the cap, rejections still enforce + count —
+     * they just stop logging. Mirrors the origin-rejection warn pattern.
+     */
+    const warnedCaps = new Set();
+    function warnCapOnce(event, fields) {
+        if (!warnedCaps.has(event) && warnedCaps.size < 100) {
+            warnedCaps.add(event);
+            deps.logger.warn(event, fields);
+        }
+    }
+    /** Drop a socket out of the pending count exactly once. */
+    function releasePending(ws) {
+        if (countedPending.has(ws)) {
+            countedPending.delete(ws);
+            preSubscribeCount -= 1;
+        }
+    }
+    function clearIdleTimer(ws) {
+        const timer = idleTimers.get(ws);
+        if (timer !== undefined) {
+            clearTimeout(timer);
+            idleTimers.delete(ws);
+        }
+    }
+    /**
+     * A socket that has become a registered subscriber is a legitimate
+     * long-lived connection: disarm its idle timer and stop counting it
+     * against the pre-subscribe ceiling. Idempotent.
+     */
+    function markSubscribed(ws) {
+        clearIdleTimer(ws);
+        releasePending(ws);
+    }
     /**
      * Tenancy guard for client-emitted observation messages
      * (`host_context_observed` today). Returns `false`
@@ -59,6 +118,37 @@ export function attachSocketRouter(wss, deps) {
     }
     async function onMessage(ws, raw) {
         const sub = deps.subscribersByWs.get(ws);
+        // Pre-subscribe per-frame payload cap. Bounds what a not-yet-
+        // subscribed (unauthenticated / unregistered) socket can buffer per
+        // frame. Subscribed sockets are exempt — their `action` frames have
+        // no protocol-level max size and are governed only by the coarse,
+        // global ws-level `maxPayload` memory backstop (see
+        // DEFAULT_WS_MAX_PAYLOAD_BYTES for its sizing rationale), never this
+        // tight handshake-sized ceiling. Measured before JSON.parse so a
+        // giant frame is dropped without being interpreted.
+        if (sub === undefined && caps.maxPayloadBytes > 0) {
+            // Already closed this socket for this cap: a same-segment burst
+            // can still deliver more already-parsed frames before
+            // `ws.close()` settles the connection. Drop them silently — one
+            // abusive socket is one rejection, not one per queued frame.
+            if (payloadRejected.has(ws)) {
+                return;
+            }
+            if (Buffer.byteLength(raw, "utf8") > caps.maxPayloadBytes) {
+                payloadRejected.add(ws);
+                rejections.payload += 1;
+                warnCapOnce("render_channel_pre_subscribe_payload_rejected", {
+                    limitBytes: caps.maxPayloadBytes,
+                });
+                try {
+                    ws.close(1009, "pre_subscribe_payload_exceeded");
+                }
+                catch {
+                    /* best-effort: socket may already be closing */
+                }
+                return;
+            }
+        }
         let message;
         try {
             message = JSON.parse(raw);
@@ -103,6 +193,14 @@ export function attachSocketRouter(wss, deps) {
                 await deps.handleSubscribe(ws, identity, message, cookieBound);
                 pendingIdentity.delete(ws);
                 pendingCookieBinding.delete(ws);
+                // A successful subscribe registers the subscriber (sets
+                // `subscribersByWs`). Only then does the socket graduate out of
+                // the pre-subscribe window: disarm its idle timer + free its
+                // ceiling slot. A REJECTED subscribe leaves it pending, so it
+                // stays bounded (and reapable) exactly as before.
+                if (deps.subscribersByWs.get(ws) !== undefined) {
+                    markSubscribed(ws);
+                }
                 return;
             }
             case "ping":
@@ -170,6 +268,58 @@ export function attachSocketRouter(wss, deps) {
      */
     const pendingCookieBinding = new WeakMap();
     wss.on("connection", (ws, req) => {
+        // Pre-subscribe connection ceiling. Count only sockets that have
+        // NOT yet completed a valid subscribe — legitimate subscriber
+        // fan-out can be large and is never bounded here. Beyond the
+        // ceiling the socket is cleanly closed (1013 "try again later")
+        // without wiring any per-socket handlers or consuming a slot.
+        if (caps.maxConnections > 0 && preSubscribeCount >= caps.maxConnections) {
+            rejections.connection += 1;
+            warnCapOnce("render_channel_pre_subscribe_connection_rejected", {
+                limit: caps.maxConnections,
+            });
+            // This early-return path skips the normal per-socket wiring below,
+            // so attach a minimal `error` listener first: a `ws` is an
+            // EventEmitter and an unhandled `error` (a refused peer resetting
+            // mid-close is the likely case here) would otherwise crash the
+            // process — the abuse path must never take the server down.
+            ws.on("error", (err) => {
+                deps.logger.warn("render_channel_socket_error", { error: String(err) });
+            });
+            try {
+                ws.close(1013, "pre_subscribe_connection_ceiling");
+            }
+            catch {
+                /* best-effort: socket may already be closing */
+            }
+            return;
+        }
+        preSubscribeCount += 1;
+        countedPending.add(ws);
+        // Pre-subscribe idle timeout. A socket that never completes a valid
+        // subscribe within the window is closed (1008). Armed here, cleared
+        // in `markSubscribed` on a successful subscribe, so a subscribed
+        // (long-idle / reconnecting) viewer is never reaped. `.unref()` so a
+        // pending timer never keeps the process alive on its own.
+        if (caps.idleMs > 0) {
+            const timer = setTimeout(() => {
+                idleTimers.delete(ws);
+                if (deps.subscribersByWs.get(ws) === undefined) {
+                    rejections.idle += 1;
+                    warnCapOnce("render_channel_pre_subscribe_idle_closed", {
+                        idleMs: caps.idleMs,
+                    });
+                    try {
+                        ws.close(1008, "pre_subscribe_idle_timeout");
+                    }
+                    catch {
+                        /* best-effort: socket may already be closing */
+                    }
+                }
+            }, caps.idleMs);
+            timer.unref?.();
+            idleTimers.set(ws, timer);
+        }
         // Bind the resolved identity from the upgrade phase. It was
         // attached to the request object in handleUpgrade.
         const identity = req.__gguiIdentity;
@@ -205,6 +355,11 @@ export function attachSocketRouter(wss, deps) {
         ws.on("close", () => {
             deps.unregister(ws);
             pendingIdentity.delete(ws);
+            // A pending socket that closes before subscribing frees its idle
+            // timer + ceiling slot. For a socket that already subscribed,
+            // `markSubscribed` cleared both — these are then no-ops.
+            clearIdleTimer(ws);
+            releasePending(ws);
         });
         ws.on("error", (err) => {
             deps.logger.warn("render_channel_socket_error", { error: String(err) });

package/dist/ggui-session-channel/subscribe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,MAAM,wCAAwC,GAChD;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;IAC/D;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,wCAAwC,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAqb9E"}
+{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,MAAM,wCAAwC,GAChD;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;IAC/D;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,wCAAwC,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAkBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAwd9E"}