@ggui-ai/mcp-server 0.6.3 → 0.8.0

package/dist/ggui-session-channel/subscribe.js

@@ -8,6 +8,20 @@
  */
 import { PROTOCOL_SCHEMA_VERSION, UPGRADE_REQUIRED } from "@ggui-ai/protocol";
 import { defaultAppIdFromIdentity, resolveIdentityFromHeaders, UnauthenticatedError, } from "../auth.js";
+/**
+ * Marker `userId` (and `workspaceId`) `resolveIdentityFromUpgrade`
+ * returns for a bootstrap-gated upgrade — see the "WS-token gate"
+ * comment there. It is a placeholder, not a verified identity:
+ * `handleSubscribe` MUST reject a subscribe on this identity outright
+ * unless the subscribe payload itself presents a `wsToken` that goes on
+ * to verify (ggui#438a security review, C1). Never treat this marker as
+ * authenticated for identity-default resolution or render provisioning.
+ */
+const BOOTSTRAP_PENDING_MARKER = "__bootstrap_pending__";
+/** Is `identity` the unverified upgrade-time placeholder above? */
+function isBootstrapPendingIdentity(identity) {
+    return identity.identity.kind === "user" && identity.identity.userId === BOOTSTRAP_PENDING_MARKER;
+}
 export function createSubscribeHandlers(deps) {
     async function resolveIdentityFromUpgrade(req) {
         const url = new URL(req.url ?? "/", "http://localhost");
@@ -27,8 +41,8 @@ export function createSubscribeHandlers(deps) {
             return {
                 identity: {
                     kind: "user",
-                    userId: "__bootstrap_pending__",
-                    workspaceId: "__bootstrap_pending__",
+                    userId: BOOTSTRAP_PENDING_MARKER,
+                    workspaceId: BOOTSTRAP_PENDING_MARKER,
                     roles: [],
                 },
                 source: "apikey",
@@ -127,6 +141,24 @@ export function createSubscribeHandlers(deps) {
             }
             return;
         }
+        // C1 (ggui#438a security review): `identity` may be the
+        // upgrade-time bootstrap-pending PLACEHOLDER (see
+        // `resolveIdentityFromUpgrade`'s "WS-token gate" comment and
+        // `isBootstrapPendingIdentity` above) — a "don't reject the
+        // upgrade" signal, not a verified identity. If the subscribe
+        // payload does not itself carry a `wsToken` to verify, this socket
+        // has proven nothing about itself and MUST be rejected here —
+        // never fall through to identity-default appId resolution or
+        // dev-mode render provisioning on an unverified placeholder. A
+        // present `payload.wsToken` is verified by the block immediately
+        // below, which returns on any verify failure — so by the time this
+        // function reaches appId resolution, every bootstrap-pending
+        // identity has either been rejected or replaced by a verified one.
+        if (isBootstrapPendingIdentity(identity) &&
+            !(typeof payload.wsToken === "string" && payload.wsToken.length > 0)) {
+            deps.sendError(ws, "UNAUTHENTICATED", "Bootstrap-gated socket did not present a wsToken to verify at subscribe", message.requestId);
+            return;
+        }
         // WS-token-auth path. When `payload.wsToken` is present, the MCP
         // Apps iframe is asking us to authenticate it via the short-lived
         // token minted by `ggui_render`. This REPLACES the upgrade-time
@@ -226,6 +258,15 @@ export function createSubscribeHandlers(deps) {
         }
         else {
             try {
+                // NO `userId` here, deliberately (#446). `effectiveIdentity`
+                // above may be the bootstrap-synthesized identity whose
+                // `userId` IS the sessionId — a render-scoped credential every
+                // holder of the bootstrap token presents, not a person.
+                // Threading it onto the row would bind the row's SUBJECT to
+                // that credential, and the render-read gate would then pass
+                // every bearer of the token as "the subject". The row acquires
+                // its real subject later, from the agent's commit, via the
+                // stores' if-not-exists semantics.
                 stored = await deps.renderStore.create({
                     id: payload.sessionId,
                     appId: effectiveAppId,

package/dist/ggui-session-channel.d.ts

@@ -60,6 +60,54 @@ import { type GguiSessionChannelBootstrap, type GguiSessionChannelCookieAuth } f
 import type { Logger } from "./logger.js";
 /** Default URL path for the channel endpoint. Operators can override. */
 export declare const DEFAULT_RENDER_CHANNEL_PATH = "/ws";
+/**
+ * Coarse ws-level `maxPayload` memory backstop (1 MiB) applied to EVERY
+ * inbound frame on EVERY socket, INCLUDING already-subscribed ones —
+ * unlike the other three pre-subscribe caps in this file, this one is
+ * NOT subscriber-exempt. It bounds the absolute per-frame buffer a
+ * hostile peer can force before the frame is even assembled: a 100x
+ * reduction from the `ws` library's own ~100 MiB default, applied
+ * uniformly regardless of subscribe state.
+ *
+ * `ActionEnvelope` (the post-subscribe `action` payload) has no
+ * protocol-level max size, so this ceiling can NOT be sized to provably
+ * never clip a legitimate frame — it is a deliberately generous-but-
+ * finite backstop, not a guarantee. The closest documented protocol-
+ * level payload bound is `CONTEXT_SNAPSHOT_MAX_BYTES` (64 KiB, the
+ * `ggui_runtime_sync_context` MCP tool call — a related but distinct
+ * transport from this WS channel), which puts 1 MiB at roughly 16x
+ * headroom over the largest structured payload the protocol formally
+ * bounds. Operators whose legitimate `action` frames exceed 1 MiB
+ * (e.g. large form submissions) should raise {@link maxPayloadBytes},
+ * or set it to `0` to fall back to the `ws` library default. Distinct from
+ * the tight, pre-subscribe-only, subscriber-exempt
+ * {@link DEFAULT_PRE_SUBSCRIBE_MAX_PAYLOAD_BYTES}. Disable this one
+ * with `0`.
+ */
+export declare const DEFAULT_WS_MAX_PAYLOAD_BYTES = 1048576;
+/**
+ * Per-frame byte ceiling on PRE-SUBSCRIBE frames (64 KiB). Pre-subscribe
+ * traffic is tiny (a subscribe carrying a JWT is under 1 KiB), so this
+ * is ~70x headroom yet caps a pre-auth memory-abuse frame. Enforced
+ * per-frame, keyed on "not yet a subscriber", so post-subscribe frames
+ * are exempt. Disable with `0`.
+ */
+export declare const DEFAULT_PRE_SUBSCRIBE_MAX_PAYLOAD_BYTES = 65536;
+/**
+ * Grace window (30 s) an unauthenticated socket has to complete a valid
+ * subscribe before it is closed. Open→subscribe is normally sub-second;
+ * 30 s tolerates a slow bootstrap-token verify while bounding how long a
+ * credential-less socket holds a slot. Disable with `0`.
+ */
+export declare const DEFAULT_PRE_SUBSCRIBE_IDLE_MS = 30000;
+/**
+ * Concurrent PENDING (pre-subscribe) socket ceiling (1024). Honest
+ * clients leave the pending state in under a second, so 1024 in-flight
+ * handshakes is far beyond any real burst yet bounds a credential-less
+ * connection flood. Counts pending sockets only — never subscribers.
+ * Disable with `0`.
+ */
+export declare const DEFAULT_MAX_PRE_SUBSCRIBE_CONNECTIONS = 1024;
 export type { GguiSessionChannelLocalToolsOptions } from "./ggui-session-channel/channel-subscriptions.js";
 export type { GguiSessionChannelBootstrap, GguiSessionChannelBootstrapRefreshResult, GguiSessionChannelBootstrapVerifyResult, GguiSessionChannelCookieAuth, } from "./ggui-session-channel/subscribe.js";
 export interface GguiSessionChannelOptions {
@@ -228,6 +276,58 @@ export interface GguiSessionChannelOptions {
      * identically in both modes.
      */
     readonly versionPolicy?: "advisory" | "reject";
+    /**
+     * Coarse ws-level `maxPayload` memory backstop (bytes) applied to
+     * EVERY inbound frame on EVERY socket, INCLUDING already-subscribed
+     * ones — the largest single frame the server will assemble before
+     * rejecting it (ws closes 1009). Distinct from
+     * {@link maxPreSubscribePayloadBytes}: that one is the tight,
+     * subscriber-exempt, credential-less bound; this one is a generous-
+     * but-finite global ceiling applied uniformly regardless of subscribe
+     * state.
+     *
+     * `ActionEnvelope` (the post-subscribe `action` payload) has no
+     * protocol-level max size, so this default can NOT be sized to
+     * provably never clip a legitimate frame — see
+     * {@link DEFAULT_WS_MAX_PAYLOAD_BYTES} for the sizing rationale.
+     * Operators expecting `action` frames larger than the default should
+     * raise this value.
+     *
+     * Defaults to {@link DEFAULT_WS_MAX_PAYLOAD_BYTES} (1 MiB). `0`
+     * disables the ws-level check (falls back to the ws library's own
+     * ~100 MiB default).
+     */
+    readonly maxPayloadBytes?: number;
+    /**
+     * Per-frame byte ceiling for PRE-SUBSCRIBE (not-yet-registered)
+     * sockets. A pre-subscribe frame larger than this closes the socket
+     * (1009) before it is parsed. Subscribed sockets are exempt — only
+     * the coarse {@link maxPayloadBytes} backstop applies to them.
+     *
+     * Defaults to {@link DEFAULT_PRE_SUBSCRIBE_MAX_PAYLOAD_BYTES}
+     * (64 KiB). `0` disables the pre-subscribe payload cap.
+     */
+    readonly maxPreSubscribePayloadBytes?: number;
+    /**
+     * Grace window (ms) a socket has to complete a valid subscribe before
+     * it is closed (1008). Armed on connection, cleared on successful
+     * subscribe — a registered subscriber is never reaped, so long-idle
+     * and reconnecting viewers keep the existing keepalive behavior.
+     *
+     * Defaults to {@link DEFAULT_PRE_SUBSCRIBE_IDLE_MS} (30 s). `0`
+     * disables the idle timeout.
+     */
+    readonly preSubscribeIdleMs?: number;
+    /**
+     * Concurrent PENDING (pre-subscribe) socket ceiling. A new upgrade
+     * that would exceed it is cleanly closed (1013). Counts only sockets
+     * that have not completed a valid subscribe — subscriber fan-out is
+     * never bounded here.
+     *
+     * Defaults to {@link DEFAULT_MAX_PRE_SUBSCRIBE_CONNECTIONS} (1024).
+     * `0` disables the ceiling.
+     */
+    readonly maxPreSubscribeConnections?: number;
     /**
      * Optional hook fired synchronously when the local subscriber count
      * for `sessionId` transitions 0 → 1 (the first subscriber for that
@@ -412,6 +512,20 @@ export interface GguiSessionChannelServer {
     readonly subscriberCount: number;
     /** Number of distinct renders with at least one subscriber. */
     readonly renderCount: number;
+    /**
+     * Monotonic counts of pre-subscribe cap-driven closures/refusals
+     * (ggui#444), surfaced on `/ggui/health` for operator diagnosis of a
+     * credential-less abuse burst. Each field only ever increases over
+     * the channel's lifetime:
+     *   - `payload` — oversized pre-subscribe frames rejected (1009).
+     *   - `idle` — sockets closed for never subscribing in time (1008).
+     *   - `connection` — upgrades refused past the pending ceiling (1013).
+     */
+    readonly preSubscribeRejections: {
+        readonly payload: number;
+        readonly idle: number;
+        readonly connection: number;
+    };
     /**
      * Close every live subscriber + the underlying ws server. Idempotent.
      */

package/dist/ggui-session-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ggui-session-channel.d.ts","sourceRoot":"","sources":["../src/ggui-session-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACd,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,iDAAiD,CAAC;AAIzD,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAKjD,YAAY,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAK3G,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,WAAW,yBAAyB;IACxC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IAEjD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjF;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,mCAAmC,CAAC;IACzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpE,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,yBAAyB,GAC9B,wBAAwB,CA8M1B"}
+{"version":3,"file":"ggui-session-channel.d.ts","sourceRoot":"","sources":["../src/ggui-session-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACd,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,iDAAiD,CAAC;AAIzD,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B,UAAY,CAAC;AACtD;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,QAAS,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAK3D,YAAY,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAK3G,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,WAAW,yBAAyB;IACxC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IAEjD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjF;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,mCAAmC,CAAC;IACzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpE,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,EAAE;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,yBAAyB,GAC9B,wBAAwB,CA4O1B"}

package/dist/ggui-session-channel.js

@@ -61,6 +61,54 @@ import { createSubscribeHandlers, } from "./ggui-session-channel/subscribe.js";
 import { createSubscriberLifecycle } from "./ggui-session-channel/subscriber-lifecycle.js";
 /** Default URL path for the channel endpoint. Operators can override. */
 export const DEFAULT_RENDER_CHANNEL_PATH = "/ws";
+/**
+ * Coarse ws-level `maxPayload` memory backstop (1 MiB) applied to EVERY
+ * inbound frame on EVERY socket, INCLUDING already-subscribed ones —
+ * unlike the other three pre-subscribe caps in this file, this one is
+ * NOT subscriber-exempt. It bounds the absolute per-frame buffer a
+ * hostile peer can force before the frame is even assembled: a 100x
+ * reduction from the `ws` library's own ~100 MiB default, applied
+ * uniformly regardless of subscribe state.
+ *
+ * `ActionEnvelope` (the post-subscribe `action` payload) has no
+ * protocol-level max size, so this ceiling can NOT be sized to provably
+ * never clip a legitimate frame — it is a deliberately generous-but-
+ * finite backstop, not a guarantee. The closest documented protocol-
+ * level payload bound is `CONTEXT_SNAPSHOT_MAX_BYTES` (64 KiB, the
+ * `ggui_runtime_sync_context` MCP tool call — a related but distinct
+ * transport from this WS channel), which puts 1 MiB at roughly 16x
+ * headroom over the largest structured payload the protocol formally
+ * bounds. Operators whose legitimate `action` frames exceed 1 MiB
+ * (e.g. large form submissions) should raise {@link maxPayloadBytes},
+ * or set it to `0` to fall back to the `ws` library default. Distinct from
+ * the tight, pre-subscribe-only, subscriber-exempt
+ * {@link DEFAULT_PRE_SUBSCRIBE_MAX_PAYLOAD_BYTES}. Disable this one
+ * with `0`.
+ */
+export const DEFAULT_WS_MAX_PAYLOAD_BYTES = 1_048_576;
+/**
+ * Per-frame byte ceiling on PRE-SUBSCRIBE frames (64 KiB). Pre-subscribe
+ * traffic is tiny (a subscribe carrying a JWT is under 1 KiB), so this
+ * is ~70x headroom yet caps a pre-auth memory-abuse frame. Enforced
+ * per-frame, keyed on "not yet a subscriber", so post-subscribe frames
+ * are exempt. Disable with `0`.
+ */
+export const DEFAULT_PRE_SUBSCRIBE_MAX_PAYLOAD_BYTES = 65_536;
+/**
+ * Grace window (30 s) an unauthenticated socket has to complete a valid
+ * subscribe before it is closed. Open→subscribe is normally sub-second;
+ * 30 s tolerates a slow bootstrap-token verify while bounding how long a
+ * credential-less socket holds a slot. Disable with `0`.
+ */
+export const DEFAULT_PRE_SUBSCRIBE_IDLE_MS = 30_000;
+/**
+ * Concurrent PENDING (pre-subscribe) socket ceiling (1024). Honest
+ * clients leave the pending state in under a second, so 1024 in-flight
+ * handshakes is far beyond any real burst yet bounds a credential-less
+ * connection flood. Counts pending sockets only — never subscribers.
+ * Disable with `0`.
+ */
+export const DEFAULT_MAX_PRE_SUBSCRIBE_CONNECTIONS = 1_024;
 /**
  * Build an OSS live-channel server. The returned object is designed to be
  * composed into `createGguiServer` — see `server.ts` for the wire-up.
@@ -73,9 +121,25 @@ export function createGguiSessionChannelServer(opts) {
     // Live-tail pub/sub. Default in-process; multi-process deployments
     // bind a pubsub-backed StreamFanout via `opts.streamFanout`.
     const streamFanout = opts.streamFanout ?? new InProcessStreamFanout();
+    // Pre-subscribe caps (ggui#444) — bound what a not-yet-subscribed
+    // (credential-less) socket can consume. Resolved once here; `0`
+    // disables a given cap. See the DEFAULT_* constants for rationale.
+    const wsMaxPayloadBytes = opts.maxPayloadBytes ?? DEFAULT_WS_MAX_PAYLOAD_BYTES;
+    const preSubscribeCaps = {
+        maxPayloadBytes: opts.maxPreSubscribePayloadBytes ?? DEFAULT_PRE_SUBSCRIBE_MAX_PAYLOAD_BYTES,
+        idleMs: opts.preSubscribeIdleMs ?? DEFAULT_PRE_SUBSCRIBE_IDLE_MS,
+        maxConnections: opts.maxPreSubscribeConnections ?? DEFAULT_MAX_PRE_SUBSCRIBE_CONNECTIONS,
+    };
+    // Live monotonic counters surfaced on `/ggui/health`. The router owns
+    // the increments; the health getter below reads a snapshot.
+    const preSubscribeRejections = { payload: 0, idle: 0, connection: 0 };
     // `noServer: true` means we own the upgrade wiring (see handleUpgrade);
-    // ws won't try to bind its own port.
-    const wss = new WebSocketServer({ noServer: true });
+    // ws won't try to bind its own port. `maxPayload` is the coarse global
+    // memory backstop; the tight pre-subscribe payload cap is enforced
+    // per-frame in the socket router. `0` → fall back to the ws default.
+    const wss = wsMaxPayloadBytes > 0
+        ? new WebSocketServer({ noServer: true, maxPayload: wsMaxPayloadBytes })
+        : new WebSocketServer({ noServer: true });
     /**
      * Flat set of all live WS subscribers. Replaces the per-render
      * `subscribersByRender` Map — routing is now StreamFanout's job;
@@ -162,6 +226,8 @@ export function createGguiSessionChannelServer(opts) {
         handleInboundAction,
         handleChannelSubscribe,
         handleChannelUnsubscribe,
+        preSubscribeCaps,
+        preSubscribeRejections,
     });
     return {
         path,
@@ -218,6 +284,15 @@ export function createGguiSessionChannelServer(opts) {
                 renders.add(sub.sessionId);
             return renders.size;
         },
+        get preSubscribeRejections() {
+            // Snapshot so callers can't mutate the live counters through the
+            // getter's return value.
+            return {
+                payload: preSubscribeRejections.payload,
+                idle: preSubscribeRejections.idle,
+                connection: preSubscribeRejections.connection,
+            };
+        },
         async close() {
             // Close every open socket + drain its StreamFanout subscription.
             // `wss.close` terminates the server but not in-flight sockets,

package/dist/health-routes.d.ts

@@ -66,6 +66,9 @@ interface MountOptions {
     readonly oauthIssuerUrl?: string;
     /** Structured logger for unexpected auth-check failures. */
     readonly logger: Logger;
+    /** Effective browser-origin allowlist, for operator diagnosis of CORS
+     *  failures — which are otherwise invisible server-side. */
+    readonly corsOrigins?: ReadonlyArray<string>;
 }
 /**
  * Mount `/ggui/live` + `/ggui/health` + `/ggui/auth-check` onto the

package/dist/health-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAU1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;KAAE,CAAC;IACrE,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAmH1D"}
+{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAU1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;KAAE,CAAC;IACrE,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;gEAC4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAuI1D"}

package/dist/health-routes.js

@@ -40,7 +40,7 @@ const READINESS_CHECK_TIMEOUT_MS = 1_000;
  * express app. Returns nothing — the routes self-register.
  */
 export function mountHealthRoutes(opts) {
-    const { app, info, toolCount, readinessChecks, getChannel, threads, auth, oauthEnabled, logger } = opts;
+    const { app, info, toolCount, readinessChecks, getChannel, threads, auth, oauthEnabled, logger, corsOrigins, } = opts;
     async function runReadinessChecks() {
         if (readinessChecks.length === 0) {
             return { allReady: true, results: {} };
@@ -86,8 +86,18 @@ export function mountHealthRoutes(opts) {
                     path: channel.path,
                     subscribers: channel.subscriberCount,
                     renders: channel.renderCount,
+                    // Pre-subscribe cap-hit counters (ggui#444) — operator
+                    // signal for a credential-less abuse burst. Monotonic; all
+                    // zero on a healthy server.
+                    caps: {
+                        preSubscribeRejections: channel.preSubscribeRejections,
+                    },
                 };
             }
+            body.cors = {
+                loopback: true,
+                origins: corsOrigins === undefined ? [] : [...corsOrigins],
+            };
             // Thread-transport presence + durability claim. When present,
             // `durability` is exactly what the caller declared — 'ephemeral'
             // by default so Portal does not silently hide its non-durable