@hua-labs/tap 0.2.3 → 0.2.5

package/dist/index.mjs

@@ -27,8 +27,8 @@ function findRepoRoot(startDir = process.cwd()) {
     if (fs.existsSync(path.join(dir, "package.json"))) {
       if (!_noGitWarned) {
         _setNoGitWarned();
-        logWarn(
-          "No .git directory found. Resolved repo root via package.json \u2014 comms directory may be created in an unexpected location. Use --comms-dir to specify explicitly."
+        log(
+          "No .git directory found. Resolved tap root via package.json. That's fine outside git; use --comms-dir to choose a different comms location."
         );
       }
       return dir;
@@ -39,8 +39,8 @@ function findRepoRoot(startDir = process.cwd()) {
   }
   if (!_noGitWarned) {
     _setNoGitWarned();
-    logWarn(
-      "No git repository or package.json found. Using current directory as root. Run 'git init' first, or use --comms-dir to specify the comms path."
+    log(
+      "No git repository or package.json found. Using the current directory as tap root. That's fine outside git; use --comms-dir to choose a different comms location."
     );
   }
   return process.cwd();
@@ -82,9 +82,6 @@ function log(message) {
 function logSuccess(message) {
   if (!_jsonMode) console.log(`  + ${message}`);
 }
-function logWarn(message) {
-  if (!_jsonMode) console.log(`  ! ${message}`);
-}
 function logError(message) {
   if (!_jsonMode) console.error(`  x ${message}`);
 }
@@ -93,6 +90,16 @@ function logHeader(message) {
   ${message}
 `);
 }
+function parseIntFlag(value, name, min, max) {
+  if (value === void 0) return void 0;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+    throw new RangeError(
+      `Invalid ${name}: ${value}. Must be an integer between ${min} and ${max}.`
+    );
+  }
+  return parsed;
+}
 function resolveInstanceId(identifier, state) {
   if (state.instances[identifier]) {
     return { ok: true, instanceId: identifier };
@@ -140,8 +147,8 @@ function findRepoRoot2(startDir = process.cwd()) {
     if (fs2.existsSync(path2.join(dir, "package.json"))) {
       if (!_noGitWarned) {
         _setNoGitWarned();
-        console.error(
-          "[tap] warning: No .git directory found. Resolved via package.json. Use --comms-dir to specify explicitly."
+        log(
+          "No .git directory found. Resolved tap root via package.json. That's fine outside git; use --comms-dir to choose a different comms location."
         );
       }
       return dir;
@@ -152,8 +159,8 @@ function findRepoRoot2(startDir = process.cwd()) {
   }
   if (!_noGitWarned) {
     _setNoGitWarned();
-    console.error(
-      "[tap] warning: No git repository found. Using cwd as root. Run 'git init' or use --comms-dir."
+    log(
+      "No git repository or package.json found. Using the current directory as tap root. That's fine outside git; use --comms-dir to choose a different comms location."
     );
   }
   return process.cwd();
@@ -551,7 +558,7 @@ function buildManagedMcpServerSpec(ctx, instanceId) {
   }
   if (!sourcePath) {
     issues.push(
-      "tap-comms MCP server entry not found. Reinstall @hua-labs/tap or run from a repo with packages/tap-plugin/channels/ available."
+      "tap MCP server entry not found. Reinstall @hua-labs/tap or run from a repo with packages/tap-plugin/channels/ available."
     );
     return { command: null, args: [], env, sourcePath, warnings, issues };
   }
@@ -581,7 +588,7 @@ function buildManagedMcpServerSpec(ctx, instanceId) {
   }
   if (!command) {
     issues.push(
-      "bun is required to run the repo-local tap-comms MCP server (.ts source). Install bun: https://bun.sh"
+      "bun is required to run the repo-local tap MCP server (.ts source). Install bun: https://bun.sh"
     );
     return { command: null, args: [], env, sourcePath, warnings, issues };
   }
@@ -775,6 +782,7 @@ var init_runtime = __esm({
 // src/engine/bridge.ts
 import * as fs7 from "fs";
 import * as net from "net";
+import * as os2 from "os";
 import * as path7 from "path";
 import { randomBytes } from "crypto";
 import { spawn, spawnSync as spawnSync2, execSync as execSync2 } from "child_process";
@@ -815,12 +823,66 @@ function removeFileIfExists(filePath) {
   } catch {
   }
 }
+function toPowerShellSingleQuotedString(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function toPowerShellStringArrayLiteral(values) {
+  return `@(${values.map(toPowerShellSingleQuotedString).join(", ")})`;
+}
+function cleanupStaleWindowsSpawnWrappers(now = Date.now()) {
+  let entries;
+  try {
+    entries = fs7.readdirSync(os2.tmpdir());
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.startsWith(WINDOWS_SPAWN_WRAPPER_PREFIX) || !/\.(cmd|ps1)$/i.test(entry)) {
+      continue;
+    }
+    const wrapperPath = path7.join(os2.tmpdir(), entry);
+    try {
+      const stats = fs7.statSync(wrapperPath);
+      if (now - stats.mtimeMs < WINDOWS_SPAWN_WRAPPER_STALE_MS) {
+        continue;
+      }
+      fs7.unlinkSync(wrapperPath);
+    } catch {
+    }
+  }
+}
+function buildWindowsDetachedWrapperScript(command, args, logPath, stderrLogPath, env) {
+  const lines = ["$ErrorActionPreference = 'Stop'"];
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== void 0 && value !== process.env[key]) {
+      lines.push(
+        `[Environment]::SetEnvironmentVariable(${toPowerShellSingleQuotedString(key)}, ${toPowerShellSingleQuotedString(value)}, 'Process')`
+      );
+    }
+  }
+  lines.push(
+    `$logPath = ${toPowerShellSingleQuotedString(logPath)}`,
+    `$stderrLogPath = ${toPowerShellSingleQuotedString(stderrLogPath)}`,
+    `$commandPath = ${toPowerShellSingleQuotedString(command)}`,
+    `$commandArgs = ${toPowerShellStringArrayLiteral(args)}`,
+    "$exitCode = 1",
+    "try {",
+    "  & $commandPath @commandArgs >> $logPath 2>> $stderrLogPath",
+    "  $exitCode = if ($null -ne $LASTEXITCODE) { $LASTEXITCODE } else { 0 }",
+    "} finally {",
+    "  Remove-Item -LiteralPath $PSCommandPath -Force -ErrorAction SilentlyContinue",
+    "}",
+    "exit $exitCode"
+  );
+  return `${lines.join("\r\n")}\r
+`;
+}
 function getWebSocketCtor() {
   const candidate = globalThis.WebSocket;
   return typeof candidate === "function" ? candidate : null;
 }
 function delay(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function isLoopbackHost(hostname) {
   return hostname === "127.0.0.1" || hostname === "localhost";
@@ -838,8 +900,11 @@ function resolvePowerShellCommand() {
 function resolveAuthGatewayScript(repoRoot) {
   const moduleDir = path7.dirname(fileURLToPath3(import.meta.url));
   const candidates = [
-    path7.join(moduleDir, "..", "bridges", "codex-app-server-auth-gateway.mjs"),
-    path7.join(moduleDir, "..", "bridges", "codex-app-server-auth-gateway.ts"),
+    // Bundled: dist/bridges/ sibling (npm install / built package)
+    path7.join(moduleDir, "bridges", "codex-app-server-auth-gateway.mjs"),
+    // Source: src/bridges/ sibling (monorepo dev with ts runner)
+    path7.join(moduleDir, "bridges", "codex-app-server-auth-gateway.ts"),
+    // Monorepo dist fallback
     path7.join(
       repoRoot,
       "packages",
@@ -869,7 +934,7 @@ function getBridgeRuntimeStateDir(repoRoot, instanceId) {
 }
 async function allocateLoopbackPort(hostname) {
   const bindHost = hostname === "localhost" ? "127.0.0.1" : hostname;
-  return await new Promise((resolve8, reject) => {
+  return await new Promise((resolve9, reject) => {
     const server = net.createServer();
     server.unref();
     server.once("error", reject);
@@ -887,15 +952,13 @@ async function allocateLoopbackPort(hostname) {
           reject(error);
           return;
         }
-        resolve8(port);
+        resolve9(port);
       });
     });
   });
 }
-function buildProtectedAppServerUrl(publicUrl, token) {
-  const url = new URL(publicUrl);
-  url.searchParams.set(APP_SERVER_AUTH_QUERY_PARAM, token);
-  return url.toString().replace(/\/(?=\?|$)/, "");
+function buildProtectedAppServerUrl(publicUrl, _token) {
+  return publicUrl;
 }
 function readGatewayTokenFromPath(tokenPath) {
   return fs7.readFileSync(tokenPath, "utf8").trim();
@@ -1010,7 +1073,7 @@ async function createManagedAppServerAuth(options) {
     throw new Error("Failed to spawn app-server auth gateway");
   }
   return {
-    mode: "query-token",
+    mode: "subprotocol",
     protectedUrl,
     upstreamUrl: upstreamUrl.toString().replace(/\/$/, ""),
     tokenPath,
@@ -1072,35 +1135,50 @@ function findReusableManagedAppServer(stateDir, publicUrl) {
   return null;
 }
 function startWindowsDetachedProcess(command, args, repoRoot, logPath, env = process.env) {
-  const ext = path7.extname(command).toLowerCase();
   const stderrLogPath = stderrLogFilePath(logPath);
-  const stdoutFd = fs7.openSync(logPath, "a");
-  const stderrFd = fs7.openSync(stderrLogPath, "a");
-  try {
-    const child = ext === ".ps1" ? spawn(
-      resolvePowerShellCommand(),
-      ["-NoLogo", "-NoProfile", "-File", command, ...args],
-      {
-        cwd: repoRoot,
-        detached: true,
-        stdio: ["ignore", stdoutFd, stderrFd],
-        env,
-        windowsHide: true
-      }
-    ) : spawn(command, args, {
-      cwd: repoRoot,
-      detached: true,
-      stdio: ["ignore", stdoutFd, stderrFd],
-      env,
-      windowsHide: true,
-      shell: ext === ".cmd" || ext === ".bat"
-    });
-    child.unref();
-    return child.pid ?? null;
-  } finally {
-    fs7.closeSync(stdoutFd);
-    fs7.closeSync(stderrFd);
+  const powerShellCommand = resolvePowerShellCommand();
+  cleanupStaleWindowsSpawnWrappers();
+  const wrapperPath = path7.join(
+    os2.tmpdir(),
+    `${WINDOWS_SPAWN_WRAPPER_PREFIX}${randomBytes(4).toString("hex")}.ps1`
+  );
+  fs7.writeFileSync(
+    wrapperPath,
+    buildWindowsDetachedWrapperScript(
+      command,
+      args,
+      logPath,
+      stderrLogPath,
+      env
+    )
+  );
+  const psCommand = [
+    "$p = Start-Process",
+    `-FilePath ${toPowerShellSingleQuotedString(powerShellCommand)}`,
+    `-ArgumentList ${toPowerShellStringArrayLiteral(["-NoLogo", "-NoProfile", "-File", wrapperPath])}`,
+    `-WorkingDirectory ${toPowerShellSingleQuotedString(repoRoot)}`,
+    "-WindowStyle Hidden",
+    "-PassThru",
+    "; Write-Output $p.Id"
+  ].join(" ");
+  const result = spawnSync2(
+    powerShellCommand,
+    ["-NoLogo", "-NoProfile", "-Command", psCommand],
+    {
+      encoding: "utf-8",
+      windowsHide: true
+    }
+  );
+  if (result.status !== 0) {
+    removeFileIfExists(wrapperPath);
+    return null;
+  }
+  const pid = parseInt(result.stdout.trim(), 10);
+  if (!Number.isFinite(pid)) {
+    removeFileIfExists(wrapperPath);
+    return null;
   }
+  return pid;
 }
 function startWindowsCodexAppServer(command, url, repoRoot, logPath) {
   return startWindowsDetachedProcess(
@@ -1162,12 +1240,12 @@ function resolveAppServerUrl(baseUrl, port) {
 }
 async function isTcpPortAvailable(hostname, port) {
   const bindHost = hostname === "localhost" ? "127.0.0.1" : hostname;
-  return await new Promise((resolve8) => {
+  return await new Promise((resolve9) => {
     const server = net.createServer();
     server.unref();
-    server.once("error", () => resolve8(false));
+    server.once("error", () => resolve9(false));
     server.listen(port, bindHost, () => {
-      server.close((error) => resolve8(!error));
+      server.close((error) => resolve9(!error));
     });
   });
 }
@@ -1197,12 +1275,12 @@ async function findNextAvailableAppServerPort(state, baseUrl, basePort = 4501, e
     `Failed to find a free app-server port starting at ${basePort}`
   );
 }
-async function checkAppServerHealth(url, timeoutMs = APP_SERVER_HEALTH_TIMEOUT_MS) {
+async function checkAppServerHealth(url, timeoutMs = APP_SERVER_HEALTH_TIMEOUT_MS, gatewayToken) {
   const WebSocket = getWebSocketCtor();
   if (!WebSocket) {
     return false;
   }
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let settled = false;
     let socket = null;
     const finish = (healthy) => {
@@ -1215,11 +1293,12 @@ async function checkAppServerHealth(url, timeoutMs = APP_SERVER_HEALTH_TIMEOUT_M
         socket?.close();
       } catch {
       }
-      resolve8(healthy);
+      resolve9(healthy);
     };
     const timer = setTimeout(() => finish(false), timeoutMs);
     try {
-      socket = new WebSocket(url);
+      const protocols = gatewayToken ? [`${AUTH_SUBPROTOCOL_PREFIX}${gatewayToken}`] : void 0;
+      socket = new WebSocket(url, protocols);
       socket.addEventListener("open", () => finish(true), { once: true });
       socket.addEventListener("error", () => finish(false), { once: true });
       socket.addEventListener("close", () => finish(false), { once: true });
@@ -1228,10 +1307,14 @@ async function checkAppServerHealth(url, timeoutMs = APP_SERVER_HEALTH_TIMEOUT_M
     }
   });
 }
-async function waitForAppServerHealth(url, timeoutMs) {
+async function waitForAppServerHealth(url, timeoutMs, gatewayToken) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    if (await checkAppServerHealth(url)) {
+    if (await checkAppServerHealth(
+      url,
+      APP_SERVER_HEALTH_TIMEOUT_MS,
+      gatewayToken
+    )) {
       return true;
     }
     await delay(APP_SERVER_HEALTH_RETRY_MS);
@@ -1496,8 +1579,9 @@ Or start it manually:
     throw new Error("Tap auth gateway token is missing after startup.");
   }
   const gatewayHealthy = await waitForAppServerHealth(
-    buildProtectedAppServerUrl(effectiveUrl, gatewayToken),
-    APP_SERVER_GATEWAY_START_TIMEOUT_MS
+    effectiveUrl,
+    APP_SERVER_GATEWAY_START_TIMEOUT_MS,
+    gatewayToken
   );
   if (!gatewayHealthy) {
     await terminateProcess(pid, options.platform);
@@ -1533,7 +1617,11 @@ function logFilePath(stateDir, instanceId) {
 function runtimeHeartbeatFilePath(runtimeStateDir) {
   return path7.join(runtimeStateDir, "heartbeat.json");
 }
-function loadRuntimeHeartbeatTimestamp(runtimeStateDir) {
+function runtimeThreadStateFilePath(runtimeStateDir) {
+  return path7.join(runtimeStateDir, "thread.json");
+}
+function loadRuntimeBridgeHeartbeat(bridgeState) {
+  const runtimeStateDir = bridgeState?.runtimeStateDir;
   if (!runtimeStateDir) {
     return null;
   }
@@ -1542,13 +1630,35 @@ function loadRuntimeHeartbeatTimestamp(runtimeStateDir) {
     return null;
   }
   try {
-    const raw = fs7.readFileSync(heartbeatPath, "utf-8");
-    const parsed = JSON.parse(raw);
-    return typeof parsed.updatedAt === "string" ? parsed.updatedAt : null;
+    return JSON.parse(
+      fs7.readFileSync(heartbeatPath, "utf-8")
+    );
   } catch {
     return null;
   }
 }
+function loadRuntimeBridgeThreadState(bridgeState) {
+  const runtimeStateDir = bridgeState?.runtimeStateDir;
+  if (!runtimeStateDir) {
+    return null;
+  }
+  const threadPath = runtimeThreadStateFilePath(runtimeStateDir);
+  if (!fs7.existsSync(threadPath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(
+      fs7.readFileSync(threadPath, "utf-8")
+    );
+    return parsed.threadId ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function loadRuntimeHeartbeatTimestamp(runtimeStateDir) {
+  const heartbeat = loadRuntimeBridgeHeartbeat({ runtimeStateDir });
+  return typeof heartbeat?.updatedAt === "string" ? heartbeat.updatedAt : null;
+}
 function resolveHeartbeatTimestamp(state) {
   return loadRuntimeHeartbeatTimestamp(state?.runtimeStateDir) ?? state?.lastHeartbeat ?? null;
 }
@@ -1718,6 +1828,7 @@ async function startBridge(options) {
           options.messageLookbackMinutes
         )
       } : {},
+      ...process.env.TAP_COLD_START_WARMUP === "true" ? { TAP_COLD_START_WARMUP: "true" } : {},
       ...options.threadId ? { TAP_THREAD_ID: options.threadId } : {},
       ...options.ephemeral ? { TAP_EPHEMERAL: "true" } : {},
       ...options.processExistingMessages ? { TAP_PROCESS_EXISTING: "true" } : {}
@@ -1854,7 +1965,7 @@ function getBridgeStatus(stateDir, instanceId) {
   }
   return "running";
 }
-var DEFAULT_APP_SERVER_URL2, APP_SERVER_HEALTH_TIMEOUT_MS, APP_SERVER_START_TIMEOUT_MS, APP_SERVER_GATEWAY_START_TIMEOUT_MS, APP_SERVER_HEALTH_RETRY_MS, APP_SERVER_AUTH_QUERY_PARAM, APP_SERVER_AUTH_FILE_MODE;
+var DEFAULT_APP_SERVER_URL2, APP_SERVER_HEALTH_TIMEOUT_MS, APP_SERVER_START_TIMEOUT_MS, APP_SERVER_GATEWAY_START_TIMEOUT_MS, APP_SERVER_HEALTH_RETRY_MS, AUTH_SUBPROTOCOL_PREFIX, APP_SERVER_AUTH_FILE_MODE, WINDOWS_SPAWN_WRAPPER_PREFIX, WINDOWS_SPAWN_WRAPPER_STALE_MS;
 var init_bridge = __esm({
   "src/engine/bridge.ts"() {
     "use strict";
@@ -1866,8 +1977,10 @@ var init_bridge = __esm({
     APP_SERVER_START_TIMEOUT_MS = 2e4;
     APP_SERVER_GATEWAY_START_TIMEOUT_MS = 5e3;
     APP_SERVER_HEALTH_RETRY_MS = 250;
-    APP_SERVER_AUTH_QUERY_PARAM = "tap_token";
+    AUTH_SUBPROTOCOL_PREFIX = "tap-auth-";
     APP_SERVER_AUTH_FILE_MODE = 384;
+    WINDOWS_SPAWN_WRAPPER_PREFIX = "tap-spawn-";
+    WINDOWS_SPAWN_WRAPPER_STALE_MS = 60 * 60 * 1e3;
   }
 });
 
@@ -2068,13 +2181,14 @@ function setNestedKey(obj, keyPath, value) {
 function normalizeTapCommsDir(value) {
   return typeof value === "string" ? path9.resolve(value).replace(/\\/g, "/") : "";
 }
-var MCP_SERVER_KEY, claudeAdapter;
+var MCP_SERVER_KEY, OLD_MCP_SERVER_KEY, claudeAdapter;
 var init_claude = __esm({
   "src/adapters/claude.ts"() {
     "use strict";
     init_state();
     init_common();
-    MCP_SERVER_KEY = "tap-comms";
+    MCP_SERVER_KEY = "tap";
+    OLD_MCP_SERVER_KEY = "tap-comms";
     claudeAdapter = {
       runtime: "claude",
       async probe(ctx) {
@@ -2131,6 +2245,11 @@ var init_claude = __esm({
                 `Existing "${MCP_SERVER_KEY}" entry in .mcp.json will be overwritten.`
               );
             }
+            if (config.mcpServers?.[OLD_MCP_SERVER_KEY]) {
+              conflicts.push(
+                `Legacy "${OLD_MCP_SERVER_KEY}" entry will be migrated to "${MCP_SERVER_KEY}".`
+              );
+            }
           } catch {
             warnings.push(
               ".mcp.json exists but is not valid JSON. Will be overwritten."
@@ -2140,7 +2259,7 @@ var init_claude = __esm({
         const serverEntry = buildMcpServerEntry(ctx);
         if (!serverEntry) {
           warnings.push(
-            "tap-comms MCP server entry not found. Skipping .mcp.json patch. Reinstall @hua-labs/tap or run from a repo with packages/tap-plugin/channels/ available."
+            "tap MCP server entry not found. Skipping .mcp.json patch. Reinstall @hua-labs/tap or run from a repo with packages/tap-plugin/channels/ available."
           );
           return {
             runtime: "claude",
@@ -2193,6 +2312,10 @@ var init_claude = __esm({
                   );
                 }
               }
+              const servers = config.mcpServers;
+              if (servers?.[OLD_MCP_SERVER_KEY]) {
+                delete servers[OLD_MCP_SERVER_KEY];
+              }
               if (op.key) {
                 setNestedKey(config, op.key, op.value);
               }
@@ -2241,7 +2364,7 @@ var init_claude = __esm({
               checks.push({ name: "Config is valid JSON", passed: true });
               const entry = config.mcpServers?.[MCP_SERVER_KEY];
               checks.push({
-                name: "tap-comms entry present",
+                name: "tap entry present",
                 passed: !!entry,
                 message: entry ? void 0 : `mcpServers.${MCP_SERVER_KEY} not found`
               });
@@ -2350,6 +2473,14 @@ function extractTomlTable(content, selector) {
   return `${lines.slice(range.start, range.end).join("\n")}
 `;
 }
+function removeTomlTable(content, selector) {
+  const lines = splitLines(content);
+  const range = findTableRange(lines, selector);
+  if (!range) return content;
+  const next = [...lines.slice(0, range.start), ...lines.slice(range.end)];
+  return `${trimTomlDocument(next.join("\n"))}
+`;
+}
 function replaceTomlTable(content, selector, replacement) {
   const lines = splitLines(content);
   const range = findTableRange(lines, selector);
@@ -2475,12 +2606,12 @@ function verifyManagedToml(content, ctx, configPath) {
     message: fs11.existsSync(configPath) ? void 0 : `${configPath} not found`
   });
   checks.push({
-    name: "tap-comms MCP table present",
+    name: "tap MCP table present",
     passed: !!mainTable,
     message: mainTable ? void 0 : `${MCP_SELECTOR} not found`
   });
   checks.push({
-    name: "tap-comms env table present",
+    name: "tap env table present",
     passed: !!envTable,
     message: envTable ? void 0 : `${ENV_SELECTOR} not found`
   });
@@ -2500,12 +2631,12 @@ function verifyManagedToml(content, ctx, configPath) {
       passed: mainTable.includes(
         `command = "${managed.command.replace(/\\/g, "\\\\")}"`
       ) && mainTable.includes(`args = [${expectedArgs}]`),
-      message: "Managed tap-comms command/args do not match expected values"
+      message: "Managed tap command/args do not match expected values"
     });
   }
   return checks;
 }
-var MCP_SELECTOR, ENV_SELECTOR, codexAdapter;
+var MCP_SELECTOR, ENV_SELECTOR, OLD_MCP_SELECTOR, OLD_ENV_SELECTOR, codexAdapter;
 var init_codex = __esm({
   "src/adapters/codex.ts"() {
     "use strict";
@@ -2513,8 +2644,10 @@ var init_codex = __esm({
     init_artifact_backups();
     init_toml();
     init_common();
-    MCP_SELECTOR = "mcp_servers.tap-comms";
-    ENV_SELECTOR = "mcp_servers.tap-comms.env";
+    MCP_SELECTOR = "mcp_servers.tap";
+    ENV_SELECTOR = "mcp_servers.tap.env";
+    OLD_MCP_SELECTOR = "mcp_servers.tap-comms";
+    OLD_ENV_SELECTOR = "mcp_servers.tap-comms.env";
     codexAdapter = {
       runtime: "codex",
       async probe(ctx) {
@@ -2560,6 +2693,11 @@ var init_codex = __esm({
           if (extractTomlTable(content, MCP_SELECTOR)) {
             conflicts.push(`Existing ${MCP_SELECTOR} table will be updated.`);
           }
+          if (extractTomlTable(content, OLD_MCP_SELECTOR)) {
+            conflicts.push(
+              `Legacy ${OLD_MCP_SELECTOR} table will be migrated to ${MCP_SELECTOR}.`
+            );
+          }
           if (extractTomlTable(content, ENV_SELECTOR)) {
             conflicts.push(`Existing ${ENV_SELECTOR} table will be updated.`);
           }
@@ -2625,6 +2763,12 @@ var init_codex = __esm({
           return { ...artifact, backupPath };
         });
         let nextContent = existingContent;
+        if (extractTomlTable(nextContent, OLD_ENV_SELECTOR)) {
+          nextContent = removeTomlTable(nextContent, OLD_ENV_SELECTOR);
+        }
+        if (extractTomlTable(nextContent, OLD_MCP_SELECTOR)) {
+          nextContent = removeTomlTable(nextContent, OLD_MCP_SELECTOR);
+        }
         nextContent = replaceTomlTable(
           nextContent,
           MCP_SELECTOR,
@@ -2801,7 +2945,7 @@ function verifyGeminiConfig(config, configPath, ctx) {
     message: fs12.existsSync(configPath) ? void 0 : `${configPath} not found`
   });
   checks.push({
-    name: "tap-comms entry present",
+    name: "tap entry present",
     passed: !!entry,
     message: entry ? void 0 : `${GEMINI_SELECTOR} not found`
   });
@@ -2819,14 +2963,15 @@ function verifyGeminiConfig(config, configPath, ctx) {
   }
   return checks;
 }
-var GEMINI_SELECTOR, geminiAdapter;
+var GEMINI_SELECTOR, OLD_GEMINI_SELECTOR, geminiAdapter;
 var init_gemini = __esm({
   "src/adapters/gemini.ts"() {
     "use strict";
     init_state();
     init_artifact_backups();
     init_common();
-    GEMINI_SELECTOR = "mcpServers.tap-comms";
+    GEMINI_SELECTOR = "mcpServers.tap";
+    OLD_GEMINI_SELECTOR = "mcpServers.tap-comms";
     geminiAdapter = {
       runtime: "gemini",
       async probe(ctx) {
@@ -2875,6 +3020,11 @@ var init_gemini = __esm({
             if (readNestedKey(config, GEMINI_SELECTOR) !== void 0) {
               conflicts.push(`Existing ${GEMINI_SELECTOR} entry will be updated.`);
             }
+            if (readNestedKey(config, OLD_GEMINI_SELECTOR) !== void 0) {
+              conflicts.push(
+                `Legacy ${OLD_GEMINI_SELECTOR} entry will be migrated to ${GEMINI_SELECTOR}.`
+              );
+            }
           } catch {
             warnings.push(
               `${configPath} exists but is not valid JSON. It will be replaced.`
@@ -2942,6 +3092,13 @@ var init_gemini = __esm({
           existed: previousValue !== void 0,
           value: previousValue
         });
+        const oldValue = readNestedKey(config, OLD_GEMINI_SELECTOR);
+        if (oldValue !== void 0) {
+          const servers = config.mcpServers;
+          if (servers) {
+            delete servers["tap-comms"];
+          }
+        }
         setNestedKey2(config, GEMINI_SELECTOR, {
           command: managed.command,
           args: managed.args,
@@ -3049,16 +3206,31 @@ function redactProtectedUrl(url) {
   try {
     const parsed = new URL(url);
     if (parsed.searchParams.has("tap_token")) {
-      parsed.searchParams.set("tap_token", "***");
+      parsed.searchParams.delete("tap_token");
     }
     return parsed.toString().replace(/\/$/, "");
   } catch {
-    return url.replace(/tap_token=[^&]+/g, "tap_token=***");
+    return url.replace(/[?&]tap_token=[^&]+/g, "");
   }
 }
 function loadCurrentBridgeState(stateDir, instanceId, fallback) {
   return loadBridgeState(stateDir, instanceId) ?? fallback ?? null;
 }
+function formatThreadSummary(threadId, cwd) {
+  if (!threadId) {
+    return "-";
+  }
+  return cwd ? `${threadId} (${cwd})` : threadId;
+}
+function normalizeComparablePath(value) {
+  return path13.resolve(value).replace(/\\/g, "/").toLowerCase();
+}
+function sameOptionalPath(left, right) {
+  if (!left || !right) {
+    return left === right;
+  }
+  return normalizeComparablePath(left) === normalizeComparablePath(right);
+}
 function getSharedAppServerUsers(state, stateDir, currentInstanceId, appServerUrl) {
   const shared = [];
   for (const [id, inst] of Object.entries(state.instances)) {
@@ -3136,37 +3308,37 @@ async function bridgeStart(identifier, agentName, flags = {}) {
     };
   }
   const instanceId = resolved.instanceId;
-  let instance = state.instances[instanceId];
-  if (!instance?.installed) {
+  let instance2 = state.instances[instanceId];
+  if (!instance2?.installed) {
     return {
       ok: false,
       command: "bridge",
       instanceId,
-      runtime: instance?.runtime,
+      runtime: instance2?.runtime,
       code: "TAP_INSTANCE_NOT_FOUND",
-      message: `${instanceId} is not installed. Run: npx @hua-labs/tap add ${instance?.runtime ?? identifier}`,
+      message: `${instanceId} is not installed. Run: npx @hua-labs/tap add ${instance2?.runtime ?? identifier}`,
       warnings: [],
       data: {}
     };
   }
-  const adapter = getAdapter(instance.runtime);
+  const adapter = getAdapter(instance2.runtime);
   const mode = adapter.bridgeMode();
   if (mode !== "app-server") {
     return {
       ok: true,
       command: "bridge",
       instanceId,
-      runtime: instance.runtime,
+      runtime: instance2.runtime,
       code: "TAP_NO_OP",
       message: `${instanceId} uses ${mode} mode \u2014 no bridge needed.`,
       warnings: [],
       data: { bridgeMode: mode }
     };
   }
-  const resolvedAgentName = agentName ?? instance.agentName ?? void 0;
-  if (agentName && agentName !== instance.agentName) {
-    instance = { ...instance, agentName };
-    const updatedState = updateInstanceState(state, instanceId, instance);
+  const resolvedAgentName = agentName ?? instance2.agentName ?? void 0;
+  if (agentName && agentName !== instance2.agentName) {
+    instance2 = { ...instance2, agentName };
+    const updatedState = updateInstanceState(state, instanceId, instance2);
     saveState(repoRoot, updatedState);
     state = updatedState;
   }
@@ -3177,7 +3349,7 @@ async function bridgeStart(identifier, agentName, flags = {}) {
       ok: false,
       command: "bridge",
       instanceId,
-      runtime: instance.runtime,
+      runtime: instance2.runtime,
       code: "TAP_BRIDGE_SCRIPT_MISSING",
       message: `Bridge script not found for ${instanceId}. Ensure the runtime is properly configured.`,
       warnings: [],
@@ -3186,8 +3358,8 @@ async function bridgeStart(identifier, agentName, flags = {}) {
   }
   const { config: resolvedConfig } = resolveConfig({}, repoRoot);
   const runtimeCommand = resolvedConfig.runtimeCommand;
-  const manageAppServer = instance.runtime === "codex" && flags["no-server"] !== true;
-  let effectivePort = instance.port;
+  const manageAppServer = instance2.runtime === "codex" && flags["no-server"] !== true;
+  let effectivePort = instance2.port;
   if (effectivePort == null && manageAppServer) {
     effectivePort = await findNextAvailableAppServerPort(
       state,
@@ -3195,8 +3367,8 @@ async function bridgeStart(identifier, agentName, flags = {}) {
       4501,
       instanceId
     );
-    instance = { ...instance, port: effectivePort };
-    const updatedState = updateInstanceState(state, instanceId, instance);
+    instance2 = { ...instance2, port: effectivePort };
+    const updatedState = updateInstanceState(state, instanceId, instance2);
     saveState(repoRoot, updatedState);
     state = updatedState;
   }
@@ -3212,19 +3384,19 @@ async function bridgeStart(identifier, agentName, flags = {}) {
   if (effectivePort != null) log(`Port:          ${effectivePort}`);
   if (resolvedAgentName) log(`Agent name:    ${resolvedAgentName}`);
   const noAuth = flags["no-auth"] === true;
-  if (!manageAppServer && instance.runtime === "codex") {
+  if (!manageAppServer && instance2.runtime === "codex") {
     log("Auto server:   disabled (--no-server)");
   }
   if (noAuth && manageAppServer) {
     log("Auth gateway:  disabled (--no-auth)");
   }
-  const willBeHeadless = flags["headless"] === true || instance.headless?.enabled;
+  const willBeHeadless = flags["headless"] === true || instance2.headless?.enabled;
   if (willBeHeadless) {
-    const role = (typeof flags["role"] === "string" ? flags["role"] : null) ?? instance.headless?.role ?? "reviewer";
+    const role = (typeof flags["role"] === "string" ? flags["role"] : null) ?? instance2.headless?.role ?? "reviewer";
     log(`Headless:      ${role}`);
   }
   try {
-    if (!manageAppServer && instance.runtime === "codex") {
+    if (!manageAppServer && instance2.runtime === "codex") {
       log("Checking app-server health...");
       const healthy = await checkAppServerHealth(appServerUrl);
       if (healthy) {
@@ -3235,7 +3407,7 @@ async function bridgeStart(identifier, agentName, flags = {}) {
           ok: false,
           command: "bridge",
           instanceId,
-          runtime: instance.runtime,
+          runtime: instance2.runtime,
           code: "TAP_BRIDGE_START_FAILED",
           message: `App server not reachable at ${appServerUrl}. Start it first: codex app-server --listen ${appServerUrl}`,
           warnings: [],
@@ -3249,7 +3421,7 @@ async function bridgeStart(identifier, agentName, flags = {}) {
         ok: false,
         command: "bridge",
         instanceId,
-        runtime: instance.runtime,
+        runtime: instance2.runtime,
         code: "TAP_INVALID_ARGUMENT",
         message: `Invalid --busy-mode: ${String(busyModeRaw)}. Must be "steer" or "wait".`,
         warnings: [],
@@ -3257,9 +3429,38 @@ async function bridgeStart(identifier, agentName, flags = {}) {
       };
     }
     const busyMode = busyModeRaw;
-    const pollSeconds = typeof flags["poll-seconds"] === "string" ? parseInt(flags["poll-seconds"], 10) : void 0;
-    const reconnectSeconds = typeof flags["reconnect-seconds"] === "string" ? parseInt(flags["reconnect-seconds"], 10) : void 0;
-    const messageLookbackMinutes = typeof flags["message-lookback-minutes"] === "string" ? parseInt(flags["message-lookback-minutes"], 10) : void 0;
+    const pollSecondsRaw = typeof flags["poll-seconds"] === "string" ? flags["poll-seconds"] : void 0;
+    const reconnectSecondsRaw = typeof flags["reconnect-seconds"] === "string" ? flags["reconnect-seconds"] : void 0;
+    const lookbackRaw = typeof flags["message-lookback-minutes"] === "string" ? flags["message-lookback-minutes"] : void 0;
+    let pollSeconds;
+    let reconnectSeconds;
+    let messageLookbackMinutes;
+    try {
+      pollSeconds = parseIntFlag(pollSecondsRaw, "--poll-seconds", 1, 3600);
+      reconnectSeconds = parseIntFlag(
+        reconnectSecondsRaw,
+        "--reconnect-seconds",
+        1,
+        3600
+      );
+      messageLookbackMinutes = parseIntFlag(
+        lookbackRaw,
+        "--message-lookback-minutes",
+        1,
+        10080
+      );
+    } catch (err) {
+      return {
+        ok: false,
+        command: "bridge",
+        instanceId,
+        runtime: instance2.runtime,
+        code: "TAP_INVALID_ARGUMENT",
+        message: err instanceof Error ? err.message : String(err),
+        warnings: [],
+        data: {}
+      };
+    }
     const threadId = typeof flags["thread-id"] === "string" ? flags["thread-id"] : void 0;
     const ephemeral = flags["ephemeral"] === true;
     const processExistingMessages = flags["process-existing-messages"] === true;
@@ -3271,7 +3472,7 @@ async function bridgeStart(identifier, agentName, flags = {}) {
         ok: false,
         command: "bridge",
         instanceId,
-        runtime: instance.runtime,
+        runtime: instance2.runtime,
         code: "TAP_INVALID_ARGUMENT",
         message: `Invalid --role: ${roleArg}. Must be: ${validRoles.join(", ")}`,
         warnings: [],
@@ -3283,10 +3484,10 @@ async function bridgeStart(identifier, agentName, flags = {}) {
       role: roleArg ?? "reviewer",
       maxRounds: 5,
       qualitySeverityFloor: "high"
-    } : instance.headless;
+    } : instance2.headless;
     const bridge = await startBridge({
       instanceId,
-      runtime: instance.runtime,
+      runtime: instance2.runtime,
       stateDir: ctx.stateDir,
       commsDir: ctx.commsDir,
       bridgeScript,
@@ -3327,14 +3528,14 @@ async function bridgeStart(identifier, agentName, flags = {}) {
         log(`TUI connect:  ${bridge.appServer.url}`);
       }
     }
-    const updated = { ...instance, bridge, manageAppServer, noAuth };
+    const updated = { ...instance2, bridge, manageAppServer, noAuth };
     const newState = updateInstanceState(state, instanceId, updated);
     saveState(repoRoot, newState);
     return {
       ok: true,
       command: "bridge",
       instanceId,
-      runtime: instance.runtime,
+      runtime: instance2.runtime,
       code: "TAP_BRIDGE_START_OK",
       message: `Bridge for ${instanceId} started (PID: ${bridge.pid})`,
       warnings: [],
@@ -3347,7 +3548,7 @@ async function bridgeStart(identifier, agentName, flags = {}) {
       ok: false,
       command: "bridge",
       instanceId,
-      runtime: instance.runtime,
+      runtime: instance2.runtime,
       code: "TAP_BRIDGE_START_FAILED",
       message: msg,
       warnings: [],
@@ -3449,11 +3650,11 @@ async function bridgeStopOne(identifier) {
   }
   const instanceId = resolved.instanceId;
   const ctx = createAdapterContext(state.commsDir, repoRoot);
-  const instance = state.instances[instanceId];
+  const instance2 = state.instances[instanceId];
   const bridgeState = loadCurrentBridgeState(
     ctx.stateDir,
     instanceId,
-    instance?.bridge
+    instance2?.bridge
   );
   const appServer = bridgeState?.appServer ?? null;
   logHeader(`@hua-labs/tap bridge stop ${instanceId}`);
@@ -3501,8 +3702,8 @@ async function bridgeStopOne(identifier) {
       }
     }
   }
-  if (instance) {
-    const updated = { ...instance, bridge: null };
+  if (instance2) {
+    const updated = { ...instance2, bridge: null };
     const newState = updateInstanceState(state, instanceId, updated);
     saveState(repoRoot, newState);
   }
@@ -3574,9 +3775,9 @@ async function bridgeStopAll() {
       logSuccess(`Stopped bridge for ${instanceId}`);
       stopped.push(instanceId);
     }
-    const instance = state.instances[instanceId];
-    if (instance?.bridge) {
-      state.instances[instanceId] = { ...instance, bridge: null };
+    const instance2 = state.instances[instanceId];
+    if (instance2?.bridge) {
+      state.instances[instanceId] = { ...instance2, bridge: null };
       stateChanged = true;
     }
   }
@@ -3642,12 +3843,18 @@ function bridgeStatusAll() {
         pid: null,
         port: inst.port,
         lastHeartbeat: null,
+        threadId: null,
+        threadCwd: null,
+        savedThreadId: null,
+        savedThreadCwd: null,
         appServer: null
       };
       continue;
     }
     const status = getBridgeStatus(stateDir, instanceId);
     const bridgeState = loadBridgeState(stateDir, instanceId);
+    const runtimeHeartbeat = loadRuntimeBridgeHeartbeat(bridgeState);
+    const savedThread = loadRuntimeBridgeThreadState(bridgeState);
     const age = getHeartbeatAge(stateDir, instanceId);
     const pid = bridgeState?.pid ?? null;
     const heartbeat = getBridgeHeartbeatTimestamp(stateDir, instanceId);
@@ -3669,12 +3876,26 @@ function bridgeStatusAll() {
         );
       }
     }
+    if (runtimeHeartbeat?.threadId) {
+      log(
+        `  Thread:     ${formatThreadSummary(runtimeHeartbeat.threadId, runtimeHeartbeat.threadCwd)}`
+      );
+    }
+    if (savedThread?.threadId && (savedThread.threadId !== runtimeHeartbeat?.threadId || !sameOptionalPath(savedThread.cwd, runtimeHeartbeat?.threadCwd))) {
+      log(
+        `  Saved:      ${formatThreadSummary(savedThread.threadId, savedThread.cwd)}`
+      );
+    }
     bridges[instanceId] = {
       status,
       runtime: inst.runtime,
       pid,
       port: inst.port,
       lastHeartbeat: heartbeat,
+      threadId: runtimeHeartbeat?.threadId ?? null,
+      threadCwd: runtimeHeartbeat?.threadCwd ?? null,
+      savedThreadId: savedThread?.threadId ?? null,
+      savedThreadCwd: savedThread?.cwd ?? null,
       appServer: bridgeState?.appServer ?? null
     };
   }
@@ -3750,6 +3971,10 @@ function bridgeStatusOne(identifier) {
         pid: null,
         port: inst.port,
         lastHeartbeat: null,
+        threadId: null,
+        threadCwd: null,
+        savedThreadId: null,
+        savedThreadCwd: null,
         appServer: null
       }
     };
@@ -3758,6 +3983,8 @@ function bridgeStatusOne(identifier) {
   const stateDir = resolvedCfg2.stateDir;
   const status = getBridgeStatus(stateDir, instanceId);
   const bridgeState = loadBridgeState(stateDir, instanceId);
+  const runtimeHeartbeat = loadRuntimeBridgeHeartbeat(bridgeState);
+  const savedThread = loadRuntimeBridgeThreadState(bridgeState);
   const age = getHeartbeatAge(stateDir, instanceId);
   const heartbeat = getBridgeHeartbeatTimestamp(stateDir, instanceId);
   log(`Status:      ${status}`);
@@ -3766,6 +3993,16 @@ function bridgeStatusOne(identifier) {
     log(
       `Heartbeat:   ${heartbeat ?? "-"}${age !== null ? ` (${formatAge(age)})` : ""}`
     );
+    if (runtimeHeartbeat?.threadId) {
+      log(
+        `Thread:      ${formatThreadSummary(runtimeHeartbeat.threadId, runtimeHeartbeat.threadCwd)}`
+      );
+    }
+    if (savedThread?.threadId && (savedThread.threadId !== runtimeHeartbeat?.threadId || !sameOptionalPath(savedThread.cwd, runtimeHeartbeat?.threadCwd))) {
+      log(
+        `Saved:       ${formatThreadSummary(savedThread.threadId, savedThread.cwd)}`
+      );
+    }
     log(
       `Log:         ${path13.join(stateDir, "logs", `bridge-${instanceId}.log`)}`
     );
@@ -3814,6 +4051,10 @@ function bridgeStatusOne(identifier) {
       pid: bridgeState?.pid ?? null,
       port: inst.port,
       lastHeartbeat: heartbeat,
+      threadId: runtimeHeartbeat?.threadId ?? null,
+      threadCwd: runtimeHeartbeat?.threadCwd ?? null,
+      savedThreadId: savedThread?.threadId ?? null,
+      savedThreadCwd: savedThread?.cwd ?? null,
       appServer: bridgeState?.appServer ?? null
     }
   };
@@ -3872,8 +4113,22 @@ async function bridgeRestart(identifier, flags) {
     };
   }
   const { config: resolvedConfig } = resolveConfig({}, repoRoot);
-  const drainStr = typeof flags["drain-timeout"] === "string" ? flags["drain-timeout"] : "30";
-  const drainTimeout = parseInt(drainStr, 10) || 30;
+  const drainStr = typeof flags["drain-timeout"] === "string" ? flags["drain-timeout"] : void 0;
+  let drainTimeout;
+  try {
+    drainTimeout = parseIntFlag(drainStr, "--drain-timeout", 1, 300) ?? 30;
+  } catch (err) {
+    return {
+      ok: false,
+      command: "bridge",
+      instanceId,
+      runtime: instance.runtime,
+      code: "TAP_INVALID_ARGUMENT",
+      message: err instanceof Error ? err.message : String(err),
+      warnings: [],
+      data: {}
+    };
+  }
   logHeader(`@hua-labs/tap bridge restart ${instanceId}`);
   log(`Drain timeout: ${drainTimeout}s`);
   try {
@@ -4027,7 +4282,7 @@ var init_bridge2 = __esm({
     init_utils();
     BRIDGE_HELP = `
 Usage:
-  tap-comms bridge <subcommand> [instance] [options]
+  tap bridge <subcommand> [instance] [options]
 
 Subcommands:
   start <instance>  Start bridge for an instance (e.g. codex, codex-reviewer)
@@ -4039,7 +4294,7 @@ Subcommands:
 
 Options:
   --agent-name <name>              Agent identity for bridge (or set TAP_AGENT_NAME env)
-                                   Saved to state \u2014 only needed on first start
+                                   Overrides the stored name from 'tap add' when needed
   --all                            Start all registered app-server instances
   --busy-mode <steer|wait>         How to handle active turns (default: steer)
   --poll-seconds <n>               Inbox poll interval (default: 5)
@@ -4085,7 +4340,18 @@ async function upCommand(args) {
     };
   }
   const repoRoot = findRepoRoot();
-  const result = await bridgeCommand(["start", "--all", ...args]);
+  const previousColdStartWarmup = process.env.TAP_COLD_START_WARMUP;
+  process.env.TAP_COLD_START_WARMUP = "true";
+  let result;
+  try {
+    result = await bridgeCommand(["start", "--all", ...args]);
+  } finally {
+    if (previousColdStartWarmup === void 0) {
+      delete process.env.TAP_COLD_START_WARMUP;
+    } else {
+      process.env.TAP_COLD_START_WARMUP = previousColdStartWarmup;
+    }
+  }
   const snapshot = collectDashboardSnapshot(repoRoot);
   const activeBridges = snapshot.bridges.filter(
     (bridge) => bridge.status === "running"
@@ -4121,7 +4387,7 @@ var init_up = __esm({
     init_utils();
     UP_HELP = `
 Usage:
-  tap-comms up [bridge-start options]
+  tap up [bridge-start options]
 
 Description:
   Start all registered app-server bridge daemons with one command.
@@ -4186,7 +4452,7 @@ var init_down = __esm({
     init_utils();
     DOWN_HELP = `
 Usage:
-  tap-comms down
+  tap down
 
 Description:
   Stop all running bridge daemons and managed app-servers.
@@ -4240,14 +4506,14 @@ async function* streamEvents(options) {
   const repoRoot = options?.repoRoot ?? findRepoRoot();
   while (!options?.signal?.aborted) {
     yield collectDashboardSnapshot(repoRoot, options?.commsDir);
-    await new Promise((resolve8) => {
+    await new Promise((resolve9) => {
       const onAbort = () => {
         clearTimeout(timer);
-        resolve8();
+        resolve9();
       };
       const timer = setTimeout(() => {
         options?.signal?.removeEventListener("abort", onAbort);
-        resolve8();
+        resolve9();
       }, intervalMs);
       options?.signal?.addEventListener("abort", onAbort, { once: true });
     });
@@ -4346,11 +4612,38 @@ function getConfig(options) {
 import {
   createServer as createServer2
 } from "http";
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 var CORS_HEADERS = {
   "Access-Control-Allow-Origin": "http://localhost:3000",
   "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type"
+  "Access-Control-Allow-Headers": "Content-Type, Authorization"
 };
+function tokensMatch(presentedToken, expectedToken) {
+  if (!presentedToken) {
+    return false;
+  }
+  const presented = Buffer.from(presentedToken, "utf8");
+  const expected = Buffer.from(expectedToken, "utf8");
+  if (presented.length !== expected.length) {
+    return false;
+  }
+  return timingSafeEqual(presented, expected);
+}
+function verifyBearerToken(req, expectedToken) {
+  const header = req.headers.authorization;
+  if (!header?.startsWith("Bearer ")) {
+    return false;
+  }
+  return tokensMatch(header.slice(7), expectedToken);
+}
+function verifySseToken(req, expectedToken, serverUrl) {
+  if (verifyBearerToken(req, expectedToken)) {
+    return true;
+  }
+  const url = new URL(req.url ?? "/", serverUrl);
+  const queryToken = url.searchParams.get("token");
+  return tokensMatch(queryToken, expectedToken);
+}
 function jsonResponse(res, data, status = 200) {
   res.writeHead(status, {
     "Content-Type": "application/json",
@@ -4393,6 +4686,7 @@ function handleHealth(res, apiOptions) {
 async function startHttpServer(options) {
   const port = options?.port ?? 4580;
   const host = "127.0.0.1";
+  const token = options?.token ?? randomBytes2(24).toString("base64url");
   const apiOptions = {
     repoRoot: options?.repoRoot,
     commsDir: options?.commsDir
@@ -4406,21 +4700,32 @@ async function startHttpServer(options) {
         res.end();
         return;
       }
+      if (req.method === "GET" && pathname === "/health") {
+        handleHealth(res, apiOptions);
+        return;
+      }
+      if (req.method === "GET" && pathname === "/api/events") {
+        const serverUrl = `http://${host}:${port}`;
+        if (!verifySseToken(req, token, serverUrl)) {
+          jsonResponse(res, { error: "Unauthorized" }, 401);
+          return;
+        }
+        await handleEvents(req, res, apiOptions);
+        return;
+      }
+      if (!verifyBearerToken(req, token)) {
+        jsonResponse(res, { error: "Unauthorized" }, 401);
+        return;
+      }
       try {
         if (req.method === "GET") {
           switch (pathname) {
             case "/api/snapshot":
               handleSnapshot(res, apiOptions);
               return;
-            case "/api/events":
-              await handleEvents(req, res, apiOptions);
-              return;
             case "/api/config":
               handleConfig(res, apiOptions);
               return;
-            case "/health":
-              handleHealth(res, apiOptions);
-              return;
           }
         }
         if (req.method === "POST") {
@@ -4449,17 +4754,18 @@ async function startHttpServer(options) {
       }
     }
   );
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     server.once("error", reject);
     server.listen(port, host, () => {
       server.removeListener("error", reject);
-      resolve8();
+      resolve9();
     });
   });
   return {
     port,
-    close: () => new Promise((resolve8, reject) => {
-      server.close((err) => err ? reject(err) : resolve8());
+    token,
+    close: () => new Promise((resolve9, reject) => {
+      server.close((err) => err ? reject(err) : resolve9());
     })
   };
 }