@ljwei-stak/dsh-model-route-bot 0.66.4 → 0.67.0

package/remote-computer-agent/src/desktop-session.ts

@@ -3,7 +3,7 @@ import {readFile} from 'node:fs/promises'
 import {EventEmitter} from 'node:events'
 import {randomUUID} from 'node:crypto'
 import type {WebSocket} from 'ws'
-import {AgentError,canonical,fail,integer,matches,secret,sha,type Context} from './protocol.js'
+import {AgentError,canonical,fail,identifier,integer,matches,secret,sha,type Context} from './protocol.js'
 
 type Config={pipeName:string;secretFile:string}
 type Ack={ok:boolean;code?:string;possiblyApplied?:boolean;stopConfirmed?:boolean;mode?:'watch'|'control';expiresAt?:number}
@@ -113,6 +113,13 @@ export class DesktopSessions {
     try{this.check(c);const ack=await row.native.request({t:'renew',expiresAt:c.expiresAt});if(ack.ok!==true)fail(ack.code??'DESKTOP_RENEW_FAILED',409);this.check(c);if(row.closed)fail('DESKTOP_SESSION_CLOSED',409);row.context=structuredClone(c);this.audit(row,'renewed');return this.ticket(row)}catch(e){await this.stop(row,'DESKTOP_RENEW_FAILED');throw e}finally{row.renewing=false}
   }
   async closeSession(c:Context,request:any){const row=this.own(c,request?.sessionId);return this.stop(row,'SESSION_CLOSED')}
+  async closeClientSession(clientId:string,request:any){
+    if(!request||typeof request!=='object'||Array.isArray(request)||Object.keys(request).some(key=>!['sessionId','botId','taskId','attemptId'].includes(key)))fail('INVALID_ARGUMENT')
+    for(const key of ['sessionId','botId','taskId','attemptId'])identifier(request[key])
+    const row=this.sessions.get(request.sessionId)
+    if(!row||row.context.clientId!==clientId||row.context.botId!==request.botId||row.context.taskId!==request.taskId||row.context.attemptId!==request.attemptId)fail('SCOPE_DENIED',403)
+    return this.stop(row,'SESSION_CLOSED')
+  }
   hasOrigin(origin:string){return [...this.sessions.values()].some(row=>!row.closed&&row.origin===origin&&row.context.expiresAt>Date.now())}
   private send(row:Session,message:any){if(row.socket?.readyState===1)row.socket.send(JSON.stringify(message))}
   private nextFrame(row:Session,delay=0){if(row.closed||row.frameRequested||row.pendingFrame||!row.socket||row.socket.readyState!==1)return;clearTimeout(row.frameTimer);row.frameRequested=true;row.frameTimer=setTimeout(()=>void (async()=>{if(row.closed)return;this.check(row.context);if(row.profile!==row.appliedProfile){const ack=await row.native.request({t:'video',...videoProfiles[row.profile]});if(!ack.ok)throw new AgentError(ack.code??'DESKTOP_VIDEO_FAILED');row.appliedProfile=row.profile}if(!row.closed)row.native.frame(this.forceKeyframes.delete(row))})().catch(()=>this.stop(row,'DESKTOP_VIDEO_FAILED')),delay);row.frameTimer.unref()}
@@ -156,7 +163,7 @@ export class DesktopSessions {
     fail('INVALID_ARGUMENT')
   }
   /** Called only after the HTTP server validates Host/network/TLS on upgrade. */
-  accept(socket:WebSocket,origin?:string,allowedOrigins:string[]=[]){
+  accept(socket:WebSocket,origin?:string,allowedOrigins:string[]=[],peerClientId?:string){
     this.sockets.add(socket);let row:Session|undefined,authenticating=false,alive=true
     const authTimer=setTimeout(()=>socket.close(1008,'Desktop authentication required'),this.options.authTimeoutMs??5000);authTimer.unref()
     const heartbeat=setInterval(()=>{if(!alive){socket.terminate();return}alive=false;socket.ping()},15000);heartbeat.unref();socket.on('pong',data=>{
@@ -181,6 +188,7 @@ export class DesktopSessions {
         try{
           const candidate=this.sessions.get(message.sessionId)
           if(message.type!=='auth'||typeof message.token!=='string'||!/^[A-Za-z0-9_-]{43}$/.test(message.token)||!candidate||!matches(message.token,candidate.digest))fail('AUTH_INVALID',401)
+          if(peerClientId!==undefined&&candidate.context.clientId!==peerClientId)fail('AUTH_INVALID',401)
           if(candidate.closed||candidate.used)fail('DESKTOP_SESSION_CLOSED',409)
           this.check(candidate.context)
           if(origin!==undefined&&(candidate.origin?origin!==candidate.origin:!allowedOrigins.includes(origin)))fail('ORIGIN_DENIED',403)
@@ -221,7 +229,7 @@ export class DesktopSessions {
   }
   private stop(row:Session,reason:string):Promise<{stopConfirmed:boolean}>{
     this.forceKeyframes.delete(row)
-    if(row.stop)return row.stop
+    if(row.stop)return row.stopped?Promise.resolve({stopConfirmed:true}):row.stop
     row.closed=true;row.closedAt=Date.now();clearTimeout(row.frameTimer);clearTimeout(row.ackTimer);row.pendingFrame=undefined
     row.stop=(async()=>{const result=await row.native.close().catch(()=>({stopConfirmed:false}));row.stopped=result.stopConfirmed===true;row.mode='watch';this.send(row,{type:'status',status:'disconnected',mode:'watch',code:reason,stopConfirmed:row.stopped});row.socket?.close(1000,'Desktop session closed');this.audit(row,'closed',{reason,stopConfirmed:row.stopped});return {stopConfirmed:row.stopped}})()
     return row.stop

package/remote-computer-agent/src/e2e-server.ts

@@ -0,0 +1,81 @@
+import http from 'node:http'
+import { duplexPair } from 'node:stream'
+import { WebSocketServer } from 'ws'
+import { E2ESession, TRANSPORT_DIRECT, DIRECT_PROTOCOL, SEND_BUFFER_HIGH } from '../../modules/openmaus-protocol/index.mjs'
+import { fail } from './protocol.js'
+import type { SecurePairing } from './secure-pairing.js'
+
+type Peer = Parameters<SecurePairing['validPeer']>[0]
+
+/** Inner requests arrive only on a successfully authenticated Noise stream, never a public TCP port. */
+export function secureTransport(pairing: SecurePairing,
+  handler: (req: http.IncomingMessage, res: http.ServerResponse, peer: Peer) => void,
+  upgrade: (req: http.IncomingMessage, socket: any, head: Buffer, peer: Peer) => void) {
+  const sockets = new WebSocketServer({ noServer: true, maxPayload: 65535, perMessageDeflate: false,
+    handleProtocols: protocols => protocols.has(DIRECT_PROTOCOL) ? DIRECT_PROTOCOL : false })
+  const sessions = new Set<any>(), attempts = new Map<string, { start: number; count: number }>()
+  let windowStart = 0, windowCount = 0, closing = false
+  const sweep = setInterval(() => {
+    for (const session of sessions) if (session.peer && !pairing.validPeer(session.peer)) session.remove()
+  }, 500)
+  sweep.unref()
+  return {
+    accept(req: http.IncomingMessage, socket: any, head: Buffer) {
+      if (closing || sockets.clients.size >= 16) fail('E2E_CONNECTION_LIMIT', 429)
+      if (req.headers.origin !== undefined || req.headers['sec-websocket-protocol'] !== DIRECT_PROTOCOL) fail('E2E_CLIENT_REQUIRED', 403)
+      const now = Date.now(), source = req.socket.remoteAddress ?? 'unknown'
+      if (now - windowStart >= 60_000 || now < windowStart) { windowStart = now; windowCount = 0 }
+      const previous = attempts.get(source), row = previous && now - previous.start < 60_000 && now >= previous.start ? previous : { start: now, count: 0 }
+      if (++row.count > 30 || ++windowCount > 120) fail('E2E_CONNECTION_RATE_LIMIT', 429)
+      attempts.delete(source); attempts.set(source, row)
+      while (attempts.size > 256) attempts.delete(attempts.keys().next().value!)
+      sockets.handleUpgrade(req, socket, head, ws => {
+        sockets.emit('connection', ws, req)
+        const streams = new Set<any>()
+        let session: any
+        const origin = http.createServer((request, response) => {
+          if (!session.peer || !pairing.validPeer(session.peer)) { response.writeHead(403); response.end(); return }
+          handler(request, response, session.peer)
+        })
+        origin.requestTimeout = 30_000; origin.headersTimeout = 10_000
+        origin.on('upgrade', (request, connection, bytes) => {
+          if (!session.peer || !pairing.validPeer(session.peer)) return connection.destroy()
+          upgrade(request, connection, bytes, session.peer)
+        })
+        const transport = {
+          send: (message: Uint8Array) => { if (ws.readyState === 1) ws.send(message) },
+          close: (code: number) => { if (ws.readyState < 2) ws.close(code === 1000 || code >= 3000 && code <= 4999 ? code : 1000) },
+          get bufferedAmount() { return ws.bufferedAmount },
+          onceDrained(listener: () => void) {
+            const check = () => { if (ws.readyState !== 1 || ws.bufferedAmount <= SEND_BUFFER_HIGH / 4) listener(); else { const timer = setTimeout(check, 5); timer.unref() } }
+            check()
+          },
+        }
+        session = E2ESession.computer({ transport, transportByte: TRANSPORT_DIRECT, staticKey: pairing.transportKey,
+          candidates: () => pairing.candidates(),
+          async connectOrigin() {
+            if (!session.peer || !pairing.validPeer(session.peer)) throw new Error('Peer removed')
+            const [client, server] = duplexPair()
+            Object.assign(server, { setTimeout() { return server }, setNoDelay() { return server }, setKeepAlive() { return server }, remoteAddress: source })
+            client.on('error', () => {}); server.on('error', () => {})
+            client.once('close', () => server.destroy()); server.once('close', () => client.destroy())
+            streams.add(server); server.once('close', () => streams.delete(server))
+            origin.emit('connection', server)
+            return client
+          },
+        })
+        sessions.add(session)
+        ws.on('message', (data, binary) => { try { session.receive(Buffer.from(data as Buffer), binary) } catch { session.close(4000) } })
+        ws.on('error', () => session.close(4000))
+        ws.once('close', code => session.transportClosed(code))
+        void session.closed.then(() => { sessions.delete(session); for (const stream of streams) stream.destroy(); origin.close() })
+      })
+    },
+    async close() {
+      closing = true; clearInterval(sweep)
+      for (const session of sessions) session.shutdown()
+      for (const socket of sockets.clients) socket.terminate()
+      await new Promise<void>(resolve => sockets.close(() => resolve()))
+    },
+  }
+}

package/remote-computer-agent/src/pairing-page.ts

@@ -0,0 +1,35 @@
+import QRCode from 'qrcode'
+import { randomBytes } from 'node:crypto'
+import { mkdir, writeFile, lstat, rename, rm } from 'node:fs/promises'
+import { dirname, resolve } from 'node:path'
+import { fail } from './protocol.js'
+
+const escape=(value:unknown)=>String(value).replace(/[&<>"']/g,character=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[character]!))
+
+export async function pairingPage(invite:any){
+  const {code,...scannable}=invite
+  const payload=JSON.stringify(scannable),nonce=randomBytes(18).toString('base64'),fingerprint=invite.transport.fingerprint.match(/.{1,8}/g).join(' ')
+  let qr=''
+  try{qr=await QRCode.toString(payload,{type:'svg',errorCorrectionLevel:'M',margin:4,width:320})}catch{}
+  const html=`<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="default-src 'none';style-src 'unsafe-inline';script-src 'nonce-${nonce}';base-uri 'none';form-action 'none'"><title>安全配对 · DSH 电脑</title><style>
+  :root{font-family:system-ui,"Microsoft YaHei",sans-serif;color:#25342f;background:#f5f7f6;color-scheme:light}*{box-sizing:border-box}body{margin:0;padding:24px}.card{max-width:760px;margin:32px auto;padding:32px;background:white;border:1px solid #dfe7e2;border-radius:22px;box-shadow:0 16px 50px #142d2110}h1{margin:8px 0;font-size:25px}p{line-height:1.65;color:#5f6e65}.badge{font-size:12px;color:#317453}.grid{display:grid;grid-template-columns:300px minmax(0,1fr);gap:28px;align-items:center}.qr svg{display:block;width:100%;height:auto}.code{letter-spacing:.18em;font-size:36px;color:#244f3d;font-weight:650}.timer{font-weight:600;color:#317453}.expired{color:#a83a39}.fingerprint{display:block;font-size:12px;line-height:1.8;overflow-wrap:anywhere}textarea{width:100%;min-height:94px;padding:12px;border:1px solid #dfe7e2;border-radius:10px;font:11px monospace;resize:vertical;background:#f8faf8;color:#45584d}button{border:0;border-radius:9px;background:#2d654a;color:white;font:inherit;padding:10px 18px;cursor:pointer}button:disabled{opacity:.5}details{margin-top:20px}summary{cursor:pointer}.footer{font-size:12px;margin-bottom:0}@media(max-width:620px){body{padding:12px}.card{margin:8px auto;padding:22px}.grid{grid-template-columns:1fr;gap:8px}.qr{max-width:300px;margin:auto}}
+  </style></head><body><main class="card"><span class="badge">你的电脑 · 端到端加密</span><h1>把这台电脑连接到 Bot</h1><p>在已登录的插件中打开“安全配对电脑”，扫描或粘贴下方邀请码，再核对目标电脑的确认码。</p><div class="grid"><div class="qr">${qr||'<p>这份邀请包含较大的授权范围，请复制下方邀请码。</p>'}</div><section><strong>${escape(invite.name)}</strong><p>${escape(invite.endpoint)}</p><div aria-label="六位确认码" class="code">${escape(code)}</div><p id="timer" class="timer" role="timer">邀请码有效期为两分钟</p><strong>设备指纹</strong><code class="fingerprint">${escape(fingerprint)}</code></section></div><p>共享目录：${escape(invite.ceiling.roots.join('、'))}；允许 ${invite.ceiling.tools.length} 项能力。请在接收端核对同一范围。</p><label for="invite">设备邀请码（不含确认码）</label><textarea id="invite" readonly spellcheck="false">${escape(payload)}</textarea><p><button id="copy" type="button">复制邀请码</button> <span id="feedback" role="status"></span></p><details><summary>查看能力范围</summary><p>${escape(invite.ceiling.tools.join('、'))}</p></details><p class="footer">此页面在本机生成，不加载远程资源。邀请码过期后运行 pair-device.cmd 重新生成；已配对的设备需在目标电脑核对后管理。</p></main><script nonce="${nonce}">
+  const expiresAt=${invite.expiresAt};const timer=document.getElementById('timer');const update=()=>{const remaining=Math.max(0,Math.ceil((expiresAt-Date.now())/1000));timer.textContent=remaining?'邀请码剩余 '+remaining+' 秒':'邀请码已过期，请重新生成';timer.classList.toggle('expired',!remaining);document.getElementById('copy').disabled=!remaining};update();setInterval(update,1000);
+  document.getElementById('copy').onclick=async()=>{const field=document.getElementById('invite');try{await navigator.clipboard.writeText(field.value);document.getElementById('feedback').textContent='已复制'}catch{field.focus();field.select();document.getElementById('feedback').textContent='请按 Ctrl+C 复制选中的邀请码'}};
+  </script></body></html>`
+  return {html,qr:!!qr,payload}
+}
+
+/** Replacing an invitation replaces only the explicitly named regular file; no credential is printed. */
+export async function writePairingPage(invite:any,destination:string){
+  if(!destination)fail('PAIRING_OUTPUT_REQUIRED')
+  const page=resolve(destination),json=`${page}.private.json`
+  for(const path of [page,json]){const old=await lstat(path).catch(error=>{if(error.code==='ENOENT')return null;throw error});if(old&&(!old.isFile()||old.isSymbolicLink()||old.nlink!==1))fail('PAIRING_OUTPUT_INVALID')}
+  await mkdir(dirname(page),{recursive:true,mode:0o700})
+  const result=await pairingPage(invite)
+  for(const [path,text]of [[json,JSON.stringify(JSON.parse(result.payload),null,2)+'\n'],[page,result.html]]){
+    const temporary=`${path}.${randomBytes(8).toString('hex')}.tmp`
+    try{await writeFile(temporary,text,{flag:'wx',mode:0o600});await rename(temporary,path)}finally{await rm(temporary,{force:true})}
+  }
+  return {machineId:invite.machineId,clientId:invite.clientId,inviteId:invite.inviteId,expiresAt:invite.expiresAt,transport:invite.transport,pairingFile:json,pageFile:page,qr:result.qr}
+}

package/remote-computer-agent/src/protocol.ts

@@ -1,25 +1,25 @@
-import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
-export const AGENT_VERSION = '0.1.1'
-export const AGENT_API_MAJOR = 1
-export class AgentError extends Error { constructor(public code:string, public status=400) { super(code) } }
-export const fail = (code:string,status=400):never => { throw new AgentError(code,status) }
-export const secret = () => randomBytes(32).toString('base64url')
-export const sha = (value:string|Buffer) => createHash('sha256').update(value).digest('hex')
-export const matches = (value:string, digest:string) => { const a=Buffer.from(sha(value),'hex'),b=Buffer.from(digest,'hex'); return a.length===b.length && timingSafeEqual(a,b) }
-export function canonical(v:any):string { if(v===null||typeof v!=='object')return JSON.stringify(v);if(Array.isArray(v))return `[${v.map(canonical).join(',')}]`;return `{${Object.keys(v).sort().map(k=>`${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}` }
-export function identifier(v:any):string { if(typeof v!=='string'||!/^[-a-zA-Z0-9_.]{1,128}$/.test(v))fail('INVALID_ID');return v }
-export function integer(v:any,min:number,max:number,defaultValue?:number) { const n=v??defaultValue;if(!Number.isSafeInteger(n)||n<min||n>max)fail('INVALID_ARGUMENT');return n }
-export type Context = {clientId:string;botId:string;taskId:string;attemptId:string;roots:string[];tools:string[];expiresAt:number;revision:number;grantId:string}
-export const CATALOG = Object.freeze([
-  ['machine_ping',false],['fs_list',false],['fs_read',false],['fs_write',true],['shell_exec',true],
-  // Versioned container-command Task backend. A distinct name means an older
-  // Agent answers before any work instead of silently running a native shell.
-  ['container_command_v1',true],
-  ['cli_probe_v1',false],['cli_task_v1',true],
-  ['operation_status',false],['operation_cancel',true],['artifact_stat',false],['artifact_read',false],
-  ['worktree_create',true],['worktree_diff',false],['worktree_integrate',true],
-  ['browser_open',true],['browser_snapshot',false],['browser_click',true],['browser_type',true],['browser_script',true],['browser_upload',true],['browser_download',true],['browser_close',true],
-  ['desktop_screenshot',true],['desktop_click',true],['desktop_type',true],['desktop_key',true],['desktop_scroll',true],
-].map(([name,mutating])=>({name:String(name),mutating:Boolean(mutating),inputSchema:{type:'object',additionalProperties:true}})))
-export const TOOL_NAMES = CATALOG.map(x=>x.name)
-export const isMutating = (name:string) => CATALOG.find(x=>x.name===name)?.mutating??false
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
+export const AGENT_VERSION = '0.1.2'
+export const AGENT_API_MAJOR = 1
+export class AgentError extends Error { constructor(public code:string, public status=400) { super(code) } }
+export const fail = (code:string,status=400):never => { throw new AgentError(code,status) }
+export const secret = () => randomBytes(32).toString('base64url')
+export const sha = (value:string|Buffer) => createHash('sha256').update(value).digest('hex')
+export const matches = (value:string, digest:string) => { const a=Buffer.from(sha(value),'hex'),b=Buffer.from(digest,'hex'); return a.length===b.length && timingSafeEqual(a,b) }
+export function canonical(v:any):string { if(v===null||typeof v!=='object')return JSON.stringify(v);if(Array.isArray(v))return `[${v.map(canonical).join(',')}]`;return `{${Object.keys(v).sort().map(k=>`${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}` }
+export function identifier(v:any):string { if(typeof v!=='string'||!/^[-a-zA-Z0-9_.]{1,128}$/.test(v))fail('INVALID_ID');return v }
+export function integer(v:any,min:number,max:number,defaultValue?:number) { const n=v??defaultValue;if(!Number.isSafeInteger(n)||n<min||n>max)fail('INVALID_ARGUMENT');return n }
+export type Context = {clientId:string;botId:string;taskId:string;attemptId:string;roots:string[];tools:string[];expiresAt:number;revision:number;grantId:string}
+export const CATALOG = Object.freeze([
+  ['machine_ping',false],['fs_list',false],['fs_read',false],['fs_write',true],['shell_exec',true],
+  // Versioned container-command Task backend. A distinct name means an older
+  // Agent answers before any work instead of silently running a native shell.
+  ['container_command_v1',true],
+  ['cli_probe_v1',false],['cli_task_v1',true],
+  ['operation_status',false],['operation_cancel',true],['artifact_stat',false],['artifact_read',false],
+  ['worktree_create',true],['worktree_diff',false],['worktree_integrate',true],
+  ['browser_open',true],['browser_snapshot',false],['browser_click',true],['browser_type',true],['browser_script',true],['browser_upload',true],['browser_download',true],['browser_close',true],
+  ['desktop_screenshot',true],['desktop_click',true],['desktop_type',true],['desktop_key',true],['desktop_scroll',true],
+].map(([name,mutating])=>({name:String(name),mutating:Boolean(mutating),inputSchema:{type:'object',additionalProperties:true}})))
+export const TOOL_NAMES = CATALOG.map(x=>x.name)
+export const isMutating = (name:string) => CATALOG.find(x=>x.name===name)?.mutating??false

package/remote-computer-agent/src/secure-pairing.ts

@@ -0,0 +1,105 @@
+import { randomInt, randomUUID, timingSafeEqual } from 'node:crypto'
+import { generateKeyPair, keyPairFromPrivate, keyId, psk, b64u, credentialHashFromHex } from '../../modules/openmaus-protocol/index.mjs'
+import { canonical, fail, identifier, secret, sha } from './protocol.js'
+
+export const PAIRING_TTL_MS = 120_000
+export const PAIRING_ATTEMPTS = 5
+export const MAX_PAIRED_CLIENTS = 128
+const MAX_INVITES = 20
+const digestEqual = (a: string, b: string) => /^[0-9a-f]{64}$/.test(a) && /^[0-9a-f]{64}$/.test(b) && timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'))
+const nameOf = (value: unknown) => String(value ?? '').replace(/[\u0000-\u001f\u007f]/g, ' ').trim().slice(0, 60) || 'DSH Host'
+type Approval = { botIds: string[]; roots: string[]; tools: string[]; hostManagedBots?: boolean }
+type Peer = { kind: 'invite'; id: string; digest: string } | { kind: 'client'; id: string; digest: string; revision: number }
+type Outcome = { clientId: string; token: string; machineId: string; secretRef: string; hostManagedBots: boolean }
+
+/** An invite fixes the remote owner's ceiling; redemption never accepts replacement roots or tools. */
+export class SecurePairing {
+  private replay = new Map<string, { proof: string; requestId: string; expiresAt: number; result: Outcome }>()
+  readonly transportKey: { privateKey: Buffer; publicKey: Buffer }
+  constructor(private db: any, private machineId: string, private commitClient: (id: string, ceiling: Approval) => Outcome, private now = Date.now) {
+    db.exec(`CREATE TABLE IF NOT EXISTS pairing_invites (
+      id TEXT PRIMARY KEY, client_id TEXT NOT NULL, token_digest TEXT NOT NULL, code_digest TEXT NOT NULL,
+      expires_at INTEGER NOT NULL, attempts_left INTEGER NOT NULL, ceiling TEXT NOT NULL, name TEXT NOT NULL,
+      consumed_request TEXT, consumed_at INTEGER
+    ); CREATE INDEX IF NOT EXISTS pairing_invite_expiry ON pairing_invites(expires_at);`)
+    const generated = generateKeyPair()
+    db.prepare('INSERT OR IGNORE INTO meta VALUES (?,?)').run('e2eTransportPrivateKey', b64u(generated.privateKey))
+    const stored = db.prepare('SELECT value FROM meta WHERE key=?').get('e2eTransportPrivateKey')?.value
+    if (typeof stored !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(stored)) fail('PAIRING_IDENTITY_INVALID')
+    try { this.transportKey = keyPairFromPrivate(Buffer.from(stored, 'base64url')) } catch { fail('PAIRING_IDENTITY_INVALID') }
+  }
+
+  identity() { return { kind: 'noise-v1', publicKey: b64u(this.transportKey.publicKey), fingerprint: sha(this.transportKey.publicKey) } }
+
+  create(clientId: string, ceiling: Approval, options: { endpoint: string; name?: string }) {
+    identifier(clientId)
+    let endpoint: URL
+    try { endpoint = new URL(options.endpoint) } catch { fail('PAIRING_ENDPOINT_INVALID') }
+    if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.pathname !== '/' || endpoint.search || endpoint.hash || endpoint.href.length > 1024) fail('PAIRING_ENDPOINT_INVALID')
+    const now = this.now(), token = `dsh_pair_${secret()}`, code = String(randomInt(1_000_000)).padStart(6, '0'), id = `invite-${randomUUID()}`
+    return this.db.transaction(() => {
+      this.db.prepare('DELETE FROM pairing_invites WHERE expires_at<=?').run(now - PAIRING_TTL_MS)
+      if (this.db.prepare('SELECT 1 FROM clients WHERE id=? AND revoked=0').get(clientId)) fail('CLIENT_ALREADY_PAIRED', 409)
+      if (this.db.prepare('SELECT count(*) AS n FROM clients WHERE revoked=0').get().n >= MAX_PAIRED_CLIENTS) fail('PAIRING_DEVICE_LIMIT', 429)
+      this.db.prepare('UPDATE pairing_invites SET attempts_left=0 WHERE client_id=? AND consumed_request IS NULL').run(clientId)
+      if (this.db.prepare('SELECT count(*) AS n FROM pairing_invites WHERE expires_at>? AND attempts_left>0 AND consumed_request IS NULL').get(now).n >= MAX_INVITES) fail('PAIRING_WINDOW_LIMIT', 429)
+      this.db.prepare('INSERT INTO pairing_invites VALUES (?,?,?,?,?,?,?,?,NULL,NULL)').run(id, clientId, sha(token), sha(code), now + PAIRING_TTL_MS, PAIRING_ATTEMPTS, canonical(ceiling), nameOf(options.name))
+      return { format: 'dsh-pairing-invite', version: 2, inviteId: id, machineId: this.machineId, clientId, name: nameOf(options.name),
+        endpoint: endpoint.origin, expiresAt: now + PAIRING_TTL_MS, token, code, transport: this.identity(),
+        ceiling: structuredClone(ceiling) }
+    }).immediate()
+  }
+
+  candidates() {
+    const now = this.now(), transportId = keyId(this.transportKey.publicKey)
+    for (const [id, row] of this.replay) if (row.expiresAt <= now) this.replay.delete(id)
+    const invites = this.db.prepare('SELECT id,token_digest FROM pairing_invites WHERE expires_at>? AND attempts_left>0').all(now)
+      .map((row: any) => ({ id: { kind: 'invite', id: row.id, digest: row.token_digest } as Peer, hash: row.token_digest }))
+    const clients = this.db.prepare('SELECT id,digest,revision FROM clients WHERE revoked=0').all()
+      .map((row: any) => ({ id: { kind: 'client', id: row.id, digest: row.digest, revision: row.revision } as Peer, hash: row.digest }))
+    if (clients.length > MAX_PAIRED_CLIENTS) fail('PAIRING_DEVICE_LIMIT', 429)
+    return [...invites, ...clients].map(row => ({ id: row.id, psk: psk(credentialHashFromHex(row.hash)!, transportId) }))
+  }
+
+  validPeer(peer: Peer) {
+    if (peer.kind === 'client') {
+      const client = this.db.prepare('SELECT digest,revision,revoked FROM clients WHERE id=?').get(peer.id)
+      return Boolean(client && !client.revoked && client.revision === peer.revision && digestEqual(client.digest, peer.digest))
+    }
+    const invite = this.db.prepare('SELECT token_digest,expires_at,attempts_left FROM pairing_invites WHERE id=?').get(peer.id)
+    return Boolean(invite && invite.expires_at > this.now() && invite.attempts_left > 0 && digestEqual(invite.token_digest, peer.digest))
+  }
+
+  redeem(peer: Peer, input: any) {
+    if (peer.kind !== 'invite' || !input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(key => !['requestId', 'code'].includes(key))
+      || typeof input.requestId !== 'string' || !/^[A-Za-z0-9_-]{16,128}$/.test(input.requestId) || typeof input.code !== 'string' || !/^\d{6}$/.test(input.code)) fail('PAIRING_REQUEST_INVALID')
+    const now = this.now()
+    const decision = this.db.transaction(() => {
+      const row = this.db.prepare('SELECT * FROM pairing_invites WHERE id=?').get(peer.id)
+      if (!row || !digestEqual(row.token_digest, peer.digest) || row.expires_at <= now || row.attempts_left <= 0) return { error: 'PAIRING_WINDOW_CLOSED' }
+      if (!digestEqual(row.code_digest, sha(input.code))) {
+        this.db.prepare('UPDATE pairing_invites SET attempts_left=attempts_left-1 WHERE id=?').run(peer.id)
+        return { error: 'PAIRING_CODE_INVALID' }
+      }
+      if (row.consumed_request !== null) {
+        const cached = this.replay.get(row.id), client = this.db.prepare('SELECT digest,revoked FROM clients WHERE id=?').get(row.client_id)
+        if (row.consumed_request !== input.requestId || !cached || cached.expiresAt <= now || cached.proof !== peer.digest || cached.requestId !== input.requestId) return { error: 'PAIRING_ALREADY_REDEEMED' }
+        if (!client || client.revoked || !digestEqual(client.digest, sha(cached.result.token))) return { error: 'PAIRING_DEVICE_CHANGED' }
+        return { result: structuredClone(cached.result), ceiling: JSON.parse(row.ceiling), recovered: true }
+      }
+      const result = this.commitClient(row.client_id, JSON.parse(row.ceiling))
+      this.db.prepare('UPDATE pairing_invites SET consumed_request=?,consumed_at=? WHERE id=?').run(input.requestId, now, row.id)
+      this.replay.set(row.id, { proof: peer.digest, requestId: input.requestId, expiresAt: row.expires_at, result: structuredClone(result) })
+      return { result, ceiling: JSON.parse(row.ceiling), recovered: false }
+    }).immediate()
+    if (decision.error) fail(decision.error, 403)
+    return { ...decision.result, transport: this.identity(), ceiling: decision.ceiling, recovered: decision.recovered }
+  }
+
+  invalidate(clientId: string) {
+    this.db.prepare('UPDATE pairing_invites SET attempts_left=0 WHERE client_id=?').run(clientId)
+    for (const [id, row] of this.replay) if (row.result.clientId === clientId) this.replay.delete(id)
+  }
+
+  close() { this.replay.clear() }
+}

package/remote-computer-agent/src/store.ts

@@ -3,7 +3,9 @@ import { join } from 'node:path'
 import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
 import { canonical, fail, identifier, matches, secret, sha, TOOL_NAMES, type Context } from './protocol.js'
+import { SecurePairing, MAX_PAIRED_CLIENTS } from './secure-pairing.js'
 export class Store {
+  pairing: SecurePairing
   db:any;machineId:string;private lockFd:number|undefined;private lockPath:string;private controllerGuard:any;private closed=false;private admin=false
   constructor(public dataDir:string,Database?:any,options:{admin?:boolean}={}) {
     this.admin=options.admin===true
@@ -38,6 +40,7 @@ export class Store {
         CREATE TABLE IF NOT EXISTS audit(id INTEGER PRIMARY KEY,time INTEGER NOT NULL,code TEXT NOT NULL,actor TEXT,operation TEXT);`)
       this.db.prepare('INSERT OR IGNORE INTO meta VALUES (?,?)').run('machineId',`machine-${randomUUID()}`)
       this.machineId=this.db.prepare('SELECT value FROM meta WHERE key=?').get('machineId').value
+      this.pairing=new SecurePairing(this.db,this.machineId,(id,ceiling)=>this.commitClient(id,ceiling))
       if(!options.admin)this.db.prepare("UPDATE operations SET status='unknown',error='OUTCOME_UNKNOWN' WHERE status IN ('admitted','running','cancel_pending')").run()
       // Tickets are process-lifetime credentials; a restart requires explicit reissuance.
       if(!options.admin)this.db.prepare('DELETE FROM grants').run()
@@ -52,7 +55,7 @@ export class Store {
       }
     }finally{if(this.controllerGuard){try{this.controllerGuard.exec('ROLLBACK')}catch{};this.controllerGuard.close();this.controllerGuard=undefined}}
   }
-  pair(id:string,ceiling:{botIds?:string[];hostManagedBots?:boolean;roots:string[];tools:string[]}) {
+  private approvedCeiling(id:string,ceiling:{botIds?:string[];hostManagedBots?:boolean;roots:string[];tools:string[]}) {
     identifier(id)
     if(!ceiling||ceiling.hostManagedBots!==undefined&&typeof ceiling.hostManagedBots!=='boolean'||!Array.isArray(ceiling.botIds??[])||!Array.isArray(ceiling.roots)||!ceiling.roots.length||!Array.isArray(ceiling.tools)||!ceiling.tools.length||ceiling.tools.some(x=>!TOOL_NAMES.includes(x)))fail('INVALID_CEILING')
     const managed=ceiling.hostManagedBots===true,botIds=ceiling.botIds??[]
@@ -60,11 +63,23 @@ export class Store {
     if(!managed&&!botIds.length)fail('INVALID_CEILING')
     botIds.forEach(identifier);ceiling.roots.forEach(identifier)
     const saved={botIds,roots:ceiling.roots,tools:ceiling.tools,...(managed?{hostManagedBots:true}:{})}
-    const token=secret();this.db.prepare('INSERT INTO clients VALUES (?,?,1,0,?)').run(id,sha(token),canonical(saved));return {clientId:id,token,machineId:this.machineId,secretRef:`remote-agent/${this.machineId}/${id}`,hostManagedBots:managed}
+    return saved
   }
+  private commitClient(id:string,ceiling:{botIds:string[];hostManagedBots?:boolean;roots:string[];tools:string[]}) { return this.db.transaction(()=>{
+    const previous=this.db.prepare('SELECT revoked FROM clients WHERE id=?').get(id);if(previous&&!previous.revoked)fail('CLIENT_ALREADY_PAIRED',409)
+    if(this.db.prepare('SELECT count(*) AS n FROM clients WHERE revoked=0').get().n>=MAX_PAIRED_CLIENTS)fail('PAIRING_DEVICE_LIMIT',429)
+    const token=secret();if(previous)this.db.prepare('UPDATE clients SET digest=?,revision=revision+1,revoked=0,ceiling=? WHERE id=? AND revoked=1').run(sha(token),canonical(ceiling),id)
+    else this.db.prepare('INSERT INTO clients VALUES (?,?,1,0,?)').run(id,sha(token),canonical(ceiling));return {clientId:id,token,machineId:this.machineId,secretRef:`remote-agent/${this.machineId}/${id}`,hostManagedBots:ceiling.hostManagedBots===true}
+  }).immediate() }
+  pair(id:string,ceiling:{botIds?:string[];hostManagedBots?:boolean;roots:string[];tools:string[]}) { return this.commitClient(id,this.approvedCeiling(id,ceiling)) }
+  invite(id:string,ceiling:{botIds?:string[];hostManagedBots?:boolean;roots:string[];tools:string[]},options:{endpoint:string;name?:string}) { if(!this.admin)fail('ADMIN_REQUIRED',403);return this.pairing.create(id,this.approvedCeiling(id,ceiling),options) }
   client(token:string) {if(typeof token!=='string'||token.length>256)fail('AUTH_INVALID',401);const row=this.db.prepare('SELECT * FROM clients WHERE digest=?').get(sha(token));const verified=matches(token,row?.digest??'0'.repeat(64));if(!verified||!row||row.revoked)fail('AUTH_INVALID',401);return row}
-  rotate(id:string) {const token=secret();if(!this.db.prepare('UPDATE clients SET digest=?,revision=revision+1,revoked=0 WHERE id=?').run(sha(token),identifier(id)).changes)fail('AUTH_INVALID',401);return {clientId:id,token}}
-  revoke(id:string) {this.db.prepare('UPDATE clients SET revoked=1,revision=revision+1 WHERE id=?').run(identifier(id))}
+  rotate(id:string) {return this.db.transaction(()=>{
+    identifier(id);const row=this.db.prepare('SELECT revoked FROM clients WHERE id=?').get(id);if(!row)fail('AUTH_INVALID',401)
+    if(row.revoked&&this.db.prepare('SELECT count(*) AS n FROM clients WHERE revoked=0').get().n>=MAX_PAIRED_CLIENTS)fail('PAIRING_DEVICE_LIMIT',429)
+    const token=secret();this.db.prepare('UPDATE clients SET digest=?,revision=revision+1,revoked=0 WHERE id=?').run(sha(token),id);this.pairing.invalidate(id);return {clientId:id,token}
+  }).immediate() }
+  revoke(id:string) {this.db.prepare('UPDATE clients SET revoked=1,revision=revision+1 WHERE id=?').run(identifier(id));this.pairing.invalidate(id)}
   private currentClient(client:any){const row=this.db.prepare('SELECT * FROM clients WHERE id=?').get(client?.id);if(!row||row.revoked||row.revision!==client.revision||row.digest!==client.digest)fail('AUTH_INVALID',401);return row}
   issue(client:any,request:any) {
     client=this.currentClient(client)
@@ -97,5 +112,5 @@ export class Store {
   finish(id:string,status:string,result:any=null,error:string|null=null) {this.db.prepare('UPDATE operations SET status=?,result=?,error=?,finished=? WHERE id=?').run(status,result===null?null:canonical(result),error,Date.now(),id)}
   running(id:string) {this.db.prepare("UPDATE operations SET status='running' WHERE id=? AND status='admitted'").run(id)}
   audit(code:string,actor:string|null=null,operation:string|null=null){this.db.prepare('INSERT INTO audit(time,code,actor,operation) VALUES (?,?,?,?)').run(Date.now(),code,actor,operation);this.db.prepare('DELETE FROM audit WHERE id < (SELECT max(id)-10000 FROM audit)').run()}
-  close(){if(this.closed)return;this.closed=true;try{this.db.close()}finally{this.releaseController()}}
+  close(){if(this.closed)return;this.closed=true;this.pairing?.close();try{this.db.close()}finally{this.releaseController()}}
 }

package/remote-computer-agent/src/transport.ts

@@ -8,7 +8,8 @@ import { AgentError, AGENT_VERSION, CATALOG, fail } from './protocol.js'
 import type { Agent } from './agent.js'
 import {AuthThrottle,validateAuthLimits,type AuthLimits} from './auth-throttle.js'
 import {WebSocketServer} from 'ws'
-export type NetworkConfig={mode?:'loopback'|'wireguard'|'tailscale'|'cloudflare-tunnel'|'public-tls';host?:string;port?:number;protectedTunnel?:boolean;allowedHosts?:string[];allowedOrigins?:string[];trustedProxies?:string[];authLimits?:AuthLimits;tls?:{keyFile:string;certFile:string;caFile?:string;requireClientCertificate?:boolean}}
+import {secureTransport} from './e2e-server.js'
+export type NetworkConfig={mode?:'loopback'|'wireguard'|'tailscale'|'cloudflare-tunnel'|'public-tls'|'e2e';host?:string;port?:number;protectedTunnel?:boolean;allowedHosts?:string[];allowedOrigins?:string[];trustedProxies?:string[];authLimits?:AuthLimits;tls?:{keyFile:string;certFile:string;caFile?:string;requireClientCertificate?:boolean}}
 const loopback=(host:string)=>['127.0.0.1','::1','::ffff:127.0.0.1'].includes(host)
 export function validateNetwork(c:NetworkConfig){const host=c.host??'127.0.0.1',mode=c.mode??'loopback';if(['0.0.0.0','::','localhost'].includes(host))fail('BIND_ADDRESS_REQUIRED')
   if(!isIP(host)||c.port!==undefined&&(!Number.isSafeInteger(c.port)||c.port<0||c.port>65535))fail('INVALID_NETWORK_CONFIG')
@@ -22,31 +23,42 @@ export function validateNetwork(c:NetworkConfig){const host=c.host??'127.0.0.1',
   if(['wireguard','tailscale'].includes(mode)){if(!Object.values(networkInterfaces()).flat().some(x=>x?.address===host))fail('BIND_INTERFACE_NOT_FOUND');if(!c.tls&&!c.protectedTunnel)fail('TUNNEL_ATTESTATION_REQUIRED')}
   if(mode==='cloudflare-tunnel'&&(!loopback(host)||!c.protectedTunnel))fail('TUNNEL_BACKEND_MUST_BE_LOOPBACK')
   if(mode==='public-tls'&&!c.tls&&(!loopback(host)||!c.trustedProxies?.length))fail('TLS_REQUIRED')
-  if(!c.tls&&!loopback(host)&&!c.protectedTunnel)fail('TLS_REQUIRED')
-  if(!['loopback','wireguard','tailscale','cloudflare-tunnel','public-tls'].includes(mode))fail('INVALID_NETWORK_MODE')
+  if(!c.tls&&!loopback(host)&&!c.protectedTunnel&&mode!=='e2e')fail('TLS_REQUIRED')
+  if(!['loopback','wireguard','tailscale','cloudflare-tunnel','public-tls','e2e'].includes(mode))fail('INVALID_NETWORK_MODE')
 }
 export async function serve(agent:Agent,c:NetworkConfig={}){
   c=structuredClone(c);validateNetwork(c);const throttle=new AuthThrottle(c.authLimits),host=c.host??'127.0.0.1'
-  const requestBoundary=(req:http.IncomingMessage,upgrade=false)=>{
+  if(c.mode==='e2e'&&!agent.store.pairing)fail('PAIRING_SERVICE_REQUIRED')
+  const requestBoundary=(req:http.IncomingMessage,upgrade=false,encrypted=false)=>{
     const address=server.address() as any,defaultHost=`${host.includes(':')?`[${host}]`:host}:${address.port}`
     if(!(c.allowedHosts??[defaultHost]).includes(req.headers.host??''))fail('HOST_DENIED',403)
     const origin=req.headers.origin
     if(origin!==undefined&&!(c.allowedOrigins??[]).includes(origin)&&!(upgrade&&agent.desktopSessions.hasOrigin(origin)))fail('ORIGIN_DENIED',403)
-    if(c.mode==='public-tls'&&!c.tls&&(!(c.trustedProxies??[]).includes(req.socket.remoteAddress??'unknown')||req.headers['x-forwarded-proto']!=='https'))fail('TLS_REQUIRED',403)
+    if(!encrypted&&c.mode==='public-tls'&&!c.tls&&(!(c.trustedProxies??[]).includes(req.socket.remoteAddress??'unknown')||req.headers['x-forwarded-proto']!=='https'))fail('TLS_REQUIRED',403)
     return defaultHost
   }
-  const handler=async(req:http.IncomingMessage,res:http.ServerResponse)=>{
+  const handler=async(req:http.IncomingMessage,res:http.ServerResponse,peer?:Parameters<typeof agent.store.pairing.validPeer>[0])=>{
     let context:any;const source=req.socket.remoteAddress??'unknown';const json=(status:number,value:any)=>{res.writeHead(status,{'content-type':'application/json','cache-control':'no-store','x-content-type-options':'nosniff'});res.end(JSON.stringify(value))}
     try{
-      const defaultHost=requestBoundary(req)
+      const defaultHost=requestBoundary(req,false,!!peer)
+      if(c.mode==='e2e'&&!peer)fail('E2E_REQUIRED',426)
+      const url=new URL(req.url??'/',`http://${defaultHost}`)
+      if(peer&&!agent.store.pairing.validPeer(peer))fail('AUTH_INVALID',401)
+      if(url.pathname==='/pair/v2/redeem'){
+        if(!peer||peer.kind!=='invite'||req.method!=='POST'||url.search)fail('PAIRING_CHANNEL_REQUIRED',403)
+        let body=Buffer.alloc(0);for await(const chunk of req){body=Buffer.concat([body,chunk]);if(body.length>2048)fail('REQUEST_TOO_LARGE',413)}
+        let input:any;try{input=JSON.parse(body.toString('utf8'))}catch{fail('INVALID_JSON')}
+        json(200,agent.store.pairing.redeem(peer,input));return
+      }
+      if(peer?.kind==='invite')fail('PAIRING_CHANNEL_ONLY',403)
       const reject=(decision:ReturnType<AuthThrottle['failure']>)=>{
         if(decision.audit)agent.store.audit(decision.code)
         if(decision.retryAfterMs)res.setHeader('retry-after',String(Math.max(1,Math.ceil(decision.retryAfterMs/1000))))
         fail(decision.code,decision.status)
       }
       const auth=req.headers.authorization??'';if(!/^Bearer [A-Za-z0-9_-]{43}$/.test(auth)){reject(throttle.failure(source))}
-      const url=new URL(req.url??'/',`http://${defaultHost}`);let client:any
-      const authenticate=()=>{try{if(url.pathname.startsWith('/control/v1/'))client=agent.store.client(auth.slice(7));else context=agent.store.grant(auth.slice(7))}catch{reject(throttle.failure(source))}}
+      let client:any
+      const authenticate=()=>{try{if(peer&&!agent.store.pairing.validPeer(peer))fail('AUTH_INVALID',401);if(url.pathname.startsWith('/control/v1/'))client=agent.store.client(auth.slice(7));else context=agent.store.grant(auth.slice(7));if(peer&&(client?.id??context?.clientId)!==peer.id)fail('AUTH_INVALID',401)}catch{reject(throttle.failure(source))}}
       authenticate()
       // Valid credentials bypass anonymous source cooldown, including shared proxies.
       const limited=throttle.authenticated(client?.id??context.clientId,client?.revision??context.revision)
@@ -59,6 +71,7 @@ export async function serve(agent:Agent,c:NetworkConfig={}){
       authenticate()
       if(url.pathname==='/control/v1/grants'){json(200,agent.store.issue(client,parsed));return}
       if(url.pathname==='/control/v1/grants/revoke'){const result=agent.store.revokeGrants(client,parsed);await agent.desktopSessions.sweep();json(200,result);return}
+      if(url.pathname==='/control/v1/desktop/close'){json(200,await agent.desktopSessions.closeClientSession(client.id,parsed));return}
       if(url.pathname==='/desktop/v1/session'){json(200,await agent.desktopSessions.open(context,parsed));return}
       if(url.pathname==='/desktop/v1/session/renew'){json(200,await agent.desktopSessions.renew(context,parsed));return}
       if(url.pathname==='/desktop/v1/session/close'){json(200,await agent.desktopSessions.closeSession(context,parsed));return}
@@ -74,16 +87,27 @@ export async function serve(agent:Agent,c:NetworkConfig={}){
     }catch(e){json(e instanceof AgentError?e.status:500,{error:{code:e instanceof AgentError?e.code:'AGENT_INTERNAL'}})}
   }
   const tls=c.tls?{key:readFileSync(c.tls.keyFile),cert:readFileSync(c.tls.certFile),ca:c.tls.caFile?readFileSync(c.tls.caFile):undefined,requestCert:!!c.tls.requireClientCertificate,rejectUnauthorized:!!c.tls.requireClientCertificate}:null
-  const server=tls?https.createServer(tls,handler):http.createServer(handler);server.requestTimeout=30000;server.headersTimeout=10000;server.maxConnections=128
+  const publicHandler=(req:http.IncomingMessage,res:http.ServerResponse)=>void handler(req,res)
+  const server=tls?https.createServer(tls,publicHandler):http.createServer(publicHandler);server.requestTimeout=30000;server.headersTimeout=10000;server.maxConnections=128
   const websocket=new WebSocketServer({noServer:true,clientTracking:true,maxPayload:65536,perMessageDeflate:false})
-  server.on('upgrade',(req,socket,head)=>{
+  const desktopUpgrade=(req:http.IncomingMessage,socket:any,head:Buffer,peer?:Parameters<typeof agent.store.pairing.validPeer>[0])=>{
     try{
-      const defaultHost=requestBoundary(req,true),url=new URL(req.url??'/',`http://${defaultHost}`)
+      const defaultHost=requestBoundary(req,true,!!peer),url=new URL(req.url??'/',`http://${defaultHost}`)
+      if(c.mode==='e2e'&&!peer)fail('E2E_REQUIRED',426)
+      if(peer&&(peer.kind!=='client'||!agent.store.pairing.validPeer(peer)))fail('AUTH_INVALID',401)
       if(url.pathname!=='/desktop/v1/socket'||url.search)fail('NOT_FOUND',404)
       if(websocket.clients.size>=16)fail('DESKTOP_CONNECTION_LIMIT',429)
-      websocket.handleUpgrade(req,socket,head,ws=>{websocket.emit('connection',ws,req);agent.desktopSessions.accept(ws,req.headers.origin,c.allowedOrigins??[])})
+      websocket.handleUpgrade(req,socket,head,ws=>{websocket.emit('connection',ws,req);agent.desktopSessions.accept(ws,req.headers.origin,c.allowedOrigins??[],peer?.id)})
+    }catch(e){const status=e instanceof AgentError?e.status:500;socket.end(`HTTP/1.1 ${status} Rejected\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`)}
+  }
+  const encrypted=agent.store.pairing?secureTransport(agent.store.pairing,(req,res,peer)=>void handler(req,res,peer),desktopUpgrade):null
+  server.on('upgrade',(req,socket,head)=>{
+    try{
+      const defaultHost=requestBoundary(req,true),url=new URL(req.url??'/',`http://${defaultHost}`)
+      if(url.pathname==='/v1/e2e'&&!url.search){if(!encrypted)fail('NOT_FOUND',404);encrypted.accept(req,socket,head);return}
+      desktopUpgrade(req,socket,head)
     }catch(e){const status=e instanceof AgentError?e.status:500;socket.end(`HTTP/1.1 ${status} Rejected\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`)}
   })
-  await new Promise<void>((resolve,reject)=>{server.once('error',reject);server.listen(c.port??9701,host,()=>resolve())})
-  return {server,address:server.address(),supportedMcpVersions:SUPPORTED_PROTOCOL_VERSIONS,close:async()=>{await agent.desktopSessions.close();for(const client of websocket.clients)client.terminate();await new Promise<void>(resolve=>websocket.close(()=>resolve()));await new Promise<void>((resolve,reject)=>server.close(e=>e?reject(e):resolve()))}}
+  try{await new Promise<void>((resolve,reject)=>{server.once('error',reject);server.listen(c.port??9701,host,()=>resolve())})}catch(error){await encrypted?.close();throw error}
+  return {server,address:server.address(),supportedMcpVersions:SUPPORTED_PROTOCOL_VERSIONS,close:async()=>{await agent.desktopSessions.close();for(const client of websocket.clients)client.terminate();await new Promise<void>(resolve=>websocket.close(()=>resolve()));await encrypted?.close();await new Promise<void>((resolve,reject)=>server.close(e=>e?reject(e):resolve()))}}
 }