@llui/agent 0.0.34 → 0.0.36

package/dist/server/web/upgrade.js.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../../src/server/web/upgrade.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAA;IACf,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC7C,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACpE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAY,EACZ,KAAsB;IAEtB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,WAAW,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAEhE,kEAAkE;IAClE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,IAAI,GACR,UACD,CAAC,aAAa,CAAA;IACf,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,QAAQ,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAGtB;IAAC,MAA4C,CAAC,MAAM,EAAE,CAAA;IAEvD,MAAM,IAAI,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,EAAE,CAAA;QACZ,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,sEAAsE;IACtE,0BAA0B;IAC1B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAEzD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,KAAsB;IAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAEhE,MAAM,KAAK,GACT,UAKD,CAAC,IAAI,CAAA;IACN,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,QAAQ,CAAC,mDAAmD,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAA;IAElD,kEAAkE;IAClE,mDAAmD;IACnD,MAAM,CAAC,gBAAgB,CACrB,MAAM,EACN,GAAG,EAAE;QACH,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACvD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAA;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import type { AgentCoreHandle } from '../core.js'\nimport { createWHATWGPairingConnection } from './adapter.js'\n\n/**\n * Extract the bearer token from a LAP WebSocket upgrade request.\n * Accepts the token on either `?token=` or `Authorization: Bearer` —\n * query-string is the common pattern because browsers can't set\n * arbitrary headers on WebSocket construction.\n */\nexport function extractToken(req: Request): string | null {\n  const url = new URL(req.url)\n  const q = url.searchParams.get('token')\n  if (q) return q\n  const auth = req.headers.get('authorization')\n  if (auth?.startsWith('Bearer ')) return auth.slice('Bearer '.length)\n  return null\n}\n\n/**\n * Cloudflare Workers handler. Accepts a WebSocket upgrade using\n * `WebSocketPair`, validates the token via\n * `agent.acceptConnection`, and returns the 101 upgrade Response.\n *\n * Usage:\n * ```ts\n * const agent = createLluiAgentCore({ signingKey: env.AGENT_KEY })\n * export default {\n *   async fetch(req, env) {\n *     const url = new URL(req.url)\n *     if (url.pathname === '/agent/ws') return handleCloudflareUpgrade(req, agent)\n *     return (await agent.router(req)) ?? new Response('Not Found', { status: 404 })\n *   },\n * }\n * ```\n */\nexport async function handleCloudflareUpgrade(\n  req: Request,\n  agent: AgentCoreHandle,\n): Promise<Response> {\n  if (req.headers.get('upgrade') !== 'websocket') {\n    return new Response('Expected upgrade: websocket', { status: 426 })\n  }\n  const token = extractToken(req)\n  if (!token) return new Response('Unauthorized', { status: 401 })\n\n  // `WebSocketPair` is a Cloudflare Workers global. We reference it\n  // through `globalThis` so importing this module in non-CF runtimes\n  // (e.g. during type-checking on Node) doesn't crash.\n  const Pair = (\n    globalThis as unknown as { WebSocketPair?: new () => { 0: WebSocket; 1: WebSocket } }\n  ).WebSocketPair\n  if (!Pair) {\n    return new Response('WebSocketPair unavailable in this runtime', { status: 501 })\n  }\n  const pair = new Pair()\n  const client = pair[0]\n  const server = pair[1]!\n  // `accept()` on the server half is Cloudflare-specific — it tells\n  // the runtime the Worker will handle the WebSocket itself.\n  ;(server as unknown as { accept: () => void }).accept()\n\n  const conn = createWHATWGPairingConnection(server)\n  const result = await agent.acceptConnection(token, conn)\n  if (!result.ok) {\n    conn.close()\n    return new Response(result.code, { status: result.status })\n  }\n\n  // `webSocket` on ResponseInit is Cloudflare-specific; cast to satisfy\n  // the standard lib types.\n  return new Response(null, { status: 101, webSocket: client } as ResponseInit & {\n    webSocket: WebSocket\n  })\n}\n\n/**\n * Deno handler. Uses `Deno.upgradeWebSocket(req)` to produce the\n * response + socket pair, then plugs the socket into the registry.\n *\n * Usage:\n * ```ts\n * Deno.serve(async (req) => {\n *   const url = new URL(req.url)\n *   if (url.pathname === '/agent/ws') return handleDenoUpgrade(req, agent)\n *   return (await agent.router(req)) ?? new Response('Not Found', { status: 404 })\n * })\n * ```\n */\nexport async function handleDenoUpgrade(req: Request, agent: AgentCoreHandle): Promise<Response> {\n  const token = extractToken(req)\n  if (!token) return new Response('Unauthorized', { status: 401 })\n\n  const Deno_ = (\n    globalThis as unknown as {\n      Deno?: {\n        upgradeWebSocket: (req: Request) => { socket: WebSocket; response: Response }\n      }\n    }\n  ).Deno\n  if (!Deno_) {\n    return new Response('Deno.upgradeWebSocket unavailable in this runtime', { status: 501 })\n  }\n\n  const { socket, response } = Deno_.upgradeWebSocket(req)\n  const conn = createWHATWGPairingConnection(socket)\n\n  // Deno opens the socket asynchronously; validate the token first,\n  // then register on `open` so frames aren't missed.\n  socket.addEventListener(\n    'open',\n    () => {\n      void agent.acceptConnection(token, conn).then((result) => {\n        if (!result.ok) conn.close()\n      })\n    },\n    { once: true },\n  )\n\n  return response\n}\n"]}
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../../src/server/web/upgrade.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAA;IACf,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC7C,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACpE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAY,EACZ,KAAsB;IAEtB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,WAAW,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAEhE,kEAAkE;IAClE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,IAAI,GACR,UACD,CAAC,aAAa,CAAA;IACf,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,QAAQ,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAGtB;IAAC,MAA4C,CAAC,MAAM,EAAE,CAAA;IAEvD,MAAM,IAAI,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,EAAE,CAAA;QACZ,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,sEAAsE;IACtE,0BAA0B;IAC1B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAEzD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,KAAsB;IAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAEhE,MAAM,KAAK,GACT,UAKD,CAAC,IAAI,CAAA;IACN,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,QAAQ,CAAC,mDAAmD,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAA;IAElD,kEAAkE;IAClE,mDAAmD;IACnD,MAAM,CAAC,gBAAgB,CACrB,MAAM,EACN,GAAG,EAAE;QACH,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACvD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAA;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import type { AgentCoreHandle } from '../core.js'\nimport { createWHATWGPairingConnection } from './adapter.js'\n\n/**\n * Extract the bearer token from a LAP WebSocket upgrade request.\n * Accepts the token on either `?token=` or `Authorization: Bearer` —\n * query-string is the common pattern because browsers can't set\n * arbitrary headers on WebSocket construction.\n */\nexport function extractToken(req: Request): string | null {\n  const url = new URL(req.url)\n  const q = url.searchParams.get('token')\n  if (q) return q\n  const auth = req.headers.get('authorization')\n  if (auth?.startsWith('Bearer ')) return auth.slice('Bearer '.length)\n  return null\n}\n\n/**\n * Cloudflare Workers handler. Accepts a WebSocket upgrade using\n * `WebSocketPair`, validates the token via\n * `agent.acceptConnection`, and returns the 101 upgrade Response.\n *\n * Usage:\n * ```ts\n * const agent = createLluiAgentCore()\n * export default {\n *   async fetch(req, env) {\n *     const url = new URL(req.url)\n *     if (url.pathname === '/agent/ws') return handleCloudflareUpgrade(req, agent)\n *     return (await agent.router(req)) ?? new Response('Not Found', { status: 404 })\n *   },\n * }\n * ```\n */\nexport async function handleCloudflareUpgrade(\n  req: Request,\n  agent: AgentCoreHandle,\n): Promise<Response> {\n  if (req.headers.get('upgrade') !== 'websocket') {\n    return new Response('Expected upgrade: websocket', { status: 426 })\n  }\n  const token = extractToken(req)\n  if (!token) return new Response('Unauthorized', { status: 401 })\n\n  // `WebSocketPair` is a Cloudflare Workers global. We reference it\n  // through `globalThis` so importing this module in non-CF runtimes\n  // (e.g. during type-checking on Node) doesn't crash.\n  const Pair = (\n    globalThis as unknown as { WebSocketPair?: new () => { 0: WebSocket; 1: WebSocket } }\n  ).WebSocketPair\n  if (!Pair) {\n    return new Response('WebSocketPair unavailable in this runtime', { status: 501 })\n  }\n  const pair = new Pair()\n  const client = pair[0]\n  const server = pair[1]!\n  // `accept()` on the server half is Cloudflare-specific — it tells\n  // the runtime the Worker will handle the WebSocket itself.\n  ;(server as unknown as { accept: () => void }).accept()\n\n  const conn = createWHATWGPairingConnection(server)\n  const result = await agent.acceptConnection(token, conn)\n  if (!result.ok) {\n    conn.close()\n    return new Response(result.code, { status: result.status })\n  }\n\n  // `webSocket` on ResponseInit is Cloudflare-specific; cast to satisfy\n  // the standard lib types.\n  return new Response(null, { status: 101, webSocket: client } as ResponseInit & {\n    webSocket: WebSocket\n  })\n}\n\n/**\n * Deno handler. Uses `Deno.upgradeWebSocket(req)` to produce the\n * response + socket pair, then plugs the socket into the registry.\n *\n * Usage:\n * ```ts\n * Deno.serve(async (req) => {\n *   const url = new URL(req.url)\n *   if (url.pathname === '/agent/ws') return handleDenoUpgrade(req, agent)\n *   return (await agent.router(req)) ?? new Response('Not Found', { status: 404 })\n * })\n * ```\n */\nexport async function handleDenoUpgrade(req: Request, agent: AgentCoreHandle): Promise<Response> {\n  const token = extractToken(req)\n  if (!token) return new Response('Unauthorized', { status: 401 })\n\n  const Deno_ = (\n    globalThis as unknown as {\n      Deno?: {\n        upgradeWebSocket: (req: Request) => { socket: WebSocket; response: Response }\n      }\n    }\n  ).Deno\n  if (!Deno_) {\n    return new Response('Deno.upgradeWebSocket unavailable in this runtime', { status: 501 })\n  }\n\n  const { socket, response } = Deno_.upgradeWebSocket(req)\n  const conn = createWHATWGPairingConnection(socket)\n\n  // Deno opens the socket asynchronously; validate the token first,\n  // then register on `open` so frames aren't missed.\n  socket.addEventListener(\n    'open',\n    () => {\n      void agent.acceptConnection(token, conn).then((result) => {\n        if (!result.ok) conn.close()\n      })\n    },\n    { once: true },\n  )\n\n  return response\n}\n"]}

package/dist/server/ws/upgrade.d.ts

@@ -4,7 +4,6 @@ import type { PairingRegistry } from './pairing-registry.js';
 import type { TokenStore } from '../token-store.js';
 import type { AuditSink } from '../audit.js';
 export type UpgradeDeps = {
-    signingKey: string | Uint8Array;
     tokenStore: TokenStore;
     registry: PairingRegistry;
     auditSink: AuditSink;

package/dist/server/ws/upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../../src/server/ws/upgrade.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,uBAAuB,CAAA;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAI5C,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,eAAe,CAAA;IACzB,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,WAAW,IAIxC,KAAK,eAAe,EAAE,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAoEjF"}
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../../src/server/ws/upgrade.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,uBAAuB,CAAA;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAI5C,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,eAAe,CAAA;IACzB,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,WAAW,IAIxC,KAAK,eAAe,EAAE,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CA4EjF"}

package/dist/server/ws/upgrade.js

@@ -1,5 +1,5 @@
 import { WebSocketServer } from 'ws';
-import { verifyToken } from '../token.js';
+import { tokenHashOf } from '../token.js';
 /**
  * Returns a handler for `server.on('upgrade', ...)`. Validates the token
  * from the query string, attaches to the registry, wires frame/close
@@ -33,13 +33,21 @@ export function createWsUpgradeHandler(deps) {
             socket.destroy();
             return;
         }
-        const verified = await verifyToken(token, deps.signingKey);
-        if (verified.kind !== 'ok') {
+        // Same hash-lookup verify path as the LAP HTTP handlers — see
+        // describe.ts:verifyAndReadTid for the rationale.
+        const hash = await tokenHashOf(token);
+        if (!hash) {
             socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
             socket.destroy();
             return;
         }
-        const { tid } = verified.payload;
+        const rec = await deps.tokenStore.findByTokenHash(hash);
+        if (!rec || rec.expiresAt <= now()) {
+            socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+            socket.destroy();
+            return;
+        }
+        const tid = rec.tid;
         // Perform upgrade, wire to registry
         wss.handleUpgrade(req, socket, head, (ws) => {
             const conn = {

package/dist/server/ws/upgrade.js.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../../src/server/ws/upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAA;AAOpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAWzC;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1C,OAAO,KAAK,EAAE,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAiB,EAAE;QACjF,aAAa;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;YAC9C,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QAED,4DAA4D;QAC5D,IAAI,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACjD,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1D,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACjD,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAA;QAEhC,oCAAoC;QACpC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAa,EAAE,EAAE;YACrD,MAAM,IAAI,GAAsB;gBAC9B,IAAI,CAAC,KAAkB;oBACrB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;gBAChC,CAAC;gBACD,OAAO,CAAC,OAAO;oBACb,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAqB,EAAE,EAAE;wBACzC,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;wBACnE,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAA;4BAC7C,OAAO,CAAC,MAAM,CAAC,CAAA;wBACjB,CAAC;wBAAC,MAAM,CAAC;4BACP,2BAA2B;wBAC7B,CAAC;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,CAAC,OAAO;oBACb,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACzB,CAAC;gBACD,KAAK;oBACH,EAAE,CAAC,KAAK,EAAE,CAAA;gBACZ,CAAC;aACF,CAAA;YACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAEjC,8EAA8E;YAC9E,KAAK,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YACnD,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBACxB,EAAE,EAAE,GAAG,EAAE;gBACT,GAAG;gBACH,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;aAC5B,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import { WebSocketServer } from 'ws'\nimport type { WebSocket } from 'ws'\nimport type { IncomingMessage } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport type { PairingRegistry, PairingConnection } from './pairing-registry.js'\nimport type { TokenStore } from '../token-store.js'\nimport type { AuditSink } from '../audit.js'\nimport { verifyToken } from '../token.js'\nimport type { ClientFrame, ServerFrame } from '../../protocol.js'\n\nexport type UpgradeDeps = {\n  signingKey: string | Uint8Array\n  tokenStore: TokenStore\n  registry: PairingRegistry\n  auditSink: AuditSink\n  now?: () => number\n}\n\n/**\n * Returns a handler for `server.on('upgrade', ...)`. Validates the token\n * from the query string, attaches to the registry, wires frame/close\n * routing. Unauthorized paths/tokens get a bare HTTP error response on\n * the raw socket (per RFC 6455 the response must be sent before the\n * socket is torn down).\n *\n * Spec §10.2, §10.4.\n */\nexport function createWsUpgradeHandler(deps: UpgradeDeps) {\n  const wss = new WebSocketServer({ noServer: true })\n  const now = deps.now ?? (() => Date.now())\n\n  return async (req: IncomingMessage, socket: Duplex, head: Buffer): Promise<void> => {\n    // Path check\n    const url = new URL(req.url ?? '/', 'http://localhost')\n    if (url.pathname !== '/agent/ws') {\n      socket.write('HTTP/1.1 404 Not Found\\r\\n\\r\\n')\n      socket.destroy()\n      return\n    }\n\n    // Token — try query string first, then Authorization header\n    let token = url.searchParams.get('token')\n    if (!token) {\n      const auth = req.headers['authorization']\n      if (typeof auth === 'string' && auth.startsWith('Bearer ')) {\n        token = auth.slice('Bearer '.length)\n      }\n    }\n    if (!token) {\n      socket.write('HTTP/1.1 401 Unauthorized\\r\\n\\r\\n')\n      socket.destroy()\n      return\n    }\n\n    const verified = await verifyToken(token, deps.signingKey)\n    if (verified.kind !== 'ok') {\n      socket.write('HTTP/1.1 401 Unauthorized\\r\\n\\r\\n')\n      socket.destroy()\n      return\n    }\n    const { tid } = verified.payload\n\n    // Perform upgrade, wire to registry\n    wss.handleUpgrade(req, socket, head, (ws: WebSocket) => {\n      const conn: PairingConnection = {\n        send(frame: ServerFrame) {\n          ws.send(JSON.stringify(frame))\n        },\n        onFrame(handler) {\n          ws.on('message', (data: Buffer | string) => {\n            const raw = typeof data === 'string' ? data : data.toString('utf8')\n            try {\n              const parsed = JSON.parse(raw) as ClientFrame\n              handler(parsed)\n            } catch {\n              // Ignore malformed frames.\n            }\n          })\n        },\n        onClose(handler) {\n          ws.on('close', handler)\n        },\n        close() {\n          ws.close()\n        },\n      }\n      deps.registry.register(tid, conn)\n\n      // Transition status: browser WS is now live, waiting for Claude's first call.\n      void deps.tokenStore.markAwaitingClaude(tid, now())\n      void deps.auditSink.write({\n        at: now(),\n        tid,\n        uid: null,\n        event: 'claim',\n        detail: { transport: 'ws' },\n      })\n    })\n  }\n}\n"]}
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../../src/server/ws/upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAA;AAOpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAUzC;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1C,OAAO,KAAK,EAAE,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAiB,EAAE;QACjF,aAAa;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;YAC9C,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QAED,4DAA4D;QAC5D,IAAI,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACjD,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QAED,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACjD,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACjD,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;QAEnB,oCAAoC;QACpC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAa,EAAE,EAAE;YACrD,MAAM,IAAI,GAAsB;gBAC9B,IAAI,CAAC,KAAkB;oBACrB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;gBAChC,CAAC;gBACD,OAAO,CAAC,OAAO;oBACb,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAqB,EAAE,EAAE;wBACzC,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;wBACnE,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAA;4BAC7C,OAAO,CAAC,MAAM,CAAC,CAAA;wBACjB,CAAC;wBAAC,MAAM,CAAC;4BACP,2BAA2B;wBAC7B,CAAC;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,CAAC,OAAO;oBACb,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACzB,CAAC;gBACD,KAAK;oBACH,EAAE,CAAC,KAAK,EAAE,CAAA;gBACZ,CAAC;aACF,CAAA;YACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAEjC,8EAA8E;YAC9E,KAAK,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YACnD,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBACxB,EAAE,EAAE,GAAG,EAAE;gBACT,GAAG;gBACH,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;aAC5B,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import { WebSocketServer } from 'ws'\nimport type { WebSocket } from 'ws'\nimport type { IncomingMessage } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport type { PairingRegistry, PairingConnection } from './pairing-registry.js'\nimport type { TokenStore } from '../token-store.js'\nimport type { AuditSink } from '../audit.js'\nimport { tokenHashOf } from '../token.js'\nimport type { ClientFrame, ServerFrame } from '../../protocol.js'\n\nexport type UpgradeDeps = {\n  tokenStore: TokenStore\n  registry: PairingRegistry\n  auditSink: AuditSink\n  now?: () => number\n}\n\n/**\n * Returns a handler for `server.on('upgrade', ...)`. Validates the token\n * from the query string, attaches to the registry, wires frame/close\n * routing. Unauthorized paths/tokens get a bare HTTP error response on\n * the raw socket (per RFC 6455 the response must be sent before the\n * socket is torn down).\n *\n * Spec §10.2, §10.4.\n */\nexport function createWsUpgradeHandler(deps: UpgradeDeps) {\n  const wss = new WebSocketServer({ noServer: true })\n  const now = deps.now ?? (() => Date.now())\n\n  return async (req: IncomingMessage, socket: Duplex, head: Buffer): Promise<void> => {\n    // Path check\n    const url = new URL(req.url ?? '/', 'http://localhost')\n    if (url.pathname !== '/agent/ws') {\n      socket.write('HTTP/1.1 404 Not Found\\r\\n\\r\\n')\n      socket.destroy()\n      return\n    }\n\n    // Token — try query string first, then Authorization header\n    let token = url.searchParams.get('token')\n    if (!token) {\n      const auth = req.headers['authorization']\n      if (typeof auth === 'string' && auth.startsWith('Bearer ')) {\n        token = auth.slice('Bearer '.length)\n      }\n    }\n    if (!token) {\n      socket.write('HTTP/1.1 401 Unauthorized\\r\\n\\r\\n')\n      socket.destroy()\n      return\n    }\n\n    // Same hash-lookup verify path as the LAP HTTP handlers — see\n    // describe.ts:verifyAndReadTid for the rationale.\n    const hash = await tokenHashOf(token)\n    if (!hash) {\n      socket.write('HTTP/1.1 401 Unauthorized\\r\\n\\r\\n')\n      socket.destroy()\n      return\n    }\n    const rec = await deps.tokenStore.findByTokenHash(hash)\n    if (!rec || rec.expiresAt <= now()) {\n      socket.write('HTTP/1.1 401 Unauthorized\\r\\n\\r\\n')\n      socket.destroy()\n      return\n    }\n    const tid = rec.tid\n\n    // Perform upgrade, wire to registry\n    wss.handleUpgrade(req, socket, head, (ws: WebSocket) => {\n      const conn: PairingConnection = {\n        send(frame: ServerFrame) {\n          ws.send(JSON.stringify(frame))\n        },\n        onFrame(handler) {\n          ws.on('message', (data: Buffer | string) => {\n            const raw = typeof data === 'string' ? data : data.toString('utf8')\n            try {\n              const parsed = JSON.parse(raw) as ClientFrame\n              handler(parsed)\n            } catch {\n              // Ignore malformed frames.\n            }\n          })\n        },\n        onClose(handler) {\n          ws.on('close', handler)\n        },\n        close() {\n          ws.close()\n        },\n      }\n      deps.registry.register(tid, conn)\n\n      // Transition status: browser WS is now live, waiting for Claude's first call.\n      void deps.tokenStore.markAwaitingClaude(tid, now())\n      void deps.auditSink.write({\n        at: now(),\n        tid,\n        uid: null,\n        event: 'claim',\n        detail: { transport: 'ws' },\n      })\n    })\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llui/agent",
-  "version": "0.0.34",
+  "version": "0.0.36",
   "type": "module",
   "sideEffects": false,
   "exports": {