@loicngr/kobo 2.1.26 → 2.1.28

package/dist/mcp-server/workspace-dialogue-client.js

@@ -45,8 +45,9 @@ export async function callWorkspaceDialogueTool(backendUrl, name, args, token, c
     const transport = new StreamableHTTPClientTransport(new URL(`${backendUrl.replace(/\/$/, '')}/api/mcp`), {
         requestInit: {
             signal,
+            redirect: 'error',
             headers: {
-                ...(token ? { 'X-Kobo-Token': token } : {}),
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
                 'X-Kobo-Client-Name': encodeURIComponent(normalizeClientName(clientName)),
                 'X-Kobo-Client-Name-Encoding': 'uri',
                 'X-Kobo-Client-Transport': 'stdio',
@@ -61,3 +62,27 @@ export async function callWorkspaceDialogueTool(backendUrl, name, args, token, c
         await client.close();
     }
 }
+/** Discovery uses the same principal and live grants as execution. */
+export async function listWorkspaceDialogueTools(backendUrl, token, clientName) {
+    const client = new Client({ name: 'kobo-stdio-bridge', version: '1.0.0' });
+    const signal = AbortSignal.timeout(30_000);
+    const transport = new StreamableHTTPClientTransport(new URL(`${backendUrl.replace(/\/$/, '')}/api/mcp`), {
+        requestInit: {
+            signal,
+            redirect: 'error',
+            headers: {
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                'X-Kobo-Client-Name': encodeURIComponent(normalizeClientName(clientName)),
+                'X-Kobo-Client-Name-Encoding': 'uri',
+                'X-Kobo-Client-Transport': 'stdio',
+            },
+        },
+    });
+    try {
+        await client.connect(transport, { signal });
+        return await client.listTools({}, { signal, timeout: 30_000 });
+    }
+    finally {
+        await client.close();
+    }
+}

package/dist/server/index.js

@@ -7,8 +7,11 @@ import { WebSocketServer } from 'ws';
 import { closeDb, getDb } from './db/index.js';
 import { getPendingMigrations, runMigrations } from './db/migrations.js';
 import { hostCheckMiddleware } from './middleware/host-check-middleware.js';
-import { networkAuthMiddleware } from './middleware/network-auth-middleware.js';
+import { networkAuthMiddleware, operatorDispatchAuthMiddleware } from './middleware/network-auth-middleware.js';
+import { securityHeadersMiddleware } from './middleware/security-headers-middleware.js';
+import { requestBodyLimitsMiddleware, trafficLimitsMiddleware } from './middleware/traffic-limits-middleware.js';
 import activityRouter from './routes/activity.js';
+import authRouter from './routes/auth.js';
 import changelogRouter from './routes/changelog.js';
 import devServerRouter from './routes/dev-server.js';
 import documentsRouter from './routes/documents.js';
@@ -20,8 +23,10 @@ import gitRouter from './routes/git.js';
 import healthRouter from './routes/health.js';
 import imagesRouter from './routes/images.js';
 import integrationsRouter from './routes/integrations.js';
+import internalMcpRouter from './routes/internal-mcp.js';
 import maintenanceRouter from './routes/maintenance.js';
 import mcpRouter from './routes/mcp.js';
+import mcpCredentialsRouter from './routes/mcp-credentials.js';
 import memoryRouter from './routes/memory.js';
 import { migrationRouter } from './routes/migration.js';
 import notionRouter from './routes/notion.js';
@@ -47,7 +52,8 @@ import { beginDevServerShutdown, startDevServer, stopAllDevServers, stopDevServe
 import { onKoboShutdown } from './services/lifecycle-hook-service.js';
 import { reconcileMessageRequests } from './services/mcp-message-request-service.js';
 import { reconcileMemoryContextsOnStartup } from './services/memory-context-service.js';
-import { authorizeWsUpgrade, generateToken, getLanHostnames, getLanUrls, isAllowedOrigin, isAllowedRequestHost, resolveBindHost, resolveDevClientOrigin, resolveNetworkAccessEnvOverrides, resolveProxyHostname, } from './services/network-access-service.js';
+import { generateToken, getLanHostnames, getLanUrls, isAllowedOrigin, isAllowedRequestHost, resolveBindHost, resolveDevClientOrigin, resolveNetworkAccessEnvOverrides, resolveProxyHostname, resolveProxyOrigin, } from './services/network-access-service.js';
+import { consumeWebSocketTicket, isNetworkTransportAllowed, registerNetworkSocket, } from './services/network-session-service.js';
 import { startPrWatcher, stopPrWatcher } from './services/pr-watcher-service.js';
 import { reconcileOrphanedProgressBars } from './services/progress-bar-service.js';
 import * as quotaBackoffService from './services/quota-backoff-service.js';
@@ -156,14 +162,21 @@ const app = new Hono();
 // that re-resolves its own domain to 127.0.0.1 cannot read our responses as
 // same-origin. Mounted on every path, ahead of the token gate: the SPA shell
 // is served outside /api/*, and rebinding targets the browser, not the socket.
+app.use('*', securityHeadersMiddleware());
 app.use('*', hostCheckMiddleware);
 // Gate non-loopback requests behind the network-access token (loopback exempt).
+app.use('/api/*', trafficLimitsMiddleware());
 app.use('/api/*', networkAuthMiddleware);
+app.use('/api/*', requestBodyLimitsMiddleware());
+app.use('/api/*', operatorDispatchAuthMiddleware);
 // Health check (root / is handled by the SPA catch-all below)
 app.get('/api/health', (c) => c.json({ status: 'ok', version: getPackageVersion() }));
 // Mount route sub-routers
 app.route('/api/workspaces', workspacesRouter);
 app.route('/api/workspace-messages', workspaceMessagesRouter);
+app.route('/api/auth', authRouter);
+app.route('/api/internal-mcp', internalMcpRouter);
+app.route('/api/mcp-credentials', mcpCredentialsRouter);
 app.route('/api/mcp', mcpRouter);
 app.route('/api/memory', memoryRouter);
 app.route('/api/progress-bars', progressBarsRouter);
@@ -265,7 +278,6 @@ const server = serve({
         devClientOrigin: resolveDevClientOrigin(),
         networkEnabled: settings.networkAccessEnabled,
         lanUrls: settings.networkAccessEnabled ? getLanUrls(info.port) : [],
-        token: settings.networkAccessToken,
         changelog: readStartupNotes(getChangelogPath()),
         color: Boolean(process.stdout.isTTY && process.env.TERM !== 'dumb' && !('NO_COLOR' in process.env)),
     }));
@@ -288,8 +300,8 @@ server.on('error', (err) => {
     void gracefulShutdown('server error', 1);
 });
 // Create WebSocketServer attached to the HTTP server
-const wss = new WebSocketServer({ noServer: true });
-const terminalWss = new WebSocketServer({ noServer: true });
+const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024, perMessageDeflate: false });
+const terminalWss = new WebSocketServer({ noServer: true, maxPayload: 128 * 1024, perMessageDeflate: false });
 // Wire WebSocket connections to websocket-service.handleConnection()
 wss.on('connection', (ws) => {
     handleConnection(ws);
@@ -353,8 +365,32 @@ server.on('upgrade', (request, socket, head) => {
         socket.destroy();
         return;
     }
-    const { pathname } = new URL(request.url ?? '/', `http://localhost:${PORT}`);
-    const wsGlobal = getGlobalSettings();
+    let upgradeUrl;
+    try {
+        const raw = request.url ?? '/';
+        if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\'))
+            throw new Error('Invalid upgrade path');
+        upgradeUrl = new URL(raw, `http://localhost:${PORT}`);
+    }
+    catch {
+        socket.write('HTTP/1.1 400 Bad Request\r\n\r\n');
+        socket.destroy();
+        return;
+    }
+    const { pathname } = upgradeUrl;
+    let wsGlobal;
+    try {
+        wsGlobal = getGlobalSettings();
+    }
+    catch {
+        socket.destroy();
+        return;
+    }
+    if (!isNetworkTransportAllowed(request.socket.remoteAddress, wsGlobal)) {
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+    }
     // WebSockets are exempt from the same-origin policy and send no preflight,
     // so without these two any page the user visits could open /ws/terminal/<id>
     // and drive a real shell here. Checked before the token gate: on loopback the
@@ -369,7 +405,7 @@ server.on('upgrade', (request, socket, head) => {
         behindProxy: wsGlobal.networkAccessBehindProxy,
         proxyHostname: resolveProxyHostname(),
     })) {
-        console.warn(`[host-check] WS 403 (forbidden host '${wsHost ?? 'unknown'}') ${pathname}`);
+        console.warn('[host-check] WS 403 (forbidden host)');
         socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
         socket.destroy();
         return;
@@ -380,27 +416,23 @@ server.on('upgrade', (request, socket, head) => {
         behindProxy: wsGlobal.networkAccessBehindProxy,
         proxyHostname: resolveProxyHostname(),
         devOrigin: resolveDevClientOrigin(),
+        proxyOrigin: resolveProxyOrigin(),
     })) {
-        console.warn(`[origin-check] WS 403 (forbidden origin '${request.headers.origin ?? 'unknown'}') ${pathname}`);
+        console.warn('[origin-check] WS 403 (forbidden origin)');
         socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
         socket.destroy();
         return;
     }
-    if (!authorizeWsUpgrade({
-        address: request.socket.remoteAddress,
-        rawUrl: request.url,
-        enabled: wsGlobal.networkAccessEnabled,
-        expectedToken: wsGlobal.networkAccessToken,
-        trustLoopback: !wsGlobal.networkAccessBehindProxy,
-    })) {
-        console.warn(`[network-auth] WS 401 (missing/invalid token) from ${request.socket.remoteAddress ?? 'unknown'} ${pathname}`);
+    const ticket = consumeWebSocketTicket(upgradeUrl.searchParams.get('ticket'), pathname, wsGlobal);
+    if (!ticket) {
         socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
         socket.destroy();
         return;
     }
     if (pathname === '/ws') {
         wss.handleUpgrade(request, socket, head, (ws) => {
-            wss.emit('connection', ws, request);
+            if (registerNetworkSocket(ws, request.socket.remoteAddress ?? 'unknown', wsGlobal, getGlobalSettings, ticket.session))
+                wss.emit('connection', ws, request);
         });
     }
     else if (pathname.startsWith('/ws/terminal/')) {
@@ -410,7 +442,8 @@ server.on('upgrade', (request, socket, head) => {
             return;
         }
         terminalWss.handleUpgrade(request, socket, head, (ws) => {
-            terminalWss.emit('connection', ws, workspaceId);
+            if (registerNetworkSocket(ws, request.socket.remoteAddress ?? 'unknown', wsGlobal, getGlobalSettings, ticket.session))
+                terminalWss.emit('connection', ws, workspaceId);
         });
     }
     else {

package/dist/server/middleware/host-check-middleware.js

@@ -1,4 +1,4 @@
-import { getLanHostnames, isAllowedOrigin, isAllowedRequestHost, isLocalRequestHost, resolveDevClientOrigin, resolveProxyHostname, } from '../services/network-access-service.js';
+import { getLanHostnames, isAllowedOrigin, isAllowedRequestHost, isLocalRequestHost, resolveDevClientOrigin, resolveProxyHostname, resolveProxyOrigin, } from '../services/network-access-service.js';
 import { getGlobalSettings } from '../services/settings-service.js';
 /**
  * Rejects requests addressed to a hostname this server is not legitimately
@@ -24,11 +24,12 @@ export const hostCheckMiddleware = async (c, next) => {
         return next();
     let host;
     try {
-        host = new URL(c.req.url).host;
+        host = c.req.header('host') ?? new URL(c.req.url).host;
     }
     catch {
         host = undefined;
     }
+    const requestProtocol = new URL(c.req.url).protocol;
     const origin = c.req.header('origin');
     // Fast path. This middleware runs on every request, static assets included,
     // and the calls below are a synchronous settings read plus an interface
@@ -39,7 +40,7 @@ export const hostCheckMiddleware = async (c, next) => {
         return next();
     const devOrigin = resolveDevClientOrigin();
     // A page we served ourselves, talking to us: still no settings needed.
-    if (isLocalRequestHost(host) && isAllowedOrigin({ origin, requestHost: host, devOrigin })) {
+    if (isLocalRequestHost(host) && isAllowedOrigin({ origin, requestHost: host, devOrigin, requestProtocol })) {
         return next();
     }
     let global;
@@ -63,7 +64,7 @@ export const hostCheckMiddleware = async (c, next) => {
         proxyHostname: resolveProxyHostname(),
     })) {
         // Surface it: "the page just stopped loading" is otherwise undebuggable.
-        console.warn(`[host-check] 403 (forbidden host '${host ?? 'unknown'}') ${c.req.method} ${c.req.path}`);
+        console.warn('[host-check] 403 (forbidden host)');
         return c.json({ error: 'forbidden host' }, 403);
     }
     if (!isAllowedOrigin({
@@ -72,8 +73,10 @@ export const hostCheckMiddleware = async (c, next) => {
         behindProxy: global.networkAccessBehindProxy,
         proxyHostname: resolveProxyHostname(),
         devOrigin,
+        requestProtocol,
+        proxyOrigin: resolveProxyOrigin(),
     })) {
-        console.warn(`[origin-check] 403 (forbidden origin '${origin}') ${c.req.method} ${c.req.path}`);
+        console.warn('[origin-check] 403 (forbidden origin)');
         return c.json({ error: 'forbidden origin' }, 403);
     }
     return next();

package/dist/server/middleware/network-auth-middleware.js

@@ -1,42 +1,64 @@
 import { getConnInfo } from '@hono/node-server/conninfo';
-import { evaluateNetworkAccess } from '../services/network-access-service.js';
+import { getCookie } from 'hono/cookie';
+import { evaluateNetworkAccess, isLoopbackAddress } from '../services/network-access-service.js';
+import { browserCookieName, getBrowserSession } from '../services/network-session-service.js';
 import { getGlobalSettings } from '../services/settings-service.js';
-/**
- * Gates non-loopback requests behind the network-access token.
- *
- * Loopback requests pass without a token (the host machine's own usage is
- * frictionless) — unless `networkAccessBehindProxy` is enabled, in which case
- * loopback is treated like any other address (see network-access-service.ts).
- * The client IP comes only from the OS socket via getConnInfo, never from
- * X-Forwarded-For, so a remote client cannot spoof a loopback address.
- *
- * `/api/health` is always exempt, regardless of `networkAccessBehindProxy`:
- * it exposes only `{ status, version }` (nothing sensitive), and Docker's own
- * HEALTHCHECK / a Compose healthcheck / an orchestrator's liveness probe has
- * no way to supply the runtime-generated token — without this exemption, a
- * "behind a reverse proxy" deployment's own container never reports healthy.
- */
+/** Socket addresses are authoritative; forwarded headers never establish trust. */
 export const networkAuthMiddleware = async (c, next) => {
     if (c.req.path === '/api/health')
         return next();
     const address = getConnInfo(c).remote.address;
-    const global = getGlobalSettings();
-    // MCP clients commonly send the shared token as an Authorization header.
-    const bearerToken = /^\/api\/mcp\/?$/.test(c.req.path)
-        ? c.req.header('Authorization')?.match(/^Bearer\s+(.+)$/i)?.[1]
-        : undefined;
+    const policy = getGlobalSettings();
+    const loopback = isLoopbackAddress(address);
+    // These two transports authenticate themselves, with credentials that cannot
+    // authorize any other HTTP route. Internal capabilities never cross the network.
+    if (/^\/api\/internal-mcp(?:\/|$)/.test(c.req.path)) {
+        if (c.req.method !== 'POST' || !loopback)
+            return c.json({ error: 'unauthorized' }, 403);
+        return next();
+    }
+    if (c.req.path === '/api/mcp' || c.req.path === '/api/mcp/') {
+        if (!policy.networkAccessEnabled && (!loopback || policy.networkAccessBehindProxy))
+            return c.json({ error: 'unauthorized' }, 403);
+        return next();
+    }
+    // Supplying an MCP credential never becomes operator authority, even where
+    // unauthenticated local operator requests are normally trusted.
+    if (/^Bearer\s+kobo_mcp_/i.test(c.req.header('Authorization') ?? '') ||
+        c.req.header('X-Kobo-Token')?.startsWith('kobo_mcp_')) {
+        return c.json({ error: 'Operator credential required' }, 401);
+    }
+    const session = getBrowserSession(getCookie(c, browserCookieName(policy)), policy);
     const decision = evaluateNetworkAccess({
         address,
-        enabled: global.networkAccessEnabled,
-        expectedToken: global.networkAccessToken,
-        providedToken: c.req.header('X-Kobo-Token') ?? bearerToken,
-        trustLoopback: !global.networkAccessBehindProxy,
+        enabled: policy.networkAccessEnabled,
+        expectedToken: policy.networkAccessToken,
+        providedToken: session ? policy.networkAccessToken : c.req.header('X-Kobo-Token'),
+        trustLoopback: !policy.networkAccessBehindProxy,
     });
     if (decision.allow)
         return next();
-    // Surface denied requests so "my device can't connect" is debuggable.
-    // Never log the token itself, only the reason and the remote address.
-    const reason = decision.status === 403 ? 'network access disabled' : 'missing/invalid token';
-    console.warn(`[network-auth] HTTP ${decision.status} (${reason}) from ${address ?? 'unknown'} ${c.req.method} ${c.req.path}`);
     return c.json({ error: 'unauthorized' }, decision.status);
 };
+/** Mount after the initial auth gate and body limits, before operator routes.
+ * Acceptance happens only after the complete bounded request has arrived.
+ * MCP transports implement their own equivalent live-credential checks.
+ */
+export const operatorDispatchAuthMiddleware = async (c, next) => {
+    if (/^\/api\/(?:internal-)?mcp(?:\/|$)/.test(c.req.path))
+        return next();
+    if (c.req.raw.body) {
+        const original = c.req.raw;
+        let body;
+        try {
+            body = await original.arrayBuffer();
+        }
+        catch {
+            return c.json({ error: 'Invalid request body' }, 400);
+        }
+        // Preserve raw consumers (multipart uploads and workspace creation), as
+        // well as Hono's json/formData helpers. The initial limits ran beforehand.
+        c.req.raw = new Request(original, { body });
+    }
+    return networkAuthMiddleware(c, next);
+};

package/dist/server/middleware/security-headers-middleware.js

@@ -0,0 +1,19 @@
+/** Browser protections that also apply to denied requests and SPA responses. */
+export function securityHeadersMiddleware() {
+    return async (c, next) => {
+        c.header('Content-Security-Policy', "frame-ancestors 'self'");
+        c.header('X-Frame-Options', 'SAMEORIGIN');
+        c.header('X-Content-Type-Options', 'nosniff');
+        c.header('Referrer-Policy', 'no-referrer');
+        if (c.req.path === '/api' || c.req.path.startsWith('/api/')) {
+            c.header('Cache-Control', 'no-store');
+            c.header('Pragma', 'no-cache');
+        }
+        // HSTS belongs at the TLS terminator. Forwarded headers are client input
+        // unless a proxy is explicitly trusted, and local HTTP must remain usable.
+        await next();
+        if (c.req.path === '/api' || c.req.path.startsWith('/api/')) {
+            c.header('Cache-Control', 'no-store');
+        }
+    };
+}

package/dist/server/middleware/traffic-limits-middleware.js

@@ -0,0 +1,74 @@
+import { getConnInfo } from '@hono/node-server/conninfo';
+import { bodyLimit } from 'hono/body-limit';
+/** Bounded process-local limits, keyed by OS peers, never attacker-controlled forwarded IPs. */
+export function trafficLimitsMiddleware() {
+    const peers = new Map();
+    let activeMcp = 0;
+    let activeLargeMcp = 0;
+    return async (c, next) => {
+        if (c.req.path === '/api/health')
+            return next();
+        const now = Date.now();
+        const address = getConnInfo(c).remote.address ?? 'unknown';
+        let peer = peers.get(address);
+        if (!peer || peer.reset <= now) {
+            for (const [key, value] of peers)
+                if (value.reset <= now)
+                    peers.delete(key);
+            if (peers.size >= 4096 && !peers.has(address))
+                return c.json({ error: 'Too many clients' }, 429);
+            peer = { reset: now + 60_000, requests: 0, logins: 0 };
+            peers.set(address, peer);
+        }
+        if (++peer.requests > 3000 ||
+            (c.req.path === '/api/auth/session' && c.req.method === 'POST' && ++peer.logins > 20)) {
+            c.header('Retry-After', String(Math.max(1, Math.ceil((peer.reset - now) / 1000))));
+            return c.json({ error: 'Too many requests' }, 429);
+        }
+        const mcp = /^\/api\/(?:internal-)?mcp\/?$/.test(c.req.path);
+        // Node rejects mismatched Content-Length framing. Unknown/chunked lengths
+        // reserve a large-body slot until completion without reading any bytes.
+        const length = c.req.header('Content-Length');
+        const largeMcp = mcp && c.req.raw.body !== null && (length === undefined || !/^\d+$/.test(length) || Number(length) > 1024 * 1024);
+        if (mcp && (activeMcp >= 32 || (largeMcp && activeLargeMcp >= 4)))
+            return c.json({ error: 'Too many active MCP requests' }, 429);
+        if (mcp)
+            activeMcp++;
+        if (largeMcp)
+            activeLargeMcp++;
+        // Do not buffer bodies here: authentication must finish first.
+        try {
+            return await next();
+        }
+        finally {
+            if (mcp)
+                activeMcp--;
+            if (largeMcp)
+                activeLargeMcp--;
+        }
+    };
+}
+/** Mount after operator authentication. MCP routes authenticate and bound their own bodies. */
+export function requestBodyLimitsMiddleware() {
+    const small = bodyLimit({ maxSize: 1024 * 1024 });
+    const large = bodyLimit({ maxSize: 72 * 1024 * 1024 });
+    let activeUploads = 0;
+    return async (c, next) => {
+        if (/^\/api\/(?:internal-)?mcp\/?$/.test(c.req.path))
+            return next();
+        const attachments = c.req.path === '/api/workspaces' ||
+            /^\/api\/workspaces\/[^/]+\/(images|attachments|messages)(?:\/|$)/.test(c.req.path) ||
+            c.req.path.startsWith('/api/voice/');
+        if (!attachments)
+            return small(c, next);
+        if (activeUploads >= 4)
+            return c.json({ error: 'Too many active uploads' }, 429);
+        activeUploads++;
+        try {
+            return await large(c, next);
+        }
+        finally {
+            activeUploads--;
+        }
+    };
+}

package/dist/server/routes/auth.js

@@ -0,0 +1,73 @@
+import { getConnInfo } from '@hono/node-server/conninfo';
+import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
+import { evaluateNetworkAccess, tokenMatches } from '../services/network-access-service.js';
+import { browserCookieName, createBrowserSession, createWebSocketTicket, getBrowserSession, revokeBrowserSession, secureBrowserCookie, } from '../services/network-session-service.js';
+import { getGlobalSettings } from '../services/settings-service.js';
+const router = new Hono();
+router.use('*', bodyLimit({ maxSize: 1024 }));
+router.post('/session', (c) => {
+    const policy = getGlobalSettings();
+    // Even a local unauthenticated caller cannot mint an authenticated session.
+    if (!policy.networkAccessToken || !tokenMatches(c.req.header('X-Kobo-Token') ?? '', policy.networkAccessToken))
+        return c.json({ error: 'unauthorized' }, 401);
+    try {
+        const session = createBrowserSession(policy);
+        setCookie(c, browserCookieName(policy), session.token, {
+            httpOnly: true,
+            secure: secureBrowserCookie(policy),
+            sameSite: 'Strict',
+            path: '/',
+            maxAge: 12 * 60 * 60,
+        });
+        return c.json({ ok: true });
+    }
+    catch {
+        return c.json({ error: 'Session capacity reached' }, 429);
+    }
+});
+router.delete('/session', (c) => {
+    const policy = getGlobalSettings();
+    const token = getCookie(c, browserCookieName(policy));
+    if (token)
+        revokeBrowserSession(token);
+    deleteCookie(c, browserCookieName(policy), { path: '/', secure: secureBrowserCookie(policy) });
+    return c.json({ ok: true });
+});
+router.post('/ws-ticket', async (c) => {
+    let body;
+    try {
+        body = await c.req.json();
+    }
+    catch {
+        return c.json({ error: 'Invalid JSON' }, 400);
+    }
+    if (!body ||
+        typeof body !== 'object' ||
+        !('path' in body) ||
+        typeof body.path !== 'string' ||
+        !/^\/ws(?:\/terminal\/[A-Za-z0-9_-]{1,200})?$/.test(body.path))
+        return c.json({ error: 'Invalid WebSocket path' }, 400);
+    const policy = getGlobalSettings();
+    const cookie = getCookie(c, browserCookieName(policy));
+    const session = getBrowserSession(cookie, policy);
+    // Stale cookies must not override a valid operator header or trusted local access.
+    // Remote callers still need a current session or token in the policy check below.
+    const decision = evaluateNetworkAccess({
+        address: getConnInfo(c).remote.address,
+        enabled: policy.networkAccessEnabled,
+        expectedToken: policy.networkAccessToken,
+        providedToken: session ? policy.networkAccessToken : c.req.header('X-Kobo-Token'),
+        trustLoopback: !policy.networkAccessBehindProxy,
+    });
+    if (!decision.allow)
+        return c.json({ error: 'unauthorized' }, decision.status);
+    try {
+        return c.json({ ticket: createWebSocketTicket(body.path, policy, session) });
+    }
+    catch {
+        return c.json({ error: 'Ticket capacity reached' }, 429);
+    }
+});
+export default router;

package/dist/server/routes/internal-mcp.js

@@ -0,0 +1,137 @@
+import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { createManagedMcpDispatcher } from '../../mcp-server/managed-mcp-dispatcher.js';
+import { MAX_MCP_ATTACHMENT_REQUEST_BYTES } from '../../shared/mcp-attachments.js';
+import { normalizeClientName } from '../../shared/workspace-message-types.js';
+import { getDb } from '../db/index.js';
+import { authorizeInternalMcpTool, resolveInternalMcpCapability } from '../services/internal-mcp-capability-service.js';
+import { getSettingsPath } from '../utils/paths.js';
+const app = new Hono();
+app.use('*', async (c, next) => {
+    try {
+        resolveInternalMcpCapability(c.req.header('X-Kobo-Mcp-Session'));
+    }
+    catch {
+        return c.json({ isError: true, content: [{ type: 'text', text: 'Invalid or revoked managed MCP capability' }] }, 403);
+    }
+    return next();
+});
+app.use('*', bodyLimit({ maxSize: MAX_MCP_ATTACHMENT_REQUEST_BYTES }));
+app.post('/', async (c) => {
+    let input;
+    try {
+        input = await c.req.json();
+    }
+    catch {
+        return c.json({ error: 'Invalid JSON' }, 400);
+    }
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return c.json({ error: 'Expected an object' }, 400);
+    const token = c.req.header('X-Kobo-Mcp-Session');
+    try {
+        const capability = resolveInternalMcpCapability(token);
+        const args = input.arguments ?? {};
+        if (!args || typeof args !== 'object' || Array.isArray(args))
+            return c.json({ error: 'Expected arguments object' }, 400);
+        const name = typeof input.name === 'string' ? input.name : '';
+        if (input.method !== 'list' && input.method !== 'call')
+            return c.json({ error: 'Unknown operation' }, 400);
+        if (input.method === 'call')
+            authorizeInternalMcpTool(token, name, args);
+        // Only attachment tools receive the larger envelope budget.
+        if (name !== 'create_workspace' &&
+            name !== 'send_workspace_message' &&
+            new TextEncoder().encode(JSON.stringify(input)).byteLength > 1024 * 1024)
+            return c.json({ error: 'Request too large' }, 413);
+        const check = () => {
+            if (input.method === 'call')
+                authorizeInternalMcpTool(token, name, args);
+            else
+                resolveInternalMcpCapability(token);
+        };
+        const dispatch = async (pathname, init) => {
+            // All paths originate from the fixed managed-tool dispatcher. Reject path
+            // traversal before URL normalization, including caller-supplied IDs.
+            const requestPath = pathname.split('?')[0];
+            if (requestPath.includes('..') || /[%\\#]/.test(requestPath))
+                throw new Error('Invalid managed request path');
+            let routes;
+            let prefix;
+            if (pathname.startsWith('/api/workspaces/')) {
+                routes = (await import('./workspaces.js')).default;
+                prefix = '/api/workspaces';
+            }
+            else if (pathname.startsWith('/api/dev-server/')) {
+                routes = (await import('./dev-server.js')).default;
+                prefix = '/api/dev-server';
+            }
+            else if (pathname.startsWith('/api/memory/agent/')) {
+                routes = (await import('./memory.js')).default;
+                prefix = '/api/memory';
+            }
+            else if (pathname.startsWith('/api/progress-bars/agent/')) {
+                routes = (await import('./progress-bars.js')).default;
+                prefix = '/api/progress-bars';
+            }
+            else if (pathname.startsWith('/api/search?')) {
+                routes = (await import('./search.js')).default;
+                prefix = '/api/search';
+            }
+            else
+                throw new Error('Unsupported managed request');
+            check();
+            const relative = pathname.slice(prefix.length);
+            return routes.request(`http://kobo.internal${relative.startsWith('?') ? '/' : ''}${relative}`, init);
+        };
+        const backendRequest = async (method, pathname, body) => {
+            const response = await dispatch(pathname, {
+                method,
+                headers: { 'Content-Type': 'application/json' },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+            if (!response.ok)
+                throw new Error(`Managed backend returned ${response.status}`);
+            const text = await response.text();
+            return text ? JSON.parse(text) : null;
+        };
+        const dispatcher = createManagedMcpDispatcher({
+            workspaceId: capability.workspaceId,
+            db: getDb(),
+            settingsPath: getSettingsPath(),
+            backendUrl: 'http://kobo.internal',
+            env: capability.env,
+            backendRequest,
+            fetcher: async (url, init) => dispatch(new URL(String(url)).pathname, init ?? {}),
+            dialogueTool: async (_url, tool, arguments_) => {
+                const { executeExternalMcpTool } = await import('./mcp.js');
+                check();
+                return executeExternalMcpTool(tool, arguments_, {
+                    kind: 'mcp',
+                    clientName: normalizeClientName(typeof input.clientName === 'string' ? input.clientName : 'kobo-managed-agent'),
+                    transport: 'stdio',
+                });
+            },
+        });
+        if (input.method === 'list')
+            return c.json({
+                tools: dispatcher.availableTools().filter((tool) => {
+                    try {
+                        authorizeInternalMcpTool(token, tool.name, {});
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                }),
+            });
+        check();
+        return c.json(await dispatcher.callTool(name, args));
+    }
+    catch (error) {
+        return c.json({
+            isError: true,
+            content: [{ type: 'text', text: error instanceof Error ? error.message : 'Managed MCP request rejected' }],
+        }, 403);
+    }
+});
+export default app;