@monotykamary/localterm-server 2.33.0 → 2.35.0

package/dist/index.js

@@ -18,7 +18,7 @@ import { CdpClient } from "./cdp/cdp-client.js";
 import { detectWithExplicitPort } from "./cdp/discover-explicit-endpoint.js";
 import { DaemonConfigStore } from "./daemon-config-store.js";
 import { z } from "zod";
-import { ACTIVITY_DIRNAME, ACTIVITY_REFRESH_DEBOUNCE_MS, ACTIVITY_WATCHED_PROGRAMS, AUTOMATION_EVENT_DEBOUNCE_MS, AUTOMATION_RECONCILE_MIN_DOWNTIME_MS, AUTOMATION_RUN_QUERY_PARAM, AUTOMATION_WATCH_DEBOUNCE_MS, AUTOMATION_WATCH_POST_RUN_GRACE_MS, AUTOMATION_WEBHOOK_DEBOUNCE_MS, DEFAULT_HOST, DEFAULT_PORT, FRIENDLY_HOSTNAME, GIT_MAX_REF_LENGTH, HTTP_STATUS_ACCEPTED, HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_CONFLICT, HTTP_STATUS_CREATED, HTTP_STATUS_NOT_FOUND, MAX_AUTOMATIONS, MAX_PROCESSES, MAX_SECRETS, MS_PER_MINUTE, PROCESSES_FILENAME, SECRETS_FILENAME, SECRETS_SHIMS_DIRNAME, SERVER_STOP_GRACE_MS, SESSION_ID_QUERY_PARAM, SESSION_ACTIVITY_WINDOW_MS, WAIT_DEFAULT_TIMEOUT_MS, WS_BACKPRESSURE_THRESHOLD_BYTES, WS_CLOSE_BACKPRESSURE, WS_CLOSE_CAPACITY_REACHED, WS_CLOSE_POLICY_VIOLATION, WS_HEARTBEAT_GRACE_MS, WS_HEARTBEAT_INTERVAL_MS, WS_HEARTBEAT_TIMEOUT_MS, WS_READY_STATE_OPEN, } from "./constants.js";
+import { ACTIVITY_DIRNAME, ACTIVITY_REFRESH_DEBOUNCE_MS, ACTIVITY_WATCHED_PROGRAMS, AUTOMATION_EVENT_DEBOUNCE_MS, AUTOMATION_RECONCILE_MIN_DOWNTIME_MS, AUTOMATION_RUN_QUERY_PARAM, AUTOMATION_WATCH_DEBOUNCE_MS, AUTOMATION_WATCH_POST_RUN_GRACE_MS, AUTOMATION_WEBHOOK_DEBOUNCE_MS, DEFAULT_HOST, DEFAULT_PORT, FRIENDLY_HOSTNAME, GIT_MAX_REF_LENGTH, HTTP_STATUS_ACCEPTED, HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_CONFLICT, HTTP_STATUS_CREATED, HTTP_STATUS_NOT_FOUND, MAX_AUTOMATIONS, MAX_PROCESSES, MAX_SECRETS, MS_PER_MINUTE, PROCESSES_FILENAME, SECRETS_FILENAME, SECRETS_SHIMS_DIRNAME, SERVER_STOP_GRACE_MS, SESSION_ID_QUERY_PARAM, SESSION_ACTIVITY_WINDOW_MS, WAIT_DEFAULT_TIMEOUT_MS, WS_BACKPRESSURE_THRESHOLD_BYTES, WS_CLOSE_BACKPRESSURE, WS_CLOSE_CAPACITY_REACHED, WS_CLOSE_POLICY_VIOLATION, WS_HEARTBEAT_GRACE_MS, WS_HEARTBEAT_INTERVAL_MS, WS_HEARTBEAT_TIMEOUT_MS, WS_READY_STATE_OPEN, AUTH_SECRET_FILENAME, AUTH_COOKIE_NAME, } from "./constants.js";
 import { getDefaultShell } from "./default-shell.js";
 import { shellPathForUserShell } from "./utils/shell-path.js";
 import { openChromeInspect } from "./utils/open-chrome-inspect.js";
@@ -38,6 +38,9 @@ import { createGitWorktree, listGitWorktrees, removeGitWorktree } from "./git-wo
 import { defaultSnapshotListeners, isSessionDescendantPid, listSessionListeningPorts, } from "./listening-ports.js";
 import { clientToServerMessageSchema, createAutomationInputSchema, createSessionInputSchema, createWorktreeInputSchema, execInputSchema, execOneShotInputSchema, launchInputSchema, resetAutomationInputSchema, secretEntrySchema, secretSetInputSchema, sessionInputSchema, sessionResizeSchema, processNameSchema, processSetInputSchema, updateAutomationInputSchema, updateDaemonConfigInputSchema, updateSessionInputSchema, updateWorktreeConfigInputSchema, worktreeIncludeFileInputSchema, waitInputSchema, mouseInputSchema, } from "./schemas.js";
 import { createNetworkPolicyMiddleware, isAllowedSourceIp, isLoopbackHost } from "./security.js";
+import { createIdentityProvider } from "./identity/factory.js";
+import { loadOrCreateAuthSecret, signSessionToken } from "./identity/session-cookie.js";
+import { createAuthGateMiddleware, createIdentityResolver, getRequestSourceIp, toSessionOwner, } from "./identity/resolve.js";
 import { SessionManager, } from "./session-manager.js";
 import { capturePanePng, sendMouse } from "./session-automation.js";
 import { encodeClick, encodeDrag, encodeMove, encodeScroll } from "./utils/sgr-mouse.js";
@@ -168,7 +171,7 @@ const normalizeMouseAction = (input) => {
 };
 const buildApiRoutes = (ctx) => {
     const api = new Hono();
-    const { registry, cdpClient, secretBackend, secretStore, shimsDir, processStore, syncSecretShims, automationStore, broadcastAutomations, syncFolderWatchers, syncSessionEventListeners, webhookTriggerManager, worktreeConfigStore, portsSnapshotProcesses, portsSnapshotListeners, toAutomationWithNextRun, listAutomationsWithNextRun, tryLaunch, getCdpPort, applyCdpPort, getGraceSeconds, applyGraceSeconds, connectCdpNow, buildTabUrl, } = ctx;
+    const { registry, ownerFor, cdpClient, secretBackend, secretStore, shimsDir, processStore, syncSecretShims, automationStore, broadcastAutomations, syncFolderWatchers, syncSessionEventListeners, webhookTriggerManager, worktreeConfigStore, portsSnapshotProcesses, portsSnapshotListeners, toAutomationWithNextRun, listAutomationsWithNextRun, tryLaunch, getCdpPort, applyCdpPort, getGraceSeconds, applyGraceSeconds, connectCdpNow, buildTabUrl, mintViewerCookie, } = ctx;
     // Headless SGR-1006 fallback for `mouse` when no CDP tab is reachable:
     // encode the gesture as SGR bytes and write them straight to the PTY. Closes
     // over `registry` so the automation layer stays CDP-agnostic. Coords arrive
@@ -203,9 +206,9 @@ const buildApiRoutes = (ctx) => {
     // switch to one by id or kill one it no longer wants. `clients` is the count
     // of attached sockets — 0 marks a dormant shell left behind by a closed tab,
     // which is exactly the row the picker exists to surface.
-    api.get("/sessions", (context) => context.json({ sessions: registry.list() }));
+    api.get("/sessions", (context) => context.json({ sessions: registry.list(ownerFor(context)) }));
     api.delete("/sessions/:id", (context) => {
-        const killed = registry.kill(context.req.param("id"));
+        const killed = registry.kill(context.req.param("id"), ownerFor(context));
         if (!killed)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json({ ok: true });
@@ -219,7 +222,9 @@ const buildApiRoutes = (ctx) => {
     // network-policy middleware already on `*`; the daemon hands out unrestricted
     // shells, so driving one programmatically is no escalation.
     api.get("/sessions/:id", (context) => {
-        const managed = registry.list().find((session) => session.id === context.req.param("id"));
+        const managed = registry
+            .list(ownerFor(context))
+            .find((session) => session.id === context.req.param("id"));
         if (!managed)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json({ session: managed });
@@ -244,12 +249,12 @@ const buildApiRoutes = (ctx) => {
             cols: parsed.data.cols,
             rows: parsed.data.rows,
             initialCommand: parsed.data.command,
-        }, parsed.data.pinned ?? true);
+        }, parsed.data.pinned ?? true, ownerFor(context));
         if (!id)
             return context.json({ error: "capacity" }, HTTP_STATUS_CONFLICT);
         if (parsed.data.name)
-            registry.setTitleById(id, parsed.data.name);
-        const session = registry.list().find((item) => item.id === id);
+            registry.setTitleById(id, parsed.data.name, ownerFor(context));
+        const session = registry.list(ownerFor(context)).find((item) => item.id === id);
         return context.json({ session }, HTTP_STATUS_CREATED);
     });
     // Rename (sets the title) and/or toggle pin. A pin change re-arms the grace
@@ -259,11 +264,12 @@ const buildApiRoutes = (ctx) => {
         if (!parsed.success)
             return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
         const id = context.req.param("id");
+        const owner = ownerFor(context);
         if (parsed.data.name !== undefined)
-            registry.setTitleById(id, parsed.data.name);
+            registry.setTitleById(id, parsed.data.name, owner);
         if (parsed.data.pinned !== undefined)
-            registry.setPinned(id, parsed.data.pinned);
-        const session = registry.list().find((item) => item.id === id);
+            registry.setPinned(id, parsed.data.pinned, owner);
+        const session = registry.list(owner).find((item) => item.id === id);
         if (!session)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json({ session });
@@ -278,9 +284,10 @@ const buildApiRoutes = (ctx) => {
         if (!parsed.success)
             return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
         const id = context.req.param("id");
+        const owner = ownerFor(context);
         const written = parsed.data.named
-            ? registry.pressKeysById(id, parsed.data.data)
-            : registry.writeInputById(id, parsed.data.data);
+            ? registry.pressKeysById(id, parsed.data.data, owner)
+            : registry.writeInputById(id, parsed.data.data, owner);
         if (!written)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json({ ok: true });
@@ -289,7 +296,7 @@ const buildApiRoutes = (ctx) => {
         const parsed = sessionResizeSchema.safeParse(await readJsonBody(context));
         if (!parsed.success)
             return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
-        const resized = registry.resizeById(context.req.param("id"), parsed.data.cols, parsed.data.rows);
+        const resized = registry.resizeById(context.req.param("id"), parsed.data.cols, parsed.data.rows, ownerFor(context));
         if (!resized)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json({ ok: true });
@@ -301,9 +308,16 @@ const buildApiRoutes = (ctx) => {
     // headless capture renderer's grid, which works with no browser at all.
     api.get("/sessions/:id/pane", async (context) => {
         const id = context.req.param("id");
+        // PNG is rasterized by a CDP tab the daemon opens minted the owner's
+        // session cookie, so gate both formats on ownership before delegating — a
+        // cross-tenant id surfaces as not-found, not a screenshot of someone else's shell.
+        const owner = ownerFor(context);
+        if (!registry.list(owner).some((session) => session.id === id)) {
+            return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
+        }
         const format = context.req.query("format");
         if (format === "png") {
-            const png = await capturePanePng({ cdpClient, buildTabUrl }, registry, id);
+            const png = await capturePanePng({ cdpClient, buildTabUrl, mintViewerCookie }, registry, id, owner);
             if (!png)
                 return context.json({ error: "no_browser" }, HTTP_STATUS_CONFLICT);
             return new Response(png, { headers: { "content-type": "image/png" } });
@@ -313,7 +327,7 @@ const buildApiRoutes = (ctx) => {
         if (lines !== undefined && (!Number.isInteger(lines) || lines <= 0)) {
             return context.json({ error: "invalid_lines" }, HTTP_STATUS_BAD_REQUEST);
         }
-        const text = await registry.capturePane(id, lines);
+        const text = await registry.capturePane(id, lines, owner);
         if (text === null)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json({ text });
@@ -332,7 +346,7 @@ const buildApiRoutes = (ctx) => {
         if (!predicate)
             return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
         const idleMs = parsed.data.mode === "idle" ? (parsed.data.idleMs ?? SESSION_ACTIVITY_WINDOW_MS) : undefined;
-        const result = await registry.waitFor(id, predicate, timeoutMs, idleMs);
+        const result = await registry.waitFor(id, predicate, timeoutMs, idleMs, ownerFor(context));
         if (!result)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json(result);
@@ -345,23 +359,31 @@ const buildApiRoutes = (ctx) => {
         if (!parsed.success)
             return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
         const id = context.req.param("id");
+        // sendMouse drives the session via a CDP tab the daemon opens minted the
+        // owner's session cookie, so gate on ownership here (the manager calls
+        // inside sendMouse aren't owner-scoped) — a cross-tenant id surfaces as not-found.
+        const owner = ownerFor(context);
+        if (!registry.list(owner).some((session) => session.id === id)) {
+            return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
+        }
         const action = normalizeMouseAction(parsed.data);
         if (!action)
             return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
-        const result = await sendMouse({ cdpClient, buildTabUrl }, registry, id, action, writeSgrMouseFallback);
+        const result = await sendMouse({ cdpClient, buildTabUrl, mintViewerCookie }, registry, id, action, owner, writeSgrMouseFallback);
         return context.json(result);
     });
     // mouse state: whether the session's foreground app enabled mouse tracking
     // (gates the SGR fallback) plus the viewport size.
     api.get("/sessions/:id/mouse/state", (context) => {
         const id = context.req.param("id");
-        const managed = registry.list().find((session) => session.id === id);
+        const owner = ownerFor(context);
+        const managed = registry.list(owner).find((session) => session.id === id);
         if (!managed)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json({
-            enabled: registry.mouseEnabledFor(id),
-            cols: registry.sessionSizeFor(id).cols,
-            rows: registry.sessionSizeFor(id).rows,
+            enabled: registry.mouseEnabledFor(id, owner),
+            cols: registry.sessionSizeFor(id, owner).cols,
+            rows: registry.sessionSizeFor(id, owner).rows,
         });
     });
     // In-session exec: run a single command line inside a persistent session,
@@ -375,7 +397,7 @@ const buildApiRoutes = (ctx) => {
         const result = await registry.execInSession(context.req.param("id"), parsed.data.command, {
             timeoutMs: parsed.data.timeoutMs,
             outputLimitBytes: parsed.data.outputLimitBytes,
-        });
+        }, ownerFor(context));
         if (!result)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json(result);
@@ -396,14 +418,15 @@ const buildApiRoutes = (ctx) => {
         if (registry.atCapacity()) {
             return context.json({ error: "capacity" }, HTTP_STATUS_CONFLICT);
         }
-        const id = registry.spawnDetached({ cwd, cols: parsed.data.cols, rows: parsed.data.rows, env: parsed.data.env }, false);
+        const owner = ownerFor(context);
+        const id = registry.spawnDetached({ cwd, cols: parsed.data.cols, rows: parsed.data.rows, env: parsed.data.env }, false, owner);
         if (!id)
             return context.json({ error: "capacity" }, HTTP_STATUS_CONFLICT);
         const result = await registry.execInSession(id, parsed.data.command, {
             timeoutMs: parsed.data.timeoutMs,
             outputLimitBytes: parsed.data.outputLimitBytes,
-        });
-        registry.kill(id);
+        }, owner);
+        registry.kill(id, owner);
         if (!result)
             return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
         return context.json(result);
@@ -553,7 +576,7 @@ const buildApiRoutes = (ctx) => {
     // each row carries the session's title/cwd for the modal to badge without a
     // second fetch.
     api.get("/ports", async (context) => {
-        const sessions = registry.list();
+        const sessions = registry.list(ownerFor(context));
         const sessionPids = sessions.map((session) => session.pid);
         const [snapshot, listeners] = await Promise.all([
             portsSnapshotProcesses(),
@@ -1230,6 +1253,54 @@ export const createServer = async (options = {}) => {
     // the next `connect()` picks up the new port without re-wiring.
     const daemonConfigStore = new DaemonConfigStore(path.join(stateDirectory, "config.json"));
     let cdpPort = daemonConfigStore.getCdpPort();
+    // Identity provider (config-file `identity`, overridable via `ServerOptions`).
+    // `null` = no provider → single-authority mode: every request is the operator
+    // tier, the registry stays unscoped, byte-identical to no-auth. A configured
+    // provider resolves an `Identity` per request to partition the registry by
+    // user. Built once at start; changing it requires a restart (unlike the
+    // live cdpPort/graceSeconds knobs).
+    const identityConfig = options.identity ?? daemonConfigStore.getIdentity();
+    // The HMAC secret for the passkey provider's signed session cookie.
+    // Generated once and persisted; losing it invalidates every live session
+    // (users re-log in) — never silently reused. Unused by the `header` provider.
+    const authSecret = loadOrCreateAuthSecret(path.join(stateDirectory, AUTH_SECRET_FILENAME));
+    const identityProviderDeps = {
+        secret: authSecret,
+        getOrigin: () => localOrigin ?? publicOrigin ?? null,
+        stateDirectory,
+    };
+    const identityProvider = identityConfig
+        ? createIdentityProvider(identityConfig, identityProviderDeps)
+        : null;
+    const identityResolver = createIdentityResolver(identityProvider);
+    const resolveIdentity = (context, sourceIp) => identityResolver.resolve(context, sourceIp ?? getRequestSourceIp(context));
+    const ownerFor = (context) => toSessionOwner(resolveIdentity(context));
+    // In an auth-gated mode, mint a signed session cookie for the daemon's own
+    // CDP viewer tabs (capture-pane --png / real-browser mouse) so their /ws
+    // upgrade passes the auth gate — those tabs carry no browser session.
+    // Undefined when no provider is configured (the gate is open); null for the
+    // operator tier (passkey mode has no operator sessions, so that degrades).
+    const mintViewerCookie = identityProvider?.denyUnauthenticated
+        ? (owner) => owner ? { name: AUTH_COOKIE_NAME, value: signSessionToken(authSecret, owner) } : null
+        : undefined;
+    // Reject unauthenticated requests at the door for providers that own their
+    // login (passkey/oidc): a request with no valid session is 401 (HTTP) or
+    // never reaches the WS upgrade. Exempts `/api/health` (readiness) and
+    // everything outside `/api` and `/ws` (the static terminal app + the `/auth`
+    // login flow must load before there's a session). The `header` provider opts
+    // out (denyUnauthenticated: false) — its no-header case IS the operator tier.
+    app.use("*", createAuthGateMiddleware(identityProvider, resolveIdentity));
+    if (identityProvider?.routes)
+        app.route("/auth", identityProvider.routes());
+    // Unauthenticated meta endpoint the terminal app / CLI hit before login to
+    // learn which login flow to offer: the provider kind, and (for passkey)
+    // whether registration is open. Exempt from the gate (it's under /auth).
+    app.get("/auth/provider", (context) => context.json({
+        provider: identityConfig?.provider ?? null,
+        registration: identityConfig?.provider === "passkey"
+            ? (identityConfig.registration ?? "open")
+            : undefined,
+    }));
     // One persistent CDP socket for the daemon's lifetime — opened once at start
     // (below), so the user clears the browser's remote-debugging prompt a single
     // time rather than on every run. Skipped when a caller injects its own
@@ -1514,6 +1585,8 @@ export const createServer = async (options = {}) => {
     };
     const ctx = {
         registry,
+        resolveIdentity,
+        ownerFor,
         cdpClient,
         secretBackend,
         secretStore,
@@ -1541,6 +1614,7 @@ export const createServer = async (options = {}) => {
             url.searchParams.set(SESSION_ID_QUERY_PARAM, sessionId);
             return url.toString();
         },
+        mintViewerCookie,
     };
     const api = buildApiRoutes(ctx);
     app.route("/api", api);
@@ -1616,18 +1690,25 @@ export const createServer = async (options = {}) => {
         return {
             onOpen(_event, ws) {
                 activeWs = ws;
+                const remoteAddress = extractRemoteAddress(ws.raw);
                 if (!isLoopbackBind) {
-                    const remoteAddress = extractRemoteAddress(ws.raw);
                     if (remoteAddress && !isAllowedSourceIp(remoteAddress, host)) {
                         ws.close(WS_CLOSE_POLICY_VIOLATION, "source IP not allowed");
                         return;
                     }
                 }
+                // The partition key for this tab. The WS upgrade carries the same
+                // headers as an HTTP request, so `resolveIdentity` reads the
+                // provider's header here too — using the raw socket's source IP
+                // (more authoritative than conninfo at upgrade time) for the
+                // trusted-proxy check. `null` = operator tier (full access); a
+                // non-null value scopes attach + spawn to that user.
+                const owner = toSessionOwner(resolveIdentity(context, remoteAddress));
                 // Reattach if `?sid=` names a PTY the manager still has live (a
                 // transient drop, or a switch from the session picker). A miss
                 // (shell exited while dormant, killed, or reaped by the idle
                 // sweep) falls through to a fresh spawn.
-                const attached = requestedSid ? registry.attach(ws, requestedSid) : null;
+                const attached = requestedSid ? registry.attach(ws, requestedSid, owner) : null;
                 if (attached) {
                     managed = attached;
                     sessionId = attached.id;
@@ -1657,7 +1738,7 @@ export const createServer = async (options = {}) => {
                         cwd: sessionCwd,
                         initialCommand: claimedRun?.command ?? requestedInitialCommand,
                         env: claimedRun?.env,
-                    }, automation);
+                    }, automation, owner);
                     if (!spawned) {
                         ws.close(WS_CLOSE_CAPACITY_REACHED, "session capacity reached");
                         return;
@@ -1967,7 +2048,7 @@ export const createServer = async (options = {}) => {
 export { CaffeinateController } from "./caffeinate-controller.js";
 export { DEFAULT_HOST, DEFAULT_PORT, WS_CLOSE_BACKPRESSURE } from "./constants.js";
 export { isLoopbackHost, isPrivateHost, isAllowedSourceIp } from "./security.js";
-export { healthSchema, cdpHealthSchema, daemonConfigSchema, updateDaemonConfigInputSchema, } from "./schemas.js";
+export { healthSchema, cdpHealthSchema, daemonConfigSchema, identityConfigSchema, oidcConfigSchema, passkeyConfigSchema, updateDaemonConfigInputSchema, } from "./schemas.js";
 export { createSessionInputSchema, sessionResponseSchema, updateSessionInputSchema, sessionInputSchema, sessionResizeSchema, execInputSchema, execOneShotInputSchema, execResultSchema, capturePaneResponseSchema, sessionsListResponseSchema, } from "./schemas.js";
 export { createDefaultSecretBackend } from "./secret-backend.js";
 export { detectChromiumBrowsers } from "./cdp/detect-chromium.js";