@oar-sh/oar 0.9.9 → 0.9.11

package/server/services/preview-static-handler.mjs

@@ -72,11 +72,24 @@ export function isDeniedName(fileName) {
   return DENIED_NAME_RE.test(name);
 }
 
+// A path that is not there answers "no"; any other fs error (EACCES, EIO, too
+// many open files, …) may pass, so a caller that would delete something over
+// the answer can tell the two apart.
+const ABSENT_CODES = new Set(['ENOENT', 'ENOTDIR']);
+
+function refusal(error, cause) {
+  const code = toText(cause?.code);
+  return code && !ABSENT_CODES.has(code)
+    ? { ok: false, error: `${error} (${code})`, transient: true }
+    : { ok: false, error };
+}
+
 /**
  * Registration-time jail: resolve `dir` (absolute, or relative to the
  * workspace root), realpath it, and require it to live inside the workspace
  * root's realpath. Returns `{ ok, rootDir }` or `{ ok:false, error }` with a
- * message that names exactly what was refused.
+ * message that names exactly what was refused; `transient: true` marks a
+ * refusal over an fs error other than a missing path.
  */
 export function validateStaticRoot(dir, { workspaceRoot, fsImpl = fs, pathImpl = path } = {}) {
   const dirInput = toText(dir);
@@ -89,22 +102,22 @@ export function validateStaticRoot(dir, { workspaceRoot, fsImpl = fs, pathImpl =
   let workspaceReal;
   try {
     workspaceReal = fsImpl.realpathSync(pathImpl.resolve(workspaceInput));
-  } catch {
-    return { ok: false, error: `Workspace root does not exist: ${workspaceInput}` };
+  } catch (error) {
+    return refusal(`Workspace root does not exist: ${workspaceInput}`, error);
   }
 
   const resolved = pathImpl.resolve(workspaceReal, dirInput);
   let rootReal;
   try {
     rootReal = fsImpl.realpathSync(resolved);
-  } catch {
-    return { ok: false, error: `Directory not found: ${dirInput}` };
+  } catch (error) {
+    return refusal(`Directory not found: ${dirInput}`, error);
   }
   let stats;
   try {
     stats = fsImpl.statSync(rootReal);
-  } catch {
-    return { ok: false, error: `Directory not found: ${dirInput}` };
+  } catch (error) {
+    return refusal(`Directory not found: ${dirInput}`, error);
   }
   if (!stats.isDirectory()) {
     return { ok: false, error: `Not a directory: ${dirInput}` };
@@ -115,6 +128,26 @@ export function validateStaticRoot(dir, { workspaceRoot, fsImpl = fs, pathImpl =
   return { ok: true, rootDir: rootReal };
 }
 
+/**
+ * validateStaticRoot against several workspace roots: the first that accepts
+ * wins. A transient refusal from any root is returned as such, so the caller
+ * keeps what it would otherwise drop; else the first root's refusal.
+ */
+export function validateStaticRootInAny(dir, workspaceRoots = [], options = {}) {
+  const roots = [...new Set((Array.isArray(workspaceRoots) ? workspaceRoots : [workspaceRoots])
+    .map(toText).filter(Boolean))];
+  if (roots.length === 0) return validateStaticRoot(dir, { ...options, workspaceRoot: '' });
+  let first = null;
+  let transient = null;
+  for (const workspaceRoot of roots) {
+    const checked = validateStaticRoot(dir, { ...options, workspaceRoot });
+    if (checked.ok) return checked;
+    if (checked.transient && !transient) transient = checked;
+    if (!first) first = checked;
+  }
+  return transient || first;
+}
+
 /**
  * Request-time resolution inside a registered root. Returns one of:
  *  { kind:'file', filePath, contentType, size }

package/server/services/preview-store.mjs

@@ -0,0 +1,274 @@
+'use strict';
+
+import childProcess from 'child_process';
+import fs from 'fs';
+import os from 'os';
+
+import { previewsTableProblem } from '../migrations/0013-previews.mjs';
+
+// Persistence for the preview registry: the `previews` table (migration 0013)
+// behind a small store, so the registry can restore its links after a
+// restart and stays testable with a plain in-memory store.
+//
+// Also the host boot id, which decides whether a port preview may come back:
+// only within the boot it was registered in.
+//
+// Both are exported for a one-off carry-over script as well: open the relay's
+// database, `createSqlitePreviewStore(db).insert({ ...preview, hostBootId:
+// readHostBootId() })` for every preview from `GET /api/previews`, and the next
+// runtime restores them.
+
+const PREVIEW_MODES = new Set(['port', 'static']);
+const TOKEN_RE = /^[0-9a-f]{32}$/;
+
+function toText(value) {
+  return String(value ?? '').trim();
+}
+
+function toEpochMs(value) {
+  if (value === null || value === undefined || value === '') return null;
+  const num = typeof value === 'number' ? value : Number(value);
+  if (Number.isFinite(num)) return Math.trunc(num);
+  const parsed = Date.parse(String(value));
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+function toPort(value) {
+  const num = Number(value);
+  return Number.isInteger(num) && num > 0 && num <= 65535 ? num : null;
+}
+
+/**
+ * A registry record (the shape `GET /api/previews` lists, plus `hostBootId`)
+ * as a row. Returns null for a record no restore could use, a token not in
+ * its canonical form (32 lower-case hex) included.
+ */
+export function previewRecordToRow(record = {}) {
+  const token = typeof record.token === 'string' ? record.token : '';
+  const mode = toText(record.mode);
+  if (!TOKEN_RE.test(token) || !PREVIEW_MODES.has(mode)) return null;
+  const createdAt = toEpochMs(record.createdAt);
+  return {
+    token,
+    mode,
+    conversation_id: toText(record.conversationId) || null,
+    label: toText(record.label).slice(0, 120) || (mode === 'static' ? 'static preview' : 'preview'),
+    target_host: mode === 'port' ? (toText(record.targetHost) || null) : null,
+    target_port: mode === 'port' ? toPort(record.targetPort) : null,
+    root_dir: mode === 'static' ? (toText(record.rootDir) || null) : null,
+    created_at: createdAt ?? Date.now(),
+    last_hit_at: toEpochMs(record.lastHitAt),
+    host_boot_id: toText(record.hostBootId) || null,
+  };
+}
+
+// The token as stored, not normalised: a row the relay did not write itself
+// may hold one in another form, and only the stored value deletes it.
+export function previewRowToRecord(row = {}) {
+  return {
+    token: String(row.token ?? ''),
+    mode: toText(row.mode),
+    conversationId: toText(row.conversation_id) || null,
+    label: toText(row.label),
+    targetHost: toText(row.target_host) || null,
+    targetPort: toPort(row.target_port),
+    rootDir: toText(row.root_dir) || null,
+    createdAt: toEpochMs(row.created_at),
+    lastHitAt: toEpochMs(row.last_hit_at),
+    hostBootId: toText(row.host_boot_id) || null,
+  };
+}
+
+function unavailableStore(reason) {
+  return {
+    available: false,
+    reason,
+    list: () => [],
+    insert: () => false,
+    remove: () => false,
+    removeForConversation: () => 0,
+    touch: () => false,
+    withBusyTimeout: (_ms, run) => run(),
+  };
+}
+
+/**
+ * The store on the relay's database. Without a usable table (migration 0013
+ * failed and is retried next boot, or a `previews` table of other columns)
+ * every call is a no-op and the registry keeps its previews in memory only,
+ * as before. A table that is there but unusable is logged once; it never
+ * stops the relay.
+ */
+export function createSqlitePreviewStore(db, { logger = console } = {}) {
+  let hasTable = false;
+  try {
+    hasTable = !!db
+      ?.prepare?.(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'previews'`)
+      .get();
+  } catch {}
+  if (!hasTable) return unavailableStore('no previews table');
+  let stmts;
+  try {
+    const problem = previewsTableProblem(db);
+    if (problem) throw new Error(problem);
+    stmts = createStatements(db);
+  } catch (error) {
+    const reason = error?.message || String(error);
+    logger?.warn?.(`[preview] previews are not persisted: ${reason}`);
+    return unavailableStore(reason);
+  }
+  return {
+    available: true,
+    list: () => stmts.list.all().map(previewRowToRecord),
+    insert(record) {
+      const row = previewRecordToRow(record);
+      if (!row) return false;
+      stmts.insert.run(row);
+      return true;
+    },
+    remove: (token) => stmts.remove.run(String(token ?? '')).changes > 0,
+    // `exceptTokens`: rows to leave, for a delete that is carried out late and
+    // must not take a preview registered since.
+    removeForConversation(conversationId, { exceptTokens = [] } = {}) {
+      if (exceptTokens.length === 0) return stmts.removeForConversation.run(toText(conversationId)).changes;
+      return stmts.removeForConversationExcept
+        .run(toText(conversationId), JSON.stringify(exceptTokens.map(String))).changes;
+    },
+    touch: (token, at) => stmts.touch.run(toEpochMs(at), toText(token)).changes > 0,
+    // Runs `run` with another wait on a locked database, then puts the
+    // connection's own back.
+    withBusyTimeout(ms, run) {
+      let previous = null;
+      try {
+        previous = Number(db.pragma('busy_timeout', { simple: true }));
+        db.pragma(`busy_timeout = ${Math.max(0, Math.trunc(Number(ms) || 0))}`);
+      } catch {}
+      try {
+        return run();
+      } finally {
+        if (Number.isFinite(previous)) {
+          try { db.pragma(`busy_timeout = ${previous}`); } catch {}
+        }
+      }
+    },
+  };
+}
+
+function createStatements(db) {
+  return {
+    list: db.prepare(`SELECT * FROM previews ORDER BY created_at ASC, token ASC`),
+    insert: db.prepare(`
+      INSERT OR REPLACE INTO previews (
+        token, mode, conversation_id, label, target_host, target_port, root_dir,
+        created_at, last_hit_at, host_boot_id
+      ) VALUES (
+        @token, @mode, @conversation_id, @label, @target_host, @target_port, @root_dir,
+        @created_at, @last_hit_at, @host_boot_id
+      )
+    `),
+    remove: db.prepare(`DELETE FROM previews WHERE token = ?`),
+    removeForConversation: db.prepare(`DELETE FROM previews WHERE conversation_id = ?`),
+    removeForConversationExcept: db.prepare(`
+      DELETE FROM previews
+      WHERE conversation_id = ? AND token NOT IN (SELECT value FROM json_each(?))
+    `),
+    touch: db.prepare(`UPDATE previews SET last_hit_at = ? WHERE token = ?`),
+  };
+}
+
+/** Same calls, kept in a Map: for tests and for a relay without a database. */
+export function createMemoryPreviewStore(initialRecords = []) {
+  const rows = new Map();
+  const store = {
+    available: true,
+    rows,
+    list: () => [...rows.values()]
+      .sort((a, b) => (a.created_at - b.created_at) || a.token.localeCompare(b.token))
+      .map(previewRowToRecord),
+    insert(record) {
+      const row = previewRecordToRow(record);
+      if (!row) return false;
+      rows.set(row.token, row);
+      return true;
+    },
+    remove: (token) => rows.delete(String(token ?? '')),
+    removeForConversation(conversationId, { exceptTokens = [] } = {}) {
+      const id = toText(conversationId);
+      let removed = 0;
+      for (const [token, row] of rows) {
+        if (row.conversation_id !== id || exceptTokens.includes(token)) continue;
+        rows.delete(token);
+        removed += 1;
+      }
+      return removed;
+    },
+    touch(token, at) {
+      const row = rows.get(toText(token));
+      if (!row) return false;
+      row.last_hit_at = toEpochMs(at);
+      return true;
+    },
+  };
+  for (const record of initialRecords) store.insert(record);
+  return store;
+}
+
+// ─── Host boot id ────────────────────────────────────────────────────────────
+//
+// An opaque string that changes when the host boots again:
+// - Linux: the kernel's random boot id (/proc/sys/kernel/random/boot_id).
+// - macOS: `sysctl -n kern.bootsessionuuid`, a UUID minted per boot.
+// - Anything else (Windows) or a failed read: the boot time, derived from the
+//   uptime, as `boot-time:<epoch seconds>`. That form is compared with a
+//   tolerance, because it moves a little with clock adjustments. On Windows
+//   "fast startup" a shutdown hibernates the kernel and keeps the uptime, so
+//   such a shutdown and power-on counts as the same boot there.
+// An empty id never matches anything, so port previews are then not restored.
+
+const BOOT_TIME_PREFIX = 'boot-time:';
+const BOOT_TIME_TOLERANCE_S = 120;
+
+export function readHostBootId({
+  platform = process.platform,
+  readFileSync = fs.readFileSync,
+  execFileSync = childProcess.execFileSync,
+  uptime = os.uptime,
+  now = Date.now,
+} = {}) {
+  if (platform === 'linux') {
+    try {
+      const id = toText(readFileSync('/proc/sys/kernel/random/boot_id', 'utf8'));
+      if (id) return `linux:${id}`;
+    } catch {}
+  }
+  if (platform === 'darwin') {
+    try {
+      const id = toText(execFileSync('sysctl', ['-n', 'kern.bootsessionuuid'], {
+        encoding: 'utf8',
+        timeout: 2000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }));
+      if (id) return `darwin:${id}`;
+    } catch {}
+  }
+  try {
+    const seconds = Number(uptime());
+    if (Number.isFinite(seconds) && seconds >= 0) {
+      return `${BOOT_TIME_PREFIX}${Math.round(now() / 1000 - seconds)}`;
+    }
+  } catch {}
+  return '';
+}
+
+export function isSameHostBoot(storedId, currentId) {
+  const stored = toText(storedId);
+  const current = toText(currentId);
+  if (!stored || !current) return false;
+  if (stored === current) return true;
+  if (stored.startsWith(BOOT_TIME_PREFIX) && current.startsWith(BOOT_TIME_PREFIX)) {
+    const a = Number(stored.slice(BOOT_TIME_PREFIX.length));
+    const b = Number(current.slice(BOOT_TIME_PREFIX.length));
+    return Number.isFinite(a) && Number.isFinite(b) && Math.abs(a - b) <= BOOT_TIME_TOLERANCE_S;
+  }
+  return false;
+}

package/server/services/push-dispatch-service.mjs

@@ -324,6 +324,22 @@ export function createPushDispatchService({
     }
   }
 
+  // A turn that answers relay events (its message is the relay's event row,
+  // kind 'relay-event') pushes no "reply ready" or "failed" either: the
+  // watcher answers events many times an hour and pushes by itself when one
+  // matters. Question pushes are unchanged.
+  let messageKindStatement = null;
+  function turnAnswersRelayEvents(sourceMessageId) {
+    const id = String(sourceMessageId || '').trim();
+    if (!id) return false;
+    try {
+      messageKindStatement ??= db.prepare(`SELECT kind FROM messages WHERE id = ?`);
+      return String(messageKindStatement.get(id)?.kind || '').trim() === 'relay-event';
+    } catch {
+      return false;
+    }
+  }
+
   async function sendToSubscription(row, event) {
     const preferences = normalizePushPreferences(parseJsonObject(row.preferences_json));
     const payload = renderPushNotification(event, preferences);
@@ -440,6 +456,7 @@ export function createPushDispatchService({
   // the turn.
   function notifyTurnComplete({ conversationId, messageId, sourceMessageId, text } = {}) {
     if (turnStartedByRemoteAgent(sourceMessageId)) return Promise.resolve({ outcome: 'remote-agent' });
+    if (turnAnswersRelayEvents(sourceMessageId)) return Promise.resolve({ outcome: 'relay-event' });
     return dispatch({
       type: 'turnComplete',
       conversationId: conversationId || null,
@@ -450,6 +467,7 @@ export function createPushDispatchService({
 
   function notifyTurnFailed({ conversationId, messageId, sourceMessageId, text } = {}) {
     if (turnStartedByRemoteAgent(sourceMessageId)) return Promise.resolve({ outcome: 'remote-agent' });
+    if (turnAnswersRelayEvents(sourceMessageId)) return Promise.resolve({ outcome: 'relay-event' });
     return dispatch({
       type: 'turnFailed',
       conversationId: conversationId || null,

package/server/services/rate-limit-service.mjs

@@ -59,5 +59,16 @@ export function createFixedWindowRateLimiter({
     return { ok: true, retryAfterSeconds: 0 };
   }
 
-  return { consume, prune, size: () => buckets.size };
+  // Whether consume() would refuse now, without counting a hit.
+  function peek(key, reference = nowMs()) {
+    const bucket = buckets.get(String(key || '').trim());
+    if (!bucket || !Number.isFinite(bucket.windowStartAt) || (reference - bucket.windowStartAt) >= windowMs) {
+      return { ok: true, retryAfterSeconds: 0 };
+    }
+    if (bucket.count < limit) return { ok: true, retryAfterSeconds: 0 };
+    const retryAfterMs = Math.max(250, windowMs - (reference - bucket.windowStartAt));
+    return { ok: false, retryAfterSeconds: Math.max(1, Math.ceil(retryAfterMs / 1000)) };
+  }
+
+  return { consume, peek, prune, size: () => buckets.size };
 }

package/server/services/relay-auth.mjs

@@ -0,0 +1,183 @@
+'use strict';
+
+import crypto from 'node:crypto';
+
+import { createFixedWindowRateLimiter } from './rate-limit-service.mjs';
+import { createLocalRequestCheck, expressRequestView } from './request-boundary.mjs';
+
+// The relay's token check for the API (`auth`) and the Socket.IO handshake.
+//
+// The token is read from the Authorization header or the HttpOnly cookie,
+// nothing else. A `?token=` in the page address is the app's sign-in link:
+// the page (bootstrap.js) takes it out of the address and exchanges it once
+// for the cookie with a Bearer request; no API route accepts it, so the token
+// does not sit in API or asset URLs, logs and the browser history.
+//
+// Wrong tokens are counted per client address (Express `req.ip`, which
+// follows `trust proxy`): after AUTH_FAILURE_LIMIT failures in one window,
+// every request from that address is answered 429 with Retry-After until the
+// window ends, the right token included, so guessing does not go on behind
+// the 429s. Truly local requests (request-boundary.mjs) are never counted or
+// refused: the relay's own workers and agent tools must not be locked out.
+
+export const AUTH_FAILURE_LIMIT = 10;
+export const AUTH_FAILURE_WINDOW_MS = 60_000;
+const AUTH_FAILURE_MAX_CLIENTS = 4_096;
+
+/**
+ * Constant-time comparison so the token cannot be recovered through response
+ * timing. The token length is fixed (a UUID), so the length short-circuit
+ * leaks nothing secret; any empty or missing value is a non-match.
+ */
+export function tokensMatch(presented, expected) {
+  const a = Buffer.from(String(presented || ''), 'utf8');
+  const b = Buffer.from(String(expected || ''), 'utf8');
+  if (a.length === 0 || b.length === 0 || a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+
+function normalizeClientKey(value) {
+  const text = String(value || '').trim();
+  const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(text);
+  return (mapped ? mapped[1] : text).slice(0, 128);
+}
+
+/**
+ * Fixed-window count of wrong tokens per client. A browser tab that still
+ * holds an old cookie repeats the same wrong value on every request; one
+ * value counts once per window, so only distinct guesses add up.
+ */
+export function createAuthFailureLockout({
+  limit = AUTH_FAILURE_LIMIT,
+  windowMs = AUTH_FAILURE_WINDOW_MS,
+  maxClients = AUTH_FAILURE_MAX_CLIENTS,
+  nowMs = Date.now,
+} = {}) {
+  const failures = createFixedWindowRateLimiter({ windowMs, limit, bucketTtlMs: windowMs, maxBuckets: maxClients, nowMs });
+  // Evicting a fingerprint early only makes that value count again.
+  const counted = createFixedWindowRateLimiter({ windowMs, limit: 1, bucketTtlMs: windowMs, maxBuckets: maxClients, nowMs });
+
+  function check(clientKey) {
+    const key = normalizeClientKey(clientKey);
+    if (!key) return { ok: true, retryAfterSeconds: 0 };
+    return failures.peek(key);
+  }
+
+  function recordFailure(clientKey, presentedToken) {
+    const key = normalizeClientKey(clientKey);
+    if (!key) return { ok: true, retryAfterSeconds: 0 };
+    const fingerprint = crypto.createHash('sha256').update(String(presentedToken || '')).digest('hex').slice(0, 24);
+    if (counted.consume(`${key}\n${fingerprint}`).ok) failures.consume(key);
+    return failures.peek(key);
+  }
+
+  return { check, recordFailure, size: () => failures.size() };
+}
+
+export function createRelayAuth({
+  app,
+  getAuthToken,
+  cookieName,
+  cookiePath = '/',
+  parseCookies,
+  appendSetCookie,
+  localRequestCheck = createLocalRequestCheck(),
+  lockout = createAuthFailureLockout(),
+  logger = console,
+} = {}) {
+  function bearerToken(headers) {
+    return String(headers?.authorization || '').replace(/^Bearer\s+/i, '');
+  }
+
+  function lockedPayload(retryAfterSeconds) {
+    return {
+      error: `Too many failed sign-in attempts. Try again in ${retryAfterSeconds} s.`,
+      retryAfterSeconds,
+    };
+  }
+
+  function noteLocked(clientKey, state, via) {
+    logger?.warn?.(`[auth] ${via} from ${clientKey} refused: too many wrong tokens (retry after ${state.retryAfterSeconds} s)`);
+  }
+
+  // The lockout key of a request; null for a truly local one (exempt).
+  function lockoutKeyOf(req) {
+    if (localRequestCheck.isTrulyLocal(req)) return null;
+    return normalizeClientKey(req?.ip || req?.socket?.remoteAddress) || 'unknown';
+  }
+
+  function auth(req, res, next) {
+    const lockoutKey = lockoutKeyOf(req);
+    if (lockoutKey) {
+      const state = lockout.check(lockoutKey);
+      if (!state.ok) {
+        res.setHeader('Retry-After', String(state.retryAfterSeconds));
+        res.status(429).json(lockedPayload(state.retryAfterSeconds));
+        return;
+      }
+    }
+    const expected = getAuthToken();
+    const cookies = parseCookies(req.headers.cookie);
+    // req.secure is derived through the configured `trust proxy` boundary, so a
+    // direct (untrusted) client cannot force a non-Secure cookie by omitting
+    // X-Forwarded-Proto.
+    const secureAttr = req.secure ? '; Secure' : '';
+    // The token is intentionally NOT read from req.body (an easy CSRF/logging
+    // vector) nor from the query string (see the top of this file).
+    const token = bearerToken(req.headers) || cookies[cookieName];
+    if (tokensMatch(token, expected)) {
+      if (res && !tokensMatch(cookies[cookieName], expected)) {
+        appendSetCookie(res, `${cookieName}=${encodeURIComponent(expected)}; Path=${cookiePath}; Max-Age=2592000; SameSite=Lax; HttpOnly${secureAttr}`);
+      }
+      next();
+      return;
+    }
+    if (lockoutKey && token) {
+      const state = lockout.recordFailure(lockoutKey, token);
+      if (!state.ok) noteLocked(lockoutKey, state, `${req.method || 'request'} ${req.path || req.url || ''}`.trim());
+    }
+    if (res && cookies[cookieName]) {
+      appendSetCookie(res, `${cookieName}=; Path=${cookiePath}; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; SameSite=Lax; HttpOnly${secureAttr}`);
+    }
+    res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  /** The token a Socket.IO handshake presents: `auth.token`, else the cookie. */
+  function socketAuthToken(socket) {
+    const cookies = parseCookies(socket?.request?.headers?.cookie);
+    return socket?.handshake?.auth?.token || cookies[cookieName];
+  }
+
+  function socketTokenValid(socket) {
+    return tokensMatch(socketAuthToken(socket), getAuthToken());
+  }
+
+  // io.use() middleware.
+  function socketMiddleware(socket, next) {
+    const rawReq = socket?.request;
+    const lockoutKey = localRequestCheck.isTrulyLocal(rawReq)
+      ? null
+      : normalizeClientKey(expressRequestView(app, rawReq).ip || rawReq?.socket?.remoteAddress) || 'unknown';
+    if (lockoutKey) {
+      const state = lockout.check(lockoutKey);
+      if (!state.ok) {
+        const error = new Error('Too many failed sign-in attempts');
+        error.data = { retryAfterSeconds: state.retryAfterSeconds };
+        next(error);
+        return;
+      }
+    }
+    if (socketTokenValid(socket)) {
+      next();
+      return;
+    }
+    const token = socketAuthToken(socket);
+    if (lockoutKey && token) {
+      const state = lockout.recordFailure(lockoutKey, token);
+      if (!state.ok) noteLocked(lockoutKey, state, 'socket handshake');
+    }
+    next(new Error('Unauthorized'));
+  }
+
+  return { auth, socketMiddleware, socketAuthToken, socketTokenValid, lockout };
+}

package/server/services/relay-cli-launcher-service.mjs

@@ -3,6 +3,7 @@
 import { execFileSync, spawn } from 'child_process';
 import { createSessionWorkerProcessInspector } from './session-worker-process-service.mjs';
 import { launchSessionCli } from './session-worker-launch-service.mjs';
+import { windowsSystemToolPath } from '../../shared/windows-system-tools.mjs';
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -79,7 +80,7 @@ export function createRelayCliLauncherService({
       '  try { Stop-Process -Id $id -Force -ErrorAction SilentlyContinue } catch {}',
       '}',
     ].join('; ');
-    execFileSyncImpl('powershell.exe', ['-NoProfile', '-Command', script], {
+    execFileSyncImpl(windowsSystemToolPath('powershell.exe'), ['-NoProfile', '-Command', script], {
       stdio: ['ignore', 'ignore', 'ignore'],
     });
     return ids;
@@ -117,6 +118,7 @@ export function createRelayCliLauncherService({
       spawnImpl,
       execFileSyncImpl,
       processInspector,
+      log,
     });
     return launched;
   }