@phnx-labs/agents-cli 1.22.47 → 1.22.50

package/dist/lib/share/worker-template.js

@@ -1,13 +1,31 @@
 // The Cloudflare Worker that fronts the R2 share bucket.
 //
 // One tiny Worker does both sides:
-//   - PUT  /<username>/<slug>  — bearer-gated (WRITE_TOKEN secret); writes the body
-//     to R2 via the BUCKET binding, storing an optional expires-at value plus
-//     provenance (agent/session/host/repo/date), a label, and any `--meta`
-//     entries in object metadata. Overwriting an existing slug first copies the
-//     current object to <slug>/rev-<ts>-<rand> (revision history) unless
+//   - PUT  /<username>/<slug>  — bearer-gated by TWO principals (not a fallback):
+//       1. Static WRITE_TOKEN (BYO Cloudflare) — checked first when the presented
+//          bearer equals env.WRITE_TOKEN. owner = env.SHARE_NAMESPACE or the
+//          path's first segment.
+//       2. Phoenix bearer — otherwise GET ${env.PHOENIX_ID_BASE}/api/v1/auth/me
+//          with that bearer → {userId,email}; 401 if absent/invalid.
+//          customMetadata.owner = userId (stable). The path's first segment MUST
+//          equal handleFromEmail(email) (the public handle, e.g. muqsitnawaz),
+//          so one user cannot write another's prefix (403 namespace mismatch).
+//          A __handles/<handle> claim binds the handle to the first userId that
+//          writes it; a different userId gets 409 handle taken.
+//     A managed deployment sets PHOENIX_ID_BASE; BYO sets WRITE_TOKEN; the
+//     platform endpoint may set both. Fail loud (401) when neither authenticates.
+//     Writes the body to R2 via the BUCKET binding, storing visibility
+//     (public|unlisted|me|org), owner, org_domain (org only), an optional
+//     expires-at, plus provenance (agent/session/host/repo/date), a label, and
+//     any `--meta` entries in object metadata. me/org require a Phoenix
+//     identity (BYO WRITE_TOKEN cannot publish them). org from a public inbox
+//     domain is 400. Overwriting an existing slug first copies the current
+//     object to <slug>/rev-<ts>-<rand> (revision history) unless
 //     x-share-no-revision is set.
-//   - GET  /<username>/<slug>  — public; streams the object from R2, 410s (and lazily
+//   - GET  /<username>/<slug>  — public|unlisted are anonymous; me requires the
+//     Phoenix owner, org requires a same-domain Phoenix identity (Bearer, then
+//     HMAC cookie, then phoenix_ticket). Unauthenticated me/org 302s to
+//     Phoenix login (or 401 JSON if PHOENIX_ID_BASE is unset). 410s (and lazily
 //     deletes) once its expiry has passed. A bucket lifecycle rule is the durable
 //     sweeper; this is the immediate gate.
 //   - GET  /<username>/<slug>?revisions=json — machine-readable history of the
@@ -39,6 +57,10 @@
 export function renderWorkerScript() {
     return `// GENERATED by agents-cli agents share setup — do not edit here; edit
 // src/lib/share/worker-template.ts and re-run setup.
+export const hooks = {
+  verifyPhoenixToken: defaultVerifyPhoenixToken,
+};
+
 export default {
   async fetch(request, env) {
     const url = new URL(request.url);
@@ -50,15 +72,44 @@ export default {
       });
     }
 
+    const firstSeg = path.split('/').filter(Boolean)[0] || '';
+    if ((request.method === 'GET' || request.method === 'HEAD') && firstSeg.startsWith('__')) {
+      return new Response('not found', { status: 404, headers: { 'content-type': 'text/plain' } });
+    }
+
     if (request.method === 'PUT') {
-      const presented = (request.headers.get('authorization') || '').replace(/^Bearer\\s+/i, '');
-      if (!env.WRITE_TOKEN || !safeEqual(presented, env.WRITE_TOKEN)) {
-        return json({ error: 'unauthorized' }, 401);
+      const auth = await authorizeWrite(request, env);
+      if (auth.error) return auth.error;
+      const vis = normalizeVisibility(request.headers.get('x-share-visibility'));
+      if (vis.error) return vis.error;
+      const visibility = vis.value;
+      if (visibility === 'me' || visibility === 'org') {
+        const phoenixBase = typeof env.PHOENIX_ID_BASE === 'string' ? env.PHOENIX_ID_BASE.replace(/\\/+$/, '') : '';
+        if (auth.kind !== 'phoenix' || !phoenixBase) {
+          return json({ error: 'visibility me/org requires Phoenix identity' }, 400);
+        }
+        if (visibility === 'org') {
+          const domain = emailDomain(auth.email);
+          if (!domain) return json({ error: 'org visibility requires a verified email domain' }, 400);
+          if (PUBLIC_INBOX_DOMAINS.indexOf(domain) !== -1) {
+            return json({ error: 'org visibility cannot use a public email domain', domain: domain }, 400);
+          }
+        }
+      }
+      const segments = path.split('/').filter(Boolean);
+      if (auth.kind === 'phoenix') {
+        const expected = phoenixHandle(auth);
+        if (!expected || segments[0] !== expected) {
+          return json({ error: 'namespace mismatch', owner: expected }, 403);
+        }
+        const claimed = await claimHandle(env.BUCKET, expected, auth.owner);
+        if (claimed.error) return claimed.error;
       }
       const expiresAt = request.headers.get('x-share-expires-at') || '';
       // 'unlisted' hides the page from the public gallery + JSON listing while
       // keeping the direct URL world-readable (capability URL, not secret).
-      const visibility = (request.headers.get('x-share-visibility') || '').toLowerCase();
+      // me/org are also hidden from gallery/listing; GET is identity-gated
+      // and always sends X-Robots-Tag: noindex (same as unlisted).
       const contentType = request.headers.get('content-type') || 'text/html; charset=utf-8';
       // Provenance (RUSH-2683): captured client-side from the exec env/git/clock,
       // never invented here — a header is simply absent when the CLI had nothing
@@ -93,7 +144,13 @@ export default {
         delete customMetadata[reservedKey];
       }
       if (expiresAt) customMetadata['expires-at'] = expiresAt;
-      if (visibility === 'unlisted') customMetadata['visibility'] = 'unlisted';
+      customMetadata['visibility'] = visibility;
+      const owner =
+        auth.kind === 'phoenix'
+          ? auth.owner
+          : (env.SHARE_NAMESPACE || segments[0] || 'byo');
+      if (owner) customMetadata['owner'] = owner;
+      if (visibility === 'org') customMetadata['org_domain'] = emailDomain(auth.email);
       if (agent) customMetadata['agent'] = agent;
       if (session) customMetadata['session'] = session;
       if (host) customMetadata['host'] = host;
@@ -129,7 +186,7 @@ export default {
         httpMetadata: { contentType },
         customMetadata,
       });
-      return json({ ok: true, url: url.origin + '/' + path, expiresAt: expiresAt || null, unlisted: visibility === 'unlisted' }, 200);
+      return json({ ok: true, url: url.origin + '/' + path, expiresAt: expiresAt || null, unlisted: visibility === 'unlisted', visibility }, 200);
     }
 
     if (request.method === 'GET' || request.method === 'HEAD') {
@@ -157,9 +214,22 @@ export default {
 
       // Revision history for one canonical <user>/<slug> key (RUSH-2683). Checked
       // before the plain object GET below so the query param routes even though
-      // the canonical key itself resolves to a real object.
+      // the canonical key itself resolves to a real object. me/org use the same
+      // identity gate as the page GET — listing session/host/repo on an unauthed
+      // ?revisions=json must not leak that the page exists.
       if (segments.length === 2 && url.searchParams.get('revisions') === 'json') {
-        return renderRevisions(env.BUCKET, url.origin, path, request.method);
+        const canonical = await env.BUCKET.get(path);
+        if (canonical) {
+          const denied = await gateRestrictedGet(request, env, url, canonical);
+          if (denied) return denied;
+        }
+        return renderRevisions(
+          env.BUCKET,
+          url.origin,
+          path,
+          request.method,
+          canonical && isIdentityGated((canonical.customMetadata && canonical.customMetadata.visibility) || 'public'),
+        );
       }
 
       const obj = await env.BUCKET.get(path);
@@ -169,17 +239,43 @@ export default {
         await env.BUCKET.delete(path);
         return new Response('gone — this link has expired', { status: 410, headers: { 'content-type': 'text/plain' } });
       }
+      const denied = await gateRestrictedGet(request, env, url, obj);
+      if (denied) return denied;
+      const visibility = (obj.customMetadata && obj.customMetadata.visibility) || 'public';
       const headers = new Headers();
       obj.writeHttpMetadata(headers);
       headers.set('etag', obj.httpEtag);
       if (!headers.has('content-type')) headers.set('content-type', 'text/html; charset=utf-8');
-      headers.set('cache-control', 'public, max-age=60');
+      if (visibility === 'me' || visibility === 'org') {
+        headers.set('cache-control', 'private, no-store');
+        headers.set('X-Robots-Tag', 'noindex');
+      } else {
+        headers.set('cache-control', 'public, max-age=60');
+        if (visibility === 'unlisted') headers.set('X-Robots-Tag', 'noindex');
+      }
       return new Response(request.method === 'HEAD' ? null : obj.body, { status: 200, headers });
     }
 
     if (request.method === 'DELETE') {
-      const presented = (request.headers.get('authorization') || '').replace(/^Bearer\\s+/i, '');
-      if (!env.WRITE_TOKEN || !safeEqual(presented, env.WRITE_TOKEN)) return json({ error: 'unauthorized' }, 401);
+      const auth = await authorizeWrite(request, env);
+      if (auth.error) return auth.error;
+      if (auth.kind === 'phoenix') {
+        const handle = phoenixHandle(auth);
+        const uid = sanitizeNamespace(auth.owner);
+        const delSegments = path.split('/').filter(Boolean);
+        // Handle is the public namespace; userId prefix is still deletable so
+        // P1 UUID-namespaced objects the same account published can be taken down.
+        // A colliding local-part (same handle, different userId) must not be
+        // able to DELETE the claimant's pages — consult the claim the same way PUT does.
+        if (delSegments[0] && delSegments[0] === uid) {
+          // own leftover UUID prefix
+        } else if (delSegments[0] && delSegments[0] === handle) {
+          const owned = await assertHandleOwner(env.BUCKET, handle, auth.owner);
+          if (owned.error) return owned.error;
+        } else {
+          return json({ error: 'namespace mismatch', owner: handle || uid }, 403);
+        }
+      }
       await env.BUCKET.delete(path);
       return json({ ok: true, deleted: path }, 200);
     }
@@ -210,8 +306,8 @@ async function renderGallery(bucket, origin, user, method) {
   const activeObjects = objects.filter(o => {
     if (isRevisionKey(o.key)) return false;
     if (o.key.endsWith('.png')) return false;
-    // Unlisted pages are reachable by direct URL only — never on the gallery.
-    if (o.customMetadata && o.customMetadata.visibility === 'unlisted') return false;
+    // Unlisted / me / org pages are reachable by direct URL only — never on the gallery.
+    if (isHiddenFromGallery(o.customMetadata && o.customMetadata.visibility)) return false;
     const expiresAt = o.customMetadata && o.customMetadata['expires-at'];
     return !(expiresAt && Date.now() > Date.parse(expiresAt));
   });
@@ -273,10 +369,10 @@ async function renderListing(bucket, origin, user, method) {
   const items = objects
     .filter(o => {
       // Mirror the gallery: hide revisions, sibling .png OG covers, expired
-      // pages, and unlisted pages — the listing is the machine-readable public surface.
+      // pages, and unlisted/me/org pages — the listing is the machine-readable public surface.
       if (isRevisionKey(o.key)) return false;
       if (o.key.endsWith('.png')) return false;
-      if (o.customMetadata && o.customMetadata.visibility === 'unlisted') return false;
+      if (isHiddenFromGallery(o.customMetadata && o.customMetadata.visibility)) return false;
       const expiresAt = o.customMetadata && o.customMetadata['expires-at'];
       return !(expiresAt && now > Date.parse(expiresAt));
     })
@@ -307,7 +403,7 @@ async function renderListing(bucket, origin, user, method) {
   });
 }
 
-async function renderRevisions(bucket, origin, key, method) {
+async function renderRevisions(bucket, origin, key, method, identityGated) {
   const objects = [];
   let cursor;
   do {
@@ -333,12 +429,15 @@ async function renderRevisions(bucket, origin, key, method) {
   // Newest first — the most recently replaced version leads.
   items.sort((a, b) => (a.uploadedAt < b.uploadedAt ? 1 : a.uploadedAt > b.uploadedAt ? -1 : 0));
 
+  const cacheHeaders = identityGated
+    ? { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-store', 'X-Robots-Tag': 'noindex' }
+    : { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'public, max-age=30' };
   if (method === 'HEAD') {
-    return new Response(null, { status: 200, headers: { 'content-type': 'application/json; charset=utf-8' } });
+    return new Response(null, { status: 200, headers: cacheHeaders });
   }
   return new Response(JSON.stringify({ key, count: items.length, revisions: items }), {
     status: 200,
-    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'public, max-age=30' },
+    headers: cacheHeaders,
   });
 }
 
@@ -347,7 +446,10 @@ async function renderRevisions(bucket, origin, key, method) {
 // before it ever reaches this Worker; see RESERVED_META_KEYS in publish.ts).
 // One list, reused both to strip a same-named --meta collision on write and
 // to split arbitrary --meta entries back out on read.
-var RESERVED_METADATA_KEYS = ['expires-at', 'visibility', 'agent', 'session', 'host', 'repo', 'date', 'label', 'label-source'];
+var RESERVED_METADATA_KEYS = ['expires-at', 'visibility', 'owner', 'org_domain', 'agent', 'session', 'host', 'repo', 'date', 'label', 'label-source'];
+var PUBLIC_INBOX_DOMAINS = ['gmail.com', 'googlemail.com', 'outlook.com', 'hotmail.com', 'live.com', 'icloud.com', 'me.com'];
+var SHARE_COOKIE = '__Host-phoenix_share';
+var SHARE_COOKIE_MAX_AGE = 604800;
 
 // Everything in customMetadata that ISN'T one of the reserved provenance/label
 // keys above — i.e. the caller's own \`--meta key=value\` entries. Surfaced on
@@ -383,5 +485,280 @@ function safeEqual(a, b) {
   for (let i = 0; i < la; i++) out |= a.charCodeAt(i) ^ b.charCodeAt(i % lb || 0);
   return out === 0 && la === lb;
 }
+
+// URL-safety, not collision-resistance. Two values that differ only in
+// case/punctuation share a prefix.
+function sanitizeNamespace(s) {
+  return String(s || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+
+// Public handle: email local-part, plus-tag stripped. Must match CLI handleFromEmail.
+function handleFromEmail(email) {
+  if (!email) return '';
+  const local = String(email).split('@')[0] || '';
+  const beforePlus = local.split('+')[0] || local;
+  return sanitizeNamespace(beforePlus);
+}
+
+function phoenixHandle(auth) {
+  return handleFromEmail(auth.email) || sanitizeNamespace(auth.owner);
+}
+
+// First writer of a handle owns it. Later PUTs from the same userId are fine;
+// a different userId whose email local-part collides gets 409, not a silent overwrite.
+async function assertHandleOwner(bucket, handle, userId) {
+  // Pages under the handle already stamp customMetadata.owner = userId.
+  // Treat that as the source of truth so a colliding local-part cannot
+  // PUT/DELETE another account's objects even if the claim object is missing.
+  const list = await bucket.list({ prefix: handle + '/', include: ['customMetadata'] });
+  for (const o of list.objects || []) {
+    const owner = o.customMetadata && o.customMetadata.owner;
+    if (owner && owner !== userId) {
+      return { error: json({ error: 'handle taken', handle: handle }, 409) };
+    }
+  }
+  const key = '__handles/' + handle;
+  const existing = await bucket.get(key);
+  if (!existing) return {};
+  const claimed = existing.customMetadata && existing.customMetadata.userId;
+  if (claimed && claimed !== userId) {
+    return { error: json({ error: 'handle taken', handle: handle }, 409) };
+  }
+  return {};
+}
+
+async function claimHandle(bucket, handle, userId) {
+  const owned = await assertHandleOwner(bucket, handle, userId);
+  if (owned.error) return owned;
+  const key = '__handles/' + handle;
+  // Write (or rewrite) so a same-user republish resets object Age against the
+  // bucket's 366-day lifecycle — otherwise the claim can expire while pages stay live.
+  await bucket.put(key, JSON.stringify({ userId: userId }), {
+    httpMetadata: { contentType: 'application/json' },
+    customMetadata: { userId: userId, visibility: 'unlisted' },
+  });
+  return {};
+}
+
+function normalizeVisibility(raw) {
+  const v = (raw || '').trim().toLowerCase();
+  if (!v || v === 'public') return { value: 'public' };
+  if (v === 'unlisted' || v === 'me' || v === 'org') return { value: v };
+  return { error: json({ error: 'visibility must be public, unlisted, me, or org' }, 400) };
+}
+
+function emailDomain(email) {
+  if (!email) return '';
+  const at = String(email).lastIndexOf('@');
+  if (at < 0) return '';
+  return String(email).slice(at + 1).toLowerCase();
+}
+
+function isHiddenFromGallery(visibility) {
+  return visibility === 'unlisted' || visibility === 'me' || visibility === 'org';
+}
+
+function isIdentityGated(visibility) {
+  return visibility === 'me' || visibility === 'org';
+}
+
+async function gateRestrictedGet(request, env, url, obj) {
+  const visibility = (obj.customMetadata && obj.customMetadata.visibility) || 'public';
+  if (!isIdentityGated(visibility)) return null;
+  const viewer = await resolveViewer(request, env, url);
+  if (viewer.redirect) return viewer.redirect;
+  if (viewer.error) return viewer.error;
+  if (!viewer.identity) return bounceToLogin(url, env);
+  if (!viewerMayRead(visibility, obj.customMetadata, viewer.identity)) {
+    return new Response('not found', { status: 404, headers: { 'content-type': 'text/plain' } });
+  }
+  return null;
+}
+
+function viewerMayRead(visibility, meta, identity) {
+  if (visibility === 'me') {
+    const owner = meta && meta.owner;
+    return !!owner && owner === identity.userId;
+  }
+  if (visibility === 'org') {
+    const stamped = meta && meta.org_domain;
+    if (!stamped) return false;
+    return emailDomain(identity.email) === String(stamped).toLowerCase();
+  }
+  return true;
+}
+
+function bounceToLogin(url, env) {
+  const base = typeof env.PHOENIX_ID_BASE === 'string' ? env.PHOENIX_ID_BASE.replace(/\\/+$/, '') : '';
+  if (!base) return json({ error: 'phoenix login is not configured' }, 401);
+  return new Response(null, {
+    status: 302,
+    headers: { Location: base + '/login?return=' + encodeURIComponent(url.toString()) },
+  });
+}
+
+function readCookie(request, name) {
+  const header = request.headers.get('Cookie') || '';
+  const parts = header.split(';');
+  for (let i = 0; i < parts.length; i++) {
+    const p = parts[i];
+    const eq = p.indexOf('=');
+    if (eq < 0) continue;
+    if (p.slice(0, eq).trim() === name) return p.slice(eq + 1).trim();
+  }
+  return '';
+}
+
+function toB64Url(s) {
+  const bytes = new TextEncoder().encode(s);
+  let bin = '';
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');
+}
+
+function fromB64Url(s) {
+  const pad = s.length % 4 === 0 ? '' : '='.repeat(4 - (s.length % 4));
+  const b64 = s.replace(/-/g, '+').replace(/_/g, '/') + pad;
+  const bin = atob(b64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
+}
+
+function bufToHex(buf) {
+  return [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, '0')).join('');
+}
+
+async function hmacHex(secret, data) {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(data));
+  return bufToHex(sig);
+}
+
+async function signShareCookie(identity, env) {
+  const secret = typeof env.WRITE_TOKEN === 'string' ? env.WRITE_TOKEN : '';
+  if (!secret) return '';
+  const exp = Math.floor(Date.now() / 1000) + SHARE_COOKIE_MAX_AGE;
+  const payload = identity.userId + '|' + (identity.email || '') + '|' + exp;
+  const sig = await hmacHex(secret, payload);
+  const value = toB64Url(payload) + '.' + sig;
+  return SHARE_COOKIE + '=' + value + '; HttpOnly; Secure; Path=/; SameSite=Lax; Max-Age=' + SHARE_COOKIE_MAX_AGE;
+}
+
+async function identityFromCookie(request, env) {
+  const secret = typeof env.WRITE_TOKEN === 'string' ? env.WRITE_TOKEN : '';
+  if (!secret) return null;
+  const raw = readCookie(request, SHARE_COOKIE);
+  if (!raw) return null;
+  const dot = raw.lastIndexOf('.');
+  if (dot < 1) return null;
+  let payload;
+  try {
+    payload = fromB64Url(raw.slice(0, dot));
+  } catch {
+    return null;
+  }
+  const sig = raw.slice(dot + 1);
+  const expected = await hmacHex(secret, payload);
+  if (!safeEqual(sig, expected)) return null;
+  const first = payload.indexOf('|');
+  const last = payload.lastIndexOf('|');
+  if (first < 0 || last <= first) return null;
+  const userId = payload.slice(0, first);
+  const email = payload.slice(first + 1, last);
+  const cookieExp = Number(payload.slice(last + 1));
+  if (!userId || !Number.isFinite(cookieExp) || Math.floor(Date.now() / 1000) > cookieExp) return null;
+  return { userId: userId, email: email };
+}
+
+async function redeemTicket(ticket, env) {
+  const base = typeof env.PHOENIX_ID_BASE === 'string' ? env.PHOENIX_ID_BASE.replace(/\\/+$/, '') : '';
+  if (!base || !ticket) return null;
+  let res;
+  try {
+    res = await fetch(base + '/api/v1/auth/ticket', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ ticket: ticket }),
+    });
+  } catch {
+    return null;
+  }
+  if (!res.ok) return null;
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return null;
+  }
+  if (!body || typeof body.userId !== 'string' || !body.userId) return null;
+  return { userId: body.userId, email: typeof body.email === 'string' ? body.email : '' };
+}
+
+async function resolveViewer(request, env, url) {
+  const claims = await hooks.verifyPhoenixToken(request, env);
+  if (claims && typeof claims.userId === 'string' && claims.userId) {
+    return { identity: { userId: claims.userId, email: typeof claims.email === 'string' ? claims.email : '' } };
+  }
+  const cookieId = await identityFromCookie(request, env);
+  if (cookieId) return { identity: cookieId };
+  const ticket = url.searchParams.get('phoenix_ticket');
+  if (!ticket) return {};
+  const redeemed = await redeemTicket(ticket, env);
+  if (!redeemed) return { error: json({ error: 'invalid ticket' }, 401) };
+  const cookie = await signShareCookie(redeemed, env);
+  if (!cookie) return { error: json({ error: 'phoenix login is not configured' }, 401) };
+  url.searchParams.delete('phoenix_ticket');
+  const headers = new Headers();
+  headers.set('Location', url.toString());
+  headers.append('Set-Cookie', cookie);
+  return { redirect: new Response(null, { status: 302, headers: headers }) };
+}
+
+async function defaultVerifyPhoenixToken(request, env) {
+  const presented = (request.headers.get('authorization') || '').replace(/^Bearer\\s+/i, '');
+  if (!presented) return null;
+  const base = typeof env.PHOENIX_ID_BASE === 'string' ? env.PHOENIX_ID_BASE.replace(/\\/+$/, '') : '';
+  if (!base) return null;
+  let res;
+  try {
+    res = await fetch(base + '/api/v1/auth/me', {
+      method: 'GET',
+      headers: { Authorization: 'Bearer ' + presented },
+    });
+  } catch {
+    return null;
+  }
+  if (!res.ok) return null;
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return null;
+  }
+  if (!body || typeof body.userId !== 'string' || !body.userId) return null;
+  return { userId: body.userId, email: typeof body.email === 'string' ? body.email : '' };
+}
+
+// Two legitimate principals: WRITE_TOKEN equality first (admin/BYO), otherwise
+// the bearer is a Phoenix token and we verify it. 401 when neither authenticates.
+async function authorizeWrite(request, env) {
+  const presented = (request.headers.get('authorization') || '').replace(/^Bearer\\s+/i, '');
+  if (!presented) return { error: json({ error: 'unauthorized' }, 401) };
+  if (env.WRITE_TOKEN && safeEqual(presented, env.WRITE_TOKEN)) {
+    return { kind: 'byo', owner: env.SHARE_NAMESPACE || 'byo' };
+  }
+  const claims = await hooks.verifyPhoenixToken(request, env);
+  if (claims && typeof claims.userId === 'string' && claims.userId) {
+    return { kind: 'phoenix', owner: claims.userId, email: typeof claims.email === 'string' ? claims.email : '' };
+  }
+  return { error: json({ error: 'unauthorized' }, 401) };
+}
 `;
 }

package/dist/lib/sqlite.js

@@ -41,10 +41,23 @@ function loadNodeSqlite() {
         process.emitWarning = original;
     }
 }
-// Keep Node on createRequire() so Vitest doesn't try to prebundle the built-in
-// sqlite module as a userland package during test collection.
+// Keep BOTH runtimes on createRequire() so Vitest doesn't try to prebundle the
+// built-in sqlite module as a userland package during test collection.
+//
+// The Bun arm used to be `await import('bun:sqlite' as string)`, which made this
+// a TOP-LEVEL AWAIT. esbuild cannot lower top-level await to CJS, so every test
+// that spawns a subprocess through `tsx` (CJS mode) died at transform time with
+// `Top-level await is currently not supported with the "cjs" output format` --
+// 49 failures across 7 files, none of which touch sqlite. `require` is
+// synchronous, so the await disappears and with it the whole failure class.
+//
+// The specifier is held in a variable, not written inline: a literal
+// `require('bun:sqlite')` is statically analyzable, so bundlers and Vitest's
+// collector try to resolve a module that does not exist off-Bun. That
+// indirection is what the old `as string` cast was doing for the dynamic import.
+const BUN_SQLITE = 'bun:sqlite';
 const sqliteMod = isBun
-    ? await import('bun:sqlite')
+    ? require(BUN_SQLITE)
     : loadNodeSqlite();
 // bun:sqlite exports `Database`; node:sqlite exports `DatabaseSync`.
 const NativeDatabase = sqliteMod.Database

package/dist/lib/ssh-exec.d.ts

@@ -13,6 +13,14 @@
  * smuggled in as part of a remote command, and `sshExec` additionally rejects a
  * leading `-` so it can never be parsed as an ssh argv flag.
  */
+/**
+ * ssh's own connection-layer failure code — the transport dropped or never came
+ * up, as opposed to the remote command choosing an exit status. Defined here,
+ * in the layer that owns the ssh invocation, and re-exported by
+ * `lib/hosts/reconnect.ts` as `SSH_CONN_FAILURE` so there is one constant for
+ * the concept rather than two that can drift apart.
+ */
+export declare const SSH_CONN_FAILURE_CODE = 255;
 export declare const SSH_TARGET_RE: RegExp;
 export declare function assertValidSshTarget(host: string): void;
 /** POSIX single-quote a string for safe interpolation into a remote shell command. */
@@ -156,11 +164,68 @@ export interface SshStreamOptions {
     /** Additional OpenSSH argv placed before the target (for example `-i <path>`). */
     extraSshArgs?: string[];
 }
+/**
+ * The DEC private modes a full-screen remote app turns ON and, when it exits
+ * cleanly, turns back off itself. A remote agent TUI killed by a dropped link
+ * never gets to, so they stay enabled on the LOCAL terminal after ssh is gone:
+ * focus reporting (1004) and the mode/colour-scheme reports (996/997) then make
+ * the terminal emit answerback sequences at a shell that is not expecting them,
+ * which is the `^[[?997;1n ^[[I ^[[O` litter seen after a drop (RUSH-3125). Also
+ * resets bracketed paste (2004), the alternate screen (1049), mouse tracking
+ * (1000/1002/1003/1006), and re-shows the cursor (25) — every one of which a TUI
+ * leaves armed the same way.
+ */
+export declare const TERMINAL_MODE_RESET: string;
+/**
+ * Put the local terminal back the way ssh found it.
+ *
+ * Two independent kinds of state survive a hard ssh death, and BOTH have to be
+ * undone or the next thing the user sees is corrupted:
+ *
+ *  - **termios** (kernel side): `-tt` puts the tty in raw mode, so a killed ssh
+ *    leaves it with echo and line-editing off. `saved` is the `stty -g` snapshot
+ *    taken before the spawn; restoring it is exact, unlike guessing at `sane`.
+ *  - **DEC private modes** (terminal side): see {@link TERMINAL_MODE_RESET}.
+ *
+ * Then drain whatever the terminal already answered back into the input buffer.
+ * Without the drain those bytes are not merely cosmetic — they are still queued
+ * on the tty, so the NEXT attach hands them straight to the agent as if the user
+ * had typed them.
+ *
+ * Best-effort by construction: this runs while recovering from a failure, so a
+ * missing `stty`, a non-TTY stdin, or a closed stream must never turn a
+ * recoverable drop into a thrown error.
+ */
+export declare function restoreLocalTerminal(saved: string | undefined, opts: {
+    drainStdin: boolean;
+}): void;
+/** `stty -g` snapshot of the local tty, or undefined when there is nothing to snapshot. */
+export declare function saveLocalTerminal(): string | undefined;
 /**
  * Foreground counterpart to `sshExec`: run `remoteCmd` on `target` with the
  * local stdio wired straight through (`stdio: 'inherit'`), so output streams as
  * it is produced and — with `tty` — keystrokes reach a remote picker. Blocks
  * until the remote command exits and returns its exit code (255 is ssh's own
  * connection-layer failure; any other non-zero is the remote command's code).
+ *
+ * On a `tty` stream the local terminal state is snapshotted before the spawn and
+ * restored after it. ssh restores termios itself when it exits cleanly, so this
+ * is for the case that matters here: the link dying under a full-screen agent
+ * TUI, which leaves the tty raw and the TUI's DEC modes armed. Doing it HERE
+ * rather than in the reconnect loop means every caller that opens an interactive
+ * remote stream is covered, not just the one that noticed (RUSH-3125).
+ *
+ * **The stdin drain is gated on an ABNORMAL exit, and the distinction is not
+ * cosmetic.** Resetting termios and the DEC modes is idempotent — on a clean
+ * exit ssh and the remote TUI have already done it, so re-doing it changes
+ * nothing. Draining stdin is destructive: it discards whatever the user has
+ * typed ahead. On a clean exit those bytes are legitimate type-ahead the
+ * resuming shell should receive, and eating them would be a new bug in every
+ * caller of this function (`runInteractiveOnHost`, the remote-tmux attach in
+ * commands/go.ts, the remote secrets browse) rather than a fix. Only an
+ * abnormal exit — ssh killed by a signal (`status === null`) or its own
+ * connection-layer failure (255) — produces the answerback storm the drain
+ * exists to clear, because only then did the TUI die without sending its own
+ * mode resets.
  */
 export declare function sshStream(target: string, remoteCmd: string, opts?: SshStreamOptions): number;