@poolzin/pool-bot 2026.2.21 → 2026.2.23

package/dist/gateway/server/ws-connection/message-handler.js

@@ -1,88 +1,33 @@
 import os from "node:os";
+import { loadConfig } from "../../../config/config.js";
 import { deriveDeviceIdFromPublicKey, normalizeDevicePublicKeyBase64Url, verifyDeviceSignature, } from "../../../infra/device-identity.js";
 import { approveDevicePairing, ensureDeviceToken, getPairedDevice, requestDevicePairing, updatePairedDeviceMetadata, verifyDeviceToken, } from "../../../infra/device-pairing.js";
 import { updatePairedNodeMetadata } from "../../../infra/node-pairing.js";
 import { recordRemoteNodeInfo, refreshRemoteNodeBins } from "../../../infra/skills-remote.js";
-import { loadVoiceWakeConfig } from "../../../infra/voicewake.js";
 import { upsertPresence } from "../../../infra/system-presence.js";
+import { loadVoiceWakeConfig } from "../../../infra/voicewake.js";
 import { rawDataToString } from "../../../infra/ws.js";
 import { isGatewayCliClient, isWebchatClient } from "../../../utils/message-channel.js";
+import { resolveRuntimeServiceVersion } from "../../../version.js";
+import { AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, } from "../../auth-rate-limit.js";
 import { authorizeGatewayConnect, isLocalDirectRequest } from "../../auth.js";
-import { loadConfig } from "../../../config/config.js";
 import { buildDeviceAuthPayload } from "../../device-auth.js";
 import { isLoopbackAddress, isTrustedProxyAddress, resolveGatewayClientIp } from "../../net.js";
+import { resolveHostName } from "../../net.js";
 import { resolveNodeCommandAllowlist } from "../../node-command-policy.js";
-import { ErrorCodes, errorShape, formatValidationErrors, PROTOCOL_VERSION, validateConnectParams, validateRequestFrame, } from "../../protocol/index.js";
+import { checkBrowserOrigin } from "../../origin-check.js";
 import { GATEWAY_CLIENT_IDS } from "../../protocol/client-info.js";
+import { ErrorCodes, errorShape, formatValidationErrors, PROTOCOL_VERSION, validateConnectParams, validateRequestFrame, } from "../../protocol/index.js";
 import { MAX_BUFFERED_BYTES, MAX_PAYLOAD_BYTES, TICK_INTERVAL_MS } from "../../server-constants.js";
 import { handleGatewayRequest } from "../../server-methods.js";
 import { formatError } from "../../server-utils.js";
 import { formatForLog, logWs } from "../../ws-log.js";
 import { truncateCloseReason } from "../close-reason.js";
 import { buildGatewaySnapshot, getHealthCache, getHealthVersion, incrementPresenceVersion, refreshGatewayHealthSnapshot, } from "../health-state.js";
+import { formatGatewayAuthFailureMessage } from "./auth-messages.js";
 const DEVICE_SIGNATURE_SKEW_MS = 10 * 60 * 1000;
-function resolveHostName(hostHeader) {
-    const host = (hostHeader ?? "").trim().toLowerCase();
-    if (!host)
-        return "";
-    if (host.startsWith("[")) {
-        const end = host.indexOf("]");
-        if (end !== -1)
-            return host.slice(1, end);
-    }
-    const [name] = host.split(":");
-    return name ?? "";
-}
-function formatGatewayAuthFailureMessage(params) {
-    const { authMode, authProvided, reason, client } = params;
-    const isCli = isGatewayCliClient(client);
-    const isControlUi = client?.id === GATEWAY_CLIENT_IDS.CONTROL_UI;
-    const isWebchat = isWebchatClient(client);
-    const uiHint = "open a tokenized dashboard URL or paste token in Control UI settings";
-    const tokenHint = isCli
-        ? "set gateway.remote.token to match gateway.auth.token"
-        : isControlUi || isWebchat
-            ? uiHint
-            : "provide gateway auth token";
-    const passwordHint = isCli
-        ? "set gateway.remote.password to match gateway.auth.password"
-        : isControlUi || isWebchat
-            ? "enter the password in Control UI settings"
-            : "provide gateway auth password";
-    switch (reason) {
-        case "token_missing":
-            return `unauthorized: gateway token missing (${tokenHint})`;
-        case "token_mismatch":
-            return `unauthorized: gateway token mismatch (${tokenHint})`;
-        case "token_missing_config":
-            return "unauthorized: gateway token not configured on gateway (set gateway.auth.token)";
-        case "password_missing":
-            return `unauthorized: gateway password missing (${passwordHint})`;
-        case "password_mismatch":
-            return `unauthorized: gateway password mismatch (${passwordHint})`;
-        case "password_missing_config":
-            return "unauthorized: gateway password not configured on gateway (set gateway.auth.password)";
-        case "tailscale_user_missing":
-            return "unauthorized: tailscale identity missing (use Tailscale Serve auth or gateway token/password)";
-        case "tailscale_proxy_missing":
-            return "unauthorized: tailscale proxy headers missing (use Tailscale Serve or gateway token/password)";
-        case "tailscale_whois_failed":
-            return "unauthorized: tailscale identity check failed (use Tailscale Serve auth or gateway token/password)";
-        case "tailscale_user_mismatch":
-            return "unauthorized: tailscale identity mismatch (use Tailscale Serve auth or gateway token/password)";
-        default:
-            break;
-    }
-    if (authMode === "token" && authProvided === "none") {
-        return `unauthorized: gateway token missing (${tokenHint})`;
-    }
-    if (authMode === "password" && authProvided === "none") {
-        return `unauthorized: gateway password missing (${passwordHint})`;
-    }
-    return "unauthorized";
-}
 export function attachGatewayWsMessageHandler(params) {
-    const { socket, upgradeReq, connId, remoteAddr, forwardedFor, realIp, requestHost, requestOrigin, requestUserAgent, canvasHostUrl, connectNonce, resolvedAuth, gatewayMethods, events, extraHandlers, buildRequestContext, send, close, isClosed, clearHandshakeTimer, getClient, setClient, setHandshakeState, setCloseCause, setLastFrameMeta, logGateway, logHealth, logWsControl, } = params;
+    const { socket, upgradeReq, connId, remoteAddr, forwardedFor, realIp, requestHost, requestOrigin, requestUserAgent, canvasHostUrl, connectNonce, resolvedAuth, rateLimiter, gatewayMethods, events, extraHandlers, buildRequestContext, send, close, isClosed, clearHandshakeTimer, getClient, setClient, setHandshakeState, setCloseCause, setLastFrameMeta, logGateway, logHealth, logWsControl, } = params;
     const configSnapshot = loadConfig();
     const trustedProxies = configSnapshot.gateway?.trustedProxies ?? [];
     const clientIp = resolveGatewayClientIp({ remoteAddr, forwardedFor, realIp, trustedProxies });
@@ -115,8 +60,9 @@ export function attachGatewayWsMessageHandler(params) {
     }
     const isWebchatConnect = (p) => isWebchatClient(p?.client);
     socket.on("message", async (data) => {
-        if (isClosed())
+        if (isClosed()) {
             return;
+        }
         const text = rawDataToString(data);
         try {
             const parsed = JSON.parse(text);
@@ -182,27 +128,35 @@ export function attachGatewayWsMessageHandler(params) {
                 const frame = parsed;
                 const connectParams = frame.params;
                 const clientLabel = connectParams.client.displayName ?? connectParams.client.id;
+                const clientMeta = {
+                    client: connectParams.client.id,
+                    clientDisplayName: connectParams.client.displayName,
+                    mode: connectParams.client.mode,
+                    version: connectParams.client.version,
+                };
+                const markHandshakeFailure = (cause, meta) => {
+                    setHandshakeState("failed");
+                    setCloseCause(cause, { ...meta, ...clientMeta });
+                };
+                const sendHandshakeErrorResponse = (code, message, options) => {
+                    send({
+                        type: "res",
+                        id: frame.id,
+                        ok: false,
+                        error: errorShape(code, message, options),
+                    });
+                };
                 // protocol negotiation
                 const { minProtocol, maxProtocol } = connectParams;
                 if (maxProtocol < PROTOCOL_VERSION || minProtocol > PROTOCOL_VERSION) {
-                    setHandshakeState("failed");
-                    logWsControl.warn(`protocol mismatch conn=${connId} remote=${remoteAddr ?? "?"} client=${clientLabel} ${connectParams.client.mode} v${connectParams.client.version}`);
-                    setCloseCause("protocol-mismatch", {
+                    markHandshakeFailure("protocol-mismatch", {
                         minProtocol,
                         maxProtocol,
                         expectedProtocol: PROTOCOL_VERSION,
-                        client: connectParams.client.id,
-                        clientDisplayName: connectParams.client.displayName,
-                        mode: connectParams.client.mode,
-                        version: connectParams.client.version,
                     });
-                    send({
-                        type: "res",
-                        id: frame.id,
-                        ok: false,
-                        error: errorShape(ErrorCodes.INVALID_REQUEST, "protocol mismatch", {
-                            details: { expectedProtocol: PROTOCOL_VERSION },
-                        }),
+                    logWsControl.warn(`protocol mismatch conn=${connId} remote=${remoteAddr ?? "?"} client=${clientLabel} ${connectParams.client.mode} v${connectParams.client.version}`);
+                    sendHandshakeErrorResponse(ErrorCodes.INVALID_REQUEST, "protocol mismatch", {
+                        details: { expectedProtocol: PROTOCOL_VERSION },
                     });
                     close(1002, "protocol mismatch");
                     return;
@@ -210,76 +164,137 @@ export function attachGatewayWsMessageHandler(params) {
                 const roleRaw = connectParams.role ?? "operator";
                 const role = roleRaw === "operator" || roleRaw === "node" ? roleRaw : null;
                 if (!role) {
-                    setHandshakeState("failed");
-                    setCloseCause("invalid-role", {
+                    markHandshakeFailure("invalid-role", {
                         role: roleRaw,
-                        client: connectParams.client.id,
-                        clientDisplayName: connectParams.client.displayName,
-                        mode: connectParams.client.mode,
-                        version: connectParams.client.version,
-                    });
-                    send({
-                        type: "res",
-                        id: frame.id,
-                        ok: false,
-                        error: errorShape(ErrorCodes.INVALID_REQUEST, "invalid role"),
                     });
+                    sendHandshakeErrorResponse(ErrorCodes.INVALID_REQUEST, "invalid role");
                     close(1008, "invalid role");
                     return;
                 }
-                const requestedScopes = Array.isArray(connectParams.scopes) ? connectParams.scopes : [];
-                const scopes = requestedScopes.length > 0
-                    ? requestedScopes
-                    : role === "operator"
-                        ? ["operator.admin"]
-                        : [];
+                // Default-deny: scopes must be explicit. Empty/missing scopes means no permissions.
+                // Note: If the client does not present a device identity, we can't bind scopes to a paired
+                // device/token, so we will clear scopes after auth to avoid self-declared permissions.
+                let scopes = Array.isArray(connectParams.scopes) ? connectParams.scopes : [];
                 connectParams.role = role;
                 connectParams.scopes = scopes;
+                const isControlUi = connectParams.client.id === GATEWAY_CLIENT_IDS.CONTROL_UI;
+                const isWebchat = isWebchatConnect(connectParams);
+                if (isControlUi || isWebchat) {
+                    const originCheck = checkBrowserOrigin({
+                        requestHost,
+                        origin: requestOrigin,
+                        allowedOrigins: configSnapshot.gateway?.controlUi?.allowedOrigins,
+                    });
+                    if (!originCheck.ok) {
+                        const errorMessage = "origin not allowed (open the Control UI from the gateway host or allow it in gateway.controlUi.allowedOrigins)";
+                        markHandshakeFailure("origin-mismatch", {
+                            origin: requestOrigin ?? "n/a",
+                            host: requestHost ?? "n/a",
+                            reason: originCheck.reason,
+                        });
+                        sendHandshakeErrorResponse(ErrorCodes.INVALID_REQUEST, errorMessage);
+                        close(1008, truncateCloseReason(errorMessage));
+                        return;
+                    }
+                }
                 const deviceRaw = connectParams.device;
                 let devicePublicKey = null;
                 const hasTokenAuth = Boolean(connectParams.auth?.token);
                 const hasPasswordAuth = Boolean(connectParams.auth?.password);
                 const hasSharedAuth = hasTokenAuth || hasPasswordAuth;
-                const isControlUi = connectParams.client.id === GATEWAY_CLIENT_IDS.CONTROL_UI;
                 const allowInsecureControlUi = isControlUi && configSnapshot.gateway?.controlUi?.allowInsecureAuth === true;
                 const disableControlUiDeviceAuth = isControlUi && configSnapshot.gateway?.controlUi?.dangerouslyDisableDeviceAuth === true;
                 const allowControlUiBypass = allowInsecureControlUi || disableControlUiDeviceAuth;
                 const device = disableControlUiDeviceAuth ? null : deviceRaw;
+                const hasDeviceTokenCandidate = Boolean(connectParams.auth?.token && device);
+                let authResult = await authorizeGatewayConnect({
+                    auth: resolvedAuth,
+                    connectAuth: connectParams.auth,
+                    req: upgradeReq,
+                    trustedProxies,
+                    rateLimiter: hasDeviceTokenCandidate ? undefined : rateLimiter,
+                    clientIp,
+                    rateLimitScope: AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET,
+                });
+                if (hasDeviceTokenCandidate &&
+                    authResult.ok &&
+                    rateLimiter &&
+                    (authResult.method === "token" || authResult.method === "password")) {
+                    const sharedRateCheck = rateLimiter.check(clientIp, AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET);
+                    if (!sharedRateCheck.allowed) {
+                        authResult = {
+                            ok: false,
+                            reason: "rate_limited",
+                            rateLimited: true,
+                            retryAfterMs: sharedRateCheck.retryAfterMs,
+                        };
+                    }
+                    else {
+                        rateLimiter.reset(clientIp, AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET);
+                    }
+                }
+                let authOk = authResult.ok;
+                let authMethod = authResult.method ?? (resolvedAuth.mode === "password" ? "password" : "token");
+                const sharedAuthResult = hasSharedAuth
+                    ? await authorizeGatewayConnect({
+                        auth: { ...resolvedAuth, allowTailscale: false },
+                        connectAuth: connectParams.auth,
+                        req: upgradeReq,
+                        trustedProxies,
+                        // Shared-auth probe only; rate-limit side effects are handled in
+                        // the primary auth flow (or deferred for device-token candidates).
+                        rateLimitScope: AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET,
+                    })
+                    : null;
+                const sharedAuthOk = sharedAuthResult?.ok === true &&
+                    (sharedAuthResult.method === "token" || sharedAuthResult.method === "password");
+                const rejectUnauthorized = (failedAuth) => {
+                    markHandshakeFailure("unauthorized", {
+                        authMode: resolvedAuth.mode,
+                        authProvided: connectParams.auth?.token
+                            ? "token"
+                            : connectParams.auth?.password
+                                ? "password"
+                                : "none",
+                        authReason: failedAuth.reason,
+                        allowTailscale: resolvedAuth.allowTailscale,
+                    });
+                    logWsControl.warn(`unauthorized conn=${connId} remote=${remoteAddr ?? "?"} client=${clientLabel} ${connectParams.client.mode} v${connectParams.client.version} reason=${failedAuth.reason ?? "unknown"}`);
+                    const authProvided = connectParams.auth?.token
+                        ? "token"
+                        : connectParams.auth?.password
+                            ? "password"
+                            : "none";
+                    const authMessage = formatGatewayAuthFailureMessage({
+                        authMode: resolvedAuth.mode,
+                        authProvided,
+                        reason: failedAuth.reason,
+                        client: connectParams.client,
+                    });
+                    sendHandshakeErrorResponse(ErrorCodes.INVALID_REQUEST, authMessage);
+                    close(1008, truncateCloseReason(authMessage));
+                };
                 if (!device) {
-                    const canSkipDevice = allowControlUiBypass ? hasSharedAuth : hasTokenAuth;
+                    if (scopes.length > 0 && !allowControlUiBypass) {
+                        scopes = [];
+                        connectParams.scopes = scopes;
+                    }
+                    const canSkipDevice = sharedAuthOk;
                     if (isControlUi && !allowControlUiBypass) {
                         const errorMessage = "control ui requires HTTPS or localhost (secure context)";
-                        setHandshakeState("failed");
-                        setCloseCause("control-ui-insecure-auth", {
-                            client: connectParams.client.id,
-                            clientDisplayName: connectParams.client.displayName,
-                            mode: connectParams.client.mode,
-                            version: connectParams.client.version,
-                        });
-                        send({
-                            type: "res",
-                            id: frame.id,
-                            ok: false,
-                            error: errorShape(ErrorCodes.INVALID_REQUEST, errorMessage),
-                        });
+                        markHandshakeFailure("control-ui-insecure-auth");
+                        sendHandshakeErrorResponse(ErrorCodes.INVALID_REQUEST, errorMessage);
                         close(1008, errorMessage);
                         return;
                     }
-                    // Allow token-authenticated connections (e.g., control-ui) to skip device identity
+                    // Allow shared-secret authenticated connections (e.g., control-ui) to skip device identity
                     if (!canSkipDevice) {
-                        setHandshakeState("failed");
-                        setCloseCause("device-required", {
-                            client: connectParams.client.id,
-                            clientDisplayName: connectParams.client.displayName,
-                            mode: connectParams.client.mode,
-                            version: connectParams.client.version,
-                        });
-                        send({
-                            type: "res",
-                            id: frame.id,
-                            ok: false,
-                            error: errorShape(ErrorCodes.NOT_PAIRED, "device identity required"),
-                        });
+                        if (!authOk && hasSharedAuth) {
+                            rejectUnauthorized(authResult);
+                            return;
+                        }
+                        markHandshakeFailure("device-required");
+                        sendHandshakeErrorResponse(ErrorCodes.NOT_PAIRED, "device identity required");
                         close(1008, "device identity required");
                         return;
                     }
@@ -359,12 +374,27 @@ export function attachGatewayWsMessageHandler(params) {
                         clientId: connectParams.client.id,
                         clientMode: connectParams.client.mode,
                         role,
-                        scopes: requestedScopes,
+                        scopes,
                         signedAtMs: signedAt,
                         token: connectParams.auth?.token ?? null,
                         nonce: providedNonce || undefined,
                         version: providedNonce ? "v2" : "v1",
                     });
+                    const rejectDeviceSignatureInvalid = () => {
+                        setHandshakeState("failed");
+                        setCloseCause("device-auth-invalid", {
+                            reason: "device-signature",
+                            client: connectParams.client.id,
+                            deviceId: device.id,
+                        });
+                        send({
+                            type: "res",
+                            id: frame.id,
+                            ok: false,
+                            error: errorShape(ErrorCodes.INVALID_REQUEST, "device signature invalid"),
+                        });
+                        close(1008, "device signature invalid");
+                    };
                     const signatureOk = verifyDeviceSignature(device.publicKey, payload, device.signature);
                     const allowLegacy = !nonceRequired && !providedNonce;
                     if (!signatureOk && allowLegacy) {
@@ -373,7 +403,7 @@ export function attachGatewayWsMessageHandler(params) {
                             clientId: connectParams.client.id,
                             clientMode: connectParams.client.mode,
                             role,
-                            scopes: requestedScopes,
+                            scopes,
                             signedAtMs: signedAt,
                             token: connectParams.auth?.token ?? null,
                             version: "v1",
@@ -382,36 +412,12 @@ export function attachGatewayWsMessageHandler(params) {
                             // accepted legacy loopback signature
                         }
                         else {
-                            setHandshakeState("failed");
-                            setCloseCause("device-auth-invalid", {
-                                reason: "device-signature",
-                                client: connectParams.client.id,
-                                deviceId: device.id,
-                            });
-                            send({
-                                type: "res",
-                                id: frame.id,
-                                ok: false,
-                                error: errorShape(ErrorCodes.INVALID_REQUEST, "device signature invalid"),
-                            });
-                            close(1008, "device signature invalid");
+                            rejectDeviceSignatureInvalid();
                             return;
                         }
                     }
                     else if (!signatureOk) {
-                        setHandshakeState("failed");
-                        setCloseCause("device-auth-invalid", {
-                            reason: "device-signature",
-                            client: connectParams.client.id,
-                            deviceId: device.id,
-                        });
-                        send({
-                            type: "res",
-                            id: frame.id,
-                            ok: false,
-                            error: errorShape(ErrorCodes.INVALID_REQUEST, "device signature invalid"),
-                        });
-                        close(1008, "device signature invalid");
+                        rejectDeviceSignatureInvalid();
                         return;
                     }
                     devicePublicKey = normalizeDevicePublicKeyBase64Url(device.publicKey);
@@ -432,60 +438,41 @@ export function attachGatewayWsMessageHandler(params) {
                         return;
                     }
                 }
-                const authResult = await authorizeGatewayConnect({
-                    auth: resolvedAuth,
-                    connectAuth: connectParams.auth,
-                    req: upgradeReq,
-                    trustedProxies,
-                });
-                let authOk = authResult.ok;
-                let authMethod = authResult.method ?? (resolvedAuth.mode === "password" ? "password" : "token");
                 if (!authOk && connectParams.auth?.token && device) {
-                    const tokenCheck = await verifyDeviceToken({
-                        deviceId: device.id,
-                        token: connectParams.auth.token,
-                        role,
-                        scopes,
-                    });
-                    if (tokenCheck.ok) {
-                        authOk = true;
-                        authMethod = "device-token";
+                    if (rateLimiter) {
+                        const deviceRateCheck = rateLimiter.check(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+                        if (!deviceRateCheck.allowed) {
+                            authResult = {
+                                ok: false,
+                                reason: "rate_limited",
+                                rateLimited: true,
+                                retryAfterMs: deviceRateCheck.retryAfterMs,
+                            };
+                        }
+                    }
+                    if (!authResult.rateLimited) {
+                        const tokenCheck = await verifyDeviceToken({
+                            deviceId: device.id,
+                            token: connectParams.auth.token,
+                            role,
+                            scopes,
+                        });
+                        if (tokenCheck.ok) {
+                            authOk = true;
+                            authMethod = "device-token";
+                            rateLimiter?.reset(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+                        }
+                        else {
+                            authResult = { ok: false, reason: "device_token_mismatch" };
+                            rateLimiter?.recordFailure(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+                        }
                     }
                 }
                 if (!authOk) {
-                    setHandshakeState("failed");
-                    logWsControl.warn(`unauthorized conn=${connId} remote=${remoteAddr ?? "?"} client=${clientLabel} ${connectParams.client.mode} v${connectParams.client.version} reason=${authResult.reason ?? "unknown"}`);
-                    const authProvided = connectParams.auth?.token
-                        ? "token"
-                        : connectParams.auth?.password
-                            ? "password"
-                            : "none";
-                    const authMessage = formatGatewayAuthFailureMessage({
-                        authMode: resolvedAuth.mode,
-                        authProvided,
-                        reason: authResult.reason,
-                        client: connectParams.client,
-                    });
-                    setCloseCause("unauthorized", {
-                        authMode: resolvedAuth.mode,
-                        authProvided,
-                        authReason: authResult.reason,
-                        allowTailscale: resolvedAuth.allowTailscale,
-                        client: connectParams.client.id,
-                        clientDisplayName: connectParams.client.displayName,
-                        mode: connectParams.client.mode,
-                        version: connectParams.client.version,
-                    });
-                    send({
-                        type: "res",
-                        id: frame.id,
-                        ok: false,
-                        error: errorShape(ErrorCodes.INVALID_REQUEST, authMessage),
-                    });
-                    close(1008, truncateCloseReason(authMessage));
+                    rejectUnauthorized(authResult);
                     return;
                 }
-                const skipPairing = allowControlUiBypass && hasSharedAuth;
+                const skipPairing = allowControlUiBypass && sharedAuthOk;
                 if (device && devicePublicKey && !skipPairing) {
                     const requirePairing = async (reason, _paired) => {
                         const pairing = await requestDevicePairing({
@@ -540,35 +527,40 @@ export function attachGatewayWsMessageHandler(params) {
                     const isPaired = paired?.publicKey === devicePublicKey;
                     if (!isPaired) {
                         const ok = await requirePairing("not-paired");
-                        if (!ok)
+                        if (!ok) {
                             return;
+                        }
                     }
                     else {
                         const allowedRoles = new Set(Array.isArray(paired.roles) ? paired.roles : paired.role ? [paired.role] : []);
                         if (allowedRoles.size === 0) {
                             const ok = await requirePairing("role-upgrade", paired);
-                            if (!ok)
+                            if (!ok) {
                                 return;
+                            }
                         }
                         else if (!allowedRoles.has(role)) {
                             const ok = await requirePairing("role-upgrade", paired);
-                            if (!ok)
+                            if (!ok) {
                                 return;
+                            }
                         }
                         const pairedScopes = Array.isArray(paired.scopes) ? paired.scopes : [];
                         if (scopes.length > 0) {
                             if (pairedScopes.length === 0) {
                                 const ok = await requirePairing("scope-upgrade", paired);
-                                if (!ok)
+                                if (!ok) {
                                     return;
+                                }
                             }
                             else {
                                 const allowedScopes = new Set(pairedScopes);
                                 const missingScope = scopes.find((scope) => !allowedScopes.has(scope));
                                 if (missingScope) {
                                     const ok = await requirePairing("scope-upgrade", paired);
-                                    if (!ok)
+                                    if (!ok) {
                                         return;
+                                    }
                                 }
                             }
                         }
@@ -642,10 +634,7 @@ export function attachGatewayWsMessageHandler(params) {
                     type: "hello-ok",
                     protocol: PROTOCOL_VERSION,
                     server: {
-                        version: process.env.POOLBOT_VERSION ??
-                            process.env.CLAWDBOT_VERSION ??
-                            process.env.npm_package_version ??
-                            "dev",
+                        version: resolveRuntimeServiceVersion(process.env, "dev"),
                         commit: process.env.GIT_COMMIT,
                         host: os.hostname(),
                         connId,
@@ -673,6 +662,7 @@ export function attachGatewayWsMessageHandler(params) {
                     connect: connectParams,
                     connId,
                     presenceKey,
+                    clientIp: reportedClientIp,
                 };
                 setClient(nextClient);
                 setHandshakeState("connected");
@@ -684,8 +674,9 @@ export function attachGatewayWsMessageHandler(params) {
                     const instanceIdRaw = connectParams.client.instanceId;
                     const instanceId = typeof instanceIdRaw === "string" ? instanceIdRaw.trim() : "";
                     const nodeIdsForPairing = new Set([nodeSession.nodeId]);
-                    if (instanceId)
+                    if (instanceId) {
                         nodeIdsForPairing.add(instanceId);
+                    }
                     for (const nodeId of nodeIdsForPairing) {
                         void updatePairedNodeMetadata(nodeId, {
                             lastConnectedAtMs: nodeSession.connectedAtMs,