@qodalis/cli-server-node 1.0.0-beta.5 → 1.0.0-beta.7

package/dist/src/services/cli-event-socket-manager.d.ts

@@ -1,4 +1,7 @@
 import type { Server } from 'http';
+import { CliShellSessionManager } from './cli-shell-session-manager';
+import { CliShellAuthMode, CliShellOptions } from './cli-shell-options';
+import { ICliServerAuth } from '../auth/cli-server-auth';
 /** Information about a connected WebSocket event client. */
 export interface CliWebSocketClientInfo {
     id: string;
@@ -6,9 +9,28 @@ export interface CliWebSocketClientInfo {
     remoteAddress: string;
     type: 'events';
 }
+export interface CliEventSocketManagerOptions {
+    /** Accept interactive shell sessions on `/ws/v1/qcli/shell` (default false). */
+    enableShell?: boolean;
+    /** Shell security options (access mode, limits, timeouts, environment). */
+    shell?: CliShellOptions;
+    /**
+     * Trusted reverse-proxy hops (`true` = 1, `false`/0 = none) for `X-Forwarded-*`
+     * headers (shell per-address limits/logs, same-origin checks).
+     */
+    trustProxy?: boolean | number;
+    /** When set, every upgrade with an `Origin` header must come from one of these. */
+    allowedOrigins?: string[];
+}
 /**
  * Manages WebSocket connections for server-push events and interactive shell sessions.
- * Handles upgrades on `/ws/v1/qcli/events` and `/ws/v1/qcli/shell` paths.
+ * Handles upgrades on `/ws/v1/qcli/events` and (when `enableShell` is set)
+ * `/ws/v1/qcli/shell`. With an auth provider that protects the server, event
+ * upgrades need a single-use `?ticket=`; `session-kicked` is delivered only to
+ * the affected user. Sockets authenticated with a stored session are bound to
+ * it: once it ends they are closed with 4401 `session ended` (after
+ * `session-kicked` for revocations; see {@link SessionBoundSockets}). Shell
+ * access (modes, limits, session binding) is decided by {@link CliShellSessionManager}.
  */
 export declare class CliEventSocketManager {
     private _wss;
@@ -16,6 +38,20 @@ export declare class CliEventSocketManager {
     private readonly _clientMeta;
     private readonly _shellManager;
     private _nextClientId;
+    private _auth?;
+    private _allowedOrigins?;
+    private readonly _trustProxy;
+    private readonly _sessionBound;
+    constructor(options?: CliEventSocketManagerOptions);
+    /** Installs the auth provider (users plugin) used to authenticate upgrades with tickets. */
+    setAuth(auth: ICliServerAuth | undefined): void;
+    setAllowedOrigins(origins: string[] | undefined): void;
+    setShellEnabled(enabled: boolean): void;
+    get shellEnabled(): boolean;
+    /** Shell access mode (`undefined` while the shell is disabled). */
+    get shellAuthMode(): CliShellAuthMode | undefined;
+    /** The shell session manager (open sessions, limits, binding). */
+    get shellManager(): CliShellSessionManager;
     private static readonly EVENT_PATHS;
     private static readonly SHELL_PATHS;
     /**

package/dist/src/services/cli-event-socket-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-event-socket-manager.d.ts","sourceRoot":"","sources":["../../../src/services/cli-event-socket-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAmB,MAAM,MAAM,CAAC;AAOpD,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,QAAQ,CAAC;CAClB;AAQD;;;GAGG;AACH,qBAAa,qBAAqB;IAC9B,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgC;IAC9D,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAGhC;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAGhC;IAEH;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IA8D5B;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IASxD;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB1C;;OAEG;IACH,UAAU,IAAI,sBAAsB,EAAE;IAkBtC,kEAAkE;IAClE,OAAO,IAAI,IAAI;CAQlB"}
+{"version":3,"file":"cli-event-socket-manager.d.ts","sourceRoot":"","sources":["../../../src/services/cli-event-socket-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAmB,MAAM,MAAM,CAAC;AAEpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAA8C,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAMrG,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,QAAQ,CAAC;CAClB;AAUD,MAAM,WAAW,4BAA4B;IACzC,gFAAgF;IAChF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAKD;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IAC9B,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IACvD,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,KAAK,CAAC,CAAiB;IAC/B,OAAO,CAAC,eAAe,CAAC,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgD;gBAElE,OAAO,GAAE,4BAAiC;IAUtD,4FAA4F;IAC5F,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI;IAM/C,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI;IAItD,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIvC,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,mEAAmE;IACnE,IAAI,aAAa,IAAI,gBAAgB,GAAG,SAAS,CAEhD;IAED,kEAAkE;IAClE,IAAI,YAAY,IAAI,sBAAsB,CAEzC;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAGhC;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAGhC;IAEH;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IA+E5B;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAyCxD;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B1C;;OAEG;IACH,UAAU,IAAI,sBAAsB,EAAE;IAkBtC,kEAAkE;IAClE,OAAO,IAAI,IAAI;CAUlB"}

package/dist/src/services/cli-event-socket-manager.js

@@ -5,17 +5,64 @@ const ws_1 = require("ws");
 const url_1 = require("url");
 const cli_shell_session_manager_1 = require("./cli-shell-session-manager");
 const logger_1 = require("../utils/logger");
+const cli_server_auth_1 = require("../auth/cli-server-auth");
+const ws_upgrade_auth_1 = require("../auth/ws-upgrade-auth");
+const session_bound_sockets_1 = require("./session-bound-sockets");
 const logger = (0, logger_1.createLogger)('EventSocket');
+/** Events delivered only to sockets authenticated as the event's user. */
+const USER_SCOPED_EVENTS = new Set(['session-kicked']);
 /**
  * Manages WebSocket connections for server-push events and interactive shell sessions.
- * Handles upgrades on `/ws/v1/qcli/events` and `/ws/v1/qcli/shell` paths.
+ * Handles upgrades on `/ws/v1/qcli/events` and (when `enableShell` is set)
+ * `/ws/v1/qcli/shell`. With an auth provider that protects the server, event
+ * upgrades need a single-use `?ticket=`; `session-kicked` is delivered only to
+ * the affected user. Sockets authenticated with a stored session are bound to
+ * it: once it ends they are closed with 4401 `session ended` (after
+ * `session-kicked` for revocations; see {@link SessionBoundSockets}). Shell
+ * access (modes, limits, session binding) is decided by {@link CliShellSessionManager}.
  */
 class CliEventSocketManager {
     _wss = null;
     _clients = new Set();
     _clientMeta = new Map();
-    _shellManager = new cli_shell_session_manager_1.CliShellSessionManager();
+    _shellManager;
     _nextClientId = 1;
+    _auth;
+    _allowedOrigins;
+    _trustProxy;
+    _sessionBound = new session_bound_sockets_1.SessionBoundSockets({ awaitKick: true });
+    constructor(options = {}) {
+        this._shellManager = new cli_shell_session_manager_1.CliShellSessionManager({
+            enabled: options.enableShell ?? false,
+            shell: options.shell,
+            trustProxy: options.trustProxy,
+        });
+        this._allowedOrigins = options.allowedOrigins;
+        this._trustProxy = options.trustProxy ?? false;
+    }
+    /** Installs the auth provider (users plugin) used to authenticate upgrades with tickets. */
+    setAuth(auth) {
+        this._auth = auth;
+        this._shellManager.setAuth(auth);
+        this._sessionBound.setAuth(auth);
+    }
+    setAllowedOrigins(origins) {
+        this._allowedOrigins = origins;
+    }
+    setShellEnabled(enabled) {
+        this._shellManager.setEnabled(enabled);
+    }
+    get shellEnabled() {
+        return this._shellManager.enabled;
+    }
+    /** Shell access mode (`undefined` while the shell is disabled). */
+    get shellAuthMode() {
+        return this._shellManager.authMode;
+    }
+    /** The shell session manager (open sessions, limits, binding). */
+    get shellManager() {
+        return this._shellManager;
+    }
     static EVENT_PATHS = new Set([
         '/ws/v1/qcli/events',
         '/ws/qcli/events',
@@ -30,56 +77,73 @@ class CliEventSocketManager {
      */
     attach(server) {
         this._wss = new ws_1.WebSocketServer({ noServer: true });
+        this._shellManager.logStartupState();
         server.on('upgrade', (request, socket, head) => {
-            const parsed = new url_1.URL(request.url ?? '', 'http://localhost');
+            let parsed;
+            try {
+                parsed = new url_1.URL(request.url ?? '', 'http://localhost');
+            }
+            catch {
+                return; // malformed request target: not one of our paths
+            }
             const pathname = parsed.pathname;
             if (CliEventSocketManager.EVENT_PATHS.has(pathname)) {
-                this._wss.handleUpgrade(request, socket, head, (ws) => {
-                    this._wss.emit('connection', ws, request);
-                });
+                (0, ws_upgrade_auth_1.authorizeWsUpgrade)(request, parsed, { auth: this._auth, allowedOrigins: this._allowedOrigins, trustProxy: this._trustProxy }).then((result) => {
+                    if (!result.ok) {
+                        (0, ws_upgrade_auth_1.rejectUpgrade)(socket, result.status);
+                        return;
+                    }
+                    this._wss.handleUpgrade(request, socket, head, (ws) => {
+                        this._wss.emit('connection', ws, request, result.ctx);
+                    });
+                }, () => (0, ws_upgrade_auth_1.rejectUpgrade)(socket, 401));
                 return;
             }
             if (CliEventSocketManager.SHELL_PATHS.has(pathname)) {
-                this._wss.handleUpgrade(request, socket, head, (ws) => {
-                    const cols = parseInt(parsed.searchParams.get('cols') ?? '80', 10) || 80;
-                    const rows = parseInt(parsed.searchParams.get('rows') ?? '24', 10) || 24;
-                    const cmd = parsed.searchParams.get('cmd') || undefined;
-                    this._shellManager.handleSession(ws, cols, rows, cmd).catch((err) => {
-                        try {
-                            ws.send(JSON.stringify({ type: 'error', message: err.message }));
-                            ws.close();
-                        }
-                        catch {
-                            // ignore
-                        }
+                // Origin rejection stays an HTTP 403; every other refusal is
+                // "accept, then close" with a code the browser can read (C5).
+                (0, ws_upgrade_auth_1.authorizeWsUpgrade)(request, parsed, { allowedOrigins: this._allowedOrigins, trustProxy: this._trustProxy }).then((result) => {
+                    if (!result.ok) {
+                        (0, ws_upgrade_auth_1.rejectUpgrade)(socket, result.status);
+                        return;
+                    }
+                    this._wss.handleUpgrade(request, socket, head, (ws) => {
+                        this._shellManager.accept(ws, request, parsed).catch((err) => {
+                            logger.error('Shell session error: %s', err?.message ?? err);
+                            try {
+                                ws.close(1011, 'shell error');
+                            }
+                            catch {
+                                // ignore
+                            }
+                        });
                     });
                 });
                 return;
             }
             // Unrecognized path; leave for other upgrade handlers
         });
-        this._wss.on('connection', (ws, request) => {
+        this._wss.on('connection', (ws, request, auth) => {
             this._clients.add(ws);
             const id = `evt-${this._nextClientId++}`;
             this._clientMeta.set(ws, {
                 id,
                 connectedAt: new Date(),
                 remoteAddress: request.socket.remoteAddress ?? 'unknown',
+                auth,
             });
+            this._sessionBound.bind(ws, auth);
             logger.info('Client connected (id=%s)', id);
             ws.send(JSON.stringify({ type: 'connected' }));
-            ws.on('close', () => {
-                const meta = this._clientMeta.get(ws);
-                logger.info('Client disconnected (id=%s)', meta?.id ?? 'unknown');
-                this._clients.delete(ws);
-                this._clientMeta.delete(ws);
-            });
-            ws.on('error', () => {
+            const disconnected = () => {
                 const meta = this._clientMeta.get(ws);
                 logger.info('Client disconnected (id=%s)', meta?.id ?? 'unknown');
+                this._sessionBound.unbind(ws);
                 this._clients.delete(ws);
                 this._clientMeta.delete(ws);
-            });
+            };
+            ws.on('close', disconnected);
+            ws.on('error', disconnected);
         });
     }
     /**
@@ -87,10 +151,40 @@ class CliEventSocketManager {
      */
     broadcastMessage(message) {
         const data = JSON.stringify(message);
+        const type = typeof message.type === 'string' ? message.type : '';
+        const payload = (message.data ?? {});
+        const toClose = [];
         for (const ws of this._clients) {
-            if (ws.readyState === ws_1.WebSocket.OPEN) {
+            if (ws.readyState !== ws_1.WebSocket.OPEN)
+                continue;
+            const auth = this._clientMeta.get(ws)?.auth;
+            if (USER_SCOPED_EVENTS.has(type)) {
+                // Only the affected user's sockets learn about it
+                if (!auth || auth.userId !== payload.userId)
+                    continue;
                 ws.send(data);
+                if (type === 'session-kicked' && auth.sessionId && auth.sessionId === payload.sessionId) {
+                    toClose.push(ws);
+                }
+                continue;
             }
+            // A socket whose session ended only waits for its session-kicked
+            if (this._sessionBound.isEnding(ws))
+                continue;
+            if (this._auth?.protectServer) {
+                // Server-wide events need the matching read permission
+                const needed = type === 'log' || type.startsWith('log:')
+                    ? cli_server_auth_1.CliServerPermissions.LogsRead
+                    : type.startsWith('job:')
+                        ? cli_server_auth_1.CliServerPermissions.JobsRead
+                        : undefined;
+                if (needed && (!auth || !this._auth.hasPermission(auth, needed)))
+                    continue;
+            }
+            ws.send(data);
+        }
+        for (const ws of toClose) {
+            this._sessionBound.kicked(ws);
         }
     }
     /**
@@ -111,6 +205,8 @@ class CliEventSocketManager {
             }
         }
         await Promise.all(promises);
+        this._shellManager.dispose();
+        this._sessionBound.dispose();
         this._clients.clear();
         this._clientMeta.clear();
     }
@@ -136,6 +232,8 @@ class CliEventSocketManager {
     }
     /** Terminates all connections and closes the WebSocket server. */
     dispose() {
+        this._shellManager.dispose();
+        this._sessionBound.dispose();
         for (const ws of this._clients) {
             ws.terminate();
         }

package/dist/src/services/cli-event-socket-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-event-socket-manager.js","sourceRoot":"","sources":["../../../src/services/cli-event-socket-manager.ts"],"names":[],"mappings":";;;AAAA,2BAAgD;AAEhD,6BAA0B;AAC1B,2EAAqE;AACrE,4CAA+C;AAE/C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,aAAa,CAAC,CAAC;AAgB3C;;;GAGG;AACH,MAAa,qBAAqB;IACtB,IAAI,GAA2B,IAAI,CAAC;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAAa,CAAC;IAChC,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,aAAa,GAAG,IAAI,kDAAsB,EAAE,CAAC;IACtD,aAAa,GAAG,CAAC,CAAC;IAElB,MAAM,CAAU,WAAW,GAAG,IAAI,GAAG,CAAC;QAC1C,oBAAoB;QACpB,iBAAiB;KACpB,CAAC,CAAC;IAEK,MAAM,CAAU,WAAW,GAAG,IAAI,GAAG,CAAC;QAC1C,mBAAmB;QACnB,gBAAgB;KACnB,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,MAAc;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,oBAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,IAAI,SAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEjC,IAAI,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,IAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;oBACnD,IAAI,CAAC,IAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC/C,CAAC,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,IAAI,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,IAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;oBACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;oBACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;oBACzE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;oBAExD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;wBAChE,IAAI,CAAC;4BACD,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;4BACjE,EAAE,CAAC,KAAK,EAAE,CAAC;wBACf,CAAC;wBAAC,MAAM,CAAC;4BACL,SAAS;wBACb,CAAC;oBACL,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,sDAAsD;QAC1D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,OAAwB,EAAE,EAAE;YACxD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE;gBACrB,EAAE;gBACF,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aAC3D,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC5C,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAE/C,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAChB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAChB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAgC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACnC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB;QACrB,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CACT,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC1B,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;wBAClB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;wBACvC,OAAO,EAAE,CAAC;oBACd,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CACL,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,UAAU;QACN,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtC,IAAI,IAAI,EAAE,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC;wBACR,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;wBAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,IAAI,EAAE,QAAQ;qBACjB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,OAAO;QACH,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,EAAE,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;;AAvJL,sDAwJC"}
+{"version":3,"file":"cli-event-socket-manager.js","sourceRoot":"","sources":["../../../src/services/cli-event-socket-manager.ts"],"names":[],"mappings":";;;AAAA,2BAAgD;AAEhD,6BAA0B;AAC1B,2EAAqE;AAErE,4CAA+C;AAC/C,6DAAqG;AACrG,6DAA4E;AAC5E,mEAA8D;AAE9D,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,aAAa,CAAC,CAAC;AAgC3C,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAa,qBAAqB;IACtB,IAAI,GAA2B,IAAI,CAAC;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAAa,CAAC;IAChC,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,aAAa,CAAyB;IAC/C,aAAa,GAAG,CAAC,CAAC;IAClB,KAAK,CAAkB;IACvB,eAAe,CAAY;IAClB,WAAW,CAAmB;IAC9B,aAAa,GAAG,IAAI,2CAAmB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9E,YAAY,UAAwC,EAAE;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,kDAAsB,CAAC;YAC5C,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;IACnD,CAAC;IAED,4FAA4F;IAC5F,OAAO,CAAC,IAAgC;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,iBAAiB,CAAC,OAA6B;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,eAAe,CAAC,OAAgB;QAC5B,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,YAAY;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;IACtC,CAAC;IAED,mEAAmE;IACnE,IAAI,aAAa;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;IACvC,CAAC;IAED,kEAAkE;IAClE,IAAI,YAAY;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAEO,MAAM,CAAU,WAAW,GAAG,IAAI,GAAG,CAAC;QAC1C,oBAAoB;QACpB,iBAAiB;KACpB,CAAC,CAAC;IAEK,MAAM,CAAU,WAAW,GAAG,IAAI,GAAG,CAAC;QAC1C,mBAAmB;QACnB,gBAAgB;KACnB,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,MAAc;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,oBAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC3C,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,SAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,CAAC,iDAAiD;YAC7D,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEjC,IAAI,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,IAAA,oCAAkB,EAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAC9H,CAAC,MAAM,EAAE,EAAE;oBACP,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;wBACb,IAAA,+BAAa,EAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;wBACrC,OAAO;oBACX,CAAC;oBACD,IAAI,CAAC,IAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;wBACnD,IAAI,CAAC,IAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC3D,CAAC,CAAC,CAAC;gBACP,CAAC,EACD,GAAG,EAAE,CAAC,IAAA,+BAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CACnC,CAAC;gBACF,OAAO;YACX,CAAC;YAED,IAAI,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,6DAA6D;gBAC7D,8DAA8D;gBAC9D,IAAA,oCAAkB,EAAC,OAAO,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBACxH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;wBACb,IAAA,+BAAa,EAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;wBACrC,OAAO;oBACX,CAAC;oBACD,IAAI,CAAC,IAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;wBACnD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BACzD,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;4BAC7D,IAAI,CAAC;gCACD,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;4BAClC,CAAC;4BAAC,MAAM,CAAC;gCACL,SAAS;4BACb,CAAC;wBACL,CAAC,CAAC,CAAC;oBACP,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,sDAAsD;QAC1D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,OAAwB,EAAE,IAA2B,EAAE,EAAE;YACrF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE;gBACrB,EAAE;gBACF,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;gBACxD,IAAI;aACP,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC5C,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAE/C,MAAM,YAAY,GAAG,GAAG,EAAE;gBACtB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC,CAAC;gBAClE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC;YACF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC7B,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAgC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAChE,MAAM,OAAO,GAAgB,EAAE,CAAC;QAEhC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI;gBAAE,SAAS;YAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC;YAE5C,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,kDAAkD;gBAClD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;oBAAE,SAAS;gBACtD,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;oBACtF,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACrB,CAAC;gBACD,SAAS;YACb,CAAC;YAED,iEAAiE;YACjE,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YAE9C,IAAI,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;gBAC5B,uDAAuD;gBACvD,MAAM,MAAM,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC,CAAC,sCAAoB,CAAC,QAAQ;oBAC/B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;wBACrB,CAAC,CAAC,sCAAoB,CAAC,QAAQ;wBAC/B,CAAC,CAAC,SAAS,CAAC;gBACpB,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAAE,SAAS;YAC/E,CAAC;YAED,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB;QACrB,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CACT,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC1B,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;wBAClB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;wBACvC,OAAO,EAAE,CAAC;oBACd,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CACL,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,UAAU;QACN,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtC,IAAI,IAAI,EAAE,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC;wBACR,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;wBAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,IAAI,EAAE,QAAQ;qBACjB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,OAAO;QACH,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,EAAE,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;;AAvPL,sDAwPC"}

package/dist/src/services/cli-log-socket-manager.d.ts

@@ -1,4 +1,5 @@
 import type { Server } from 'http';
+import { ICliServerAuth } from '../auth/cli-server-auth';
 /** Information about a connected WebSocket log-streaming client. */
 export interface CliLogWebSocketClientInfo {
     id: string;
@@ -11,12 +12,25 @@ export interface CliLogWebSocketClientInfo {
  * Manages WebSocket connections for streaming log messages to clients.
  *
  * Parity with CliLogSocketManager in the .NET and Python servers.
- * Handles `/ws/v1/qcli/logs` and `/ws/qcli/logs` upgrade paths.
+ * Handles `/ws/v1/qcli/logs` and `/ws/qcli/logs` upgrade paths. Sockets
+ * authenticated with a stored session are bound to it: once it ends they are
+ * closed with 4401 `session ended` (see {@link SessionBoundSockets}).
  */
 export declare class CliLogSocketManager {
     private _wss;
     private readonly _clients;
     private _nextClientId;
+    private _auth?;
+    private _allowedOrigins?;
+    private readonly _trustProxy;
+    private readonly _sessionBound;
+    constructor(options?: {
+        allowedOrigins?: string[];
+        trustProxy?: boolean | number;
+    });
+    /** Installs the auth provider; when it protects the server, upgrades need a ticket and `logs:read`. */
+    setAuth(auth: ICliServerAuth | undefined): void;
+    setAllowedOrigins(origins: string[] | undefined): void;
     private static readonly LOG_PATHS;
     /**
      * Check whether a log at `logLevel` passes the `filterLevel` gate.

package/dist/src/services/cli-log-socket-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-log-socket-manager.d.ts","sourceRoot":"","sources":["../../../src/services/cli-log-socket-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAmB,MAAM,MAAM,CAAC;AAMpD,oEAAoE;AACpE,MAAM,WAAW,yBAAyB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CAChB;AAsCD;;;;;GAKG;AACH,qBAAa,mBAAmB;IAC5B,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAG9B;IAEH;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAY3E;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;IAUzF;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAgB5B;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAsB5E;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAsB1C;;OAEG;IACH,UAAU,IAAI,yBAAyB,EAAE;IAgBzC,kEAAkE;IAClE,OAAO,IAAI,IAAI;IAQf,OAAO,CAAC,iBAAiB;CAyB5B"}
+{"version":3,"file":"cli-log-socket-manager.d.ts","sourceRoot":"","sources":["../../../src/services/cli-log-socket-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAmB,MAAM,MAAM,CAAC;AAGpD,OAAO,EAA8C,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAMrG,oEAAoE;AACpE,MAAM,WAAW,yBAAyB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CAChB;AAsCD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC5B,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,KAAK,CAAC,CAAiB;IAC/B,OAAO,CAAC,eAAe,CAAC,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;gBAE/C,OAAO,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAO;IAKtF,uGAAuG;IACvG,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI;IAK/C,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI;IAItD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAG9B;IAEH;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAY3E;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;IAUzF;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAmC5B;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAsB5E;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB1C;;OAEG;IACH,UAAU,IAAI,yBAAyB,EAAE;IAgBzC,kEAAkE;IAClE,OAAO,IAAI,IAAI;IASf,OAAO,CAAC,iBAAiB;CAwB5B"}

package/dist/src/services/cli-log-socket-manager.js

@@ -4,6 +4,9 @@ exports.CliLogSocketManager = void 0;
 const ws_1 = require("ws");
 const url_1 = require("url");
 const logger_1 = require("../utils/logger");
+const cli_server_auth_1 = require("../auth/cli-server-auth");
+const ws_upgrade_auth_1 = require("../auth/ws-upgrade-auth");
+const session_bound_sockets_1 = require("./session-bound-sockets");
 const logger = (0, logger_1.createLogger)('LogSocket');
 /**
  * Level ordering from lowest to highest severity.
@@ -34,12 +37,30 @@ function normalizeLevel(level) {
  * Manages WebSocket connections for streaming log messages to clients.
  *
  * Parity with CliLogSocketManager in the .NET and Python servers.
- * Handles `/ws/v1/qcli/logs` and `/ws/qcli/logs` upgrade paths.
+ * Handles `/ws/v1/qcli/logs` and `/ws/qcli/logs` upgrade paths. Sockets
+ * authenticated with a stored session are bound to it: once it ends they are
+ * closed with 4401 `session ended` (see {@link SessionBoundSockets}).
  */
 class CliLogSocketManager {
     _wss = null;
     _clients = new Map();
     _nextClientId = 1;
+    _auth;
+    _allowedOrigins;
+    _trustProxy;
+    _sessionBound = new session_bound_sockets_1.SessionBoundSockets();
+    constructor(options = {}) {
+        this._allowedOrigins = options.allowedOrigins;
+        this._trustProxy = options.trustProxy ?? false;
+    }
+    /** Installs the auth provider; when it protects the server, upgrades need a ticket and `logs:read`. */
+    setAuth(auth) {
+        this._auth = auth;
+        this._sessionBound.setAuth(auth);
+    }
+    setAllowedOrigins(origins) {
+        this._allowedOrigins = origins;
+    }
     static LOG_PATHS = new Set([
         '/ws/v1/qcli/logs',
         '/ws/qcli/logs',
@@ -79,14 +100,31 @@ class CliLogSocketManager {
     attach(server) {
         this._wss = new ws_1.WebSocketServer({ noServer: true });
         server.on('upgrade', (request, socket, head) => {
-            const parsed = new url_1.URL(request.url ?? '', 'http://localhost');
+            let parsed;
+            try {
+                parsed = new url_1.URL(request.url ?? '', 'http://localhost');
+            }
+            catch {
+                return; // malformed request target: not one of our paths
+            }
             const pathname = parsed.pathname;
             if (!CliLogSocketManager.LOG_PATHS.has(pathname))
                 return;
-            this._wss.handleUpgrade(request, socket, head, (ws) => {
-                const levelFilter = parsed.searchParams.get('level') || null;
-                this._handleConnection(ws, request, levelFilter);
-            });
+            (0, ws_upgrade_auth_1.authorizeWsUpgrade)(request, parsed, {
+                auth: this._auth,
+                allowedOrigins: this._allowedOrigins,
+                trustProxy: this._trustProxy,
+                permission: cli_server_auth_1.CliServerPermissions.LogsRead,
+            }).then((result) => {
+                if (!result.ok) {
+                    (0, ws_upgrade_auth_1.rejectUpgrade)(socket, result.status);
+                    return;
+                }
+                this._wss.handleUpgrade(request, socket, head, (ws) => {
+                    const levelFilter = parsed.searchParams.get('level') || null;
+                    this._handleConnection(ws, request, levelFilter, result.ctx);
+                });
+            }, () => (0, ws_upgrade_auth_1.rejectUpgrade)(socket, 401));
         });
     }
     /**
@@ -131,6 +169,7 @@ class CliLogSocketManager {
             }
         }
         await Promise.all(promises);
+        this._sessionBound.dispose();
         this._clients.clear();
     }
     /**
@@ -153,13 +192,14 @@ class CliLogSocketManager {
     }
     /** Terminates all connections and closes the WebSocket server. */
     dispose() {
+        this._sessionBound.dispose();
         for (const entry of this._clients.values()) {
             entry.ws.terminate();
         }
         this._clients.clear();
         this._wss?.close();
     }
-    _handleConnection(ws, request, levelFilter) {
+    _handleConnection(ws, request, levelFilter, auth) {
         const id = `log-${this._nextClientId++}`;
         const entry = {
             id,
@@ -169,16 +209,16 @@ class CliLogSocketManager {
             levelFilter,
         };
         this._clients.set(id, entry);
+        this._sessionBound.bind(ws, auth);
         ws.send(JSON.stringify({ type: 'connected' }));
         logger.info('Log client connected (id=%s, level=%s)', id, levelFilter ?? 'all');
-        ws.on('close', () => {
-            logger.info('Log client disconnected (id=%s)', id);
-            this._clients.delete(id);
-        });
-        ws.on('error', () => {
+        const disconnected = () => {
             logger.info('Log client disconnected (id=%s)', id);
+            this._sessionBound.unbind(ws);
             this._clients.delete(id);
-        });
+        };
+        ws.on('close', disconnected);
+        ws.on('error', disconnected);
     }
 }
 exports.CliLogSocketManager = CliLogSocketManager;

package/dist/src/services/cli-log-socket-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-log-socket-manager.js","sourceRoot":"","sources":["../../../src/services/cli-log-socket-manager.ts"],"names":[],"mappings":";;;AAAA,2BAAgD;AAEhD,6BAA0B;AAC1B,4CAA+C;AAE/C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,WAAW,CAAC,CAAC;AAmBzC;;;GAGG;AACH,MAAM,WAAW,GAA2B;IACxC,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,CAAC;IACd,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACX,CAAC;AAEF;;;GAGG;AACH,MAAM,aAAa,GAA2B;IAC1C,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,OAAO;CACf,CAAC;AAEF,SAAS,cAAc,CAAC,KAAa;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAa,mBAAmB;IACpB,IAAI,GAA2B,IAAI,CAAC;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,aAAa,GAAG,CAAC,CAAC;IAElB,MAAM,CAAU,SAAS,GAAG,IAAI,GAAG,CAAC;QACxC,kBAAkB;QAClB,eAAe;KAClB,CAAC,CAAC;IAEH;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,WAA0B,EAAE,QAAgB;QAC7D,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAErD,6BAA6B;QAC7B,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAEjE,OAAO,MAAM,IAAI,SAAS,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAAa,EAAE,OAAe,EAAE,QAAwB;QAC5E,OAAO,IAAI,CAAC,SAAS,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;YAC5B,OAAO;YACP,QAAQ,EAAE,QAAQ,IAAI,IAAI;SAC7B,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAAc;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,oBAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,IAAI,SAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEjC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO;YAEzD,IAAI,CAAC,IAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBACnD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;gBAC7D,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,QAAwB;QACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAErC,IAAI,SAAS,GAAkB,IAAI,CAAC;QAEpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI;gBAAE,SAAS;YACrD,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;gBAAE,SAAS;YAE3E,uDAAuD;YACvD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC;gBACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACL,4DAA4D;YAChE,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB;QACrB,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACzC,QAAQ,CAAC,IAAI,CACT,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC1B,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE;wBAC9B,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;wBAC7C,OAAO,EAAE,CAAC;oBACd,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CACL,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,UAAU;QACN,MAAM,MAAM,GAAgC,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC;oBACR,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;oBAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,IAAI,EAAE,MAAM;iBACf,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,OAAO;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,iBAAiB,CAAC,EAAa,EAAE,OAAwB,EAAE,WAA0B;QACzF,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAmB;YAC1B,EAAE;YACF,EAAE;YACF,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;YACxD,WAAW;SACd,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAE7B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,EAAE,WAAW,IAAI,KAAK,CAAC,CAAC;QAEhF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAChB,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAChB,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACP,CAAC;;AAnKL,kDAoKC"}
+{"version":3,"file":"cli-log-socket-manager.js","sourceRoot":"","sources":["../../../src/services/cli-log-socket-manager.ts"],"names":[],"mappings":";;;AAAA,2BAAgD;AAEhD,6BAA0B;AAC1B,4CAA+C;AAC/C,6DAAqG;AACrG,6DAA4E;AAC5E,mEAA8D;AAE9D,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,WAAW,CAAC,CAAC;AAmBzC;;;GAGG;AACH,MAAM,WAAW,GAA2B;IACxC,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,CAAC;IACd,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACX,CAAC;AAEF;;;GAGG;AACH,MAAM,aAAa,GAA2B;IAC1C,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,OAAO;CACf,CAAC;AAEF,SAAS,cAAc,CAAC,KAAa;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAa,mBAAmB;IACpB,IAAI,GAA2B,IAAI,CAAC;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,aAAa,GAAG,CAAC,CAAC;IAClB,KAAK,CAAkB;IACvB,eAAe,CAAY;IAClB,WAAW,CAAmB;IAC9B,aAAa,GAAG,IAAI,2CAAmB,EAAE,CAAC;IAE3D,YAAY,UAAwE,EAAE;QAClF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;IACnD,CAAC;IAED,uGAAuG;IACvG,OAAO,CAAC,IAAgC;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,iBAAiB,CAAC,OAA6B;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACnC,CAAC;IAEO,MAAM,CAAU,SAAS,GAAG,IAAI,GAAG,CAAC;QACxC,kBAAkB;QAClB,eAAe;KAClB,CAAC,CAAC;IAEH;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,WAA0B,EAAE,QAAgB;QAC7D,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAErD,6BAA6B;QAC7B,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAEjE,OAAO,MAAM,IAAI,SAAS,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAAa,EAAE,OAAe,EAAE,QAAwB;QAC5E,OAAO,IAAI,CAAC,SAAS,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;YAC5B,OAAO;YACP,QAAQ,EAAE,QAAQ,IAAI,IAAI;SAC7B,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAAc;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,oBAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC3C,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,SAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,CAAC,iDAAiD;YAC7D,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEjC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO;YAEzD,IAAA,oCAAkB,EAAC,OAAO,EAAE,MAAM,EAAE;gBAChC,IAAI,EAAE,IAAI,CAAC,KAAK;gBAChB,cAAc,EAAE,IAAI,CAAC,eAAe;gBACpC,UAAU,EAAE,IAAI,CAAC,WAAW;gBAC5B,UAAU,EAAE,sCAAoB,CAAC,QAAQ;aAC5C,CAAC,CAAC,IAAI,CACH,CAAC,MAAM,EAAE,EAAE;gBACP,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACb,IAAA,+BAAa,EAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACrC,OAAO;gBACX,CAAC;gBACD,IAAI,CAAC,IAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;oBACnD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;oBAC7D,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,CAAC,CAAC,CAAC;YACP,CAAC,EACD,GAAG,EAAE,CAAC,IAAA,+BAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CACnC,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,QAAwB;QACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAErC,IAAI,SAAS,GAAkB,IAAI,CAAC;QAEpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI;gBAAE,SAAS;YACrD,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;gBAAE,SAAS;YAE3E,uDAAuD;YACvD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC;gBACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACL,4DAA4D;YAChE,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB;QACrB,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACzC,QAAQ,CAAC,IAAI,CACT,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC1B,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE;wBAC9B,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;wBAC7C,OAAO,EAAE,CAAC;oBACd,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CACL,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,UAAU;QACN,MAAM,MAAM,GAAgC,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC;oBACR,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;oBAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,IAAI,EAAE,MAAM;iBACf,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,OAAO;QACH,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,iBAAiB,CAAC,EAAa,EAAE,OAAwB,EAAE,WAA0B,EAAE,IAA2B;QACtH,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAmB;YAC1B,EAAE;YACF,EAAE;YACF,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;YACxD,WAAW;SACd,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAElC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,EAAE,WAAW,IAAI,KAAK,CAAC,CAAC;QAEhF,MAAM,YAAY,GAAG,GAAG,EAAE;YACtB,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC;QACF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7B,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjC,CAAC;;AA1ML,kDA2MC"}

package/dist/src/services/cli-shell-options.d.ts

@@ -0,0 +1,107 @@
+import type { IncomingMessage } from 'http';
+/** How the remote shell decides who may open a session (`shellAuth` in `/capabilities`). */
+export type CliShellAuthMode = 'users' | 'token' | 'custom' | 'anonymous' | 'locked';
+/** Extra information handed to a custom {@link CliShellOptions.authorize} check. */
+export interface CliShellAuthorizeContext {
+    /** Parsed upgrade URL (path + query). */
+    url: URL;
+    /** Remote address of the socket. */
+    remoteAddress: string;
+    /** `interactive` shell or one-shot `command` (`?cmd=`). */
+    mode: 'interactive' | 'command';
+}
+/** Environment of the shell child process. */
+export interface CliShellEnvOptions {
+    /** Extra server environment variable names copied into the shell (e.g. `['NODE_ENV']`). */
+    allow?: string[];
+    /** Fixed values set in the shell environment (applied last). */
+    set?: Record<string, string>;
+}
+/**
+ * Remote shell security options (`createCliServer({ enableShell: true, shell: {...} })`).
+ *
+ * The shell is only reachable when `enableShell` is true; access is then decided by
+ * exactly one mode: `users` (users plugin mounted: ticket + `shell:execute`),
+ * `token`, `custom` (`authorize`), or `anonymous` (`allowAnonymous`). With none of
+ * them the shell is **locked** (every connection closed with 4401).
+ */
+export interface CliShellOptions {
+    /**
+     * Shared secret. Clients send `Authorization: Bearer <token>` (header, or the
+     * `_header_Authorization` query parameter used by browser clients). Compared in
+     * constant time, never logged. Always required when set (also with the users
+     * plugin and together with `authorize`).
+     */
+    token?: string;
+    /**
+     * Host-defined check (headers, query, remote address). Thrown errors and
+     * rejections deny. Always required when set (also with the users plugin and
+     * together with `token`).
+     */
+    authorize?: (request: IncomingMessage, context: CliShellAuthorizeContext) => boolean | Promise<boolean>;
+    /**
+     * Open the shell to anyone who can reach the server (logs a startup WARNING).
+     * Ignored once `token` or `authorize` is set.
+     */
+    allowAnonymous?: boolean;
+    /** Concurrent shells per user (users mode) or per remote address (other modes). Default 3. */
+    maxSessionsPerUser?: number;
+    /** Concurrent shells in total. Default 20. */
+    maxSessions?: number;
+    /** Close a shell after this long without stdin (ms). Default 15 minutes; 0 disables. */
+    idleTimeoutMs?: number;
+    /** Close a shell after this long regardless of activity (ms). Default: no limit. */
+    maxDurationMs?: number;
+    /**
+     * How often open users-mode shells re-check their session and `shell:execute` (ms).
+     * Default 30 000, maximum 60 000. Session/user/group changes trigger an immediate re-check.
+     */
+    sessionCheckIntervalMs?: number;
+    /** Working directory of the shell. Default: the server user's home directory. */
+    cwd?: string;
+    /** Shell binary. Default: detected (`$SHELL`, bash, sh; powershell on Windows). */
+    shell?: string;
+    /** Shell environment: a minimal base plus `allow` / `set`. */
+    env?: CliShellEnvOptions;
+}
+export declare const SHELL_DEFAULTS: {
+    readonly maxSessionsPerUser: 3;
+    readonly maxSessions: 20;
+    readonly idleTimeoutMs: number;
+    readonly sessionCheckIntervalMs: number;
+    readonly maxSessionCheckIntervalMs: number;
+    /** stdin touches the users session at most this often. */
+    readonly touchIntervalMs: number;
+};
+/** WebSocket close codes used by the shell socket (accept, then close). */
+export declare const ShellCloseCodes: {
+    readonly LoginRequired: 4401;
+    readonly Forbidden: 4403;
+    readonly Disabled: 4404;
+    readonly TimedOut: 4408;
+    readonly TooMany: 4429;
+};
+/**
+ * Resolves the access mode (`shellAuth`). Users plugin mounted ⇒ `users`; otherwise
+ * `token` before `custom`, then `anonymous`; otherwise `locked`. Every configured
+ * check among token/authorize must pass whatever the reported mode.
+ */
+export declare function resolveShellAuthMode(options: CliShellOptions | undefined, usersMounted: boolean): CliShellAuthMode;
+/** Constant-time comparison of a presented token with the configured secret. */
+export declare function tokensEqual(presented: string, expected: string): boolean;
+/**
+ * Bearer token from the `Authorization` header or, for browser clients that
+ * cannot set WebSocket headers, the `_header_Authorization` query parameter.
+ */
+export declare function readBearerToken(request: IncomingMessage, url: URL): string | undefined;
+/**
+ * Builds the minimal shell environment: `PATH`, `HOME`, `USER`, `LANG`, `TERM`,
+ * `COLUMNS`, `LINES`, `SHELL` (plus the Windows essentials on win32), then the
+ * `allow`-listed server variables, then the fixed `set` values.
+ */
+export declare function buildShellEnv(options: CliShellEnvOptions | undefined, info: {
+    shell: string;
+    cols: number;
+    rows: number;
+}, source?: NodeJS.ProcessEnv): Record<string, string>;
+//# sourceMappingURL=cli-shell-options.d.ts.map

package/dist/src/services/cli-shell-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-shell-options.d.ts","sourceRoot":"","sources":["../../../src/services/cli-shell-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAI5C,4FAA4F;AAC5F,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAErF,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACrC,yCAAyC;IACzC,GAAG,EAAE,GAAG,CAAC;IACT,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CACnC;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IAC/B,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxG;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,eAAO,MAAM,cAAc;;;;;;IAMvB,0DAA0D;;CAEpD,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,EAAE,YAAY,EAAE,OAAO,GAAG,gBAAgB,CAMlH;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIxE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CAatF;AAMD;;;;GAIG;AACH,wBAAgB,aAAa,CACzB,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnD,MAAM,GAAE,MAAM,CAAC,UAAwB,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BxB"}