@rubytech/create-realagent 1.0.812 → 1.0.813

package/payload/server/public/index.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Real Agent</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/admin-w4mS-Tne.js"></script>
+  <script type="module" crossorigin src="/assets/admin-D_1VXUmN.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-DD-I1_y5.js">
   <link rel="modulepreload" crossorigin href="/assets/jsx-runtime-DOYWvSKw.js">
   <link rel="modulepreload" crossorigin href="/assets/preload-helper-qlgyTAkD.js">

package/payload/server/server.js

@@ -45,6 +45,7 @@ import {
   sleep,
   streamLogPathFor,
   stripAttachmentMetaSuffix,
+  tryCookieBridgeForConversation,
   validateKey,
   validatePasswordStrength,
   verifyPassword,
@@ -52,7 +53,7 @@ import {
   vncLog,
   waitForExit,
   writeChromiumWrapper
-} from "./chunk-6UFBDVWR.js";
+} from "./chunk-KKC4IV6I.js";
 import {
   agentLogStream,
   clearSessionHistory,
@@ -80,7 +81,7 @@ import {
   sigtermFlushStreamLogs,
   unregisterSession,
   validateSession
-} from "./chunk-D2JKNYRK.js";
+} from "./chunk-WK6KSHPD.js";
 import {
   ACCOUNTS_DIR,
   GREETING_DIRECTIVE,
@@ -120,7 +121,7 @@ import {
   verifyAndGetConversationUpdatedAt,
   verifyConversationOwnership,
   writeAdminUserAndPerson
-} from "./chunk-FMNXMQIL.js";
+} from "./chunk-TQTMKIW6.js";
 
 // ../lib/graph-trash/dist/index.js
 var require_dist = __commonJS({
@@ -8707,7 +8708,7 @@ var app11 = new Hono();
 app11.post("/cancel", requireAdminSession, async (c) => {
   const session_key = c.var.sessionKey;
   try {
-    const { interruptClient: interruptClient2 } = await import("./client-pool-VW3EE2YD.js");
+    const { interruptClient: interruptClient2 } = await import("./client-pool-KUFFECZC.js");
     await interruptClient2(session_key);
     return c.json({ ok: true });
   } catch (err) {
@@ -9643,9 +9644,38 @@ app17.delete("/:id", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to delete session" }, 500);
   }
 });
-app17.get("/:id/messages", requireAdminSession, async (c) => {
+app17.get("/:id/messages", async (c) => {
   const conversationId = c.req.param("id");
-  const sessionKey = c.var.sessionKey;
+  const sessionKey = c.req.query("session_key") ?? "";
+  if (!sessionKey) {
+    console.error(`[session] middleware-reject status=400 code=session-missing reason="session_key required" path=${c.req.path}`);
+    return c.json({ error: "session_key required", code: "session-missing" }, 400);
+  }
+  let result = validateSession(sessionKey, "admin");
+  if (!result.ok) {
+    if (result.reason === "session-not-registered") {
+      const bridge = await tryCookieBridgeForConversation(c, sessionKey, conversationId);
+      if (!bridge.ok) {
+        if (bridge.reason === "conversation-not-found") {
+          return c.json({ error: "Conversation not found" }, 404);
+        }
+        const tail = sessionKey.slice(0, 8);
+        console.error(`[session] middleware-reject status=401 code=session-not-registered reason="cookie-bridge-rejected:${bridge.reason}" path=${c.req.path} sessionKey=${tail}\u2026`);
+        return c.json({ error: "Invalid or expired admin session", code: "session-not-registered" }, 401);
+      }
+      result = validateSession(sessionKey, "admin");
+      if (!result.ok) {
+        const tail = sessionKey.slice(0, 8);
+        console.error(`[session] middleware-reject status=401 code=session-not-registered reason="post-bridge re-validate failed" path=${c.req.path} sessionKey=${tail}\u2026`);
+        return c.json({ error: "Invalid or expired admin session", code: "session-not-registered" }, 401);
+      }
+    } else {
+      const tail = sessionKey.slice(0, 8);
+      const wireCode = result.reason === "agent-type-mismatch" ? "session-not-registered" : result.reason;
+      console.error(`[session] middleware-reject status=401 code=${wireCode} reason="invalid or expired admin session" path=${c.req.path} sessionKey=${tail}\u2026`);
+      return c.json({ error: "Invalid or expired admin session", code: wireCode }, 401);
+    }
+  }
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
   const owned = await verifyConversationOwnership(conversationId, accountId);