@saluzi/saluzi-edu 0.2.31 → 0.2.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saluzi/saluzi-edu",
-  "version": "0.2.31",
+  "version": "0.2.33",
   "description": "Saluzi CLI - interactive AI coding assistant in the terminal",
   "license": "MIT",
   "type": "module",
@@ -58,6 +58,8 @@
     "check:unused": "knip-bun",
     "health": "bun run scripts/health-check.ts",
     "docs:dev": "npx mintlify dev",
+    "build:guide": "vite build packages/guide-web && bun run scripts/build-guide.ts",
+    "dev:guide": "vite dev packages/guide-web",
     "typecheck": "tsc --noEmit",
     "precheck": "bun run typecheck && bun run check:fix && bun test --isolate",
     "rcs": "bun run scripts/rcs.ts",

package/packages/remote-control-server/src/routes/acp/index.ts

@@ -1,4 +1,5 @@
 import { Hono } from 'hono'
+import { getCookie } from 'hono/cookie'
 import { randomUUID } from 'node:crypto'
 import type { Context } from 'hono'
 import type { UpgradeWebSocket } from 'hono/ws'
@@ -14,6 +15,8 @@ import {
 } from '../../auth/middleware'
 import { validateApiKey } from '../../auth/api-key'
 import { resolveToken } from '../../auth/token'
+import { resolveSessionToken } from '../../auth/session'
+import { getDb } from '../../db/sqlite'
 import {
   handleAcpWsOpen,
   handleAcpWsMessage,
@@ -55,9 +58,47 @@ function toAcpAgentResponse(env: ReturnType<typeof storeGetEnvironment> & {}) {
   }
 }
 
+/**
+ * Resolve a Web UI user's token (SQLite session token from cookie or
+ * Bearer) to a userId. Returns null if the token is invalid or absent.
+ *
+ * Web UI users authenticate via rct_* SQLite session tokens stored in the
+ * rcs_access cookie (or Bearer for API calls). ACP read/relay endpoints
+ * must accept these in addition to admin API keys, otherwise non-admin
+ * users can list ACP sessions (via /web/sessions with sessionAuth) but
+ * can't open them (ACP endpoints reject with 401 "unauthorized").
+ */
+function resolveWebUserToken(c: Context): string | null {
+  // Cookie (rcs_access) — primary Web UI auth path for WebSocket upgrades.
+  // Wrapped because getCookie accesses c.req.raw.headers, which may not
+  // exist on mock contexts in unit tests.
+  let cookieToken: string | undefined
+  try {
+    cookieToken = getCookie(c, 'rcs_access')
+  } catch {
+    cookieToken = undefined
+  }
+  // Bearer — for REST calls from Web UI (Authorization header)
+  const bearerToken = extractBearerToken(c)
+  const token = cookieToken || bearerToken
+  if (!token) return null
+  // Try in-memory token (legacy issueToken flow)
+  const username = resolveToken(token)
+  if (username) return username
+  // Try SQLite session token
+  try {
+    return resolveSessionToken(token, getDb())
+  } catch {
+    return null
+  }
+}
+
 function hasAcpReadAuth(c: Context): boolean {
-  const token = extractBearerToken(c)
-  return !!token && validateApiKey(token)
+  // Admin API key (RCS_API_KEYS)
+  const bearer = extractBearerToken(c)
+  if (bearer && validateApiKey(bearer)) return true
+  // Web UI user (SQLite session token or in-memory token)
+  return !!resolveWebUserToken(c)
 }
 
 /**
@@ -68,10 +109,36 @@ function hasAcpReadAuth(c: Context): boolean {
  */
 export function hasAcpRelayAuth(c: Context): boolean {
   const token = extractWebSocketAuthToken(c)
-  if (!token) return false
-  if (validateApiKey(token)) return true
-  // Try session token resolution (in-memory issueToken tokens)
-  return !!resolveToken(token)
+  if (token) {
+    if (validateApiKey(token)) return true
+    // Try in-memory token resolution (existing issueToken flow)
+    if (resolveToken(token)) return true
+    // Try SQLite session token (rct_* from Bearer or Sec-WebSocket-Protocol)
+    try {
+      if (resolveSessionToken(token, getDb())) return true
+    } catch {
+      // DB unavailable — fall through to cookie check
+    }
+  }
+  // Cookie-based session token (rcs_access) — browser WebSocket upgrades
+  // automatically send cookies, so this works without client-side token
+  // injection. Wrapped because getCookie accesses c.req.raw.headers,
+  // which may not exist on mock contexts in unit tests.
+  let cookieToken: string | undefined
+  try {
+    cookieToken = getCookie(c, 'rcs_access')
+  } catch {
+    cookieToken = undefined
+  }
+  if (cookieToken) {
+    if (resolveToken(cookieToken)) return true
+    try {
+      if (resolveSessionToken(cookieToken, getDb())) return true
+    } catch {
+      return false
+    }
+  }
+  return false
 }
 
 function acpReadUnauthorized(c: Context) {