@saluzi/saluzi-edu 0.2.64 → 0.2.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saluzi/saluzi-edu",
-  "version": "0.2.64",
+  "version": "0.2.66",
   "description": "Saluzi CLI - interactive AI coding assistant in the terminal",
   "license": "MIT",
   "type": "module",

package/packages/remote-control-server/src/__tests__/attach-code.test.ts

@@ -16,6 +16,7 @@ import {
   storeCreateEnvironment,
   storeIssueAttachCode,
   storeConsumeAttachCode,
+  storeAttachCodesSize,
 } from '../store'
 import { initDatabase, resetDbSingleton, getDb } from '../db/sqlite'
 import { issueSessionToken } from '../auth/session'
@@ -172,6 +173,17 @@ describe('attach codes', () => {
     expect(storeConsumeAttachCode(record.code)).toBeNull()
   })
 
+  test('unconsumed expired codes are swept on the next issue (memory hygiene)', () => {
+    expect(storeAttachCodesSize()).toBe(0)
+    // Expired immediately and never presented — consume() would never see it.
+    storeIssueAttachCode(sessionId, -1000)
+    expect(storeAttachCodesSize()).toBe(1)
+    // The next issue sweeps it instead of letting it accumulate forever.
+    const live = storeIssueAttachCode(sessionId)
+    expect(storeAttachCodesSize()).toBe(1)
+    expect(storeConsumeAttachCode(live.code)?.sessionId).toBe(sessionId)
+  })
+
   test('missing code or environment_id → 400', async () => {
     const res = await app.request('/v1/sessions/attach-code/exchange', {
       method: 'POST',

package/packages/remote-control-server/src/__tests__/attach-wait.test.ts

@@ -30,6 +30,7 @@ import { storeBindSession } from '../store'
  * - POST /v1/environments/bridge persists session_mode:'attach'.
  * - GET /v1/environments/:id/assignment returns the first open non-ACP
  *   session on the env (assigned:false until the Web UI binds one).
+ *   Gated on env ownership (admin bypasses; unowned envs stay open).
  * - GET /web/environments surfaces attach_waiting for waiting workers.
  */
 
@@ -124,6 +125,116 @@ describe('Session Attach wait mode', () => {
     expect(after ?? 0).toBeGreaterThan(stale.getTime())
   })
 
+  test('assignment: owned env + owner rct token → 200 (worker polls as itself)', async () => {
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'mac1',
+      ownerUserId: owner.id,
+      sessionMode: 'attach',
+    })
+    const res = await app.request(`/v1/environments/${env.id}/assignment`, {
+      headers: { Authorization: rctAuth(owner.id) },
+    })
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ assigned: false })
+  })
+
+  test('assignment: owned env + stranger rct token → 403, heartbeat NOT refreshed', async () => {
+    // Assignment discloses the env's bound session AND is its liveness
+    // signal — neither may be driven by a third party.
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'mac1',
+      ownerUserId: owner.id,
+      sessionMode: 'attach',
+    })
+    const stale = new Date(Date.now() - 10 * 60 * 1000)
+    storeUpdateEnvironment(env.id, { lastPollAt: stale })
+
+    const stranger = createUser(db)
+    const res = await app.request(`/v1/environments/${env.id}/assignment`, {
+      headers: { Authorization: rctAuth(stranger.id) },
+    })
+    expect(res.status).toBe(403)
+    const body = (await res.json()) as { error: { type: string } }
+    expect(body.error.type).toBe('forbidden')
+    // updatePollTime runs only AFTER the gate — a 403 must not keep a dead
+    // env looking alive.
+    expect(storeGetEnvironment(env.id)?.lastPollAt?.getTime()).toBe(
+      stale.getTime(),
+    )
+  })
+
+  test('assignment: unowned env (claim pending) + any auth → 200 assigned:false', async () => {
+    // Two-phase wait (claim → attach): while unowned there is nothing to
+    // disclose, so the poll stays open to any authenticated caller.
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'unclaimed',
+      sessionMode: 'attach',
+    })
+    const stranger = createUser(db)
+    const res = await app.request(`/v1/environments/${env.id}/assignment`, {
+      headers: { Authorization: rctAuth(stranger.id) },
+    })
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ assigned: false })
+  })
+
+  test('assignment: disconnected env + authorized caller → reactivated, not 404', async () => {
+    // A wait-mode worker whose env the disconnect monitor flipped (laptop
+    // sleep during the 24h wait, pre-fix claim-wait, etc.) must recover on
+    // its next poll instead of dead-waiting on swallowed 404s — the CLI
+    // ignores assignment errors until its deadline.
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'mac1',
+      ownerUserId: owner.id,
+      sessionMode: 'attach',
+    })
+    storeUpdateEnvironment(env.id, { status: 'disconnected' })
+
+    const res = await app.request(`/v1/environments/${env.id}/assignment`, {
+      headers: { ...ADMIN_KEY },
+    })
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ assigned: false })
+    expect(storeGetEnvironment(env.id)?.status).toBe('active')
+  })
+
+  test('assignment: disconnected env + stranger → 403, env NOT reactivated', async () => {
+    // Same invariant as the heartbeat test above: a 403 must not resurrect
+    // or keep alive an env the caller has no business touching.
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'mac1',
+      ownerUserId: owner.id,
+      sessionMode: 'attach',
+    })
+    storeUpdateEnvironment(env.id, { status: 'disconnected' })
+    const stranger = createUser(db)
+
+    const res = await app.request(`/v1/environments/${env.id}/assignment`, {
+      headers: { Authorization: rctAuth(stranger.id) },
+    })
+    expect(res.status).toBe(403)
+    expect(storeGetEnvironment(env.id)?.status).toBe('disconnected')
+  })
+
+  test('assignment: deregistered env → 404 (terminal)', async () => {
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'mac1',
+      ownerUserId: owner.id,
+      sessionMode: 'attach',
+    })
+    storeUpdateEnvironment(env.id, { status: 'deregistered' })
+    const res = await app.request(`/v1/environments/${env.id}/assignment`, {
+      headers: { ...ADMIN_KEY },
+    })
+    expect(res.status).toBe(404)
+  })
+
   test('assignment: session bound to the env (web attach) → assigned with session id', async () => {
     const env = storeCreateEnvironment({
       secret: 'test-api-key',

package/packages/remote-control-server/src/__tests__/attach.test.ts

@@ -207,33 +207,62 @@ describe('POST /v1/sessions/:id/attach', () => {
     expect(body.idempotent).toBeUndefined()
   })
 
-  test('idempotent re-entry bypasses manage-rights check (doReconnect re-bind)', async () => {
-    // Wait-mode scenario: a team admin bound the session to the caller's env;
-    // the caller itself has no manage rights. The re-bind after env loss must
-    // still succeed via the same-env idempotent path.
+  test('idempotent re-entry bypasses manage-rights check for the env owner (doReconnect re-bind)', async () => {
+    // Wait-mode scenario: a team admin bound the session to the CLI worker's
+    // env; the worker itself has no manage rights on the session. The re-bind
+    // after env loss must still succeed via the same-env idempotent path —
+    // gated on env ownership (the worker owns its env), not session rights.
+    const world = seedWorld(db)
+    const cliOwner = createUser(db)
+    const cliEnv = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'cli-worker',
+      ownerUserId: cliOwner.id,
+    })
+    // The team-admin bind: the session is re-pointed to the CLI env with a
+    // live work item (bare admin API key performs the attach).
+    const first = await app.request(`/v1/sessions/${world.sessionId}/attach`, {
+      method: 'POST',
+      headers: { ...JSON_HDRS, ...ADMIN_KEY },
+      body: JSON.stringify({ environment_id: cliEnv.id }),
+    })
+    expect(first.status).toBe(200)
+    const { work_item_id } = (await first.json()) as { work_item_id: string }
+
+    // Re-entry as the CLI owner (no manage rights, owns the env) → 200 with
+    // the SAME work item.
+    const second = await app.request(`/v1/sessions/${world.sessionId}/attach`, {
+      method: 'POST',
+      headers: { ...JSON_HDRS, Authorization: rctAuth(cliOwner.id) },
+      body: JSON.stringify({ environment_id: cliEnv.id }),
+    })
+    expect(second.status).toBe(200)
+    const body = (await second.json()) as {
+      idempotent: boolean
+      work_item_id: string
+    }
+    expect(body.idempotent).toBe(true)
+    expect(body.work_item_id).toBe(work_item_id)
+  })
+
+  test('idempotent re-entry by a non-owner who knows session+env IDs → 403', async () => {
+    // The idempotent path echoes the work-item id; a random authenticated
+    // caller must not be able to probe bindings. Falls through to the full
+    // checks → manage-rights 403.
     const world = seedWorld(db)
-    const admin = createUser(db, 'admin')
-    // Attach once WITH rights (owner) so a work item exists on world.envId.
     const first = await app.request(`/v1/sessions/${world.sessionId}/attach`, {
       method: 'POST',
       headers: { ...JSON_HDRS, Authorization: rctAuth(world.owner.id) },
       body: JSON.stringify({ environment_id: world.envId }),
     })
     expect(first.status).toBe(200)
-    void admin
 
-    // Re-entry as the STRANGER (no manage rights) but same env → 200.
-    // Note: env ownership also matches the stranger? No — the env belongs to
-    // owner; but the idempotent check runs BEFORE both the access and env
-    // ownership checks, so the re-entry returns the existing binding.
     const second = await app.request(`/v1/sessions/${world.sessionId}/attach`, {
       method: 'POST',
       headers: { ...JSON_HDRS, Authorization: rctAuth(world.stranger.id) },
       body: JSON.stringify({ environment_id: world.envId }),
     })
-    expect(second.status).toBe(200)
-    const body = (await second.json()) as { idempotent: boolean }
-    expect(body.idempotent).toBe(true)
+    expect(second.status).toBe(403)
   })
 
   test("stranger's rct token → 403 (canManageSession, G9)", async () => {
@@ -284,6 +313,43 @@ describe('POST /v1/sessions/:id/attach', () => {
     expect(body.error.type).toBe('environment_unowned')
   })
 
+  test('bare admin API key attaches to an unowned env (documented worker setup)', async () => {
+    // Self-hosted workers connect with SALUZI_BRIDGE_OAUTH_TOKEN=<RCS_API_KEYS>
+    // and no SALUZI_BRIDGE_USERNAME — the env they register is unowned until
+    // claimed, and the direct-attach path never prints a claim URL. A hard
+    // 409 here made `/rc --attach <id>` fail out of the box. Bare admin keys
+    // are trusted credentials (ensureAttachAccess already audited their
+    // session-manage bypass) — the bind is allowed.
+    const owner = createUser(db)
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'cli-worker',
+    })
+    const session = createSession({
+      environment_id: null,
+      title: 'Web session',
+      source: 'web',
+    })
+    storeBindSession(session.id, owner.id, 'user')
+
+    const res = await app.request(`/v1/sessions/${session.id}/attach`, {
+      method: 'POST',
+      headers: { ...JSON_HDRS, ...ADMIN_KEY },
+      body: JSON.stringify({ environment_id: env.id }),
+    })
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as {
+      status: string
+      session_id: string
+      work_item_id: string
+      rebind: boolean
+    }
+    expect(body.status).toBe('attached')
+    expect(body.session_id).toBe(session.id)
+    expect(body.work_item_id).toMatch(/^work_/)
+    expect(body.rebind).toBe(true)
+  })
+
   test('archived session → 409 session_closed', async () => {
     const world = seedWorld(db)
     const { archiveSession } = await import('../services/session')
@@ -411,6 +477,19 @@ describe('GET /v1/sessions/attachable', () => {
     const list = (await res.json()) as Array<{ id: string }>
     expect(list.some(s => s.id === world.sessionId)).toBe(true)
   })
+
+  test('admin API key + unresolvable X-Username → 403 (consistent with attach)', async () => {
+    // An explicit-but-unknown identity is a misconfiguration, not "see
+    // everything" — the listing must be exactly as strict as
+    // POST /:id/attach's ensureAttachAccess.
+    await seedWorld(db)
+    const res = await app.request('/v1/sessions/attachable', {
+      headers: { ...ADMIN_KEY, 'X-Username': 'no_such_user_xyz' },
+    })
+    expect(res.status).toBe(403)
+    const body = (await res.json()) as { error: { type: string } }
+    expect(body.error.type).toBe('forbidden')
+  })
 })
 
 describe('GET /v1/sessions/:id/events (bridge auth)', () => {
@@ -518,4 +597,21 @@ describe('storeRebindSessionEnvironment', () => {
     storeReset()
     expect(storeRebindSessionEnvironment('ses_missing', 'env_x')).toBe(false)
   })
+
+  test('rebinding to null clears the binding (dispatch-failure rollback)', () => {
+    const db = freshDb()
+    storeReset()
+    const world = seedWorld(db)
+    const web = createSession({
+      environment_id: null,
+      title: 'Web session',
+      source: 'web',
+    })
+    expect(storeRebindSessionEnvironment(web.id, world.envId)).toBe(true)
+    expect(storeRebindSessionEnvironment(web.id, null)).toBe(true)
+    const row = db
+      .query('SELECT environment_id FROM sessions WHERE id = $id')
+      .get({ $id: web.id }) as { environment_id: string | null }
+    expect(row.environment_id).toBeNull()
+  })
 })

package/packages/remote-control-server/src/__tests__/low-priority-fixes.test.ts

@@ -10,8 +10,11 @@ import { Hono } from 'hono'
 import {
   storeReset,
   storeCreateSession,
+  storeCreateEnvironment,
   storeBindSession,
   storeListSessionsByOwnerUuid,
+  storeListSessionsByEnvironment,
+  storeGetActiveWorkItemBySession,
 } from '../store'
 import { initDatabase, resetDbSingleton } from '../db/sqlite'
 import { issueToken } from '../auth/token'
@@ -176,3 +179,95 @@ describe('M2: resolveOwnedWebSessionId removes redundant fallback', () => {
     expect(source).not.toMatch(/import\s*\{[^}]*storeIsSessionOwner[^}]*\}/)
   })
 })
+
+// =============================================================================
+// worker_at_capacity pre-validation: the repl-worker capacity check must run
+// BEFORE createSession. It used to run after, where the just-created session
+// (already bound to body.environment_id) always tripped it — every web session
+// creation on a repl worker env 409'd AND left a stray bound-but-never-
+// dispatched session behind on each retry.
+// =============================================================================
+describe('worker_at_capacity pre-validation (repl workers)', () => {
+  let app: Hono
+
+  beforeEach(() => {
+    freshDb()
+    storeReset()
+    app = createApp()
+  })
+
+  test('idle repl worker env → 200, session created AND work item dispatched', async () => {
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'cli-worker',
+      workerType: 'repl',
+    })
+    const res = await app.request('/web/sessions', {
+      method: 'POST',
+      headers: {
+        Authorization: userAuth('webuser'),
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ title: 'On Worker', environment_id: env.id }),
+    })
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as { id: string; environment_id: string }
+    expect(body.environment_id).toBe(env.id)
+    // Pre-fix the 409 returned before createWorkItem — the CLI would poll a
+    // session that never received work.
+    const work = storeGetActiveWorkItemBySession(body.id)
+    expect(work).not.toBeNull()
+    expect(work?.environmentId).toBe(env.id)
+  })
+
+  test('repl env with an open session → 409 and NO stray session left behind', async () => {
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'cli-worker',
+      workerType: 'repl',
+    })
+    storeCreateSession({
+      environmentId: env.id,
+      title: 'Existing',
+      source: 'web',
+    })
+    const before = storeListSessionsByEnvironment(env.id).length
+
+    const res = await app.request('/web/sessions', {
+      method: 'POST',
+      headers: {
+        Authorization: userAuth('webuser'),
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ title: 'Overflow', environment_id: env.id }),
+    })
+    expect(res.status).toBe(409)
+    const body = (await res.json()) as { error: { type: string } }
+    expect(body.error.type).toBe('worker_at_capacity')
+    // Pre-fix the session record was created (and bound) before the 409.
+    expect(storeListSessionsByEnvironment(env.id).length).toBe(before)
+  })
+
+  test('non-repl (spawn) env skips the capacity check', async () => {
+    const env = storeCreateEnvironment({
+      secret: 'test-api-key',
+      machineName: 'spawn-worker',
+      workerType: 'claude_code',
+      maxSessions: 4,
+    })
+    storeCreateSession({
+      environmentId: env.id,
+      title: 'Existing',
+      source: 'web',
+    })
+    const res = await app.request('/web/sessions', {
+      method: 'POST',
+      headers: {
+        Authorization: userAuth('webuser'),
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ title: 'Second', environment_id: env.id }),
+    })
+    expect(res.status).toBe(200)
+  })
+})

package/packages/remote-control-server/src/__tests__/routes.test.ts

@@ -10,6 +10,9 @@ import {
   storeCreateSession,
   storeCreateEnvironment,
   storeBindSession,
+  storeUpdateEnvironment,
+  storeGetEnvironment,
+  storeGetActiveWorkItemBySession,
 } from '../store'
 import {
   removeEventBus,
@@ -323,6 +326,72 @@ describe('V1 Session Routes', () => {
     expect(body.id).toMatch(/^session_/)
   })
 
+  test('POST /v1/sessions with environment_id refreshes env liveness (claim-wait retry loop)', async () => {
+    // An unowned env's claim-wait loop retries POST /v1/sessions every 5s
+    // (409 environment_unowned) for up to 24h — that retry IS the worker's
+    // only traffic. Without touching lastPollAt here the disconnect monitor
+    // flips the env after RCS_DISCONNECT_TIMEOUT, and when the claim finally
+    // lands the work item dispatch rejects the non-active env: a session
+    // that exists yet never receives work (the CLI polls 204s forever).
+    ensureUser('testuser')
+    const envRes = await app.request('/v1/environments/bridge', {
+      method: 'POST',
+      headers: {
+        ...AUTH_HEADERS,
+        'Content-Type': 'application/json',
+        'X-User-Id': 'testuser',
+      },
+      body: JSON.stringify({ machine_name: 'test' }),
+    })
+    const { environment_id } = await envRes.json()
+    // Age the heartbeat past the disconnect timeout, then simulate one
+    // claim-wait retry.
+    const stale = new Date(Date.now() - 10 * 60 * 1000)
+    storeUpdateEnvironment(environment_id, { lastPollAt: stale })
+    const before = storeGetEnvironment(environment_id)?.lastPollAt?.getTime()
+
+    const sessRes = await app.request('/v1/sessions', {
+      method: 'POST',
+      headers: { ...AUTH_HEADERS, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ environment_id }),
+    })
+    expect(sessRes.status).toBe(200)
+    const after = storeGetEnvironment(environment_id)?.lastPollAt?.getTime()
+    expect(after).not.toBe(before)
+    expect(after ?? 0).toBeGreaterThan(stale.getTime())
+  })
+
+  test('POST /v1/sessions reactivates a monitor-flipped env so the work item is created', async () => {
+    // Recovery path for envs already flipped to 'disconnected' (CLI waited
+    // out the timeout before these fixes, laptop sleep, etc.): the retry
+    // reactivates the env, so the session gets its work item instead of
+    // becoming a zombie the CLI polls forever.
+    ensureUser('testuser')
+    const envRes = await app.request('/v1/environments/bridge', {
+      method: 'POST',
+      headers: {
+        ...AUTH_HEADERS,
+        'Content-Type': 'application/json',
+        'X-User-Id': 'testuser',
+      },
+      body: JSON.stringify({ machine_name: 'test' }),
+    })
+    const { environment_id } = await envRes.json()
+    storeUpdateEnvironment(environment_id, { status: 'disconnected' })
+
+    const sessRes = await app.request('/v1/sessions', {
+      method: 'POST',
+      headers: { ...AUTH_HEADERS, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ environment_id }),
+    })
+    expect(sessRes.status).toBe(200)
+    const body = await sessRes.json()
+    expect(storeGetEnvironment(environment_id)?.status).toBe('active')
+    const work = storeGetActiveWorkItemBySession(body.id)
+    expect(work).not.toBeNull()
+    expect(work?.environmentId).toBe(environment_id)
+  })
+
   test('POST /v1/sessions with events — publishes initial events', async () => {
     const sessRes = await app.request('/v1/sessions', {
       method: 'POST',

package/packages/remote-control-server/src/auth/bridge-auth.ts

@@ -74,3 +74,47 @@ export function resolveUserIdUuid(
     .get({ $value: value }) as { id: string } | null
   return row?.id ?? null
 }
+
+/** Caller identity resolved for attach-family endpoints. */
+export type AttachCaller = {
+  /** Resolved users.id UUID — null for a bare admin API key. */
+  uuid: string | null
+  isApiAdmin: boolean
+  /** True when no identity at all was presented (bare admin API key). */
+  hasIdentity: boolean
+  /**
+   * True when the users-table lookup itself failed (DB unavailable). Routes
+   * must return 503 BEFORE treating uuid:null as an unresolvable identity —
+   * a DB outage must not masquerade as a 403.
+   */
+  dbUnavailable: boolean
+}
+
+/**
+ * Resolve the bridge caller identity for attach endpoints.
+ *
+ * bridgeAuth's userId may be a UUID (rct_* token), a username (in-memory
+ * token) or an arbitrary X-Username string (shared admin API key) — only
+ * users-table UUIDs can hold session management rights, so everything goes
+ * through resolveUserIdUuid (G9: the API layer must self-enforce
+ * canManageSession; the ingress WS accepting a global API key is not a
+ * boundary we may lean on).
+ */
+export function resolveAttachCaller(c: Context): AttachCaller {
+  const raw = c.get('userId') as string | undefined
+  const isApiAdmin = (c.get('isApiAdmin') as boolean | undefined) ?? false
+  if (!raw) {
+    return { uuid: null, isApiAdmin, hasIdentity: false, dbUnavailable: false }
+  }
+  try {
+    return {
+      uuid: resolveUserIdUuid(getDb(), raw),
+      isApiAdmin,
+      hasIdentity: true,
+      dbUnavailable: false,
+    }
+  } catch (err) {
+    console.error('[bridge] DB error resolving attach caller identity:', err)
+    return { uuid: null, isApiAdmin, hasIdentity: true, dbUnavailable: true }
+  }
+}

package/packages/remote-control-server/src/routes/v1/environments.ts

@@ -4,10 +4,14 @@ import {
   registerEnvironment,
   deregisterEnvironment,
   reconnectEnvironment,
-  updatePollTime,
+  touchEnvironmentActivity,
 } from '../../services/environment'
 import { acceptCliHeaders, apiKeyAuth } from '../../auth/middleware'
-import { bridgeAuth, resolveUserIdUuid } from '../../auth/bridge-auth'
+import {
+  bridgeAuth,
+  resolveAttachCaller,
+  resolveUserIdUuid,
+} from '../../auth/bridge-auth'
 import { getDb } from '../../db/sqlite'
 import { isSessionClosedStatus } from '../../services/session'
 import {
@@ -282,22 +286,76 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
  *  waiting for the Web UI to bind a session (POST /v1/sessions/:id/attach).
  *  Returns the first open, non-ACP session on the environment, or
  *  assigned:false to keep waiting. Long-polling is unnecessary — the worker
- *  already runs a poll loop cadence for work items. */
+ *  already runs a poll loop cadence for work items.
+ *  Access: the env owner (the polling worker itself) or an admin. */
 app.get('/:id/assignment', acceptCliHeaders, bridgeAuth, async c => {
   const envId = c.req.param('id')!
   const env = storeGetEnvironment(envId)
-  if (!env || env.status !== 'active') {
+  // 'disconnected' is NOT a 404 here: the ownership gate below authorizes the
+  // caller first, then touchEnvironmentActivity reactivates the env — a live
+  // wait-mode worker polling a monitor-flipped env recovers instead of
+  // dead-waiting on swallowed 404s for its 24h deadline. Deregistered is
+  // terminal.
+  if (!env || env.status === 'deregistered') {
     return c.json(
       { error: { type: 'not_found', message: 'Environment not found' } },
       404,
     )
   }
+
+  // Ownership gate: assignment discloses the env's bound session AND doubles
+  // as its liveness signal (touchEnvironmentActivity below) — both are
+  // restricted to the env owner (the wait-mode worker polls under the same
+  // identity it registered with) and admins. Unowned envs (claim pending)
+  // stay open: nothing is bound yet, so there is nothing to disclose or keep
+  // alive.
+  const caller = resolveAttachCaller(c)
+  if (caller.dbUnavailable) {
+    return c.json(
+      {
+        error: {
+          type: 'database_unavailable',
+          message: 'Database unavailable',
+        },
+      },
+      503,
+    )
+  }
+  let ownerUserId: string | null = null
+  try {
+    ownerUserId = storeGetEnvironmentOwnership(envId)?.ownerUserId ?? null
+  } catch (err) {
+    console.error('[bridge] DB error during assignment ownership lookup:', err)
+    return c.json(
+      {
+        error: {
+          type: 'database_unavailable',
+          message: 'Database unavailable',
+        },
+      },
+      503,
+    )
+  }
+  if (ownerUserId && !caller.isApiAdmin && caller.uuid !== ownerUserId) {
+    return c.json(
+      {
+        error: {
+          type: 'forbidden',
+          message: 'Not allowed to poll this environment',
+        },
+      },
+      403,
+    )
+  }
+
   // The attach-wait worker has no work item in flight, so the work-poll
   // route never refreshes its heartbeat. This poll IS its liveness signal:
   // without touching lastPollAt the disconnect monitor flips the env to
-  // disconnected after the idle timeout, assignment starts 404ing, and the
-  // CLI silently spins until its 24h deadline (P0-2).
-  updatePollTime(envId)
+  // disconnected after the idle timeout and the CLI silently spins until its
+  // 24h deadline (P0-2). touchEnvironmentActivity also reactivates an env the
+  // monitor already flipped (runs only after the gate — a 403 must not keep
+  // a dead env looking alive).
+  touchEnvironmentActivity(envId)
   const assigned = storeListSessionsByEnvironment(envId)
     .filter(s => !isSessionClosedStatus(s.status))
     .filter(s => s.source !== 'acp')

package/packages/remote-control-server/src/routes/v1/environments.work.ts

@@ -6,14 +6,14 @@ import {
   heartbeatWork,
 } from '../../services/work-dispatch'
 import { apiKeyAuth, acceptCliHeaders } from '../../auth/middleware'
-import { updatePollTime } from '../../services/environment'
+import { touchEnvironmentActivity } from '../../services/environment'
 
 const app = new Hono()
 
 /** GET /v1/environments/:id/work/poll — Long-poll for work */
 app.get('/:id/work/poll', acceptCliHeaders, apiKeyAuth, async c => {
   const envId = c.req.param('id')!
-  updatePollTime(envId)
+  touchEnvironmentActivity(envId)
   const result = await pollWork(envId)
   if (!result) {
     // Return 204 No Content so the client's axios parses it as null