@tapflowio/relay 0.23.0 → 0.25.0

package/dist/RelayServer.d.ts

@@ -27,6 +27,13 @@ export declare function ownerKeyFor(userId: number | string | undefined, claimed
     user: string;
     minted: boolean;
 };
+export declare const LOGS_FORBIDDEN_MESSAGE = "Logs are only available on the relay host. Run `tapflow logs` there.";
+/**
+ * `?lines=` for `/api/v1/logs`: an integer in [1, 500], 100 when absent or not a number. A bare
+ * `Number()` let `abc` through as NaN, and `slice(-NaN)` returns the whole buffer; `-5` became
+ * `slice(5)`, everything but the oldest five.
+ */
+export declare function parseLogLines(raw: string | null): number;
 export declare class RelayServer {
     private readonly options;
     private httpServer;
@@ -98,6 +105,23 @@ export declare class RelayServer {
     /** Per-socket throttle state for `logInboundRejection`. A `WeakMap` so a closed socket's entry goes
      *  with the socket — there is no cleanup to forget, unlike the maps keyed by session id nearby. */
     private readonly rejectionLog;
+    /**
+     * The credential each remote socket was accepted with, re-checked by `revalidateSockets` on every
+     * heartbeat and after every write that can take access away (`onAuthChanged`). Local sockets have
+     * no entry and are never re-checked: they needed no credential.
+     */
+    private readonly principals;
+    /** For a `first-message` socket: what its first frame may make of it. Absent means anything (local). */
+    private readonly firstMessageGrants;
+    /**
+     * Sockets the relay closed because their credential stopped being valid. Their frames are dropped
+     * from the moment of the close rather than from the peer's close reply, and an agent socket among
+     * them skips the reconnect grace: the agent will be refused when it comes back, so holding its
+     * sessions for 15 s would only postpone the same end.
+     */
+    private readonly revokedSockets;
+    /** Per-credential throttle for `logConnectionRejection`: agents retry forever on a refusal. */
+    private readonly connectionRejectLog;
     private agentHolds;
     private stopping;
     private wsExternal;
@@ -138,7 +162,28 @@ export declare class RelayServer {
     address(): string | import("net").AddressInfo | null;
     /** The tunnel listener's address, or null when this relay was given no `tunnelPort`. */
     tunnelAddress(): string | import("net").AddressInfo | null;
+    /**
+     * An install upgrading to a relay that checks an agent token's owner stops connecting agents whose
+     * token belongs to a since-demoted Admin. Say how many at boot, with the fix, rather than leaving the
+     * operator to read 1008s off each agent.
+     */
+    private warnOrphanedAgentTokens;
     private runHeartbeat;
+    /**
+     * Injected into the handlers whose write can take access away — member update and removal, token
+     * revocation, invitation accept — and called after the write commits. It carries no argument on
+     * purpose: the sweep re-derives every socket's standing from the database, so no handler has to know
+     * which sockets its change affects.
+     */
+    private readonly onAuthChanged;
+    private revalidateSockets;
+    private closeForAuth;
+    /**
+     * One line per refused credential per interval. Agents retry forever on a refusal, so logging each
+     * attempt would fill the 500-line buffer with one agent's reconnects. Keyed by PAT id when there is
+     * one and by address otherwise; the first refusal of each is always written.
+     */
+    private logConnectionRejection;
     /**
      * Has this socket answered recently enough to be treated as present?
      *

package/dist/RelayServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RelayServer.d.ts","sourceRoot":"","sources":["../src/RelayServer.ts"],"names":[],"mappings":"AAsBA,OAAO,EAA4D,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAwBjH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQvD;AAGD;;gFAEgF;AAChF,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAC1C;;sGAEsG;AACtG,eAAO,MAAM,iCAAiC,MAAM,CAAA;AAqEpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,EACnC,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAUhD;AA8BD,qBAAa,WAAW;IA6GV,OAAO,CAAC,QAAQ,CAAC,OAAO;IA5GpC,OAAO,CAAC,UAAU,CAA4B;IAC9C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY,CAA0C;IAC9D,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,eAAe,CAAsD;IAC7E,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,oBAAoB,CAA8C;IAC1E,OAAO,CAAC,sBAAsB,CAA8C;IAC5E,OAAO,CAAC,gBAAgB,CAA8C;IACtE,OAAO,CAAC,mBAAmB,CAA8C;IACzE,OAAO,CAAC,cAAc,CAA8C;IACpE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,UAAU,CAAmC;IACrD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAA2E;IAC3F,OAAO,CAAC,YAAY,CAAgC;IAEpD,OAAO,CAAC,iBAAiB,CAAgC;IAEzD,OAAO,CAAC,QAAQ,CAAyC;IAEzD,OAAO,CAAC,aAAa,CAAgC;IACrD;gCAC4B;IAC5B,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,OAAO,CAAuD;IACtE;uGACmG;IACnG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+D;IAM5F,OAAO,CAAC,UAAU,CAAsD;IAIxE,OAAO,CAAC,QAAQ,CAAQ;IAGxB,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IAEzC,OAAO,CAAC,oBAAoB,CAAQ;IACpC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,kBAAkB,CAKtB;IACJ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,cAAc,CAKlB;gBAEyB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,aAAa,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;IAkEzW,OAAO,CAAC,cAAc;IA2GtB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAO1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoCtB,OAAO,CAAC,YAAY;IAyBpB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgCrB,OAAO;IAIP,wFAAwF;IACxF,aAAa;IAKb,OAAO,CAAC,YAAY;IAOpB;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;IAYf,gBAAgB,CAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAQ/D;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,YAAY;IAiBpB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,gBAAgB;IAuKxB;;;;;;;;;;OAUG;IACH;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAwClB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,KAAK;IAyZb,OAAO,CAAC,oBAAoB;IAc5B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM;IAKd;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAkCvB,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAOnB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+BxB,OAAO,CAAC,mBAAmB;IAgG3B;;;;;;4GAMwG;IACxG,OAAO,CAAC,kBAAkB;IAwI1B;wFACoF;IACpF,OAAO,CAAC,YAAY;IAUpB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAYtB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,+BAA+B;IASvC;;;;;;;;;;gFAU4E;IAC5E,OAAO,CAAC,WAAW;IAInB;qGACiG;IACjG,OAAO,CAAC,OAAO;IAIf,2GAA2G;IAC3G,OAAO,CAAC,MAAM;IAId;;;;;;;;;;kDAU8C;IAC9C,OAAO,CAAC,WAAW;IASnB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,WAAW;IAiBnB;;;;uGAImG;IACnG,OAAO,CAAC,cAAc;IActB;;;;;0FAKsF;IACtF,OAAO,CAAC,gBAAgB;IAoCxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;;iDAM6C;IAC7C,OAAO,CAAC,WAAW;IAanB;;;;;;+EAM2E;IAC3E,OAAO,CAAC,uBAAuB;IAqE/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;IAS3B,6FAA6F;IAC7F,OAAO,CAAC,sBAAsB;YAoChB,mBAAmB;YAwDnB,eAAe;IAoD7B,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,oBAAoB;YAed,aAAa;IAoC3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;IAmC3B,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,WAAW;CAwFpB"}
+{"version":3,"file":"RelayServer.d.ts","sourceRoot":"","sources":["../src/RelayServer.ts"],"names":[],"mappings":"AAuBA,OAAO,EAA4D,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAwBjH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQvD;AAGD;;gFAEgF;AAChF,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAC1C;;sGAEsG;AACtG,eAAO,MAAM,iCAAiC,MAAM,CAAA;AAqEpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,EACnC,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAUhD;AAQD,eAAO,MAAM,sBAAsB,yEAAyE,CAAA;AAE5G;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAKxD;AA2BD,qBAAa,WAAW;IA8HV,OAAO,CAAC,QAAQ,CAAC,OAAO;IA7HpC,OAAO,CAAC,UAAU,CAA4B;IAC9C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY,CAA0C;IAC9D,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,eAAe,CAAsD;IAC7E,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,oBAAoB,CAA8C;IAC1E,OAAO,CAAC,sBAAsB,CAA8C;IAC5E,OAAO,CAAC,gBAAgB,CAA8C;IACtE,OAAO,CAAC,mBAAmB,CAA8C;IACzE,OAAO,CAAC,cAAc,CAA8C;IACpE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,UAAU,CAAmC;IACrD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAA2E;IAC3F,OAAO,CAAC,YAAY,CAAgC;IAEpD,OAAO,CAAC,iBAAiB,CAAgC;IAEzD,OAAO,CAAC,QAAQ,CAAyC;IAEzD,OAAO,CAAC,aAAa,CAAgC;IACrD;gCAC4B;IAC5B,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,OAAO,CAAuD;IACtE;uGACmG;IACnG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+D;IAC5F;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA8E;IACjH;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAwD;IAM5F,OAAO,CAAC,UAAU,CAAsD;IAIxE,OAAO,CAAC,QAAQ,CAAQ;IAGxB,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IAEzC,OAAO,CAAC,oBAAoB,CAAQ;IACpC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,kBAAkB,CAKtB;IACJ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,cAAc,CAKlB;gBAEyB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,aAAa,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;IAkEzW,OAAO,CAAC,cAAc;IAiHtB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAO1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwCtB,OAAO,CAAC,YAAY;IAyBpB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgCrB,OAAO;IAIP,wFAAwF;IACxF,aAAa;IAIb;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,YAAY;IAQpB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE7B;IAED,OAAO,CAAC,iBAAiB;IAgCzB,OAAO,CAAC,YAAY;IAMpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;IAYf,gBAAgB,CAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAQ/D;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,YAAY;IAiBpB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,gBAAgB;IAsMxB;;;;;;;;;;OAUG;IACH;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAqElB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,KAAK;IAyZb,OAAO,CAAC,oBAAoB;IAc5B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM;IAKd;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAyCvB,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAOnB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+BxB,OAAO,CAAC,mBAAmB;IAgG3B;;;;;;4GAMwG;IACxG,OAAO,CAAC,kBAAkB;IAwI1B;wFACoF;IACpF,OAAO,CAAC,YAAY;IAUpB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAYtB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,+BAA+B;IASvC;;;;;;;;;;gFAU4E;IAC5E,OAAO,CAAC,WAAW;IAInB;qGACiG;IACjG,OAAO,CAAC,OAAO;IAIf,2GAA2G;IAC3G,OAAO,CAAC,MAAM;IAId;;;;;;;;;;kDAU8C;IAC9C,OAAO,CAAC,WAAW;IASnB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,WAAW;IAiBnB;;;;uGAImG;IACnG,OAAO,CAAC,cAAc;IActB;;;;;0FAKsF;IACtF,OAAO,CAAC,gBAAgB;IAoCxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;;iDAM6C;IAC7C,OAAO,CAAC,WAAW;IAanB;;;;;;+EAM2E;IAC3E,OAAO,CAAC,uBAAuB;IA0E/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;IAS3B,6FAA6F;IAC7F,OAAO,CAAC,sBAAsB;YAoChB,mBAAmB;YAwDnB,eAAe;IAoD7B,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,oBAAoB;YAed,aAAa;IA4C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;IAmC3B,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,WAAW;CAwFpB"}

package/dist/RelayServer.js

@@ -8,14 +8,15 @@ import { WebSocketServer, WebSocket } from 'ws';
 import { SessionManager } from './SessionManager.js';
 import { directionOf, parseInbound } from '@tapflowio/protocol/validate';
 import { Router, json } from './router.js';
-import { requireViewAuth, requireAuth, getAuth, verifyPat } from './middleware/auth.js';
-import { classifyConnection } from './lib/connectionAuth.js';
-import { isTunnelIngress, markTunnelIngress, resolveClientAddress } from './lib/clientAddress.js';
+import { requireViewAuth, requireAuth, getAuth, verifyPat, touchPat, findPat, findUser } from './middleware/auth.js';
+import { AGENT_SCOPE, WS_AGENT_OWNER_REASON, WS_SCOPE_REASON, classifyConnection, revalidatePrincipal } from './lib/connectionAuth.js';
+import { isTunnelIngress, markTunnelIngress, resolveClientAddress, resolveRequestClient } from './lib/clientAddress.js';
 import { BuildTicketStore } from './lib/buildTickets.js';
+import { resolveBuildFile } from './lib/buildFiles.js';
 import { resolveCorsHeaders } from './lib/cors.js';
 import { isCsrfBlocked } from './lib/csrf.js';
 import { pickLanAddress, runningInContainer } from './lib/lanAddress.js';
-import { config } from './lib/config.js';
+import { config, getJwtSecret } from './lib/config.js';
 import { forTeammates, resolveAgentRelayUrl, resolvePublicBaseUrl } from './lib/publicUrl.js';
 import { createTrailingRequester, systemTimerScheduler } from './lib/trailingRequester.js';
 import { getDb } from './db.js';
@@ -141,6 +142,22 @@ export function ownerKeyFor(userId, claimed) {
 }
 /** One line per rejecting socket per second, at most. See `RelayServer.logInboundRejection`. */
 const REJECT_LOG_INTERVAL_MS = 1_000;
+/** One line per refused credential per minute. See `RelayServer.logConnectionRejection`. */
+const CONNECTION_REJECT_LOG_INTERVAL_MS = 60_000;
+export const LOGS_FORBIDDEN_MESSAGE = 'Logs are only available on the relay host. Run `tapflow logs` there.';
+/**
+ * `?lines=` for `/api/v1/logs`: an integer in [1, 500], 100 when absent or not a number. A bare
+ * `Number()` let `abc` through as NaN, and `slice(-NaN)` returns the whole buffer; `-5` became
+ * `slice(5)`, everything but the oldest five.
+ */
+export function parseLogLines(raw) {
+    if (raw === null || raw.trim() === '')
+        return 100;
+    const n = Number(raw);
+    if (!Number.isFinite(n))
+        return 100;
+    return Math.min(500, Math.max(1, Math.trunc(n)));
+}
 /** What the door refused, as one line. The throttling that decides whether to write it is the
  *  caller's, because it is per socket and this function has no state. */
 function describeRejection(failure, suppressed) {
@@ -227,6 +244,23 @@ export class RelayServer {
     /** Per-socket throttle state for `logInboundRejection`. A `WeakMap` so a closed socket's entry goes
      *  with the socket — there is no cleanup to forget, unlike the maps keyed by session id nearby. */
     rejectionLog = new WeakMap();
+    /**
+     * The credential each remote socket was accepted with, re-checked by `revalidateSockets` on every
+     * heartbeat and after every write that can take access away (`onAuthChanged`). Local sockets have
+     * no entry and are never re-checked: they needed no credential.
+     */
+    principals = new WeakMap();
+    /** For a `first-message` socket: what its first frame may make of it. Absent means anything (local). */
+    firstMessageGrants = new WeakMap();
+    /**
+     * Sockets the relay closed because their credential stopped being valid. Their frames are dropped
+     * from the moment of the close rather than from the peer's close reply, and an agent socket among
+     * them skips the reconnect grace: the agent will be refused when it comes back, so holding its
+     * sessions for 15 s would only postpone the same end.
+     */
+    revokedSockets = new WeakSet();
+    /** Per-credential throttle for `logConnectionRejection`: agents retry forever on a refusal. */
+    connectionRejectLog = new Map();
     // Agent sockets whose sessions are being held open, and the timer that gives up on each.
     // Keyed by the dead socket, never by session id: a rebind moves sessions off that socket, so an
     // expiry that fires late has nothing left to evict. That is the invariant — releasing the hold
@@ -320,7 +354,7 @@ export class RelayServer {
     registerRoutes() {
         const u = this.uploadsDir;
         // auth
-        this.router.get('/api/v1/auth/status', handleAuthStatus);
+        this.router.get('/api/v1/auth/status', (req, res) => handleAuthStatus(req, res, this.options.trustedProxies ?? []));
         this.router.post('/api/v1/auth/init', (req, res) => handleInit(req, res, this.options.trustedProxies ?? []));
         this.router.get('/api/v1/auth/me', handleMe);
         this.router.post('/api/v1/auth/login', (req, res) => handleLogin(req, res, this.options.trustedProxies ?? []));
@@ -330,7 +364,7 @@ export class RelayServer {
         this.router.post('/api/v1/auth/reset-password', handleDoReset);
         // invitations
         this.router.get('/api/v1/invitations/verify', handleVerify);
-        this.router.post('/api/v1/invitations/accept', (req, res) => handleAccept(req, res, u));
+        this.router.post('/api/v1/invitations/accept', (req, res) => handleAccept(req, res, u, this.onAuthChanged));
         // apps
         this.router.get('/api/v1/apps', handleListApps);
         this.router.post('/api/v1/apps', handleCreateApp);
@@ -361,13 +395,13 @@ export class RelayServer {
         // team
         this.router.get('/api/v1/team/members', handleListMembers);
         this.router.post('/api/v1/team/invite', (req, res) => handleInvite(req, res, this.options.tunnel));
-        this.router.patch('/api/v1/team/members/:id', handleUpdateMember);
-        this.router.delete('/api/v1/team/members/:id', handleDeleteMember);
+        this.router.patch('/api/v1/team/members/:id', (req, res, params) => handleUpdateMember(req, res, params, this.onAuthChanged));
+        this.router.delete('/api/v1/team/members/:id', (req, res, params) => handleDeleteMember(req, res, params, this.onAuthChanged));
         this.router.post('/api/v1/team/members/:id/send-reset', (req, res, params) => handleSendMemberReset(req, res, params, this.options.tunnel));
         // tokens
         this.router.get('/api/v1/tokens', handleListTokens);
         this.router.post('/api/v1/tokens', handleCreateToken);
-        this.router.delete('/api/v1/tokens/:id', handleRevokeToken);
+        this.router.delete('/api/v1/tokens/:id', (req, res, params) => handleRevokeToken(req, res, params, this.onAuthChanged));
         // settings
         this.router.get('/api/v1/settings', handleGetSettings);
         this.router.patch('/api/v1/settings', (req, res) => handleUpdateSettings(req, res, u));
@@ -377,10 +411,16 @@ export class RelayServer {
         this.router.post('/api/v1/recordings/upload', (req, res) => handleUploadRecording(req, res, this.recordingsDir));
         this.router.get('/api/v1/recordings', (req, res) => handleListRecordings(req, res));
         this.router.get('/api/v1/recordings/:filename', (req, res) => handleDownloadRecording(req, res, this.recordingsDir));
-        // logs
+        // logs — the relay host only. The buffer holds the addresses of refused connections, nothing
+        // remote reads it (`tapflow logs` is its only consumer), and every line is also in the relay's own
+        // output. Same locality rule and proxy list as `auth/init` and the WebSocket handshake, so the tunnel
+        // listener is remote here too.
         this.router.get('/api/v1/logs', (req, res) => {
+            if (!resolveRequestClient(req, this.options.trustedProxies ?? []).isLocal) {
+                return json(res, 403, { error: LOGS_FORBIDDEN_MESSAGE });
+            }
             const url = new URL(req.url ?? '/', `http://localhost`);
-            const lines = Math.min(Number(url.searchParams.get('lines') ?? 100), 500);
+            const lines = parseLogLines(url.searchParams.get('lines'));
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(this.logBuffer.slice(-lines)));
         });
@@ -416,6 +456,10 @@ export class RelayServer {
         logger.info(msg);
     }
     start() {
+        // Creates this install's JWT secret if it has none. Here rather than at import, so commands
+        // that never run a relay stop leaving one behind — and a write failure is still a boot failure.
+        getJwtSecret();
+        this.warnOrphanedAgentTokens();
         purgeExpiredRecordings(this.recordingsDir);
         this.purgeRecordingsTimer = setInterval(() => purgeExpiredRecordings(this.recordingsDir), 24 * 60 * 60 * 1000);
         this.purgeRecordingsTimer.unref();
@@ -425,8 +469,8 @@ export class RelayServer {
         purgeOldResources();
         this.purgeOldResourcesTimer = setInterval(purgeOldResources, 24 * 60 * 60 * 1000);
         this.purgeOldResourcesTimer.unref();
-        purgeExpiredBuilds(this.recordingsDir);
-        this.purgeBuildsTimer = setInterval(() => purgeExpiredBuilds(this.recordingsDir), 24 * 60 * 60 * 1000);
+        purgeExpiredBuilds(this.recordingsDir, this.uploadsDir);
+        this.purgeBuildsTimer = setInterval(() => purgeExpiredBuilds(this.recordingsDir, this.uploadsDir), 24 * 60 * 60 * 1000);
         this.purgeBuildsTimer.unref();
         this.flushResourcesTimer = setInterval(() => this.flushResourceBuffers(), 60_000);
         this.flushResourcesTimer.unref();
@@ -525,8 +569,28 @@ export class RelayServer {
     tunnelAddress() {
         return this.tunnelServer?.address() ?? null;
     }
+    /**
+     * An install upgrading to a relay that checks an agent token's owner stops connecting agents whose
+     * token belongs to a since-demoted Admin. Say how many at boot, with the fix, rather than leaving the
+     * operator to read 1008s off each agent.
+     */
+    warnOrphanedAgentTokens() {
+        const row = getDb().prepare(`
+      SELECT COUNT(*) AS n FROM personal_access_tokens pat JOIN users u ON u.id = pat.user_id
+      WHERE u.role <> 'Admin'
+        AND (',' || REPLACE(pat.scope, ' ', '') || ',') LIKE '%,${AGENT_SCOPE},%'
+        AND (pat.expires_at IS NULL OR datetime(pat.expires_at) > datetime('now'))
+    `).get();
+        if (row.n > 0) {
+            logger.warn(`${row.n} agent token(s) belong to a member who is no longer an Admin and will be refused. An Admin must issue a new agent token (Dashboard → Settings → Tokens) for each agent that uses one.`);
+        }
+    }
     // Terminate sockets that missed the previous pong; ping the rest. Covers all roles via wss.clients.
+    // Every socket's credential is re-checked on the same sweep: this is the guarantee that a removed
+    // member, a revoked or expired token, or an expired session cookie loses an open socket within one
+    // interval, whatever path the change took. `onAuthChanged` is the same check run early.
     runHeartbeat(clients = this.wss.clients) {
+        this.revalidateSockets(clients);
         for (const ws of clients) {
             if (!this.isAlive(ws)) {
                 ws.terminate();
@@ -536,6 +600,77 @@ export class RelayServer {
                 ws.ping();
         }
     }
+    /**
+     * Injected into the handlers whose write can take access away — member update and removal, token
+     * revocation, invitation accept — and called after the write commits. It carries no argument on
+     * purpose: the sweep re-derives every socket's standing from the database, so no handler has to know
+     * which sockets its change affects.
+     */
+    onAuthChanged = () => {
+        this.revalidateSockets(this.wss.clients);
+    };
+    revalidateSockets(clients) {
+        const now = Math.floor(Date.now() / 1000);
+        for (const ws of clients) {
+            const principal = this.principals.get(ws);
+            if (!principal || this.revokedSockets.has(ws) || ws.readyState !== WebSocket.OPEN)
+                continue;
+            let reason;
+            try {
+                const pat = principal.via === 'pat' ? findPat(principal.patId) : null;
+                const role = this.wsRoles.get(ws);
+                reason = revalidatePrincipal(principal, role, {
+                    userExists: principal.via === 'cookie' ? findUser(principal.userId) !== null : true,
+                    pat,
+                }, now);
+                // A socket that has not introduced itself yet takes what a fresh handshake would give it now.
+                if (reason === null && role === undefined && pat) {
+                    const again = classifyConnection({ isLocal: false, hasCookieAuth: false, patScopes: pat.scopes, patOwnerRole: pat.ownerRole });
+                    if (again.action === 'accept') {
+                        this.firstMessageGrants.set(ws, again.role === 'browser'
+                            ? { mayBrowse: true, mayRegisterAgent: false }
+                            : { mayBrowse: again.mayBrowse, mayRegisterAgent: again.mayRegisterAgent });
+                    }
+                }
+            }
+            catch (err) {
+                // A database fault is not a revocation: closing every socket on a transient `SQLITE_BUSY` would
+                // disconnect the whole team. The next sweep asks again.
+                logger.error('socket re-validation failed:', err);
+                return;
+            }
+            if (reason !== null)
+                this.closeForAuth(ws, reason);
+        }
+    }
+    closeForAuth(ws, reason) {
+        this.revokedSockets.add(ws);
+        this.pushLog(`WS connection closed — ${reason}`);
+        ws.close(1008, reason);
+    }
+    /**
+     * One line per refused credential per interval. Agents retry forever on a refusal, so logging each
+     * attempt would fill the 500-line buffer with one agent's reconnects. Keyed by PAT id when there is
+     * one and by address otherwise; the first refusal of each is always written.
+     */
+    logConnectionRejection(addr, reason, patId) {
+        const key = patId !== undefined ? `pat:${patId}` : `addr:${addr}`;
+        const now = Date.now();
+        const state = this.connectionRejectLog.get(key);
+        if (state && now - state.at < CONNECTION_REJECT_LOG_INTERVAL_MS) {
+            state.suppressed++;
+            return;
+        }
+        if (this.connectionRejectLog.size > 1000) {
+            for (const [k, v] of this.connectionRejectLog) {
+                if (now - v.at >= CONNECTION_REJECT_LOG_INTERVAL_MS)
+                    this.connectionRejectLog.delete(k);
+            }
+        }
+        const also = state && state.suppressed > 0 ? ` (+${state.suppressed} more in the last minute)` : '';
+        this.connectionRejectLog.set(key, { at: now, suppressed: 0 });
+        this.pushLog(`WS connection rejected from ${addr} — ${reason}${also}`);
+    }
     /**
      * Has this socket answered recently enough to be treated as present?
      *
@@ -696,17 +831,50 @@ export class RelayServer {
             trustedProxies: this.options.trustedProxies ?? [],
             viaTunnel,
         });
-        const hasCookieAuth = getAuth(request) !== null;
-        // DB lookup — only when the connection can't be classified without it (remote, no cookie).
-        const pat = !isLocal && !hasCookieAuth ? verifyPat(request) : null;
-        const decision = classifyConnection({
-            isLocal,
-            hasCookieAuth,
-            patScopes: pat ? pat.scope.split(',').map((s) => s.trim()) : null,
-        });
-        if (decision.action === 'reject') {
-            this.pushLog(`WS connection rejected from ${addr} — no credentials (agents: PAT with 'agent' scope via --token)`);
-            ws.close(1008, decision.reason);
+        // **Everything that reads the database is inside this try.** `getAuth` and `verifyPat` both query,
+        // and this handler runs synchronously in the `connection` event: a throw here is uncaught and takes
+        // the relay process down with every session on it. A fault closes this one socket instead (1011),
+        // and is never read as "no credentials".
+        let decision;
+        let userId;
+        try {
+            // Resolved once: `hasCookieAuth`, the owner key and the principal all read this one answer. Two
+            // calls were two queries, with a window where they could disagree.
+            const cookie = getAuth(request);
+            // DB lookup — only when the connection can't be classified without it (remote, no cookie).
+            const pat = !isLocal && !cookie ? verifyPat(request) : null;
+            decision = classifyConnection({
+                isLocal,
+                hasCookieAuth: cookie !== null,
+                patScopes: pat?.scopes ?? null,
+                patOwnerRole: pat?.ownerRole ?? null,
+            });
+            if (decision.action === 'reject') {
+                this.logConnectionRejection(addr, decision.reason, pat?.patId);
+                ws.close(1008, decision.reason);
+                return;
+            }
+            // Only an accepted token was used; a refused one keeps its "last used".
+            if (pat)
+                touchPat(pat.patId);
+            userId = cookie?.userId ?? pat?.userId;
+            if (!isLocal) {
+                if (cookie)
+                    this.principals.set(ws, { via: 'cookie', userId: cookie.userId, jwtExp: cookie.exp });
+                else if (pat)
+                    this.principals.set(ws, { via: 'pat', userId: pat.userId, patId: pat.patId });
+            }
+            if (decision.role === 'first-message') {
+                this.firstMessageGrants.set(ws, { mayBrowse: decision.mayBrowse, mayRegisterAgent: decision.mayRegisterAgent });
+            }
+            else if (pat?.scopes.includes(AGENT_SCOPE)) {
+                // A `view,agent` token whose owner is no longer an Admin: browsing only, and a handshake is told why.
+                this.firstMessageGrants.set(ws, { mayBrowse: true, mayRegisterAgent: false });
+            }
+        }
+        catch (err) {
+            logger.error(`WebSocket handshake failed for ${addr}:`, err);
+            ws.close(1011, 'Internal error');
             return;
         }
         this.wsExternal.set(ws, isExternalAddress(addr));
@@ -718,8 +886,8 @@ export class RelayServer {
         // so every agent, `mcp-server` and `flow-runner` connection would have been `anon:` — and the whole
         // point of pairing the claim with a user is that a leaked client id is useless to anyone else. Two
         // processes on the same PAT are the same principal, which is right; two on different PATs are not,
-        // which is what this restores. `pat` is already resolved above and was being discarded.
-        this.ownerKey.set(ws, ownerKeyFor(getAuth(request)?.userId ?? pat?.userId, claimed));
+        // which is what this restores.
+        this.ownerKey.set(ws, ownerKeyFor(userId, claimed));
         // Heartbeat liveness: a fresh socket counts as having just answered, and each pong renews it.
         this.lastPongAt.set(ws, Date.now());
         ws.on('pong', () => this.lastPongAt.set(ws, Date.now()));
@@ -727,6 +895,10 @@ export class RelayServer {
             this.wsRoles.set(ws, 'browser');
         // 'first-message' → role is determined by the first message (agent:register / stream:register)
         ws.on('message', (data, isBinary) => {
+            // Closed for a credential that stopped being valid: nothing it sends after that counts, even
+            // before its close reply arrives.
+            if (this.revokedSockets.has(ws))
+                return;
             if (isBinary) {
                 // Binary frames arrive on the dedicated stream WS, route to the session's browser
                 const session = this.sessions.getByStreamSocket(ws);
@@ -800,9 +972,9 @@ export class RelayServer {
                 return;
             if (!inbound.ok) {
                 // **After the role gate, never before it**, so a browser spoofing an agent-only type gets 1008
-                // and no reply. That is the whole of the claim: an agent- or stream-role socket sending a
-                // malformed browser request passes the gate and *is* answered, because the gate only refuses a
-                // `browser` role sending a non-browser type. Harmless, and worth stating rather than implying
+                // and no reply. That is the whole of the claim: an agent- or stream-role socket whose token also
+                // carries `view` (or a local one) sending a malformed browser request passes the gate and *is*
+                // answered — without `view` it was already closed above. Harmless, and worth stating rather than implying
                 // otherwise — such a socket already gets an answer on the well-formed path (`refuseInput` tells
                 // it `not-session-owner`), and this reply says strictly less than that one.
                 if (inbound.reason === 'bad-payload')
@@ -884,22 +1056,40 @@ export class RelayServer {
         // inverts the check below: a socket whose first frame is `screenshot:done` would be handed the
         // `agent` role and then waved through the gate that exists to refuse exactly that.
         const handshake = type === 'agent:register' || type === 'stream:register';
+        // What the credentials allow the first frame to make of this socket (`classifyConnection`). No entry
+        // is a socket that may become anything: a local one.
+        const grants = this.firstMessageGrants.get(ws);
         if (!this.wsRoles.has(ws)) {
             // A handshake that did not parse confers nothing. Returning here rather than falling through to
             // `browser` is what keeps an agent whose register is malformed from being closed with
             // `Forbidden` — the caller has already logged it, and the next frame still gets to introduce it.
             if (handshake && !inbound.ok)
                 return false;
+            if (handshake && grants && !grants.mayRegisterAgent) {
+                ws.close(1008, WS_AGENT_OWNER_REASON);
+                return false;
+            }
             if (type === 'agent:register')
                 this.wsRoles.set(ws, 'agent');
             else if (type === 'stream:register')
                 this.wsRoles.set(ws, 'stream');
-            // Local connection whose first message is not an agent/stream handshake — treat it as a browser
-            // (e.g. dashboard opened on the same machine). This fallback is what puts such a socket under
-            // the gate below.
+            // A first message that is not an agent/stream handshake makes the socket a browser (e.g. the
+            // dashboard opened on the same machine) — but only when its credentials could have opened a
+            // browser socket directly. An `agent`-only token used to land here as a browser too.
+            else if (grants && !grants.mayBrowse) {
+                ws.close(1008, WS_SCOPE_REASON);
+                return false;
+            }
+            // This fallback is what puts such a socket under the gate below.
             else
                 this.wsRoles.set(ws, 'browser');
         }
+        // A `view,agent` token whose owner lost Admin was accepted as a browser; its handshake is told why
+        // it cannot register rather than a bare `Forbidden`.
+        if (handshake && this.wsRoles.get(ws) === 'browser' && grants && !grants.mayRegisterAgent) {
+            ws.close(1008, WS_AGENT_OWNER_REASON);
+            return false;
+        }
         // Browser sockets must not spoof agent control messages.
         //
         // This was a hand-copied array of 29 literals with two type assertions holding it against the
@@ -909,6 +1099,17 @@ export class RelayServer {
             ws.close(1008, 'Forbidden');
             return false;
         }
+        // The other direction of the same rule. An agent or stream socket on a token without `view` may
+        // not act as a browser after its handshake either — `session:start`, `input:*`, `device:*` — or an
+        // `agent`-only token would drive devices just by registering first. No agent needs this: their
+        // text frames go through `sendMsg`/`sendOn`, typed `AgentToRelay | AgentToBrowser`, and the stream
+        // socket sends only `stream:register`; none of those types is browser-direction (checked against
+        // `BrowserToRelay` when this was added). Local agents carry no grants and are not gated.
+        const role = this.wsRoles.get(ws);
+        if ((role === 'agent' || role === 'stream') && grants && !grants.mayBrowse && directionOf(type) === 'browser') {
+            ws.close(1008, WS_SCOPE_REASON);
+            return false;
+        }
         return true;
     }
     /**
@@ -1449,9 +1650,17 @@ export class RelayServer {
      */
     holdAgentSocket(ws) {
         // Shutting down: nothing is coming back, and arming a timer here would leave it running after
-        // `stop()` resolved.
+        // `stop()` resolved. Closed by the relay for a credential that is no longer valid: the agent will be
+        // refused when it returns, so a hold would only postpone the same end.
         if (this.stopping)
             return this.evictAgentSocket(ws);
+        if (this.revokedSockets.has(ws)) {
+            const evicted = this.evictAgentSocket(ws);
+            // `evictAgentSocket` keeps the resource entry when there were no sessions to end.
+            if (!evicted)
+                this.sessions.removeResources(ws);
+            return evicted;
+        }
         const sessions = this.sessions.getAllByAgentSocket(ws);
         if (sessions.length === 0) {
             // No sessions to hold, but the socket may still own a resource entry — `evictAgentSocket`
@@ -2084,9 +2293,15 @@ export class RelayServer {
         // A missing file is answered rather than thrown for the same reason the lookup above is: the
         // build row outlives its file whenever a bind mount goes away or a purge half-ran, and an
         // unanswered install is a spinner that never stops and a caller that times out with no cause.
+        //
+        // Resolved rather than read verbatim: the stored path names wherever the data directory was at
+        // upload time, and a migrated, moved or restored install keeps the file under a different one.
+        const filePath = resolveBuildFile(build.file_path, this.uploadsDir);
         let bytes;
         try {
-            bytes = fs.statSync(build.file_path).size;
+            if (filePath === null)
+                throw new Error('not found');
+            bytes = fs.statSync(filePath).size;
         }
         catch {
             return fail('The relay cannot read this build file. It may have been deleted — re-upload the build.');
@@ -2097,10 +2312,10 @@ export class RelayServer {
             requestId,
             payload: {
                 // Still sent, and sent first: an agent that predates `build-download` reads only this.
-                filePath: build.file_path,
+                filePath,
                 bundleId: build.bundle_id,
-                buildTicket: this.buildTickets.mint(msg.buildId, build.file_path),
-                buildName: path.basename(build.file_path),
+                buildTicket: this.buildTickets.mint(msg.buildId, filePath),
+                buildName: path.basename(filePath),
                 buildBytes: bytes,
             },
         });
@@ -2330,8 +2545,18 @@ export class RelayServer {
             }
         }
         if (url.startsWith('/uploads/')) {
-            if (!requireViewAuth(req, res))
+            // Outside the router, so outside its catch: the auth check reads the database, and a throw here
+            // would be an unhandled rejection that ends the process.
+            try {
+                if (!requireViewAuth(req, res))
+                    return;
+            }
+            catch (err) {
+                logger.error('upload auth failed:', err);
+                if (!res.headersSent)
+                    json(res, 500, { error: 'Internal server error' });
                 return;
+            }
             this.serveUpload(req, res);
             return;
         }