@tom2012/cc-web 2026.5.24-a → 2026.5.24-c

package/README.md

@@ -2,7 +2,7 @@
 
 A self-hosted web application (distributed as npm package) that provides a browser-based interface for [Claude Code](https://docs.anthropic.com/en/docs/claude-code) CLI sessions. Create projects, each with a persistent terminal running Claude Code, and interact with them through a real-time terminal UI.
 
-**Current version**: v2026.5.24-a | [GitHub](https://github.com/zbc0315/cc-web) | MIT License
+**Current version**: v2026.5.24-c | [GitHub](https://github.com/zbc0315/cc-web) | MIT License
 
 ## Features
 

package/backend/dist/__tests__/browser-chrome-e2e.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=browser-chrome-e2e.test.d.ts.map

package/backend/dist/__tests__/browser-chrome-e2e.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-chrome-e2e.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/browser-chrome-e2e.test.ts"],"names":[],"mappings":""}

package/backend/dist/__tests__/browser-chrome-e2e.test.js

@@ -0,0 +1,121 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * E2E: launches real headless chromium via SessionManager and verifies
+ * screencast frames are delivered. Skipped if chromium binary missing.
+ *
+ * Run: npx vitest run src/__tests__/browser-chrome-e2e.test.ts
+ */
+const vitest_1 = require("vitest");
+const http = __importStar(require("http"));
+const playwright_1 = require("playwright");
+const session_manager_1 = require("../browser-chrome/session-manager");
+const screencast_1 = require("../browser-chrome/screencast");
+// Skip if chromium binary not installed locally — keeps CI green when
+// `npx playwright install chromium` hasn't run.
+let chromiumAvailable = false;
+try {
+    const path = playwright_1.chromium.executablePath();
+    chromiumAvailable = !!path;
+}
+catch {
+    chromiumAvailable = false;
+}
+vitest_1.describe.skipIf(!chromiumAvailable)('browser-chrome e2e (real chromium)', () => {
+    let upstream;
+    let upstreamPort = 0;
+    // Minimal mock WS that captures sent messages — avoids needing a real
+    // server/client pair just to verify screencast delivers frames.
+    function mockWs() {
+        const sent = [];
+        const ws = {
+            readyState: 1, // OPEN
+            bufferedAmount: 0,
+            send: (data) => sent.push(data),
+            close: () => { ws.readyState = 3; },
+        };
+        return { sent, ws };
+    }
+    (0, vitest_1.afterAll)(async () => {
+        await session_manager_1.browserChromeSessions.destroyAll();
+        if (upstream)
+            await new Promise(r => upstream.close(() => r()));
+    }, 30000);
+    (0, vitest_1.it)('starts chromium, navigates to local server, and delivers screencast frames', async () => {
+        upstream = http.createServer((req, res) => {
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            // Animated page is required — CDP screencast only emits frames on
+            // visual change, a fully static page yields zero frames.
+            res.end(`<html><body style="background:#f00;font-size:48px">
+        <div id="c">0</div>
+        <script>let n=0;setInterval(()=>{document.getElementById('c').textContent=++n},50)</script>
+      </body></html>`);
+        });
+        await new Promise(r => upstream.listen(0, '127.0.0.1', r));
+        upstreamPort = upstream.address().port;
+        const session = await session_manager_1.browserChromeSessions.getOrCreate('e2e-user');
+        (0, vitest_1.expect)(session.sid).toBeTruthy();
+        (0, vitest_1.expect)(session.username).toBe('e2e-user');
+        await session.page.goto(`http://127.0.0.1:${upstreamPort}/`, { waitUntil: 'load' });
+        (0, vitest_1.expect)(session.page.url()).toContain('127.0.0.1');
+        const { sent, ws } = mockWs();
+        const stop = await (0, screencast_1.startScreencast)(session, ws);
+        // Wait for at least 1 frame (chromium usually emits within 200ms after page paints).
+        await new Promise((resolve, reject) => {
+            const t = setTimeout(() => reject(new Error('no frame in 3s')), 3000);
+            const i = setInterval(() => {
+                if (sent.length > 0) {
+                    clearTimeout(t);
+                    clearInterval(i);
+                    resolve();
+                }
+            }, 50);
+        });
+        (0, vitest_1.expect)(sent.length).toBeGreaterThan(0);
+        const msg = JSON.parse(sent[0]);
+        (0, vitest_1.expect)(msg.type).toBe('frame');
+        (0, vitest_1.expect)(msg.format).toBe('jpeg');
+        (0, vitest_1.expect)(typeof msg.data).toBe('string');
+        (0, vitest_1.expect)(msg.data.length).toBeGreaterThan(100);
+        await stop();
+    }, 30000);
+    (0, vitest_1.it)('reuses session for same user', async () => {
+        const a = await session_manager_1.browserChromeSessions.getOrCreate('reuse-user');
+        const b = await session_manager_1.browserChromeSessions.getOrCreate('reuse-user');
+        (0, vitest_1.expect)(a.sid).toBe(b.sid);
+    }, 30000);
+});
+//# sourceMappingURL=browser-chrome-e2e.test.js.map

package/backend/dist/__tests__/browser-chrome-e2e.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-chrome-e2e.test.js","sourceRoot":"","sources":["../../src/__tests__/browser-chrome-e2e.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;GAKG;AACH,mCAAwD;AACxD,2CAA6B;AAE7B,2CAAsC;AACtC,uEAA0E;AAC1E,6DAA+D;AAE/D,sEAAsE;AACtE,gDAAgD;AAChD,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,CAAC;IACH,MAAM,IAAI,GAAG,qBAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;AAC7B,CAAC;AAAC,MAAM,CAAC;IACP,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED,iBAAQ,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAC7E,IAAI,QAAqB,CAAC;IAC1B,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,sEAAsE;IACtE,gEAAgE;IAChE,SAAS,MAAM;QACb,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG;YACT,UAAU,EAAE,CAAC,EAAE,OAAO;YACtB,cAAc,EAAE,CAAC;YACjB,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACvC,KAAK,EAAE,GAAG,EAAE,GAAI,EAA6B,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;SAChE,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtB,CAAC;IAED,IAAA,iBAAQ,EAAC,KAAK,IAAI,EAAE;QAClB,MAAM,uCAAqB,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,QAAQ;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC,EAAE,KAAM,CAAC,CAAC;IAEX,IAAA,WAAE,EAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,kEAAkE;YAClE,yDAAyD;YACzD,GAAG,CAAC,GAAG,CAAC;;;qBAGO,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,YAAY,GAAI,QAAQ,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;QAExD,MAAM,OAAO,GAAG,MAAM,uCAAqB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACpE,IAAA,eAAM,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,YAAY,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,IAAA,eAAM,EAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAe,EAAC,OAAO,EAAE,EAAW,CAAC,CAAC;QAEzD,qFAAqF;QACrF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE;gBACzB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAAC,aAAa,CAAC,CAAC,CAAC,CAAC;oBAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;YACxE,CAAC,EAAE,EAAE,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAA,eAAM,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,IAAA,eAAM,EAAC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAA,eAAM,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAE7C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,EAAE,KAAM,CAAC,CAAC;IAEX,IAAA,WAAE,EAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,CAAC,GAAG,MAAM,uCAAqB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,MAAM,uCAAqB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChE,IAAA,eAAM,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,EAAE,KAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/backend/dist/__tests__/browser-chrome.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=browser-chrome.test.d.ts.map

package/backend/dist/__tests__/browser-chrome.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-chrome.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/browser-chrome.test.ts"],"names":[],"mappings":""}

package/backend/dist/__tests__/browser-chrome.test.js

@@ -0,0 +1,169 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const jwt = __importStar(require("jsonwebtoken"));
+const session_manager_1 = require("../browser-chrome/session-manager");
+const config_1 = require("../config");
+(0, vitest_1.describe)('mintSessionToken / verifySessionToken', () => {
+    (0, vitest_1.it)('round-trips a valid token', () => {
+        const token = (0, session_manager_1.mintSessionToken)('sid-1', 'tom');
+        const claim = (0, session_manager_1.verifySessionToken)(token);
+        (0, vitest_1.expect)(claim).toEqual({ sid: 'sid-1', username: 'tom' });
+    });
+    (0, vitest_1.it)('rejects token with wrong typ', () => {
+        const config = (0, config_1.getConfig)();
+        const wrongTyp = jwt.sign({ sid: 'x', username: 'tom', typ: 'user' }, config.jwtSecret, { expiresIn: '1h' });
+        (0, vitest_1.expect)((0, session_manager_1.verifySessionToken)(wrongTyp)).toBeNull();
+    });
+    (0, vitest_1.it)('rejects token signed with wrong secret', () => {
+        const wrong = jwt.sign({ sid: 'x', username: 'tom', typ: 'browser-chrome' }, 'wrong-secret', { expiresIn: '1h' });
+        (0, vitest_1.expect)((0, session_manager_1.verifySessionToken)(wrong)).toBeNull();
+    });
+    (0, vitest_1.it)('rejects token missing sid or username', () => {
+        const config = (0, config_1.getConfig)();
+        const noSid = jwt.sign({ username: 'tom', typ: 'browser-chrome' }, config.jwtSecret, { expiresIn: '1h' });
+        (0, vitest_1.expect)((0, session_manager_1.verifySessionToken)(noSid)).toBeNull();
+        const noUser = jwt.sign({ sid: 'x', typ: 'browser-chrome' }, config.jwtSecret, { expiresIn: '1h' });
+        (0, vitest_1.expect)((0, session_manager_1.verifySessionToken)(noUser)).toBeNull();
+    });
+    (0, vitest_1.it)('rejects malformed token', () => {
+        (0, vitest_1.expect)((0, session_manager_1.verifySessionToken)('not-a-jwt')).toBeNull();
+        (0, vitest_1.expect)((0, session_manager_1.verifySessionToken)('')).toBeNull();
+    });
+});
+// Pure-logic tests for input-forwarder require it to export sanitize helpers
+// or accept a mock page. We test sanitize/clamp behavior indirectly by
+// constructing edge-case messages and asserting they don't throw with a
+// minimal mock Page.
+(0, vitest_1.describe)('handleInput (with mock page)', () => {
+    // Lazy import to avoid pulling playwright at module load.
+    (0, vitest_1.it)('clamps out-of-range click coords and ignores invalid modifiers', async () => {
+        const calls = [];
+        const mockPage = {
+            mouse: {
+                click: async (x, y, opts) => { calls.push(['click', x, y, opts.button]); },
+                move: async () => { calls.push(['move']); },
+                wheel: async (dx, dy) => { calls.push(['wheel', dx, dy]); },
+            },
+            keyboard: {
+                down: async (k) => { calls.push(['kd', k]); },
+                up: async (k) => { calls.push(['ku', k]); },
+                press: async (k) => { calls.push(['kp', k]); },
+                type: async (t) => { calls.push(['type', t]); },
+            },
+            setViewportSize: async (s) => { calls.push(['vp', s.width, s.height]); },
+        };
+        const mockSession = {
+            sid: 's', username: 'u', browser: {}, context: {},
+            page: mockPage, cdp: {},
+            createdAt: 0, lastActivityAt: 0,
+            viewport: { w: 1280, h: 800 }, url: '',
+        };
+        const { handleInput } = await Promise.resolve().then(() => __importStar(require('../browser-chrome/input-forwarder')));
+        // Negative coords clamp to 0; over-max clamp to viewport.
+        await handleInput(mockSession, { type: 'click', x: -100, y: -50 });
+        (0, vitest_1.expect)(calls).toContainEqual(['click', 0, 0, 'left']);
+        calls.length = 0;
+        await handleInput(mockSession, { type: 'click', x: 9999, y: 9999, button: 'right', modifiers: ['Shift', 'EvilMod'] });
+        // EvilMod dropped; Shift held around click.
+        (0, vitest_1.expect)(calls).toEqual([
+            ['kd', 'Shift'],
+            ['click', 1280, 800, 'right'],
+            ['ku', 'Shift'],
+        ]);
+        // Scroll clamps delta.
+        calls.length = 0;
+        await handleInput(mockSession, { type: 'scroll', x: 100, y: 100, deltaX: 999999, deltaY: -999999 });
+        (0, vitest_1.expect)(calls).toEqual([
+            ['move'],
+            ['wheel', 10000, -10000],
+        ]);
+        // type with too-long text rejected silently.
+        calls.length = 0;
+        await handleInput(mockSession, { type: 'type', text: 'x'.repeat(2000) });
+        (0, vitest_1.expect)(calls).toEqual([]);
+        // type with normal text works.
+        calls.length = 0;
+        await handleInput(mockSession, { type: 'type', text: 'hello' });
+        (0, vitest_1.expect)(calls).toEqual([['type', 'hello']]);
+        // resize clamps to bounds.
+        calls.length = 0;
+        await handleInput(mockSession, { type: 'resize', w: 50, h: 100000 });
+        (0, vitest_1.expect)(calls).toEqual([['vp', 200, 2160]]);
+        (0, vitest_1.expect)(mockSession.viewport).toEqual({ w: 200, h: 2160 });
+    });
+    (0, vitest_1.it)('key event uses press by default and releases modifiers in reverse', async () => {
+        const calls = [];
+        const mockPage = {
+            mouse: { click: async () => { }, move: async () => { }, wheel: async () => { } },
+            keyboard: {
+                down: async (k) => { calls.push(`d:${k}`); },
+                up: async (k) => { calls.push(`u:${k}`); },
+                press: async (k) => { calls.push(`p:${k}`); },
+                type: async () => { },
+            },
+            setViewportSize: async () => { },
+        };
+        const mockSession = {
+            sid: 's', username: 'u', browser: {}, context: {},
+            page: mockPage, cdp: {},
+            createdAt: 0, lastActivityAt: 0,
+            viewport: { w: 1280, h: 800 }, url: '',
+        };
+        const { handleInput } = await Promise.resolve().then(() => __importStar(require('../browser-chrome/input-forwarder')));
+        await handleInput(mockSession, { type: 'key', action: 'press', key: 'a', modifiers: ['Control', 'Shift'] });
+        (0, vitest_1.expect)(calls).toEqual(['d:Control', 'd:Shift', 'p:a', 'u:Shift', 'u:Control']);
+    });
+    (0, vitest_1.it)('drops key event when key is empty or too long', async () => {
+        const calls = [];
+        const mockPage = {
+            mouse: { click: async () => { }, move: async () => { }, wheel: async () => { } },
+            keyboard: { down: async () => { }, up: async () => { }, press: async (k) => { calls.push(k); }, type: async () => { } },
+            setViewportSize: async () => { },
+        };
+        const mockSession = {
+            sid: 's', username: 'u', browser: {}, context: {},
+            page: mockPage, cdp: {},
+            createdAt: 0, lastActivityAt: 0,
+            viewport: { w: 1280, h: 800 }, url: '',
+        };
+        const { handleInput } = await Promise.resolve().then(() => __importStar(require('../browser-chrome/input-forwarder')));
+        await handleInput(mockSession, { type: 'key', action: 'press', key: '' });
+        await handleInput(mockSession, { type: 'key', action: 'press', key: 'x'.repeat(100) });
+        (0, vitest_1.expect)(calls).toEqual([]);
+    });
+});
+//# sourceMappingURL=browser-chrome.test.js.map

package/backend/dist/__tests__/browser-chrome.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-chrome.test.js","sourceRoot":"","sources":["../../src/__tests__/browser-chrome.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAA8C;AAC9C,kDAAoC;AACpC,uEAAyF;AACzF,sCAAsC;AAEtC,IAAA,iBAAQ,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,IAAA,WAAE,EAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,KAAK,GAAG,IAAA,kCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAA,oCAAkB,EAAC,KAAK,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,IAAA,kBAAS,GAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7G,IAAA,eAAM,EAAC,IAAA,oCAAkB,EAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClH,IAAA,eAAM,EAAC,IAAA,oCAAkB,EAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,IAAA,kBAAS,GAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1G,IAAA,eAAM,EAAC,IAAA,oCAAkB,EAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,IAAA,eAAM,EAAC,IAAA,oCAAkB,EAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,IAAA,eAAM,EAAC,IAAA,oCAAkB,EAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,IAAA,eAAM,EAAC,IAAA,oCAAkB,EAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,uEAAuE;AACvE,wEAAwE;AACxE,qBAAqB;AAErB,IAAA,iBAAQ,EAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,0DAA0D;IAC1D,IAAA,WAAE,EAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,GAAkC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG;YACf,KAAK,EAAE;gBACL,KAAK,EAAE,KAAK,EAAE,CAAS,EAAE,CAAS,EAAE,IAAwB,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9G,IAAI,EAAE,KAAK,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,KAAK,EAAE,KAAK,EAAE,EAAU,EAAE,EAAU,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5E;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,EAAE,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,KAAK,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxD;YACD,eAAe,EAAE,KAAK,EAAE,CAAoC,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5G,CAAC;QACF,MAAM,WAAW,GAAG;YAClB,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,EAAW,EAAE,OAAO,EAAE,EAAW;YACnE,IAAI,EAAE,QAAiB,EAAE,GAAG,EAAE,EAAW;YACzC,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;YAC/B,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE;SACvC,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,mCAAmC,GAAC,CAAC;QAE1E,0DAA0D;QAC1D,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAEtD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACtH,4CAA4C;QAC5C,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,CAAC,IAAI,EAAE,OAAO,CAAC;YACf,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;YAC7B,CAAC,IAAI,EAAE,OAAO,CAAC;SAChB,CAAC,CAAC;QAEH,uBAAuB;QACvB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,CAAC,MAAM,CAAC;YACR,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC;SACzB,CAAC,CAAC;QAEH,6CAA6C;QAC7C,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE1B,+BAA+B;QAC/B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAE3C,2BAA2B;QAC3B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG;YACf,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE;YAC7E,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpD,EAAE,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClD,KAAK,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrD,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;aACrB;YACD,eAAe,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;SAChC,CAAC;QACF,MAAM,WAAW,GAAG;YAClB,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,EAAW,EAAE,OAAO,EAAE,EAAW;YACnE,IAAI,EAAE,QAAiB,EAAE,GAAG,EAAE,EAAW;YACzC,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;YAC/B,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE;SACvC,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,mCAAmC,GAAC,CAAC;QAE1E,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG;YACf,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE;YAC7E,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE;YAC5H,eAAe,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;SAChC,CAAC;QACF,MAAM,WAAW,GAAG;YAClB,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,EAAW,EAAE,OAAO,EAAE,EAAW;YACnE,IAAI,EAAE,QAAiB,EAAE,GAAG,EAAE,EAAW;YACzC,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;YAC/B,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE;SACvC,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,mCAAmC,GAAC,CAAC;QAE1E,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1E,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/backend/dist/__tests__/browser-proxy.test.js

@@ -42,13 +42,14 @@ const http = __importStar(require("http"));
 const jwt = __importStar(require("jsonwebtoken"));
 const browser_proxy_1 = __importStar(require("../routes/browser-proxy"));
 const config_1 = require("../config");
-// Mint a valid browser-proxy session cookie using the real jwt secret —
-// the test machine has a config.json so getConfig() works. CI without
-// config would skip these e2e tests.
-function mintProxyCookie() {
+// Mint a valid browser-proxy session token using the real jwt secret —
+// the test machine has a config.json so getConfig() works.
+function mintProxyToken() {
     const config = (0, config_1.getConfig)();
-    const token = jwt.sign({ username: 'test', typ: 'browser-proxy' }, config.jwtSecret, { expiresIn: '1h' });
-    return `ccweb_bp=${encodeURIComponent(token)}`;
+    return jwt.sign({ username: 'test', typ: 'browser-proxy' }, config.jwtSecret, { expiresIn: '1h' });
+}
+function tok() {
+    return `_bp_tok=${encodeURIComponent(mintProxyToken())}`;
 }
 (0, vitest_1.describe)('parseHostport', () => {
     (0, vitest_1.it)('接受 host:port (http only)', () => {
@@ -134,69 +135,94 @@ function mintProxyCookie() {
 });
 (0, vitest_1.describe)('rewriteHtml', () => {
     const prefix = '/api/browser-proxy/127.0.0.1:8080';
-    (0, vitest_1.it)('重写 src/href/action 的 root-absolute path', () => {
+    const T = 'TESTTOK';
+    (0, vitest_1.it)('重写 src/href/action 的 root-absolute path 并带上 token', () => {
         const input = '<script src="/main.js"></script><a href="/about">x</a><form action="/login">';
-        const out = (0, browser_proxy_1.rewriteHtml)(input, prefix);
-        (0, vitest_1.expect)(out).toContain('src="/api/browser-proxy/127.0.0.1:8080/main.js"');
-        (0, vitest_1.expect)(out).toContain('href="/api/browser-proxy/127.0.0.1:8080/about"');
-        (0, vitest_1.expect)(out).toContain('action="/api/browser-proxy/127.0.0.1:8080/login"');
+        const out = (0, browser_proxy_1.rewriteHtml)(input, prefix, T);
+        (0, vitest_1.expect)(out).toContain('src="/api/browser-proxy/127.0.0.1:8080/main.js?_bp_tok=TESTTOK"');
+        (0, vitest_1.expect)(out).toContain('href="/api/browser-proxy/127.0.0.1:8080/about?_bp_tok=TESTTOK"');
+        (0, vitest_1.expect)(out).toContain('action="/api/browser-proxy/127.0.0.1:8080/login?_bp_tok=TESTTOK"');
+    });
+    (0, vitest_1.it)('已有 query string 用 & 拼 token', () => {
+        const input = '<a href="/foo?x=1">';
+        const out = (0, browser_proxy_1.rewriteHtml)(input, prefix, T);
+        (0, vitest_1.expect)(out).toContain('href="/api/browser-proxy/127.0.0.1:8080/foo?x=1&_bp_tok=TESTTOK"');
     });
     (0, vitest_1.it)('strip 上游 <base href> 避免覆盖代理路径', () => {
         const input = '<head><base href="/"><base href="https://other.example/"></head><body></body>';
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix)).toBe('<head></head><body></body>');
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix, T)).toBe('<head></head><body></body>');
     });
     (0, vitest_1.it)('protocol-relative (//) 不改', () => {
         const input = '<img src="//cdn.example.com/x.png">';
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix)).toBe(input);
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix, T)).toBe(input);
     });
     (0, vitest_1.it)('相对路径不改', () => {
         const input = '<img src="foo/bar.png"><a href="../other">x</a>';
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix)).toBe(input);
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix, T)).toBe(input);
     });
     (0, vitest_1.it)('绝对 URL 不改', () => {
         const input = '<a href="https://example.com/path">x</a>';
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix)).toBe(input);
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix, T)).toBe(input);
     });
     (0, vitest_1.it)('单引号 attribute 也支持', () => {
         const input = "<a href='/foo'>";
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix)).toContain("href='/api/browser-proxy/127.0.0.1:8080/foo'");
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteHtml)(input, prefix, T)).toContain("href='/api/browser-proxy/127.0.0.1:8080/foo?_bp_tok=TESTTOK'");
     });
 });
 (0, vitest_1.describe)('rewriteLocationHeader', () => {
     const parsed = { host: '127.0.0.1', port: 8080 };
     const prefix = '/api/browser-proxy/127.0.0.1:8080';
-    (0, vitest_1.it)('absolute redirect 同 scheme/host/port → 重写为 proxy URL', () => {
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('http://127.0.0.1:8080/new-path?x=1', parsed, prefix))
-            .toBe('/api/browser-proxy/127.0.0.1:8080/new-path?x=1');
+    const T = 'TESTTOK';
+    (0, vitest_1.it)('absolute redirect 同 scheme/host/port → 重写为 proxy URL 并带 token', () => {
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('http://127.0.0.1:8080/new-path?x=1', parsed, prefix, T))
+            .toBe('/api/browser-proxy/127.0.0.1:8080/new-path?x=1&_bp_tok=TESTTOK');
     });
     (0, vitest_1.it)('absolute redirect 不同 scheme → 原样保留（防协议混淆）', () => {
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('https://127.0.0.1:8080/foo', parsed, prefix))
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('https://127.0.0.1:8080/foo', parsed, prefix, T))
             .toBe('https://127.0.0.1:8080/foo');
     });
     (0, vitest_1.it)('absolute redirect 不同 host → 原样保留', () => {
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('http://other.example/foo', parsed, prefix))
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('http://other.example/foo', parsed, prefix, T))
             .toBe('http://other.example/foo');
     });
-    (0, vitest_1.it)('root-relative redirect → 加前缀', () => {
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('/foo?x=1', parsed, prefix))
-            .toBe('/api/browser-proxy/127.0.0.1:8080/foo?x=1');
+    (0, vitest_1.it)('root-relative redirect → 加前缀 + token', () => {
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('/foo?x=1', parsed, prefix, T))
+            .toBe('/api/browser-proxy/127.0.0.1:8080/foo?x=1&_bp_tok=TESTTOK');
     });
     (0, vitest_1.it)('protocol-relative (//) → 不改', () => {
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('//cdn.example/x', parsed, prefix))
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('//cdn.example/x', parsed, prefix, T))
             .toBe('//cdn.example/x');
     });
     (0, vitest_1.it)('纯相对路径 → 不改', () => {
-        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('foo/bar', parsed, prefix))
+        (0, vitest_1.expect)((0, browser_proxy_1.rewriteLocationHeader)('foo/bar', parsed, prefix, T))
             .toBe('foo/bar');
     });
 });
+(0, vitest_1.describe)('stripTokenFromSubPath', () => {
+    (0, vitest_1.it)('移除 _bp_tok 不留空 query', () => {
+        (0, vitest_1.expect)((0, browser_proxy_1.stripTokenFromSubPath)('/foo?_bp_tok=abc')).toBe('/foo');
+        (0, vitest_1.expect)((0, browser_proxy_1.stripTokenFromSubPath)('/foo?_bp_tok=abc#hash')).toBe('/foo#hash');
+    });
+    (0, vitest_1.it)('保留其它 query', () => {
+        (0, vitest_1.expect)((0, browser_proxy_1.stripTokenFromSubPath)('/foo?x=1&_bp_tok=abc&y=2')).toBe('/foo?x=1&y=2');
+        (0, vitest_1.expect)((0, browser_proxy_1.stripTokenFromSubPath)('/foo?_bp_tok=abc&x=1')).toBe('/foo?x=1');
+        (0, vitest_1.expect)((0, browser_proxy_1.stripTokenFromSubPath)('/foo?x=1&_bp_tok=abc')).toBe('/foo?x=1');
+    });
+    (0, vitest_1.it)('没 token 不动', () => {
+        (0, vitest_1.expect)((0, browser_proxy_1.stripTokenFromSubPath)('/foo')).toBe('/foo');
+        (0, vitest_1.expect)((0, browser_proxy_1.stripTokenFromSubPath)('/foo?x=1')).toBe('/foo?x=1');
+        (0, vitest_1.expect)((0, browser_proxy_1.stripTokenFromSubPath)('/')).toBe('/');
+    });
+});
 (0, vitest_1.describe)('e2e: browser-proxy router 跑通本地 dummy server', () => {
     let upstream;
     let upstreamPort = 0;
     let proxy;
     let proxyPort = 0;
+    const upstreamSeenUrls = [];
     (0, vitest_1.beforeAll)(async () => {
         upstream = http.createServer((req, res) => {
+            upstreamSeenUrls.push(req.url || '');
             if (req.url === '/index.html') {
                 res.writeHead(200, {
                     'Content-Type': 'text/html; charset=utf-8',
@@ -232,26 +258,25 @@ function mintProxyCookie() {
         await new Promise((resolve) => upstream.close(() => resolve()));
         await new Promise((resolve) => proxy.close(() => resolve()));
     });
-    const withCookie = (path, init) => fetch(`http://127.0.0.1:${proxyPort}${path}`, { ...(init ?? {}), headers: { ...(init?.headers ?? {}), Cookie: mintProxyCookie() } });
-    (0, vitest_1.it)('无 cookie → 403 (session required)', async () => {
+    const withTok = (path, init) => {
+        const sep = path.includes('?') ? '&' : '?';
+        return fetch(`http://127.0.0.1:${proxyPort}${path}${sep}${tok()}`, init);
+    };
+    (0, vitest_1.it)('无 token → 403 (session required)', async () => {
         const r = await fetch(`http://127.0.0.1:${proxyPort}/api/browser-proxy/127.0.0.1:${upstreamPort}/index.html`);
         (0, vitest_1.expect)(r.status).toBe(403);
     });
-    (0, vitest_1.it)('伪造的 cookie (错 typ 或错 secret) → 403', async () => {
+    (0, vitest_1.it)('伪造的 token (错 typ 或错 secret) → 403', async () => {
         const config = (0, config_1.getConfig)();
         const wrongTyp = jwt.sign({ username: 'x', typ: 'user' }, config.jwtSecret, { expiresIn: '1h' });
-        const r1 = await fetch(`http://127.0.0.1:${proxyPort}/api/browser-proxy/127.0.0.1:${upstreamPort}/index.html`, {
-            headers: { Cookie: `ccweb_bp=${encodeURIComponent(wrongTyp)}` },
-        });
+        const r1 = await fetch(`http://127.0.0.1:${proxyPort}/api/browser-proxy/127.0.0.1:${upstreamPort}/index.html?_bp_tok=${encodeURIComponent(wrongTyp)}`);
         (0, vitest_1.expect)(r1.status).toBe(403);
         const wrongSecret = jwt.sign({ username: 'x', typ: 'browser-proxy' }, 'not-the-secret', { expiresIn: '1h' });
-        const r2 = await fetch(`http://127.0.0.1:${proxyPort}/api/browser-proxy/127.0.0.1:${upstreamPort}/index.html`, {
-            headers: { Cookie: `ccweb_bp=${encodeURIComponent(wrongSecret)}` },
-        });
+        const r2 = await fetch(`http://127.0.0.1:${proxyPort}/api/browser-proxy/127.0.0.1:${upstreamPort}/index.html?_bp_tok=${encodeURIComponent(wrongSecret)}`);
         (0, vitest_1.expect)(r2.status).toBe(403);
     });
-    (0, vitest_1.it)('代理 HTML：strip X-Frame / CSP / Clear-Site-Data + rewrite path + 注入 CSP sandbox', async () => {
-        const r = await withCookie(`/api/browser-proxy/127.0.0.1:${upstreamPort}/index.html`);
+    (0, vitest_1.it)('代理 HTML：strip X-Frame / CSP / Clear-Site-Data + rewrite path + 注入 CSP sandbox + 带 token', async () => {
+        const r = await withTok(`/api/browser-proxy/127.0.0.1:${upstreamPort}/index.html`);
         (0, vitest_1.expect)(r.status).toBe(200);
         (0, vitest_1.expect)(r.headers.get('x-frame-options')).toBeNull();
         (0, vitest_1.expect)(r.headers.get('content-security-policy')).toContain('sandbox');
@@ -259,36 +284,45 @@ function mintProxyCookie() {
         (0, vitest_1.expect)(r.headers.get('content-security-policy')).not.toContain('allow-popups-to-escape-sandbox');
         (0, vitest_1.expect)(r.headers.get('clear-site-data')).toBeNull();
         const body = await r.text();
-        (0, vitest_1.expect)(body).toContain(`href="/api/browser-proxy/127.0.0.1:${upstreamPort}/about"`);
-        (0, vitest_1.expect)(body).toContain(`src="/api/browser-proxy/127.0.0.1:${upstreamPort}/m.js"`);
+        (0, vitest_1.expect)(body).toMatch(new RegExp(`href="/api/browser-proxy/127\\.0\\.0\\.1:${upstreamPort}/about\\?_bp_tok=`));
+        (0, vitest_1.expect)(body).toMatch(new RegExp(`src="/api/browser-proxy/127\\.0\\.0\\.1:${upstreamPort}/m\\.js\\?_bp_tok=`));
         (0, vitest_1.expect)(body).not.toContain('<base');
     });
     (0, vitest_1.it)('代理 JS：原样透传不重写', async () => {
-        const r = await withCookie(`/api/browser-proxy/127.0.0.1:${upstreamPort}/m.js`);
+        const r = await withTok(`/api/browser-proxy/127.0.0.1:${upstreamPort}/m.js`);
         (0, vitest_1.expect)(r.status).toBe(200);
         (0, vitest_1.expect)(await r.text()).toBe('console.log(1);');
     });
-    (0, vitest_1.it)('代理 redirect：root-relative Location 加前缀', async () => {
-        const r = await withCookie(`/api/browser-proxy/127.0.0.1:${upstreamPort}/redir`, { redirect: 'manual' });
+    (0, vitest_1.it)('代理 redirect：root-relative Location 加前缀 + token', async () => {
+        const r = await withTok(`/api/browser-proxy/127.0.0.1:${upstreamPort}/redir`, { redirect: 'manual' });
         (0, vitest_1.expect)(r.status).toBe(302);
-        (0, vitest_1.expect)(r.headers.get('location')).toBe(`/api/browser-proxy/127.0.0.1:${upstreamPort}/landed`);
+        (0, vitest_1.expect)(r.headers.get('location')).toMatch(new RegExp(`^/api/browser-proxy/127\\.0\\.0\\.1:${upstreamPort}/landed\\?_bp_tok=`));
     });
     (0, vitest_1.it)('拒绝公网字面量 IP (403)', async () => {
-        const r = await withCookie('/api/browser-proxy/1.1.1.1:80/');
+        const r = await withTok('/api/browser-proxy/1.1.1.1:80/');
         (0, vitest_1.expect)(r.status).toBe(403);
     });
     (0, vitest_1.it)('拒绝 cloud metadata IP (403)', async () => {
-        const r = await withCookie('/api/browser-proxy/169.254.169.254:80/');
+        const r = await withTok('/api/browser-proxy/169.254.169.254:80/');
         (0, vitest_1.expect)(r.status).toBe(403);
     });
     (0, vitest_1.it)('拒绝非法 hostport (400)', async () => {
-        const r = await withCookie('/api/browser-proxy/not-a-host');
+        const r = await withTok('/api/browser-proxy/not-a-host');
         (0, vitest_1.expect)(r.status).toBe(400);
     });
     (0, vitest_1.it)('拒绝黑名单端口 (400)', async () => {
-        const r = await withCookie('/api/browser-proxy/127.0.0.1:22/');
+        const r = await withTok('/api/browser-proxy/127.0.0.1:22/');
         (0, vitest_1.expect)(r.status).toBe(400);
     });
+    (0, vitest_1.it)('session token 不泄露给上游', async () => {
+        upstreamSeenUrls.length = 0;
+        await withTok(`/api/browser-proxy/127.0.0.1:${upstreamPort}/index.html`);
+        await withTok(`/api/browser-proxy/127.0.0.1:${upstreamPort}/m.js`);
+        (0, vitest_1.expect)(upstreamSeenUrls.length).toBeGreaterThan(0);
+        for (const u of upstreamSeenUrls) {
+            (0, vitest_1.expect)(u).not.toContain('_bp_tok');
+        }
+    });
     (0, vitest_1.it)('_session 无 Bearer token → 401', async () => {
         const r = await fetch(`http://127.0.0.1:${proxyPort}/api/browser-proxy/_session`, { method: 'POST' });
         (0, vitest_1.expect)(r.status).toBe(401);