@tulex-cli/tulex-code 0.1.1

package/dist/src/serve/auth/qwenDeviceFlowProvider.test.js

@@ -0,0 +1,301 @@
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Unit tests for `QwenOAuthDeviceFlowProvider`'s stderr audit path.
+ *
+ * PR #4291 follow-up review (qwen-latest, #1): the catch block in
+ * `poll()` adds 4 distinct branches (AbortError skip, structured
+ * `QwenOAuthPollError`, generic `Error` with name+length redaction,
+ * non-Error throw) that drive what — if anything — lands in the
+ * operator audit. The security-critical pieces are:
+ *
+ * - `device_code` + PKCE verifier are POSTed to the IdP per RFC 8628
+ *   §3.4. A WAF / reverse proxy that echoes the request body in its
+ *   error response would put both into stderr if we naively logged
+ *   `err.message` — violating the BrandedSecret-style "secrets never
+ *   appear in logs" contract the registry depends on.
+ * - The cancel/dispose lifecycle MUST stay quiet — emitting a "poll
+ *   failed" line on every normal cancellation pollutes the audit.
+ *
+ * These tests pin all four branches against a stub `IQwenOAuth2Client`
+ * so a future refactor that drops the redaction shows up in CI.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { QwenOAuthPollError, } from '@tulex-cli/tulex-cli-core';
+import { QwenOAuthDeviceFlowProvider } from './qwenDeviceFlowProvider.js';
+import { brandSecret } from './deviceFlow.js';
+function fakeClient(overrides = {}) {
+    return {
+        setCredentials: () => { },
+        getCredentials: () => ({}),
+        getAccessToken: async () => ({}),
+        requestDeviceAuthorization: async () => ({}),
+        pollDeviceToken: async () => ({}),
+        refreshAccessToken: async () => ({}),
+        ...overrides,
+    };
+}
+describe('QwenOAuthDeviceFlowProvider.poll() — stderr audit branches', () => {
+    let stderrLines;
+    let stderrSpy;
+    let originalWrite;
+    beforeEach(() => {
+        stderrLines = [];
+        originalWrite = process.stderr.write.bind(process.stderr);
+        stderrSpy = vi.fn((chunk) => {
+            stderrLines.push(typeof chunk === 'string' ? chunk : chunk.toString());
+            return true;
+        });
+        // process.stderr.write has overloaded signatures; cast to align with
+        // the chunk-only call shape used by writeStderrLine.
+        process.stderr.write = stderrSpy;
+    });
+    afterEach(() => {
+        process.stderr.write = originalWrite;
+    });
+    function makeState() {
+        return {
+            deviceCode: brandSecret('device-code-secret-AAAA1111'),
+            pkceVerifier: brandSecret('pkce-verifier-secret-BBBB2222'),
+        };
+    }
+    it('skips stderr audit when caller aborted before poll started (signal.aborted check)', async () => {
+        // The early `opts.signal.aborted` short-circuit returns `pending`
+        // without invoking `pollDeviceToken` at all — no fetch, no catch,
+        // no audit. Pin the negative case so a future refactor that
+        // accidentally writes a stderr line on this path fails CI.
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient());
+        const controller = new AbortController();
+        controller.abort();
+        const result = await provider.poll(makeState(), {
+            signal: controller.signal,
+        });
+        expect(result.kind).toBe('pending');
+        expect(stderrLines).toHaveLength(0);
+    });
+    it('skips stderr audit when AbortError is thrown AND the registry-owned signal is aborted (cancel/dispose lifecycle)', async () => {
+        // `cancel()` / `dispose()` aborts the AbortController and the
+        // underlying fetch throws an `AbortError`-like exception. This
+        // is normal lifecycle. The post-await `opts.signal.aborted`
+        // check is what proves WE caused the abort — that's the gate,
+        // not the error name itself.
+        const abortErr = new Error('The operation was aborted.');
+        abortErr.name = 'AbortError';
+        const controller = new AbortController();
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient({
+            pollDeviceToken: async () => {
+                controller.abort();
+                throw abortErr;
+            },
+        }));
+        const result = await provider.poll(makeState(), {
+            signal: controller.signal,
+        });
+        expect(result.kind).toBe('error');
+        if (result.kind === 'error') {
+            expect(result.errorKind).toBe('upstream_error');
+        }
+        expect(stderrLines).toHaveLength(0);
+    });
+    it('LOGS unexpected AbortError when the registry-owned signal is NOT aborted (transport / proxy / undici)', async () => {
+        // PR #4291 follow-up review (gpt-5.5, #1): an `AbortError` can
+        // come from sources we did NOT initiate — upstream IdP TCP RST,
+        // proxy timeout, undici/node-fetch wrapping unrelated transport
+        // failures as AbortError. Earlier shape silently dropped these
+        // because of the `err.name === 'AbortError'` skip; now we only
+        // skip when WE caused the abort. Unexpected AbortError must
+        // still produce a stderr breadcrumb.
+        const abortErr = new Error('The operation was aborted.');
+        abortErr.name = 'AbortError';
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient({
+            pollDeviceToken: async () => {
+                throw abortErr;
+            },
+        }));
+        const result = await provider.poll(makeState(), {
+            // Signal NOT aborted — the abort came from an upstream source.
+            signal: new AbortController().signal,
+        });
+        expect(result.kind).toBe('error');
+        if (result.kind === 'error') {
+            expect(result.errorKind).toBe('upstream_error');
+        }
+        expect(stderrLines).toHaveLength(1);
+        const line = stderrLines[0];
+        // Routes through the non-OAuth Error path (name + length).
+        expect(line).toContain('AbortError');
+        expect(line).toContain('raw suppressed');
+        // Negative: the raw message is NOT echoed.
+        expect(line).not.toContain('The operation was aborted.');
+    });
+    it('skips stderr audit when signal.aborted is set after the throw, even for non-AbortError errors', async () => {
+        // The other half of the abort guard: a cooperative provider
+        // notices the signal is aborted post-fetch and throws something
+        // generic. We still treat the post-await `signal.aborted` as
+        // proof this was a cancel, not a real failure.
+        const controller = new AbortController();
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient({
+            pollDeviceToken: async () => {
+                controller.abort();
+                throw new Error('socket hangup');
+            },
+        }));
+        const result = await provider.poll(makeState(), {
+            signal: controller.signal,
+        });
+        expect(result.kind).toBe('error');
+        expect(stderrLines).toHaveLength(0);
+    });
+    it('logs only the structured oauthError field on QwenOAuthPollError (no raw body, no device_code/PKCE leak)', async () => {
+        // Critical security path: even when the upstream RESPONSE includes
+        // the request body verbatim (WAF echo, hostile reverse proxy), the
+        // QwenOAuthPollError carries only the structured `oauthError` /
+        // `description` fields. Logging those is safe; logging
+        // `err.message` would re-introduce the leak vector.
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient({
+            pollDeviceToken: async () => {
+                throw new QwenOAuthPollError({
+                    oauthError: 'slow_down',
+                    description: 'Polling too fast',
+                    status: 400,
+                });
+            },
+        }));
+        const result = await provider.poll(makeState(), {
+            signal: new AbortController().signal,
+        });
+        expect(result.kind).toBe('error');
+        expect(stderrLines).toHaveLength(1);
+        const line = stderrLines[0];
+        expect(line).toContain('qwen device-flow poll failed');
+        expect(line).toContain('oauthError=slow_down');
+        // The raw default message ("Device token poll failed: slow_down -
+        // Polling too fast") MUST NOT appear — only the structured field.
+        expect(line).not.toContain('Device token poll failed:');
+        expect(line).not.toContain('device-code-secret');
+        expect(line).not.toContain('pkce-verifier-secret');
+    });
+    it('logs only err.name + message length on generic Error (raw message is suppressed)', async () => {
+        // The catch block treats any non-OAuth Error as potentially
+        // tainted (a fetch wrapper that templated the request body into
+        // its message). Log just the constructor name + length so
+        // on-call gets a triage-able breadcrumb without the request body.
+        const longMessage = 'HTTP 502 from qwen IdP: <html><body>Forbidden — request body: device_code=device-code-secret-AAAA1111&code_verifier=pkce-verifier-secret-BBBB2222</body></html>';
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient({
+            pollDeviceToken: async () => {
+                throw new Error(longMessage);
+            },
+        }));
+        const result = await provider.poll(makeState(), {
+            signal: new AbortController().signal,
+        });
+        expect(result.kind).toBe('error');
+        if (result.kind === 'error') {
+            expect(result.errorKind).toBe('upstream_error');
+        }
+        expect(stderrLines).toHaveLength(1);
+        const line = stderrLines[0];
+        expect(line).toContain('Error');
+        expect(line).toContain(`message ${longMessage.length} bytes`);
+        expect(line).toContain('raw suppressed');
+        // Hard assertions: NEITHER the raw message NOR the templated
+        // device-flow secrets may appear in stderr.
+        expect(line).not.toContain('HTTP 502 from qwen');
+        expect(line).not.toContain('device-code-secret');
+        expect(line).not.toContain('pkce-verifier-secret');
+    });
+    it('logs <non-Error throw: typeof> placeholder when a non-Error value is thrown', async () => {
+        // `throw 'string'` is bad practice but fetch wrappers sometimes
+        // do it (or `throw { code: 'X' }`). The catch block writes a
+        // typeof-bound placeholder and gives up on extracting more —
+        // the typed return shape (`upstream_error`) carries enough for
+        // the SSE consumer.
+        // The catch in poll() must handle non-Error throws. We wrap the
+        // raw throw inside a sync function called from the async path so
+        // the lint rule against literal throws can stay enabled — the
+        // reject value is what we're testing, not the throw idiom.
+        const nonErrorThrower = () => {
+            const value = 'this is not an Error instance';
+            throw value;
+        };
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient({
+            pollDeviceToken: async () => nonErrorThrower(),
+        }));
+        const result = await provider.poll(makeState(), {
+            signal: new AbortController().signal,
+        });
+        expect(result.kind).toBe('error');
+        expect(stderrLines).toHaveLength(1);
+        const line = stderrLines[0];
+        expect(line).toContain('<non-Error throw: string>');
+        // The raw thrown string is NOT echoed.
+        expect(line).not.toContain('this is not an Error instance');
+    });
+    it('reports the resolved errorKind on every emitted stderr line so triage can branch on it', async () => {
+        // Mapping check: the `errorKind` field in the typed return AND
+        // the stderr breadcrumb must agree. A mis-mapping here would
+        // route the SSE consumer one way and the operator another.
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient({
+            pollDeviceToken: async () => {
+                throw new QwenOAuthPollError({
+                    oauthError: 'access_denied',
+                    description: 'user declined',
+                    status: 400,
+                });
+            },
+        }));
+        const result = await provider.poll(makeState(), {
+            signal: new AbortController().signal,
+        });
+        expect(result.kind).toBe('error');
+        if (result.kind === 'error') {
+            expect(result.errorKind).toBe('access_denied');
+        }
+        expect(stderrLines).toHaveLength(1);
+        expect(stderrLines[0]).toContain('errorKind=access_denied');
+        expect(stderrLines[0]).toContain('oauthError=access_denied');
+    });
+    it('sanitizes control characters and ANSI escapes in attacker-controlled oauthError before stderr interpolation', async () => {
+        // PR #4291 follow-up review (gpt-5.5, #2): the OAuth `error` field
+        // comes directly from the upstream JSON. A compromised IdP / WAF
+        // / proxy can return a value containing newlines, terminal control
+        // characters, or ANSI escape sequences — interpolating that
+        // verbatim into a stderr line would forge additional log entries
+        // or inject color/cursor-movement sequences into operator
+        // terminals. `sanitizeForStderr` strips C0/C1 controls + DEL.
+        const malicious = 'slow_down\n[serve] FORGED LOG ENTRY 2026-01-01\x1b[31mRED\x1b[0m';
+        const provider = new QwenOAuthDeviceFlowProvider(fakeClient({
+            pollDeviceToken: async () => {
+                throw new QwenOAuthPollError({
+                    oauthError: malicious,
+                    description: 'attacker-supplied',
+                    status: 400,
+                });
+            },
+        }));
+        const result = await provider.poll(makeState(), {
+            signal: new AbortController().signal,
+        });
+        expect(result.kind).toBe('error');
+        expect(stderrLines).toHaveLength(1);
+        const line = stderrLines[0];
+        // The forged log line text MUST NOT appear as a real second line.
+        // Implementation replaces \n with `?`, so the body is on a single
+        // line and the second `[serve]` no longer leads a line.
+        expect(line.split('\n').length).toBe(2); // single content line + trailing newline
+        // ANSI escape \x1b is gone.
+        expect(line).not.toContain('\x1b[31m');
+        expect(line).not.toContain('\x1b[0m');
+        // Newline inside the value is gone.
+        expect(line).not.toMatch(/\n\[serve\] FORGED/);
+        // The literal text after the controls is preserved (operator can
+        // still see what the IdP claimed) — only the harmful bytes are
+        // replaced.
+        expect(line).toContain('FORGED LOG ENTRY');
+        expect(line).toContain('RED');
+    });
+});
+//# sourceMappingURL=qwenDeviceFlowProvider.test.js.map

package/dist/src/serve/auth/qwenDeviceFlowProvider.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qwenDeviceFlowProvider.test.js","sourceRoot":"","sources":["../../../../src/serve/auth/qwenDeviceFlowProvider.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,SAAS,UAAU,CACjB,YAAwC,EAAE;IAE1C,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,GAAE,CAAC;QACxB,cAAc,EAAE,GAAG,EAAE,CACnB,CAAC,EAAE,CAAoD;QACzD,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CACrC,CAAC,EAAE,CAEF;QACH,eAAe,EAAE,KAAK,IAAI,EAAE,CAC1B,CAAC,EAAE,CAA8D;QACnE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAC7B,CAAC,EAAE,CAAiE;QACtE,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,4DAA4D,EAAE,GAAG,EAAE;IAC1E,IAAI,WAAqB,CAAC;IAC1B,IAAI,SAAmC,CAAC;IACxC,IAAI,aAA0C,CAAC;IAE/C,UAAU,CAAC,GAAG,EAAE;QACd,WAAW,GAAG,EAAE,CAAC;QACjB,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,KAA0B,EAAE,EAAE;YAC/C,WAAW,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,qEAAqE;QACrE,qDAAqD;QACpD,OAAO,CAAC,MAA6B,CAAC,KAAK,GAAG,SAAS,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACZ,OAAO,CAAC,MAA0C,CAAC,KAAK,GAAG,aAAa,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,SAAS,SAAS;QAChB,OAAO;YACL,UAAU,EAAE,WAAW,CAAC,6BAA6B,CAAC;YACtD,YAAY,EAAE,WAAW,CAAC,+BAA+B,CAAC;SAC3D,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,kEAAkE;QAClE,kEAAkE;QAClE,4DAA4D;QAC5D,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kHAAkH,EAAE,KAAK,IAAI,EAAE;QAChI,8DAA8D;QAC9D,+DAA+D;QAC/D,4DAA4D;QAC5D,8DAA8D;QAC9D,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAC9C,UAAU,CAAC;YACT,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,QAAQ,CAAC;YACjB,CAAC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;QACrH,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,qCAAqC;QACrC,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAC9C,UAAU,CAAC;YACT,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,QAAQ,CAAC;YACjB,CAAC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,+DAA+D;YAC/D,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,2DAA2D;QAC3D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACzC,2CAA2C;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,4DAA4D;QAC5D,gEAAgE;QAChE,6DAA6D;QAC7D,+CAA+C;QAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAC9C,UAAU,CAAC;YACT,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;QACvH,mEAAmE;QACnE,mEAAmE;QACnE,gEAAgE;QAChE,uDAAuD;QACvD,oDAAoD;QACpD,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAC9C,UAAU,CAAC;YACT,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,UAAU,EAAE,WAAW;oBACvB,WAAW,EAAE,kBAAkB;oBAC/B,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC/C,kEAAkE;QAClE,kEAAkE;QAClE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,4DAA4D;QAC5D,gEAAgE;QAChE,0DAA0D;QAC1D,kEAAkE;QAClE,MAAM,WAAW,GACf,iKAAiK,CAAC;QACpK,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAC9C,UAAU,CAAC;YACT,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/B,CAAC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACzC,6DAA6D;QAC7D,4CAA4C;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,gEAAgE;QAChE,6DAA6D;QAC7D,6DAA6D;QAC7D,+DAA+D;QAC/D,oBAAoB;QACpB,gEAAgE;QAChE,iEAAiE;QACjE,8DAA8D;QAC9D,2DAA2D;QAC3D,MAAM,eAAe,GAAG,GAAU,EAAE;YAClC,MAAM,KAAK,GAAY,+BAA+B,CAAC;YACvD,MAAM,KAAc,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAC9C,UAAU,CAAC;YACT,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,EAAE;SAC/C,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACpD,uCAAuC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,+DAA+D;QAC/D,6DAA6D;QAC7D,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAC9C,UAAU,CAAC;YACT,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,UAAU,EAAE,eAAe;oBAC3B,WAAW,EAAE,eAAe;oBAC5B,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6GAA6G,EAAE,KAAK,IAAI,EAAE;QAC3H,mEAAmE;QACnE,iEAAiE;QACjE,mEAAmE;QACnE,4DAA4D;QAC5D,iEAAiE;QACjE,0DAA0D;QAC1D,8DAA8D;QAC9D,MAAM,SAAS,GACb,kEAAkE,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAC9C,UAAU,CAAC;YACT,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,UAAU,EAAE,SAAS;oBACrB,WAAW,EAAE,mBAAmB;oBAChC,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,kEAAkE;QAClE,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,yCAAyC;QAClF,4BAA4B;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,oCAAoC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/C,iEAAiE;QACjE,+DAA+D;QAC/D,YAAY;QACZ,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/serve/auth.d.ts

@@ -0,0 +1,101 @@
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { RequestHandler } from 'express';
+/**
+ * Reject any request that carries an `Origin` header. CLI/SDK clients never
+ * set Origin; only browsers do. Returning a deterministic 403 JSON keeps
+ * the daemon from CSRF-ing itself (and is more useful to clients than the
+ * 500 HTML default that the `cors` package's error-callback path produces
+ * when no Express error middleware is registered).
+ */
+export declare const denyBrowserOriginCors: RequestHandler;
+/**
+ * Reject requests whose Host header isn't one of the bound interfaces.
+ * Defense against DNS rebinding when the daemon is on loopback.
+ *
+ * `bind` is the hostname the listener was started with. `getPort` is read
+ * lazily on each request because callers commonly request port 0 (ephemeral)
+ * and only learn the actual port once `listen()` has resolved.
+ */
+export declare function hostAllowlist(bind: string, getPort: () => number): RequestHandler;
+/**
+ * Bearer token middleware. When `token` is undefined the gate is open — used
+ * for the loopback-only developer default. `runQwenServe` enforces that any
+ * non-loopback bind has a token, and that `--require-auth` boots only with a
+ * token configured, so this no-token branch is reachable only on loopback
+ * developer setups that opted out of `--require-auth`.
+ */
+export declare function bearerAuth(token: string | undefined): RequestHandler;
+/**
+ * Per-route mutation gate (issue #4175 PR 15).
+ *
+ * Wave 4 (PR 16-21) will add broadly state-changing routes — memory
+ * CRUD, agent CRUD, tool enable/disable, MCP restart, file write/edit,
+ * device-flow auth, etc. The roadmap calls for "a single mutation-gating
+ * helper rather than open-code auth checks per route" so all those
+ * routes share one choke point. This factory is that choke point;
+ * Wave 1-2 routes apply it as a centralization marker (no behavior
+ * change today), and Wave 4 routes opt into `strict: true` to enforce
+ * "token required even on loopback" without depending on the operator
+ * also passing `--require-auth`.
+ *
+ * Behavior matrix:
+ *
+ * | daemon config              | route opts        | result          |
+ * | -------------------------- | ----------------- | --------------- |
+ * | requireAuth=true           | any               | passthrough (1) |
+ * | token configured           | any               | passthrough (2) |
+ * | no token (loopback dev)    | strict=false      | passthrough     |
+ * | no token (loopback dev)    | strict=true       | 401 + code      |
+ *
+ * (1) `--require-auth` boots only with a token, so the global
+ *     `bearerAuth` middleware already 401'd unauthenticated requests
+ *     before they reached this gate.
+ * (2) Any token configuration makes the global `bearerAuth` enforce
+ *     bearer-required-everywhere; the gate is redundant but harmless.
+ *
+ * The 401 body uses `code: 'token_required'` (distinct from
+ * `bearerAuth`'s plain `Unauthorized` shape) so SDK clients can branch
+ * on it: surface a "this route needs the daemon to be configured with
+ * a token; restart with --require-auth or --token" hint rather than a
+ * generic auth failure. Pre-flight via `/capabilities.features.require_auth`
+ * still requires a successful unauthenticated `/capabilities` call,
+ * which is only possible when the daemon has not enforced auth — so
+ * the gate's own 401 is the discovery surface for routes that opt in
+ * to strict mode on otherwise-open daemons.
+ */
+export interface MutationGateOptions {
+    /**
+     * When true, this route refuses to serve unauthenticated callers
+     * even on loopback no-token defaults. Used by Wave 4 mutation routes
+     * (memory, file edit, tool enable, MCP restart, device-flow auth)
+     * that should never be reachable without explicit operator opt-in.
+     * Defaults to false so Wave 1-2 routes that already exist can adopt
+     * the helper without behavior change.
+     */
+    strict?: boolean;
+}
+export interface CreateMutationGateDeps {
+    /** Was the daemon configured with a bearer token? */
+    tokenConfigured: boolean;
+    /** Was `--require-auth` passed at boot? */
+    requireAuth: boolean;
+}
+/**
+ * Build a route-scoped mutation gate factory. Returns a function that
+ * — given `MutationGateOptions` — yields an Express `RequestHandler`.
+ *
+ * Callers cache the factory at app construction time and invoke it per
+ * route, e.g.:
+ *
+ *   const mutate = createMutationGate({ tokenConfigured, requireAuth });
+ *   app.post('/workspace/memory', mutate({ strict: true }), handler);
+ *   app.post('/session', mutate(), handler);
+ *
+ * The factory is hot-path-friendly: the strict-passthrough decision is
+ * made once at construction and the returned handler is a cheap closure.
+ */
+export declare function createMutationGate(deps: CreateMutationGateDeps): (opts?: MutationGateOptions) => RequestHandler;

package/dist/src/serve/auth.js

@@ -0,0 +1,216 @@
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { isLoopbackBind } from './loopbackBinds.js';
+/**
+ * Reject any request that carries an `Origin` header. CLI/SDK clients never
+ * set Origin; only browsers do. Returning a deterministic 403 JSON keeps
+ * the daemon from CSRF-ing itself (and is more useful to clients than the
+ * 500 HTML default that the `cors` package's error-callback path produces
+ * when no Express error middleware is registered).
+ */
+export const denyBrowserOriginCors = (req, res, next) => {
+    if (req.headers.origin) {
+        res.status(403).json({ error: 'Request denied by CORS policy' });
+        return;
+    }
+    next();
+};
+/**
+ * Reject requests whose Host header isn't one of the bound interfaces.
+ * Defense against DNS rebinding when the daemon is on loopback.
+ *
+ * `bind` is the hostname the listener was started with. `getPort` is read
+ * lazily on each request because callers commonly request port 0 (ephemeral)
+ * and only learn the actual port once `listen()` has resolved.
+ */
+export function hostAllowlist(bind, getPort) {
+    if (!isLoopbackBind(bind)) {
+        // For non-loopback binds the operator chose the surface area; trust the
+        // bearer token gate to cover Host header spoofing.
+        return (_req, _res, next) => next();
+    }
+    // Cache the allowed-Host Set per port. `getPort()` is invoked
+    // lazily because tests bind to ephemeral port 0 — the actual port
+    // is only known after `listen()` resolves and tests can call
+    // through with a placeholder port that flips later. SSE
+    // heartbeats and high-frequency probes go through this middleware,
+    // so allocating a fresh Set + 4 interpolated strings per request
+    // is wasted work. Rebuild only when the port changes.
+    let cachedPort = -1;
+    let cachedAllowed = new Set();
+    const allowedFor = (port) => {
+        if (port === cachedPort)
+            return cachedAllowed;
+        cachedPort = port;
+        cachedAllowed = new Set([
+            `localhost:${port}`,
+            `127.0.0.1:${port}`,
+            `[::1]:${port}`,
+            `host.docker.internal:${port}`,
+        ]);
+        // RFC 7230 §5.4: clients may omit the port suffix when it matches
+        // the URI scheme's default. http → 80, https → 443. The qwen
+        // serve daemon is plain HTTP, so accept the no-port forms when
+        // we're listening on port 80 (uncommon but valid for an operator
+        // who points at a privileged port for clean URLs).
+        if (port === 80) {
+            cachedAllowed.add('localhost');
+            cachedAllowed.add('127.0.0.1');
+            cachedAllowed.add('[::1]');
+            cachedAllowed.add('host.docker.internal');
+        }
+        return cachedAllowed;
+    };
+    return (req, res, next) => {
+        const port = getPort();
+        // Per RFC 7230 §5.4, Host is case-insensitive. Express normalizes
+        // header *names* to lowercase but NOT values, so a Docker-proxy
+        // that capitalizes the hostname (`Host: Localhost:4170`) or a
+        // platform with case-preserving DNS (`HOST.docker.internal`) would
+        // get 403 with an exact-string compare. Lowercase both sides.
+        const host = (req.headers.host || '').toLowerCase();
+        if (!allowedFor(port).has(host)) {
+            res.status(403).json({ error: 'Invalid Host header' });
+            return;
+        }
+        next();
+    };
+}
+/**
+ * Bearer token middleware. When `token` is undefined the gate is open — used
+ * for the loopback-only developer default. `runQwenServe` enforces that any
+ * non-loopback bind has a token, and that `--require-auth` boots only with a
+ * token configured, so this no-token branch is reachable only on loopback
+ * developer setups that opted out of `--require-auth`.
+ */
+export function bearerAuth(token) {
+    if (!token) {
+        return (_req, _res, next) => next();
+    }
+    // Pre-hash the configured token once. Per-request we hash the candidate and
+    // constant-time compare; this avoids leaking byte positions through string
+    // inequality short-circuiting.
+    const expected = createHash('sha256').update(token, 'utf8').digest();
+    return (req, res, next) => {
+        const header = req.headers.authorization;
+        if (!header) {
+            res.status(401).json({ error: 'Unauthorized' });
+            return;
+        }
+        // Per RFC 7235 §2.1 / RFC 7230 §3.2.6 the auth scheme token is
+        // case-insensitive — `Bearer` / `bearer` / `BEARER` are all valid.
+        // Lowercase the scheme before comparing; the token value itself
+        // stays case-sensitive (it's user-defined opaque material).
+        //
+        // Hand-rolled split rather than a regex like `^(\S+)\s+(.+)$`
+        // because CodeQL flags the latter as a polynomial-regex risk on
+        // user-controlled input (the `\s+` / `.+` overlap can backtrack
+        // on adversarial whitespace-heavy headers). Two indexOf calls
+        // are O(n) total with no backtracking.
+        const schemeEnd = header.indexOf(' ');
+        if (schemeEnd <= 0) {
+            res.status(401).json({ error: 'Unauthorized' });
+            return;
+        }
+        const scheme = header.slice(0, schemeEnd).toLowerCase();
+        if (scheme !== 'bearer') {
+            res.status(401).json({ error: 'Unauthorized' });
+            return;
+        }
+        // After the initial SP separator (the scheme→credentials boundary
+        // matches RFC 9110 §11.6.2's `1*SP`), skip any extra BWS before
+        // the credentials. RFC 7230 §3.2.6 BWS allows both SP (0x20)
+        // and HTAB (0x09); accept both so a client emitting
+        // `Authorization: Bearer \t<token>` (SP then HTAB) doesn't 401.
+        // Pure-HTAB-as-separator (`Bearer\t<token>`) is still rejected
+        // because the scheme parse uses `indexOf(' ')` — that's
+        // intentional per RFC 9110, not an oversight.
+        let credStart = schemeEnd + 1;
+        while (credStart < header.length &&
+            (header.charCodeAt(credStart) === 0x20 ||
+                header.charCodeAt(credStart) === 0x09)) {
+            credStart++;
+        }
+        const credentials = header.slice(credStart);
+        if (credentials.length === 0) {
+            res.status(401).json({ error: 'Unauthorized' });
+            return;
+        }
+        const candidate = createHash('sha256').update(credentials, 'utf8').digest();
+        if (!timingSafeEqual(candidate, expected)) {
+            res.status(401).json({ error: 'Unauthorized' });
+            return;
+        }
+        next();
+    };
+}
+/**
+ * Build a route-scoped mutation gate factory. Returns a function that
+ * — given `MutationGateOptions` — yields an Express `RequestHandler`.
+ *
+ * Callers cache the factory at app construction time and invoke it per
+ * route, e.g.:
+ *
+ *   const mutate = createMutationGate({ tokenConfigured, requireAuth });
+ *   app.post('/workspace/memory', mutate({ strict: true }), handler);
+ *   app.post('/session', mutate(), handler);
+ *
+ * The factory is hot-path-friendly: the strict-passthrough decision is
+ * made once at construction and the returned handler is a cheap closure.
+ */
+export function createMutationGate(deps) {
+    // When the global gate is already enforcing bearer auth (token set
+    // via --token / env, OR --require-auth boot-checked a token), every
+    // request that reaches the route handler has already passed
+    // `bearerAuth`. The mutation gate becomes a passthrough — return a
+    // pre-built no-op so we don't allocate one closure per route call.
+    const passthrough = (_req, _res, next) => next();
+    if (deps.requireAuth || deps.tokenConfigured) {
+        return () => passthrough;
+    }
+    // No token configured (loopback developer default). Non-strict
+    // routes preserve the legacy "open on loopback" behavior; strict
+    // routes refuse with a structured 401 the SDK can surface.
+    //
+    // Body-parser ordering (PR #4236 review #3254485915): the strict 401
+    // fires AFTER `express.json()` because the gate is per-route
+    // middleware, not app-level. On no-token loopback defaults a strict
+    // route therefore parses the request body before refusing it —
+    // bounded by `express.json({limit: '10mb'})` × `--max-connections`
+    // (256 default). Loopback-only attack surface, so the worst case is
+    // ~2.5 GB transient on a fully-saturated listener. The strict routes
+    // Wave 4 actually adds (memory writes / file edits / device-flow
+    // auth) carry small bodies in legitimate use, so the parsing-cost
+    // amplification isn't a production hot path. If a future strict
+    // route accepts large bodies, lift its gate to app-level (maintain a
+    // strict-path Set in `createServeApp` and check it before
+    // `express.json()`); tracked as a Wave 4 follow-up rather than
+    // re-architecting the helper here.
+    //
+    // Allocation symmetry (PR #4236 review #3254467193): cache the strict
+    // denier alongside `passthrough` so a route table with N strict
+    // routes doesn't allocate N identical closures. The auth.test.ts
+    // identity assertion anchors this — a future change that loses the
+    // cache is visible.
+    const strictDenier = (_req, res) => {
+        // Only list remediations that work standalone. `--require-auth` is
+        // paired-required-with-a-token at boot (`runQwenServe.ts` refuses
+        // to start with the flag set but no token), so naming it as a
+        // third standalone option here would loop the operator into a
+        // different boot error. Configuring a token via `QWEN_SERVER_TOKEN`
+        // or `--token` IS the fix; the operator can decide separately
+        // whether to also harden loopback with `--require-auth`.
+        res.status(401).json({
+            error: 'This route requires the daemon to be configured with a bearer ' +
+                'token. Set QWEN_SERVER_TOKEN or pass --token to enable bearer ' +
+                'auth.',
+            code: 'token_required',
+        });
+    };
+    return (opts = {}) => opts.strict ? strictDenier : passthrough;
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/serve/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/serve/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CACnD,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,EAAE;IACF,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAAqB;IAErB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,wEAAwE;QACxE,mDAAmD;QACnD,OAAO,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IACD,8DAA8D;IAC9D,kEAAkE;IAClE,6DAA6D;IAC7D,wDAAwD;IACxD,mEAAmE;IACnE,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;IACpB,IAAI,aAAa,GAAgB,IAAI,GAAG,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,IAAY,EAAe,EAAE;QAC/C,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,aAAa,CAAC;QAC9C,UAAU,GAAG,IAAI,CAAC;QAClB,aAAa,GAAG,IAAI,GAAG,CAAC;YACtB,aAAa,IAAI,EAAE;YACnB,aAAa,IAAI,EAAE;YACnB,SAAS,IAAI,EAAE;YACf,wBAAwB,IAAI,EAAE;SAC/B,CAAC,CAAC;QACH,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,iEAAiE;QACjE,mDAAmD;QACnD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC/B,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC/B,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,aAAa,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IACF,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACrE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,4DAA4D;QAC5D,EAAE;QACF,8DAA8D;QAC9D,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,uCAAuC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,oDAAoD;QACpD,gEAAgE;QAChE,+DAA+D;QAC/D,wDAAwD;QACxD,8CAA8C;QAC9C,IAAI,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;QAC9B,OACE,SAAS,GAAG,MAAM,CAAC,MAAM;YACzB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI;gBACpC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,EACxC,CAAC;YACD,SAAS,EAAE,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5E,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AA2DD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA4B;IAE5B,mEAAmE;IACnE,oEAAoE;IACpE,4DAA4D;IAC5D,mEAAmE;IACnE,mEAAmE;IACnE,MAAM,WAAW,GAAmB,CAClC,IAAa,EACb,IAAc,EACd,IAAkB,EAClB,EAAE,CAAC,IAAI,EAAE,CAAC;IACZ,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC;IAC3B,CAAC;IACD,+DAA+D;IAC/D,iEAAiE;IACjE,2DAA2D;IAC3D,EAAE;IACF,qEAAqE;IACrE,6DAA6D;IAC7D,oEAAoE;IACpE,+DAA+D;IAC/D,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,iEAAiE;IACjE,kEAAkE;IAClE,gEAAgE;IAChE,qEAAqE;IACrE,0DAA0D;IAC1D,+DAA+D;IAC/D,mCAAmC;IACnC,EAAE;IACF,sEAAsE;IACtE,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,oBAAoB;IACpB,MAAM,YAAY,GAAmB,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,8DAA8D;QAC9D,8DAA8D;QAC9D,oEAAoE;QACpE,8DAA8D;QAC9D,yDAAyD;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EACH,gEAAgE;gBAChE,gEAAgE;gBAChE,OAAO;YACT,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,OAA4B,EAAE,EAAkB,EAAE,CACxD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AAC7C,CAAC"}