@wipcomputer/wip-ldm-os 0.4.85-alpha.3 → 0.4.85-alpha.32

package/scripts/test-crc-e2ee-session-route.mjs

@@ -0,0 +1,129 @@
+import { readFileSync } from "node:fs";
+
+const server = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+
+function assertContains(needle, label) {
+  if (!server.includes(needle)) {
+    throw new Error(`${label} missing expected text: ${needle}`);
+  }
+}
+
+function assertBefore(first, second, label) {
+  const firstIndex = server.indexOf(first);
+  const secondIndex = firstIndex === -1 ? -1 : server.indexOf(second, firstIndex + first.length);
+  if (firstIndex === -1 || secondIndex === -1 || firstIndex >= secondIndex) {
+    throw new Error(`${label} expected "${first}" before "${second}"`);
+  }
+}
+
+assertContains("const codexWebClients = new Map(); // `${agentId}:${threadId}` -> Set<ws>", "thread-keyed web client sets");
+assertContains("const codexE2eeSessionRoutes = new Map(); // `${agentId}:${e2eeSession}` -> { threadId, webKey, ws }", "e2ee session route map");
+assertContains("function registerCodexE2eeSessionRoute(agentId, e2eeSession, threadId, ws)", "route registration helper");
+assertContains("codexE2eeSessionRoutes.set(codexRelayKey(agentId, e2eeSession), { threadId, webKey, ws });", "route map stores e2ee session to thread");
+assertContains("function addCodexWebClient(webKey, ws)", "web client set add helper");
+assertContains("function removeCodexWebClient(webKey, ws)", "web client set remove helper");
+assertContains("function openCodexWebClientsForKey(webKey)", "web client set read helper");
+assertContains("function resolveCodexWebClientsForDaemonFrame(agentId, routeId)", "daemon route resolver");
+assertContains("const routed = codexE2eeSessionRoutes.get(codexRelayKey(agentId, routeId));", "daemon route lookup uses e2ee session map");
+assertContains("if (routed && routed.ws && routed.ws.readyState === routed.ws.OPEN) return [routed.ws];", "daemon route resolves to active owner socket");
+assertContains("return openCodexWebClientsForKey(codexRelayKey(agentId, routeId));", "daemon route keeps direct thread fallback");
+assertContains("const targets = resolveCodexWebClientsForDaemonFrame(identity.agentId, sessionId);", "daemon frames use route resolver");
+assertContains("for (const target of targets) {", "daemon frames send to every resolved target");
+assertContains("if (isCodexE2eeEnvelope(envelope) && envelope.session) {", "web e2ee messages are detected");
+assertContains("envelope.route_thread_id = threadId;", "relay injects ticket-bound thread into e2ee hello");
+assertContains("text = JSON.stringify(envelope);", "relay forwards the route-bound e2ee hello");
+assertContains("registerCodexE2eeSessionRoute(identity.agentId, envelope.session, threadId, ws);", "web e2ee session is registered");
+assertContains("const clientCount = addCodexWebClient(webKey, ws);", "new web connections are added without replacing existing clients");
+assertContains("removeCodexWebClient(webKey, ws);", "close cleanup removes only the closing socket");
+assertContains("removeCodexE2eeRoutesForWeb(identity.agentId, threadId, ws);", "close cleanup");
+assertContains("if (route.webKey === webKey && (!ws || route.ws === ws)) {", "cleanup only removes routes owned by the closing socket");
+assertBefore(
+  "envelope.route_thread_id = threadId;",
+  "daemonWs.send(text);",
+  "web route thread is injected before forwarding to daemon",
+);
+assertBefore(
+  "registerCodexE2eeSessionRoute(identity.agentId, envelope.session, threadId, ws);",
+  "daemonWs.send(text);",
+  "web session route registered before forwarding to daemon",
+);
+if (server.includes("const previous = codexWebClients.get(key);")) {
+  throw new Error("web client replacement lookup is still present");
+}
+if (server.includes("codexWebClients.set(key, ws);")) {
+  throw new Error("web client singleton set is still present");
+}
+
+const OPEN = 1;
+const agentId = "parker-smoke-test";
+const threadId = "thread-123";
+const e2eeSession = "e2ee-random-session-456";
+if (e2eeSession === threadId) {
+  throw new Error("test setup must use a random E2EE session distinct from threadId");
+}
+
+const modelWebClients = new Map();
+const modelRoutes = new Map();
+const webSocketA = { readyState: OPEN, OPEN };
+const webSocketB = { readyState: OPEN, OPEN };
+const webSocketC = { readyState: OPEN, OPEN };
+const webKey = `${agentId}:${threadId}`;
+
+function modelAddWebClient(ws) {
+  let clients = modelWebClients.get(webKey);
+  if (!clients) {
+    clients = new Set();
+    modelWebClients.set(webKey, clients);
+  }
+  clients.add(ws);
+}
+
+function modelRegister(session, ws) {
+  modelRoutes.set(`${agentId}:${session}`, { webKey, ws });
+}
+
+function modelResolve(routeId) {
+  const route = modelRoutes.get(`${agentId}:${routeId}`);
+  if (route && route.ws.readyState === route.ws.OPEN) return [route.ws];
+  const clients = modelWebClients.get(`${agentId}:${routeId}`) || new Set();
+  return [...clients].filter((webWs) => webWs.readyState === webWs.OPEN);
+}
+
+function modelRemoveOwnedRoutes(ws) {
+  for (const [routeKey, route] of modelRoutes) {
+    if (route.webKey === webKey && route.ws === ws) modelRoutes.delete(routeKey);
+  }
+}
+
+function modelRemoveWebClient(ws) {
+  const clients = modelWebClients.get(webKey);
+  if (!clients) return;
+  clients.delete(ws);
+  if (clients.size === 0) modelWebClients.delete(webKey);
+}
+
+modelAddWebClient(webSocketA);
+modelAddWebClient(webSocketB);
+modelRegister(e2eeSession, webSocketA);
+if (modelResolve(e2eeSession)[0] !== webSocketA) {
+  throw new Error("random E2EE session did not route to the owning thread web socket");
+}
+const threadTargets = modelResolve(threadId);
+if (threadTargets.length !== 2 || !threadTargets.includes(webSocketA) || !threadTargets.includes(webSocketB)) {
+  throw new Error("direct thread fallback did not broadcast to every thread web socket");
+}
+
+modelRemoveOwnedRoutes(webSocketA);
+modelRemoveWebClient(webSocketA);
+modelAddWebClient(webSocketC);
+modelRegister(e2eeSession, webSocketC);
+modelRemoveOwnedRoutes(webSocketA);
+if (modelResolve(e2eeSession)[0] !== webSocketC) {
+  throw new Error("old socket cleanup removed or stole the replacement E2EE route");
+}
+const remainingThreadTargets = modelResolve(threadId);
+if (remainingThreadTargets.length !== 2 || !remainingThreadTargets.includes(webSocketB) || !remainingThreadTargets.includes(webSocketC)) {
+  throw new Error("closing one web socket removed another browser client");
+}
+
+console.log("crc e2ee session route checks passed");

package/scripts/test-crc-pair-login-flow.mjs

@@ -0,0 +1,115 @@
+import { readFileSync } from "node:fs";
+
+const server = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+const loginFiles = [
+  "src/hosted-mcp/app/kaleidoscope-login.html",
+  "src/hosted-mcp/demo/login.html",
+];
+
+function assertContains(source, needle, label) {
+  if (!source.includes(needle)) {
+    throw new Error(`${label} missing expected text: ${needle}`);
+  }
+}
+
+function assertNotContains(source, needle, label) {
+  if (source.includes(needle)) {
+    throw new Error(`${label} must not contain: ${needle}`);
+  }
+}
+
+function assertBefore(source, first, second, label) {
+  const firstIndex = source.indexOf(first);
+  const secondIndex = source.indexOf(second);
+  if (firstIndex === -1 || secondIndex === -1 || firstIndex >= secondIndex) {
+    throw new Error(`${label} expected "${first}" before "${second}"`);
+  }
+}
+
+function extractServerNextSanitizer(source) {
+  const consts = [
+    source.match(/const PAIR_NEXT_REGEX = .+;/)?.[0],
+    source.match(/const REMOTE_CONTROL_NEXT_REGEX = .+;/)?.[0],
+    source.match(/const DEMO_NEXT_REGEX = .+;/)?.[0],
+  ];
+  if (consts.some((line) => !line)) {
+    throw new Error("server sanitizer test could not extract next regex constants");
+  }
+  const start = source.indexOf("function sanitizeCrcPairNext(raw)");
+  const end = source.indexOf("// POST /api/qr-login", start);
+  if (start === -1 || end === -1) {
+    throw new Error("server sanitizer test could not extract sanitizeCrcPairNext");
+  }
+  return Function(`${consts.join("\n")}\n${source.slice(start, end)}\nreturn sanitizeCrcPairNext;`)();
+}
+
+function assertSanitizedNext(sanitize, value, expected) {
+  const actual = sanitize(value);
+  if (actual !== expected) {
+    throw new Error(`sanitizeCrcPairNext(${JSON.stringify(value)}) expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+  }
+}
+
+assertContains(server, "const PAIR_NEXT_REGEX = /^\\/pair\\/[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{6}$/;", "server pair regex");
+assertContains(server, "const REMOTE_CONTROL_NEXT_REGEX = /^\\/codex-remote-control\\/", "server remote-control regex");
+assertContains(server, "const DEMO_NEXT_REGEX = /^\\/demo$/;", "server demo regex");
+assertContains(server, "purpose,           // \"pair\" | null", "server stores pair purpose");
+assertContains(server, "next: next || null, // sanitized `/pair/<CODE>`, `/codex-remote-control/<UUID>`, `/demo`, or null", "server stores sanitized next");
+assertContains(server, "DEMO_NEXT_REGEX.test(decoded)", "server allows demo next");
+assertContains(server, "json(res, 200, { status: \"approved\", agentId: entry.agentId });", "server strips desktop pair status");
+assertContains(server, "json(res, 200, { ok: true, next: entry.next });", "server returns next to phone approve");
+assertContains(server, "tenantId: entry.tenantId || null,", "server returns QR login tenant");
+assertContains(server, "const verifiedIdentity = identityForApiKey(apiKey);", "server canonicalizes QR approval identity");
+
+const sanitizeCrcPairNext = extractServerNextSanitizer(server);
+assertSanitizedNext(sanitizeCrcPairNext, "/demo", "/demo");
+assertSanitizedNext(sanitizeCrcPairNext, "/demo/", null);
+assertSanitizedNext(sanitizeCrcPairNext, "/demo/../admin", null);
+assertSanitizedNext(sanitizeCrcPairNext, "//evil.com", null);
+assertSanitizedNext(sanitizeCrcPairNext, "https://evil", null);
+assertSanitizedNext(sanitizeCrcPairNext, "/demoX", null);
+
+for (const file of loginFiles) {
+  const html = readFileSync(file, "utf8");
+  assertContains(html, "var DEMO_NEXT_REGEX = /^\\/demo$/;", `${file} demo regex`);
+  assertContains(html, "function defaultLocalPasskeysOn()", `${file} has local passkey default helper`);
+  assertContains(html, "return isMobileDevice();", `${file} defaults local passkeys on for mobile`);
+  assertContains(html, "function getLocalPasskeysPreference()", `${file} has local passkey preference helper`);
+  assertContains(html, "if (stored === 'on' || stored === 'off') return stored;", `${file} respects stored local passkey preference`);
+  assertContains(html, "function needsCustomQR() {\n  return !isLocalPasskeysOn();\n}", `${file} uses QR whenever local passkeys are off`);
+  assertNotContains(html, "return !isMobileDevice() && !isSafariDesktop() && !isLocalPasskeysOn();", `${file} must not gate QR by browser or mobile status`);
+  assertContains(html, "DEMO_NEXT_REGEX.test(raw)", `${file} allowlists demo next`);
+  assertContains(html, "function storeDemoHandoffIfNeeded(next, identity, isNewAccount)", `${file} demo handoff helper`);
+  assertContains(html, "sessionStorage.setItem('lesa-token', identity.apiKey);", `${file} stores demo token`);
+  assertContains(html, "sessionStorage.setItem('lesa-agent', identity.agentId);", `${file} stores demo agent`);
+  assertContains(html, "if (identity.tenantId) sessionStorage.setItem('lesa-tenant', identity.tenantId);", `${file} stores demo tenant`);
+  assertContains(html, "if (isNewAccount) sessionStorage.setItem('lesa-new-account', 'true');", `${file} stores demo new-account flag conditionally`);
+  assertContains(html, "tenantId: result.tenantId,", `${file} sends tenant to QR approval`);
+  assertContains(html, "storeDemoHandoffIfNeeded(data.next, data, qrLoginMode === 'register');", `${file} QR status stores demo handoff`);
+  assertContains(html, "storeDemoHandoffIfNeeded('/demo', data, qrLoginMode === 'register');", `${file} plain QR success keeps demo handoff`);
+  assertContains(html, "storeDemoHandoffIfNeeded('/demo', result, true);", `${file} plain create success keeps demo handoff`);
+  assertContains(html, "storeDemoHandoffIfNeeded('/demo', result, false);", `${file} plain sign-in success keeps demo handoff`);
+  if (html.includes('onclick="sessionStorage.clear();"')) {
+    throw new Error(`${file} Try the Demo button must not clear sessionStorage`);
+  }
+  assertContains(html, "followPairNextIfPresent(approveResponse, result, true)", `${file} create account marks new account`);
+  assertContains(html, "followPairNextIfPresent(approveResponse, result, false)", `${file} sign-in does not mark new account`);
+  assertContains(html, "function isPairNextOnDesktop()", `${file} desktop pair helper`);
+  assertContains(html, "} else if (isPairNextOnDesktop()) {", `${file} auto-start desktop pair QR`);
+  assertContains(html, "startQrLogin('', 'signin');", `${file} pair QR uses sign-in mode`);
+  assertContains(html, "if (approveResponse && typeof approveResponse.next === 'string' && isWhitelistedNext(approveResponse.next))", `${file} consumes approve next`);
+  assertContains(html, "if (urlNext && PAIR_NEXT_REGEX.test(urlNext))", `${file} desktop pair approved branch`);
+  assertBefore(html, "if (isPairNextOnDesktop() && !qrSessionMode)", "if (needsCustomQR() && !qrSessionMode)", `${file} create button forces pair QR before normal QR fallback`);
+}
+
+const appLogin = readFileSync("src/hosted-mcp/app/kaleidoscope-login.html", "utf8");
+assertContains(appLogin, "Local passkeys are on by default on mobile devices.", "app login mobile tooltip copy");
+assertContains(appLogin, "This device's passkeys are used for login and device sync.", "app login mobile tooltip current-device copy");
+assertContains(appLogin, "Turn this off to use or save passkeys on a different device.", "app login mobile tooltip off copy");
+assertContains(appLogin, "Local passkeys are off by default on desktop.", "app login desktop tooltip copy");
+assertContains(appLogin, "Your mobile device's passkeys are used for login and device sync.", "app login desktop tooltip mobile-device copy");
+assertContains(appLogin, "Turn this on to use or save passkeys on this computer.", "app login desktop tooltip on copy");
+assertNotContains(appLogin, "phone's passkeys", "app login tooltip must not say phone passkeys");
+assertNotContains(appLogin, "mobile devices' passkeys", "app login tooltip must not use plural possessive");
+
+console.log("crc pair login flow checks passed");

package/scripts/test-crc-pair-relink-audit-and-rotation.mjs

@@ -0,0 +1,164 @@
+import { readFileSync } from "node:fs";
+import {
+  codexDaemonPubkeyFingerprint,
+  createCodexDaemonPubkeyRegistry,
+  evaluateCodexDaemonReconnectPubkey,
+} from "../src/hosted-mcp/codex-relay-e2ee-registry.mjs";
+
+const server = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+const pairHtml = readFileSync("src/hosted-mcp/app/pair.html", "utf8");
+const loginHtml = readFileSync("src/hosted-mcp/app/kaleidoscope-login.html", "utf8");
+const registrySource = readFileSync("src/hosted-mcp/codex-relay-e2ee-registry.mjs", "utf8");
+const ticket = readFileSync("ai/product/bugs/codex-remote-control/2026-05-05--codex--remote-control-pair-relink-audit-and-rotation.md", "utf8");
+
+function assertContains(haystack, needle, label) {
+  if (!haystack.includes(needle)) {
+    throw new Error(`${label} missing expected text: ${needle}`);
+  }
+}
+
+function assert(condition, label, detail = "") {
+  if (!condition) throw new Error(`${label}${detail ? ": " + detail : ""}`);
+}
+
+function createSilentLogger() {
+  return { log() {}, error() {} };
+}
+
+assertContains(server, "const CODEX_PAIR_PRESENCE_TTL_MS = 2 * 60 * 1000;", "short pair presence ttl");
+assertContains(server, "const codexPairPresenceTokens = new Map();", "pair presence token store");
+assertContains(server, "function generateCodexPairPresenceToken(agentId)", "pair presence token mint");
+assertContains(server, "function consumeCodexPairPresenceToken(token, agentId)", "pair presence token consume");
+assertContains(server, "codex_pair_presence_token: generateCodexPairPresenceToken(agentId)", "registration mints pair presence token");
+assertContains(server, "codex_pair_presence_token: generateCodexPairPresenceToken(entry.agentId)", "authentication mints pair presence token");
+assertContains(server, 'error: "fresh_presence_required"', "pair-complete fresh presence rejection");
+assertContains(server, "consumeCodexPairPresenceToken(pairPresenceToken, identity.agentId)", "pair-complete consumes pair presence token");
+assertContains(server, 'json(res, 404, { error: "invalid or already-used code" });', "pair code reuse rejection");
+assertContains(server, 'json(res, 410, { error: "code expired or already used" });', "pair code expiry rejection");
+assertContains(server, "invalidateCodexBrowserSessionsForAgent(identity.agentId, \"daemon key replaced\")", "daemon replacement invalidates stale browser sessions");
+assertContains(server, "evaluateCodexDaemonReconnectPubkey(", "daemon reconnect checks existing key policy");
+assertContains(server, "daemon key change requires fresh pair", "changed daemon reconnect key requires pair flow");
+assertContains(server, "daemonIdentityAccepted = activateCodexDaemonWs();", "daemon only becomes active after identity is accepted");
+assertContains(server, "daemon already online", "duplicate daemon cannot evict an online daemon");
+assertContains(server, "daemon identity required", "daemon frames require identity before routing");
+assertContains(server, "p.replaced_daemon_key = !!daemonKeyResult?.replaced;", "pair state records replacement status");
+assertContains(server, "replaced_daemon_key: !!p.replaced_daemon_key", "pair-status exposes relink replacement status");
+assertContains(pairHtml, "codex_pair_presence_token: getPairPresenceToken()", "pair page sends pair presence token");
+assertContains(pairHtml, "fresh_presence_required", "pair page handles fresh presence error");
+assertContains(pairHtml, "Remote Control relinked this laptop.", "pair page gives relink message");
+assertContains(loginHtml, "wip_codex_pair_presence_token", "login carries pair presence token into pair page");
+assertContains(registrySource, "CREATE TABLE IF NOT EXISTS codex_daemon_e2ee_key_audit", "pair audit table");
+assertContains(registrySource, "old_pubkey_fingerprint", "audit stores old key fingerprint");
+assertContains(registrySource, "new_pubkey_fingerprint", "audit stores new key fingerprint");
+assertContains(ticket, "status: done", "ticket marked done");
+
+const oldFingerprint = codexDaemonPubkeyFingerprint("old-spki-key");
+const newFingerprint = codexDaemonPubkeyFingerprint("new-spki-key");
+assert(oldFingerprint && oldFingerprint.startsWith("sha256:"), "fingerprint has sha256 prefix");
+assert(oldFingerprint !== newFingerprint, "fingerprint changes when daemon key changes");
+
+const registry = createCodexDaemonPubkeyRegistry({
+  usePrisma: false,
+  devMode: false,
+  logger: createSilentLogger(),
+});
+const first = await registry.register("acct:test-user-a", "old-spki-key", ["e2ee-v1"], "pair-complete");
+assert(first.registered === true, "first pair registers key");
+assert(first.replaced === false, "first pair is not replacement");
+const second = await registry.register("acct:test-user-a", "new-spki-key", ["e2ee-v1"], "pair-complete");
+assert(second.registered === true, "relink registers new key");
+assert(second.replaced === true, "relink replacement is detected");
+assert(second.old_fingerprint === oldFingerprint, "relink reports old fingerprint");
+assert(second.new_fingerprint === newFingerprint, "relink reports new fingerprint");
+assert(registry.auditLog.length === 2, "registry keeps audit entries");
+assert(registry.auditLog[1].replaced === true, "audit marks replacement");
+assert(registry.auditLog[1].old_pubkey_fingerprint === oldFingerprint, "audit stores old fingerprint");
+assert(registry.auditLog[1].new_pubkey_fingerprint === newFingerprint, "audit stores new fingerprint");
+
+const firstReconnectPolicy = evaluateCodexDaemonReconnectPubkey(null, "daemon-reconnect-key");
+assert(firstReconnectPolicy.allowed === true, "daemon reconnect can self-heal when no key is registered");
+assert(firstReconnectPolicy.replaced === false, "first daemon reconnect is not a replacement");
+const sameReconnectPolicy = evaluateCodexDaemonReconnectPubkey({ pubkey: "daemon-reconnect-key" }, "daemon-reconnect-key");
+assert(sameReconnectPolicy.allowed === true, "daemon reconnect can re-register the same key");
+assert(sameReconnectPolicy.replaced === false, "same-key daemon reconnect is not a replacement");
+const changedReconnectPolicy = evaluateCodexDaemonReconnectPubkey({ pubkey: "daemon-reconnect-key" }, "attacker-reconnect-key");
+assert(changedReconnectPolicy.allowed === false, "daemon reconnect cannot replace an existing key");
+assert(changedReconnectPolicy.reason === "fresh_pair_required", "changed daemon reconnect requires fresh pair");
+assert(changedReconnectPolicy.replaced === true, "changed daemon reconnect is detected as replacement");
+assert(changedReconnectPolicy.old_fingerprint === codexDaemonPubkeyFingerprint("daemon-reconnect-key"), "changed reconnect reports old fingerprint");
+assert(changedReconnectPolicy.new_fingerprint === codexDaemonPubkeyFingerprint("attacker-reconnect-key"), "changed reconnect reports new fingerprint");
+const invalidReconnectPolicy = evaluateCodexDaemonReconnectPubkey({ pubkey: "daemon-reconnect-key" }, "");
+assert(invalidReconnectPolicy.allowed === false, "daemon reconnect rejects missing pubkey");
+assert(invalidReconnectPolicy.reason === "invalid_daemon_pubkey", "missing daemon reconnect pubkey has explicit reason");
+const oversizedReconnectPolicy = evaluateCodexDaemonReconnectPubkey(null, "x".repeat(1025));
+assert(oversizedReconnectPolicy.allowed === false, "daemon reconnect rejects oversized pubkey");
+assert(oversizedReconnectPolicy.reason === "invalid_daemon_pubkey", "oversized daemon reconnect pubkey has explicit reason");
+
+const executeCalls = [];
+const persistedRegistry = createCodexDaemonPubkeyRegistry({
+  usePrisma: true,
+  devMode: false,
+  logger: createSilentLogger(),
+  prisma: {
+    async $executeRawUnsafe(sql, ...args) {
+      executeCalls.push({ sql, args });
+      return 1;
+    },
+  },
+});
+await persistedRegistry.register("acct:test-user-b", "persisted-spki-key", ["e2ee-v1"], "daemon-reconnect");
+const auditInsert = executeCalls.find((call) => call.sql.includes("INSERT INTO codex_daemon_e2ee_key_audit"));
+assert(auditInsert, "audit insert executes for persisted registry");
+assert(auditInsert.sql.includes("$7::timestamptz"), "audit insert casts registered_at parameter to timestamptz");
+assert(typeof auditInsert.args[6] === "string" && auditInsert.args[6].includes("T"), "audit insert passes ISO registered_at value");
+
+function pairCompleteModel({ hasDaemonPublicKey, pairPresenceOk, previousPubkey, nextPubkey }) {
+  if (hasDaemonPublicKey && !pairPresenceOk) return { code: 403, error: "fresh_presence_required" };
+  const replaced = !!(previousPubkey && nextPubkey && previousPubkey !== nextPubkey);
+  return { code: 200, replaced };
+}
+
+assert(
+  pairCompleteModel({
+    hasDaemonPublicKey: true,
+    pairPresenceOk: false,
+    previousPubkey: "old",
+    nextPubkey: "new",
+  }).code === 403,
+  "ck token alone cannot replace daemon key",
+);
+assert(
+  pairCompleteModel({
+    hasDaemonPublicKey: true,
+    pairPresenceOk: true,
+    previousPubkey: "old",
+    nextPubkey: "new",
+  }).replaced === true,
+  "fresh pair presence permits relink",
+);
+assert(
+  pairCompleteModel({
+    hasDaemonPublicKey: true,
+    pairPresenceOk: true,
+    previousPubkey: null,
+    nextPubkey: "new",
+  }).replaced === false,
+  "fresh pair presence permits first pair",
+);
+
+function pairCodeModel(pair, codeKnown, now) {
+  if (!codeKnown) return { code: 404, error: "invalid or already-used code" };
+  if (!pair || pair.status !== "pending" || now > pair.expires) {
+    return { code: 410, error: "code expired or already used" };
+  }
+  pair.status = "completed";
+  return { code: 200 };
+}
+
+const pair = { status: "pending", expires: 100 };
+assert(pairCodeModel(pair, true, 10).code === 200, "first pair-complete succeeds");
+assert(pairCodeModel(pair, true, 20).code === 410, "pair code reuse fails");
+assert(pairCodeModel({ status: "pending", expires: 100 }, true, 200).code === 410, "expired pair code fails");
+assert(pairCodeModel(null, false, 10).code === 404, "unknown pair code fails");
+
+console.log("crc pair relink audit and rotation checks passed");

package/scripts/test-crc-pair-status-poll-token.mjs

@@ -0,0 +1,73 @@
+import { readFileSync } from "node:fs";
+
+const server = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+
+function assertContains(needle, label) {
+  if (!server.includes(needle)) {
+    throw new Error(`${label} missing expected text: ${needle}`);
+  }
+}
+
+function assertNotContains(needle, label) {
+  if (server.includes(needle)) {
+    throw new Error(`${label} still contains forbidden text: ${needle}`);
+  }
+}
+
+assertContains("function generateCodexPairPollToken()", "pair poll token generator");
+assertContains('return "ppt_" + randomBytes(32).toString("base64url");', "pair poll token entropy");
+assertContains("function getBearerToken(req)", "bearer token helper");
+assertContains("const pollToken = generateCodexPairPollToken();", "pair-init mints poll token");
+assertContains("poll_token: pollToken,", "pair state stores poll token");
+assertContains("poll_token_used: false,", "pair state tracks token consumption");
+assertContains("pair_poll_token: pollToken,", "pair-init returns poll token to daemon");
+assertContains('json(res, 401, { error: "pair_poll_token_expired" });', "expired token rejected");
+assertContains('json(res, 401, { error: "invalid_pair_poll_token" });', "missing or wrong token rejected");
+assertContains("if (!pollToken || pollToken !== p.poll_token || p.poll_token_used)", "pair-status validates token");
+assertContains("p.poll_token_used = true;", "completed credential response consumes token");
+
+function pairStatusModel(pair, bearer, now) {
+  if (now > pair.expires) return { code: 401, body: { error: "pair_poll_token_expired" } };
+  if (!bearer || bearer !== pair.poll_token || pair.poll_token_used) {
+    return { code: 401, body: { error: "invalid_pair_poll_token" } };
+  }
+  if (pair.status === "completed") {
+    pair.poll_token_used = true;
+    return { code: 200, body: { status: "completed", api_key: pair.apiKey, handle: pair.handle } };
+  }
+  return { code: 200, body: { status: pair.status } };
+}
+
+const pair = {
+  status: "pending",
+  expires: 10_000,
+  poll_token: "ppt_good",
+  poll_token_used: false,
+  apiKey: "ck_secret",
+  handle: "Parker",
+};
+
+if (pairStatusModel({ ...pair }, null, 1).code !== 401) {
+  throw new Error("missing poll token should fail");
+}
+if (pairStatusModel({ ...pair }, "ppt_wrong", 1).code !== 401) {
+  throw new Error("wrong poll token should fail");
+}
+if (pairStatusModel({ ...pair }, "ppt_good", 20_000).code !== 401) {
+  throw new Error("expired poll token should fail");
+}
+if (pairStatusModel({ ...pair }, "ppt_good", 1).body.status !== "pending") {
+  throw new Error("correct poll token should return pending before completion");
+}
+
+const completedPair = { ...pair, status: "completed" };
+const completed = pairStatusModel(completedPair, "ppt_good", 1);
+if (completed.code !== 200 || completed.body.api_key !== "ck_secret") {
+  throw new Error("correct poll token should return completed credential once");
+}
+const replay = pairStatusModel(completedPair, "ppt_good", 1);
+if (replay.code !== 401) {
+  throw new Error("reused completed poll token should fail");
+}
+
+console.log("crc pair-status poll token checks passed");

package/scripts/test-crc-websocket-abuse-limits.mjs

@@ -0,0 +1,128 @@
+import { readFileSync } from "node:fs";
+import assert from "node:assert/strict";
+import {
+  CODEX_WS_CLOSE_CODES,
+  codexWsFrameByteLength,
+  createCodexWsAbuseLimitConfig,
+  createCodexWsConnectionGuard,
+  formatCodexWsLimitLog,
+  isCodexWsAgentDisabled,
+} from "../src/hosted-mcp/codex-relay-ws-abuse-limits.mjs";
+
+const server = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+const deploy = readFileSync("src/hosted-mcp/deploy.sh", "utf8");
+
+function assertContains(source, needle, label) {
+  if (!source.includes(needle)) {
+    throw new Error(`${label} missing expected text: ${needle}`);
+  }
+}
+
+function assertBefore(source, first, second, label) {
+  const firstIndex = source.indexOf(first);
+  const secondIndex = firstIndex === -1 ? -1 : source.indexOf(second, firstIndex + first.length);
+  if (firstIndex === -1 || secondIndex === -1 || firstIndex >= secondIndex) {
+    throw new Error(`${label} expected "${first}" before "${second}"`);
+  }
+}
+
+const config = createCodexWsAbuseLimitConfig({
+  LDM_CODEX_WS_MAX_FRAME_BYTES: "10",
+  LDM_CODEX_WS_RATE_WINDOW_MS: "100",
+  LDM_CODEX_WS_MAX_MESSAGES_PER_WINDOW: "2",
+  LDM_CODEX_WS_MAX_BYTES_PER_WINDOW: "15",
+  LDM_CODEX_WS_MAX_BROWSER_SOCKETS_PER_THREAD: "3",
+  LDM_CODEX_WS_IDLE_TTL_MS: "50",
+  LDM_CODEX_WS_MAX_MALFORMED_FRAMES: "1",
+  LDM_CODEX_WS_MAX_PENDING_BYTES: "20",
+  LDM_CODEX_WS_KILL_SWITCH_AGENTS: "acct:blocked, acct:other",
+});
+
+assert.equal(config.maxFrameBytes, 10);
+assert.equal(config.maxBrowserSocketsPerThread, 3);
+assert.equal(isCodexWsAgentDisabled(config, "acct:blocked"), true);
+assert.equal(isCodexWsAgentDisabled(config, "acct:allowed"), false);
+
+let nowMs = 1_000;
+const guard = createCodexWsConnectionGuard({
+  config,
+  agentId: "acct:allowed",
+  now: () => nowMs,
+});
+
+assert.equal(guard.observeFrame(11).code, CODEX_WS_CLOSE_CODES.oversizedFrame);
+assert.equal(guard.observeFrame(5).ok, true);
+assert.equal(guard.observeFrame(5).ok, true);
+assert.equal(guard.observeFrame(5).reason, "message rate limit");
+
+nowMs += 101;
+const byteGuard = createCodexWsConnectionGuard({ config, agentId: "acct:allowed", now: () => nowMs });
+assert.equal(byteGuard.observeFrame(8).ok, true);
+assert.equal(byteGuard.observeFrame(8).reason, "byte rate limit");
+
+const malformedGuard = createCodexWsConnectionGuard({ config, agentId: "acct:allowed", now: () => nowMs });
+assert.equal(malformedGuard.observeMalformed().ok, true);
+assert.equal(malformedGuard.observeMalformed().code, CODEX_WS_CLOSE_CODES.malformedFrames);
+
+const pendingGuard = createCodexWsConnectionGuard({ config, agentId: "acct:allowed", now: () => nowMs });
+assert.equal(pendingGuard.observePendingBytes(21).code, CODEX_WS_CLOSE_CODES.pendingBytes);
+
+const idleGuard = createCodexWsConnectionGuard({ config, agentId: "acct:allowed", now: () => nowMs });
+assert.equal(idleGuard.observeFrame(1).ok, true);
+assert.equal(idleGuard.observeIdle(nowMs + 51).code, CODEX_WS_CLOSE_CODES.idleTimeout);
+
+const killedGuard = createCodexWsConnectionGuard({ config, agentId: "acct:blocked", now: () => nowMs });
+assert.equal(killedGuard.observeFrame(1).code, CODEX_WS_CLOSE_CODES.operatorDisabled);
+assert.equal(codexWsFrameByteLength(Buffer.from("hello")), 5);
+assert.match(
+  formatCodexWsLimitLog({
+    agentId: "acct:blocked",
+    threadId: "thread-a",
+    connectionId: "conn-a",
+    reason: "message rate limit",
+  }),
+  /reason=message rate limit agent=acct:blocked thread=thread-a conn=conn-a/,
+);
+
+assertContains(server, "import {", "server imports abuse module");
+assertContains(server, "createCodexWsAbuseLimitConfig", "server configures websocket limits");
+assertContains(server, "isCodexWsAgentDisabled(CODEX_WS_ABUSE_LIMITS, identity.agentId)", "server checks operator kill switch");
+assertContains(server, "openBrowserSockets >= CODEX_WS_ABUSE_LIMITS.maxBrowserSocketsPerThread", "server limits browser sockets per thread");
+assertContains(server, "createCodexWsConnectionGuard({", "server creates per-socket guard");
+assertContains(server, "guard.observeFrame(codexWsFrameByteLength(data))", "server observes browser frame size and rate");
+assertContains(server, "guard.observeMalformed()", "server observes malformed browser frames");
+assertContains(server, "guard.observePendingBytes(daemonWs.bufferedAmount || 0)", "server observes pending daemon bytes");
+assertContains(server, "guard.observeIdle()", "server observes idle connections");
+assertContains(server, "closeCodexWsForLimit(ws, guardContext, decision)", "server closes idle sockets by limit");
+assertContains(server, "closeCodexWsForLimit(ws, guardContext, frameDecision)", "server closes frame abuse");
+assertContains(server, "closeCodexWsForLimit(ws, guardContext, malformedDecision)", "server closes malformed abuse");
+assertContains(server, "closeCodexWsForLimit(ws, guardContext, pendingDecision)", "server closes pending byte abuse");
+assertContains(server, "codex-relay-ws-abuse-limits.mjs", "deploy inventory includes abuse module");
+assertContains(deploy, "add_file \"codex-relay-ws-abuse-limits.mjs\"", "deploy copies abuse module");
+
+assertBefore(
+  server,
+  "openBrowserSockets >= CODEX_WS_ABUSE_LIMITS.maxBrowserSocketsPerThread",
+  "codexRelayWss.handleUpgrade(req, socket, head, (ws) => {",
+  "socket cap should run before websocket upgrade is accepted",
+);
+assertBefore(
+  server,
+  "const frameDecision = guard.observeFrame(codexWsFrameByteLength(data));",
+  "let text = data.toString();",
+  "frame limit should run before parsing or forwarding browser data",
+);
+assertBefore(
+  server,
+  "if (!envelope || typeof envelope !== \"object\" || Array.isArray(envelope)) {",
+  "const daemonWs = codexDaemons.get(identity.agentId);",
+  "malformed browser frames should not be forwarded",
+);
+assertBefore(
+  server,
+  "const pendingDecision = guard.observePendingBytes(daemonWs.bufferedAmount || 0);",
+  "daemonWs.send(text);",
+  "pending byte check should run before forwarding to daemon",
+);
+
+console.log("crc websocket abuse limit checks passed");