@worca/app 1.4.0 → 1.5.0-rc.3

package/src/core/bridge/translate/responses-stream.mjs

@@ -0,0 +1,327 @@
+// src/core/bridge/translate/responses-stream.mjs
+// OpenAI Responses API -> Anthropic Messages (2026-09-23-bridge-openai-
+// responses-design.md §9): the SSE stream state machine and the buffered
+// (non-streaming) response. Pure; the same push()/finish() contract as
+// ChatStreamTranslator, fed by the same SseDataParser (a Responses stream has
+// no [DONE] sentinel — it ends when the connection closes).
+//
+// Events are correlated by `output_index`, never `item_id`: Copilot rotates
+// item_id on every event. Anthropic content blocks are strictly sequential:
+// reasoning summary text and output text stream live; a function call is
+// emitted whole when its item is done (the done item carries the complete
+// arguments). A reasoning item becomes a `thinking` block whose signature is
+// the reasoning marker (common.mjs) — or a `redacted_thinking` block when the
+// model produced no summary text — so the CLI echoes it back next turn and
+// responses-request.mjs replays it as a `reasoning` input item.
+
+import { newMessageId, newToolUseId, parsesAsJson, truncatedToolNote } from './stream.mjs';
+import { encodeReasoningMarker } from './common.mjs';
+import { isFailedResponseOverflow, PROMPT_TOO_LONG } from '../errors.mjs';
+
+/** Responses usage -> Anthropic usage. */
+export function mapResponsesUsage(usage) {
+  const u = usage && typeof usage === 'object' ? usage : {};
+  const input = Number(u.input_tokens) || 0;
+  const cached = Number(u.input_tokens_details && u.input_tokens_details.cached_tokens) || 0;
+  return {
+    input_tokens: Math.max(0, input - cached),
+    output_tokens: Number(u.output_tokens) || 0,
+    cache_read_input_tokens: cached,
+    cache_creation_input_tokens: 0,
+  };
+}
+
+const errorEvent = (message) => ({ event: 'error', data: { type: 'error', error: { type: 'api_error', message } } });
+
+export class ResponsesStreamTranslator {
+  /**
+   * @param {{model:string, upstreamModel:string}} opts  the catalog id the CLI
+   *   expects back, and the upstream id the reasoning marker names
+   */
+  constructor({ model, upstreamModel } = {}) {
+    this.model = model || 'bridge';
+    this.upstreamModel = upstreamModel || '';
+    this.id = newMessageId();
+    this.started = false;
+    this.nextIndex = 0;
+    this.open = null;          // the open live block: { outputIndex, kind: 'text'|'thinking', index }
+    this.slots = new Map();    // output_index -> { type, callId, name, args, done, thinking, newPart }
+    this.toolsEmitted = 0;
+    this.emittedAny = false;
+    this.terminal = null;      // 'completed' | 'incomplete' | 'failed'
+    this.incompleteReason = null;
+    this.usage = null;
+  }
+
+  _start() {
+    if (this.started) return [];
+    this.started = true;
+    return [{
+      event: 'message_start',
+      data: {
+        type: 'message_start',
+        message: {
+          id: this.id, type: 'message', role: 'assistant', model: this.model, content: [],
+          stop_reason: null, stop_sequence: null,
+          usage: { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 },
+        },
+      },
+    }];
+  }
+
+  _slot(i) {
+    let s = this.slots.get(i);
+    if (!s) {
+      s = { type: null, callId: '', name: '', args: '', done: false, thinking: false, newPart: false };
+      this.slots.set(i, s);
+    }
+    return s;
+  }
+
+  _close() {
+    if (!this.open) return [];
+    const { index } = this.open;
+    this.open = null;
+    return [{ event: 'content_block_stop', data: { type: 'content_block_stop', index } }];
+  }
+
+  _isOpen(outputIndex, kind) {
+    return !!this.open && this.open.outputIndex === outputIndex && this.open.kind === kind;
+  }
+
+  /** Open a live (streamed) block for `outputIndex`, closing whatever is open. */
+  _openLive(outputIndex, kind, contentBlock) {
+    const out = this._close();
+    const index = this.nextIndex++;
+    this.open = { outputIndex, kind, index };
+    out.push({ event: 'content_block_start', data: { type: 'content_block_start', index, content_block: contentBlock } });
+    this.emittedAny = true;
+    return out;
+  }
+
+  _delta(delta) {
+    return { event: 'content_block_delta', data: { type: 'content_block_delta', index: this.open.index, delta } };
+  }
+
+  /** A complete block emitted at once: a tool call, a redacted reasoning item, a note. */
+  _whole(contentBlock, deltas = []) {
+    const out = this._close();
+    const index = this.nextIndex++;
+    out.push({ event: 'content_block_start', data: { type: 'content_block_start', index, content_block: contentBlock } });
+    for (const d of deltas) out.push({ event: 'content_block_delta', data: { type: 'content_block_delta', index, delta: d } });
+    out.push({ event: 'content_block_stop', data: { type: 'content_block_stop', index } });
+    this.emittedAny = true;
+    return out;
+  }
+
+  /**
+   * A finished function call: the tool_use block — or, when it was cut off
+   * mid-arguments, a note saying so (forwarded, the CLI would reject the
+   * unterminated JSON and the model would retry the same oversized call).
+   */
+  _finishCall(s, { callId, name, args, incomplete }) {
+    s.done = true;
+    if (incomplete || !parsesAsJson(args)) {
+      return this._whole({ type: 'text', text: '' }, [{ type: 'text_delta', text: truncatedToolNote(name || 'tool') }]);
+    }
+    this.toolsEmitted += 1;
+    return this._whole(
+      { type: 'tool_use', id: callId || newToolUseId(), name, input: {} },
+      [{ type: 'input_json_delta', partial_json: args || '{}' }],
+    );
+  }
+
+  /**
+   * Feed one parsed stream event. Returns the SSE events to write.
+   * @param {object} ev
+   */
+  push(ev) {
+    const out = this._start();
+    if (!ev || typeof ev !== 'object') return out;
+    if (this.terminal === 'failed') return out;   // the error event is the stream's last word
+    const i = Number.isInteger(ev.output_index) ? ev.output_index : null;
+    // A data line with no type but an `error` (the chat-style mid-stream error) is a failure too.
+    const type = ev.type || (ev.error ? 'error' : undefined);
+    switch (type) {
+      case 'response.output_item.added': {
+        if (i === null || !ev.item) break;
+        const s = this._slot(i);
+        s.type = ev.item.type;
+        if (s.type === 'function_call') {
+          s.callId = typeof ev.item.call_id === 'string' ? ev.item.call_id : '';
+          s.name = typeof ev.item.name === 'string' ? ev.item.name : '';
+          if (typeof ev.item.arguments === 'string') s.args = ev.item.arguments;
+        }
+        break;
+      }
+      case 'response.reasoning_summary_part.added': {
+        if (i !== null && this._slot(i).thinking) this._slot(i).newPart = true;
+        break;
+      }
+      case 'response.reasoning_summary_text.delta': {
+        if (i === null || typeof ev.delta !== 'string' || !ev.delta) break;
+        const s = this._slot(i);
+        if (!this._isOpen(i, 'thinking')) {
+          out.push(...this._openLive(i, 'thinking', { type: 'thinking', thinking: '', signature: '' }));
+          s.thinking = true;
+          s.newPart = false;
+        }
+        if (s.newPart) {
+          out.push(this._delta({ type: 'thinking_delta', thinking: '\n\n' }));
+          s.newPart = false;
+        }
+        out.push(this._delta({ type: 'thinking_delta', thinking: ev.delta }));
+        break;
+      }
+      case 'response.output_text.delta':
+      case 'response.refusal.delta': {
+        if (i === null || typeof ev.delta !== 'string' || !ev.delta) break;
+        if (!this._isOpen(i, 'text')) out.push(...this._openLive(i, 'text', { type: 'text', text: '' }));
+        out.push(this._delta({ type: 'text_delta', text: ev.delta }));
+        break;
+      }
+      case 'response.function_call_arguments.delta': {
+        if (i !== null && typeof ev.delta === 'string') this._slot(i).args += ev.delta;
+        break;
+      }
+      case 'response.output_item.done': {
+        if (i === null || !ev.item) break;
+        const s = this._slot(i);
+        const item = ev.item;
+        if (item.type === 'reasoning') {
+          s.done = true;
+          const enc = typeof item.encrypted_content === 'string' ? item.encrypted_content : '';
+          const marker = enc ? encodeReasoningMarker(this.upstreamModel, enc) : '';
+          if (this._isOpen(i, 'thinking')) {
+            if (marker) out.push(this._delta({ type: 'signature_delta', signature: marker }));
+            out.push(...this._close());
+          } else if (marker) {
+            // No summary text — or its thinking block was already closed by an
+            // interleaved item: a redacted block carries the reasoning on.
+            out.push(...this._whole({ type: 'redacted_thinking', data: marker }));
+          }
+        } else if (item.type === 'message') {
+          s.done = true;
+          if (this.open && this.open.outputIndex === i) out.push(...this._close());
+        } else if (item.type === 'function_call') {
+          out.push(...this._finishCall(s, {
+            callId: typeof item.call_id === 'string' && item.call_id ? item.call_id : s.callId,
+            name: typeof item.name === 'string' && item.name ? item.name : s.name,
+            // The done item's arguments are authoritative — unless it came back empty
+            // after arguments streamed in (then the streamed ones are the call).
+            args: typeof item.arguments === 'string' && item.arguments.trim() ? item.arguments : s.args,
+            incomplete: item.status === 'incomplete',
+          }));
+        }
+        break;
+      }
+      case 'response.completed':
+      case 'response.incomplete': {
+        this.terminal = ev.type === 'response.completed' ? 'completed' : 'incomplete';
+        const r = ev.response && typeof ev.response === 'object' ? ev.response : {};
+        if (r.usage) this.usage = r.usage;
+        if (r.incomplete_details && typeof r.incomplete_details.reason === 'string') this.incompleteReason = r.incomplete_details.reason;
+        break;
+      }
+      case 'response.failed':
+      case 'error': {
+        this.terminal = 'failed';
+        const e = type === 'error'
+          ? (ev.error && typeof ev.error === 'object' ? ev.error : typeof ev.error === 'string' ? { message: ev.error } : ev)
+          : ((ev.response && ev.response.error) || {});
+        const msg = (e && (e.message || e.code)) || 'the upstream reported a failure';
+        // A context overflow is said in the words the CLI compacts on, as for an HTTP 400 — and
+        // only an overflow: a rate limit or a timeout keeps its own words (errors.mjs).
+        out.push(...this._close(), isFailedResponseOverflow(e && e.code, e && e.message)
+          ? { event: 'error', data: { type: 'error', error: { type: 'invalid_request_error', message: PROMPT_TOO_LONG } } }
+          : errorEvent(`upstream stream error: ${msg}`));
+        break;
+      }
+      default:
+        break;   // created, in_progress, content_part.*, *.done text events, copilot_usage lines …
+    }
+    return out;
+  }
+
+  /** End of stream: close blocks, settle unfinished calls, emit message_delta + message_stop. */
+  finish() {
+    const out = this._start();
+    if (this.terminal === 'failed') return out;   // the error event is already out
+    out.push(...this._close());
+    // Function calls whose item never finished (a cut stream, an incomplete response).
+    for (const [, s] of [...this.slots.entries()].sort((a, b) => a[0] - b[0])) {
+      if (s.type !== 'function_call' || s.done) continue;
+      out.push(...this._finishCall(s, { callId: s.callId, name: s.name, args: s.args, incomplete: !s.args.trim() }));
+    }
+    let stop;
+    if (this.terminal === 'incomplete') stop = this.incompleteReason === 'max_output_tokens' ? 'max_tokens' : 'end_turn';
+    else if (this.terminal === 'completed') stop = 'end_turn';
+    else stop = this.emittedAny ? 'end_turn' : null;
+    if (stop === null) {
+      out.push(errorEvent('upstream stream ended without content or a terminal event'));
+      return out;
+    }
+    if (this.toolsEmitted && stop === 'end_turn') stop = 'tool_use';
+    out.push({ event: 'message_delta', data: { type: 'message_delta', delta: { stop_reason: stop, stop_sequence: null }, usage: mapResponsesUsage(this.usage) } });
+    out.push({ event: 'message_stop', data: { type: 'message_stop' } });
+    return out;
+  }
+}
+
+/**
+ * A buffered (non-streaming) Responses API body -> Anthropic message object.
+ * @param {object} resp  the upstream JSON body
+ * @param {{model:string, upstreamModel:string}} opts
+ */
+export function toMessagesResponseFromResponses(resp, { model, upstreamModel } = {}) {
+  const r = resp && typeof resp === 'object' ? resp : {};
+  const content = [];
+  let tools = 0;
+  for (const item of Array.isArray(r.output) ? r.output : []) {
+    if (!item || typeof item !== 'object') continue;
+    if (item.type === 'reasoning') {
+      const text = (Array.isArray(item.summary) ? item.summary : [])
+        .map((p) => (p && typeof p.text === 'string' ? p.text : ''))
+        .filter(Boolean)
+        .join('\n\n');
+      const marker = typeof item.encrypted_content === 'string' && item.encrypted_content
+        ? encodeReasoningMarker(upstreamModel || '', item.encrypted_content) : '';
+      if (text) content.push({ type: 'thinking', thinking: text, signature: marker });
+      else if (marker) content.push({ type: 'redacted_thinking', data: marker });
+    } else if (item.type === 'message') {
+      const text = (Array.isArray(item.content) ? item.content : [])
+        .map((c) => {
+          if (!c || typeof c !== 'object') return '';
+          if (c.type === 'output_text' && typeof c.text === 'string') return c.text;
+          if (c.type === 'refusal' && typeof c.refusal === 'string') return c.refusal;
+          return '';
+        })
+        .join('');
+      if (text) content.push({ type: 'text', text });
+    } else if (item.type === 'function_call') {
+      const name = String(item.name || '');
+      const args = typeof item.arguments === 'string' ? item.arguments : '';
+      if (item.status === 'incomplete' || !parsesAsJson(args)) {
+        content.push({ type: 'text', text: truncatedToolNote(name || 'tool') });
+        continue;
+      }
+      let input = {};
+      if (args.trim()) { try { input = JSON.parse(args); } catch { input = { _raw: args }; } }
+      content.push({ type: 'tool_use', id: item.call_id || newToolUseId(), name, input });
+      tools += 1;
+    }
+  }
+  let stop = r.status === 'incomplete' && r.incomplete_details && r.incomplete_details.reason === 'max_output_tokens'
+    ? 'max_tokens' : 'end_turn';
+  if (tools && stop === 'end_turn') stop = 'tool_use';
+  return {
+    id: newMessageId(),
+    type: 'message',
+    role: 'assistant',
+    model: model || 'bridge',
+    content,
+    stop_reason: stop,
+    stop_sequence: null,
+    usage: mapResponsesUsage(r.usage),
+  };
+}

package/src/core/bridge/upstream.mjs

@@ -7,7 +7,9 @@
 import { toChatRequest } from './translate/request.mjs';
 import { ChatStreamTranslator, SseDataParser, serializeSse } from './translate/stream.mjs';
 import { toMessagesResponse } from './translate/response.mjs';
-import { mapUpstreamError, mapNetworkError, bridgeErrors, PAYLOAD_CEILING_BYTES } from './errors.mjs';
+import { toResponsesRequest } from './translate/responses-request.mjs';
+import { ResponsesStreamTranslator, toMessagesResponseFromResponses } from './translate/responses-stream.mjs';
+import { mapUpstreamError, mapNetworkError, bridgeErrors, anthropicError, isFailedResponseOverflow, PAYLOAD_CEILING_BYTES } from './errors.mjs';
 import { copilotToken, invalidateCopilotToken, copilotApiHost, copilotHeaders, bodyHasImage, requestInitiator } from './providers/copilot.mjs';
 import { upstreamSettings, providerReadiness } from './registry.mjs';
 import { KeyedSemaphore } from './semaphore.mjs';
@@ -36,7 +38,7 @@ async function prepareUpstream(us, body, { fetch: f, requestHeaders }) {
     const build = async (force) => {
       const { token, apiHost } = await copilotToken(us.githubToken, { fetch: f, force });
       const host = apiHost || copilotApiHost(us.accountType);
-      const path = us.api === 'anthropic' ? '/v1/messages' : '/chat/completions';
+      const path = us.api === 'anthropic' ? '/v1/messages' : us.api === 'openai-responses' ? '/responses' : '/chat/completions';
       const headers = { ...copilotHeaders(token, { vision, initiator }), ...us.headers };
       if (us.api === 'anthropic') {
         headers['anthropic-version'] = requestHeaders['anthropic-version'] || '2023-06-01';
@@ -62,7 +64,7 @@ async function prepareUpstream(us, body, { fetch: f, requestHeaders }) {
   }
   const base = (us.baseUrl || 'https://api.openai.com/v1').replace(/\/+$/, '');
   return {
-    url: `${base}/chat/completions`,
+    url: `${base}/${us.api === 'openai-responses' ? 'responses' : 'chat/completions'}`,
     headers: { 'content-type': 'application/json', ...(us.apiKey ? { authorization: `Bearer ${us.apiKey}` } : {}), ...us.headers },
     provider: us.provider,
     initiator,
@@ -96,7 +98,8 @@ export async function handleMessages({ entry, body, requestHeaders = {}, tag = '
   if (us.api === 'anthropic') {
     outBody = { ...body, model: us.model };
   } else {
-    const t = toChatRequest(body, { upstreamModel: us.model, capabilities: us.capabilities });
+    const responses = us.api === 'openai-responses';
+    const t = (responses ? toResponsesRequest : toChatRequest)(body, { upstreamModel: us.model, capabilities: us.capabilities });
     if (t.error) {
       const e = bridgeErrors.unsupported(t.error.message);
       recordBridgeError({ tag, catalogId: entry.id, provider: us.provider, status: e.status, message: e.body.error.message });
@@ -105,7 +108,7 @@ export async function handleMessages({ entry, body, requestHeaders = {}, tag = '
     for (const w of t.warnings) {
       const line = w === 'max_tokens clamped'
         ? 'max_tokens clamped to the model\'s output limit'
-        : `${w} has no chat/completions equivalent — dropped`;
+        : `${w} has no ${responses ? 'Responses API' : 'chat/completions'} equivalent — dropped`;
       warnOnce(`${entry.id}:${w}`, `[worca] bridge: model ${JSON.stringify(entry.id)}: ${line}`, log);
     }
     outBody = t.body;
@@ -176,11 +179,35 @@ export async function handleMessages({ entry, body, requestHeaders = {}, tag = '
 
     if (!streaming) {
       const j = await res.json();
-      return reply.json(200, toMessagesResponse(j, { model: entry.id }));
+      if (us.api === 'openai-responses' && j && j.status === 'failed') {
+        // A buffered Responses body reports its failure with HTTP 200: answer it as the error it is.
+        const fe = j.error && typeof j.error === 'object' ? j.error : {};
+        const e = isFailedResponseOverflow(fe.code, fe.message)
+          ? bridgeErrors.tooLarge()
+          : anthropicError(502, 'api_error', `${us.provider}: upstream error — ${fe.message || fe.code || 'the response failed'}`);
+        recordBridgeError({ tag, catalogId: entry.id, provider: us.provider, status: 200, message: e.body.error.message });
+        return reply.json(e.status, e.body);
+      }
+      return reply.json(200, us.api === 'openai-responses'
+        ? toMessagesResponseFromResponses(j, { model: entry.id, upstreamModel: us.model })
+        : toMessagesResponse(j, { model: entry.id }));
     }
 
     reply.status(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache' });
-    const translator = new ChatStreamTranslator({ model: entry.id });
+    const translator = us.api === 'openai-responses'
+      ? new ResponsesStreamTranslator({ model: entry.id, upstreamModel: us.model })
+      : new ChatStreamTranslator({ model: entry.id });
+    // A Responses stream can fail mid-flight (response.failed / error): book it
+    // like an upstream refusal, so the Test button can name the reason. The
+    // chat stream's events pass through untouched.
+    const booked = (events) => {
+      if (us.api === 'openai-responses') {
+        for (const e of events) {
+          if (e.event === 'error') recordBridgeError({ tag, catalogId: entry.id, provider: us.provider, status: 200, message: e.data.error.message });
+        }
+      }
+      return events;
+    };
     const parser = new SseDataParser();
     const decoder = new TextDecoder();
     let ping = setInterval(() => reply.write('event: ping\ndata: {"type":"ping"}\n\n'), PING_INTERVAL_MS);
@@ -191,14 +218,14 @@ export async function handleMessages({ entry, body, requestHeaders = {}, tag = '
         for await (const chunk of res.body) {
           const text = decoder.decode(chunk, { stream: true });
           for (const obj of parser.feed(text)) {
-            const events = translator.push(obj);
+            const events = booked(translator.push(obj));
             if (events.length) { reply.write(serializeSse(events)); bump(); }
           }
           if (parser.done) break;
         }
-        for (const obj of parser.end()) reply.write(serializeSse(translator.push(obj)));
+        for (const obj of parser.end()) reply.write(serializeSse(booked(translator.push(obj))));
       }
-      reply.write(serializeSse(translator.finish()));
+      reply.write(serializeSse(booked(translator.finish())));
     } finally {
       clearInterval(ping);
     }

package/src/core/cf-access.mjs

@@ -0,0 +1,90 @@
+// Cloudflare Access token verification (docs/remote-access.md). Access signs a
+// short-lived RS256 JWT and sends it as `Cf-Access-Jwt-Assertion` on every
+// request it lets through, WebSocket upgrades included. The team's public keys
+// come from https://<team>/cdn-cgi/access/certs: cached 10 min, refetched on an
+// unknown `kid` (key rotation) at most once per 30 s. node:crypto only.
+import { createPublicKey, verify } from 'node:crypto';
+
+const KEYS_TTL_MS = 600_000;
+const REFETCH_MIN_MS = 30_000;
+const CLOCK_SKEW_S = 30;
+
+/** "acme.cloudflareaccess.com" (a scheme or trailing slash is tolerated) -> "acme.cloudflareaccess.com". */
+export function normalizeTeamDomain(value) {
+  return String(value || '').trim().replace(/^https?:\/\//i, '').replace(/\/+$/, '').toLowerCase();
+}
+
+/**
+ * @returns {(token: string) => Promise<{ email: string|null, sub: string|null } | null>}
+ *   resolves to the identity for a valid token, null for any invalid one; rejects
+ *   only when the keys cannot be loaded (the caller answers 503, not 401).
+ */
+export function createAccessVerifier({ teamDomain, aud, fetchImpl = fetch, now = () => Date.now() }) {
+  const domain = normalizeTeamDomain(teamDomain);
+  if (!domain) throw new Error('createAccessVerifier: teamDomain is required');
+  if (!aud) throw new Error('createAccessVerifier: aud is required');
+  const issuer = `https://${domain}`;
+  const certsUrl = `${issuer}/cdn-cgi/access/certs`;
+  let keys = new Map();
+  let fetchedAt = 0;
+  let inflight = null;
+
+  async function fetchKeys() {
+    const res = await fetchImpl(certsUrl);
+    if (!res.ok) throw new Error(`Access certs: HTTP ${res.status}`);
+    const body = await res.json();
+    const next = new Map();
+    for (const k of Array.isArray(body?.keys) ? body.keys : []) {
+      if (typeof k?.kid !== 'string' || k.kty !== 'RSA') continue;
+      try { next.set(k.kid, createPublicKey({ key: k, format: 'jwk' })); } catch { /* skip a malformed key */ }
+    }
+    if (!next.size) throw new Error('Access certs: no usable RSA keys');
+    keys = next;
+    fetchedAt = now();
+  }
+
+  async function loadKeys(force) {
+    const age = now() - fetchedAt;
+    if (keys.size && age < (force ? REFETCH_MIN_MS : KEYS_TTL_MS)) return;
+    // One fetch at a time: a burst of requests after expiry shares it.
+    inflight ||= fetchKeys().finally(() => { inflight = null; });
+    try {
+      await inflight;
+    } catch (err) {
+      // Stale keys beat none: keep serving with them if the refresh fails.
+      if (!keys.size) throw err;
+    }
+  }
+
+  const decode = (seg) => JSON.parse(Buffer.from(seg, 'base64url').toString('utf8'));
+
+  return async function verifyAccessJwt(token) {
+    const parts = typeof token === 'string' ? token.split('.') : [];
+    if (parts.length !== 3 || parts.some((p) => !p)) return null;
+    let header, payload;
+    try { header = decode(parts[0]); payload = decode(parts[1]); } catch { return null; }
+    if (!header || header.alg !== 'RS256' || typeof header.kid !== 'string') return null;
+    if (!payload || typeof payload !== 'object') return null;
+
+    await loadKeys(false);
+    if (!keys.has(header.kid)) await loadKeys(true);
+    const key = keys.get(header.kid);
+    if (!key) return null;
+
+    let ok = false;
+    try {
+      ok = verify('RSA-SHA256', Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], 'base64url'));
+    } catch { ok = false; }
+    if (!ok) return null;
+
+    const t = Math.floor(now() / 1000);
+    const auds = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    if (payload.iss !== issuer || !auds.includes(aud)) return null;
+    if (typeof payload.exp !== 'number' || payload.exp < t - CLOCK_SKEW_S) return null;
+    if (typeof payload.nbf === 'number' && payload.nbf > t + CLOCK_SKEW_S) return null;
+    return {
+      email: typeof payload.email === 'string' ? payload.email : null,
+      sub: typeof payload.sub === 'string' ? payload.sub : null,
+    };
+  };
+}

package/src/core/chat/command-router.mjs

@@ -16,6 +16,7 @@ import { createAllowlistGuard, parseIdList } from './allowlist.mjs';
 import { runRef, fmtUsd, fmtMs } from './renderers.mjs';
 import { promptFields, parseAnswerLine } from '../../shared/forms/project.mjs';
 import { giveUpOption, describePauseReason, pauseConsequences } from '../failure-policy.mjs';
+import { chatActor } from '../identity.mjs';
 
 const md = (value) => ({ kind: 'markdown', value });
 const reply = (text, severity = 'info') => ({ title: null, body: [md(text)], severity });
@@ -227,21 +228,21 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
       return reply(`\`${runRef(t.run.runId)}\` cost so far: ${fmtUsd(state?.totalCostUsd) || '$0.00'}`);
     },
 
-    pause: async ({ chatKey, args }) => {
+    pause: async ({ chatKey, args, actor }) => {
       const t = resolveTarget(args[0], scopedRuns(chatKey), [], { wantLive: true });
       if (t.error) return t.error;
-      await actions.pause(t.run.runId);
+      await actions.pause(t.run.runId, actor);
       return reply(`⏸ Pausing \`${runRef(t.run.runId)}\` — resume from the UI or \`/resume ${runRef(t.run.runId)}\`.`, 'warning');
     },
 
-    stop: async ({ chatKey, args }) => {
+    stop: async ({ chatKey, args, actor }) => {
       const t = resolveTarget(args[0], scopedRuns(chatKey), [], { wantLive: true });
       if (t.error) return t.error;
-      await actions.stop(t.run.runId);
+      await actions.stop(t.run.runId, actor);
       return reply(`⏹ Stopping \`${runRef(t.run.runId)}\` (${String(t.run.title || '').slice(0, 50)}).`, 'warning');
     },
 
-    resume: async ({ args }) => {
+    resume: async ({ args, actor }) => {
       // Resolve against PAUSED/INTERRUPTED history rows (resume works across
       // restarts); a live match means it's already running.
       const rows = (await actions.history({ limit: 50 })).filter((r) => r.status === 'paused' || r.status === 'interrupted');
@@ -254,7 +255,7 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
         if (args[0] || rows.length !== 1) return t.error;
         t = { row: rows[0] };            // exactly one paused row, bare /resume: take it
       }
-      const out = await actions.resume(t.row.id);
+      const out = await actions.resume(t.row.id, actor);
       if (out?.ok) return reply(`▶️ Resuming \`${runRef(t.row.id)}\` — ${String(t.row.title || '').slice(0, 50)}`);
       return reply(`Could not resume \`${runRef(t.row.id)}\`: ${out?.error || 'unknown error'}`, 'error');
     },
@@ -263,7 +264,7 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
     retry: async (env) => answerDecision(env, 'retry'),
     abort: async (env) => answerDecision(env, 'abort'),
 
-    answer: async ({ chatKey, args }) => {
+    answer: async ({ chatKey, args, actor }) => {
       const t = resolveTarget(args[0] && args[0].startsWith('*') ? args[0] : '', scopedRuns(chatKey), [], { wantLive: true });
       if (t.error) return t.error;
       const pq = actions.pendingQuestion(t.run.runId);
@@ -295,7 +296,7 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
             '', `Reply: \`/answer ${formRef} ${example}\``].join('\n'), 'warning');
         }
         try {
-          await actions.answer(t.run.runId, pq.id, { values: parsed.values });
+          await actions.answer(t.run.runId, pq.id, { values: parsed.values }, actor);
         } catch (err) {
           if (!err || err.code !== 'INVALID_ANSWER') throw err;   // the handler's catch owns everything else
           return reply([`\`${formRef}\` — that answer was rejected:`,
@@ -348,7 +349,7 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
           return reply(`Q${i + 1} takes an option number (1–${opts.length}), not text.`, 'warning');
         }
       }
-      await actions.answer(t.run.runId, pq.id, { answers });
+      await actions.answer(t.run.runId, pq.id, { answers }, actor);
       return reply(`✅ Answered ${questions.length} question${questions.length === 1 ? '' : 's'} on \`${ref}\`.`, 'success');
     },
 
@@ -367,7 +368,7 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
     },
   };
 
-  async function answerDecision({ chatKey, args }, verb) {
+  async function answerDecision({ chatKey, args, actor }, verb) {
     const t = resolveTarget(args[0], scopedRuns(chatKey), [], { wantLive: true });
     if (t.error) return t.error;
     const pq = actions.pendingQuestion(t.run.runId);
@@ -384,7 +385,7 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
     } else {
       return reply(`\`${ref}\` is waiting on ${pq.kind} — use \`/answer ${ref} <n>\`.`, 'warning');
     }
-    await actions.answer(t.run.runId, pq.id, payload);
+    await actions.answer(t.run.runId, pq.id, payload, actor);
     const what = pq.kind === 'gate'
       ? (payload.decision === 'continue' ? 'approved — continuing' : 'sent back for another cycle')
       : (payload.decision === 'retry' ? 'retrying' : payload.decision === 'abort' ? 'aborting the run' : 'pausing the run');
@@ -407,8 +408,12 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
       const handler = Object.hasOwn(handlers, parsed.command) ? handlers[parsed.command] : null;
       const chatKey = `${platform}:${msg.chatId}`;
       if (!handler) return reply(`Unknown command \`/${parsed.command}\` — \`/help\` lists commands.`, 'warning');
+      // Who sent it, as attribution TEXT ("ada via Slack"): the platform's display name or
+      // user id, never a sign-in identity. Actions that change a run record it.
+      const meta = msg.meta && typeof msg.meta === 'object' ? msg.meta : {};
+      const actor = chatActor({ platform, userName: meta.username || meta.name || meta.userName || null, userId: msg.userId });
       try {
-        return await handler({ chatKey, platform, plugin, channelId, msg, args: parsed.args });
+        return await handler({ chatKey, platform, plugin, channelId, msg, args: parsed.args, actor });
       } catch (err) {
         logger('error', `chat command /${parsed.command} failed: ${err?.message || err}`);
         return reply(`Command failed: ${String(err?.message || err).slice(0, 200)}`, 'error');