@wrongstack/cli 1.0.26 → 1.0.28

package/dist/{chunk-OAVBM55Q.js → chunk-ENRYW73H.js}

@@ -41,8 +41,7 @@ import {
   HqAlertEngine,
   HqBootstrapCodeStore,
   HqCommandAuditLog,
-  hqTokenKey as hqTokenKey2,
-  isTokenExpired as isTokenExpired4,
+  hqTokenKey as hqTokenKey4,
   mintHqCookieSecret as mintHqCookieSecret2,
   mutateHqAuthFile as mutateHqAuthFile4,
   shouldCloseBrowserSocket,
@@ -50,7 +49,7 @@ import {
   watchHqAuthFile
 } from "@wrongstack/core/hq";
 import { createCompatibilityTrustBoundary } from "@wrongstack/core/security";
-import { WebSocket as WebSocket3, WebSocketServer } from "ws";
+import { WebSocket as WebSocket4, WebSocketServer } from "ws";
 
 // src/hq-recovery-html.ts
 var HQ_RECOVERY_HTML = `<!doctype html>
@@ -76,270 +75,18 @@ var HQ_RECOVERY_HTML = `<!doctype html>
 </html>`;
 var HQ_HTML = HQ_RECOVERY_HTML;
 
-// src/hq-server/auth.ts
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { isIP } from "node:net";
-import { hqTokenVerifier, isLoopbackHost, isTokenExpired } from "@wrongstack/core/hq";
-var HQ_SESSION_COOKIE = "hq.session";
-var HQ_SESSION_COOKIE_SECURE = "__Host-hq.session";
-function cookieName(secure) {
-  return secure ? HQ_SESSION_COOKIE_SECURE : HQ_SESSION_COOKIE;
-}
-var HQ_SESSION_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
-var HQ_SESSION_IDLE_TIMEOUT_MS = 30 * 6e4;
-function setHqSecurityHeaders(res) {
-  res.setHeader("X-Content-Type-Options", "nosniff");
-  res.setHeader("X-Frame-Options", "DENY");
-  res.setHeader("Referrer-Policy", "no-referrer");
-  res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
-  res.setHeader(
-    "Content-Security-Policy",
-    [
-      "default-src 'self'",
-      "base-uri 'none'",
-      "object-src 'none'",
-      "frame-ancestors 'none'",
-      "form-action 'self'",
-      "script-src 'self' 'wasm-unsafe-eval'",
-      "style-src 'self' 'unsafe-inline'",
-      "font-src 'self' data:",
-      "img-src 'self' data:",
-      "connect-src 'self'"
-    ].join("; ")
-  );
-}
-function hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrigins) {
-  const rawHost = req.headers.host?.trim();
-  if (!rawHost) return false;
-  try {
-    const requestUrl = new URL(`http://${rawHost}`);
-    if (requestUrl.username || requestUrl.password || requestUrl.pathname !== "/" || requestUrl.search || requestUrl.hash) {
-      return false;
-    }
-    for (const origin of trustedPublicOrigins) {
-      const trusted = new URL(origin);
-      const normalizedRequest = new URL(`${trusted.protocol}//${rawHost}`);
-      if (trusted.host.toLowerCase() === normalizedRequest.host.toLowerCase()) return true;
-    }
-    const hostname = requestUrl.hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1");
-    const requestPort = requestUrl.port || "80";
-    const portMatches = boundPort === void 0 || boundPort === 0 || requestPort === String(boundPort);
-    const isLoopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
-    if (isLoopback) return portMatches;
-    if (isIP(hostname) !== 0) {
-      const normalizedBoundHost = boundHost?.toLowerCase().replace(/^\[(.*)\]$/, "$1");
-      const permitsIpHost = normalizedBoundHost === void 0 || normalizedBoundHost === "0.0.0.0" || normalizedBoundHost === "::" || normalizedBoundHost === hostname;
-      return permitsIpHost && portMatches;
-    }
-    return boundHost?.toLowerCase() === hostname && portMatches;
-  } catch {
-    return false;
-  }
-}
-function hasTrustedBrowserOrigin(req, boundHost, boundPort, trustedPublicOrigins = /* @__PURE__ */ new Set(), allowFileOrigin = false, credentialedSurface = false) {
-  if (!hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrigins)) return false;
-  const origin = req.headers.origin;
-  if (origin === void 0) {
-    if (!credentialedSurface) {
-      return boundHost !== void 0 && isLoopbackHost(boundHost);
-    }
-    return true;
-  }
-  try {
-    const parsed = new URL(origin);
-    if (parsed.protocol === "file:") return allowFileOrigin;
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
-    const rawRequestHost = req.headers.host?.trim();
-    if (!rawRequestHost) return false;
-    const requestHost = new URL(`${parsed.protocol}//${rawRequestHost}`).host.toLowerCase();
-    if (parsed.host.toLowerCase() !== requestHost) return false;
-    const registeredPublicOrigin = [...trustedPublicOrigins].some(
-      (trustedOrigin) => new URL(trustedOrigin).host.toLowerCase() === requestHost
-    );
-    return !registeredPublicOrigin || trustedPublicOrigins.has(parsed.origin.toLowerCase());
-  } catch {
-    return false;
-  }
-}
-function signHqSession(sessionId, secret) {
-  return createHmac("sha256", secret).update(sessionId).digest("hex");
-}
-function serializeHqSessionCookie(sessionId, secret) {
-  return `${sessionId}.${signHqSession(sessionId, secret)}`;
-}
-function parseHqSessionCookie(value, secret) {
-  const dot = value.indexOf(".");
-  if (dot === -1) return void 0;
-  const sessionId = value.slice(0, dot);
-  const sig = value.slice(dot + 1);
-  if (!sessionId || !sig) return void 0;
-  const expected = signHqSession(sessionId, secret);
-  try {
-    if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) return void 0;
-  } catch {
-    return void 0;
-  }
-  return sessionId;
-}
-function parseCookieHeader(cookieHeader) {
-  const out = {};
-  if (typeof cookieHeader !== "string") return out;
-  for (const part of cookieHeader.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1) continue;
-    const key = part.slice(0, idx).trim();
-    const value = part.slice(idx + 1).trim();
-    if (key) {
-      try {
-        out[key] = decodeURIComponent(value);
-      } catch {
-        out[key] = value;
-      }
-    }
-  }
-  return out;
-}
-function readHqSessionCookie(cookieHeader) {
-  const cookies = parseCookieHeader(cookieHeader);
-  return cookies[HQ_SESSION_COOKIE_SECURE] ?? cookies[HQ_SESSION_COOKIE];
-}
-function setHqSessionCookie(res, value, secure) {
-  const name = cookieName(secure);
-  const parts = [
-    `${name}=${encodeURIComponent(value)}`,
-    "Path=/",
-    "HttpOnly",
-    "SameSite=Lax",
-    `Max-Age=${Math.floor(HQ_SESSION_MAX_AGE_MS / 1e3)}`
-  ];
-  if (secure) parts.push("Secure");
-  res.setHeader("Set-Cookie", parts.join("; "));
-}
-function clearHqSessionCookie(res, secure) {
-  const name = cookieName(secure);
-  const parts = [`${name}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`];
-  if (secure) parts.push("Secure");
-  res.setHeader("Set-Cookie", parts.join("; "));
-}
-function isTokenAuth(auth) {
-  return auth !== void 0 && auth.kind === "token";
-}
-function isCookieAuth(auth) {
-  return auth !== void 0 && auth.kind === "cookie";
-}
-function hqAuthRequired(mutableAuth, requireBrowserAuth) {
-  return (requireBrowserAuth ?? mutableAuth.requireBrowserAuth) === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
-}
-function hqClientAuthRequired(mutableAuth) {
-  return mutableAuth.clientTokens.size > 0 || hqAuthRequired(mutableAuth);
-}
-function extractBrowserToken(req, url) {
-  const queryToken = url.searchParams.get("token");
-  if (queryToken) {
-    const requestHost = (req.headers.host ?? "").trim();
-    let hostname = "";
-    try {
-      hostname = new URL(`http://${requestHost}`).hostname;
-    } catch {
-    }
-    if (hostname && isLoopbackHost(hostname)) {
-      console.warn(
-        JSON.stringify({
-          level: "warn",
-          event: "hq.token_from_query_param",
-          message: "Browser token accepted from URL query parameter \u2014 token can leak through browser history, server access logs, and Referer headers.",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
-      );
-      return queryToken;
-    }
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "hq.token_from_query_param_rejected",
-        message: "Browser token in URL query rejected on a non-loopback request \u2014 send it in the Authorization header instead.",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  }
-  const auth = req.headers.authorization;
-  if (typeof auth === "string" && auth.toLowerCase().startsWith("bearer ")) {
-    return auth.slice(7).trim();
-  }
-  return void 0;
-}
-function timingSafeTokenMatch(tokens, supplied) {
-  if (!supplied) return void 0;
-  const b = Buffer.from(hqTokenVerifier(supplied));
-  for (const candidate of tokens) {
-    const a = Buffer.from(candidate);
-    if (a.length === b.length && timingSafeEqual(a, b)) return candidate;
-  }
-  return void 0;
-}
-function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
-  const token = extractBrowserToken(req, url);
-  if (token) {
-    const matchedToken = timingSafeTokenMatch(mutableAuth.browserTokens, token);
-    if (matchedToken) {
-      const obj = mutableAuth.browserTokenObjs.get(matchedToken);
-      if (isTokenExpired(obj)) return void 0;
-      const ctx = {
-        kind: "token",
-        token: matchedToken,
-        id: obj?.id ?? "unknown"
-      };
-      if (obj?.capabilities !== void 0) ctx.capabilities = obj.capabilities;
-      return ctx;
-    }
-  }
-  if (mutableAuth.cookieSecret) {
-    const raw = readHqSessionCookie(req.headers.cookie);
-    if (raw) {
-      const sessionId = parseHqSessionCookie(raw, mutableAuth.cookieSecret);
-      if (sessionId) {
-        const session = sessions.get(sessionId);
-        const now = Date.now();
-        if (session && now - session.createdAt < HQ_SESSION_MAX_AGE_MS) {
-          if (session.pending2fa) return void 0;
-          if (now - session.lastSeenAt > HQ_SESSION_IDLE_TIMEOUT_MS) {
-            sessions.delete(sessionId);
-            return void 0;
-          }
-          session.lastSeenAt = now;
-          if (session.kind === "token" && session.tokenId !== void 0) {
-            const liveToken = [...mutableAuth.browserTokenObjs.values()].find(
-              (obj) => obj.id === session.tokenId
-            );
-            if (!liveToken) {
-              sessions.delete(sessionId);
-              return void 0;
-            }
-            const ctx = { kind: "cookie", tokenId: session.tokenId };
-            if (liveToken.capabilities !== void 0) ctx.capabilities = liveToken.capabilities;
-            return ctx;
-          }
-          return session.capabilities === void 0 ? { kind: "cookie" } : { kind: "cookie", capabilities: session.capabilities };
-        }
-        if (session) sessions.delete(sessionId);
-      }
-    }
-  }
-  return void 0;
-}
-
 // src/hq-server/auth-state.ts
 import {
   DEFAULT_HQ_REDACTION_POLICY,
   findRevokedTokenKeys,
   hqAuthContentHash,
   hqTokenKey,
-  isTokenExpired as isTokenExpired2,
+  isTokenExpired,
   logHqAuthAudit
 } from "@wrongstack/core/hq";
 var TOKEN_EXPIRY_WARNING_MS = 24 * 60 * 60 * 1e3;
 function liveTokens(list) {
-  return (list ?? []).filter((token) => !isTokenExpired2(token));
+  return (list ?? []).filter((token) => !isTokenExpired(token));
 }
 function projectAuthFile(mutableAuth, next) {
   mutableAuth.operatorPolicy = {
@@ -380,7 +127,7 @@ function createHqAuthState(authFile, dataDir, opts = {}) {
     tokenStats: () => {
       const now = Date.now();
       const all = [...rawBrowserTokens, ...rawClientTokens];
-      const live = all.filter((token) => !isTokenExpired2(token, now));
+      const live = all.filter((token) => !isTokenExpired(token, now));
       return {
         browserTotal: mutableAuth.browserTokens.size,
         clientTotal: mutableAuth.clientTokens.size,
@@ -424,10 +171,10 @@ function browserTokenMap(tokens) {
 }
 function auditPrunedTokens(scope, previous, next, authFile, dataDir) {
   const previouslyLive = new Set(
-    previous.filter((token) => !isTokenExpired2(token)).map(({ id }) => id)
+    previous.filter((token) => !isTokenExpired(token)).map(({ id }) => id)
   );
   const prunedCount = next.filter(
-    (token) => isTokenExpired2(token) && previouslyLive.has(token.id)
+    (token) => isTokenExpired(token) && previouslyLive.has(token.id)
   ).length;
   if (prunedCount === 0) return;
   const contentHash = hqAuthContentHash(authFile);
@@ -564,78 +311,330 @@ var LoginAttemptStore = class _LoginAttemptStore {
       const credKey = _LoginAttemptStore.credentialKey(password);
       this.set(credKey, backoff(this.store.get(credKey)));
     }
-    return this.store.get(ip);
+    return this.store.get(ip);
+  }
+  /**
+   * Clear the IP entry — and the credential entry when a password is given —
+   * on successful login.
+   */
+  clearOnSuccess(ip, password) {
+    this.delete(ip);
+    if (password !== void 0 && password.length > 0) {
+      this.delete(_LoginAttemptStore.credentialKey(password));
+    }
+  }
+  /** Number of tracked entries (for diagnostics). */
+  get size() {
+    return this.store.size;
+  }
+  /**
+   * Flush pending writes immediately. Called on server shutdown.
+   */
+  async flush() {
+    if (this.writeTimer) {
+      clearTimeout(this.writeTimer);
+      this.writeTimer = void 0;
+    }
+    if (this.dirty) {
+      await this.writeToDisk();
+    }
+  }
+  scheduleWrite() {
+    this.dirty = true;
+    if (this.writeTimer) return;
+    this.writeTimer = setTimeout(() => {
+      this.writeTimer = void 0;
+      void this.writeToDisk();
+    }, this.debounceMs);
+    this.writeTimer.unref?.();
+  }
+  async writeToDisk() {
+    this.dirty = false;
+    const now = Date.now();
+    const cutoff = now - this.retentionMs;
+    const obj = {};
+    for (const [key, entry] of this.store) {
+      if (entry.lastAttempt > cutoff) {
+        if (!key.startsWith("cred:")) {
+          obj[key] = entry;
+        }
+      } else {
+        this.store.delete(key);
+      }
+    }
+    try {
+      await atomicWrite(this.filePath, JSON.stringify(obj, null, 2), { mode: 384 });
+      await restrictFilePermissions(this.filePath, { label: "hq-login-attempts" });
+    } catch {
+    }
+  }
+  /** Iterate entries (for cleanup timers). */
+  entries() {
+    return this.store.entries();
+  }
+};
+
+// src/hq-server/mailbox-gateway-manager.ts
+import {
+  createMailboxHttpRouter,
+  createProjectMailbox,
+  MAILBOX_HTTP_DEFAULT_MAX_AGE_MS,
+  MailboxEventEmitter,
+  MailboxHttpRateLimiter
+} from "@wrongstack/core/coordination";
+import * as path6 from "node:path";
+
+// src/hq-server/auth.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { isIP } from "node:net";
+import { hqTokenVerifier, isLoopbackHost, isTokenExpired as isTokenExpired2 } from "@wrongstack/core/hq";
+var HQ_SESSION_COOKIE = "hq.session";
+var HQ_SESSION_COOKIE_SECURE = "__Host-hq.session";
+function cookieName(secure) {
+  return secure ? HQ_SESSION_COOKIE_SECURE : HQ_SESSION_COOKIE;
+}
+var HQ_SESSION_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+var HQ_SESSION_IDLE_TIMEOUT_MS = 30 * 6e4;
+function setHqSecurityHeaders(res) {
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Frame-Options", "DENY");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+  res.setHeader(
+    "Content-Security-Policy",
+    [
+      "default-src 'self'",
+      "base-uri 'none'",
+      "object-src 'none'",
+      "frame-ancestors 'none'",
+      "form-action 'self'",
+      "script-src 'self' 'wasm-unsafe-eval'",
+      "style-src 'self' 'unsafe-inline'",
+      "font-src 'self' data:",
+      "img-src 'self' data:",
+      "connect-src 'self'"
+    ].join("; ")
+  );
+}
+function hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrigins) {
+  const rawHost = req.headers.host?.trim();
+  if (!rawHost) return false;
+  try {
+    const requestUrl = new URL(`http://${rawHost}`);
+    if (requestUrl.username || requestUrl.password || requestUrl.pathname !== "/" || requestUrl.search || requestUrl.hash) {
+      return false;
+    }
+    for (const origin of trustedPublicOrigins) {
+      const trusted = new URL(origin);
+      const normalizedRequest = new URL(`${trusted.protocol}//${rawHost}`);
+      if (trusted.host.toLowerCase() === normalizedRequest.host.toLowerCase()) return true;
+    }
+    const hostname = requestUrl.hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1");
+    const requestPort = requestUrl.port || "80";
+    const portMatches = boundPort === void 0 || boundPort === 0 || requestPort === String(boundPort);
+    const isLoopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+    if (isLoopback) return portMatches;
+    if (isIP(hostname) !== 0) {
+      const normalizedBoundHost = boundHost?.toLowerCase().replace(/^\[(.*)\]$/, "$1");
+      const permitsIpHost = normalizedBoundHost === void 0 || normalizedBoundHost === "0.0.0.0" || normalizedBoundHost === "::" || normalizedBoundHost === hostname;
+      return permitsIpHost && portMatches;
+    }
+    return boundHost?.toLowerCase() === hostname && portMatches;
+  } catch {
+    return false;
+  }
+}
+function hasTrustedBrowserOrigin(req, boundHost, boundPort, trustedPublicOrigins = /* @__PURE__ */ new Set(), allowFileOrigin = false, credentialedSurface = false) {
+  if (!hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrigins)) return false;
+  const origin = req.headers.origin;
+  if (origin === void 0) {
+    if (!credentialedSurface) {
+      return boundHost !== void 0 && isLoopbackHost(boundHost);
+    }
+    return true;
+  }
+  try {
+    const parsed = new URL(origin);
+    if (parsed.protocol === "file:") return allowFileOrigin;
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+    const rawRequestHost = req.headers.host?.trim();
+    if (!rawRequestHost) return false;
+    const requestHost = new URL(`${parsed.protocol}//${rawRequestHost}`).host.toLowerCase();
+    if (parsed.host.toLowerCase() !== requestHost) return false;
+    const registeredPublicOrigin = [...trustedPublicOrigins].some(
+      (trustedOrigin) => new URL(trustedOrigin).host.toLowerCase() === requestHost
+    );
+    return !registeredPublicOrigin || trustedPublicOrigins.has(parsed.origin.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+function signHqSession(sessionId, secret) {
+  return createHmac("sha256", secret).update(sessionId).digest("hex");
+}
+function serializeHqSessionCookie(sessionId, secret) {
+  return `${sessionId}.${signHqSession(sessionId, secret)}`;
+}
+function parseHqSessionCookie(value, secret) {
+  const dot = value.indexOf(".");
+  if (dot === -1) return void 0;
+  const sessionId = value.slice(0, dot);
+  const sig = value.slice(dot + 1);
+  if (!sessionId || !sig) return void 0;
+  const expected = signHqSession(sessionId, secret);
+  try {
+    if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) return void 0;
+  } catch {
+    return void 0;
+  }
+  return sessionId;
+}
+function parseCookieHeader(cookieHeader) {
+  const out = {};
+  if (typeof cookieHeader !== "string") return out;
+  for (const part of cookieHeader.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1) continue;
+    const key = part.slice(0, idx).trim();
+    const value = part.slice(idx + 1).trim();
+    if (key) {
+      try {
+        out[key] = decodeURIComponent(value);
+      } catch {
+        out[key] = value;
+      }
+    }
   }
-  /**
-   * Clear the IP entry — and the credential entry when a password is given —
-   * on successful login.
-   */
-  clearOnSuccess(ip, password) {
-    this.delete(ip);
-    if (password !== void 0 && password.length > 0) {
-      this.delete(_LoginAttemptStore.credentialKey(password));
+  return out;
+}
+function readHqSessionCookie(cookieHeader) {
+  const cookies = parseCookieHeader(cookieHeader);
+  return cookies[HQ_SESSION_COOKIE_SECURE] ?? cookies[HQ_SESSION_COOKIE];
+}
+function setHqSessionCookie(res, value, secure) {
+  const name = cookieName(secure);
+  const parts = [
+    `${name}=${encodeURIComponent(value)}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${Math.floor(HQ_SESSION_MAX_AGE_MS / 1e3)}`
+  ];
+  if (secure) parts.push("Secure");
+  res.setHeader("Set-Cookie", parts.join("; "));
+}
+function clearHqSessionCookie(res, secure) {
+  const name = cookieName(secure);
+  const parts = [`${name}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`];
+  if (secure) parts.push("Secure");
+  res.setHeader("Set-Cookie", parts.join("; "));
+}
+function isTokenAuth(auth) {
+  return auth !== void 0 && auth.kind === "token";
+}
+function isCookieAuth(auth) {
+  return auth !== void 0 && auth.kind === "cookie";
+}
+function hqAuthRequired(mutableAuth, requireBrowserAuth) {
+  return (requireBrowserAuth ?? mutableAuth.requireBrowserAuth) === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
+}
+function hqClientAuthRequired(mutableAuth) {
+  return mutableAuth.clientTokens.size > 0 || hqAuthRequired(mutableAuth);
+}
+function extractBrowserToken(req, url) {
+  const queryToken = url.searchParams.get("token");
+  if (queryToken) {
+    const requestHost = (req.headers.host ?? "").trim();
+    let hostname = "";
+    try {
+      hostname = new URL(`http://${requestHost}`).hostname;
+    } catch {
+    }
+    if (hostname && isLoopbackHost(hostname)) {
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "hq.token_from_query_param",
+          message: "Browser token accepted from URL query parameter \u2014 token can leak through browser history, server access logs, and Referer headers.",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+      return queryToken;
     }
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "hq.token_from_query_param_rejected",
+        message: "Browser token in URL query rejected on a non-loopback request \u2014 send it in the Authorization header instead.",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
   }
-  /** Number of tracked entries (for diagnostics). */
-  get size() {
-    return this.store.size;
+  const auth = req.headers.authorization;
+  if (typeof auth === "string" && auth.toLowerCase().startsWith("bearer ")) {
+    return auth.slice(7).trim();
   }
-  /**
-   * Flush pending writes immediately. Called on server shutdown.
-   */
-  async flush() {
-    if (this.writeTimer) {
-      clearTimeout(this.writeTimer);
-      this.writeTimer = void 0;
-    }
-    if (this.dirty) {
-      await this.writeToDisk();
-    }
+  return void 0;
+}
+function timingSafeTokenMatch(tokens, supplied) {
+  if (!supplied) return void 0;
+  const b = Buffer.from(hqTokenVerifier(supplied));
+  for (const candidate of tokens) {
+    const a = Buffer.from(candidate);
+    if (a.length === b.length && timingSafeEqual(a, b)) return candidate;
   }
-  scheduleWrite() {
-    this.dirty = true;
-    if (this.writeTimer) return;
-    this.writeTimer = setTimeout(() => {
-      this.writeTimer = void 0;
-      void this.writeToDisk();
-    }, this.debounceMs);
-    this.writeTimer.unref?.();
+  return void 0;
+}
+function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
+  const token = extractBrowserToken(req, url);
+  if (token) {
+    const matchedToken = timingSafeTokenMatch(mutableAuth.browserTokens, token);
+    if (matchedToken) {
+      const obj = mutableAuth.browserTokenObjs.get(matchedToken);
+      if (isTokenExpired2(obj)) return void 0;
+      const ctx = {
+        kind: "token",
+        token: matchedToken,
+        id: obj?.id ?? "unknown"
+      };
+      if (obj?.capabilities !== void 0) ctx.capabilities = obj.capabilities;
+      return ctx;
+    }
   }
-  async writeToDisk() {
-    this.dirty = false;
-    const now = Date.now();
-    const cutoff = now - this.retentionMs;
-    const obj = {};
-    for (const [key, entry] of this.store) {
-      if (entry.lastAttempt > cutoff) {
-        if (!key.startsWith("cred:")) {
-          obj[key] = entry;
+  if (mutableAuth.cookieSecret) {
+    const raw = readHqSessionCookie(req.headers.cookie);
+    if (raw) {
+      const sessionId = parseHqSessionCookie(raw, mutableAuth.cookieSecret);
+      if (sessionId) {
+        const session = sessions.get(sessionId);
+        const now = Date.now();
+        if (session && now - session.createdAt < HQ_SESSION_MAX_AGE_MS) {
+          if (session.pending2fa) return void 0;
+          if (now - session.lastSeenAt > HQ_SESSION_IDLE_TIMEOUT_MS) {
+            sessions.delete(sessionId);
+            return void 0;
+          }
+          session.lastSeenAt = now;
+          if (session.kind === "token" && session.tokenId !== void 0) {
+            const liveToken = [...mutableAuth.browserTokenObjs.values()].find(
+              (obj) => obj.id === session.tokenId
+            );
+            if (!liveToken || isTokenExpired2(liveToken)) {
+              sessions.delete(sessionId);
+              return void 0;
+            }
+            const ctx = { kind: "cookie", tokenId: session.tokenId };
+            if (liveToken.capabilities !== void 0) ctx.capabilities = liveToken.capabilities;
+            return ctx;
+          }
+          return session.capabilities === void 0 ? { kind: "cookie" } : { kind: "cookie", capabilities: session.capabilities };
         }
-      } else {
-        this.store.delete(key);
+        if (session) sessions.delete(sessionId);
       }
     }
-    try {
-      await atomicWrite(this.filePath, JSON.stringify(obj, null, 2), { mode: 384 });
-      await restrictFilePermissions(this.filePath, { label: "hq-login-attempts" });
-    } catch {
-    }
-  }
-  /** Iterate entries (for cleanup timers). */
-  entries() {
-    return this.store.entries();
   }
-};
-
-// src/hq-server/mailbox-gateway-manager.ts
-import {
-  createMailboxHttpRouter,
-  createProjectMailbox,
-  MAILBOX_HTTP_DEFAULT_MAX_AGE_MS,
-  MailboxEventEmitter,
-  MailboxHttpRateLimiter
-} from "@wrongstack/core/coordination";
-import * as path6 from "node:path";
+  return void 0;
+}
 
 // src/hq-static-serve.ts
 import * as fs2 from "node:fs";
@@ -886,7 +885,12 @@ async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, require
       ...publicOrigin !== void 0 ? { publicOrigin } : {},
       secureCookies: secureCookies === true,
       loggedIn: auth !== void 0 || localOpenMode,
-      authKind: isCookieAuth(auth) ? "password" : isTokenAuth(auth) ? "token" : localOpenMode ? "open" : void 0
+      authKind: isCookieAuth(auth) ? "password" : isTokenAuth(auth) ? "token" : localOpenMode ? "open" : void 0,
+      // What this credential may do, when it is narrower than full access
+      // (absent = unrestricted). The mobile login is deliberately
+      // `control.enqueue`-only; without this the dashboard could not know,
+      // offered Allow/Deny buttons, and every tap came back 403.
+      ...auth?.capabilities !== void 0 ? { capabilities: auth.capabilities } : {}
     })
   );
 }
@@ -2187,6 +2191,12 @@ async function projectDirectoryExists(globalRoot, projectId) {
     return false;
   }
 }
+function warnProjectUnavailable(projectId, reason) {
+  process.stderr.write(
+    `${JSON.stringify({ level: "warn", event: "hq.project_unavailable", projectId, reason })}
+`
+  );
+}
 function resolveHqProjectRoot(globalRoot, ids) {
   const fn = async () => {
     const { getSessionRegistry } = await import("@wrongstack/core/storage");
@@ -2198,7 +2208,13 @@ function resolveHqProjectRoot(globalRoot, ids) {
       }
       if (typeof ids.projectId === "string") {
         const { createHash: createHash2 } = await import("node:crypto");
-        const all = await registry.list().catch(() => []);
+        const probeFailures = [];
+        const all = await registry.list({
+          onProjectFailure: (slug, phase, error) => {
+            const code = error?.code ?? "error";
+            probeFailures.push(`${slug}/${phase}/${code}`);
+          }
+        }).catch(() => []);
         const projectIds = /* @__PURE__ */ new Map();
         const projectIdForRoot = (projectRoot) => {
           const cached = projectIds.get(projectRoot);
@@ -2212,10 +2228,15 @@ function resolveHqProjectRoot(globalRoot, ids) {
         );
         if (match) return { status: "found", projectRoot: match.projectRoot };
         if (await projectDirectoryExists(globalRoot, ids.projectId)) {
+          warnProjectUnavailable(
+            ids.projectId,
+            probeFailures.length > 0 ? `probe-failed ${probeFailures.join(",")}` : "no-live-lease"
+          );
           return { status: "unavailable" };
         }
       }
     } catch {
+      warnProjectUnavailable(String(ids.projectId ?? ids.sessionId ?? "?"), "registry-error");
       return { status: "unavailable" };
     }
     return { status: "unknown" };
@@ -2549,20 +2570,11 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     res.end(JSON.stringify({ error: "unrecognized or malformed command", type: body.type }));
     return;
   }
-  if ((validated.type === "approve" || validated.type === "answer-input") && isCookieAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.approve")) {
-    res.writeHead(403, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: "forbidden: browser session lacks control.approve capability"
-      })
-    );
-    return;
-  }
-  if ((validated.type === "approve" || validated.type === "answer-input") && isTokenAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.approve")) {
+  if ((validated.type === "approve" || validated.type === "answer-input") && (isCookieAuth(auth) || isTokenAuth(auth)) && !credentialMayAnswer(auth.capabilities, validated)) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
       JSON.stringify({
-        error: "forbidden: token lacks control.approve capability"
+        error: isCookieAuth(auth) ? "forbidden: browser session lacks control.approve capability" : "forbidden: token lacks control.approve capability"
       })
     );
     return;
@@ -2610,8 +2622,6 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     return;
   }
   target.commandQueue.push(queued);
-  if (target.commandQueue.length > 200)
-    target.commandQueue.splice(0, target.commandQueue.length - 200);
   const auditEntry = {
     commandId,
     type: validated.type,
@@ -2622,9 +2632,35 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
   };
   auditLog.record(auditEntry);
   broadcastCommandStatus(auditEntry, browsers);
+  trimCommandQueue(target, browsers, auditLog);
   res.writeHead(202, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ commandId, queued: true, clientId: target.clientId }));
 }
+var MAX_QUEUED_COMMANDS_PER_CLIENT = 200;
+function trimCommandQueue(target, browsers, auditLog) {
+  const overflow = target.commandQueue.length - MAX_QUEUED_COMMANDS_PER_CLIENT;
+  if (overflow <= 0) return;
+  const dropped = target.commandQueue.splice(0, overflow);
+  const droppedAt = (/* @__PURE__ */ new Date()).toISOString();
+  for (const command of dropped) {
+    if (auditLog.get(command.commandId)?.status !== "queued") continue;
+    const updated = auditLog.updateForClient(command.commandId, target.clientId, {
+      status: "acked",
+      ackStatus: "failed",
+      ackMessage: "dropped from the queue: the client stopped polling for commands",
+      ackedAt: droppedAt
+    });
+    const entry = updated ? auditLog.get(command.commandId) : void 0;
+    if (entry !== void 0) broadcastCommandStatus(entry, browsers);
+  }
+}
+var ONE_SHOT_DECISIONS = /* @__PURE__ */ new Set(["yes", "no"]);
+function credentialMayAnswer(capabilities, command) {
+  if (capabilities === void 0 || capabilities.includes("control.approve")) return true;
+  if (!capabilities.includes("control.approve.once")) return false;
+  if (command.type === "answer-input") return true;
+  return command.type === "approve" && ONE_SHOT_DECISIONS.has(command.decision);
+}
 
 // src/hq-server/routes/data-handlers.ts
 async function handleApiProjectDetail(_req, res, url, clients) {
@@ -2652,7 +2688,7 @@ async function handleApiProjectDetail(_req, res, url, clients) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify(detail));
 }
-async function handleApiEvents(req, res, persistence) {
+async function handleApiEvents(req, res, persistence, resolveMachineClientIds) {
   const url = new URL(req.url ?? "/", "http://localhost");
   const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
   const limit = Math.min(5e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
@@ -2663,14 +2699,13 @@ async function handleApiEvents(req, res, persistence) {
   const untilMsRaw = url.searchParams.get("until");
   const sinceMs = sinceMsRaw !== null && sinceMsRaw.length > 0 && Number.isFinite(Number(sinceMsRaw)) ? Number(sinceMsRaw) : void 0;
   const untilMs = untilMsRaw !== null && untilMsRaw.length > 0 && Number.isFinite(Number(untilMsRaw)) ? Number(untilMsRaw) : void 0;
-  const events = await persistence.eventLog.recent(limit, typeFilter);
-  const filtered = events.filter((event) => {
-    const payload = event.payload;
-    if (clientIdFilter !== void 0 && payload?.clientId !== clientIdFilter) {
-      return false;
-    }
-    if (machineIdFilter !== void 0 && payload?.machineId !== machineIdFilter) {
-      return false;
+  const clientsOnMachine = machineIdFilter !== void 0 ? resolveMachineClientIds?.(machineIdFilter) ?? /* @__PURE__ */ new Set() : void 0;
+  const matches = (event) => {
+    if (clientIdFilter !== void 0 && event.clientId !== clientIdFilter) return false;
+    if (machineIdFilter !== void 0) {
+      const payload = event.payload;
+      const onMachine = payload?.machineId === machineIdFilter || payload?.client?.machineId === machineIdFilter || event.clientId !== void 0 && clientsOnMachine?.has(event.clientId) === true;
+      if (!onMachine) return false;
     }
     if (sinceMs !== void 0 || untilMs !== void 0) {
       const ts = event.timestamp !== void 0 ? Date.parse(event.timestamp) : Number.NaN;
@@ -2679,7 +2714,13 @@ async function handleApiEvents(req, res, persistence) {
       if (untilMs !== void 0 && ts > untilMs) return false;
     }
     return true;
-  });
+  };
+  const narrowed = clientIdFilter !== void 0 || machineIdFilter !== void 0 || sinceMs !== void 0 || untilMs !== void 0;
+  const filtered = await persistence.eventLog.recent(
+    limit,
+    typeFilter,
+    narrowed ? matches : void 0
+  );
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ events: filtered, total: filtered.length }));
 }
@@ -3109,7 +3150,10 @@ function createHqRouter(deps) {
           secureCookies,
           trustedProxyHops,
           dataDir,
-          url.pathname === "/api/mobile/login" ? ["control.enqueue"] : void 0
+          // Least privilege for the phone: send and steer, plus ONE-SHOT
+          // answers to pending prompts (see `credentialMayAnswer`) — never
+          // persistent approval policy, never account administration.
+          url.pathname === "/api/mobile/login" ? ["control.enqueue", "control.approve.once"] : void 0
         );
         return;
       }
@@ -3252,7 +3296,15 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/events" && req.method === "GET") {
-        await handleApiEvents(req, res, persistence);
+        await handleApiEvents(req, res, persistence, (machineId) => {
+          const ids = /* @__PURE__ */ new Set();
+          for (const client of clients.values()) {
+            if ((client.machineId || client.project.machineId) === machineId) {
+              ids.add(client.clientId);
+            }
+          }
+          return ids;
+        });
         return;
       }
       if (url.pathname === "/api/trends/cost" && req.method === "GET") {
@@ -3724,20 +3776,80 @@ function createHqServerShutdown(params) {
   });
 }
 
+// src/hq-server/socket-credentials.ts
+import { hqTokenKey as hqTokenKey2, isTokenExpired as isTokenExpired4 } from "@wrongstack/core/hq";
+import { WebSocket as WebSocket2 } from "ws";
+function createHqSocketCredentialEnforcer(state) {
+  const closeSessionSockets = (sessionId, reason) => {
+    for (const [browser, boundSessionId] of state.browserSocketSessions) {
+      if (boundSessionId === sessionId && browser.readyState === WebSocket2.OPEN) {
+        browser.close(1008, reason);
+      }
+    }
+  };
+  const closeUnauthorizedClientSockets = () => {
+    const clientAuthRequired = hqClientAuthRequired(state.mutableAuth);
+    for (const [clientSocket, authToken] of state.clientSocketTokens) {
+      const stillAuthorized = authToken === void 0 ? !clientAuthRequired : !isTokenExpired4(authToken) && state.mutableAuth.clientTokenObjs.has(hqTokenKey2(authToken));
+      if (!stillAuthorized) clientSocket.close(1008, "Client authentication revoked");
+    }
+  };
+  return {
+    announceRevokedTokens(keys, ids) {
+      const frame = JSON.stringify({ type: "hq.auth_revoked", revokedTokenKeys: keys });
+      const revokedIds = new Set(ids);
+      for (const ws of state.browsers) {
+        if (ws.readyState !== WebSocket2.OPEN) continue;
+        const sessionId = state.browserSocketSessions.get(ws);
+        if (sessionId !== void 0) {
+          const session = state.sessions.get(sessionId);
+          const affected = session === void 0 || session.kind === "token" && (session.tokenId === void 0 || revokedIds.has(session.tokenId));
+          if (!affected) continue;
+        }
+        ws.send(frame);
+      }
+    },
+    closeUnauthorizedClientSockets,
+    sweepExpiredSocketCredentials(now = Date.now()) {
+      closeUnauthorizedClientSockets();
+      for (const [browser, key] of state.browserSocketTokenKeys ?? []) {
+        const token = state.mutableAuth.browserTokenObjs.get(key);
+        const live = state.mutableAuth.browserTokens.has(key) && token !== void 0 && !isTokenExpired4(token, now);
+        if (!live && browser.readyState === WebSocket2.OPEN) {
+          browser.close(1008, "Browser token expired or revoked");
+        }
+      }
+      const expiredTokenIds = new Set(
+        [...state.mutableAuth.browserTokenObjs.values()].filter((token) => isTokenExpired4(token, now)).map((token) => token.id)
+      );
+      for (const sessionId of new Set(state.sessions.keys())) {
+        const session = state.sessions.get(sessionId);
+        if (session === void 0) continue;
+        const expired = now - session.createdAt >= HQ_SESSION_MAX_AGE_MS || session.kind === "token" && session.tokenId !== void 0 && expiredTokenIds.has(session.tokenId);
+        if (!expired) continue;
+        state.sessions.delete(sessionId);
+        closeSessionSockets(sessionId, "Browser session expired");
+      }
+    },
+    closeSessionSockets
+  };
+}
+
 // src/hq-server/upgrade-handler.ts
-import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3 } from "@wrongstack/core/hq";
+import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3, isTokenExpired as isTokenExpired5 } from "@wrongstack/core/hq";
 
 // src/hq-server/ws.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import {
   HQ_PROTOCOL_VERSION as HQ_PROTOCOL_VERSION2,
+  hqTokenKey as hqTokenKey3,
   parseHqFrame,
   redactHqEvent as redactHqEvent2,
   resolveHqRedactionPolicy,
   tightenHqRedactionPolicy as tightenHqRedactionPolicy2,
   tokenHasCapability as tokenHasCapability3
 } from "@wrongstack/core/hq";
-import { WebSocket as WebSocket2 } from "ws";
+import { WebSocket as WebSocket3 } from "ws";
 
 // src/hq-server/ws-client-events.ts
 import {
@@ -3826,9 +3938,8 @@ function handleIncomingClientEvent(ws, incomingEvent, clients, browsers, auth, s
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         })
       );
-    });
+    }).finally(() => broadcastEvent(event, browsers));
     persistEvent(event);
-    broadcastEvent(event, browsers);
     return;
   }
   if (event.type === "mailbox.snapshot") {
@@ -4276,6 +4387,12 @@ function handleBrowser(ws, snapshotBroadcaster, browsers, eventLog) {
     browsers.delete(ws);
   });
 }
+function undeliveredCommands(client, auditLog) {
+  if (auditLog === void 0) return [...client.commandQueue];
+  return client.commandQueue.filter(
+    (queued) => auditLog.get(queued.commandId)?.status === "queued"
+  );
+}
 function failUndeliveredCommands(lostClient, browsers, auditLog) {
   if (auditLog === void 0 || lostClient.commandQueue.length === 0) return;
   const disconnectedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -4337,16 +4454,29 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
       );
       const declaredRedactionPolicy = resolveHqRedactionPolicy(payload.redactionPolicy);
       const supersededLeaders = [];
+      const inheritedCommands = [];
       let inheritedLeader = false;
       const isSessionSurface = acceptedCapabilities.includes("session.summary");
+      const helloTokenKey = auth.token === void 0 ? void 0 : hqTokenKey3(auth.token);
+      for (const [otherWs, otherClient] of clients) {
+        if (otherWs === ws || otherClient.clientId !== payload.client.clientId) continue;
+        const otherTokenKey = otherClient.authToken === void 0 ? void 0 : hqTokenKey3(otherClient.authToken);
+        if (otherTokenKey !== helloTokenKey && otherWs.readyState === WebSocket3.OPEN) {
+          ws.close(4003, "clientId is held by another credential");
+          return;
+        }
+      }
       for (const [otherWs, otherClient] of clients) {
         const sameClientId = otherClient.clientId === payload.client.clientId;
         const samePublisher = otherClient.projectId === payload.project.projectId && otherClient.kind === payload.client.kind && otherClient.pid !== void 0 && payload.client.pid !== void 0 && otherClient.pid === payload.client.pid && (otherClient.machineId || otherClient.project.machineId) === (payload.client.machineId || payload.project.machineId) && isSessionSurface === otherClient.capabilities.includes("session.summary");
-        if (otherWs !== ws && (sameClientId || samePublisher && otherClient.sessions.size === 0)) {
+        const sameCredential = (otherClient.authToken === void 0 ? void 0 : hqTokenKey3(otherClient.authToken)) === helloTokenKey;
+        if (otherWs !== ws && sameCredential && (sameClientId || samePublisher && otherClient.sessions.size === 0)) {
           if (otherClient.isLeader) {
             if (sameClientId) inheritedLeader = true;
             else supersededLeaders.push(otherClient);
           }
+          if (sameClientId) inheritedCommands.push(...undeliveredCommands(otherClient, auditLog));
+          else failUndeliveredCommands(otherClient, browsers, auditLog);
           clients.delete(otherWs);
           otherWs.close(4001, "superseded by a newer HQ connection");
         }
@@ -4371,7 +4501,7 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
         sessions: /* @__PURE__ */ new Map(),
         fleets: /* @__PURE__ */ new Map(),
         mcpSnapshots: /* @__PURE__ */ new Map(),
-        commandQueue: [],
+        commandQueue: inheritedCommands,
         isLeader: inheritedLeader || computeIsLeader(clients, payload.project.projectId, acceptedCapabilities)
       };
       clients.set(ws, client);
@@ -4439,7 +4569,7 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
         }
         if (toSend.length > 0) {
           const batch = JSON.stringify({ type: "hq.command_batch", commands: toSend });
-          if (ws.readyState === WebSocket2.OPEN) ws.send(batch);
+          if (ws.readyState === WebSocket3.OPEN) ws.send(batch);
           const dispatchedAt = Date.now();
           for (const cmd of toSend) {
             auditLog?.update(cmd.commandId, { status: "delivered", dispatchedAt });
@@ -4565,11 +4695,16 @@ function handleHqUpgrade(req, socket, head, deps) {
         supplied = "";
       }
     }
-    const tokenValid = timingSafeTokenMatch(tokenSet, supplied) !== void 0;
-    const cookieValid = pathname === "/ws/browser" && deps.mutableAuth.cookieSecret !== void 0 && (() => {
+    const matchedTokenKey = timingSafeTokenMatch(tokenSet, supplied);
+    const tokenValid = matchedTokenKey !== void 0;
+    if (tokenValid && pathname === "/ws/browser") {
+      req.hqBrowserTokenKey = matchedTokenKey;
+    }
+    const cookieSecret = deps.mutableAuth.cookieSecret;
+    const cookieValid = pathname === "/ws/browser" && cookieSecret !== void 0 && (() => {
       const raw = readHqSessionCookie(req.headers.cookie);
       if (!raw) return false;
-      const sessionId = parseHqSessionCookie2(raw, deps.mutableAuth.cookieSecret);
+      const sessionId = parseHqSessionCookie2(raw, cookieSecret);
       if (sessionId === void 0) return false;
       const session = deps.sessions.get(sessionId);
       if (!session || Date.now() - session.createdAt >= HQ_SESSION_MAX_AGE_MS)
@@ -4581,7 +4716,7 @@ function handleHqUpgrade(req, socket, head, deps) {
       if (session.pending2fa) return false;
       if (session.kind === "token" && session.tokenId !== void 0) {
         const stillAuthorized = [...deps.mutableAuth.browserTokenObjs.values()].some(
-          (obj) => obj.id === session.tokenId
+          (obj) => obj.id === session.tokenId && !isTokenExpired5(obj)
         );
         if (!stillAuthorized) return false;
       }
@@ -4611,6 +4746,13 @@ function handleHqConnection(ws, req, pathname, deps) {
     if (sessionId !== void 0) {
       deps.browserSocketSessions.set(ws, sessionId);
       ws.once("close", () => deps.browserSocketSessions.delete(ws));
+    } else {
+      const tokenKey = req.hqBrowserTokenKey;
+      const tokenSockets = deps.browserSocketTokenKeys;
+      if (tokenKey !== void 0 && tokenSockets !== void 0) {
+        tokenSockets.set(ws, tokenKey);
+        ws.once("close", () => tokenSockets.delete(ws));
+      }
     }
     handleBrowser(ws, deps.snapshotBroadcaster, deps.browsers, deps.eventLog);
   } else {
@@ -4683,7 +4825,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
   let revokeBrowserSessions;
   const authState = createHqAuthState(authFile, dataDir, {
     onApplied: (live) => reassessExposureFloor(live),
-    onTokensRevoked: (keys) => revokeBrowserSessions?.(keys),
+    onTokensRevoked: (keys, ids) => revokeBrowserSessions?.(keys, ids),
     requireBrowserAuth: options.requireBrowserAuth
   });
   const { mutableAuth } = authState;
@@ -4729,15 +4871,18 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const clients = /* @__PURE__ */ new Map();
     const clientSocketTokens = /* @__PURE__ */ new Map();
     const browserSocketSessions = /* @__PURE__ */ new Map();
+    const browserSocketTokenKeys = /* @__PURE__ */ new Map();
     const browsers = /* @__PURE__ */ new Set();
     const sessions = /* @__PURE__ */ new Map();
-    revokeBrowserSessions = (keys) => {
-      const frame = JSON.stringify({ type: "hq.auth_revoked", revokedTokenKeys: keys });
-      for (const ws of browsers) {
-        if (ws.readyState !== WebSocket3.OPEN) continue;
-        ws.send(frame);
-      }
-    };
+    const socketCredentials = createHqSocketCredentialEnforcer({
+      mutableAuth,
+      sessions,
+      browsers,
+      browserSocketSessions,
+      browserSocketTokenKeys,
+      clientSocketTokens
+    });
+    revokeBrowserSessions = (keys, ids) => socketCredentials.announceRevokedTokens(keys, ids);
     const eventLog = [];
     const transcripts = /* @__PURE__ */ new Map();
     const agentMessages = /* @__PURE__ */ new Map();
@@ -4759,6 +4904,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       for (const [id, session] of sessions) {
         if (session.createdAt < maxAgeCutoff) {
           sessions.delete(id);
+          socketCredentials.closeSessionSockets(id, "Browser session expired");
           continue;
         }
         if (session.pending2fa) {
@@ -4814,7 +4960,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
         const msg = toAlertMessage(alert);
         const data = JSON.stringify(msg);
         for (const ws of browsers) {
-          if (ws.readyState === WebSocket3.OPEN) ws.send(data);
+          if (ws.readyState === WebSocket4.OPEN) ws.send(data);
         }
       },
       onPersist: (alert) => persistence.alertLog.append(alert)
@@ -4853,6 +4999,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const clientTtlMs = options.clientTtlMs ?? CLIENT_TTL_MS;
     const sessionSnapshotTtlMs = options.sessionSnapshotTtlMs ?? SESSION_SNAPSHOT_TTL_MS;
     const cleanupTimer = setInterval(() => {
+      socketCredentials.sweepExpiredSocketCredentials();
       const cutoff = Date.now() - clientTtlMs;
       const sessionCutoff = Date.now() - sessionSnapshotTtlMs;
       let changed = false;
@@ -4861,6 +5008,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
           const lostClient = client;
           ws.terminate();
           clients.delete(ws);
+          failUndeliveredCommands(lostClient, browsers, auditLog);
           detectLeaderLoss(lostClient, clients, browsers, "heartbeat-timeout", {
             eventLog,
             persistence
@@ -4887,7 +5035,8 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
           const lostClient = client;
           ws.terminate();
           clients.delete(ws);
-          detectLeaderLoss(lostClient, clients, browsers, "heartbeat-timeout", {
+          failUndeliveredCommands(lostClient, browsers, auditLog);
+          detectLeaderLoss(lostClient, clients, browsers, "crash", {
             eventLog,
             persistence
           });
@@ -4933,7 +5082,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const closeSocketsOfRemovedSessions = (before) => {
       for (const [browser, sessionId] of browserSocketSessions) {
         if (!before.has(sessionId) || sessions.has(sessionId)) continue;
-        if (browser.readyState === WebSocket3.OPEN) {
+        if (browser.readyState === WebSocket4.OPEN) {
           browser.close(1008, "Browser session revoked");
         }
       }
@@ -4951,7 +5100,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
         serverTime: (/* @__PURE__ */ new Date()).toISOString()
       });
       for (const browser of browsers) {
-        if (browser.readyState === WebSocket3.OPEN) browser.send(heartbeat);
+        if (browser.readyState === WebSocket4.OPEN) browser.send(heartbeat);
       }
     }, options.browserHeartbeatIntervalMs ?? BROWSER_HEARTBEAT_INTERVAL_MS);
     browserHeartbeatTimer.unref?.();
@@ -4967,6 +5116,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       clients,
       clientSocketTokens,
       browserSocketSessions,
+      browserSocketTokenKeys,
       browsers,
       eventLog,
       transcripts,
@@ -5010,11 +5160,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
             }
           }
         }
-        const clientAuthRequired = hqClientAuthRequired(mutableAuth);
-        for (const [clientSocket, authToken] of clientSocketTokens) {
-          const stillAuthorized = authToken === void 0 ? !clientAuthRequired : !isTokenExpired4(authToken) && mutableAuth.clientTokenObjs.has(hqTokenKey2(authToken));
-          if (!stillAuthorized) clientSocket.close(1008, "Client authentication revoked");
-        }
+        socketCredentials.closeUnauthorizedClientSockets();
         if ((options.requireBrowserAuth || mutableAuth.requireAuthFloor) && mutableAuth.browserTokens.size === 0 && mutableAuth.passwordHash === void 0) {
           sessions.clear();
           for (const browser of browsers) browser.close(1008, "Browser authentication removed");
@@ -5070,7 +5216,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
         const hqUrl = `http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${actualPort}`;
         await writeHqRuntimeMarker(dataDir, hqUrl).catch(() => {
         });
-        const browserTokenObj = (firstRunAuth.browserToken !== void 0 ? mutableAuth.browserTokenObjs.get(hqTokenKey2(firstRunAuth.browserToken)) : void 0) ?? mutableAuth.browserTokenObjs.values().next().value;
+        const browserTokenObj = (firstRunAuth.browserToken !== void 0 ? mutableAuth.browserTokenObjs.get(hqTokenKey4(firstRunAuth.browserToken)) : void 0) ?? mutableAuth.browserTokenObjs.values().next().value;
         let browserUrl;
         if (browserTokenObj) {
           const code = bootstrapStore.issue({
@@ -5150,4 +5296,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-OAVBM55Q.js.map
+//# sourceMappingURL=chunk-ENRYW73H.js.map