agent-tower 0.5.4-beta.0 → 0.5.4-beta.1

package/dist/socket/middleware/__tests__/auth.test.js

@@ -1,6 +1,20 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { TunnelService } from '../../../services/tunnel.service.js';
+import { INTERNAL_API_TOKEN_ENV, INTERNAL_API_TOKEN_HEADER, } from '../../../utils/internal-api-token.js';
 import { authMiddleware } from '../auth.js';
+const accessAuthMock = vi.hoisted(() => ({
+    extractCookieFromHeader: vi.fn(() => null),
+    validateSessionTokenWithGeneration: vi.fn(async () => ({ valid: true, generation: 0 })),
+    getSessionSecretGeneration: vi.fn(() => 0),
+}));
+vi.mock('../../../services/access-auth.service.js', () => ({
+    AccessAuthService: {
+        cookieName: 'agent-tower-access',
+        extractCookieFromHeader: accessAuthMock.extractCookieFromHeader,
+        validateSessionTokenWithGeneration: accessAuthMock.validateSessionTokenWithGeneration,
+        getSessionSecretGeneration: accessAuthMock.getSessionSecretGeneration,
+    },
+}));
 function makeSocket({ headers, auth, }) {
     return {
         id: 'socket-12345678',
@@ -15,13 +29,21 @@ function makeSocket({ headers, auth, }) {
 }
 describe('socket authMiddleware', () => {
     beforeEach(() => {
+        delete process.env[INTERNAL_API_TOKEN_ENV];
+        accessAuthMock.extractCookieFromHeader.mockReset();
+        accessAuthMock.validateSessionTokenWithGeneration.mockReset();
+        accessAuthMock.getSessionSecretGeneration.mockReset();
         vi.spyOn(TunnelService, 'isRunning').mockReturnValue(true);
         vi.spyOn(TunnelService, 'validateToken').mockImplementation((token) => token === 'good-token');
+        accessAuthMock.extractCookieFromHeader.mockReturnValue(null);
+        accessAuthMock.validateSessionTokenWithGeneration.mockResolvedValue({ valid: true, generation: 0 });
+        accessAuthMock.getSessionSecretGeneration.mockReturnValue(0);
     });
     afterEach(() => {
+        delete process.env[INTERNAL_API_TOKEN_ENV];
         vi.restoreAllMocks();
     });
-    it('accepts tunnel websocket connections with a valid tunnel session cookie', () => {
+    it('accepts tunnel websocket connections with a valid tunnel session cookie', async () => {
         const socket = makeSocket({
             headers: {
                 'cf-ray': 'abc123',
@@ -30,10 +52,12 @@ describe('socket authMiddleware', () => {
         });
         const next = vi.fn();
         authMiddleware(socket, next);
+        await vi.waitFor(() => expect(next).toHaveBeenCalled());
         expect(next).toHaveBeenCalledWith();
         expect(socket.userId).toBe('good-token');
+        expect(socket.accessAuthSessionSecretGeneration).toBe(0);
     });
-    it('rejects tunnel websocket connections that only send auth.token', () => {
+    it('rejects tunnel websocket connections that only send auth.token', async () => {
         const socket = makeSocket({
             headers: {
                 'cf-ray': 'abc123',
@@ -44,7 +68,83 @@ describe('socket authMiddleware', () => {
         });
         const next = vi.fn();
         authMiddleware(socket, next);
+        await vi.waitFor(() => expect(next).toHaveBeenCalled());
         expect(next.mock.calls[0][0]).toBeInstanceOf(Error);
     });
+    it('rejects websocket connections without an access auth session when enabled', async () => {
+        accessAuthMock.validateSessionTokenWithGeneration.mockResolvedValueOnce({ valid: false, generation: 0 });
+        const socket = makeSocket({
+            headers: {},
+        });
+        const next = vi.fn();
+        authMiddleware(socket, next);
+        await vi.waitFor(() => expect(next).toHaveBeenCalled());
+        expect(next.mock.calls[0][0]).toBeInstanceOf(Error);
+        expect(String(next.mock.calls[0][0].message)).toContain('access password');
+    });
+    it('accepts websocket connections with a valid internal token', async () => {
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        accessAuthMock.getSessionSecretGeneration.mockReturnValueOnce(3);
+        accessAuthMock.validateSessionTokenWithGeneration.mockResolvedValueOnce({ valid: false, generation: 0 });
+        const socket = makeSocket({
+            headers: {
+                [INTERNAL_API_TOKEN_HEADER]: 'expected-internal-token',
+            },
+        });
+        const next = vi.fn();
+        authMiddleware(socket, next);
+        await vi.waitFor(() => expect(next).toHaveBeenCalled());
+        expect(next).toHaveBeenCalledWith();
+        expect(accessAuthMock.validateSessionTokenWithGeneration).not.toHaveBeenCalled();
+        expect(socket.accessAuthSessionSecretGeneration).toBe(3);
+    });
+    it('rejects invalid internal token even when an access auth session cookie is valid', async () => {
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        accessAuthMock.extractCookieFromHeader.mockReturnValueOnce('valid-access-token');
+        accessAuthMock.validateSessionTokenWithGeneration.mockResolvedValueOnce({ valid: true, generation: 2 });
+        const socket = makeSocket({
+            headers: {
+                [INTERNAL_API_TOKEN_HEADER]: 'wrong-internal-token',
+                cookie: 'agent-tower-access=valid-access-token',
+            },
+        });
+        const next = vi.fn();
+        authMiddleware(socket, next);
+        await vi.waitFor(() => expect(next).toHaveBeenCalled());
+        expect(next.mock.calls[0][0]).toBeInstanceOf(Error);
+        expect(String(next.mock.calls[0][0].message)).toContain('invalid internal token');
+        expect(accessAuthMock.validateSessionTokenWithGeneration).not.toHaveBeenCalled();
+        expect(socket.accessAuthSessionSecretGeneration).toBeUndefined();
+    });
+    it('uses access auth session cookie when internal token is missing', async () => {
+        accessAuthMock.extractCookieFromHeader.mockReturnValueOnce('valid-access-token');
+        accessAuthMock.validateSessionTokenWithGeneration.mockResolvedValueOnce({ valid: true, generation: 2 });
+        const socket = makeSocket({
+            headers: {
+                cookie: 'agent-tower-access=valid-access-token',
+            },
+        });
+        const next = vi.fn();
+        authMiddleware(socket, next);
+        await vi.waitFor(() => expect(next).toHaveBeenCalled());
+        expect(next).toHaveBeenCalledWith();
+        expect(accessAuthMock.validateSessionTokenWithGeneration).toHaveBeenCalledWith('valid-access-token');
+        expect(socket.accessAuthSessionSecretGeneration).toBe(2);
+    });
+    it('rejects websocket connections when access auth generation changes during validation', async () => {
+        accessAuthMock.extractCookieFromHeader.mockReturnValueOnce('old-token');
+        accessAuthMock.validateSessionTokenWithGeneration.mockResolvedValueOnce({ valid: false, generation: 1 });
+        const socket = makeSocket({
+            headers: {
+                cookie: 'agent-tower-access=old-token',
+            },
+        });
+        const next = vi.fn();
+        authMiddleware(socket, next);
+        await vi.waitFor(() => expect(next).toHaveBeenCalled());
+        expect(accessAuthMock.validateSessionTokenWithGeneration).toHaveBeenCalledWith('old-token');
+        expect(next.mock.calls[0][0]).toBeInstanceOf(Error);
+        expect(socket.accessAuthSessionSecretGeneration).toBeUndefined();
+    });
 });
 //# sourceMappingURL=auth.test.js.map

package/dist/socket/middleware/__tests__/auth.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../../../src/socket/middleware/__tests__/auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,cAAc,EAA4B,MAAM,YAAY,CAAC;AAEtE,SAAS,UAAU,CAAC,EAClB,OAAO,EACP,IAAI,GAIL;IACC,OAAO;QACL,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,IAAI,EAAE;SACvB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,KAAK,EAAE,EAAE;SACV;KACqB,CAAC;AAC3B,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC3D,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,sCAAsC;aAC/C;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE7B,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;aACnB;YACD,IAAI,EAAE;gBACJ,KAAK,EAAE,YAAY;aACpB;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../../../src/socket/middleware/__tests__/auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,cAAc,EAA4B,MAAM,YAAY,CAAC;AAEtE,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACvC,uBAAuB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAqB,CAAC;IAC3D,kCAAkC,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,0BAA0B,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CAC3C,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,iBAAiB,EAAE;QACjB,UAAU,EAAE,oBAAoB;QAChC,uBAAuB,EAAE,cAAc,CAAC,uBAAuB;QAC/D,kCAAkC,EAAE,cAAc,CAAC,kCAAkC;QACrF,0BAA0B,EAAE,cAAc,CAAC,0BAA0B;KACtE;CACF,CAAC,CAAC,CAAC;AAEJ,SAAS,UAAU,CAAC,EAClB,OAAO,EACP,IAAI,GAIL;IACC,OAAO;QACL,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,IAAI,EAAE;SACvB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,KAAK,EAAE,EAAE;SACV;KACqB,CAAC;AAC3B,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC3C,cAAc,CAAC,uBAAuB,CAAC,SAAS,EAAE,CAAC;QACnD,cAAc,CAAC,kCAAkC,CAAC,SAAS,EAAE,CAAC;QAC9D,cAAc,CAAC,0BAA0B,CAAC,SAAS,EAAE,CAAC;QACtD,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC3D,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QAC/F,cAAc,CAAC,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7D,cAAc,CAAC,kCAAkC,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,cAAc,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC3C,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,sCAAsC;aAC/C;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ;aACnB;YACD,IAAI,EAAE;gBACJ,KAAK,EAAE,YAAY;aACpB;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,cAAc,CAAC,kCAAkC,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,cAAc,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACjE,cAAc,CAAC,kCAAkC,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE;gBACP,CAAC,yBAAyB,CAAC,EAAE,yBAAyB;aACvD;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjF,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,cAAc,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QACjF,cAAc,CAAC,kCAAkC,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE;gBACP,CAAC,yBAAyB,CAAC,EAAE,sBAAsB;gBACnD,MAAM,EAAE,uCAAuC;aAChD;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAClF,MAAM,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjF,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,cAAc,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QACjF,cAAc,CAAC,kCAAkC,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE;gBACP,MAAM,EAAE,uCAAuC;aAChD;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;QACrG,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,cAAc,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACxE,cAAc,CAAC,kCAAkC,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE;gBACP,MAAM,EAAE,8BAA8B;aACvC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACrB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/socket/middleware/auth.d.ts

@@ -3,6 +3,7 @@ type NextFunction = (err?: Error) => void;
 export interface AuthenticatedSocket extends Socket {
     userId?: string;
     username?: string;
+    accessAuthSessionSecretGeneration?: number;
 }
 /**
  * Socket 认证中间件

package/dist/socket/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/socket/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAIvC,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,CAAA;AAEzC,MAAM,WAAW,mBAAoB,SAAQ,MAAM;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,YAAY,QAuBnB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/socket/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AASvC,KAAK,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,CAAA;AAEzC,MAAM,WAAW,mBAAoB,SAAQ,MAAM;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iCAAiC,CAAC,EAAE,MAAM,CAAA;CAC3C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,YAAY,QAGnB"}

package/dist/socket/middleware/auth.js

@@ -1,19 +1,39 @@
 import { TunnelService } from '../../services/tunnel.service.js';
 import { extractTunnelSessionTokenFromCookieHeader } from '../../utils/tunnel-cookie.js';
+import { AccessAuthService } from '../../services/access-auth.service.js';
+import { INTERNAL_API_TOKEN_HEADER, validateInternalApiToken, } from '../../utils/internal-api-token.js';
 /**
  * Socket 认证中间件
  * 隧道请求（带 CF 头）必须携带有效 token，本地请求放行
  */
 export function authMiddleware(socket, next) {
-    // 检查是否为隧道请求
+    void authenticateSocket(socket, next);
+}
+async function authenticateSocket(socket, next) {
     const headers = socket.request.headers;
     const isTunnel = !!(headers['cf-connecting-ip'] || headers['cf-ray']);
-    const cookieToken = extractTunnelSessionTokenFromCookieHeader(socket.request.headers.cookie);
+    const cookieToken = extractTunnelSessionTokenFromCookieHeader(headers.cookie);
     if (isTunnel && TunnelService.isRunning()) {
         if (!cookieToken || !TunnelService.validateToken(cookieToken)) {
             return next(new Error('Unauthorized: valid tunnel session cookie required'));
         }
     }
+    const internalToken = headers[INTERNAL_API_TOKEN_HEADER];
+    const normalizedInternalToken = Array.isArray(internalToken) ? internalToken[0] : internalToken;
+    if (internalToken !== undefined) {
+        if (!validateInternalApiToken(normalizedInternalToken)) {
+            return next(new Error('Unauthorized: invalid internal token'));
+        }
+        socket.accessAuthSessionSecretGeneration = AccessAuthService.getSessionSecretGeneration();
+    }
+    else {
+        const accessToken = AccessAuthService.extractCookieFromHeader(headers.cookie);
+        const accessAuthResult = await AccessAuthService.validateSessionTokenWithGeneration(accessToken);
+        if (!accessAuthResult.valid) {
+            return next(new Error('Unauthorized: access password required'));
+        }
+        socket.accessAuthSessionSecretGeneration = accessAuthResult.generation;
+    }
     // 设置用户标识
     if (cookieToken) {
         socket.userId = cookieToken;

package/dist/socket/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/socket/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAChE,OAAO,EAAE,yCAAyC,EAAE,MAAM,8BAA8B,CAAA;AASxF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA2B,EAC3B,IAAkB;IAElB,YAAY;IACZ,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAA;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrE,MAAM,WAAW,GAAG,yCAAyC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAE5F,IAAI,QAAQ,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED,SAAS;IACT,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,MAAM,GAAG,WAAW,CAAA;QAC3B,MAAM,CAAC,QAAQ,GAAG,QAAQ,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,MAAM,GAAG,aAAa,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;QACpD,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAA;IAC/B,CAAC;IAED,IAAI,EAAE,CAAA;AACR,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/socket/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAChE,OAAO,EAAE,yCAAyC,EAAE,MAAM,8BAA8B,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mCAAmC,CAAA;AAU1C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA2B,EAC3B,IAAkB;IAElB,KAAK,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAA2B,EAC3B,IAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAA;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrE,MAAM,WAAW,GAAG,yCAAyC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAE7E,IAAI,QAAQ,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACxD,MAAM,uBAAuB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IAC/F,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,CAAC,iCAAiC,GAAG,iBAAiB,CAAC,0BAA0B,EAAE,CAAA;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7E,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC,kCAAkC,CAAC,WAAW,CAAC,CAAA;QAChG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,CAAC,iCAAiC,GAAG,gBAAgB,CAAC,UAAU,CAAA;IACxE,CAAC;IAED,SAAS;IACT,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,MAAM,GAAG,WAAW,CAAA;QAC3B,MAAM,CAAC,QAAQ,GAAG,QAAQ,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,MAAM,GAAG,aAAa,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;QACpD,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAA;IAC/B,CAAC;IAED,IAAI,EAAE,CAAA;AACR,CAAC"}

package/dist/socket/socket-gateway.d.ts

@@ -1,7 +1,8 @@
-import type { Namespace, Socket } from 'socket.io';
+import type { Namespace } from 'socket.io';
 import type { EventBus } from '../core/event-bus.js';
 import type { SessionManager } from '../services/session-manager.js';
 import type { TerminalManager } from '../services/terminal-manager.js';
+import type { AuthenticatedSocket } from './middleware/index.js';
 export declare class SocketGateway {
     private readonly nsp;
     private readonly eventBus;
@@ -10,8 +11,11 @@ export declare class SocketGateway {
     private cleanups;
     constructor(nsp: Namespace, eventBus: EventBus, sessionManager: SessionManager, terminalManager: TerminalManager);
     destroy(): void;
-    register(socket: Socket): void;
+    register(socket: AuthenticatedSocket): void;
     private registerEventBusForwarders;
+    private isSocketAuthCurrent;
+    private ensureSocketAuthIsCurrent;
+    private disconnectStaleSockets;
     private handleSubscribe;
     private handleUnsubscribe;
 }

package/dist/socket/socket-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"socket-gateway.d.ts","sourceRoot":"","sources":["../../src/socket/socket-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAevE,qBAAa,aAAa;IAItB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe;IANlC,OAAO,CAAC,QAAQ,CAAyB;gBAGtB,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,cAAc,EAC9B,eAAe,EAAE,eAAe;IAKnD,OAAO,IAAI,IAAI;IAOf,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAsD9B,OAAO,CAAC,0BAA0B;IA2GlC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;CAO1B"}
+{"version":3,"file":"socket-gateway.d.ts","sourceRoot":"","sources":["../../src/socket/socket-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAU,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAejE,qBAAa,aAAa;IAItB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe;IANlC,OAAO,CAAC,QAAQ,CAAyB;gBAGtB,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,cAAc,EAC9B,eAAe,EAAE,eAAe;IAKnD,OAAO,IAAI,IAAI;IAOf,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI;IA4D3C,OAAO,CAAC,0BAA0B;IAuIlC,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,yBAAyB;IAiBjC,OAAO,CAAC,sBAAsB;IAQ9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;CAO1B"}

package/dist/socket/socket-gateway.js

@@ -1,3 +1,4 @@
+import { AccessAuthService } from '../services/access-auth.service.js';
 import { ClientEvents, ServerEvents, } from './events.js';
 export class SocketGateway {
     nsp;
@@ -21,13 +22,19 @@ export class SocketGateway {
     register(socket) {
         // --- Subscribe / Unsubscribe ---
         socket.on(ClientEvents.SUBSCRIBE, (payload, ack) => {
+            if (!this.ensureSocketAuthIsCurrent(socket, ack))
+                return;
             this.handleSubscribe(socket, payload, ack);
         });
         socket.on(ClientEvents.UNSUBSCRIBE, (payload, ack) => {
+            if (!this.ensureSocketAuthIsCurrent(socket, ack))
+                return;
             this.handleUnsubscribe(socket, payload, ack);
         });
         // --- Agent session I/O ---
         socket.on(ClientEvents.INPUT, (payload) => {
+            if (!this.ensureSocketAuthIsCurrent(socket))
+                return;
             if (!payload?.sessionId || typeof payload.data !== 'string')
                 return;
             try {
@@ -38,6 +45,8 @@ export class SocketGateway {
             }
         });
         socket.on(ClientEvents.RESIZE, (payload) => {
+            if (!this.ensureSocketAuthIsCurrent(socket))
+                return;
             if (!payload?.sessionId || typeof payload.cols !== 'number' || typeof payload.rows !== 'number')
                 return;
             try {
@@ -49,6 +58,8 @@ export class SocketGateway {
         });
         // --- Standalone terminal I/O ---
         socket.on(ClientEvents.TERMINAL_INPUT, (payload) => {
+            if (!this.ensureSocketAuthIsCurrent(socket))
+                return;
             if (!payload?.terminalId || typeof payload.data !== 'string')
                 return;
             try {
@@ -59,6 +70,8 @@ export class SocketGateway {
             }
         });
         socket.on(ClientEvents.TERMINAL_RESIZE, (payload) => {
+            if (!this.ensureSocketAuthIsCurrent(socket))
+                return;
             if (!payload?.terminalId || typeof payload.cols !== 'number' || typeof payload.rows !== 'number')
                 return;
             try {
@@ -74,56 +87,82 @@ export class SocketGateway {
         });
     }
     registerEventBusForwarders() {
+        const emitToCurrentSockets = (event, payload) => {
+            for (const socket of this.nsp.sockets.values()) {
+                if (this.isSocketAuthCurrent(socket)) {
+                    socket.emit(event, payload);
+                }
+                else {
+                    socket.disconnect(true);
+                }
+            }
+        };
+        const emitToCurrentTerminalRoom = (terminalId, event, payload) => {
+            for (const socketId of this.nsp.adapter.rooms.get(`terminal:${terminalId}`) ?? []) {
+                const socket = this.nsp.sockets.get(socketId);
+                if (!socket)
+                    continue;
+                if (this.isSocketAuthCurrent(socket)) {
+                    socket.emit(event, payload);
+                }
+                else {
+                    socket.disconnect(true);
+                }
+            }
+        };
         // --- Session events: broadcast to entire namespace (no room filtering) ---
         const onStdout = ({ sessionId, data }) => {
-            this.nsp.emit(ServerEvents.SESSION_STDOUT, { sessionId, data });
+            emitToCurrentSockets(ServerEvents.SESSION_STDOUT, { sessionId, data });
         };
         const onPatch = ({ sessionId, patch, seq }) => {
-            this.nsp.emit(ServerEvents.SESSION_PATCH, { sessionId, patch, seq });
+            emitToCurrentSockets(ServerEvents.SESSION_PATCH, { sessionId, patch, seq });
         };
         const onSessionId = ({ sessionId, agentSessionId }) => {
-            this.nsp.emit(ServerEvents.SESSION_ID, { sessionId, agentSessionId });
+            emitToCurrentSockets(ServerEvents.SESSION_ID, { sessionId, agentSessionId });
         };
         const onExit = ({ sessionId, exitCode }) => {
-            this.nsp.emit(ServerEvents.SESSION_EXIT, {
+            emitToCurrentSockets(ServerEvents.SESSION_EXIT, {
                 sessionId,
                 exitCode: typeof exitCode === 'number' ? exitCode : 0,
             });
         };
         const onSessionCompleted = ({ sessionId, status }) => {
-            this.nsp.emit(ServerEvents.SESSION_COMPLETED, { sessionId, status });
+            emitToCurrentSockets(ServerEvents.SESSION_COMPLETED, { sessionId, status });
         };
         const onTask = ({ taskId, projectId, status }) => {
-            this.nsp.emit(ServerEvents.TASK_UPDATED, { taskId, projectId, status });
+            emitToCurrentSockets(ServerEvents.TASK_UPDATED, { taskId, projectId, status });
         };
         const onTaskDeleted = ({ taskId, projectId }) => {
-            this.nsp.emit(ServerEvents.TASK_DELETED, { taskId, projectId });
+            emitToCurrentSockets(ServerEvents.TASK_DELETED, { taskId, projectId });
         };
         const onWorkspaceCommitMessageUpdated = (payload) => {
-            this.nsp.emit(ServerEvents.WORKSPACE_COMMIT_MESSAGE_UPDATED, payload);
+            emitToCurrentSockets(ServerEvents.WORKSPACE_COMMIT_MESSAGE_UPDATED, payload);
         };
         // --- Terminal events: keep room-based dispatch (lifecycle tied to socket) ---
         const onTerminalStdout = ({ terminalId, data }) => {
-            this.nsp.to(`terminal:${terminalId}`).emit(ServerEvents.TERMINAL_STDOUT, { terminalId, data });
+            emitToCurrentTerminalRoom(terminalId, ServerEvents.TERMINAL_STDOUT, { terminalId, data });
         };
         const onTerminalExit = ({ terminalId, exitCode }) => {
-            this.nsp.to(`terminal:${terminalId}`).emit(ServerEvents.TERMINAL_EXIT, {
+            emitToCurrentTerminalRoom(terminalId, ServerEvents.TERMINAL_EXIT, {
                 terminalId,
                 exitCode: typeof exitCode === 'number' ? exitCode : 0,
             });
         };
         // --- Workspace events: broadcast to entire namespace ---
         const onWorkspaceSetupProgress = (payload) => {
-            this.nsp.emit(ServerEvents.WORKSPACE_SETUP_PROGRESS, payload);
+            emitToCurrentSockets(ServerEvents.WORKSPACE_SETUP_PROGRESS, payload);
         };
         const onWorkspaceHibernated = (payload) => {
-            this.nsp.emit(ServerEvents.WORKSPACE_HIBERNATED, payload);
+            emitToCurrentSockets(ServerEvents.WORKSPACE_HIBERNATED, payload);
         };
         const onWorkspaceGitChanged = (payload) => {
-            this.nsp.emit(ServerEvents.WORKSPACE_GIT_CHANGED, payload);
+            emitToCurrentSockets(ServerEvents.WORKSPACE_GIT_CHANGED, payload);
         };
         const onTeamRunInvalidated = (payload) => {
-            this.nsp.emit(ServerEvents.TEAM_RUN_INVALIDATED, payload);
+            emitToCurrentSockets(ServerEvents.TEAM_RUN_INVALIDATED, payload);
+        };
+        const onAccessAuthSessionSecretRotated = () => {
+            this.disconnectStaleSockets();
         };
         this.eventBus.on('session:stdout', onStdout);
         this.eventBus.on('session:patch', onPatch);
@@ -139,7 +178,31 @@ export class SocketGateway {
         this.eventBus.on('workspace:hibernated', onWorkspaceHibernated);
         this.eventBus.on('workspace:git_changed', onWorkspaceGitChanged);
         this.eventBus.on('team-run:invalidated', onTeamRunInvalidated);
-        this.cleanups.push(() => this.eventBus.off('session:stdout', onStdout), () => this.eventBus.off('session:patch', onPatch), () => this.eventBus.off('session:sessionId', onSessionId), () => this.eventBus.off('session:exit', onExit), () => this.eventBus.off('session:completed', onSessionCompleted), () => this.eventBus.off('task:updated', onTask), () => this.eventBus.off('task:deleted', onTaskDeleted), () => this.eventBus.off('workspace:commit_message_updated', onWorkspaceCommitMessageUpdated), () => this.eventBus.off('terminal:stdout', onTerminalStdout), () => this.eventBus.off('terminal:exit', onTerminalExit), () => this.eventBus.off('workspace:setup_progress', onWorkspaceSetupProgress), () => this.eventBus.off('workspace:hibernated', onWorkspaceHibernated), () => this.eventBus.off('workspace:git_changed', onWorkspaceGitChanged), () => this.eventBus.off('team-run:invalidated', onTeamRunInvalidated));
+        this.eventBus.on('access-auth:session-secret-rotated', onAccessAuthSessionSecretRotated);
+        this.cleanups.push(() => this.eventBus.off('session:stdout', onStdout), () => this.eventBus.off('session:patch', onPatch), () => this.eventBus.off('session:sessionId', onSessionId), () => this.eventBus.off('session:exit', onExit), () => this.eventBus.off('session:completed', onSessionCompleted), () => this.eventBus.off('task:updated', onTask), () => this.eventBus.off('task:deleted', onTaskDeleted), () => this.eventBus.off('workspace:commit_message_updated', onWorkspaceCommitMessageUpdated), () => this.eventBus.off('terminal:stdout', onTerminalStdout), () => this.eventBus.off('terminal:exit', onTerminalExit), () => this.eventBus.off('workspace:setup_progress', onWorkspaceSetupProgress), () => this.eventBus.off('workspace:hibernated', onWorkspaceHibernated), () => this.eventBus.off('workspace:git_changed', onWorkspaceGitChanged), () => this.eventBus.off('team-run:invalidated', onTeamRunInvalidated), () => this.eventBus.off('access-auth:session-secret-rotated', onAccessAuthSessionSecretRotated));
+    }
+    isSocketAuthCurrent(socket) {
+        return socket.accessAuthSessionSecretGeneration === AccessAuthService.getSessionSecretGeneration();
+    }
+    ensureSocketAuthIsCurrent(socket, ack) {
+        if (this.isSocketAuthCurrent(socket))
+            return true;
+        ack?.({
+            success: false,
+            error: {
+                code: 'ACCESS_AUTH_STALE_SESSION',
+                message: 'Socket authentication is no longer current',
+            },
+        });
+        socket.disconnect(true);
+        return false;
+    }
+    disconnectStaleSockets() {
+        for (const socket of this.nsp.sockets.values()) {
+            if (!this.isSocketAuthCurrent(socket)) {
+                socket.disconnect(true);
+            }
+        }
     }
     handleSubscribe(socket, payload, ack) {
         if (payload.topic === 'terminal' && payload.id) {

package/dist/socket/socket-gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"socket-gateway.js","sourceRoot":"","sources":["../../src/socket/socket-gateway.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,YAAY,EACZ,YAAY,GAUb,MAAM,aAAa,CAAC;AAErB,MAAM,OAAO,aAAa;IAIL;IACA;IACA;IACA;IANX,QAAQ,GAAsB,EAAE,CAAC;IAEzC,YACmB,GAAc,EACd,QAAkB,EAClB,cAA8B,EAC9B,eAAgC;QAHhC,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAU;QAClB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,oBAAe,GAAf,eAAe,CAAiB;QAEjD,IAAI,CAAC,0BAA0B,EAAE,CAAC;IACpC,CAAC;IAED,OAAO;QACL,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,kCAAkC;QAClC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,OAAyB,EAAE,GAAgC,EAAE,EAAE;YAChG,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,OAA2B,EAAE,GAAgC,EAAE,EAAE;YACpG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,OAA4B,EAAE,EAAE;YAC7D,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpE,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;YACtF,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAA6B,EAAE,EAAE;YAC/D,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACxG,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;YACvF,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,kCAAkC;QAClC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,OAA6B,EAAE,EAAE;YACvE,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACrE,IAAI,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,qDAAqD,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,OAA8B,EAAE,EAAE;YACzE,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACzG,IAAI,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,sDAAsD,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;YAClG,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B;QAChC,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAuC,EAAE,EAAE;YAC5E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAwD,EAAE,EAAE;YAClG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,EAAE,SAAS,EAAE,cAAc,EAAiD,EAAE,EAAE;YACnG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAA4C,EAAE,EAAE;YACnF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;gBACvC,SAAS;gBACT,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACtD,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,kBAAkB,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAyC,EAAE,EAAE;YAC1F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAyD,EAAE,EAAE;YACtG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAyC,EAAE,EAAE;YACrF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC;QACF,MAAM,+BAA+B,GAAG,CAAC,OAIxC,EAAE,EAAE;YACH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC,CAAC;QAEF,+EAA+E;QAC/E,MAAM,gBAAgB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAwC,EAAE,EAAE;YACtF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC,CAAC;QACF,MAAM,cAAc,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,EAA6C,EAAE,EAAE;YAC7F,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;gBACrE,UAAU;gBACV,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACtD,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,0DAA0D;QAC1D,MAAM,wBAAwB,GAAG,CAAC,OAQjC,EAAE,EAAE;YACH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC,CAAC;QAEF,MAAM,qBAAqB,GAAG,CAAC,OAI9B,EAAE,EAAE;YACH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC,CAAC;QAEF,MAAM,qBAAqB,GAAG,CAAC,OAAmC,EAAE,EAAE;YACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC,CAAC;QAEF,MAAM,oBAAoB,GAAG,CAAC,OAAkC,EAAE,EAAE;YAClE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,kCAAkC,EAAE,+BAA+B,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;QAE/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EACnD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,EACjD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,EACzD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,EAC/C,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EAChE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,EAC/C,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,EACtD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,kCAAkC,EAAE,+BAA+B,CAAC,EAC5F,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAC5D,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,EACxD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,EAC7E,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,EACtE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,EACvE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CACtE,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,MAAc,EAAE,OAAyB,EAAE,GAAgC;QACjG,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;IAEO,iBAAiB,CAAC,MAAc,EAAE,OAA2B,EAAE,GAAgC;QACrG,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"socket-gateway.js","sourceRoot":"","sources":["../../src/socket/socket-gateway.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EACL,YAAY,EACZ,YAAY,GAUb,MAAM,aAAa,CAAC;AAErB,MAAM,OAAO,aAAa;IAIL;IACA;IACA;IACA;IANX,QAAQ,GAAsB,EAAE,CAAC;IAEzC,YACmB,GAAc,EACd,QAAkB,EAClB,cAA8B,EAC9B,eAAgC;QAHhC,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAU;QAClB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,oBAAe,GAAf,eAAe,CAAiB;QAEjD,IAAI,CAAC,0BAA0B,EAAE,CAAC;IACpC,CAAC;IAED,OAAO;QACL,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,MAA2B;QAClC,kCAAkC;QAClC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,OAAyB,EAAE,GAAgC,EAAE,EAAE;YAChG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO;YACzD,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,OAA2B,EAAE,GAAgC,EAAE,EAAE;YACpG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO;YACzD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,OAA4B,EAAE,EAAE;YAC7D,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBAAE,OAAO;YACpD,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpE,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;YACtF,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAA6B,EAAE,EAAE;YAC/D,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBAAE,OAAO;YACpD,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACxG,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;YACvF,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,kCAAkC;QAClC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,OAA6B,EAAE,EAAE;YACvE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBAAE,OAAO;YACpD,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACrE,IAAI,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,qDAAqD,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,OAA8B,EAAE,EAAE;YACzE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBAAE,OAAO;YACpD,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACzG,IAAI,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,sDAAsD,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;YAClG,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B;QAChC,MAAM,oBAAoB,GAAG,CAAC,KAAa,EAAE,OAAgB,EAAE,EAAE;YAC/D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/C,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAA6B,CAAC,EAAE,CAAC;oBAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,yBAAyB,GAAG,CAAC,UAAkB,EAAE,KAAa,EAAE,OAAgB,EAAE,EAAE;YACxF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAA6B,CAAC,EAAE,CAAC;oBAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAuC,EAAE,EAAE;YAC5E,oBAAoB,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAwD,EAAE,EAAE;YAClG,oBAAoB,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,EAAE,SAAS,EAAE,cAAc,EAAiD,EAAE,EAAE;YACnG,oBAAoB,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAA4C,EAAE,EAAE;YACnF,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE;gBAC9C,SAAS;gBACT,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACtD,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,kBAAkB,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAyC,EAAE,EAAE;YAC1F,oBAAoB,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAyD,EAAE,EAAE;YACtG,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAyC,EAAE,EAAE;YACrF,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC;QACF,MAAM,+BAA+B,GAAG,CAAC,OAIxC,EAAE,EAAE;YACH,oBAAoB,CAAC,YAAY,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC,CAAC;QAEF,+EAA+E;QAC/E,MAAM,gBAAgB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAwC,EAAE,EAAE;YACtF,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,MAAM,cAAc,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,EAA6C,EAAE,EAAE;YAC7F,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,aAAa,EAAE;gBAChE,UAAU;gBACV,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACtD,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,0DAA0D;QAC1D,MAAM,wBAAwB,GAAG,CAAC,OAQjC,EAAE,EAAE;YACH,oBAAoB,CAAC,YAAY,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC,CAAC;QAEF,MAAM,qBAAqB,GAAG,CAAC,OAI9B,EAAE,EAAE;YACH,oBAAoB,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC,CAAC;QAEF,MAAM,qBAAqB,GAAG,CAAC,OAAmC,EAAE,EAAE;YACpE,oBAAoB,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,MAAM,oBAAoB,GAAG,CAAC,OAAkC,EAAE,EAAE;YAClE,oBAAoB,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC,CAAC;QAEF,MAAM,gCAAgC,GAAG,GAAG,EAAE;YAC5C,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,CAAC,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,kCAAkC,EAAE,+BAA+B,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,oCAAoC,EAAE,gCAAgC,CAAC,CAAC;QAEzF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EACnD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,EACjD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,EACzD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,EAC/C,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EAChE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,EAC/C,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,EACtD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,kCAAkC,EAAE,+BAA+B,CAAC,EAC5F,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAC5D,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,EACxD,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,EAC7E,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,EACtE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,EACvE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,EACrE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,oCAAoC,EAAE,gCAAgC,CAAC,CAChG,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,MAA2B;QACrD,OAAO,MAAM,CAAC,iCAAiC,KAAK,iBAAiB,CAAC,0BAA0B,EAAE,CAAC;IACrG,CAAC;IAEO,yBAAyB,CAC/B,MAA2B,EAC3B,GAAgC;QAEhC,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAElD,GAAG,EAAE,CAAC;YACJ,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,4CAA4C;aACtD;SACF,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,sBAAsB;QAC5B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAA6B,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,MAAc,EAAE,OAAyB,EAAE,GAAgC;QACjG,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;IAEO,iBAAiB,CAAC,MAAc,EAAE,OAA2B,EAAE,GAAgC;QACrG,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF"}

package/dist/utils/internal-api-token.d.ts

@@ -0,0 +1,9 @@
+export declare const INTERNAL_API_TOKEN_HEADER = "x-agent-tower-internal-token";
+export declare const INTERNAL_API_TOKEN_ENV = "AGENT_TOWER_INTERNAL_TOKEN";
+export declare function getInternalApiTokenPath(dataDir?: string): string;
+export declare function readInternalApiToken(dataDir?: string): string | null;
+export declare function readInternalApiTokenFromEnv(env?: NodeJS.ProcessEnv): string | null;
+export declare function requireInternalApiTokenFromEnv(env?: NodeJS.ProcessEnv): string;
+export declare function getOrCreateInternalApiToken(dataDir?: string): string;
+export declare function validateInternalApiToken(value: string | null | undefined): boolean;
+//# sourceMappingURL=internal-api-token.d.ts.map

package/dist/utils/internal-api-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-api-token.d.ts","sourceRoot":"","sources":["../../src/utils/internal-api-token.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AACxE,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAGnE,wBAAgB,uBAAuB,CAAC,OAAO,SAAmB,GAAG,MAAM,CAE1E;AAOD,wBAAgB,oBAAoB,CAAC,OAAO,SAAmB,GAAG,MAAM,GAAG,IAAI,CAS9E;AAED,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAG/F;AAED,wBAAgB,8BAA8B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAM3F;AAED,wBAAgB,2BAA2B,CAAC,OAAO,SAAmB,GAAG,MAAM,CAuB9E;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAUlF"}

package/dist/utils/internal-api-token.js

@@ -0,0 +1,74 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { resolveDataDir } from './data-dir.js';
+export const INTERNAL_API_TOKEN_HEADER = 'x-agent-tower-internal-token';
+export const INTERNAL_API_TOKEN_ENV = 'AGENT_TOWER_INTERNAL_TOKEN';
+const INTERNAL_API_TOKEN_FILE = 'internal-api-token';
+export function getInternalApiTokenPath(dataDir = resolveDataDir()) {
+    return path.join(dataDir, INTERNAL_API_TOKEN_FILE);
+}
+function normalizeToken(value) {
+    const token = value.trim();
+    return token.length > 0 ? token : null;
+}
+export function readInternalApiToken(dataDir = resolveDataDir()) {
+    const tokenPath = getInternalApiTokenPath(dataDir);
+    if (!existsSync(tokenPath))
+        return null;
+    try {
+        return normalizeToken(readFileSync(tokenPath, 'utf-8')) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export function readInternalApiTokenFromEnv(env = process.env) {
+    const value = env[INTERNAL_API_TOKEN_ENV];
+    return typeof value === 'string' ? normalizeToken(value) : null;
+}
+export function requireInternalApiTokenFromEnv(env = process.env) {
+    const token = readInternalApiTokenFromEnv(env);
+    if (!token) {
+        throw new Error(`${INTERNAL_API_TOKEN_ENV} is required for Agent Tower internal API access`);
+    }
+    return token;
+}
+export function getOrCreateInternalApiToken(dataDir = resolveDataDir()) {
+    const existing = readInternalApiToken(dataDir);
+    if (existing)
+        return existing;
+    mkdirSync(dataDir, { recursive: true });
+    const token = randomBytes(32).toString('base64url');
+    const tokenPath = getInternalApiTokenPath(dataDir);
+    try {
+        writeFileSync(tokenPath, `${token}\n`, {
+            encoding: 'utf-8',
+            mode: 0o600,
+            flag: 'wx',
+        });
+        return token;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === 'EEXIST') {
+            const raced = readInternalApiToken(dataDir);
+            if (raced)
+                return raced;
+        }
+        throw err;
+    }
+}
+export function validateInternalApiToken(value) {
+    if (!value)
+        return false;
+    const expected = readInternalApiTokenFromEnv();
+    if (!expected)
+        return false;
+    const actualBuffer = Buffer.from(value);
+    const expectedBuffer = Buffer.from(expected);
+    if (actualBuffer.length !== expectedBuffer.length)
+        return false;
+    return timingSafeEqual(actualBuffer, expectedBuffer);
+}
+//# sourceMappingURL=internal-api-token.js.map

package/dist/utils/internal-api-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-api-token.js","sourceRoot":"","sources":["../../src/utils/internal-api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AACnE,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAErD,MAAM,UAAU,uBAAuB,CAAC,OAAO,GAAG,cAAc,EAAE;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAO,GAAG,cAAc,EAAE;IAC7D,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjF,MAAM,KAAK,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,sBAAsB,kDAAkD,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAO,GAAG,cAAc,EAAE;IACpE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,CAAC;QACH,aAAa,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,EAAE;YACrC,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACvD,CAAC"}

package/dist/utils/preview-path.d.ts

@@ -0,0 +1,11 @@
+export declare const PREVIEW_PREFIX = "/view";
+export declare const PREVIEW_ACCESS_TOKEN_VERSION = "pv1";
+export interface ParsedPreviewPath {
+    workspaceId: string;
+    previewToken: string | null;
+    suffix: string;
+    search: string;
+}
+export declare function buildPreviewPathPrefix(workspaceId: string, previewToken?: string | null): string;
+export declare function parsePreviewPath(url: string): ParsedPreviewPath | null;
+//# sourceMappingURL=preview-path.d.ts.map

package/dist/utils/preview-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-path.d.ts","sourceRoot":"","sources":["../../src/utils/preview-path.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,UAAU,CAAC;AACtC,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAGlD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAIhG;AAMD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAkCtE"}