botmux 2.111.0 → 2.112.0

package/dist/core/dashboard-ipc-server.js

@@ -1,11 +1,13 @@
 // src/core/dashboard-ipc-server.ts
 import { createServer } from 'node:http';
 import { readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { logger } from '../utils/logger.js';
-import { verifyHmac } from '../dashboard/auth.js';
+import { cliAuthBind, verifyHmac } from '../dashboard/auth.js';
+import { WORKFLOW_DAEMON_IPC_ROUTE_PREFIX } from '../workflows/v3/daemon-ipc-auth.js';
+import { V3_SESSION_RUN_MUTATION_ROUTE_PREFIX } from '../workflows/v3/session-relay.js';
 import { listenWithProbe } from '../utils/listen-with-probe.js';
+import { dashboardSecretPath } from './dashboard-secret.js';
 import * as sessionStore from '../services/session-store.js';
 import * as scheduleStore from '../services/schedule-store.js';
 import * as groupsStore from '../services/groups-store.js';
@@ -64,7 +66,7 @@ import { readGlobalConfig } from '../global-config.js';
 import { normalizeChatReplyMode, setChatReplyMode } from '../services/chat-reply-mode-store.js';
 import * as chatFirstSeenStore from '../services/chat-first-seen-store.js';
 import * as scheduler from './scheduler.js';
-import { listActiveSessions, findActiveBySessionId, closeSession, getActiveSessionsRegistry, transferSession, deliverWriteLinkCardToOwners, forkWorker, suspendWorker } from './worker-pool.js';
+import { listActiveSessions, findActiveBySessionId, closeSession, getActiveSessionsRegistry, transferSession, deliverWriteLinkCardToOwners, forkWorker, suspendWorker, killWorker } from './worker-pool.js';
 import { listOnlineDaemons } from '../utils/daemon-discovery.js';
 import { getChatMode, replyMessage, sendMessage, resolveUnionIdFromOpenId, listThreadMessages, listChatMessages, listChatBotMembers, getUserProfile, resolveAllowedUsersWithMap } from '../im/lark/client.js';
 import { parseApiMessage, cardContentHasUpgradeFallback, resolveMergedCardContent } from '../im/lark/message-parser.js';
@@ -78,29 +80,33 @@ import { validateWorkingDir } from './working-dir.js';
 import { isValidRoleChatId, resolveRole, resolveRoleFile, writeRoleFile, deleteRoleFile, readRoleInjectMode, writeRoleInjectMode, deleteRoleInjectMode } from './role-resolver.js';
 import { deleteRoleProfileEntry, deleteRoleProfileIfEmpty, isValidRoleProfileId, listRoleProfileEntries, listRoleProfiles, MAX_ROLE_PROFILE_ENTRY_BYTES, readRoleProfileEntry, writeRoleProfileEntry, } from '../services/role-profile-store.js';
 import { triggerSessionTurn } from './trigger-session.js';
-import { triggerWorkflowFromEnvelope } from '../workflows/trigger-from-envelope.js';
 import { validateTriggerRequest } from '../services/trigger-types.js';
 import { resolveCliSelection, selectionKeyForBot } from '../setup/cli-selection.js';
 import { checkCliAvailability } from '../setup/cli-availability.js';
 import { enrichHistorySenders } from '../dashboard/history-senders.js';
-// Workflow runner is wired by the daemon (it owns the heavy triggerWorkflowRun
-// deps). Until set, workflow-targeted triggers report not-implemented.
-let workflowRunner = null;
-export function setWorkflowRunner(fn) {
-    workflowRunner = fn;
-}
 let botRenamer = null;
 export function setBotRenamer(fn) {
     botRenamer = fn;
 }
 import { composeRowFromActive, composeRowFromClosed, feishuChatLink, setBotName as setRowsBotName, getBotName, } from './dashboard-rows.js';
-import { getBotBrand, getBot, loadBotConfigs, readBotSkillPolicy } from '../bot-registry.js';
+import { getBotBrand, getBot, loadBotConfigs, readBotSkillPolicy, getBotTuiSlashAllow } from '../bot-registry.js';
 import { normalizeKanbanColumn, normalizeKanbanPosition, normalizeSessionTitle } from './session-board.js';
+import { validateSlashInjection } from './slash-inject.js';
+import { validateRoleLibraryPath } from './role-library.js';
+import { repinSessionWorkingDir } from './session-cwd.js';
+import { authorizeSessionScopedIpc } from './daemon-ipc-session-auth.js';
 import { updateSessionTitle } from './session-title.js';
 import { requestAgentSessionRename } from './session-rename.js';
 import { attachSkillPolicy, detachSkillPolicy } from './skills/im-command.js';
 import { readSkillRegistry } from '../services/skill-registry-store.js';
 const routes = [];
+/** Requests that crossed the server-wide trusted-host gate. The legacy
+ * write-link handlers consult this marker so they do not verify (and consume)
+ * the same one-shot nonce twice. */
+const trustedHostRequests = new WeakSet();
+export function isTrustedHostIpcRequest(req) {
+    return trustedHostRequests.has(req);
+}
 /** Register a handler. Path supports `:name` segments captured into the params object. */
 export function ipcRoute(method, path, handler) {
     const keys = [];
@@ -119,20 +125,16 @@ export async function readJsonBody(req) {
         return {};
     return JSON.parse(Buffer.concat(chunks).toString('utf8'));
 }
-// ─── Token-route auth (loopback HMAC) ───────────────────────────────────────
+// ─── Trusted-host auth (loopback + route-bound HMAC) ────────────────────────
 //
-// Most IPC routes are loopback-trusted: the codebase's threat model treats a
-// local botmux process as already root-equivalent on the box (see the
-// migrate-to-chat route below), so close/resume/sandbox-diff carry no per-route
-// auth. The two write-link routes are different — they HAND OUT a reusable
-// terminal-control credential (the worker write token: GET /write-link returns
-// the URL, POST /write-link-card delivers it as a private Lark card), so they
-// additionally require the caller to prove it can read ~/.botmux/.dashboard-secret.
-// That keeps a sandboxed worker, or a random local process that merely discovered
-// the ipcPort, from minting write tokens for sessions it doesn't own. The legit
-// callers — the dashboard proxy and `botmux term-link` — sign with the same secret
-// + scheme as `botmux dashboard` → /__cli/rotate. (A same-user process that can
-// read the secret is out of scope: it's already trusted.)
+// Production start enables a server-wide gate: loopback is connectivity, not
+// identity, because a Linux bwrap CLI keeps host networking for model egress.
+// Every data/read or mutation route therefore requires proof that the caller
+// can read ~/.botmux/.dashboard-secret. Only health and a tiny set of handlers
+// with their own exact live-worker capability checks are admitted without it.
+// The two write-link handlers retain their historical local check for unit-test
+// compatibility; production requests arrive pre-authorized and are marked in
+// trustedHostRequests so the one-shot nonce is not consumed twice.
 let injectedIpcSecret = null;
 /** Test seam: override the secret used to verify token-route HMAC. */
 export function setIpcAuthSecret(secret) { injectedIpcSecret = secret; }
@@ -140,13 +142,19 @@ function ipcAuthSecret() {
     if (injectedIpcSecret)
         return injectedIpcSecret;
     try {
-        return readFileSync(join(homedir(), '.botmux', '.dashboard-secret'), 'utf8').trim() || null;
+        return readFileSync(dashboardSecretPath(), 'utf8').trim() || null;
     }
     catch {
         return null;
     }
 }
-function tokenRouteAuthorized(req) {
+/** Authenticate legacy terminal-token routes with the machine-local dashboard
+ * secret. Workflow v3 mutations intentionally use their separate, full-request
+ * protocol (`workflows/v3/daemon-ipc-auth`) and must never call this bare
+ * ts:nonce verifier. */
+export function ipcHmacAuthorized(req) {
+    if (trustedHostRequests.has(req))
+        return true;
     const secret = ipcAuthSecret();
     if (!secret)
         return false; // fail-closed: no secret on disk → nobody can sign
@@ -157,6 +165,63 @@ function tokenRouteAuthorized(req) {
         return false;
     return verifyHmac(secret, { ts, nonce, sig }, req.socket.remoteAddress ?? '').ok;
 }
+function routeHasPublicAccess(method, pathname) {
+    // Liveness contains no data and performs no mutation.
+    return method === 'GET' && pathname === '/__health';
+}
+function routeHasNarrowUntrustedAuth(method, pathname) {
+    // The receiver action endpoint performs its own rotating worker-capability
+    // verification and then enters the durable action ledger. Keeping this one
+    // aperture is what preserves managed meeting actions from inside bwrap.
+    if (method === 'POST' && pathname === '/api/vc-meetings/action-request')
+        return true;
+    // These two CLI-in-sandbox endpoints verify the same rotating capability in
+    // their handlers and bind it to body.sessionId. They cannot be bare loopback
+    // exceptions: a receiver that learned another session id could otherwise
+    // forge readiness or an ask for that session.
+    if (method === 'POST' && pathname === '/api/session-ready')
+        return true;
+    if (method === 'POST' && pathname === '/api/asks')
+        return true;
+    // botmux slash / botmux cd（角色切换）：合法调用方是会话内的 CLI 自身，沙箱 /
+    // 读隔离下读不到 host secret。两个 handler 内验证该会话的 rotating per-turn
+    // capability 并绑定到 URL 里的 sessionId（同 /api/asks 姿势）——capability 只
+    // 证明「我是这个会话当前这一轮的 CLI」，选不了别的会话。
+    if (method === 'POST' && /^\/api\/sessions\/[^/]+\/(?:slash|cd)$/.test(pathname))
+        return true;
+    if (method === 'POST' && pathname === '/api/hooks/emit')
+        return true;
+    if (method === 'POST' && pathname === '/api/attention')
+        return true;
+    // Workflow v3 mutations carry their own domain-separated full-envelope
+    // protocol (request signature over method/path/exact body with nonce
+    // anti-replay + boot audience, signed response), keyed on the same host
+    // secret as the outer gate. The handler fail-closes on that envelope, which
+    // is strictly stronger binding than the outer ts:nonce HMAC, so the prefix
+    // is admitted here instead of being double-signed with the same secret.
+    if (method === 'POST' && pathname.startsWith(`${WORKFLOW_DAEMON_IPC_ROUTE_PREFIX}/`))
+        return true;
+    // Workflow v3 session relay: sandboxed / read-isolated chat CLIs cannot read
+    // the host secret, so these handlers verify the session's rotating per-turn
+    // capability and re-derive the caller tuple from the daemon's own live
+    // session record (same posture as /api/asks above).
+    if (method === 'POST' && pathname.startsWith(`${V3_SESSION_RUN_MUTATION_ROUTE_PREFIX}/`))
+        return true;
+    return false;
+}
+function trustedHostAuthorized(req, pathname, port, secret) {
+    const ts = req.headers['x-botmux-cli-ts'];
+    const nonce = req.headers['x-botmux-cli-nonce'];
+    const sig = req.headers['x-botmux-cli-auth'];
+    if (typeof ts !== 'string' || typeof nonce !== 'string' || typeof sig !== 'string') {
+        return { ok: false, reason: 'missing_headers' };
+    }
+    const bind = cliAuthBind(req.method ?? 'GET', pathname, port);
+    const verified = verifyHmac(secret, { ts, nonce, sig }, req.socket.remoteAddress ?? '', bind);
+    return verified.ok
+        ? { ok: true }
+        : { ok: false, reason: verified.reason ?? 'unauthorized' };
+}
 ipcRoute('GET', '/__health', (_req, res) => {
     jsonRes(res, 200, { ok: true });
 });
@@ -275,6 +340,126 @@ ipcRoute('POST', '/api/sessions/:sessionId/suspend', (_req, res, params) => {
     }
     jsonRes(res, 200, { ok: true, sessionId: params.sessionId, suspended: true });
 });
+/** 会话级 CLI IPC（slash/cd）的调用方证明：trusted-host（.dashboard-secret HMAC，
+ *  外层 gate 已验）直接放行；否则（沙箱/读隔离 CLI 读不到 secret，走
+ *  routeHasNarrowUntrustedAuth 窄孔进来）必须出示该会话当前轮换的 capability，
+ *  与 daemon 活跃记录里的 managedTurnOrigin 比对（/api/asks 同款姿势）。
+ *  capability 只证明「我是这个会话当前这一轮的 CLI」——绑定 URL sessionId，
+ *  拿到别的 sessionId 也伪造不了它的 capability。会话不存在时对未签名调用方
+ *  同样回 origin_unproven，不提供「哪些 sessionId 活跃」的探针。 */
+function sessionCliIpcAuth(req, ds, sessionId, body) {
+    const claimedAttempt = typeof body?.originDispatchAttempt === 'number'
+        && Number.isSafeInteger(body.originDispatchAttempt)
+        && body.originDispatchAttempt > 0
+        ? body.originDispatchAttempt
+        : undefined;
+    const decision = authorizeSessionScopedIpc({
+        trustedHost: isTrustedHostIpcRequest(req),
+        sessionExists: !!ds,
+        receiverSession: !!ds?.session.vcMeetingReceiver,
+        allowReceiver: false,
+        sessionId,
+        liveOrigin: ds?.managedTurnOrigin,
+        claimedCapability: typeof body?.originCapability === 'string' ? body.originCapability : undefined,
+        claimedTurnId: typeof body?.originTurnId === 'string' ? body.originTurnId : undefined,
+        claimedDispatchAttempt: claimedAttempt,
+    });
+    return decision.ok ? { ok: true } : { ok: false, error: decision.error };
+}
+/** 向本会话 CLI 注入一条 allowlist 内的原生斜杠命令（idle 后生效）。
+ *  鉴权双路径（见 sessionCliIpcAuth）：trusted-host 签名或本会话 rotating
+ *  capability；命令面由 allowlist（默认空=全拒）承担。 */
+ipcRoute('POST', '/api/sessions/:sessionId/slash', async (req, res, params) => {
+    const body = await readJsonBody(req)
+        .catch(() => ({}));
+    const ds = findActiveBySessionId(params.sessionId);
+    const auth = sessionCliIpcAuth(req, ds, params.sessionId, body);
+    if (!auth.ok)
+        return jsonRes(res, 403, { ok: false, error: auth.error });
+    if (!ds)
+        return jsonRes(res, 404, { ok: false, error: 'session_not_active' });
+    // Adopt/observed 会话是收编的用户自有 pane，用户可能正在里面打字——机器注入
+    // 会与人的输入交错。与 /suspend、/restart 同款排除。
+    if (ds.adoptedFrom || ds.initConfig?.adoptMode) {
+        return jsonRes(res, 409, { ok: false, error: 'adopt_inject_unsupported' });
+    }
+    if (!ds.worker || ds.worker.killed)
+        return jsonRes(res, 409, { ok: false, error: 'no_live_worker' });
+    const allow = getBotTuiSlashAllow(ds.larkAppId);
+    const v = validateSlashInjection(body?.command ?? '', allow);
+    if (!v.ok)
+        return jsonRes(res, 403, { ok: false, error: v.error });
+    try {
+        ds.worker.send({ type: 'inject_command', command: v.command });
+    }
+    catch {
+        // slash 注入无状态（不像 /cd 那样已 repin 记录），send 失败不需要杀进程
+        // 冷启动——直接把失败面报给调用方即可。
+        return jsonRes(res, 502, { ok: false, error: 'worker_send_failed' });
+    }
+    jsonRes(res, 200, { ok: true, sessionId: params.sessionId, queued: v.command });
+});
+/** 会话内切换工作目录（角色切换专用）：硬校验角色库根 → 更新记录落盘（唯一事实源）
+ *  → 按能力位选择 idle 注入 /cd（进程不死）或杀进程冷启动兜底。
+ *  鉴权双路径（见 sessionCliIpcAuth）：trusted-host 签名或本会话 rotating
+ *  capability；目录面由 validateRoleLibraryPath 硬校验承担（realpath 归一 +
+ *  dev/ino 包含判断，角色库根之外一律拒）。
+ *  不发话题消息（AI 自己发角色化确认）。 */
+ipcRoute('POST', '/api/sessions/:sessionId/cd', async (req, res, params) => {
+    const body = await readJsonBody(req)
+        .catch(() => ({}));
+    const ds = findActiveBySessionId(params.sessionId);
+    const auth = sessionCliIpcAuth(req, ds, params.sessionId, body);
+    if (!auth.ok)
+        return jsonRes(res, 403, { ok: false, error: auth.error });
+    if (!ds)
+        return jsonRes(res, 404, { ok: false, error: 'session_not_active' });
+    // Adopt/observed 会话是收编的用户自有 pane——注入或冷重启都会打断用户自己的
+    // 终端会话。与 /suspend、/restart、/slash 同款排除。
+    if (ds.adoptedFrom || ds.initConfig?.adoptMode) {
+        return jsonRes(res, 409, { ok: false, error: 'adopt_cd_unsupported' });
+    }
+    const v = validateRoleLibraryPath(body?.dir ?? '');
+    if (!v.ok) {
+        return jsonRes(res, v.error === 'outside_role_library' ? 403 : 400, { ok: false, error: v.error });
+    }
+    repinSessionWorkingDir(ds, v.resolvedPath);
+    const cliId = ds.session.cliId;
+    let canInject = false;
+    try {
+        canInject = !!(cliId && createCliAdapterSync(cliId).supportsSessionCwdMove);
+    }
+    catch { /* unknown cli */ }
+    if (ds.worker && !ds.worker.killed && canInject) {
+        // updateWorkingDir 随 inject_command 带给 worker：会话内 /cd 后 worker 内部的
+        // respawn（claude_exit 自动重启 / IM /restart / dashboard restart）必须收敛到
+        // 新目录，而不是陈旧的 lastInitConfig.workingDir。daemon 侧的 ds.initConfig 同步
+        // 更新，保持与 worker 侧一致（下次 forkWorker 用它重建 init 消息）。
+        if (ds.initConfig)
+            ds.initConfig.workingDir = v.resolvedPath;
+        try {
+            ds.worker.send({ type: 'inject_command', command: `/cd ${v.resolvedPath}`, updateWorkingDir: v.resolvedPath });
+        }
+        catch {
+            // send() 抛异常：worker 进程实际上已经不可达（管道已断），但 above 的
+            // repinSessionWorkingDir 已经把记录改成了新目录——绝不能留下「记录新、
+            // 进程仍在旧目录」的分裂状态。杀掉 worker 让下一条消息冷启动进新目录。
+            killWorker(ds);
+            return jsonRes(res, 200, { ok: true, mode: 'cold-restart', dir: v.resolvedPath });
+        }
+        return jsonRes(res, 200, { ok: true, mode: 'inject', dir: v.resolvedPath });
+    }
+    // Unconditional (no `ds.worker` guard), matching the IM `/cd` command handler
+    // (src/core/command-handler.ts) — killWorker() already no-ops safely when there
+    // is no live worker. That "no worker" branch is exactly what must run here for a
+    // lazy-restored-after-daemon-restart or crash-stopped TmuxBackend/HerdrBackend/
+    // ZellijBackend session: the persistent backing pane survives the worker's death
+    // and still binds the OLD cwd, so it must be torn down via
+    // destroyOrphanedBackingSession (called from inside killWorker) or the next
+    // resume would silently reattach to it and ignore the just-repinned workingDir.
+    killWorker(ds);
+    jsonRes(res, 200, { ok: true, mode: 'cold-restart', dir: v.resolvedPath });
+});
 /** 解析 session（活跃优先，已关闭兜底）。活跃会话取 ds.session —— registry 与
  *  store 持有同一对象，改字段后 updateSession 即落盘。 */
 function findSessionRecord(sessionId) {
@@ -460,6 +645,9 @@ ipcRoute('GET', '/api/sessions/:sessionId/history', async (req, res, params) =>
                 messageId: parsed.messageId,
                 senderId: parsed.senderId,
                 senderType: parsed.senderType,
+                // 服务端返回的发送者名（with_sender_name=true，bot 也有）。enrich 阶段
+                // 本地花名册/contact 解析不到时兜底用它——第三方 bot 不再是一串 open_id。
+                ...(parsed.senderName ? { senderName: parsed.senderName } : {}),
                 msgType: parsed.msgType,
                 content: parsed.content,
                 // Lark create_time 是毫秒 epoch 字符串——规范成数字，前端 new Date 直接用
@@ -699,12 +887,12 @@ ipcRoute('POST', '/api/sessions/:sessionId/lock', async (req, res, params) => {
  *
  * Two gates protect it: at the dashboard's HTTP boundary this path is absent
  * from the public allow-list, so an anonymous browser 401s; and here on the
- * daemon IPC, tokenRouteAuthorized requires a loopback-HMAC signed with
+ * daemon IPC, ipcHmacAuthorized requires a loopback-HMAC signed with
  * .dashboard-secret, so a local process that merely knows the ipcPort still
  * can't pull a write token.
  */
 ipcRoute('GET', '/api/sessions/:sessionId/write-link', (req, res, params) => {
-    if (!tokenRouteAuthorized(req))
+    if (!ipcHmacAuthorized(req))
         return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
     const ds = findActiveBySessionId(params.sessionId);
     if (!ds)
@@ -729,7 +917,7 @@ ipcRoute('GET', '/api/sessions/:sessionId/write-link', (req, res, params) => {
  * credential, just into Lark rather than into the HTTP response.
  */
 ipcRoute('POST', '/api/sessions/:sessionId/write-link-card', async (req, res, params) => {
-    if (!tokenRouteAuthorized(req))
+    if (!ipcHmacAuthorized(req))
         return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
     const ds = findActiveBySessionId(params.sessionId);
     if (!ds)
@@ -1060,17 +1248,33 @@ ipcRoute('POST', '/api/trigger', async (req, res) => {
             error: `request target botId ${valid.request.target.botId} does not match daemon ${cachedLarkAppId}`,
         });
     }
+    if (valid.request.target.kind === 'turn' && valid.request.target.sessionId) {
+        const receiverTarget = [...activeSessions.values()].find((candidate) => candidate.session.sessionId === valid.request.target.sessionId);
+        if (receiverTarget?.session.vcMeetingReceiver) {
+            return jsonRes(res, 403, {
+                ok: false,
+                errorCode: 'managed_receiver_requires_delivery_endpoint',
+                error: 'dedicated meeting receiver sessions accept only fenced delivery or explicit IM routing',
+            });
+        }
+    }
     try {
-        let result;
         if (valid.request.target.kind === 'workflow') {
-            if (!workflowRunner) {
-                return jsonRes(res, 501, { ok: false, errorCode: 'workflow_trigger_not_implemented', error: 'workflow runner not wired on this daemon' });
-            }
-            result = await triggerWorkflowFromEnvelope(valid.request, { larkAppId: cachedLarkAppId, runWorkflow: workflowRunner });
+            return jsonRes(res, 410, {
+                ok: false,
+                errorCode: 'legacy_workflow_retired',
+                error: 'v2 workflow trigger targets are retired; migrate the definition and run it through /workflow',
+            });
         }
-        else {
-            result = await triggerSessionTurn(valid.request, { larkAppId: cachedLarkAppId, activeSessions });
+        const activeSessions = getActiveSessionsRegistry();
+        if (!activeSessions) {
+            return jsonRes(res, 503, {
+                ok: false,
+                errorCode: 'trigger_failed',
+                error: 'active session registry unavailable',
+            });
         }
+        const result = await triggerSessionTurn(valid.request, { larkAppId: cachedLarkAppId, activeSessions });
         const status = result.ok
             ? 200
             : result.errorCode === 'bot_not_in_chat'
@@ -2102,7 +2306,9 @@ ipcRoute('PUT', '/api/bot-env', async (req, res) => {
 // 空白 → 清除；否则按 json kind 解析后落盘。走 applyConfigField（与 /botconfig
 // 同一写盘 + 内存热更新路径），next-session 生效。仅 backendType=riff 时使用。
 /** riff 配置里 dashboard 可编辑的字段——PUT /bot-riff 只覆盖这些，其余保留。 */
-const RIFF_UI_EDITABLE_KEYS = new Set(['baseUrl', 'agent', 'model', 'jwtEnv', 'sandboxCluster', 'injectStatusLines', 'systemPrompt', 'setupCommands']);
+// sandboxCluster / injectStatusLines 已从 dashboard UI 移除（前者极少用、后者
+// 恒默认开启）——不在此集合中意味着存量 bots.json 值按「隐藏字段」原样保留。
+const RIFF_UI_EDITABLE_KEYS = new Set(['baseUrl', 'agent', 'model', 'jwtEnv', 'systemPrompt', 'setupCommands']);
 /** 发给浏览器前脱敏：明文 jwt / env（可能含各类密钥）绝不进 dashboard 响应。 */
 function redactRiffForClient(riff) {
     if (!riff || typeof riff !== 'object')
@@ -2619,9 +2825,25 @@ ipcRoute('GET', '/api/events', (_req, res) => {
     res.on('close', () => { off(); clearInterval(hb); });
 });
 export function startIpcServer(opts) {
+    let boundPort = opts.port;
     const server = createServer(async (req, res) => {
         try {
             const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+            const method = req.method ?? 'GET';
+            const publicRoute = routeHasPublicAccess(method, url.pathname);
+            const capabilityRoute = routeHasNarrowUntrustedAuth(method, url.pathname);
+            if (opts.authRequired && !publicRoute) {
+                const secret = ipcAuthSecret();
+                const auth = secret
+                    ? trustedHostAuthorized(req, url.pathname, boundPort, secret)
+                    : { ok: false, reason: 'secret_unavailable' };
+                if (auth.ok) {
+                    trustedHostRequests.add(req);
+                }
+                else if (!capabilityRoute) {
+                    return jsonRes(res, 401, { ok: false, error: 'unauthorized', reason: auth.reason });
+                }
+            }
             for (const r of routes) {
                 if (r.method !== req.method)
                     continue;
@@ -2651,9 +2873,12 @@ export function startIpcServer(opts) {
         port: opts.port,
         host: opts.host,
         log: (m) => logger.warn(`[dashboard-ipc] ${m}`),
-    }).then((port) => ({
-        port,
-        close: () => new Promise(r => server.close(() => r())),
-    }));
+    }).then((port) => {
+        boundPort = port;
+        return {
+            port,
+            close: () => new Promise(r => server.close(() => r())),
+        };
+    });
 }
 //# sourceMappingURL=dashboard-ipc-server.js.map