byollm 0.1.0-alpha.97 → 0.1.0-alpha.98

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.97`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.98`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npx byollm@latest`, or `npm install byollm@latest`.
 >

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   main
-} from "./chunk-R3WK5X6Q.js";
+} from "./chunk-JCLM24WC.js";
 
 // src/bin.ts
 process.exitCode = await main(process.argv.slice(2));

package/dist/{chunk-R3WK5X6Q.js → chunk-JCLM24WC.js}

@@ -4985,9 +4985,13 @@ async function openPtyShell(options) {
 }
 
 // src/console-agent-main.ts
-import { SealedEnvelope as SealedEnvelopeSchema } from "@byollm/protocol";
-var connectWebSocket = (url) => new Promise((resolve, reject) => {
-  const socket = new WebSocket(url);
+import {
+  SealedEnvelope as SealedEnvelopeSchema,
+  signRequest as signRequest2
+} from "@byollm/protocol";
+var CONSOLE_BOX_ENDPOINT = "/console/box";
+var connectWebSocket = (url, headers) => new Promise((resolve, reject) => {
+  const socket = new WebSocket(url, { headers });
   socket.addEventListener("open", () => {
     resolve({
       send: (text) => {
@@ -5019,7 +5023,17 @@ async function runConsoleAgent(options) {
     cwd: options.cwd,
     env: options.env
   });
-  const socket = await (options.connect ?? connectWebSocket)(options.url);
+  const signed = signRequest2(options.keys, {
+    endpoint: CONSOLE_BOX_ENDPOINT,
+    runnerId: options.runnerId,
+    issuedAt: (options.now ?? Date.now)(),
+    body: options.sessionId
+  });
+  const socket = await (options.connect ?? connectWebSocket)(options.url, {
+    "x-byollm-runner": signed.runnerId,
+    "x-byollm-issued-at": String(signed.issuedAt),
+    "x-byollm-signature": signed.signature
+  });
   const session = consoleSession({
     sessionId: options.sessionId,
     deadlineAt: options.deadlineAt,
@@ -5099,10 +5113,10 @@ var ConsoleAgentSpec = z5.object({
 }).strict();
 
 // src/console-listen.ts
-import { signRequest as signRequest2 } from "@byollm/protocol";
+import { signRequest as signRequest3 } from "@byollm/protocol";
 var CONSOLE_DEVICE_ENDPOINT = "/console/device";
 var deviceHeaders = (keys, runnerId, now) => {
-  const signed = signRequest2(keys, {
+  const signed = signRequest3(keys, {
     endpoint: CONSOLE_DEVICE_ENDPOINT,
     runnerId,
     issuedAt: now,
@@ -8888,10 +8902,19 @@ async function commandConsoleAgent(paths, args, io) {
       runnerId: paired.runnerId,
       keys,
       run: (announcement) => runConsoleAgent({
-        url: `${paired.origin.replace(/^http/, "ws")}/console/box?session=${announcement.sessionId}`,
+        /* The endpoint from one definition, shared with the signer that
+           has to name it identically — a URL built here and a signature
+           built there, disagreeing by a character, is a 401 nobody can
+           read. */
+        url: `${paired.origin.replace(/^http/, "ws")}${CONSOLE_BOX_ENDPOINT}?session=${announcement.sessionId}`,
         sessionId: announcement.sessionId,
         deadlineAt: announcement.deadlineAt,
         keys,
+        /* The data door is authenticated too, and signs over the SESSION —
+           a signature captured from one cannot be replayed to join
+           another. Without this the dial is refused 401 before the
+           handshake, which is what attempt six hit. */
+        runnerId: paired.runnerId,
         browser: announcement.browser,
         command: process.env["BYOLLM_CONSOLE_SHELL"] ?? "/bin/sh",
         args: [],
@@ -8923,12 +8946,22 @@ async function commandConsoleAgent(paths, args, io) {
     io.err("That session description is not one this agent understands.\n");
     return 2;
   }
+  const agentPairings = new Pairings(paths.pairings);
+  await agentPairings.load();
+  const agentPaired = agentPairings.list()[0];
+  if (agentPaired === void 0) {
+    io.err(
+      "byollm console-agent cannot join a console: this device is not paired.\nThe hub will not accept an unsigned connection. Pair it first with `byollm connect`.\n"
+    );
+    return 1;
+  }
   try {
     const why = await runConsoleAgent({
       url: session.data.url,
       sessionId: session.data.sessionId,
       deadlineAt: session.data.deadlineAt,
       keys,
+      runnerId: agentPaired.runnerId,
       browser: session.data.browser,
       command: session.data.shell.command,
       args: session.data.shell.args,
@@ -10503,7 +10536,7 @@ async function exists(path) {
 }
 
 // src/index.ts
-var DAEMON_VERSION = "0.1.0-alpha.97";
+var DAEMON_VERSION = "0.1.0-alpha.98";
 function daemonVersion() {
   return {
     daemon: DAEMON_VERSION,
@@ -10562,4 +10595,4 @@ export {
   runCli,
   main
 };
-//# sourceMappingURL=chunk-R3WK5X6Q.js.map
+//# sourceMappingURL=chunk-JCLM24WC.js.map