commandmate 0.34.0 → 0.34.1

package/dist/server/server.js

@@ -87,6 +87,83 @@ const session_cleanup_1 = require("./src/lib/session-cleanup");
 const dev = process.env.NODE_ENV !== 'production';
 const hostname = (0, env_1.getEnvByKey)('CM_BIND') || '127.0.0.1';
 const port = parseInt((0, env_1.getEnvByKey)('CM_PORT') || '3000', 10);
+/**
+ * Issue #2489: the `CM_AUTH_SCOPE` value that exempts the local listener.
+ *
+ * Written out here rather than imported from `src/lib/ws-server.ts`, which
+ * exports the same constant for the Node-runtime side, for the same reason the
+ * `x-cm-raw-url` header name below is written out: this is read at MODULE SCOPE,
+ * before `app.prepare()`, and everything server.ts evaluates that early has to
+ * stand on its own. `tests/integration/remote-ingress-auth-2489.test.ts` holds
+ * the two spellings equal, so a rename cannot leave one of them behind.
+ */
+const REMOTE_ONLY_AUTH_SCOPE = 'remote-only';
+/**
+ * Issue #2489: the loopback address the Provider's upstream is pointed at.
+ *
+ * `commandmate remote --auth remote-only` asks for "the phone authenticates,
+ * the PC in front of the machine does not". The listener a request landed on is
+ * the only unforgeable way to tell those apart (see the header of
+ * `src/lib/ws-server.ts`'s ingress section), so this bind is deliberately the
+ * literal loopback address rather than `hostname`: the second listener must
+ * never be reachable from the LAN, whatever `CM_BIND` says.
+ */
+const REMOTE_INGRESS_BIND = '127.0.0.1';
+/**
+ * Issue #2489: whether `CM_BIND` keeps the local listener off the network.
+ *
+ * `remote-only` makes the local listener unauthenticated, so a non-loopback
+ * bind would extend "local means trusted" to every host on the LAN. The CLI
+ * refuses that combination up front (exit 2); this is the second, independent
+ * check, because `CM_BIND` can also be set in `.env` or exported after the fact.
+ */
+function isLoopbackBind(bind) {
+    return bind === '127.0.0.1' || bind === 'localhost' || bind === '::1' || bind === '[::1]';
+}
+/**
+ * Fall back to authenticating every listener, and say why.
+ *
+ * Writes the decision back into `process.env` rather than only returning it:
+ * `middleware.ts` and `ws-server.ts` read `CM_AUTH_SCOPE` per request, so a
+ * degradation that lived in a local variable would leave the local listener
+ * exempt while this process believed it had closed the door.
+ */
+function refuseRemoteOnly(reason) {
+    console.error(`[Security] CM_AUTH_SCOPE=${REMOTE_ONLY_AUTH_SCOPE} refused: ${reason}. ` +
+        'Every listener will require authentication.');
+    process.env.CM_AUTH_SCOPE = 'all';
+    return null;
+}
+/**
+ * Resolve the port of the remote-only ingress listener, or null for one listener.
+ *
+ * Fail-closed at every branch: anything this cannot verify turns into
+ * {@link refuseRemoteOnly}, which is the pre-#2489 behaviour (auth everywhere).
+ *
+ * @returns The loopback port to open for the Provider, or null
+ */
+function resolveRemoteIngressPort() {
+    if (process.env.CM_AUTH_SCOPE !== REMOTE_ONLY_AUTH_SCOPE)
+        return null;
+    if (!isLoopbackBind(hostname)) {
+        return refuseRemoteOnly(`CM_BIND is ${hostname}, which is not loopback`);
+    }
+    const raw = process.env.CM_REMOTE_INGRESS_PORT;
+    if (!raw) {
+        return refuseRemoteOnly('CM_REMOTE_INGRESS_PORT is not set');
+    }
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535) {
+        return refuseRemoteOnly(`CM_REMOTE_INGRESS_PORT is not a valid port: ${raw}`);
+    }
+    if (parsed === port) {
+        // One socket cannot be two ingresses, and "the Provider dials the port the
+        // user dials" is exactly the confusion this whole mechanism exists to avoid.
+        return refuseRemoteOnly('CM_REMOTE_INGRESS_PORT is the same port the server serves on');
+    }
+    return parsed;
+}
+const remoteIngressPort = resolveRemoteIngressPort();
 // Issue #331: HTTPS configuration
 const certPath = process.env.CM_HTTPS_CERT;
 const keyPath = process.env.CM_HTTPS_KEY;
@@ -162,14 +239,27 @@ async function resolveWorktreeAliasRedirect(url) {
 // All WebSocket upgrades are handled by ws-server.ts (our own upgrade listener).
 app.setupWebSocketHandler = () => { };
 app.prepare().then(() => {
-    // Request handler for both HTTP and HTTPS
-    const requestHandler = async (req, res) => {
+    // Request handler for both HTTP and HTTPS.
+    //
+    // Issue #2489: a factory rather than a single handler, because the ONE thing a
+    // request cannot lie about is the listener it arrived on, and that fact is
+    // only known here — at the point the listener is constructed. Every listener
+    // is built through this function, so every request is stamped; a listener
+    // wired up any other way would leave the caller's own `x-cm-ingress` in place,
+    // which is the single way this scheme can fail open.
+    const requestHandlerFor = (ingress) => async (req, res) => {
         // Guard: res must be a proper HTTP ServerResponse (not a raw net.Socket).
         // Defense-in-depth: normally not needed after the setupWebSocketHandler fix above,
         // but kept for safety in case any other path passes a non-ServerResponse object.
         if (typeof res?.setHeader !== 'function') {
             return;
         }
+        // Issue #2489: overwrite, unconditionally and before anything reads it.
+        // `middleware.ts` and `ws-server.ts` decide whether to demand a token from
+        // this value alone — deliberately NOT from `X-Real-IP` / `X-Forwarded-For` /
+        // `Host`, all of which a tunnelled request carries identically to a local
+        // one (a Provider's upstream IS 127.0.0.1).
+        (0, ws_server_1.stampIngress)(req.headers, ingress);
         // Issue #332: Inject X-Real-IP header for IP restriction
         // [S3-005] This applies to HTTP requests only. WebSocket upgrade requests
         // are skipped below and handled by ws-server.ts (which uses socket.remoteAddress directly).
@@ -241,15 +331,16 @@ app.prepare().then(() => {
         }
     };
     // Issue #331: Create HTTP or HTTPS server
-    let server;
+    let tlsOptions = null;
     let protocol = 'http';
     if (certPath && keyPath) {
         const validatedCertPath = validateCertPath(certPath, 'Certificate');
         const validatedKeyPath = validateCertPath(keyPath, 'Key');
         try {
-            const cert = (0, fs_1.readFileSync)(validatedCertPath);
-            const key = (0, fs_1.readFileSync)(validatedKeyPath);
-            server = (0, https_1.createServer)({ cert, key }, requestHandler);
+            tlsOptions = {
+                cert: (0, fs_1.readFileSync)(validatedCertPath),
+                key: (0, fs_1.readFileSync)(validatedKeyPath),
+            };
             protocol = 'https';
             console.log('HTTPS server created with TLS certificates');
         }
@@ -258,11 +349,35 @@ app.prepare().then(() => {
             process.exit(2);
         }
     }
-    else {
-        server = (0, http_1.createServer)(requestHandler);
-    }
+    /**
+     * Issue #2489: build one listener, stamped with its own ingress.
+     *
+     * The TLS material is read once above and shared, so the remote listener is
+     * the same server in every respect except which socket it answers on — which
+     * is the only difference that is allowed to matter.
+     */
+    const createListener = (ingress) => tlsOptions === null
+        ? (0, http_1.createServer)(requestHandlerFor(ingress))
+        : (0, https_1.createServer)(tlsOptions, requestHandlerFor(ingress));
+    const server = createListener('local');
+    /**
+     * Issue #2489: the listener `commandmate remote --auth remote-only` points the
+     * Provider at. Null in every other configuration, which is what keeps
+     * `--auth all` (and a plain `commandmate start`) on exactly one socket.
+     */
+    const remoteServer = remoteIngressPort === null ? null : createListener('remote');
+    // Issue #2489: stamp WebSocket upgrades too, and BEFORE `setupWebSocket`
+    // registers its own 'upgrade' listener — Node fires listeners in registration
+    // order, so this is what guarantees the auth check downstream reads a value
+    // this process wrote. HTTP and WS must agree: a phone drives the terminal over
+    // this socket, so a WS path that exempted more than the HTTP path would hand
+    // the tunnel a live shell while the screen behind it still asked for a token.
+    server.on('upgrade', (request) => (0, ws_server_1.stampIngress)(request.headers, 'local'));
+    remoteServer?.on('upgrade', (request) => (0, ws_server_1.stampIngress)(request.headers, 'remote'));
     // Setup WebSocket server
-    (0, ws_server_1.setupWebSocket)(server);
+    (0, ws_server_1.setupWebSocket)(server, {
+        additionalServers: remoteServer === null ? [] : [remoteServer],
+    });
     // Scan and sync worktrees on startup
     async function initializeWorktrees() {
         try {
@@ -466,9 +581,35 @@ app.prepare().then(() => {
         }
         process.exit(1);
     });
+    // Issue #2489: open the Provider's door on its own loopback socket.
+    //
+    // Started before the main `listen` so the CLI's readiness probe on this port
+    // cannot outrun it. An error here is NOT fatal to the process — killing the
+    // server would take the user's local session down with the remote one, which
+    // is the same reason `--expires` closes only the Provider (§5.3) — but it IS
+    // fail-closed: without this socket there is no "remote" ingress, so the local
+    // exemption is withdrawn and every listener goes back to demanding a token.
+    // `commandmate remote` then fails its readiness probe on this port and rolls
+    // the whole session back, which is where the user sees the error.
+    if (remoteServer !== null && remoteIngressPort !== null) {
+        remoteServer.on('error', (err) => {
+            console.error(`[Security] Remote ingress listener on ${REMOTE_INGRESS_BIND}:${remoteIngressPort} failed ` +
+                `(${err.code ?? err.message}). Every listener will require authentication.`);
+            process.env.CM_AUTH_SCOPE = 'all';
+        });
+        remoteServer.listen(remoteIngressPort, REMOTE_INGRESS_BIND, () => {
+            console.log(`> Remote ingress ready on ${protocol}://${REMOTE_INGRESS_BIND}:${remoteIngressPort} (authentication required)`);
+        });
+    }
     server.listen(port, hostname, async () => {
         console.log(`> Ready on ${protocol}://${hostname}:${port}`);
         console.log(`> WebSocket server ready`);
+        if (remoteIngressPort !== null) {
+            // Say it on the main "Ready" line too: "the PC does not need to log in" is
+            // a security-relevant departure from the default, and a server log that
+            // only mentions it in a line above is a log nobody reads.
+            console.log(`> Auth scope: ${REMOTE_ONLY_AUTH_SCOPE} — ${protocol}://${hostname}:${port} does not require a token`);
+        }
         // Issue #2113: verify that the URL the documentation advertises
         // (`http://localhost:<port>`) actually reaches THIS process. It does not when
         // another process holds `::1:<port>`: `localhost` resolves ::1 before 127.0.0.1
@@ -647,12 +788,59 @@ app.prepare().then(() => {
             console.log('Graceful shutdown timeout, forcing exit...');
             process.exit(1);
         }, 3000);
-        // Try graceful HTTP server close
-        server.close(() => {
-            clearTimeout(forceExitTimeout);
-            console.log('Server closed gracefully');
-            process.exit(0);
-        });
+        // Try graceful HTTP server close.
+        //
+        // Issue #2489: EVERY listener this process opened, not just the main one.
+        // `remoteServer` was absent from this function entirely, and the cost was
+        // asymmetry on the door the user cannot see: `server.close()`'s callback
+        // fires once the LOCAL connections have drained, and the `process.exit(0)`
+        // inside it then cut off any request still in flight through the provider.
+        // The local listener had three seconds of grace and the remote one had
+        // none. (The accept window between the teardown above and this point is the
+        // same for both listeners, and effectively zero — everything between the
+        // signal and here is synchronous, so the event loop never turns to accept a
+        // connection. The in-flight requests are the real loss.)
+        //
+        // The invariant, rather than the fix: whatever shutdown does to one
+        // listener it does to all of them. Anything added here belongs INSIDE this
+        // loop rather than on `server` alone — applying it to `server` only would
+        // put the asymmetry straight back on the listener nobody is looking at.
+        const listeners = remoteServer === null ? [server] : [server, remoteServer];
+        // `close()` stops each accept loop immediately and calls back once that
+        // listener's own connections have ended, so both doors shut now and the
+        // exit waits for the last one to drain. A listener that never reached
+        // `listen()` (EADDRINUSE on the remote port) calls its callback with an
+        // Error instead of throwing, which counts as drained here — which is what
+        // we want: a door that never opened cannot be holding anything.
+        let draining = listeners.length;
+        for (const listener of listeners) {
+            listener.close(() => {
+                draining -= 1;
+                if (draining > 0)
+                    return;
+                clearTimeout(forceExitTimeout);
+                console.log('Server closed gracefully');
+                process.exit(0);
+            });
+            // Issue #2488: close() stops accepting immediately, but its callback only
+            // fires once every ESTABLISHED connection on that listener is gone. A
+            // browser tab left on the dashboard holds keep-alive sockets with no
+            // request in flight, and nothing ever closes them, so the callback never
+            // ran and the process lived the full 3 seconds to the force-exit — with
+            // its listening socket already closed. That window is what the stop
+            // scripts used to mistake for "stopped" (they looked for a listener,
+            // found none, and returned while this process was still alive and still
+            // named by logs/server.pid).
+            //
+            // closeIdleConnections() ends exactly those sockets. A connection with a
+            // request in flight is NOT idle and is left alone: it still gets the 3
+            // seconds above, so an in-flight response is no more truncated than
+            // before. The stop scripts no longer depend on this being fast — they
+            // wait for the PID — but the common case now exits in milliseconds
+            // instead of 3 seconds. Per #2489's invariant this runs on EVERY
+            // listener, so the remote door drains on the same terms as the local one.
+            listener.closeIdleConnections();
+        }
     }
     process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
     process.on('SIGINT', () => gracefulShutdown('SIGINT'));

package/dist/server/src/lib/db/agent-instances-db.js

@@ -136,6 +136,17 @@ function getAgentInstance(db, worktreeId, instanceId) {
  * conflict rather than silently overriding it: the roster is user-maintained
  * and a mismatch means one of the two is wrong. Callers surface it as an error.
  *
+ * @deprecated Issue #1925 made `resolveSessionTarget`
+ * (`src/lib/session/resolve-session-target.ts`) the one authority, and Issue
+ * #2491 moved the last two callers — `POST /send` and `resolveRelaySession` —
+ * onto it. **Do not give this function a new caller.** Step 2 above is exactly
+ * what #2487 corrected: with no roster row it takes `requestedCliTool` even
+ * when `instanceId` itself names a different tool, so a caller wired here gets
+ * `mcbd-<requested>-<wt>-<tool-named-id>` back instead of a conflict. It is
+ * kept only because its #1629 unit test
+ * (`tests/unit/db/agent-instances-resolve-cli-tool.test.ts`) still pins that
+ * behaviour; removing both is a separate change.
+ *
  * @param db - Database instance
  * @param worktreeId - Worktree ID
  * @param instanceId - Targeted agent instance ID (omitted for the primary instance)

package/dist/server/src/lib/hooks/sources/opencode/ports.js

@@ -82,6 +82,12 @@ function keyOf(target) {
  * not throw — it spins the event loop forever, so the `try/catch` around it
  * never runs. A file path is checked the same way a directory is (the match is
  * on the prefix), so the override is refused here and the default is used.
+ *
+ * Issue #2490: the default is also what a *test* gets when it says nothing, and
+ * the writers below are read-modify-write, so an unredirected suite rewrites
+ * the ledger a live server is using. `tests/setup.ts` pins the variable for the
+ * whole suite for that reason; `tests/unit/lib/hooks/sources/opencode/port-file-isolation-2490.test.ts`
+ * is the guard on that pin.
  */
 function getOpencodePortFilePath() {
     const fallback = (0, path_1.join)((0, os_1.homedir)(), '.commandmate', 'opencode-ports.json');

package/dist/server/src/lib/relay/relay-session-ref.js

@@ -19,6 +19,7 @@ exports.resolveRelaySession = resolveRelaySession;
 exports.relayWorktreeExists = relayWorktreeExists;
 const agent_instances_db_1 = require("../../lib/db/agent-instances-db");
 const worktree_db_1 = require("../../lib/db/worktree-db");
+const resolve_session_target_1 = require("../../lib/session/resolve-session-target");
 const logger_1 = require("../../lib/logger");
 const logger = (0, logger_1.createLogger)('relay-session-ref');
 /** The tool assumed when neither the roster nor the worktree declares one. */
@@ -26,23 +27,29 @@ const FALLBACK_CLI_TOOL = 'claude';
 /**
  * Resolve one end of a relay.
  *
- * The tool comes from `resolveInstanceCliTool` — the same authority
+ * The tool comes from `resolveSessionTarget` — the same authority
  * `POST /api/worktrees/:id/send` uses, so a relay cannot address a session the
  * send route would address differently (#1629 is the record of what two
  * authorities on that cost) — falling back to the worktree's own tool and then
  * to claude.
+ *
+ * Issue #2491: that sentence was true of `resolveInstanceCliTool` when this
+ * module was written and stopped being true when `send` moved to the shared
+ * resolver. The two answer identically here — a relay never names a tool, and
+ * with `requestedCliTool` absent both walk roster → primary anchor → worktree
+ * default → claude — so this is the comment made true again, not a behaviour
+ * change. `resolveSessionTarget` folds in the worktree-default and claude
+ * stages this function used to spell out for itself; `FALLBACK_CLI_TOOL` stays
+ * because the catch below still needs an answer when the roster cannot be read
+ * at all.
  */
 function resolveRelaySession(db, endpoint) {
     let cliToolId = FALLBACK_CLI_TOOL;
     let alias = endpoint.instanceId;
     try {
-        const resolution = (0, agent_instances_db_1.resolveInstanceCliTool)(db, endpoint.worktreeId, endpoint.instanceId);
-        if (resolution.ok && resolution.cliToolId) {
-            cliToolId = resolution.cliToolId;
-        }
-        else {
-            cliToolId = (0, worktree_db_1.getWorktreeById)(db, endpoint.worktreeId)?.cliToolId ?? FALLBACK_CLI_TOOL;
-        }
+        cliToolId = (0, resolve_session_target_1.resolveSessionTarget)(db, endpoint.worktreeId, {
+            instanceId: endpoint.instanceId,
+        }).cliToolId;
         const rosterRow = (0, agent_instances_db_1.getAgentInstance)(db, endpoint.worktreeId, endpoint.instanceId);
         if (rosterRow?.alias)
             alias = rosterRow.alias;

package/dist/server/src/lib/ws-server.js

@@ -5,7 +5,9 @@
  * Issue #331: WebSocket authentication via Cookie header
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.__internal = exports.WORKTREE_RENAMED_EVENT_TYPE = void 0;
+exports.__internal = exports.WORKTREE_RENAMED_EVENT_TYPE = exports.REMOTE_ONLY_AUTH_SCOPE = exports.CM_INGRESS_HEADER = void 0;
+exports.stampIngress = stampIngress;
+exports.isIngressAuthExempt = isIngressAuthExempt;
 exports.handleProxyUpgrade = handleProxyUpgrade;
 exports.setupWebSocket = setupWebSocket;
 exports.broadcast = broadcast;
@@ -61,6 +63,59 @@ const TERMINAL_FALLBACK_CAPTURE_LINES = -200;
  * Issue #671.
  */
 const PROXY_ALLOWED_HOSTS = new Set(['localhost', '127.0.0.1']);
+/**
+ * The header `server.ts` overwrites on every request and upgrade.
+ *
+ * Written out as a literal in `server.ts` would be a second spelling of the same
+ * name, so it lives here and `server.ts` imports it — that file already imports
+ * this module at eval time (`setupWebSocket`), which is why this is the one
+ * place the constant can live without adding a module graph to `server.ts`'s
+ * eval-time graph (see the `x-cm-raw-url` comment there for what that costs).
+ * `middleware.ts` cannot import it: it runs on the Edge runtime and this module
+ * is Node-only, so it inlines the same literal under the C001 rule that already
+ * duplicates the auth constants.
+ */
+exports.CM_INGRESS_HEADER = 'x-cm-ingress';
+/**
+ * Value of `CM_AUTH_SCOPE` that exempts the local listener from authentication.
+ *
+ * Any other value — absent, misspelt, `all` — leaves every listener
+ * authenticated, which is the pre-#2489 behaviour and the fail-closed default.
+ */
+exports.REMOTE_ONLY_AUTH_SCOPE = 'remote-only';
+/**
+ * Stamp the listener identity onto a request, discarding whatever the client
+ * sent under the same name.
+ *
+ * A plain assignment, not a merge: Node joins a repeated unknown header into
+ * one comma-separated string, and assigning replaces that string wholesale.
+ * Called for EVERY request on EVERY listener — a listener that forgot to stamp
+ * would leave the caller's own value in place, which is the one way this scheme
+ * can fail open.
+ *
+ * @param headers - The mutable `req.headers` of an incoming request or upgrade
+ * @param ingress - The listener the request arrived on
+ */
+function stampIngress(headers, ingress) {
+    headers[exports.CM_INGRESS_HEADER] = ingress;
+}
+/**
+ * Whether this request may skip authentication because of where it arrived.
+ *
+ * Fail-closed on both halves: the scope has to be exactly `remote-only`, and
+ * the stamp has to be exactly `local`. An unstamped request (no listener
+ * claimed it), an array value (a repeated header that somehow survived) and an
+ * unknown value all authenticate.
+ *
+ * @param headers - Request headers, after `server.ts` has stamped them
+ * @param env - Environment to read `CM_AUTH_SCOPE` from; defaults to the process's
+ * @returns true when the request came in on the local listener of a `remote-only` server
+ */
+function isIngressAuthExempt(headers, env = process.env) {
+    if (env.CM_AUTH_SCOPE !== exports.REMOTE_ONLY_AUTH_SCOPE)
+        return false;
+    return headers[exports.CM_INGRESS_HEADER] === 'local';
+}
 /**
  * Write a minimal HTTP error response to a raw upgrade socket and destroy it.
  * Used for 4xx / 5xx rejections in the /proxy/<prefix> upgrade branch.
@@ -239,6 +294,7 @@ function isExpectedWebSocketError(error) {
  * Issue #331: Added auth check on WebSocket upgrade
  *
  * @param server - HTTP or HTTPS server instance
+ * @param options - Extra listeners to serve the same WebSocket from (Issue #2489)
  *
  * @example
  * ```typescript
@@ -247,7 +303,7 @@ function isExpectedWebSocketError(error) {
  * server.listen(3000);
  * ```
  */
-function setupWebSocket(server) {
+function setupWebSocket(server, options) {
     wss = new ws_1.WebSocketServer({ noServer: true });
     // Issue #2220: this instance now owns the sockets, so publish the capability
     // the other module instances have to borrow. Registered before anything can
@@ -262,7 +318,7 @@ function setupWebSocket(server) {
     // map, which is what a broadcast has to reach.
     (0, waiting_broadcast_1.startWaitingStatusBroadcast)(handleBroadcast);
     // Handle upgrade requests - only accept app WebSocket connections, not Next.js HMR
-    server.on('upgrade', (request, socket, head) => {
+    const handleUpgrade = (request, socket, head) => {
         const pathname = request.url || '/';
         // Let Next.js handle its own HMR WebSocket connections in development.
         // In production there are no /_next/ WebSocket connections (no HMR).
@@ -292,7 +348,13 @@ function setupWebSocket(server) {
             }
         }
         // Issue #331: WebSocket authentication via Cookie header
-        if ((0, auth_1.isAuthEnabled)()) {
+        //
+        // Issue #2489: `isIngressAuthExempt` is the ONLY thing that can skip this,
+        // and it reads the same stamped header `middleware.ts` reads. HTTP and WS
+        // have to agree here: a phone drives the terminal over this socket, so a WS
+        // path that exempted more than the HTTP path would hand the tunnel a live
+        // shell while the screen behind it still asked for a password.
+        if ((0, auth_1.isAuthEnabled)() && !isIngressAuthExempt(request.headers)) {
             const cookieHeader = request.headers.cookie || '';
             const cookies = (0, auth_1.parseCookies)(cookieHeader);
             const token = cookies[auth_1.AUTH_COOKIE_NAME];
@@ -334,7 +396,14 @@ function setupWebSocket(server) {
         wss.handleUpgrade(request, socket, head, (ws) => {
             wss.emit('connection', ws, request);
         });
-    });
+    };
+    // Issue #2489: every listener gets the same handler, and therefore the same
+    // auth decision. `server.ts` has already stamped `x-cm-ingress` by the time
+    // this runs (its stamping listener is registered first, and listeners fire in
+    // registration order), so the handler never has to know which socket it is on.
+    for (const target of [server, ...(options?.additionalServers ?? [])]) {
+        target.on('upgrade', handleUpgrade);
+    }
     // Handle WebSocket server errors (e.g., invalid frames from clients)
     wss.on('error', (error) => {
         logger.error('server:error', { error: error.message });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commandmate",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "description": "A local control plane for agent CLIs — orchestration and visibility for Claude Code, Codex, Gemini CLI, and more across Git worktrees",
   "keywords": [
     "claude-code",

package/.next/server/chunks/1049.js

@@ -1 +0,0 @@
-"use strict";exports.id=1049,exports.ids=[964,1049,8583],exports.modules={3421:(a,b,c)=>{Object.defineProperty(b,"I",{enumerable:!0,get:function(){return g}});let d=c(71237),e=c(55088),f=c(17679);async function g(a,b,c,g){if((0,d.isNodeNextResponse)(b)){var h;b.statusCode=c.status,b.statusMessage=c.statusText;let d=["set-cookie","www-authenticate","proxy-authenticate","vary"];null==(h=c.headers)||h.forEach((a,c)=>{if("x-middleware-set-cookie"!==c.toLowerCase())if("set-cookie"===c.toLowerCase())for(let d of(0,f.splitCookiesString)(a))b.appendHeader(c,d);else{let e=void 0!==b.getHeader(c);(d.includes(c.toLowerCase())||!e)&&b.appendHeader(c,a)}});let{originalResponse:i}=b;c.body&&"HEAD"!==a.method?await (0,e.pipeToNodeResponse)(c.body,i,g):i.end()}}},7329:(a,b,c)=>{c.d(b,{Hv:()=>m,W3:()=>k,uK:()=>l});var d=c(90787),e=c(52660),f=c(18201),g=c(23854),h=c(49798),i=c(67164);let j=(0,c(72626).h)("relay-service");function k(a,b){for(let c of[b.from.worktreeId,b.to.worktreeId])if(!(0,h.r)(a,c))return{ok:!1,refusal:{code:"RELAY_WORKTREE_NOT_FOUND",message:`Worktree '${c}' not found`,worktreeId:c}};let c=(0,g.$G)({from:b.from,to:b.to,parentHops:function(a,b){try{let g=(0,h.S)(a,b),i=(0,e.getMessages)(a,b.worktreeId,{limit:5,limitUnit:"pairs",cliToolId:g.cliToolId,instanceId:b.instanceId,matchResolvedInstance:!0}).filter(a=>"user"===a.role),j=i.findIndex(a=>"relay"===a.messageType);if(-1===j)return null;let k=i[j];for(let a=0;a<j;a+=1){var c;if(c=i[a],c.timestamp.getTime()<k.timestamp.getTime()||(0,f.pk)(c.content)!==(0,f.pk)(k.content))return null}let l=(0,e.parseRelayRequestId)(k.requestId);if(!l)return null;return(0,d.Ip)(a,l)?.hops??null}catch(a){return j.warn("relay-parent-lookup-failed",{worktreeId:b.worktreeId,instanceId:b.instanceId,error:a instanceof Error?a.message:String(a)}),null}}(a,b.from),allowRelayChain:!0===b.allowRelayChain,openBetween:(0,d.Oz)(a,b.from,b.to)});if((0,g.Qe)(c))return{ok:!1,refusal:c};let k=b.now??Date.now(),l=(0,d.CR)(a,{from:b.from,to:b.to,hops:c.hops,expiresAt:k+(0,g.AL)(b.ttlMs),now:k});return j.info("relay-opened",{relayId:l.id,from:`${l.from.worktreeId}/${l.from.instanceId}`,to:`${l.to.worktreeId}/${l.to.instanceId}`,hops:l.hops}),(0,i._)(a,l.id,"requested",(0,h.S)(a,l.from),(0,h.S)(a,l.to),k),{ok:!0,relay:l}}function l(a,b,c=Date.now()){let e=(0,d.Ip)(a,b);return e?(0,d.m_)(a,b,c)?(j.info("relay-cancelled",{relayId:b}),{ok:!0,relay:(0,d.Ip)(a,b)??e}):{ok:!1,reason:"already_closed",relay:e}:{ok:!1,reason:"not_found",relay:null}}function m(a,b){return(0,d.M4)(a,b)}},18201:(a,b,c)=>{c.d(b,{Ce:()=>g,pk:()=>e});let d=(0,c(72626).h)("lib/history/user-turn-recorder");function e(a){return a.replace(/\r\n?/g,"\n").split("\n").map(a=>a.replace(/[ \t　]+$/u,"")).join("\n").trim()}function f(a){return{worktreeId:a.worktreeId,cliToolId:a.cliToolId,instanceId:a.instanceId??a.cliToolId}}async function g(a,b,h,i,j={}){let k=a.instanceId??a.cliToolId,l=e(h);if(0===b.length||0===l.length)return{outcome:"skipped",messageId:null,timestampMs:null};try{let[{getDbInstance:g},m,{broadcastMessage:n}]=await Promise.all([Promise.resolve().then(c.bind(c,88807)),Promise.resolve().then(c.bind(c,52660)),Promise.resolve().then(c.bind(c,49640))]),o=g(),p=m.findMessageByRequestId(o,a.worktreeId,b);if(p)return{outcome:"already-recorded",messageId:p.id,timestampMs:p.timestamp.getTime()};let q=i>0?i:Date.now(),r=function(a,b,c,g,h,i,j,k){var l,m,n;let o=Math.min(j-12e4,k.adoptionFromMs??1/0),p=(l=a.findUnkeyedUserMessages(b,{worktreeId:c.worktreeId,cliToolId:c.cliToolId,instanceId:g,fromMs:o,toMs:j+12e4,includeRelayDelivered:!0}),m=i,n=j,l.filter(a=>e(a.content)===m).sort((a,b)=>Math.abs(a.timestamp.getTime()-n)-Math.abs(b.timestamp.getTime()-n)));for(let e of p)if(!e.requestId&&a.setMessageRequestId(b,e.id,h))return d.info("user-turn-adopted",{...f(c),requestId:h,messageId:e.id,driftMs:e.timestamp.getTime()-j}),{outcome:"adopted",messageId:e.id,timestampMs:e.timestamp.getTime()};let q=p.find(a=>a.requestId);return q?(d.info("user-turn-already-relayed",{...f(c),requestId:h,messageId:q.id,relayRequestId:q.requestId??null,driftMs:q.timestamp.getTime()-j}),{outcome:"already-recorded",messageId:q.id,timestampMs:q.timestamp.getTime()}):null}(m,o,a,k,b,l,q,j);if(r)return r;let s=m.createMessage(o,{worktreeId:a.worktreeId,role:"user",content:h,messageType:"normal",timestamp:new Date(q),cliToolId:a.cliToolId,instanceId:k,requestId:b});return n("message",{worktreeId:a.worktreeId,message:s}),d.info("user-turn-recorded",{...f(a),requestId:b,contentLength:h.length}),{outcome:"inserted",messageId:s.id,timestampMs:q}}catch(c){return d.error("user-turn-record-failed",{...f(a),requestId:b,error:c instanceof Error?c.message:String(c)}),{outcome:"failed",messageId:null,timestampMs:null}}}},40964:(a,b,c)=>{c.d(b,{m:()=>g});var d=c(15194);let e=/^[a-zA-Z0-9_-]+$/;function f(a){if(!e.test(a))throw Error(`Invalid session name format: ${a}`)}function g(a,b,c){let e=`mcbd-${a}-${b}`;if(!c||c===a)return f(e),e;let g=(0,d.pL)(c,a),h=g?`${e}-${g}`:e;return f(h),h}},95736:(a,b,c)=>{a.exports=c(44870)}};