create-windy 0.6.14 → 0.6.15

package/template/apps/server/src/agent/client-session/creation.ts

@@ -0,0 +1,103 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import type { ModuleAiJsonValue } from "@southwind-ai/server-sdk";
+import type {
+  ClientAgentProviderPort,
+  ClientSessionAdmissionPort,
+  ClientSessionRecord,
+} from "./contracts.js";
+import { digestText, validDigest } from "./digest.js";
+import { ClientAgentSessionError, clientSessionInvalid } from "./errors.js";
+import { ensureTrailingSlash, publicLimits } from "./presentation.js";
+import type { ClientSessionRepository } from "./repository.js";
+
+export async function createClientAgentSession(input: {
+  readonly request: {
+    operationKey: string;
+    input: ModuleAiJsonValue;
+    clientBindingDigest: string;
+    hostSessionDigest: `sha256:${string}`;
+    actorId: string;
+  };
+  readonly launchAuthority: "direct" | "workflow-artifact";
+  readonly recovery: Promise<number>;
+  readonly provider: ClientAgentProviderPort;
+  readonly admission: ClientSessionAdmissionPort;
+  readonly repository: ClientSessionRepository;
+  readonly trustedBaseUrl: string;
+  readonly now: () => number;
+  readonly maxTtlMs: number;
+  readonly audit: (
+    record: ClientSessionRecord,
+    metadata: Readonly<Record<string, string>>,
+  ) => Promise<void>;
+}) {
+  await input.recovery;
+  if (!(await input.provider.ready())) {
+    throw new ClientAgentSessionError(
+      "PROVIDER_FAILED",
+      "Client Agent Provider 尚未就绪",
+      503,
+    );
+  }
+  const request = input.request;
+  if (
+    !validDigest(request.clientBindingDigest) ||
+    !validDigest(request.hostSessionDigest) ||
+    !request.actorId.trim()
+  ) {
+    throw clientSessionInvalid("Client Agent binding 或 Actor 无效");
+  }
+  const admission = await input.admission.admit({
+    operationKey: request.operationKey,
+    input: request.input,
+    actorId: request.actorId,
+    clientBindingDigest: request.clientBindingDigest,
+    launchAuthority: input.launchAuthority,
+  });
+  if (
+    admission.actorId !== request.actorId ||
+    admission.operationKey !== request.operationKey ||
+    admission.clientBindingDigest !== request.clientBindingDigest
+  ) {
+    throw new Error("Client Agent admission 返回了不一致的绑定");
+  }
+  const createdAt = input.now();
+  const expiresAt =
+    createdAt +
+    Math.min(admission.limits.maxDurationSeconds * 1_000, input.maxTtlMs);
+  const accessToken = `car_${randomBytes(32).toString("base64url")}`;
+  const record: ClientSessionRecord = {
+    ...admission,
+    sessionId: `cas_${randomUUID()}`,
+    clientRunId: `carun_${randomUUID()}`,
+    tokenHash: digestText(accessToken),
+    hostSessionDigest: request.hostSessionDigest,
+    modelAlias: input.provider.modelAlias,
+    createdAt,
+    expiresAt,
+    status: "active",
+    attemptCount: 0,
+    activeRequests: 0,
+    pendingAttempts: [],
+    receipts: [],
+  };
+  await input.repository.create(record);
+  await input.audit(record, {
+    inputCommitment: record.inputCommitment,
+    authorizationDigest: record.authorizationDigest,
+    bindingDigest: record.clientBindingDigest,
+  });
+  return {
+    clientRunId: record.clientRunId,
+    sessionId: record.sessionId,
+    trustedBaseUrl: new URL(
+      `${encodeURIComponent(record.sessionId)}/v1/`,
+      ensureTrailingSlash(input.trustedBaseUrl),
+    ).toString(),
+    modelAlias: record.modelAlias,
+    limits: publicLimits(record),
+    expiresAt: new Date(record.expiresAt).toISOString(),
+    accessToken,
+    capabilities: ["pageAgentClientRun"] as const,
+  };
+}

package/template/apps/server/src/agent/client-session/digest.ts

@@ -5,6 +5,16 @@ export function digestJson(value: ModuleAiJsonValue): `sha256:${string}` {
   return digestText(canonicalJson(value));
 }
 
+export function clientSessionTerminalDigest(
+  receiptIds: readonly string[],
+  clientResult?: ModuleAiJsonValue,
+): `sha256:${string}` {
+  return digestJson({
+    receiptIds: [...receiptIds],
+    ...(clientResult === undefined ? {} : { result: clientResult }),
+  });
+}
+
 export function digestText(value: string): `sha256:${string}` {
   return `sha256:${createHash("sha256").update(value).digest("hex")}`;
 }
@@ -22,7 +32,7 @@ export function sameSecret(left: string, right: string): boolean {
   );
 }
 
-function canonicalJson(value: ModuleAiJsonValue): string {
+export function canonicalJson(value: ModuleAiJsonValue): string {
   if (value === null || typeof value !== "object") {
     if (typeof value === "number" && !Number.isFinite(value)) {
       throw new TypeError("Client Agent JSON 不能包含非有限数值");

package/template/apps/server/src/agent/client-session/drizzle-records.ts

@@ -0,0 +1,150 @@
+import {
+  clientAgentReceipts,
+  clientAgentSessions,
+} from "@southwind-ai/database";
+import type { ModuleAiJsonValue } from "@southwind-ai/server-sdk";
+import { asc, eq } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type {
+  ClientSessionAdmission,
+  ClientSessionFinalResult,
+  ClientSessionReceiptRecord,
+  ClientSessionRecord,
+  ClientSessionStatus,
+} from "./contracts.js";
+
+type SessionRow = typeof clientAgentSessions.$inferSelect;
+type ReceiptRow = typeof clientAgentReceipts.$inferSelect;
+
+export async function findClientSessionRecord(
+  db: NodePgDatabase,
+  sessionId: string,
+) {
+  const [row] = await db
+    .select()
+    .from(clientAgentSessions)
+    .where(eq(clientAgentSessions.sessionId, sessionId))
+    .limit(1);
+  return row ? hydrateClientSessionRecord(db, row) : undefined;
+}
+
+export async function hydrateClientSessionRecord(
+  db: NodePgDatabase,
+  row: SessionRow,
+) {
+  const receipts = await db
+    .select()
+    .from(clientAgentReceipts)
+    .where(eq(clientAgentReceipts.sessionId, row.sessionId))
+    .orderBy(asc(clientAgentReceipts.attempt));
+  return mapClientSessionRecord(row, receipts.map(mapReceipt));
+}
+
+export function clientSessionValues(record: ClientSessionRecord) {
+  const admission: ClientSessionAdmission = {
+    actorId: record.actorId,
+    operationKey: record.operationKey,
+    releaseId: record.releaseId,
+    inputCommitment: record.inputCommitment,
+    authorizationDigest: record.authorizationDigest,
+    clientBindingDigest: record.clientBindingDigest,
+    deploymentKey: record.deploymentKey,
+    providerDataPolicy: record.providerDataPolicy,
+    limits: record.limits,
+  };
+  return {
+    sessionId: record.sessionId,
+    clientRunId: record.clientRunId,
+    actorId: record.actorId,
+    operationKey: record.operationKey,
+    releaseId: record.releaseId,
+    tokenHash: record.tokenHash,
+    clientBindingDigest: record.clientBindingDigest,
+    hostSessionDigest: record.hostSessionDigest,
+    modelAlias: record.modelAlias,
+    status: record.status,
+    attemptCount: record.attemptCount,
+    activeRequests: record.activeRequests,
+    pendingAttempts: [...record.pendingAttempts],
+    admissionJson: admission as unknown as Record<string, unknown>,
+    terminalDigest: record.terminalDigest,
+    finalResultJson: record.finalResult as Record<string, unknown> | undefined,
+    createdAt: record.createdAt,
+    expiresAt: record.expiresAt,
+  };
+}
+
+export function mapClientSessionRecord(
+  row: SessionRow,
+  receipts: readonly ClientSessionReceiptRecord[],
+): ClientSessionRecord {
+  const admission = row.admissionJson as unknown as ClientSessionAdmission;
+  return {
+    ...admission,
+    sessionId: row.sessionId,
+    clientRunId: row.clientRunId,
+    actorId: row.actorId,
+    operationKey: row.operationKey,
+    releaseId: row.releaseId,
+    tokenHash: row.tokenHash as `sha256:${string}`,
+    clientBindingDigest: row.clientBindingDigest as `sha256:${string}`,
+    hostSessionDigest: row.hostSessionDigest as `sha256:${string}`,
+    modelAlias: row.modelAlias,
+    status: row.status as ClientSessionStatus,
+    attemptCount: row.attemptCount,
+    activeRequests: row.activeRequests,
+    pendingAttempts: row.pendingAttempts,
+    receipts,
+    createdAt: row.createdAt,
+    expiresAt: row.expiresAt,
+    ...(row.terminalDigest
+      ? { terminalDigest: row.terminalDigest as `sha256:${string}` }
+      : {}),
+    ...(row.finalResultJson
+      ? {
+          finalResult:
+            row.finalResultJson as unknown as ClientSessionFinalResult,
+        }
+      : {}),
+  };
+}
+
+export function clientSessionReceiptValues(
+  sessionId: string,
+  receipt: ClientSessionReceiptRecord,
+) {
+  return {
+    receiptId: receipt.receiptId,
+    sessionId,
+    clientRunId: receipt.clientRunId,
+    actorId: receipt.actorId,
+    operationKey: receipt.operationKey,
+    releaseId: receipt.releaseId,
+    clientBindingDigest: receipt.clientBindingDigest,
+    attempt: receipt.attempt,
+    requestDigest: receipt.requestDigest,
+    responseDigest: receipt.responseDigest,
+    deploymentDigest: receipt.deploymentDigest,
+    canonicalResultJson: receipt.canonicalResult,
+    issuedAt: receipt.issuedAt,
+  };
+}
+
+function mapReceipt(row: ReceiptRow): ClientSessionReceiptRecord {
+  return {
+    receiptId: row.receiptId,
+    clientRunId: row.clientRunId,
+    actorId: row.actorId,
+    operationKey: row.operationKey,
+    releaseId: row.releaseId,
+    clientBindingDigest: row.clientBindingDigest as `sha256:${string}`,
+    attempt: row.attempt,
+    requestDigest: row.requestDigest as `sha256:${string}`,
+    responseDigest: row.responseDigest as `sha256:${string}`,
+    deploymentDigest: row.deploymentDigest as `sha256:${string}`,
+    issuedAt: row.issuedAt,
+    ...(row.canonicalResultJson === null
+      ? {}
+      : { canonicalResult: row.canonicalResultJson as ModuleAiJsonValue }),
+  };
+}

package/template/apps/server/src/agent/client-session/drizzle-repository.integration.test.ts

@@ -8,6 +8,7 @@ import type {
   ClientSessionRecord,
 } from "./contracts.js";
 import { DrizzleClientSessionRepository } from "./drizzle-repository.js";
+import { ClientSessionAttemptAuthorityBinding } from "./attempt-authority.js";
 
 const databaseUrl = process.env.CLIENT_AGENT_TEST_DATABASE_URL;
 const describePostgres = databaseUrl ? describe : describe.skip;
@@ -38,7 +39,25 @@ describePostgres("PostgreSQL Client Agent Session repository", () => {
   });
 
   test("重启恢复 session/receipt，且并发预留与终态保持原子", async () => {
-    const first = new DrizzleClientSessionRepository(drizzle(pool));
+    let transactionAuthorityChecks = 0;
+    const commitNow = 3_000;
+    const authority = new ClientSessionAttemptAuthorityBinding();
+    authority.bind({
+      async check() {
+        return "ordinary";
+      },
+      async checkTransaction(transaction, _facts, now) {
+        expect(transaction).toBeDefined();
+        expect(now).toBe(commitNow);
+        transactionAuthorityChecks += 1;
+        return "ordinary";
+      },
+    });
+    const first = new DrizzleClientSessionRepository(
+      drizzle(pool),
+      authority,
+      () => commitNow,
+    );
     await first.create(session());
     const [accepted, denied] = await Promise.all([
       first.reserveAttempt(caller()),
@@ -47,7 +66,11 @@ describePostgres("PostgreSQL Client Agent Session repository", () => {
     expect([accepted, denied].filter(Boolean)).toHaveLength(1);
     expect([accepted, denied].filter((value) => !value)).toHaveLength(1);
 
-    const restarted = new DrizzleClientSessionRepository(drizzle(pool));
+    const restarted = new DrizzleClientSessionRepository(
+      drizzle(pool),
+      authority,
+      () => commitNow,
+    );
     expect(await restarted.find("cas_1")).toMatchObject({
       clientRunId: "carun_1",
       attemptCount: 1,
@@ -75,8 +98,12 @@ describePostgres("PostgreSQL Client Agent Session repository", () => {
     });
 
     const completed = await restarted.completeAttempt("cas_1", receipt());
+    expect(transactionAuthorityChecks).toBe(1);
     expect(completed?.receipts).toHaveLength(1);
-    const afterReceipt = new DrizzleClientSessionRepository(drizzle(pool));
+    const afterReceipt = new DrizzleClientSessionRepository(
+      drizzle(pool),
+      authority,
+    );
     expect((await afterReceipt.find("cas_1"))?.receipts[0]).toEqual(receipt());
 
     const terminal = await afterReceipt.transition(

package/template/apps/server/src/agent/client-session/drizzle-repository.ts

@@ -2,24 +2,33 @@ import {
   clientAgentReceipts,
   clientAgentSessions,
 } from "@southwind-ai/database";
-import type { ModuleAiJsonValue } from "@southwind-ai/server-sdk";
-import { and, asc, eq, sql } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type {
-  ClientSessionAdmission,
-  ClientSessionFinalResult,
   ClientSessionReceiptRecord,
   ClientSessionRecord,
   ClientSessionStatus,
 } from "./contracts.js";
 import { receiptMatches, type ClientSessionRepository } from "./repository.js";
 import { sameSecret } from "./digest.js";
-
-type SessionRow = typeof clientAgentSessions.$inferSelect;
-type ReceiptRow = typeof clientAgentReceipts.$inferSelect;
+import {
+  clientSessionAttemptAuthorityFacts,
+  type ClientSessionAttemptAuthorityBinding,
+} from "./attempt-authority.js";
+import {
+  clientSessionReceiptValues as receiptValues,
+  clientSessionValues as sessionValues,
+  findClientSessionRecord as findRecord,
+  hydrateClientSessionRecord as hydrateRecord,
+  mapClientSessionRecord as mapRecord,
+} from "./drizzle-records.js";
 
 export class DrizzleClientSessionRepository implements ClientSessionRepository {
-  constructor(private readonly db: NodePgDatabase) {}
+  constructor(
+    private readonly db: NodePgDatabase,
+    private readonly attemptAuthority?: ClientSessionAttemptAuthorityBinding,
+    private readonly now: () => number = Date.now,
+  ) {}
 
   async recoverInterrupted(now: number): Promise<number> {
     return this.db.transaction(async (transaction) => {
@@ -101,6 +110,12 @@ export class DrizzleClientSessionRepository implements ClientSessionRepository {
       ) {
         return undefined;
       }
+      const authority = await this.attemptAuthority?.checkTransaction(
+        db,
+        clientSessionAttemptAuthorityFacts(record),
+        this.now(),
+      );
+      if (authority === "revoked") return undefined;
       await db
         .insert(clientAgentReceipts)
         .values(receiptValues(sessionId, receipt));
@@ -219,127 +234,3 @@ export class DrizzleClientSessionRepository implements ClientSessionRepository {
     });
   }
 }
-
-async function findRecord(db: NodePgDatabase, sessionId: string) {
-  const [row] = await db
-    .select()
-    .from(clientAgentSessions)
-    .where(eq(clientAgentSessions.sessionId, sessionId))
-    .limit(1);
-  return row ? hydrateRecord(db, row) : undefined;
-}
-
-async function hydrateRecord(db: NodePgDatabase, row: SessionRow) {
-  const receipts = await db
-    .select()
-    .from(clientAgentReceipts)
-    .where(eq(clientAgentReceipts.sessionId, row.sessionId))
-    .orderBy(asc(clientAgentReceipts.attempt));
-  return mapRecord(row, receipts.map(mapReceipt));
-}
-
-function sessionValues(record: ClientSessionRecord) {
-  const admission: ClientSessionAdmission = {
-    actorId: record.actorId,
-    operationKey: record.operationKey,
-    releaseId: record.releaseId,
-    inputCommitment: record.inputCommitment,
-    authorizationDigest: record.authorizationDigest,
-    clientBindingDigest: record.clientBindingDigest,
-    deploymentKey: record.deploymentKey,
-    providerDataPolicy: record.providerDataPolicy,
-    limits: record.limits,
-  };
-  return {
-    sessionId: record.sessionId,
-    clientRunId: record.clientRunId,
-    actorId: record.actorId,
-    operationKey: record.operationKey,
-    releaseId: record.releaseId,
-    tokenHash: record.tokenHash,
-    clientBindingDigest: record.clientBindingDigest,
-    hostSessionDigest: record.hostSessionDigest,
-    modelAlias: record.modelAlias,
-    status: record.status,
-    attemptCount: record.attemptCount,
-    activeRequests: record.activeRequests,
-    pendingAttempts: [...record.pendingAttempts],
-    admissionJson: admission as unknown as Record<string, unknown>,
-    terminalDigest: record.terminalDigest,
-    finalResultJson: record.finalResult as Record<string, unknown> | undefined,
-    createdAt: record.createdAt,
-    expiresAt: record.expiresAt,
-  };
-}
-
-function mapRecord(
-  row: SessionRow,
-  receipts: readonly ClientSessionReceiptRecord[],
-): ClientSessionRecord {
-  const admission = row.admissionJson as unknown as ClientSessionAdmission;
-  return {
-    ...admission,
-    sessionId: row.sessionId,
-    clientRunId: row.clientRunId,
-    actorId: row.actorId,
-    operationKey: row.operationKey,
-    releaseId: row.releaseId,
-    tokenHash: row.tokenHash as `sha256:${string}`,
-    clientBindingDigest: row.clientBindingDigest as `sha256:${string}`,
-    hostSessionDigest: row.hostSessionDigest as `sha256:${string}`,
-    modelAlias: row.modelAlias,
-    status: row.status as ClientSessionStatus,
-    attemptCount: row.attemptCount,
-    activeRequests: row.activeRequests,
-    pendingAttempts: row.pendingAttempts,
-    receipts,
-    createdAt: row.createdAt,
-    expiresAt: row.expiresAt,
-    ...(row.terminalDigest
-      ? { terminalDigest: row.terminalDigest as `sha256:${string}` }
-      : {}),
-    ...(row.finalResultJson
-      ? {
-          finalResult:
-            row.finalResultJson as unknown as ClientSessionFinalResult,
-        }
-      : {}),
-  };
-}
-
-function receiptValues(sessionId: string, receipt: ClientSessionReceiptRecord) {
-  return {
-    receiptId: receipt.receiptId,
-    sessionId,
-    clientRunId: receipt.clientRunId,
-    actorId: receipt.actorId,
-    operationKey: receipt.operationKey,
-    releaseId: receipt.releaseId,
-    clientBindingDigest: receipt.clientBindingDigest,
-    attempt: receipt.attempt,
-    requestDigest: receipt.requestDigest,
-    responseDigest: receipt.responseDigest,
-    deploymentDigest: receipt.deploymentDigest,
-    canonicalResultJson: receipt.canonicalResult,
-    issuedAt: receipt.issuedAt,
-  };
-}
-
-function mapReceipt(row: ReceiptRow): ClientSessionReceiptRecord {
-  return {
-    receiptId: row.receiptId,
-    clientRunId: row.clientRunId,
-    actorId: row.actorId,
-    operationKey: row.operationKey,
-    releaseId: row.releaseId,
-    clientBindingDigest: row.clientBindingDigest as `sha256:${string}`,
-    attempt: row.attempt,
-    requestDigest: row.requestDigest as `sha256:${string}`,
-    responseDigest: row.responseDigest as `sha256:${string}`,
-    deploymentDigest: row.deploymentDigest as `sha256:${string}`,
-    issuedAt: row.issuedAt,
-    ...(row.canonicalResultJson === null
-      ? {}
-      : { canonicalResult: row.canonicalResultJson as ModuleAiJsonValue }),
-  };
-}

package/template/apps/server/src/agent/client-session/finalization.ts

@@ -0,0 +1,99 @@
+import type { ModuleAiJsonValue } from "@southwind-ai/server-sdk";
+import type {
+  ClientSessionAdmissionPort,
+  ClientSessionFinalResult,
+  ClientSessionRecord,
+} from "./contracts.js";
+import { clientSessionTerminalDigest } from "./digest.js";
+import {
+  clientSessionConflict as conflict,
+  clientSessionInvalid as invalid,
+} from "./errors.js";
+import { sessionView } from "./presentation.js";
+import type { ClientSessionRepository } from "./repository.js";
+
+export async function finalizeClientSession(input: {
+  record: ClientSessionRecord;
+  repository: ClientSessionRepository;
+  admission: ClientSessionAdmissionPort;
+  receiptIds: readonly string[];
+  clientResult?: ModuleAiJsonValue;
+  canonicalizeResult?: (
+    proposedResult: ModuleAiJsonValue,
+  ) => Promise<ModuleAiJsonValue>;
+  audit(
+    record: ClientSessionRecord,
+    metadata: Readonly<Record<string, string | number | boolean>>,
+  ): Promise<void> | void;
+}) {
+  const terminalDigest = clientSessionTerminalDigest(
+    input.receiptIds,
+    input.clientResult,
+  );
+  if (input.record.status === "completed") {
+    if (input.record.terminalDigest === terminalDigest) {
+      return sessionView(input.record);
+    }
+    throw conflict("会话已完成，终态不可改写");
+  }
+  if (input.record.status !== "active" || input.record.activeRequests) {
+    throw conflict("会话当前不能 finalize");
+  }
+  const receipts = [...input.record.receipts].sort(
+    (left, right) => left.attempt - right.attempt,
+  );
+  if (
+    !receipts.length ||
+    input.receiptIds.length !== receipts.length ||
+    receipts.some(
+      (receipt, index) => receipt.receiptId !== input.receiptIds[index],
+    )
+  ) {
+    throw invalid("Finalize 必须提交本 Run 的完整终末 receipt 链");
+  }
+  const terminal = receipts.at(-1)!;
+  const projected = terminal.canonicalResult;
+  const proposedResult = projected ?? input.clientResult;
+  if (proposedResult === undefined) throw invalid("Finalize 缺少可公开结果");
+  await input.admission.validateResult(
+    input.record.operationKey,
+    proposedResult,
+  );
+  const result = input.canonicalizeResult
+    ? await input.canonicalizeResult(proposedResult)
+    : proposedResult;
+  await input.admission.validateResult(input.record.operationKey, result);
+  const finalResult: ClientSessionFinalResult = {
+    clientRunId: input.record.clientRunId,
+    status: "completed",
+    result,
+    attestation: {
+      source:
+        projected === undefined ? "client-projected" : "provider-observed",
+      terminalReceiptId: terminal.receiptId,
+      providerAttested: projected !== undefined,
+      clientProjected: projected === undefined,
+    },
+  };
+  const completed = await input.repository.transition(
+    input.record.sessionId,
+    "active",
+    "completed",
+    { terminalDigest, finalResult },
+  );
+  if (!completed) {
+    const concurrent = await input.repository.find(input.record.sessionId);
+    if (
+      concurrent?.status === "completed" &&
+      concurrent.terminalDigest === terminalDigest
+    ) {
+      return sessionView(concurrent);
+    }
+    throw conflict("Finalize 与其它终态操作冲突");
+  }
+  await input.audit(completed, {
+    terminalReceiptId: terminal.receiptId,
+    clientProjected: projected === undefined,
+  });
+  return sessionView(completed);
+}

package/template/apps/server/src/agent/client-session/host-auth.ts

@@ -39,11 +39,22 @@ export function createClientAgentHostAuthRouteApp(input: {
         };
         if (!(await input.adapter.ready(context.request.signal)))
           throw unavailable();
-        const principal = await input.adapter.authenticate({
-          token: hostToken(context.request, path),
-          purpose: isCompletion(path) ? "completion" : "control",
-          signal: context.request.signal,
-        });
+        const purpose = isCompletion(path) ? "completion" : "control";
+        const token = hostToken(context.request);
+        const principal = token
+          ? await input.adapter.authenticate({
+              token,
+              purpose,
+              signal: context.request.signal,
+            })
+          : context.guardContext.actor.type !== "anonymous"
+            ? await input.adapter.authenticateCurrentSession?.({
+                request: context.request,
+                actorId: context.guardContext.actor.id,
+                purpose,
+                signal: context.request.signal,
+              })
+            : undefined;
         const actor = principal
           ? await input.resolveActor(principal.actorId)
           : undefined;
@@ -84,12 +95,13 @@ export function createClientAgentHostAuthRouteApp(input: {
   };
 }
 
-function hostToken(request: Request, path: string): string {
-  const header = path.includes(":sessionId")
-    ? request.headers.get("x-windy-host-authorization")
-    : request.headers.get("authorization");
+function hostToken(request: Request): string | undefined {
+  const header =
+    request.headers.get("x-windy-host-authorization") ??
+    request.headers.get("authorization");
   const token = header?.match(/^Bearer\s+(.+)$/iu)?.[1];
-  if (!token?.startsWith("bax_")) throw hidden();
+  if (!token || token.startsWith("car_")) return undefined;
+  if (!token.startsWith("bax_")) throw hidden();
   return token;
 }