crewly 1.20.168 → 1.20.169

package/dist/backend/backend/src/index.js

@@ -90,6 +90,7 @@ import { setMessageQueueService as setMessagingControllerQueueService } from './
 import { SystemResourceAlertService } from './services/monitoring/system-resource-alert.service.js';
 import { TokenUsageService } from './services/monitoring/token-usage.service.js';
 import { agentHeartbeatMiddleware } from './middleware/agent-heartbeat.middleware.js';
+import { agentOriginMiddleware } from './middleware/agent-origin.middleware.js';
 import { apiTokenMiddleware, healthGateMiddleware, socketIoAllowRequest, installWebSocketGate, } from './middleware/api-token.middleware.js';
 import { resolveApiToken } from './services/core/api-token.service.js';
 import { isHeadlessEnvironment, describeNetworkExposure } from './utils/network-exposure.utils.js';
@@ -1402,6 +1403,10 @@ export class CrewlyServer {
         // and the SPA shell are outside `/api` and stay open; `/health` has its
         // own gate below (#825).
         this.app.use('/api', apiTokenMiddleware);
+        // A skill's X-Agent-Session is checked against the agent PTY its process
+        // really runs under (X-Agent-Pid) and corrected when it names another
+        // agent — before the heartbeat and every controller read it.
+        this.app.use('/api', agentOriginMiddleware);
         // Agent heartbeat middleware - any API call with X-Agent-Session header updates heartbeat
         this.app.use('/api', agentHeartbeatMiddleware);
         // API routes