crewly 1.20.194 → 1.20.196

package/dist/backend/backend/src/middleware/agent-origin-correction.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Process-tree corrections of a request's agent identity, kept out of band.
+ *
+ * The agent-origin middleware proves from `X-Agent-Pid` which agent PTY a
+ * skill shell really runs under. When that contradicts the identity the
+ * shell claimed, it records the correction here. The caller-identity
+ * middleware (#999) reads it to override a leaked agent badge. A header
+ * would not do: a client could send it itself.
+ *
+ * @module middleware/agent-origin-correction
+ */
+/** The shell claimed `claimed`; its process runs under `actual`. */
+export interface AgentOriginCorrection {
+    claimed: string;
+    actual: string;
+}
+/**
+ * Record a correction for a request.
+ *
+ * @param req - Request object
+ * @param correction - Claimed and actual sessions
+ */
+export declare function setAgentOriginCorrection(req: object, correction: AgentOriginCorrection): void;
+/**
+ * The correction recorded for a request, if any.
+ *
+ * @param req - Request object
+ * @returns The correction or undefined
+ */
+export declare function getAgentOriginCorrection(req: object): AgentOriginCorrection | undefined;
+//# sourceMappingURL=agent-origin-correction.d.ts.map

package/dist/backend/backend/src/middleware/agent-origin-correction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-origin-correction.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin-correction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CACf;AAID;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEvF"}

package/dist/backend/backend/src/middleware/agent-origin-correction.js

@@ -0,0 +1,31 @@
+/**
+ * Process-tree corrections of a request's agent identity, kept out of band.
+ *
+ * The agent-origin middleware proves from `X-Agent-Pid` which agent PTY a
+ * skill shell really runs under. When that contradicts the identity the
+ * shell claimed, it records the correction here. The caller-identity
+ * middleware (#999) reads it to override a leaked agent badge. A header
+ * would not do: a client could send it itself.
+ *
+ * @module middleware/agent-origin-correction
+ */
+const corrections = new WeakMap();
+/**
+ * Record a correction for a request.
+ *
+ * @param req - Request object
+ * @param correction - Claimed and actual sessions
+ */
+export function setAgentOriginCorrection(req, correction) {
+    corrections.set(req, correction);
+}
+/**
+ * The correction recorded for a request, if any.
+ *
+ * @param req - Request object
+ * @returns The correction or undefined
+ */
+export function getAgentOriginCorrection(req) {
+    return corrections.get(req);
+}
+//# sourceMappingURL=agent-origin-correction.js.map

package/dist/backend/backend/src/middleware/agent-origin-correction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-origin-correction.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin-correction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,GAAG,IAAI,OAAO,EAAiC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,UAAiC;IACtF,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IACnD,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/backend/backend/src/middleware/agent-origin.middleware.d.ts

@@ -17,6 +17,12 @@
  */
 import type { Request, Response, NextFunction } from 'express';
 import { AgentProcessOriginService, type ProcessOrigin } from '../services/agent/agent-process-origin.service.js';
+/**
+ * PTY shell pid → session name for the live sessions.
+ *
+ * @returns Map (empty when no session backend is up)
+ */
+export declare function liveSessionPids(): Map<number, string>;
 /**
  * Apply a resolved origin to the request: rewrite a contradicted header and
  * warn about it, or warn that the command ran in a shared daemon.

package/dist/backend/backend/src/middleware/agent-origin.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-origin.middleware.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAAE,yBAAyB,EAAE,KAAK,aAAa,EAAE,MAAM,mDAAmD,CAAC;AA8DlH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAkB3F;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAuB5F;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAG/F"}
+{"version":3,"file":"agent-origin.middleware.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAAE,yBAAyB,EAAE,KAAK,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAMlH;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CASrD;AA4CD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAoB3F;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAuB5F;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAG/F"}

package/dist/backend/backend/src/middleware/agent-origin.middleware.js

@@ -20,13 +20,14 @@ import { LoggerService } from '../services/core/logger.service.js';
 import { getSessionBackendSync } from '../services/session/session-backend.factory.js';
 import { AgentProcessOriginService } from '../services/agent/agent-process-origin.service.js';
 import { isLoopbackAddress, isLoopbackRequest } from './api-token.middleware.js';
+import { setAgentOriginCorrection } from './agent-origin-correction.js';
 const logger = LoggerService.getInstance().createComponentLogger('AgentOriginMiddleware');
 /**
  * PTY shell pid → session name for the live sessions.
  *
  * @returns Map (empty when no session backend is up)
  */
-function liveSessionPids() {
+export function liveSessionPids() {
     const out = new Map();
     const backend = getSessionBackendSync();
     if (!backend)
@@ -84,6 +85,8 @@ function withTimeout(promise, ms) {
  */
 export function applyAgentOrigin(req, claimed, origin) {
     if (origin.session && origin.session !== claimed) {
+        // Out of band for the caller-identity middleware (#999): the header below is for logs.
+        setAgentOriginCorrection(req, { claimed, actual: origin.session });
         req.headers[AGENT_ORIGIN_CONSTANTS.CLAIMED_SESSION_HEADER] = claimed;
         req.headers[AGENT_ORIGIN_CONSTANTS.SESSION_HEADER] = origin.session;
         warnThrottled(`mismatch:${claimed}:${origin.session}`, 'Skill request claimed another agent\'s identity — its process runs under a different agent PTY; treating it as that agent. The runtime leaked the wrong CREWLY_SESSION_NAME into the agent\'s shell.', {

package/dist/backend/backend/src/middleware/agent-origin.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-origin.middleware.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAsB,MAAM,mDAAmD,CAAC;AAClH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEjF,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;AAE1F;;;;GAIG;AACH,SAAS,eAAe;IACvB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;QAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,IAAI,aAAa,GAAqC,IAAI,CAAC;AAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,IAA6B;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,sBAAsB,CAAC,gBAAgB;QAAE,OAAO;IACvF,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,EACD,GAAG,EAAE;YACJ,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,OAAe,EAAE,MAAqB;IACpF,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACpE,aAAa,CAAC,YAAY,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,sMAAsM,EAAE;YAC9P,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,OAAO;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,GAAG,CAAC,IAAI;SACd,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/C,aAAa,CAAC,UAAU,OAAO,EAAE,EAAE,0MAA0M,EAAE;YAC9O,cAAc,EAAE,OAAO;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI;SACd,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACrF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpG,IAAI,EAAE,CAAC;QACP,OAAO;IACR,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChG,IAAI,EAAE,CAAC;QACP,OAAO;IACR,CAAC;IACD,aAAa,KAAK,IAAI,yBAAyB,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,KAAK,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACtG,IAAI,CAAC;YACJ,IAAI,MAAM;gBAAE,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;gBAChE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACxF,aAAa,GAAG,OAAO,CAAC;IACxB,UAAU,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC"}
+{"version":3,"file":"agent-origin.middleware.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAsB,MAAM,mDAAmD,CAAC;AAClH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;QAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,IAAI,aAAa,GAAqC,IAAI,CAAC;AAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAG7C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,IAA6B;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,sBAAsB,CAAC,gBAAgB;QAAE,OAAO;IACvF,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,EACD,GAAG,EAAE;YACJ,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,OAAe,EAAE,MAAqB;IACpF,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAClD,uFAAuF;QACvF,wBAAwB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACpE,aAAa,CAAC,YAAY,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,sMAAsM,EAAE;YAC9P,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,OAAO;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,GAAG,CAAC,IAAI;SACd,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/C,aAAa,CAAC,UAAU,OAAO,EAAE,EAAE,0MAA0M,EAAE;YAC9O,cAAc,EAAE,OAAO;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI;SACd,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACrF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpG,IAAI,EAAE,CAAC;QACP,OAAO;IACR,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChG,IAAI,EAAE,CAAC;QACP,OAAO;IACR,CAAC;IACD,aAAa,KAAK,IAAI,yBAAyB,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,KAAK,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACtG,IAAI,CAAC;YACJ,IAAI,MAAM;gBAAE,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;gBAChE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACxF,aAAa,GAAG,OAAO,CAAC;IACxB,UAAU,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC"}

package/dist/backend/backend/src/middleware/api-token.middleware.d.ts

@@ -68,6 +68,26 @@ export declare function isLoopbackRequest(req: AddressableRequest): boolean;
  * @returns Presented token or null
  */
 export declare function extractPresentedToken(req: AddressableRequest, allowQuery: boolean): string | null;
+/**
+ * The API token a caller presented in a header (`Authorization: Bearer` or
+ * `X-Crewly-Token`) or, failing that, in the `crewly_token` cookie, and which
+ * of the two it was. A cookie is sent by the browser on its own, so a
+ * cookie-borne token alone does not authorise a write (#999).
+ *
+ * @param req - Request carrying headers
+ * @returns Token and source, or null when none was presented
+ */
+export declare function extractPresentedTokenWithSource(req: AddressableRequest): {
+    token: string;
+    source: 'header' | 'cookie';
+} | null;
+/**
+ * Parse a `Cookie` header (exported for the caller-identity middleware).
+ *
+ * @param header - Raw cookie header
+ * @returns Parsed cookies
+ */
+export declare function parseCookieHeader(header: string | undefined): Record<string, string>;
 /**
  * Whether a request presented a valid API token.
  *
@@ -116,23 +136,6 @@ export declare function isPublicHealthEnabled(): boolean;
  * @param next - Express next
  */
 export declare function healthGateMiddleware(req: Request, res: Response, next: NextFunction): void;
-/**
- * Express middleware for owner-only decisions (OKR approve/reject).
- *
- * Requires the API token EVEN from loopback — agents on the box do not have
- * it (the server strips `CREWLY_API_TOKEN` from agent PTY environments and
- * the token file is 0600), the dashboard does. Any request carrying an
- * `X-Agent-Session` header is refused outright with 403 so an agent cannot
- * approve its own proposal even if it somehow obtained the token.
- *
- * On success `res.locals.ownerTokenFingerprint` holds the first 8 hex chars
- * of sha256(token) for the audit trail.
- *
- * @param req - Express request
- * @param res - Express response
- * @param next - Express next
- */
-export declare function requireOwnerToken(req: Request, res: Response, next: NextFunction): void;
 /**
  * Decide whether a raw HTTP request (WebSocket upgrade or Engine.IO
  * handshake) may proceed.

package/dist/backend/backend/src/middleware/api-token.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.middleware.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/api-token.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAelE,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAShE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAElE;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA0BjG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAEtF;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAexF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAM1F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAiBvF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAkB9D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,GACnE,IAAI,CASN;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAuBjE"}
+{"version":3,"file":"api-token.middleware.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/api-token.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAYlE,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAShE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAElE;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA0BjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,kBAAkB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAM9H;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEpF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAEtF;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAexF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAM1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAkB9D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,GACnE,IAAI,CASN;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAuBjE"}

package/dist/backend/backend/src/middleware/api-token.middleware.js

@@ -21,14 +21,12 @@
  * @module middleware/api-token
  */
 import { API_SECURITY_CONSTANTS } from '../../../config/constants.js';
-import { verifyApiToken, getApiTokenFingerprint } from '../services/core/api-token.service.js';
+import { verifyApiToken } from '../services/core/api-token.service.js';
 import { verifyHs256Token } from './require-auth.middleware.js';
 import { LoggerService } from '../services/core/logger.service.js';
 const logger = LoggerService.getInstance().createComponentLogger('ApiTokenMiddleware');
 /** Path prefix of the chat-v2 WebSocket gateway (has its own JWT verifier). */
 const CHAT_WS_PATH = '/ws/chat';
-/** Header carrying the agent session identity (set by skill `api_call`). */
-const AGENT_SESSION_HEADER = 'x-agent-session';
 /**
  * Whether `X-Forwarded-For` should be trusted for loopback classification.
  *
@@ -135,6 +133,32 @@ export function extractPresentedToken(req, allowQuery) {
     }
     return null;
 }
+/**
+ * The API token a caller presented in a header (`Authorization: Bearer` or
+ * `X-Crewly-Token`) or, failing that, in the `crewly_token` cookie, and which
+ * of the two it was. A cookie is sent by the browser on its own, so a
+ * cookie-borne token alone does not authorise a write (#999).
+ *
+ * @param req - Request carrying headers
+ * @returns Token and source, or null when none was presented
+ */
+export function extractPresentedTokenWithSource(req) {
+    const headers = req.headers ?? {};
+    const fromHeaders = extractPresentedToken({ headers: { ...headers, cookie: undefined } }, false);
+    if (fromHeaders)
+        return { token: fromHeaders, source: 'header' };
+    const fromCookie = parseCookies(typeof headers.cookie === 'string' ? headers.cookie : undefined)[API_SECURITY_CONSTANTS.TOKEN_COOKIE];
+    return fromCookie ? { token: fromCookie, source: 'cookie' } : null;
+}
+/**
+ * Parse a `Cookie` header (exported for the caller-identity middleware).
+ *
+ * @param header - Raw cookie header
+ * @returns Parsed cookies
+ */
+export function parseCookieHeader(header) {
+    return parseCookies(header);
+}
 /**
  * Whether a request presented a valid API token.
  *
@@ -222,40 +246,6 @@ export function healthGateMiddleware(req, res, next) {
     }
     sendUnauthorized(res);
 }
-/**
- * Express middleware for owner-only decisions (OKR approve/reject).
- *
- * Requires the API token EVEN from loopback — agents on the box do not have
- * it (the server strips `CREWLY_API_TOKEN` from agent PTY environments and
- * the token file is 0600), the dashboard does. Any request carrying an
- * `X-Agent-Session` header is refused outright with 403 so an agent cannot
- * approve its own proposal even if it somehow obtained the token.
- *
- * On success `res.locals.ownerTokenFingerprint` holds the first 8 hex chars
- * of sha256(token) for the audit trail.
- *
- * @param req - Express request
- * @param res - Express response
- * @param next - Express next
- */
-export function requireOwnerToken(req, res, next) {
-    const agentSession = req.headers[AGENT_SESSION_HEADER];
-    if (typeof agentSession === 'string' && agentSession.length > 0) {
-        res.status(403).json({
-            success: false,
-            error: API_SECURITY_CONSTANTS.ERRORS.OWNER_APPROVAL_REQUIRED,
-            hint: 'This decision must be made by the owner from the dashboard or with the API token, not by an agent session.',
-        });
-        return;
-    }
-    const presented = extractPresentedToken(req, false);
-    if (!verifyApiToken(presented)) {
-        sendUnauthorized(res);
-        return;
-    }
-    res.locals.ownerTokenFingerprint = getApiTokenFingerprint(presented);
-    next();
-}
 /**
  * Decide whether a raw HTTP request (WebSocket upgrade or Engine.IO
  * handshake) may proceed.

package/dist/backend/backend/src/middleware/api-token.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.middleware.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/api-token.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAEnE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;AAEvF,+EAA+E;AAC/E,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAS/C;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3F,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAQ,sBAAsB,CAAC,kBAAwC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,OAAO,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB,EAAE,UAAmB;IAChF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9E,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,UAAU,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CACpE,sBAAsB,CAAC,iBAAiB,CACzC,CAAC;YACF,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB,EAAE,UAAmB;IAC3E,OAAO,cAAc,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAa;IACrC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,YAAY;QACjD,IAAI,EAAE,sBAAsB,CAAC,iBAAiB;KAC/C,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAChF,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;QAC/D,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,WAAW;KACtB,CAAC,CAAC;IACH,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7F,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAClF,IAAI,qBAAqB,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACtF,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC/E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,uBAAuB;YAC5D,IAAI,EAAE,4GAA4G;SACnH,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,qBAAqB,GAAG,sBAAsB,CAAC,SAAmB,CAAC,CAAC;IAC/E,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;gBAC9E,IAAI,GAAG,IAAI,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,GAAG;oBAAE,OAAO,IAAI,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,QAAoE;IAEpE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;QACvE,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;IACH,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAsB;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAoC,CAAC;IACxF,UAAwD,CAAC,IAAI,GAAG,CAC/D,KAAc,EACd,GAAG,IAAe,EACT,EAAE;QACX,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAoB,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;oBACrE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;oBAClC,IAAI,EAAE,OAAO,CAAC,GAAG;iBAClB,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,CACV,kDAAkD,sBAAsB,CAAC,WAAW,oDAAoD,CACzI,CAAC;gBACF,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-token.middleware.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/api-token.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAEnE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;AAEvF,+EAA+E;AAC/E,MAAM,YAAY,GAAG,UAAU,CAAC;AAShC;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3F,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAQ,sBAAsB,CAAC,kBAAwC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,OAAO,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB,EAAE,UAAmB;IAChF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9E,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,UAAU,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CACpE,sBAAsB,CAAC,iBAAiB,CACzC,CAAC;YACF,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAuB;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACjG,IAAI,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjE,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtI,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB,EAAE,UAAmB;IAC3E,OAAO,cAAc,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAa;IACrC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,YAAY;QACjD,IAAI,EAAE,sBAAsB,CAAC,iBAAiB;KAC/C,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAChF,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;QAC/D,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,WAAW;KACtB,CAAC,CAAC;IACH,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7F,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAClF,IAAI,qBAAqB,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACtF,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;gBAC9E,IAAI,GAAG,IAAI,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,GAAG;oBAAE,OAAO,IAAI,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,QAAoE;IAEpE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;QACvE,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;IACH,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAsB;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAoC,CAAC;IACxF,UAAwD,CAAC,IAAI,GAAG,CAC/D,KAAc,EACd,GAAG,IAAe,EACT,EAAE;QACX,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAoB,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;oBACrE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;oBAClC,IAAI,EAAE,OAAO,CAAC,GAAG;iBAClB,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,CACV,kDAAkD,sBAAsB,CAAC,WAAW,oDAAoD,CACzI,CAAC;gBACF,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/middleware/caller-identity.middleware.d.ts

@@ -0,0 +1,213 @@
+/**
+ * Caller identity (#999, specs/2026-10-03-owner-auth.md).
+ *
+ * Decides who made an `/api` request from the credentials it carries — never
+ * from a header it left out:
+ *
+ * | kind          | credential                                                    |
+ * |---------------|---------------------------------------------------------------|
+ * | `agent`       | a valid agent badge, or (migration window) `X-Agent-Session`  |
+ * | `relay-owner` | the in-memory relay credential (phone / portal over the relay) |
+ * | `cloud`       | the in-memory cloud credential (Cloud-forwarded Slack)        |
+ * | `owner`       | the owner session cookie (+ CSRF on writes) or the API token  |
+ * | `anonymous`   | nothing of the above — never the owner                        |
+ *
+ * Any sign of an agent wins over an owner credential. The owner API token
+ * presented from THIS machine is checked against the process tree: a client
+ * process that belongs to an agent is that agent, not the owner.
+ *
+ * The answer is kept per request in a WeakMap (a client cannot set it) and
+ * read through {@link getCallerIdentity}, {@link isOwnerCaller} and
+ * {@link rejectNonOwner}.
+ *
+ * @module middleware/caller-identity
+ */
+import type { Request, RequestHandler, Response } from 'express';
+import { PeerProcessService } from '../services/core/peer-process.service.js';
+/** Who a caller is. */
+export type CallerKind = 'owner' | 'agent' | 'relay-owner' | 'cloud' | 'anonymous';
+/** How the caller was identified. */
+export type CallerVia = 'owner-session' | 'api-token' | 'agent-badge' | 'legacy-header' | 'process-tree' | 'relay' | 'cloud' | 'none';
+/** The identity of one request's caller. */
+export interface CallerIdentity {
+    kind: CallerKind;
+    via: CallerVia;
+    /** The agent session (agents only; may be unknown for a process-tree match) */
+    session?: string;
+    /** The owner session id (owner via session only) */
+    ownerSessionId?: string;
+    /** Why an owner-looking credential was not accepted, or other detail for logs */
+    note?: string;
+}
+/** The request parts classification reads. */
+export type IdentifiableRequest = Pick<Request, 'headers'> & {
+    method?: string;
+    socket?: {
+        remoteAddress?: string;
+        remotePort?: number;
+        localPort?: number;
+    } | null;
+};
+/**
+ * The owner session a request's cookies carry, if any verifies. Every
+ * `crewly_owner_*` cookie is tried: the port suffix only keeps instances on
+ * one host from overwriting each other, and a cookie from another instance
+ * was signed with another secret and simply does not verify.
+ *
+ * @param req - Request
+ * @returns The session, or null
+ */
+export declare function readOwnerSession(req: IdentifiableRequest): {
+    id: string;
+} | null;
+/**
+ * Classify without a process lookup. A local API-token caller is anonymous
+ * here (it needs {@link callerIdentityMiddleware}'s process check to be the
+ * owner); everything else is decided exactly as the middleware would.
+ *
+ * @param req - Request
+ * @returns The identity
+ */
+export declare function classifyCallerSync(req: IdentifiableRequest): CallerIdentity;
+/**
+ * Classify with the process check for a local API-token caller.
+ *
+ * @param req - Request
+ * @param peers - Process classifier
+ * @returns The identity
+ */
+export declare function classifyCaller(req: IdentifiableRequest, peers: PeerProcessService): Promise<CallerIdentity>;
+/**
+ * Store a request's identity (the middleware; tests).
+ *
+ * @param req - Request
+ * @param identity - Identity
+ */
+export declare function setCallerIdentity(req: object, identity: CallerIdentity): void;
+/**
+ * The identity of a request's caller: what the middleware decided, or a
+ * synchronous classification for a request it did not see (unit tests that
+ * mount a router alone).
+ *
+ * @param req - Request
+ * @returns The identity
+ */
+export declare function getCallerIdentity(req: IdentifiableRequest): CallerIdentity;
+/**
+ * Whether the caller holds an owner credential: the dashboard session, the
+ * owner API token, or the phone / portal relay.
+ *
+ * @param req - Request
+ * @returns True for the owner
+ */
+export declare function isOwnerCaller(req: IdentifiableRequest): boolean;
+/**
+ * The agent session of the caller, when it is an agent.
+ *
+ * @param req - Request
+ * @returns Session or undefined
+ */
+export declare function callerAgentSession(req: IdentifiableRequest): string | undefined;
+/** The 401 body for a caller with no owner credential. */
+export declare const OWNER_AUTH_REQUIRED_BODY: Readonly<{
+    success: false;
+    error: "owner_auth_required";
+    code: "owner_auth_required";
+    message: "This action needs the owner: use the dashboard on this machine, the phone app, or the API token (`crewly token`).";
+}>;
+/**
+ * Whether a request comes from a browser that holds no valid owner session:
+ * a dashboard tab opened before the upgrade (its bundle never asks for a
+ * session), or one whose session ended with a backend restart.
+ *
+ * @param req - Request
+ * @returns True for a browser request without a session
+ */
+export declare function isBrowserWithoutSession(req: IdentifiableRequest): boolean;
+/**
+ * The 401 body for a caller with no owner credential. A browser without a
+ * session gets the plain instruction in `error` — what an old dashboard tab
+ * shows the owner — and every body carries `code: owner_auth_required`,
+ * which the new dashboard reacts to by refreshing its session and retrying.
+ *
+ * @param req - Request (optional)
+ * @returns Response body
+ */
+export declare function ownerAuthRequiredBody(req?: IdentifiableRequest): Record<string, unknown>;
+/**
+ * Thrown by handlers that map errors to responses themselves (decisions,
+ * project tickets): carries the owner-auth 401 body.
+ */
+export declare class OwnerAuthRequiredError extends Error {
+    readonly body: Record<string, unknown>;
+    readonly status = 401;
+    /**
+     * @param body - The 401 body ({@link ownerAuthRequiredBody})
+     */
+    constructor(body: Record<string, unknown>);
+}
+/**
+ * Answer 401 owner_auth_required. No `WWW-Authenticate: Crewly-Token`: the
+ * dashboard refreshes its session instead of prompting for the API token.
+ *
+ * @param res - Response
+ * @param req - Request, so a browser without a session is told to reload
+ */
+export declare function sendOwnerAuthRequired(res: Response, req?: IdentifiableRequest): void;
+/**
+ * Refuse a caller that is not the owner. Agents get `agentBody` (403, the
+ * route's own wording); everyone else without an owner credential gets 401.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param agentBody - 403 body for an agent
+ * @returns True when refused (response written)
+ *
+ * @example
+ * ```ts
+ * if (rejectNonOwner(req, res, { success: false, error: 'Only the owner can dismiss a ticket' })) return;
+ * ```
+ */
+export declare function rejectNonOwner(req: Request, res: Response, agentBody?: Record<string, unknown>): boolean;
+/**
+ * Express middleware form of {@link rejectNonOwner}.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param next - Next
+ */
+export declare const requireOwner: RequestHandler;
+/**
+ * Owner-only decisions with an audit fingerprint (OKR approve/reject, signal
+ * digest items). Agents get 403 `owner_approval_required`; a caller with no
+ * owner credential gets 401. Before #999 this required the raw API token
+ * even from loopback, so the local dashboard could not use it; the owner
+ * session now counts too.
+ *
+ * On success `res.locals.ownerTokenFingerprint` names the credential for the
+ * audit trail: 8 hex of sha256(API token), `session-<8 hex>` for a dashboard
+ * session, or `relay`.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param next - Next
+ */
+export declare const requireOwnerToken: RequestHandler;
+/**
+ * {@link requireOwner} with the route's own 403 wording for agents.
+ *
+ * @param agentBody - 403 body for an agent
+ * @returns Express middleware
+ */
+export declare function ownerOnly(agentBody: Record<string, unknown>): RequestHandler;
+/**
+ * Build the `/api` middleware.
+ *
+ * @param peers - Process classifier. The server passes one that knows the
+ *   live agent PTYs (`liveSessionPids` from the agent-origin middleware), so
+ *   the terminal check and session names work; without it only the
+ *   ancestry and environment checks run.
+ * @returns Express middleware
+ */
+export declare function createCallerIdentityMiddleware(peers?: PeerProcessService): RequestHandler;
+//# sourceMappingURL=caller-identity.middleware.d.ts.map

package/dist/backend/backend/src/middleware/caller-identity.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-identity.middleware.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/caller-identity.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAgB,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAW/E,OAAO,EAAE,kBAAkB,EAAmC,MAAM,0CAA0C,CAAC;AAO/G,uBAAuB;AACvB,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnF,qCAAqC;AACrC,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,WAAW,GACX,aAAa,GACb,eAAe,GACf,cAAc,GACd,OAAO,GACP,OAAO,GACP,MAAM,CAAC;AAEX,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,SAAS,CAAC;IACf,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8CAA8C;AAC9C,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACrF,CAAC;AAmDF;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAShF;AAoFD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,cAAc,CAG3E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAMjH;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE7E;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,GAAG,cAAc,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAG/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAG/E;AAED,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB;;;;;EAKnC,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAMzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWxF;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAMnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IALlD,QAAQ,CAAC,MAAM,OAAO;IAEtB;;OAEG;gBACkB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAGnD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAEpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAA6G,GAC7I,OAAO,CAST;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,cAG1B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,EAAE,cAsB/B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc,CAK5E;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,GAAE,kBAA6C,GAAG,cAAc,CAiCnH"}