dominds 1.9.1 → 1.9.2

package/dist/llm/kernel-driver/subdialog.d.ts

@@ -1,3 +1,4 @@
+import { type CallerCourseNumber } from '@longrun-ai/kernel/types/storage';
 import { Dialog, DialogID, SubDialog } from '../../dialog';
 import type { KernelDriverDriveCallOptions, KernelDriverSubdialogReplyTarget } from './types';
 export type SubdialogReplyTarget = KernelDriverSubdialogReplyTarget;
@@ -13,6 +14,7 @@ export declare function supplyResponseToSupdialog(args: {
         course: number;
         genseq: number;
     };
+    callerCourseOverride?: CallerCourseNumber;
     scheduleDrive: ScheduleDriveFn;
     subdialog?: SubDialog;
 }): Promise<void>;

package/dist/llm/kernel-driver/subdialog.js

@@ -148,7 +148,7 @@ async function resolveLatestAssignmentAnchorRef(args) {
     return undefined;
 }
 async function supplyResponseToSupdialog(args) {
-    const { parentDialog, subdialogId, responseText, callType, callId, status = 'completed', calleeResponseRef, scheduleDrive, subdialog: maybeSubdialog, } = args;
+    const { parentDialog, subdialogId, responseText, callType, callId, status = 'completed', calleeResponseRef, callerCourseOverride, scheduleDrive, subdialog: maybeSubdialog, } = args;
     try {
         const result = await (0, subdialog_txn_1.withSubdialogTxnLock)(parentDialog.id, async () => {
             const pendingSubdialogs = await persistence_1.DialogPersistence.loadPendingSubdialogs(parentDialog.id, parentDialog.status);
@@ -231,6 +231,9 @@ async function supplyResponseToSupdialog(args) {
                 sessionSlug,
                 callId: pendingRecord?.callId,
                 callingCourse: pendingRecord?.callingCourse,
+                callerCourse: pendingRecord?.callingCourse !== undefined
+                    ? (0, storage_1.toCallerCourseNumber)(pendingRecord.callingCourse)
+                    : callerCourseOverride,
                 shouldRevive,
             };
         });
@@ -271,6 +274,10 @@ async function supplyResponseToSupdialog(args) {
             })
             : undefined;
         if (resolvedCallId !== '' && calleeResponseRef) {
+            if (result.callerCourse === undefined) {
+                throw new Error(`tellask response anchor invariant violation: missing callerCourse ` +
+                    `(parentId=${parentDialog.id.selfId}, subdialogId=${subdialogId.selfId}, callId=${resolvedCallId})`);
+            }
             const assignmentRef = await resolveLatestAssignmentAnchorRef({
                 calleeDialogId: subdialogId,
                 callId: resolvedCallId,
@@ -308,9 +315,7 @@ async function supplyResponseToSupdialog(args) {
                     ? (0, storage_1.toAssignmentGenerationSeqNumber)(assignmentRef.genseq)
                     : undefined,
                 callerDialogId: parentDialog.id.selfId,
-                callerCourse: result.callingCourse !== undefined
-                    ? (0, storage_1.toCallerCourseNumber)(result.callingCourse)
-                    : undefined,
+                callerCourse: result.callerCourse,
             };
             await persistence_1.DialogPersistence.appendEvent(subdialogId, calleeResponseRef.course, anchorRecord, parentDialog.status);
         }

package/dist/llm/kernel-driver/tellask-special.js

@@ -800,6 +800,7 @@ async function executeTellaskCall(dlg, mentionList, body, callId, callbacks, opt
                     course: sub.currentCourse,
                     genseq: finalized.responseGenseq,
                 },
+                callerCourseOverride: callingCourse !== undefined ? (0, storage_1.toCallerCourseNumber)(callingCourse) : undefined,
                 scheduleDrive: callbacks.scheduleDrive,
             });
             sub.setFbrConclusionToolsEnabled(false);

package/dist/persistence.js

@@ -2260,22 +2260,37 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
                 break;
             }
             case 'tellask_call_anchor_record': {
-                const anchorEvent = {
-                    type: 'tellask_call_anchor_evt',
-                    course,
-                    genseq: event.genseq,
-                    anchorRole: event.anchorRole ?? 'response',
-                    callId: event.callId,
-                    assignmentCourse: event.assignmentCourse,
-                    assignmentGenseq: event.assignmentGenseq,
-                    callerDialogId: event.callerDialogId,
-                    callerCourse: event.callerCourse,
-                    dialog: {
-                        selfId: dialog.id.selfId,
-                        rootId: dialog.id.rootId,
-                    },
-                    timestamp: event.ts,
-                };
+                const anchorEvent = event.anchorRole === 'assignment'
+                    ? {
+                        type: 'tellask_call_anchor_evt',
+                        course,
+                        genseq: event.genseq,
+                        anchorRole: 'assignment',
+                        callId: event.callId,
+                        assignmentCourse: event.assignmentCourse,
+                        assignmentGenseq: event.assignmentGenseq,
+                        dialog: {
+                            selfId: dialog.id.selfId,
+                            rootId: dialog.id.rootId,
+                        },
+                        timestamp: event.ts,
+                    }
+                    : {
+                        type: 'tellask_call_anchor_evt',
+                        course,
+                        genseq: event.genseq,
+                        anchorRole: 'response',
+                        callId: event.callId,
+                        assignmentCourse: event.assignmentCourse,
+                        assignmentGenseq: event.assignmentGenseq,
+                        callerDialogId: event.callerDialogId,
+                        callerCourse: event.callerCourse,
+                        dialog: {
+                            selfId: dialog.id.selfId,
+                            rootId: dialog.id.rootId,
+                        },
+                        timestamp: event.ts,
+                    };
                 if (ws.readyState === 1) {
                     ws.send(JSON.stringify(anchorEvent));
                 }

package/dist/priming.js

@@ -746,27 +746,47 @@ function normalizePrimingRecordFromJson(raw) {
             if (callerDialogId !== undefined && typeof callerDialogId !== 'string') {
                 throw new Error(`${context}.callerDialogId must be a string when provided`);
             }
-            const record = {
+            const baseRecord = {
                 ts: '',
                 type,
                 ...(0, storage_1.toRootGenerationAnchor)({
                     rootCourse: expectIntegerField(raw, 'rootCourse', context),
                     rootGenseq: expectIntegerField(raw, 'rootGenseq', context),
                 }),
-                anchorRole,
                 callId: expectStringField(raw, 'callId', context),
                 genseq: expectIntegerField(raw, 'genseq', context),
+                ...(assignmentCourse !== undefined
+                    ? { assignmentCourse: (0, storage_1.toAssignmentCourseNumber)(assignmentCourse) }
+                    : {}),
+                ...(assignmentGenseq !== undefined
+                    ? { assignmentGenseq: (0, storage_1.toAssignmentGenerationSeqNumber)(assignmentGenseq) }
+                    : {}),
             };
-            if (assignmentCourse !== undefined) {
-                record.assignmentCourse = (0, storage_1.toAssignmentCourseNumber)(assignmentCourse);
-            }
-            if (assignmentGenseq !== undefined) {
-                record.assignmentGenseq = (0, storage_1.toAssignmentGenerationSeqNumber)(assignmentGenseq);
-            }
-            if (callerDialogId !== undefined)
-                record.callerDialogId = callerDialogId;
-            if (callerCourse !== undefined) {
-                record.callerCourse = (0, storage_1.toCallerCourseNumber)(callerCourse);
+            let record;
+            switch (anchorRole) {
+                case 'assignment':
+                    if (callerDialogId !== undefined || callerCourse !== undefined) {
+                        throw new Error(`${context} assignment anchor must not provide callerDialogId/callerCourse`);
+                    }
+                    record = {
+                        ...baseRecord,
+                        anchorRole: 'assignment',
+                    };
+                    break;
+                case 'response':
+                    if (typeof callerDialogId !== 'string' || callerDialogId.trim() === '') {
+                        throw new Error(`${context}.callerDialogId must be a non-empty string for response`);
+                    }
+                    if (callerCourse === undefined) {
+                        throw new Error(`${context}.callerCourse is required for response`);
+                    }
+                    record = {
+                        ...baseRecord,
+                        anchorRole: 'response',
+                        callerDialogId,
+                        callerCourse: (0, storage_1.toCallerCourseNumber)(callerCourse),
+                    };
+                    break;
             }
             if (sourceTag)
                 record.sourceTag = sourceTag;

package/dist/server/api-routes.js

@@ -320,6 +320,22 @@ async function handleSaveCurrentCoursePriming(req, res) {
     }
 }
 async function handleWorkspaceFilePreviewPage(req, res, pathname) {
+    const pseudoPathRel = parseWorkspacePseudoPreviewPathname(pathname);
+    if (pseudoPathRel !== null) {
+        if (req.method !== 'GET') {
+            res.writeHead(405, { 'Content-Type': 'text/plain; charset=utf-8', Allow: 'GET' });
+            res.end('Method Not Allowed');
+            return true;
+        }
+        const urlObj = new URL(req.url ?? '', 'http://127.0.0.1');
+        const location = `${buildWorkspacePreviewRoutePath(pseudoPathRel)}${urlObj.search}`;
+        res.writeHead(307, {
+            Location: location,
+            'Cache-Control': 'no-store',
+        });
+        res.end();
+        return true;
+    }
     if (!(pathname === '/f' || pathname === '/f/' || pathname.startsWith('/f/'))) {
         return false;
     }
@@ -359,6 +375,8 @@ async function handleWorkspaceFilePreviewPage(req, res, pathname) {
             }
         }
     }
+    const initialPreviewPayload = await buildWorkspacePreviewPagePayload(pathRel);
+    const initialPreviewPayloadJson = serializeJsonForInlineScript(initialPreviewPayload);
     const html = `<!doctype html>
 <html lang="en">
   <head>
@@ -539,7 +557,7 @@ async function handleWorkspaceFilePreviewPage(req, res, pathname) {
           <div id="preview-meta" class="meta"></div>
         </div>
         <div class="body">
-          <div id="status" class="status">Loading workspace entry...</div>
+          <div id="status" class="status">Loading preview...</div>
           <div id="code-wrap" class="code-wrap" style="display:none;">
             <div id="code-view" class="code-view"></div>
           </div>
@@ -874,15 +892,10 @@ async function handleWorkspaceFilePreviewPage(req, res, pathname) {
           return;
         }
 
+        var initialPayload = ${initialPreviewPayloadJson};
         var search = new URLSearchParams(window.location.search);
         var line = parsePositiveInt(search.get('line'));
         var column = parsePositiveInt(search.get('column'));
-        var authFromUrl = search.get('auth');
-        var authFromStorage = null;
-        try { authFromStorage = window.localStorage.getItem('dominds.authKey'); } catch {}
-        var token =
-          (typeof authFromUrl === 'string' && authFromUrl.trim() !== '' ? authFromUrl.trim() : null) ||
-          (typeof authFromStorage === 'string' && authFromStorage.trim() !== '' ? authFromStorage.trim() : null);
 
         pathEl.textContent = previewPath.length > 0 ? previewPath : '.';
         if (line !== null) {
@@ -891,64 +904,44 @@ async function handleWorkspaceFilePreviewPage(req, res, pathname) {
           metaEl.textContent = '';
         }
 
-        var headers = { Accept: 'application/json' };
-        if (token !== null) {
-          headers['Authorization'] = 'Bearer ' + token;
-        }
-
         resetViews();
-        fetch('/api/workspace/entry?path=' + encodeURIComponent(previewPath), {
-          method: 'GET',
-          headers: headers,
-          cache: 'no-store'
-        })
-          .then(function (resp) {
-            return resp.json().catch(function () { return {}; }).then(function (payload) {
-              return { ok: resp.ok, status: resp.status, payload: payload };
-            });
-          })
-          .then(function (result) {
-            if (!result.ok || !result.payload || result.payload.success !== true || typeof result.payload.kind !== 'string') {
-              var msg = result.payload && typeof result.payload.error === 'string' && result.payload.error !== ''
-                ? result.payload.error
-                : ('Request failed: HTTP ' + String(result.status));
-              setError(msg);
-              return;
-            }
+        if (!initialPayload || initialPayload.success !== true || typeof initialPayload.kind !== 'string') {
+          var errorMessage =
+            initialPayload && typeof initialPayload.error === 'string' && initialPayload.error !== ''
+              ? initialPayload.error
+              : 'Failed to load preview';
+          setError(errorMessage);
+          return;
+        }
 
-            showReady();
-            pathEl.textContent =
-              typeof result.payload.path === 'string' && result.payload.path.length > 0
-                ? result.payload.path
-                : '.';
+        showReady();
+        pathEl.textContent =
+          typeof initialPayload.path === 'string' && initialPayload.path.length > 0
+            ? initialPayload.path
+            : '.';
 
-            if (result.payload.kind === 'file' && typeof result.payload.raw === 'string') {
-              var lang = detectLang(typeof result.payload.path === 'string' ? result.payload.path : previewPath);
-              var sizeText = formatBytes(result.payload.size);
-              var metaItems = [];
-              if (line !== null) metaItems.push('Line ' + String(line) + (column !== null ? ':' + String(column) : ''));
-              metaItems.push(lang);
-              if (sizeText) metaItems.push(sizeText);
-              metaEl.textContent = metaItems.join(' | ');
-              renderFile(result.payload.raw, lang, line, column);
-              return;
-            }
+        if (initialPayload.kind === 'file' && typeof initialPayload.raw === 'string') {
+          var lang = detectLang(typeof initialPayload.path === 'string' ? initialPayload.path : previewPath);
+          var sizeText = formatBytes(initialPayload.size);
+          var metaItems = [];
+          if (line !== null) metaItems.push('Line ' + String(line) + (column !== null ? ':' + String(column) : ''));
+          metaItems.push(lang);
+          if (sizeText) metaItems.push(sizeText);
+          metaEl.textContent = metaItems.join(' | ');
+          renderFile(initialPayload.raw, lang, line, column);
+          return;
+        }
 
-            if (result.payload.kind === 'directory' && Array.isArray(result.payload.entries)) {
-              metaEl.textContent = 'directory | ' + String(result.payload.entries.length) + ' entries';
-              renderDirectory(
-                typeof result.payload.path === 'string' ? result.payload.path : previewPath,
-                result.payload.entries,
-              );
-              return;
-            }
+        if (initialPayload.kind === 'directory' && Array.isArray(initialPayload.entries)) {
+          metaEl.textContent = 'directory | ' + String(initialPayload.entries.length) + ' entries';
+          renderDirectory(
+            typeof initialPayload.path === 'string' ? initialPayload.path : previewPath,
+            initialPayload.entries,
+          );
+          return;
+        }
 
-            setError('Invalid preview payload');
-          })
-          .catch(function (err) {
-            var msg = err && typeof err.message === 'string' ? err.message : 'Failed to load workspace entry';
-            setError(msg);
-          });
+        setError('Invalid preview payload');
       })();
     </script>
   </body>
@@ -1192,9 +1185,8 @@ async function handleApiRoute(req, res, pathname, context) {
         if (pathname === '/api/docs/read' && req.method === 'GET') {
             return await handleReadDocsMarkdown(req, res);
         }
-        // Read workspace file or directory content for markdown preview links.
-        if (pathname === '/api/workspace/entry' && req.method === 'GET') {
-            return await handleReadWorkspaceEntry(req, res);
+        if (pathname === '/api/markdown-links/resolve' && req.method === 'POST') {
+            return await handleResolveMarkdownLinks(req, res);
         }
         if (pathname === '/api/snippets/builtin' && req.method === 'GET') {
             const payload = await (0, snippets_routes_1.handleGetBuiltinSnippets)();
@@ -1437,6 +1429,7 @@ async function handleReadDocsMarkdown(req, res) {
     return true;
 }
 const WORKSPACE_FILE_PREVIEW_MAX_BYTES = 2 * 1024 * 1024;
+const RTWS_PSEUDO_ROUTE_SEGMENTS = ['workspace', 'rtws'];
 function ensurePathSuffixSeparator(input) {
     if (input.endsWith(path.sep))
         return input;
@@ -1473,6 +1466,25 @@ function normalizeRtwsRelativePath(input, options) {
     }
     return normalized;
 }
+function normalizeWorkspacePseudoRelativePath(input) {
+    const trimmed = input.trim();
+    for (const prefix of RTWS_PSEUDO_ROUTE_SEGMENTS) {
+        let tail = null;
+        if (trimmed === prefix || trimmed === `/${prefix}`) {
+            tail = '';
+        }
+        else if (trimmed.startsWith(`/${prefix}/`)) {
+            tail = trimmed.slice(prefix.length + 2);
+        }
+        else if (trimmed.startsWith(`${prefix}/`)) {
+            tail = trimmed.slice(prefix.length + 1);
+        }
+        if (tail !== null) {
+            return normalizeRtwsRelativePath(tail, { allowRoot: true });
+        }
+    }
+    return null;
+}
 function parseWorkspacePreviewPathname(pathname) {
     if (pathname === '/f' || pathname === '/f/')
         return '';
@@ -1502,6 +1514,47 @@ function parseWorkspacePreviewPathname(pathname) {
     }
     return normalizeRtwsRelativePath(decodedParts.join('/'), { allowRoot: true });
 }
+function parseWorkspacePseudoPreviewPathname(pathname) {
+    for (const prefixSegment of RTWS_PSEUDO_ROUTE_SEGMENTS) {
+        const prefix = `/${prefixSegment}`;
+        if (pathname === prefix || pathname === `${prefix}/`)
+            return '';
+        if (!pathname.startsWith(`${prefix}/`))
+            continue;
+        const tail = pathname.slice(prefix.length + 1);
+        if (tail.length < 1)
+            return '';
+        const rawParts = tail.split('/');
+        const decodedParts = [];
+        for (const rawPart of rawParts) {
+            if (rawPart.length < 1)
+                continue;
+            let decoded;
+            try {
+                decoded = decodeURIComponent(rawPart);
+            }
+            catch {
+                return null;
+            }
+            if (decoded.length < 1)
+                continue;
+            if (decoded.includes('/') || decoded.includes('\\') || decoded.includes('\0')) {
+                return null;
+            }
+            decodedParts.push(decoded);
+        }
+        return normalizeWorkspacePseudoRelativePath(decodedParts.join('/'));
+    }
+    return null;
+}
+function buildWorkspacePreviewRoutePath(pathRel) {
+    if (pathRel.length < 1)
+        return '/f';
+    return `/f/${pathRel
+        .split('/')
+        .map((segment) => encodeURIComponent(segment))
+        .join('/')}`;
+}
 async function getWorkspaceRootRealAbs() {
     const workspaceRootAbs = path.resolve(process.cwd());
     try {
@@ -1620,13 +1673,13 @@ async function readFileHead(fileAbsPath, maxBytes) {
         await file.close();
     }
 }
-async function handleReadWorkspaceEntry(req, res) {
-    const urlObj = new URL(req.url ?? '', 'http://127.0.0.1');
-    const pathRaw = urlObj.searchParams.get('path');
-    const pathRel = typeof pathRaw === 'string' ? normalizeRtwsRelativePath(pathRaw, { allowRoot: true }) : '';
+async function buildWorkspacePreviewPagePayload(pathRel) {
     if (pathRel === null) {
-        respondJson(res, 400, { success: false, error: 'Invalid workspace path' });
-        return true;
+        return {
+            success: false,
+            error: 'Invalid preview path. Expected /f/<rtws-relative-path> and no ..',
+            status: 400,
+        };
     }
     try {
         const resolved = await resolveWorkspacePreviewPath(pathRel);
@@ -1637,59 +1690,129 @@ async function handleReadWorkspaceEntry(req, res) {
                 dirAbsPath: resolved.resolvedAbsPath,
                 workspaceRootRealAbs: resolved.workspaceRootRealAbs,
             });
-            respondJson(res, 200, {
+            return {
                 success: true,
                 kind: 'directory',
                 path: pathRel,
                 entries,
-            });
-            return true;
+            };
         }
         if (!stat.isFile()) {
-            respondJson(res, 400, {
+            return {
                 success: false,
                 error: 'Path must resolve to a file or directory',
                 path: pathRel,
-            });
-            return true;
+                status: 400,
+            };
         }
         if (stat.size > WORKSPACE_FILE_PREVIEW_MAX_BYTES) {
-            respondJson(res, 413, {
+            return {
                 success: false,
                 error: `File too large for preview (max ${WORKSPACE_FILE_PREVIEW_MAX_BYTES} bytes)`,
                 path: pathRel,
-                size: stat.size,
-            });
-            return true;
+                status: 413,
+            };
         }
         const raw = await promises_1.default.readFile(resolved.candidateAbsPath, 'utf-8');
-        respondJson(res, 200, {
+        return {
             success: true,
             kind: 'file',
             path: pathRel,
             raw,
             size: stat.size,
-        });
-        return true;
+        };
     }
     catch (error) {
         const code = getErrorCode(error);
         if (code === 'ENOENT') {
-            respondJson(res, 404, { success: false, error: 'Path not found', path: pathRel });
-            return true;
+            return {
+                success: false,
+                error: 'Path not found',
+                path: pathRel,
+                status: 404,
+            };
         }
         if (code === 'OUTSIDE_RTWS') {
-            respondJson(res, 403, {
+            return {
                 success: false,
                 error: 'Path resolves outside rtws',
                 path: pathRel,
-            });
-            return true;
+                status: 403,
+            };
         }
-        log.error('Failed to read workspace entry', error, { path: pathRel });
-        respondJson(res, 500, { success: false, error: 'Failed to read workspace entry' });
+        log.error('Failed to build workspace preview payload', error, { path: pathRel });
+        return {
+            success: false,
+            error: 'Failed to load preview',
+            path: pathRel,
+            status: 500,
+        };
+    }
+}
+function serializeJsonForInlineScript(value) {
+    return JSON.stringify(value)
+        .replace(/</g, '\\u003c')
+        .replace(/>/g, '\\u003e')
+        .replace(/&/g, '\\u0026')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
+async function resolveWorkspaceEntryExists(pathRel) {
+    const resolved = await resolveWorkspacePreviewPath(pathRel);
+    const stat = await promises_1.default.stat(resolved.candidateAbsPath);
+    return stat.isFile() || stat.isDirectory();
+}
+async function handleResolveMarkdownLinks(req, res) {
+    let parsed;
+    try {
+        const body = await readRequestBody(req);
+        parsed = body.length > 0 ? JSON.parse(body) : {};
+    }
+    catch {
+        respondJson(res, 400, { success: false, error: 'Invalid JSON body' });
+        return true;
+    }
+    if (!isRecord(parsed)) {
+        respondJson(res, 400, { success: false, error: 'Invalid JSON body' });
         return true;
     }
+    const pathsRaw = parsed['paths'];
+    if (!Array.isArray(pathsRaw)) {
+        respondJson(res, 400, { success: false, error: '`paths` must be an array' });
+        return true;
+    }
+    const normalizedPaths = [];
+    for (const entry of pathsRaw) {
+        if (typeof entry !== 'string') {
+            respondJson(res, 400, { success: false, error: '`paths` entries must be strings' });
+            return true;
+        }
+        const normalized = normalizeRtwsRelativePath(entry, { allowRoot: true });
+        if (normalized === null) {
+            respondJson(res, 400, { success: false, error: `Invalid workspace path: ${entry}` });
+            return true;
+        }
+        normalizedPaths.push(normalized);
+    }
+    const uniquePaths = Array.from(new Set(normalizedPaths));
+    const results = await Promise.all(uniquePaths.map(async (pathRel) => {
+        try {
+            const exists = await resolveWorkspaceEntryExists(pathRel);
+            return { path: pathRel, exists };
+        }
+        catch (error) {
+            const code = getErrorCode(error);
+            if (code === 'ENOENT' || code === 'OUTSIDE_RTWS') {
+                return { path: pathRel, exists: false };
+            }
+            throw error;
+        }
+    }));
+    respondJson(res, 200, {
+        success: true,
+        results,
+    });
+    return true;
 }
 async function handleGetToolsRegistry(req, res) {
     try {

package/dist/server/auth.d.ts

@@ -35,6 +35,7 @@ export declare function isAuthEnabled(auth: AuthConfig): auth is Extract<AuthCon
     kind: 'enabled';
 }>;
 export declare function getHttpAuthCheck(req: IncomingMessage, auth: AuthConfig): AuthCheckResult;
+export declare function getHttpAuthCheckAllowUrlParam(req: IncomingMessage, auth: AuthConfig, requestUrl: URL): AuthCheckResult;
 export declare function getWebSocketAuthCheck(req: IncomingMessage, auth: AuthConfig): AuthCheckResult;
 export declare function formatAutoAuthUrl(params: {
     host: string;

package/dist/server/auth.js

@@ -51,6 +51,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeAuthConfig = computeAuthConfig;
 exports.isAuthEnabled = isAuthEnabled;
 exports.getHttpAuthCheck = getHttpAuthCheck;
+exports.getHttpAuthCheckAllowUrlParam = getHttpAuthCheckAllowUrlParam;
 exports.getWebSocketAuthCheck = getWebSocketAuthCheck;
 exports.formatAutoAuthUrl = formatAutoAuthUrl;
 const crypto = __importStar(require("crypto"));
@@ -86,6 +87,26 @@ function getHttpAuthCheck(req, auth) {
         ? { kind: 'ok' }
         : { kind: 'unauthorized', reason: 'invalid' };
 }
+function getHttpAuthCheckAllowUrlParam(req, auth, requestUrl) {
+    if (auth.kind === 'disabled')
+        return { kind: 'ok' };
+    const header = getSingleHeaderValue(req.headers.authorization);
+    if (header) {
+        const parsed = parseBearerAuthHeader(header);
+        if (!parsed)
+            return { kind: 'unauthorized', reason: 'invalid' };
+        return constantTimeEqual(parsed.token, auth.key)
+            ? { kind: 'ok' }
+            : { kind: 'unauthorized', reason: 'invalid' };
+    }
+    const queryToken = requestUrl.searchParams.get('auth');
+    if (typeof queryToken !== 'string' || queryToken === '') {
+        return { kind: 'unauthorized', reason: 'missing' };
+    }
+    return constantTimeEqual(queryToken, auth.key)
+        ? { kind: 'ok' }
+        : { kind: 'unauthorized', reason: 'invalid' };
+}
 function getWebSocketAuthCheck(req, auth) {
     if (auth.kind === 'disabled')
         return { kind: 'ok' };

package/dist/server/server-core.js

@@ -105,6 +105,21 @@ class HttpServerCore {
                     return;
                 }
             }
+            if (pathname === '/f' ||
+                pathname === '/f/' ||
+                pathname.startsWith('/f/') ||
+                pathname === '/workspace' ||
+                pathname === '/workspace/' ||
+                pathname.startsWith('/workspace/') ||
+                pathname === '/rtws' ||
+                pathname === '/rtws/' ||
+                pathname.startsWith('/rtws/')) {
+                const authCheck = (0, auth_1.getHttpAuthCheckAllowUrlParam)(req, this.config.auth ?? { kind: 'disabled' }, requestUrl);
+                if (authCheck.kind !== 'ok') {
+                    this.sendUnauthorized(res);
+                    return;
+                }
+            }
             // Backend-direct workspace file preview page.
             if (await (0, api_routes_1.handleWorkspaceFilePreviewPage)(req, res, pathname)) {
                 return;