handmux 0.27.2 → 0.29.0

package/dist/src/deviceAuth/service.js

@@ -0,0 +1,626 @@
+import { createHash, randomBytes, randomInt, randomUUID } from 'node:crypto';
+import { tokenEquals } from '../auth.js';
+export class DeviceAuthError extends Error {
+    code;
+    status;
+    constructor(code, message, status = 400) {
+        super(message);
+        this.code = code;
+        this.status = status;
+    }
+}
+export function parseExpire(value) {
+    if (value === 'never')
+        return null;
+    if (typeof value !== 'string' || !/^[1-9]\d*[mhd]$/.test(value))
+        throw new DeviceAuthError('INVALID_EXPIRE', 'Use a positive duration such as 1h, 7d, 30d, or never');
+    const unit = value.slice(-1);
+    const duration = Number(value.slice(0, -1)) * (unit === 'm' ? 60_000 : unit === 'h' ? 3_600_000 : 86_400_000);
+    if (!Number.isSafeInteger(duration) || duration > 8_640_000_000_000_000 - Date.now())
+        throw new DeviceAuthError('INVALID_EXPIRE', 'Duration is too large');
+    return duration;
+}
+export function validateName(value) {
+    if (typeof value !== 'string' || !value.trim() || [...value.trim()].length > 80 || /[\x00-\x1f\x7f-\x9f]/.test(value))
+        throw new DeviceAuthError('INVALID_NAME', 'Device name must contain 1–80 characters without control characters');
+    return value.trim();
+}
+const hash = (secret) => createHash('sha256').update(secret).digest('hex');
+function normalizeOrigin(value) {
+    if (typeof value !== 'string' || !value)
+        return null;
+    try {
+        const url = new URL(value);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password
+            || url.pathname !== '/' || url.search || url.hash)
+            return null;
+        return url.origin;
+    }
+    catch {
+        return null;
+    }
+}
+/** Normalize an additional trusted entry point. Wildcards are host-only and
+ * must be the left-most label (for example https://*.example.com). */
+export function normalizeOriginPattern(value) {
+    if (typeof value !== 'string' || !value.trim())
+        return null;
+    try {
+        const url = new URL(value.trim());
+        const host = url.hostname.toLowerCase();
+        const wildcard = host.startsWith('*.');
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password
+            || url.pathname !== '/' || url.search || url.hash || !host
+            || (host.includes('*') && !wildcard) || (wildcard && !/^\*\.[^.]+(?:\.[^.]+)+$/.test(host)))
+            return null;
+        return url.origin;
+    }
+    catch {
+        return null;
+    }
+}
+export function originPatternMatches(pattern, origin) {
+    try {
+        const expected = new URL(pattern);
+        const actual = new URL(origin);
+        if (expected.protocol !== actual.protocol || expected.port !== actual.port)
+            return false;
+        const host = expected.hostname.toLowerCase();
+        const candidate = actual.hostname.toLowerCase();
+        return host.startsWith('*.')
+            ? candidate !== host.slice(2) && candidate.endsWith(`.${host.slice(2)}`)
+            : candidate === host;
+    }
+    catch {
+        return false;
+    }
+}
+function originPortSuffix(origin) {
+    try {
+        const port = new URL(origin).port;
+        return port ? `_${port}` : '';
+    }
+    catch {
+        return '';
+    }
+}
+export const sessionCookieName = (origin) => origin.startsWith('https:') ? `__Host-handmux_session${originPortSuffix(origin)}` : `handmux_session_http${originPortSuffix(origin)}`;
+export const pairingCookieName = (origin) => origin.startsWith('https:') ? `__Host-handmux_pairing${originPortSuffix(origin)}` : `handmux_pairing_http${originPortSuffix(origin)}`;
+function readCookieSecret(req, name) {
+    const matches = (req.headers.cookie ?? '').split(';').map(v => v.trim()).filter(v => v.startsWith(`${name}=`));
+    if (matches.length !== 1)
+        return null;
+    const value = matches[0].slice(name.length + 1);
+    return /^[A-Za-z0-9_-]{43}$/.test(value) ? value : null;
+}
+export const readSessionSecret = (req, origin) => readCookieSecret(req, sessionCookieName(origin));
+export function readPairingCookies(req, origin) {
+    const prefix = `${pairingCookieName(origin)}_`;
+    const names = (req.headers.cookie ?? '').split(';').map(v => v.trim().split('=')[0] ?? '')
+        .filter(name => name.startsWith(prefix) && /^[a-f0-9]{32}$/.test(name.slice(prefix.length)));
+    // The HTTP header itself is bounded by Node. Cap additional hash lookups independently.
+    return [...new Set(names)].slice(0, 32).flatMap(name => { const secret = readCookieSecret(req, name); return secret ? [{ name, secret }] : []; });
+}
+export class DeviceAuthService {
+    get mode() { return this.trustedDeviceEnabled ? 'trusted-device' : 'token'; }
+    get available() { return !this.closed; }
+    tokenSecret;
+    tokenGeneration;
+    trustedDeviceEnabledState;
+    trustedOriginEnabledState;
+    db;
+    now;
+    write;
+    pending = new Map();
+    retired = new Map();
+    listeners = new Set();
+    activity = new Map();
+    expireNotified = new Set();
+    observedDevices = new Set();
+    timer;
+    flushTimer;
+    claimFailures = new Map();
+    closed = false;
+    constructor({ db, token = '', now = Date.now, onSuccessfulWrite = () => { } }) {
+        this.db = db;
+        this.tokenSecret = token;
+        this.now = now;
+        this.write = onSuccessfulWrite;
+        const devicePolicyRow = db.prepare("SELECT value FROM auth_meta WHERE key='trusted_device_enabled'").get();
+        const originPolicyRow = db.prepare("SELECT value FROM auth_meta WHERE key='trusted_origin_enabled'").get();
+        const parseBoolean = (value) => value === '1' ? true : value === '0' ? false : undefined;
+        const storedDevicePolicy = parseBoolean(devicePolicyRow?.value);
+        const storedOriginPolicy = parseBoolean(originPolicyRow?.value);
+        // New installations start with both protections enabled. Explicit policy values
+        // are persisted so a CLI change survives a restart.
+        this.trustedDeviceEnabledState = storedDevicePolicy ?? true;
+        this.trustedOriginEnabledState = storedOriginPolicy ?? true;
+        const generation = db.prepare("SELECT value FROM auth_meta WHERE key='token_generation'").get();
+        this.tokenGeneration = generation?.value ?? randomUUID();
+        this.transaction(() => {
+            db.prepare("INSERT INTO auth_meta(key,value) VALUES('token_generation',?) ON CONFLICT(key) DO NOTHING").run(this.tokenGeneration);
+            db.prepare("INSERT INTO auth_meta(key,value) VALUES('trusted_device_enabled',?) ON CONFLICT(key) DO NOTHING").run(this.trustedDeviceEnabledState ? '1' : '0');
+            db.prepare("INSERT INTO auth_meta(key,value) VALUES('trusted_origin_enabled',?) ON CONFLICT(key) DO NOTHING").run(this.trustedOriginEnabledState ? '1' : '0');
+        });
+        this.timer = setInterval(() => this.sweep(), 1000);
+        this.timer.unref();
+        this.flushTimer = setInterval(() => { try {
+            this.flush();
+        }
+        catch {
+            console.error('[auth] Activity flush failed; will retry');
+        } }, 30_000);
+        this.flushTimer.unref();
+    }
+    /** Token is always the first authentication factor. */
+    get tokenEnabled() { return !this.closed; }
+    get trustedDeviceEnabled() { return !this.closed && this.trustedDeviceEnabledState; }
+    get trustedOriginEnabled() { return !this.closed && this.trustedOriginEnabledState; }
+    policy() {
+        return { trustedDeviceEnabled: this.trustedDeviceEnabled, trustedOriginEnabled: this.trustedOriginEnabled };
+    }
+    get requiresTrustedDevice() { return this.trustedDeviceEnabled && this.activeDeviceCount() === 0; }
+    get trustedOrigins() {
+        const row = this.db.prepare("SELECT value FROM auth_meta WHERE key='trusted_origins'").get();
+        if (!row?.value)
+            return [];
+        try {
+            const parsed = JSON.parse(row.value);
+            if (!Array.isArray(parsed))
+                return [];
+            return [...new Set(parsed.map(normalizeOriginPattern).filter((v) => !!v))];
+        }
+        catch {
+            return [];
+        }
+    }
+    addTrustedOrigin(value) {
+        const normalized = normalizeOriginPattern(value);
+        if (!normalized)
+            throw new DeviceAuthError('INVALID_ORIGIN', 'Trusted access domain must be an origin such as https://*.example.com', 400);
+        const origins = this.trustedOrigins;
+        if (!origins.includes(normalized)) {
+            if (origins.length >= 64)
+                throw new DeviceAuthError('ORIGIN_LIMIT', 'Too many trusted access domains; remove one before adding another', 409);
+            origins.push(normalized);
+            this.transaction(() => this.db.prepare("INSERT INTO auth_meta(key,value) VALUES('trusted_origins',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(JSON.stringify(origins)));
+        }
+        return origins;
+    }
+    removeTrustedOrigin(value) {
+        const normalized = normalizeOriginPattern(value);
+        if (!normalized)
+            throw new DeviceAuthError('INVALID_ORIGIN', 'Trusted access domain must be an origin such as https://*.example.com', 400);
+        const origins = this.trustedOrigins.filter(origin => origin !== normalized);
+        this.transaction(() => {
+            this.db.prepare("INSERT INTO auth_meta(key,value) VALUES('trusted_origins',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(JSON.stringify(origins));
+        });
+        return origins;
+    }
+    inspectTrustedOriginRemoval(value) {
+        const normalized = normalizeOriginPattern(value);
+        if (!normalized)
+            throw new DeviceAuthError('INVALID_ORIGIN', 'Trusted access domain must be an origin', 400);
+        const now = Date.now();
+        const rows = this.db.prepare(`SELECT DISTINCT d.id, d.name, d.browser_summary, s.origin FROM auth_sessions s JOIN auth_devices d ON d.id=s.device_id WHERE s.revoked_at IS NULL AND d.revoked_at IS NULL AND (d.expires_at IS NULL OR d.expires_at > ?) AND s.origin IS NOT NULL`).all(now);
+        return rows.filter(row => originPatternMatches(normalized, row.origin)).map(({ id, name, browser_summary }) => ({ id, name, browser_summary }));
+    }
+    setTrustedOrigin(origin) {
+        let normalized;
+        try {
+            const url = new URL(origin);
+            if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+                throw new Error('invalid');
+            normalized = url.origin;
+        }
+        catch {
+            throw new DeviceAuthError('INVALID_ORIGIN', 'Trusted access address must be a complete origin', 400);
+        }
+        const origins = this.trustedOrigins;
+        if (!origins.some(pattern => originPatternMatches(pattern, normalized))) {
+            if (origins.length >= 64)
+                throw new DeviceAuthError('ORIGIN_LIMIT', 'Too many trusted access domains; remove one before adding another', 409);
+            origins.push(normalized);
+        }
+        this.transaction(() => {
+            this.db.prepare("INSERT INTO auth_meta(key,value) VALUES('trusted_origins',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(JSON.stringify(origins));
+        });
+    }
+    authenticateToken(provided, origin) {
+        if (!this.tokenEnabled || !this.tokenSecret || typeof provided !== 'string' || !provided || !tokenEquals(provided, this.tokenSecret))
+            return null;
+        return { deviceId: `token_${this.tokenGeneration}`, sessionId: `token_${this.tokenGeneration}`, expiresAt: null, origin };
+    }
+    isTokenPrincipal(principal) { return principal.deviceId.startsWith('token_'); }
+    setTrustedDeviceEnabled(enabled) {
+        this.requireMode();
+        this.transaction(() => this.db.prepare("INSERT INTO auth_meta(key,value) VALUES('trusted_device_enabled',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(enabled ? '1' : '0'));
+        this.trustedDeviceEnabledState = enabled;
+    }
+    setTrustedOriginEnabled(enabled) {
+        this.requireMode();
+        this.transaction(() => this.db.prepare("INSERT INTO auth_meta(key,value) VALUES('trusted_origin_enabled',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(enabled ? '1' : '0'));
+        this.trustedOriginEnabledState = enabled;
+    }
+    transaction(run) {
+        this.db.exec('BEGIN IMMEDIATE');
+        let out;
+        try {
+            out = run();
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            try {
+                this.db.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+        // Backup scheduling is auxiliary; it must never turn an already committed authorization into a
+        // reported failure or leave its in-memory pairing state behind the durable transaction.
+        try {
+            this.write();
+        }
+        catch {
+            console.error('[auth] Backup scheduling failed');
+        }
+        return out;
+    }
+    requireMode() {
+        if (this.closed)
+            throw new DeviceAuthError('DEVICE_AUTH_DISABLED', 'Authentication is unavailable; restart handmux and retry', 409);
+    }
+    onRevoke(listener) { this.listeners.add(listener); return () => this.listeners.delete(listener); }
+    notify(id) {
+        for (const p of this.pending.values())
+            if (p.approver?.deviceId === id && p.state === 'configuring') {
+                p.state = 'canceled';
+                this.retire(p);
+            }
+        for (const listener of this.listeners) {
+            try {
+                listener(id);
+            }
+            catch {
+                console.error('[auth] Capability cleanup failed');
+            }
+        }
+    }
+    device(id) {
+        const row = this.db.prepare('SELECT id,name,browser_summary,authorized_at,expires_at,last_used_at,revoked_at,version FROM auth_devices WHERE id=?').get(id);
+        if (!row)
+            throw new DeviceAuthError('DEVICE_NOT_FOUND', 'Device ID not found; use handmux auth device list', 404);
+        return { ...row, status: row.revoked_at !== null ? 'revoked' : row.expires_at !== null && row.expires_at <= this.now() ? 'expired' : 'active' };
+    }
+    isDeviceActive(id) {
+        if (this.closed)
+            return false;
+        if (id.startsWith('token_')) {
+            // The Token is an authentication factor, not a row in auth_devices.
+            // Once trusted-device protection is enabled, a Token alone must no
+            // longer authorize an existing session or stream.  The Token remains
+            // the first authentication factor for obtaining trusted-device access.
+            return this.tokenEnabled && !this.trustedDeviceEnabledState && id === `token_${this.tokenGeneration}`;
+        }
+        try {
+            return this.device(id).status === 'active';
+        }
+        catch (error) {
+            if (error instanceof DeviceAuthError)
+                return false;
+            throw error;
+        }
+    }
+    activeDeviceCount() {
+        return Number(this.db.prepare('SELECT COUNT(*) AS count FROM auth_devices WHERE revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)').get(this.now())?.count ?? 0);
+    }
+    isActive(principal) {
+        if (!this.isDeviceActive(principal.deviceId))
+            return false;
+        if (this.isTokenPrincipal(principal))
+            return principal.sessionId === principal.deviceId;
+        return !!this.db.prepare('SELECT id FROM auth_sessions WHERE id=? AND device_id=? AND revoked_at IS NULL').get(principal.sessionId, principal.deviceId);
+    }
+    authenticateRequest(req, origin) {
+        const secret = readSessionSecret(req, origin);
+        return secret ? this.authenticateSecret(secret, origin) : null;
+    }
+    authenticateSecret(secret, origin) {
+        if (this.closed)
+            return null;
+        const row = this.db.prepare(`SELECT s.id AS sessionId,s.device_id AS deviceId,d.expires_at AS expiresAt,s.origin
+      FROM auth_sessions s JOIN auth_devices d ON d.id=s.device_id WHERE s.secret_hash=? AND s.origin=?
+      AND s.transport=? AND s.revoked_at IS NULL AND d.revoked_at IS NULL AND (d.expires_at IS NULL OR d.expires_at>?)`).get(hash(secret), origin, origin.startsWith('https:') ? 'https' : 'http', this.now());
+        if (!row)
+            return null;
+        this.observedDevices.add(row.deviceId);
+        this.touch(row);
+        return row;
+    }
+    touch(principal) { if (!this.isTokenPrincipal(principal) && this.isActive(principal))
+        this.activity.set(principal.sessionId, { deviceId: principal.deviceId, at: this.now() }); }
+    flush() {
+        if (!this.activity.size)
+            return;
+        const entries = [...this.activity];
+        this.transaction(() => {
+            for (const [sessionId, { deviceId, at }] of entries) {
+                this.db.prepare('UPDATE auth_sessions SET last_used_at=MAX(last_used_at,?) WHERE id=?').run(at, sessionId);
+                this.db.prepare('UPDATE auth_devices SET last_used_at=MAX(last_used_at,?) WHERE id=?').run(at, deviceId);
+            }
+        });
+        for (const [id, value] of entries)
+            if (this.activity.get(id) === value)
+                this.activity.delete(id);
+    }
+    list() {
+        this.requireMode();
+        const ids = this.db.prepare('SELECT id FROM auth_devices ORDER BY last_used_at DESC,id').all();
+        return ids.map(({ id }) => { const d = this.device(id); for (const a of this.activity.values())
+            if (a.deviceId === id)
+                d.last_used_at = Math.max(d.last_used_at, a.at); return d; });
+    }
+    assertActive(principal) {
+        if (!this.isActive(principal))
+            throw new DeviceAuthError('SESSION_INVALID', 'This device is no longer authorized; pair again', 401);
+    }
+    edit(id, values, actor) {
+        this.requireMode();
+        if (values.name === undefined && values.expire === undefined)
+            throw new DeviceAuthError('INVALID_EDIT', 'Provide --name or --expire');
+        const name = values.name === undefined ? undefined : validateName(values.name);
+        if (name !== undefined && this.db.prepare('SELECT id FROM auth_devices WHERE name=? AND id<>? AND revoked_at IS NULL').get(name, id))
+            throw new DeviceAuthError('DEVICE_NAME_TAKEN', 'Device name is already in use', 409);
+        const duration = values.expire === undefined ? undefined : parseExpire(values.expire);
+        return this.transaction(() => {
+            if (actor)
+                this.assertActive(actor);
+            const d = this.device(id);
+            if (actor && (!Number.isSafeInteger(values.version) || Number(values.version) < 1))
+                throw new DeviceAuthError('INVALID_VERSION', 'Refresh the device details before saving');
+            if (values.version !== undefined && values.version !== d.version)
+                throw new DeviceAuthError('DEVICE_CONFLICT', 'Device changed elsewhere; refresh the details and try again', 409);
+            if (d.status !== 'active')
+                throw new DeviceAuthError('DEVICE_INACTIVE', 'Expired or revoked devices must pair again', 409);
+            const expires = duration === undefined ? d.expires_at : duration === null ? null : this.now() + duration;
+            this.db.prepare('UPDATE auth_devices SET name=?,expires_at=?,version=version+1 WHERE id=?').run(name ?? d.name, expires, id);
+            return { ...this.device(id), previousExpiresAt: d.expires_at };
+        });
+    }
+    revoke(id, actor) {
+        if (actor)
+            this.assertActive(actor);
+        this.requireMode();
+        const d = this.device(id);
+        if (d.revoked_at === null)
+            this.transaction(() => {
+                const now = this.now();
+                if (actor)
+                    this.assertActive(actor);
+                this.db.prepare('UPDATE auth_devices SET revoked_at=?,version=version+1 WHERE id=?').run(now, id);
+                this.db.prepare('UPDATE auth_sessions SET revoked_at=? WHERE device_id=? AND revoked_at IS NULL').run(now, id);
+            });
+        this.notify(id);
+        return this.device(id);
+    }
+    retire(p) { this.retired.set(p.code, this.now() + 600_000); }
+    updatePair(p) {
+        if (p.state === 'configuring' && p.approver && !this.isActive(p.approver)) {
+            p.state = 'canceled';
+            this.retire(p);
+        }
+        if ((p.state === 'waiting' || p.state === 'configuring') && p.expiresAt <= this.now()) {
+            p.state = 'expired';
+            this.retire(p);
+        }
+        if (p.state === 'authorized' && p.deviceId && !this.isDeviceActive(p.deviceId)) {
+            p.state = this.device(p.deviceId).status === 'expired' ? 'expired' : 'canceled';
+            this.retire(p);
+        }
+    }
+    view(p) { this.updatePair(p); return { id: p.id, state: p.state, ...(p.state === 'waiting' ? { code: p.code } : {}), expiresAt: p.expiresAt, origin: p.origin, ...(p.source ? { source: p.source } : {}) }; }
+    pairing(secret, origin) {
+        if (!secret)
+            return null;
+        const p = this.pending.get(hash(secret));
+        return p?.origin === origin ? this.view(p) : null;
+    }
+    createPairing(secret, origin, browserSummary) {
+        this.requireMode();
+        this.sweep();
+        const existing = secret ? this.pending.get(hash(secret)) : null;
+        if (existing?.origin === origin && (existing.state === 'waiting' || existing.state === 'configuring' || existing.state === 'authorized'))
+            return { pairing: this.view(existing) };
+        if (this.pending.size >= 256)
+            throw new DeviceAuthError('PAIRING_CAPACITY', 'Too many pending requests; wait a few minutes and try again', 429);
+        let code;
+        do {
+            code = String(randomInt(1_000_000)).padStart(6, '0');
+        } while (this.retired.has(code) || [...this.pending.values()].some(p => p.code === code));
+        const next = randomBytes(32).toString('base64url');
+        const p = { id: `pair_${randomUUID().replaceAll('-', '')}`, secretHash: hash(next), origin, code, state: 'waiting', expiresAt: this.now() + 60_000, browserSummary: browserSummary.replace(/[\x00-\x1f\x7f-\x9f]/g, '').slice(0, 160) || 'Browser' };
+        if (existing) {
+            existing.state = 'canceled';
+            this.retire(existing);
+            this.pending.delete(existing.secretHash);
+        }
+        this.pending.set(p.secretHash, p);
+        return { pairing: this.view(p), secret: next };
+    }
+    registerSelf(secret, origin, values) {
+        this.requireMode();
+        const existing = this.authenticateSecret(secret, origin);
+        if (existing)
+            return this.device(existing.deviceId);
+        validateName(values.name);
+        parseExpire(values.expire);
+        const pairing = this.pending.get(hash(secret));
+        if (!pairing || pairing.origin !== origin)
+            throw new DeviceAuthError('PAIRING_NOT_FOUND', 'Prepare this browser for registration and retry', 409);
+        this.updatePair(pairing);
+        const owner = `self:${pairing.secretHash}`;
+        if (pairing.state === 'waiting')
+            this.claim(pairing.code, owner);
+        const device = this.authorize(pairing.id, owner, values);
+        return device;
+    }
+    cancelPairing(secret, origin, id) {
+        this.requireMode();
+        const p = secret ? this.pending.get(hash(secret)) : null;
+        if (!p || p.origin !== origin || p.id !== id)
+            throw new DeviceAuthError('PAIRING_NOT_FOUND', 'Pairing request changed; refresh this page', 409);
+        if (p.state !== 'authorized') {
+            p.state = 'canceled';
+            this.retire(p);
+        }
+        return this.view(p);
+    }
+    claim(code, owner, approver) {
+        this.requireMode();
+        this.sweep();
+        if (approver)
+            this.assertActive(approver);
+        for (const [key, failures] of this.claimFailures) {
+            const recent = failures.filter(at => at > this.now() - 60_000);
+            if (recent.length)
+                this.claimFailures.set(key, recent);
+            else
+                this.claimFailures.delete(key);
+        }
+        const failureKey = approver ? `web:${approver.sessionId}` : 'cli';
+        const failures = this.claimFailures.get(failureKey) ?? [];
+        if (failures.length >= 10 || (!this.claimFailures.has(failureKey) && this.claimFailures.size >= 1024))
+            throw new DeviceAuthError('CLAIM_RATE_LIMIT', 'Too many invalid codes; wait one minute before trying again', 429);
+        const p = typeof code === 'string' && /^\d{6}$/.test(code) ? [...this.pending.values()].find(p => p.code === code && p.state === 'waiting') : undefined;
+        if (!p) {
+            failures.push(this.now());
+            this.claimFailures.set(failureKey, failures);
+            throw new DeviceAuthError('CODE_INVALID', 'Code is invalid, expired, or already used; request a fresh code', 409);
+        }
+        p.state = 'configuring';
+        p.owner = owner;
+        p.source = approver ? 'web' : 'cli';
+        if (approver)
+            p.approver = approver;
+        p.expiresAt = this.now() + 300_000;
+        this.retire(p);
+        return { id: p.id, browserSummary: p.browserSummary, expiresAt: p.expiresAt, origin: p.origin };
+    }
+    cancelOwner(owner) { for (const p of this.pending.values())
+        if (p.owner === owner && p.state === 'configuring') {
+            p.state = 'canceled';
+            this.retire(p);
+        } }
+    approvalView(p) {
+        this.updatePair(p);
+        return { id: p.id, state: p.state, browserSummary: p.browserSummary, expiresAt: p.expiresAt, source: 'web', origin: p.origin, ...(p.state === 'authorized' && p.deviceId ? { device: this.device(p.deviceId) } : {}) };
+    }
+    approvals(actor) {
+        this.assertActive(actor);
+        return [...this.pending.values()].filter(p => p.source === 'web' && p.owner === `web:${actor.sessionId}`).map(p => this.approvalView(p));
+    }
+    approval(actor, id) {
+        const result = this.approvals(actor).find(p => p.id === id);
+        if (!result)
+            throw new DeviceAuthError('PAIRING_NOT_FOUND', 'This request is unavailable or belongs to another device', 404);
+        return result;
+    }
+    claimWeb(code, actor) {
+        this.assertActive(actor);
+        const owner = `web:${actor.sessionId}`;
+        const previous = [...this.pending.values()].find(p => p.owner === owner && p.code === code);
+        if (previous) {
+            this.updatePair(previous);
+            if (previous.state === 'configuring' || previous.state === 'authorized')
+                return this.approvalView(previous);
+        }
+        const claimed = this.claim(code, owner, actor);
+        return this.approval(actor, claimed.id);
+    }
+    cancelApproval(actor, id) {
+        this.approval(actor, id);
+        const p = [...this.pending.values()].find(p => p.id === id);
+        if (p.state === 'configuring') {
+            p.state = 'canceled';
+            this.retire(p);
+        }
+        return this.approvalView(p);
+    }
+    authorizeWeb(actor, id, values) {
+        this.assertActive(actor);
+        return this.authorize(id, `web:${actor.sessionId}`, values);
+    }
+    authorize(id, owner, values) {
+        this.requireMode();
+        const name = validateName(values.name);
+        const duration = parseExpire(values.expire);
+        if (this.db.prepare('SELECT id FROM auth_devices WHERE name=? AND revoked_at IS NULL').get(name))
+            throw new DeviceAuthError('DEVICE_NAME_TAKEN', 'Device name is already in use', 409);
+        const p = [...this.pending.values()].find(p => p.id === id && p.owner === owner);
+        if (!p)
+            throw new DeviceAuthError('PAIRING_NOT_FOUND', 'Pairing is no longer owned by this operation', 409);
+        this.updatePair(p);
+        if (p.state === 'authorized' && p.deviceId)
+            return this.device(p.deviceId);
+        if (p.state !== 'configuring')
+            throw new DeviceAuthError('PAIRING_INACTIVE', 'Pairing was canceled or expired; request a new code', 409);
+        const deviceId = `dev_${randomUUID().replaceAll('-', '')}`;
+        const now = this.now();
+        const pairingOrigin = normalizeOriginPattern(p.origin);
+        const currentOrigins = this.trustedOrigins;
+        const originAlreadyListed = pairingOrigin
+            ? currentOrigins.some(pattern => originPatternMatches(pattern, pairingOrigin))
+            : false;
+        this.transaction(() => {
+            if (p.approver)
+                this.assertActive(p.approver);
+            this.db.prepare('INSERT INTO auth_devices(id,pairing_request_id,name,browser_summary,authorized_at,expires_at,last_used_at) VALUES(?,?,?,?,?,?,?)').run(deviceId, p.id, name, p.browserSummary, now, duration === null ? null : now + duration, now);
+            this.db.prepare('INSERT INTO auth_sessions(id,device_id,secret_hash,origin,transport,created_at,last_used_at) VALUES(?,?,?,?,?,?,?)').run(`ses_${randomUUID().replaceAll('-', '')}`, deviceId, p.secretHash, p.origin, p.origin.startsWith('https:') ? 'https' : 'http', now, now);
+            // Record the current access origin only after the pairing has been approved.
+            if (pairingOrigin && !originAlreadyListed) {
+                if (currentOrigins.length >= 64)
+                    throw new DeviceAuthError('ORIGIN_LIMIT', 'Too many trusted access domains; remove one before adding another', 409);
+                currentOrigins.push(pairingOrigin);
+                this.db.prepare("INSERT INTO auth_meta(key,value) VALUES('trusted_origins',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(JSON.stringify(currentOrigins));
+            }
+        });
+        p.state = 'authorized';
+        p.deviceId = deviceId;
+        return this.device(deviceId);
+    }
+    sweep() {
+        try {
+            for (const [key, p] of this.pending) {
+                this.updatePair(p);
+                if (p.expiresAt + 600_000 < this.now())
+                    this.pending.delete(key);
+            }
+            for (const [code, until] of this.retired)
+                if (until <= this.now())
+                    this.retired.delete(code);
+            if (this.closed)
+                return;
+            const expired = this.db.prepare('SELECT id FROM auth_devices WHERE revoked_at IS NULL AND expires_at IS NOT NULL AND expires_at<=?').all(this.now());
+            for (const { id } of expired)
+                if (!this.expireNotified.has(id)) {
+                    this.expireNotified.add(id);
+                    this.notify(id);
+                }
+        }
+        catch {
+            // A storage fault must stop already-authorized streams as well as fail new requests closed.
+            for (const id of this.observedDevices)
+                this.notify(id);
+            this.observedDevices.clear();
+            this.notify(`token_${this.tokenGeneration}`);
+            console.error('[auth] Expiry check unavailable; device connections closed');
+        }
+    }
+    close() { clearInterval(this.timer); clearInterval(this.flushTimer); try {
+        this.flush();
+    }
+    finally {
+        this.closed = true;
+        this.pending.clear();
+    } }
+}

package/dist/src/docs.js

@@ -1,4 +1,5 @@
 import { promises as fs } from 'node:fs';
+import { assertRequestAuthority } from './requestAuthority.js';
 import { homedir } from 'node:os';
 import { join, basename } from 'node:path';
 import { TextDecoder } from 'node:util';
@@ -239,6 +240,7 @@ export function createDocs({ home, extraRoots = [], maxDownloadBytes = MAX_TRANS
     async function resolveStashDir(rawCwd) {
         const rh = await realHomeP;
         const target = join(rh, '.handmux', 'uploads', encodeCwdKey(rawCwd));
+        assertRequestAuthority();
         try {
             await fs.mkdir(target, { recursive: true });
         }
@@ -320,6 +322,7 @@ export function createDocs({ home, extraRoots = [], maxDownloadBytes = MAX_TRANS
         if ('error' in parent)
             return parent;
         const target = join(parent.real, nm);
+        assertRequestAuthority();
         try {
             await fs.mkdir(target);
         }