handmux 0.27.2 → 0.29.0

package/dist/src/httpApi.js

@@ -30,7 +30,7 @@ import { projectTaskRoutes } from './projectTask/routes.js';
 import { apiAccountRoutes } from './routes/apiAccounts.js';
 // Re-exported for tests (test/keys.test.js) and any caller that imported it by this path historically.
 export { isAllowedKey } from './routes/terminal.js';
-export function createApiRouter({ token, commands = defaultCommands, docs = defaultDocs, git = defaultGit, events, uploadExts = DEFAULT_UPLOAD_EXTS, maxUploadBytes = MAX_TRANSFER_BYTES, asrEnv = process.env, previews, shortcuts = DEFAULT_SHORTCUTS, browser, browserBootstrap, previewDomain, workspace, agentRuntime, projectTask, apiAccounts, apiErrors, agentIntegrationContext, home = homedir(), stateFile = process.env.CLAUDE_STATE_FILE || claudeStatePath(homedir()), }) {
+export function createApiRouter({ token, commands = defaultCommands, docs = defaultDocs, git = defaultGit, events, authentication, deviceAuth = false, uploadExts = DEFAULT_UPLOAD_EXTS, maxUploadBytes = MAX_TRANSFER_BYTES, asrEnv = process.env, previews, shortcuts = DEFAULT_SHORTCUTS, shortcutState, browser, browserBootstrap, previewDomain, workspace, agentRuntime, projectTask, apiAccounts, apiErrors, agentIntegrationContext, home = homedir(), stateFile = process.env.CLAUDE_STATE_FILE || claudeStatePath(homedir()), }) {
     const r = express.Router();
     r.use(apiRequestContext(apiErrors));
     // Account responses, including auth failures and malformed JSON, must never be cached. Keep the
@@ -38,6 +38,10 @@ export function createApiRouter({ token, commands = defaultCommands, docs = defa
     if (apiAccounts) {
         r.use('/api-accounts', (req, res, next) => {
             res.setHeader('Cache-Control', 'no-store');
+            if (authentication) {
+                next();
+                return;
+            }
             const provided = bearerFrom(req.get('authorization'));
             if (provided && tokenEquals(provided, token))
                 next();
@@ -47,7 +51,7 @@ export function createApiRouter({ token, commands = defaultCommands, docs = defa
                 });
         });
     }
-    r.use(expressAuth(token));
+    r.use(authentication ?? expressAuth(token));
     r.use(express.json());
     const eventOptions = { commands, push };
     const claudeEvents = events || createClaudeEvents(eventOptions);
@@ -59,7 +63,7 @@ export function createApiRouter({ token, commands = defaultCommands, docs = defa
         })))),
     };
     const deps = {
-        token, commands, docs, git, push, notifications, claudeEvents,
+        token, commands, docs, git, push, notifications, claudeEvents, deviceAuth,
         agentIdentity: agentRuntime ?? legacyAgentIdentity,
         uploadExts, maxUploadBytes, asrEnv, shortcuts, home, stateFile,
         ...(agentRuntime !== undefined ? { agentRuntime } : {}),
@@ -69,6 +73,7 @@ export function createApiRouter({ token, commands = defaultCommands, docs = defa
         ...(browserBootstrap !== undefined ? { browserBootstrap } : {}),
         ...(previewDomain !== undefined ? { previewDomain } : {}),
         ...(agentIntegrationContext !== undefined ? { agentIntegrationContext } : {}),
+        ...(shortcutState ? { shortcutState } : {}),
     };
     r.use(sessionRoutes(deps));
     r.use(terminalRoutes(deps));

package/dist/src/paneInput.js

@@ -1,3 +1,4 @@
+import { assertRequestAuthority } from './requestAuthority.js';
 const SUBMIT_GAP_MS = 120;
 const paneInputTails = new Map();
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -5,7 +6,7 @@ const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 // text + submit in the same operation prevents two clients from interleaving `paste-buffer` and Enter.
 export async function serializePaneInput(paneId, operation) {
     const previous = paneInputTails.get(paneId) ?? Promise.resolve();
-    const current = previous.catch(() => { }).then(operation);
+    const current = previous.catch(() => { }).then(() => { assertRequestAuthority(); return operation(); });
     const tail = current.then(() => { }, () => { });
     paneInputTails.set(paneId, tail);
     try {
@@ -21,9 +22,11 @@ export function sendPanePrompt(commands, paneId, text, guard) {
         if (guard && !await guard.validate())
             return { nativeMutation: false };
         await commands.exitCopyModeIfActive(paneId);
+        assertRequestAuthority();
         await commands.sendText(paneId, text);
         if (text)
             await delay(SUBMIT_GAP_MS);
+        assertRequestAuthority();
         await commands.sendEnter(paneId);
         return { nativeMutation: true };
     });
@@ -31,12 +34,23 @@ export function sendPanePrompt(commands, paneId, text, guard) {
 export function interruptPane(commands, paneId) {
     return serializePaneInput(paneId, async () => {
         await commands.exitCopyModeIfActive(paneId);
+        assertRequestAuthority();
         await commands.sendKey(paneId, 'C-c');
     });
 }
+export function interruptClaudePane(commands, paneId) {
+    return serializePaneInput(paneId, async () => {
+        await commands.exitCopyModeIfActive(paneId);
+        await commands.sendKey(paneId, 'Escape');
+    });
+}
 export function sendPaneChoice(commands, paneId, choice) {
+    if (!/^[1-9]$/.test(choice))
+        throw new TypeError('Pane choice requires a single option digit');
     return serializePaneInput(paneId, async () => {
         await commands.exitCopyModeIfActive(paneId);
-        await commands.sendText(paneId, choice);
+        assertRequestAuthority();
+        // Menu shortcuts are key events; bracketed paste is not handled by Claude's selector.
+        await commands.sendKey(paneId, choice);
     });
 }

package/dist/src/previewServer.js

@@ -76,8 +76,25 @@ const errorCode = (error) => {
 };
 export function createPreview({ previews }) {
     const router = express.Router();
+    const deviceResponses = new Map();
+    previews.onRevoke?.((deviceId) => {
+        for (const response of deviceResponses.get(deviceId) || [])
+            response.destroy();
+        deviceResponses.delete(deviceId);
+    });
+    function track(entry, res) {
+        if (!entry.deviceId)
+            return;
+        const id = entry.deviceId;
+        let responses = deviceResponses.get(id);
+        if (!responses)
+            deviceResponses.set(id, responses = new Set());
+        responses.add(res);
+        res.once('close', () => { responses.delete(res); if (!responses.size)
+            deviceResponses.delete(id); });
+    }
     function resolveEntry(name, accessToken, res) {
-        const lookup = previews.get(name);
+        const lookup = previews.get(name, accessToken);
         if (lookup.state === 'missing') {
             res.status(404).type('html').send('<!doctype html><meta charset="utf-8"><h1>预览不存在</h1>');
             return null;
@@ -93,6 +110,7 @@ export function createPreview({ previews }) {
         return lookup.entry;
     }
     async function serve(entry, rest, prefix, res) {
+        track(entry, res);
         previewHeaders(res);
         const requested = fileFor(rest);
         const segments = requested.split('/');
@@ -112,6 +130,11 @@ export function createPreview({ previews }) {
         if (['.html', '.htm', '.css', '.js', '.mjs'].includes(extension)) {
             try {
                 const source = await fs.readFile(target, 'utf8');
+                if (res.destroyed)
+                    return;
+                // File reads yield: a device may have been revoked while the file was being loaded.
+                if (!resolveEntry(entry.name, entry.accessToken || '', res))
+                    return;
                 res.type(extension).send(rewritePreviewText(source, extension, prefix));
             }
             catch (error) {
@@ -187,11 +210,12 @@ export function createPreview({ previews }) {
         catch {
             return next();
         }
-        const lookup = previews.get(name);
+        const lookup = previews.get(name, accessToken);
         if (lookup.state !== 'active')
             return next();
         if (!credentialOk(accessToken, lookup.entry.accessToken))
             return next();
+        track(lookup.entry, res);
         previewHeaders(res);
         res.sendFile(req.path, { root: lookup.entry.dir, dotfiles: 'deny' }, (err) => {
             if (err && !res.headersSent)

package/dist/src/previews.js

@@ -45,6 +45,8 @@ function parsePreviewEntry(value, realHome) {
     if (!isUnder(realDir, realHome))
         return null;
     const entry = { name, dir: value.dir, expiresAt: value.expiresAt };
+    if (typeof value.deviceId === 'string' && value.deviceId)
+        entry.deviceId = value.deviceId;
     if (value.kind === 'static')
         entry.kind = 'static';
     if (typeof value.accessToken === 'string' && value.accessToken)
@@ -53,7 +55,7 @@ function parsePreviewEntry(value, realHome) {
         entry.createdAt = value.createdAt;
     return entry;
 }
-export function createPreviews({ home = homedir(), store = process.env.PREVIEW_STORE || path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../data/previews.json'), now = () => Date.now(), ttlMs = 2 * 60 * 60_000, randomToken = () => randomBytes(24).toString('base64url'), } = {}) {
+export function createPreviews({ home = homedir(), store = process.env.PREVIEW_STORE || path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../data/previews.json'), now = () => Date.now(), ttlMs = 2 * 60 * 60_000, randomToken = () => randomBytes(24).toString('base64url'), isDeviceActive, } = {}) {
     let realHome;
     try {
         realHome = fs.realpathSync(home);
@@ -65,6 +67,13 @@ export function createPreviews({ home = homedir(), store = process.env.PREVIEW_S
     let entries = readJsonArray(store)
         .map((value) => parsePreviewEntry(value, realHome))
         .filter((entry) => entry !== null);
+    // Never inherit capabilities from a previous mode/process, even from legacy files containing tokens.
+    for (const entry of entries)
+        if (entry.kind !== 'dynamic')
+            delete entry.accessToken;
+    const authorized = (entry) => isDeviceActive
+        ? Boolean(entry.deviceId && isDeviceActive(entry.deviceId)) : !entry.deviceId;
+    const revokeListeners = new Set();
     let flushedExpiries = new Map(entries.map((entry) => [entry.name, entry.expiresAt]));
     const flush = () => {
         // Access tokens are runtime capabilities. Open device tabs re-register after a restart and receive
@@ -88,7 +97,7 @@ export function createPreviews({ home = homedir(), store = process.env.PREVIEW_S
     // directory, expired row, or process-restored row without a runtime token receives a fresh one.
     const upsert = (fields) => {
         const ts = now();
-        const current = entries.find((entry) => entry.name === fields.name);
+        const current = entries.find((entry) => entry.name === fields.name && entry.kind !== 'dynamic' && entry.deviceId === fields.deviceId);
         if (current?.kind === fields.kind
             && current.dir === fields.dir
             && current.expiresAt > ts
@@ -98,7 +107,7 @@ export function createPreviews({ home = homedir(), store = process.env.PREVIEW_S
             flush();
             return resultFor(current);
         }
-        entries = entries.filter((entry) => entry.name !== fields.name);
+        entries = entries.filter((entry) => entry.name !== fields.name || (entry.kind !== 'dynamic' && entry.deviceId !== fields.deviceId));
         const entry = {
             ...fields,
             accessToken: randomToken(),
@@ -109,7 +118,7 @@ export function createPreviews({ home = homedir(), store = process.env.PREVIEW_S
         flush();
         return resultFor(entry);
     };
-    async function register({ name, dir, port }) {
+    async function register({ name, dir, port }, deviceId) {
         const nm = safePreviewName(name);
         if (!nm)
             return { error: 'bad name', status: 400 };
@@ -135,15 +144,20 @@ export function createPreviews({ home = homedir(), store = process.env.PREVIEW_S
         }
         if (!st.isDirectory())
             return { error: 'not a directory', status: 400 };
-        return upsert({ name: nm, kind: 'static', dir: real });
+        if (isDeviceActive && (!deviceId || !isDeviceActive(deviceId)))
+            return { error: 'device authorization expired', status: 401 };
+        return upsert({ name: nm, kind: 'static', dir: real, ...(isDeviceActive && deviceId ? { deviceId } : {}) });
     }
-    function get(name) {
-        const entry = entries.find((candidate) => candidate.name === name);
+    function get(name, accessToken) {
+        const entry = entries.find((candidate) => candidate.name === name
+            && (!isDeviceActive || (candidate.kind !== 'dynamic' && candidate.accessToken === accessToken)));
         if (!entry)
             return { state: 'missing' };
+        if (entry.kind !== 'dynamic' && !authorized(entry))
+            return { state: 'expired' };
         const ts = now();
         if (entry.expiresAt <= ts) {
-            entries = entries.filter((candidate) => candidate.name !== name);
+            entries = entries.filter((candidate) => candidate !== entry);
             flush();
             return { state: 'expired' };
         }
@@ -160,20 +174,30 @@ export function createPreviews({ home = homedir(), store = process.env.PREVIEW_S
             flush();
         return { state: 'active', entry: { ...entry, kind: 'static' } }; // legacy rows (no kind) → static
     }
-    function list() {
+    function list(deviceId) {
         const active = entries.filter((entry) => entry.kind !== 'dynamic' && entry.expiresAt > now());
         if (active.length !== entries.length) {
             entries = active;
             flush();
         }
-        return active.map((entry) => ({ name: entry.name, kind: 'static', dir: entry.dir, expiresAt: entry.expiresAt }));
+        return active.filter((entry) => authorized(entry) && (!isDeviceActive || entry.deviceId === deviceId))
+            .map((entry) => ({ name: entry.name, kind: 'static', dir: entry.dir, expiresAt: entry.expiresAt }));
     }
-    function remove(name) {
-        const next = entries.filter((entry) => entry.name !== name);
+    function remove(name, deviceId) {
+        const next = entries.filter((entry) => entry.name !== name || (isDeviceActive && (entry.kind === 'dynamic' || !deviceId || entry.deviceId !== deviceId)));
         if (next.length !== entries.length) {
             entries = next;
             flush();
         }
     }
-    return { register, get, list, remove };
+    function revokeDevice(deviceId) {
+        for (const entry of entries)
+            if (entry.kind !== 'dynamic' && entry.deviceId === deviceId)
+                delete entry.accessToken;
+        for (const listener of revokeListeners)
+            listener(deviceId);
+    }
+    return { register, get, list, remove, revokeDevice,
+        onRevoke(listener) { revokeListeners.add(listener); return () => { revokeListeners.delete(listener); }; },
+    };
 }

package/dist/src/projectTask/backup.js

@@ -1,6 +1,7 @@
 import { createRequire } from 'node:module';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { migrateProjectDatabase } from './migrations.js';
 const sqlite = createRequire(import.meta.url)('node:sqlite');
 function stamp(date) {
     return date.toISOString().replace(/[:.]/g, '-');
@@ -161,6 +162,33 @@ export async function restoreProjectBackup({ backupPath, databasePath, fs = fsp,
     const temporary = `${databasePath}.restore`;
     await fs.copyFile(backupPath, temporary);
     await fs.chmod(temporary, 0o600);
+    // Revoke before publishing the restored file. A crash at any later point cannot resurrect access.
+    const restored = new sqlite.DatabaseSync(temporary, { allowExtension: false });
+    try {
+        // Revoke credentials before publishing the restored file so a crash at any later point cannot
+        // resurrect access from a backup snapshot.
+        migrateProjectDatabase(restored);
+        const hasAuth = restored.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='auth_sessions'").get();
+        if (hasAuth) {
+            restored.exec('BEGIN IMMEDIATE');
+            try {
+                const now = Date.now();
+                restored.prepare('UPDATE auth_sessions SET revoked_at = ? WHERE revoked_at IS NULL').run(now);
+                restored.prepare('UPDATE auth_devices SET revoked_at = ? WHERE revoked_at IS NULL').run(now);
+                restored.prepare("DELETE FROM auth_meta WHERE key='token_generation'").run();
+                restored.exec('COMMIT');
+            }
+            catch (error) {
+                restored.exec('ROLLBACK');
+                throw error;
+            }
+        }
+        restored.exec('PRAGMA wal_checkpoint(TRUNCATE)');
+        restored.exec('PRAGMA journal_mode = DELETE');
+    }
+    finally {
+        restored.close();
+    }
     await fs.rename(temporary, databasePath);
     await fs.rm(recoveryMarkerPath(databasePath), { force: true });
 }

package/dist/src/projectTask/lock.js

@@ -99,7 +99,7 @@ export function createProjectStoreLock({ dir, fs = fsp, pid = process.pid, now =
                 if (await reclaimStale(observed))
                     continue;
                 const pidLabel = observed?.owner?.pid ? ` (pid ${observed.owner.pid})` : '';
-                throw new ProjectTaskError('PROJECT_STORE_LOCKED', 503, `Project data is open in another HandMux instance${pidLabel}; close it and try again`);
+                throw new ProjectTaskError('PROJECT_STORE_LOCKED', 503, `Project data is open in another handmux instance${pidLabel}; close it and try again`);
             }
         }
         throw new ProjectTaskError('PROJECT_STORE_LOCKED', 503, 'Project data lock changed while starting; try again');

package/dist/src/projectTask/migrations.js

@@ -1,4 +1,21 @@
 import { PROJECT_TASK_SCHEMA_VERSION, ProjectTaskError } from './schema.js';
+const V2_AUTH_SCHEMA = `
+CREATE TABLE auth_devices (
+ id TEXT PRIMARY KEY, pairing_request_id TEXT NOT NULL UNIQUE,
+ name TEXT NOT NULL CHECK(length(trim(name)) BETWEEN 1 AND 80),
+ browser_summary TEXT NOT NULL, authorized_at INTEGER NOT NULL,
+ expires_at INTEGER, last_used_at INTEGER NOT NULL, revoked_at INTEGER
+) STRICT;
+CREATE TABLE auth_sessions (
+ id TEXT PRIMARY KEY, device_id TEXT NOT NULL REFERENCES auth_devices(id),
+ secret_hash TEXT NOT NULL UNIQUE, origin TEXT NOT NULL,
+ transport TEXT NOT NULL CHECK(transport IN ('http', 'https')),
+ created_at INTEGER NOT NULL, last_used_at INTEGER NOT NULL, revoked_at INTEGER
+) STRICT;
+CREATE INDEX auth_sessions_device ON auth_sessions(device_id);
+CREATE INDEX auth_devices_expiry ON auth_devices(expires_at) WHERE revoked_at IS NULL;
+CREATE TABLE auth_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL) STRICT;
+`;
 const V1_SCHEMA = `
 CREATE TABLE projects (
   id TEXT PRIMARY KEY,
@@ -68,7 +85,7 @@ export function configureProjectDatabase(db) {
 export function migrateProjectDatabase(db) {
     const current = Number(pragmaValue(db, 'user_version') ?? 0);
     if (current > PROJECT_TASK_SCHEMA_VERSION) {
-        throw new ProjectTaskError('PROJECT_STORE_TOO_NEW', 503, `Project data requires a newer HandMux version (schema ${current})`);
+        throw new ProjectTaskError('PROJECT_STORE_TOO_NEW', 503, `Project data requires a newer handmux version (schema ${current})`);
     }
     if (current === PROJECT_TASK_SCHEMA_VERSION)
         return current;
@@ -76,6 +93,18 @@ export function migrateProjectDatabase(db) {
     try {
         if (current === 0)
             db.exec(V1_SCHEMA);
+        if (current < 2) {
+            db.exec(V2_AUTH_SCHEMA);
+            // Public releases before trusted-device/auth-origin protection used schema 1 and
+            // allowed a valid Token from every known entry point. Preserve that behavior when
+            // upgrading an existing schema-1 database; a brand-new database (version 0) keeps
+            // the secure defaults applied by DeviceAuthService.
+            if (current === 1) {
+                db.exec("INSERT INTO auth_meta(key,value) VALUES('trusted_device_enabled','0'),('trusted_origin_enabled','0')");
+            }
+        }
+        if (current < 3)
+            db.exec('ALTER TABLE auth_devices ADD COLUMN version INTEGER NOT NULL DEFAULT 1 CHECK(version >= 1)');
         db.exec(`PRAGMA user_version = ${PROJECT_TASK_SCHEMA_VERSION}`);
         db.exec('COMMIT');
     }

package/dist/src/projectTask/runtime.js

@@ -150,11 +150,17 @@ export async function createProjectTaskRuntime({ home, databasePath = path.join(
     }
     return {
         status: () => ({ ...state }),
+        requireDatabase() {
+            if (closed || !db || state.status !== 'ready')
+                throw new Error('Authentication database unavailable; restart handmux');
+            return db;
+        },
+        successfulWrite() { backups?.successfulWrite(); },
         requireStore() {
             if (closed || !store || state.status !== 'ready') {
                 const error = state.error ?? {
                     code: 'PROJECT_STORE_CORRUPT',
-                    message: 'Project data is unavailable; restart HandMux and try again',
+                    message: 'Project data is unavailable; restart handmux and try again',
                 };
                 throw new ProjectTaskError(error.code, error.code === 'PROJECT_STORE_FULL' ? 507 : 503, error.message);
             }

package/dist/src/projectTask/schema.js

@@ -1,4 +1,4 @@
-export const PROJECT_TASK_SCHEMA_VERSION = 1;
+export const PROJECT_TASK_SCHEMA_VERSION = 3;
 export class ProjectTaskError extends Error {
     code;
     status;
@@ -30,7 +30,7 @@ export function projectStorageError(error) {
         return new ProjectTaskError('PROJECT_STORE_LOCKED', 503, 'Project data is temporarily busy; close other processes using it and try again');
     }
     if (code === 'EACCES' || code === 'EPERM' || code === 'SQLITE_READONLY' || primary === 8) {
-        return new ProjectTaskError('PROJECT_STORE_PERMISSION', 503, 'HandMux cannot access Project data; fix ~/.handmux permissions and restart');
+        return new ProjectTaskError('PROJECT_STORE_PERMISSION', 503, 'handmux cannot access Project data; fix ~/.handmux permissions and restart');
     }
     if (code === 'ENOSPC' || code === 'SQLITE_FULL' || primary === 13
         || detail.includes('database or disk is full')) {

package/dist/src/push.js

@@ -67,9 +67,28 @@ function parseStoredSubscription(value) {
     if (wrapped && isRecord(value) && typeof value.pushKey === 'string' && VALID_PUSH_KEY.test(value.pushKey)) {
         record.pushKey = value.pushKey;
     }
+    if (wrapped && isRecord(value) && typeof value.authDeviceId === 'string')
+        record.authDeviceId = value.authDeviceId;
     return record;
 }
 let subs = load();
+let deviceAuthorization = null;
+const allowed = (rec) => {
+    try {
+        return deviceAuthorization ? (!rec.authDeviceId || deviceAuthorization(rec.authDeviceId)) : !rec.authDeviceId;
+    }
+    catch {
+        return false;
+    }
+};
+export function setDeviceAuthorization(check) { deviceAuthorization = check; }
+export function revokeDevice(deviceId) {
+    const next = subs.filter(rec => rec.authDeviceId !== deviceId);
+    if (next.length !== subs.length) {
+        subs = next;
+        persist();
+    }
+}
 function load() {
     return readJsonArray(STORE)
         .map(parseStoredSubscription)
@@ -78,44 +97,54 @@ function load() {
 function persist() { writeJsonAtomic(STORE, subs); }
 export function isConfigured() { ensureInit(); return configured; }
 export function publicKey() { ensureInit(); return process.env.VAPID_PUBLIC || null; }
-export function count() { return subs.length; }
-export function addSubscription(sub, boundSessions = [], preferredPushKey = null) {
+export function count() { return subs.filter(allowed).length; }
+export function addSubscription(sub, boundSessions = [], preferredPushKey = null, authDeviceId) {
     const parsed = parsePushSubscription(sub);
     if (!parsed)
         return false;
+    if (deviceAuthorization && (!authDeviceId || !deviceAuthorization(authDeviceId)))
+        return false;
     const sessions = strings(boundSessions);
     const endpointRecord = subs.find((s) => s.subscription.endpoint === parsed.endpoint);
+    if (endpointRecord && endpointRecord.authDeviceId !== authDeviceId && endpointRecord.authDeviceId && allowed(endpointRecord))
+        return false;
     const requestedKey = typeof preferredPushKey === 'string' && VALID_PUSH_KEY.test(preferredPushKey) ? preferredPushKey : null;
-    const keyRecord = requestedKey ? subs.find((s) => s.pushKey === requestedKey) : null;
-    const pushKey = keyRecord?.pushKey || endpointRecord?.pushKey || requestedKey || genKey();
+    const keyRecord = requestedKey ? subs.find((s) => s.pushKey === requestedKey && s.authDeviceId === authDeviceId) : null;
+    const pushKey = authDeviceId ? keyRecord?.pushKey || (endpointRecord?.authDeviceId === authDeviceId ? endpointRecord?.pushKey : null) || genKey()
+        : keyRecord?.pushKey || endpointRecord?.pushKey || requestedKey || genKey();
     // A browser PushSubscription is transport state, not device identity. Re-enabling push can produce a
     // different endpoint; replace the old endpoint that owns this stable key instead of creating a new
     // script-push target. Also collapse any legacy duplicate for the new endpoint.
     subs = subs.filter((s) => s.subscription.endpoint !== parsed.endpoint && s.pushKey !== pushKey);
-    subs.push({ subscription: parsed, boundSessions: sessions, pushKey });
+    subs.push({ subscription: parsed, boundSessions: sessions, pushKey, ...(authDeviceId ? { authDeviceId } : {}) });
     persist();
     return pushKey;
 }
-export function updateBound(endpoint, boundSessions = []) {
-    const rec = subs.find((s) => s.subscription.endpoint === endpoint);
+export function updateBound(endpoint, boundSessions = [], authDeviceId) {
+    const rec = subs.find((s) => s.subscription.endpoint === endpoint && s.authDeviceId === authDeviceId && allowed(s));
     if (rec) {
         rec.boundSessions = strings(boundSessions);
         persist();
     }
 }
-export function removeSubscription(endpoint) {
-    const removed = subs.find((s) => s.subscription.endpoint === endpoint);
-    subs = subs.filter((s) => s.subscription.endpoint !== endpoint);
+export function removeSubscription(endpoint, authDeviceId) {
+    const removed = subs.find((s) => s.subscription.endpoint === endpoint && s.authDeviceId === authDeviceId);
+    subs = subs.filter((s) => s !== removed);
     if (removed)
         persist();
     return removed?.pushKey || null;
 }
 // The device-addressing id (NOT an auth credential — see /api/push/send-local). Lazy-generate for
 // records stored before the feature existed so an already-subscribed device still has one.
-export function getPushKey(endpoint) {
-    const rec = subs.find((s) => s.subscription.endpoint === endpoint);
+export function getPushKey(endpoint, authDeviceId) {
+    const rec = subs.find((s) => s.subscription.endpoint === endpoint && (s.authDeviceId === authDeviceId || (!s.authDeviceId && Boolean(authDeviceId))) && allowed(s));
     if (!rec)
         return null;
+    // Migrate subscriptions written by 0.28 on first authenticated use.
+    if (!rec.authDeviceId && authDeviceId) {
+        rec.authDeviceId = authDeviceId;
+        persist();
+    }
     if (!rec.pushKey) {
         rec.pushKey = genKey();
         persist();
@@ -171,6 +200,8 @@ async function deliver(records, payload, opts = {}) {
     let sent = 0;
     let failed = 0;
     await Promise.all(records.map(async (rec) => {
+        if (!allowed(rec))
+            return;
         try {
             await webpush.sendNotification(rec.subscription, data, options(opts));
             sent += 1;
@@ -211,7 +242,7 @@ export const resolveTargetKeys = ({ devices, sessions } = {}) => {
         : (sessions && sessions.length)
             ? subs.filter((s) => s.boundSessions.some((x) => sessions.includes(x)))
             : subs;
-    return [...new Set(pick.map((s) => s.pushKey).filter((key) => typeof key === 'string'))];
+    return [...new Set(pick.filter(allowed).map((s) => s.pushKey).filter((key) => typeof key === 'string'))];
 };
 // Back-compat: the /push/subscribe welcome still pushes to a single just-added subscription.
 export async function sendToOne(sub, payload, opts = {}) {

package/dist/src/requestAuthority.js

@@ -0,0 +1,8 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+// Carry the HTTP authorization through awaited queues to the actual side-effect edge.
+// No context means an internal/background operation; token mode remains unchanged.
+const authority = new AsyncLocalStorage();
+export function withRequestAuthority(check, operation) {
+    return authority.run(check, operation);
+}
+export function assertRequestAuthority() { authority.getStore()?.(); }

package/dist/src/requestOrigin.js

@@ -0,0 +1,62 @@
+function sameHost(origin, hostHeader) {
+    try {
+        const requestHost = new URL(`http://${hostHeader}`);
+        const originPort = origin.port || (origin.protocol === 'https:' ? '443' : '80');
+        // The backend may receive a Host without a port after TLS termination. In
+        // that case, inherit the browser origin's default port; an explicit port
+        // must still match exactly (443 remains equivalent to an omitted port).
+        const explicitPort = hostHeader.match(/:(\d+)$/)?.[1];
+        const requestPort = explicitPort ?? originPort;
+        return origin.hostname === requestHost.hostname && originPort === requestPort;
+    }
+    catch {
+        return false;
+    }
+}
+function isLoopback(address) {
+    return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
+}
+function browserProtocol(req, hostHeader) {
+    // Only a local TLS-terminating proxy may supply these implicit hints. For a
+    // direct remote request, an Origin header is not transport proof and must not
+    // turn an HTTP request into a trusted HTTPS origin.
+    if (!isLoopback(req.socket.remoteAddress))
+        return null;
+    const hinted = req.headers.origin;
+    if (typeof hinted === 'string' && hinted !== 'null') {
+        try {
+            const origin = new URL(hinted);
+            if (origin.pathname === '/' && !origin.username && !origin.password && !origin.search && !origin.hash
+                && ['http:', 'https:'].includes(origin.protocol) && sameHost(origin, hostHeader)) {
+                return origin.protocol === 'https:' ? 'https' : 'http';
+            }
+        }
+        catch { /* fall through to the transport and cookie hints */ }
+    }
+    // TLS-terminating reverse proxies may omit X-Forwarded-Proto. A Secure handmux
+    // cookie is only sent by an HTTPS browser, so it provides a stable hint for the
+    // follow-up GET that usually omits Origin.
+    const cookie = req.headers.cookie;
+    if (typeof cookie === 'string' && /(?:^|;\s*)__Host-handmux_(?:session|pairing)(?:[_A-Za-z0-9-]*)?=/.test(cookie))
+        return 'https';
+    return null;
+}
+/** Parse the effective request origin without deciding whether it is allowed. */
+export function requestOrigin(req) {
+    const encrypted = 'encrypted' in req.socket && Boolean(req.socket.encrypted);
+    const forwarded = req.headers['x-forwarded-proto'];
+    const forwardedHost = req.headers['x-forwarded-host'];
+    const hasForwardedHost = typeof forwardedHost === 'string' && forwardedHost.length > 0;
+    const hostHeader = hasForwardedHost
+        ? (forwardedHost.split(',')[0] ?? '').trim() : req.headers.host;
+    if (!hostHeader || /[\s,/@\\?#]/.test(hostHeader))
+        return null;
+    const protocol = !encrypted && (forwarded === 'http' || forwarded === 'https')
+        ? forwarded : encrypted ? 'https' : browserProtocol(req, hostHeader) ?? 'http';
+    try {
+        return new URL(`${protocol}://${hostHeader}`).origin;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/src/routes/agents.js

@@ -276,7 +276,9 @@ export function agentRoutes({ runtime }) {
                 }
             }
             const queue = runtime.conversation ? await runtime.conversation.queueSnapshot(lease) : undefined;
-            return res.json({ controls: { ...controls, ...(queue ? { queue, submissions: queue.submissions } : {}) } });
+            // The page and dispatcher consume the same Runtime activity snapshot.
+            return res.json({ controls: { ...controls,
+                    ...(queue ? { activity: queue.activity, queue, submissions: queue.submissions } : {}) } });
         }
         catch (error) {
             if (controlError(error, res))

package/dist/src/routes/files.js

@@ -161,6 +161,7 @@ export function fileRoutes({ docs, uploadExts, maxUploadBytes }) {
                 // Resolved up front for the response; re-resolved at link time if the race is lost (see below).
                 const origName = name;
                 let finalName = await freeUploadName(target.real, origName);
+                res.locals.assertDeviceActive?.();
                 let dest = joinPath(target.real, finalName);
                 const tempPath = joinPath(target.real, `.${finalName}.uploading-${randomBytes(6).toString('hex')}`);
                 tmp = tempPath;
@@ -181,6 +182,7 @@ export function fileRoutes({ docs, uploadExts, maxUploadBytes }) {
                         // file, and a clash auto-suffixes rather than 409s.
                         let linked = false;
                         for (let attempt = 0; attempt < 6 && !linked; attempt++) {
+                            res.locals.assertDeviceActive?.();
                             try {
                                 await fsp.link(tempPath, dest);
                                 linked = true;