handmux 0.27.2 → 0.29.0

package/dist/src/routes/previews.js

@@ -15,7 +15,8 @@ export function previewRoutes({ previews }) {
         if (typeof name !== 'string' || !name || typeof dir !== 'string' || !dir)
             return res.status(400).json({ error: 'bad request' });
         try {
-            const out = await previews.register({ name, dir });
+            const deviceId = res.locals.deviceAuth?.deviceId;
+            const out = await (deviceId ? previews.register({ name, dir }, deviceId) : previews.register({ name, dir }));
             if ('error' in out)
                 return res.status(out.status).json({ error: out.error });
             const url = `/preview/${encodeURIComponent(out.name)}/${encodeURIComponent(out.accessToken)}/`;
@@ -28,7 +29,8 @@ export function previewRoutes({ previews }) {
     r.get('/previews', (_req, res) => {
         if (!previews)
             return res.status(503).json({ error: 'previews disabled' });
-        return res.json({ previews: previews.list() });
+        const deviceId = res.locals.deviceAuth?.deviceId;
+        return res.json({ previews: deviceId ? previews.list(deviceId) : previews.list() });
     });
     r.delete('/previews/:name', (req, res) => {
         if (!previews)
@@ -36,7 +38,11 @@ export function previewRoutes({ previews }) {
         const name = req.params.name;
         if (!name || !safePreviewName(name))
             return res.status(400).json({ error: 'bad name' });
-        previews.remove(name);
+        const deviceId = res.locals.deviceAuth?.deviceId;
+        if (deviceId)
+            previews.remove(name, deviceId);
+        else
+            previews.remove(name);
         return res.status(204).end();
     });
     return r;

package/dist/src/routes/push.js

@@ -8,7 +8,52 @@ const strings = (value) => Array.isArray(value)
     ? value.filter((item) => typeof item === 'string' && item.length > 0)
     : [];
 const errorMessage = (error) => error instanceof Error ? error.message : String(error);
-export function pushRoutes({ push, notifications }) {
+// Shared by the legacy route and private Unix control socket. Never grant general HTTP access to CLI.
+export async function sendLocalPush({ push, notifications }, requestBody) {
+    const data = isRecord(requestBody) ? requestBody : {};
+    const { title, body, tag, url } = data;
+    const invalid = (message) => { throw Object.assign(new Error(message), { status: 400 }); };
+    if (typeof title !== 'string' || !title.trim())
+        return invalid('title required');
+    if (typeof body !== 'string' || !body.trim())
+        return invalid('body required');
+    const safeUrl = url == null ? null : sanitizeNotificationUrl(url);
+    if (url != null && !safeUrl)
+        return invalid('url must be http(s) or relative');
+    const sessions = strings(data.sessions);
+    const devices = strings(data.devices);
+    if (sessions.length && devices.length)
+        return invalid('use --session or --device, not both');
+    const payload = { title, body };
+    if (typeof tag === 'string' && tag)
+        payload.tag = tag;
+    const opts = { urgency: 'normal', ttl: 1800 };
+    if (typeof payload.tag === 'string')
+        opts.topic = payload.tag;
+    let rec = null;
+    if (notifications) {
+        const targetKeys = push.resolveTargetKeys({ devices: devices.length ? devices : null, sessions: sessions.length ? sessions : null });
+        rec = notifications.record(targetKeys, { title, body, tag: payload.tag, url: safeUrl, delivery: { status: 'pending' } });
+        payload.data = { inboxId: rec.id };
+    }
+    const out = devices.length ? await push.sendToDevices(devices, payload, opts)
+        : sessions.length ? await push.sendToSessions(sessions, payload, opts) : await push.sendToAll(payload, opts);
+    if (notifications && rec) {
+        for (const delivery of out.deliveries || []) {
+            if (!delivery.pushKey)
+                continue;
+            try {
+                notifications.updateDelivery(delivery.pushKey, rec.id, delivery);
+            }
+            catch (error) {
+                console.warn(`[handmux] notification delivery status update failed: ${errorMessage(error)}`);
+            }
+        }
+    }
+    const { deliveries: _deliveries, ...summary } = out;
+    return summary;
+}
+export function pushRoutes({ push, notifications, deviceAuth = false }) {
     const r = express.Router();
     // The client needs the VAPID public key to subscribe; 503 if the server has no keys configured.
     r.get('/push/vapid', (_req, res) => {
@@ -26,7 +71,7 @@ export function pushRoutes({ push, notifications }) {
         if (!sub)
             return res.status(400).json({ error: 'bad subscription' });
         try {
-            const pushKey = push.addSubscription(sub, boundSessions, preferredPushKey);
+            const pushKey = push.addSubscription(sub, boundSessions, preferredPushKey, res.locals.deviceAuth?.deviceId);
             if (!pushKey)
                 return res.status(400).json({ error: 'bad subscription' });
             const delivery = await push.sendToOne(sub, { title: '通知已开启 ✅', body: '会话「需要你」或「已完成」时提醒你', tag: 'handmux-welcome' }, { topic: 'handmux', urgency: 'high' });
@@ -48,7 +93,7 @@ export function pushRoutes({ push, notifications }) {
     r.post('/push/unsubscribe', (req, res) => {
         const body = req.body;
         const endpoint = isRecord(body) ? body.endpoint : undefined;
-        const pushKey = typeof endpoint === 'string' ? push.removeSubscription(endpoint) : null;
+        const pushKey = typeof endpoint === 'string' ? push.removeSubscription(endpoint, res.locals.deviceAuth?.deviceId) : null;
         return res.json({ ok: true, pushKey });
     });
     // Manual "send me a test" — pushes to every stored subscription.
@@ -68,68 +113,20 @@ export function pushRoutes({ push, notifications }) {
         const endpoint = isRecord(requestBody) ? requestBody.endpoint : undefined;
         const boundSessions = strings(isRecord(requestBody) ? requestBody.boundSessions : undefined);
         if (typeof endpoint === 'string')
-            push.updateBound(endpoint, boundSessions);
+            push.updateBound(endpoint, boundSessions, res.locals.deviceAuth?.deviceId);
         return res.json({ ok: true });
     });
     // Local script push (`handmux push`): loopback + server token. Scope is mutually exclusive —
     // devices (by pushKey) > sessions > all. This is the ONLY push-send entry; no public/remote variant.
     r.post('/push/send-local', async (req, res, next) => {
-        const requestBody = req.body;
-        const data = isRecord(requestBody) ? requestBody : {};
-        const { title, body, tag, url } = data;
-        if (typeof title !== 'string' || !title.trim())
-            return res.status(400).json({ error: 'title required' });
-        if (typeof body !== 'string' || !body.trim())
-            return res.status(400).json({ error: 'body required' });
-        const safeUrl = url == null ? null : sanitizeNotificationUrl(url);
-        if (url != null && !safeUrl)
-            return res.status(400).json({ error: 'url must be http(s) or relative' });
-        const sessions = strings(data.sessions);
-        const devices = strings(data.devices);
-        const hasSessions = sessions.length > 0;
-        const hasDevices = devices.length > 0;
-        if (hasSessions && hasDevices)
-            return res.status(400).json({ error: 'use --session or --device, not both' });
-        const payload = { title, body };
-        if (typeof tag === 'string' && tag)
-            payload.tag = tag;
-        const opts = { urgency: 'normal', ttl: 1800 };
-        if (typeof payload.tag === 'string')
-            opts.topic = payload.tag;
-        // Record FIRST so the notification tap can deep-link to this exact message's detail page. `--url`
-        // is stored on the record (surfaced in the detail), NOT used as the tap target.
-        let targetKeys = [];
-        let rec = null;
-        if (notifications) {
-            targetKeys = push.resolveTargetKeys({ devices: hasDevices ? devices : null, sessions: hasSessions ? sessions : null });
-            rec = notifications.record(targetKeys, {
-                title, body, tag: payload.tag, url: safeUrl, delivery: { status: 'pending' },
-            });
-            payload.data = { inboxId: rec.id };
-        }
+        if (deviceAuth)
+            return res.status(404).json({ error: 'use the local handmux push CLI' });
         try {
-            const out = hasDevices ? await push.sendToDevices(devices, payload, opts)
-                : hasSessions ? await push.sendToSessions(sessions, payload, opts)
-                    : await push.sendToAll(payload, opts);
-            if (notifications && rec) {
-                for (const delivery of out.deliveries || []) {
-                    if (!delivery.pushKey)
-                        continue;
-                    try {
-                        notifications.updateDelivery(delivery.pushKey, rec.id, delivery);
-                    }
-                    catch (error) {
-                        // Delivery already happened. Do not turn a status-metadata write failure into an HTTP error:
-                        // CLI automation would retry and send the real notification twice. The pending record remains
-                        // honest (unknown final state) and the server log retains the storage failure for diagnosis.
-                        console.warn(`[handmux] notification delivery status update failed: ${errorMessage(error)}`);
-                    }
-                }
-            }
-            const { deliveries: _deliveries, ...summary } = out;
-            return res.json(summary);
+            return res.json(await sendLocalPush({ push, ...(notifications ? { notifications } : {}) }, req.body));
         }
         catch (e) {
+            if (isRecord(e) && e.status === 400)
+                return res.status(400).json({ error: errorMessage(e) });
             return next(e);
         }
     });
@@ -139,7 +136,7 @@ export function pushRoutes({ push, notifications }) {
         const endpoint = isRecord(requestBody) ? requestBody.endpoint : undefined;
         if (typeof endpoint !== 'string')
             return res.status(400).json({ error: 'endpoint required' });
-        return res.json({ pushKey: push.getPushKey(endpoint) });
+        return res.json({ pushKey: push.getPushKey(endpoint, res.locals.deviceAuth?.deviceId) });
     });
     return r;
 }

package/dist/src/routes/system.js

@@ -40,9 +40,9 @@ const PKG_VERSION = (() => {
         return null;
     }
 })();
-export function systemRoutes({ commands, claudeEvents, agentRuntime, asrEnv, shortcuts, home, stateFile, previewDomain, agentIntegrationContext, }) {
+export function systemRoutes({ commands, claudeEvents, agentRuntime, asrEnv, shortcuts, home, stateFile, previewDomain, agentIntegrationContext, shortcutState, }) {
     const r = express.Router();
-    let activeShortcuts = normalizeShortcuts(shortcuts);
+    const activeShortcuts = shortcutState ?? { value: normalizeShortcuts(shortcuts) };
     const integrationContext = agentIntegrationContext ?? defaultAgentIntegrationContext({
         home,
         piEntryFile: PI_ENTRY,
@@ -65,7 +65,7 @@ export function systemRoutes({ commands, claudeEvents, agentRuntime, asrEnv, sho
             asrFillerFilter: voiceAdapter?.capabilities?.fillerFilter === true,
             claudeHooks: hooksStatus(home),
             managedCodex: true,
-            shortcuts: activeShortcuts,
+            shortcuts: activeShortcuts.value,
             browserProxy: !!previewDomain,
         });
     });
@@ -75,7 +75,7 @@ export function systemRoutes({ commands, claudeEvents, agentRuntime, asrEnv, sho
             return res.status(400).json({ error: 'shortcuts required' });
         }
         try {
-            activeShortcuts = normalizeShortcuts(body.shortcuts);
+            activeShortcuts.value = normalizeShortcuts(body.shortcuts);
         }
         catch (error) {
             return res.status(400).json({ error: errorMessage(error) });

package/dist/src/routes/terminal.js

@@ -8,6 +8,7 @@ import { capTrailingBlankRows } from '../trimCapture.js';
 import { isAllowedKey } from '../keyNames.js';
 import { restoreCaptureBackgrounds } from '../captureBackground.js';
 import { serializePaneInput } from '../paneInput.js';
+import { assertRequestAuthority } from '../requestAuthority.js';
 const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 const requestBody = (req) => isRecord(req.body) ? req.body : {};
 export { isAllowedKey } from '../keyNames.js';
@@ -104,10 +105,12 @@ export function terminalRoutes({ commands }) {
         try {
             await serializePaneInput(pane, async () => {
                 await commands.exitCopyModeIfActive(pane);
+                assertRequestAuthority();
                 await commands.sendText(pane, body);
                 if (enter) {
                     if (body)
                         await delay(SUBMIT_GAP_MS); // a bare Enter has nothing to settle — send at once
+                    assertRequestAuthority();
                     await commands.sendEnter(pane);
                 }
             });
@@ -126,6 +129,7 @@ export function terminalRoutes({ commands }) {
         try {
             await serializePaneInput(pane, async () => {
                 await commands.exitCopyModeIfActive(pane);
+                assertRequestAuthority();
                 await commands.sendHexInput(pane, hex);
             });
             return res.json({ ok: true });
@@ -175,6 +179,7 @@ export function terminalRoutes({ commands }) {
                 // restore the split arrangement (resizePane) then hand window sizing back (resizeWindow)
                 if (typeof layout === 'string' && layout)
                     await commands.applyWindowLayout(window, layout);
+                assertRequestAuthority();
                 await commands.restoreWindowSize(window);
             }
             else if (isPaneId(pane)) {
@@ -203,8 +208,10 @@ export function terminalRoutes({ commands }) {
         try {
             await serializePaneInput(pane, async () => {
                 await commands.exitCopyModeIfActive(pane);
-                for (const k of keys)
+                for (const k of keys) {
+                    assertRequestAuthority();
                     await commands.sendKey(pane, k);
+                }
             });
             return res.json({ ok: true });
         }
@@ -229,6 +236,7 @@ export function terminalRoutes({ commands }) {
             const { altScreen, mouseAware, mouseSgr, width, height } = await commands.paneInfo(pane);
             if (!altScreen || !mouseAware)
                 return res.json({ ok: false, reason: 'no-mouse' });
+            assertRequestAuthority();
             await commands.sendWheel(pane, dir, Number(lines), {
                 sgr: mouseSgr,
                 col: Math.max(1, Math.floor((width || 2) / 2)),

package/dist/src/server.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { loadConfig } from './config.js';
-import { expressAuth, loadToken } from './auth.js';
+import { loadToken } from './auth.js';
 import { createApiRouter } from './httpApi.js';
 import { loadUploadExts } from './uploadTypes.js';
 import { createClaudeEvents } from './claudeEvents.js';
@@ -13,6 +13,14 @@ import { removeLegacyCodexHooks } from './cli/legacyCodexHooks.js';
 import { agentRuntimeDirectoryPath, claudeStatePath, codexOutboxPath, } from './cli/state.js';
 import * as commands from './tmux/commands.js';
 import * as push from './push.js';
+import * as notifications from './notifications.js';
+import { sendLocalPush } from './routes/push.js';
+import { DeviceAuthService } from './deviceAuth/service.js';
+import { createDeviceAuthRouter } from './deviceAuth/http.js';
+import { startDeviceAuthControl } from './deviceAuth/control.js';
+import { createAuthOriginResolver, createDeviceAccess } from './deviceAccess.js';
+import { readState } from './cli/state.js';
+import { normalizeShortcuts } from './shortcutConfig.js';
 import { cacheControlFor } from './staticCache.js';
 import { compressStaticAssets } from './staticCompression.js';
 import { applyAppName, applyManifestName } from './appName.js';
@@ -33,7 +41,8 @@ import { apiErrorBoundary, apiRequestContext } from './apiErrors.js';
 import { RuntimeHealth } from './healthProtocol.js';
 import { healthRoutes } from './routes/health.js';
 import { createBuiltinAgentRuntime } from './agent-runtime/builtinRuntime.js';
-import { interruptPane, sendPaneChoice, sendPanePrompt } from './paneInput.js';
+import { interruptClaudePane, sendPaneChoice } from './paneInput.js';
+import { sendClaudePanePrompt } from './agents/claudePaneInput.js';
 import { createLocalAgentProcessContext, TmuxAgentPaneSource, } from './agent-runtime/tmuxRuntime.js';
 import { InboxPushProjection } from './agent-runtime/inboxPushProjection.js';
 import { defaultGit } from './git.js';
@@ -67,8 +76,40 @@ const projectTask = await createProjectTaskRuntime({
     },
 });
 if (projectTask.status().status === 'unavailable') {
-    console.warn(`[handmux] Project Task unavailable: ${projectTask.status().error?.message ?? 'unknown error'}`);
+    throw new Error(`Authentication database unavailable: ${projectTask.status().error?.message ?? 'unknown error'}`);
 }
+const auth = new DeviceAuthService({ db: projectTask.requireDatabase(), token,
+    onSuccessfulWrite: () => projectTask.successfulWrite() });
+const configuredPublicUrl = process.env.HANDMUX_PUBLIC_URL || null;
+const runtimeAdvertisedUrl = () => {
+    const state = readState(home);
+    if (!state || state.serverPid !== process.pid || state.port !== cfg.port)
+        return configuredPublicUrl;
+    // In Direct mode the supervisor's LAN/local fallback is a display URL, not
+    // a configured Public URL. Keep the setting explicitly blank so the web
+    // page can distinguish it from a user-managed reverse-tunnel address.
+    return state.tunnel === 'none' && !configuredPublicUrl ? null : state.publicUrl ?? configuredPublicUrl;
+};
+const resolveAuthOrigin = createAuthOriginResolver({ port: cfg.port, host: cfg.host,
+    ...(configuredPublicUrl ? { publicUrl: configuredPublicUrl } : {}),
+    ...(previewDomain ? { previewDomain } : {}),
+    trustedOrigins: () => auth.trustedOrigins,
+    trustedOriginEnabled: () => auth.trustedOriginEnabled,
+    runtimePublicUrl: runtimeAdvertisedUrl,
+});
+const deviceAccess = createDeviceAccess({ service: auth, resolveOrigin: resolveAuthOrigin });
+const authenticate = deviceAccess.middleware;
+push.setDeviceAuthorization((id) => auth.isDeviceActive(id));
+const shortcutState = { value: cfg.shortcuts };
+const authControl = await startDeviceAuthControl({ service: auth, home,
+    handlePush: (body) => sendLocalPush({ push, notifications }, body),
+    handleShortcuts: async (body) => {
+        if (!body || typeof body !== 'object' || !('shortcuts' in body))
+            throw new Error('shortcuts required');
+        shortcutState.value = normalizeShortcuts(body.shortcuts);
+        return { ok: true };
+    },
+});
 // One writer set is shared by background capture today and the restore runtime added on top of it. The
 // lock is filesystem-backed because the CLI may restore while this daemon is alive in another process.
 const workspaceStore = createWorkspaceStore({ home });
@@ -145,8 +186,8 @@ const agentRuntime = createBuiltinAgentRuntime({
     ...(conversationStartupBlockReason === undefined ? {} : { conversationStartupBlockReason }),
     claudeEvents: events,
     claudeConversationControl: {
-        sendPrompt: (paneId, text, guard) => sendPanePrompt(commands, paneId, text, guard),
-        interrupt: (paneId) => interruptPane(commands, paneId),
+        sendPrompt: (paneId, text, guard) => sendClaudePanePrompt(commands, paneId, text, () => events?.paneRestoredPrompt(paneId) ?? null, guard),
+        interrupt: (paneId) => interruptClaudePane(commands, paneId),
     },
     claudeInteractionControl: {
         capturePlain: (paneId) => commands.capturePlain(paneId),
@@ -169,6 +210,7 @@ const agentRuntime = createBuiltinAgentRuntime({
     },
 });
 const claudeInboxBridge = new ClaudeHookBridgeConnector({
+    nativeTail: events.nativeTail,
     socketPath: agentRuntime.socketPath,
     credentialFile: path.join(agentRuntimeDirectory, 'bridge-credential.json'),
     stateDirectory: path.join(agentRuntimeDirectory, 'connectors', 'claude'),
@@ -190,7 +232,11 @@ const inboxPush = new InboxPushProjection({
 });
 inboxPush.start();
 agentRuntime.start().catch((error) => {
-    console.warn(`[handmux] Agent Runtime unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    const detail = error instanceof Error ? error.stack ?? error.message : String(error);
+    console.warn(`[handmux] Agent Runtime unavailable\n${detail}`);
+    for (const entry of agentRuntime.health()) {
+        console.warn(`[handmux] Agent Runtime adapter ${entry.adapterId}: ${entry.availability}${entry.message ? ` — ${entry.message}` : ''}`);
+    }
 });
 claudeInboxBridge.start();
 workspace.start().catch(() => { });
@@ -219,7 +265,7 @@ try {
 catch { /* best effort — migration never fails startup */ }
 // Static directory preview remains for folders without a web server. Arbitrary sites and local ports
 // use the built-in browser below; previewDomain may provide its dedicated public origin.
-const previews = createPreviews({ home });
+const previews = createPreviews({ home, isDeviceActive: (id) => auth.isDeviceActive(id) });
 const preview = createPreview({ previews });
 const handmuxOrigin = (() => {
     try {
@@ -229,8 +275,29 @@ const handmuxOrigin = (() => {
         return `http://127.0.0.1:${cfg.port}`;
     }
 })();
-const browserWorker = createBrowserWorkerClient({ appToken: token, previewDomain, handmuxOrigin });
+const browserWorker = createBrowserWorkerClient({ appToken: token, previewDomain, handmuxOrigin,
+    deviceAuthorization: {
+        getDeviceId: (req) => deviceAccess.authenticate(req)?.deviceId ?? null,
+        isActive: (id) => auth.isDeviceActive(id),
+        isMainRequest: (req) => resolveAuthOrigin(req) !== null,
+    },
+});
+auth.onRevoke((id) => { push.revokeDevice(id); });
+auth.onRevoke((id) => { previews.revokeDevice(id); });
+auth.onRevoke((id) => { browserWorker.revokeDevice(id); });
 const app = express();
+app.disable('x-powered-by');
+app.use((_req, res, next) => {
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    next();
+});
+app.use('/api/auth', (_req, res, next) => { res.setHeader('Cache-Control', 'no-store'); next(); }, express.json({ limit: '16kb' }), createDeviceAuthRouter({
+    service: auth,
+    resolveOrigin: resolveAuthOrigin,
+    previewDomain,
+    resolvePublicUrl: runtimeAdvertisedUrl,
+}));
 app.use(healthRoutes({
     health,
     refresh: async () => {
@@ -243,10 +310,10 @@ app.use(healthRoutes({
 // Browser proxy leases stay behind normal Handmux auth. Client-owned direct tabs never enter
 // server state; proxy operations and all claimed Hammerhead paths use the isolated worker.
 app.use(browserWorker.publicHandler);
-app.use('/api/browser-proxy', apiRequestContext(), expressAuth(token), express.json(), browserWorker.apiHandler);
+app.use('/api/browser-proxy', apiRequestContext(), authenticate, express.json(), browserWorker.apiHandler);
 app.use('/api', createApiRouter({
     token, events, uploadExts, previews, shortcuts: cfg.shortcuts, workspace, previewDomain,
-    agentRuntime, projectTask, apiAccounts,
+    agentRuntime, projectTask, apiAccounts, authentication: authenticate, deviceAuth: true, shortcutState,
 }));
 app.use('/preview', preview.router);
 app.use(preview.refererFallback);
@@ -275,6 +342,12 @@ if (appName) {
 }
 // index:false so the renamed shell below owns "/" too (otherwise static would serve the generic one).
 app.use(compressStaticAssets);
+// Only the main app owns this policy. Browser proxy documents use a separate origin and must be
+// embeddable by handmux; static previews already set their own opaque-origin sandbox policy above.
+app.use((_req, res, next) => {
+    res.setHeader('Content-Security-Policy', "base-uri 'self'; object-src 'none'; frame-ancestors 'self'");
+    next();
+});
 app.use(express.static(staticDir, {
     index: false,
     // Cache-Control policy lives in staticCache.js (unit-tested): index.html + sw.js are never cached
@@ -301,7 +374,9 @@ app.use(apiErrorBoundary());
 const server = app.listen(cfg.port, cfg.host, () => {
     console.log(`[handmux] listening on http://${cfg.host}:${cfg.port} (serving ${staticDir})`);
 });
-const terminalStream = createTerminalStream({ token, commands });
+const terminalStream = createTerminalStream({ token, commands,
+    deviceAuth: { service: auth, resolveOrigin: resolveAuthOrigin },
+});
 server.on('upgrade', (req, socket, head) => {
     if (terminalStream.onUpgrade(req, socket, head))
         return;
@@ -310,12 +385,13 @@ server.on('upgrade', (req, socket, head) => {
 });
 const shutdown = createGracefulShutdown({ events, workspace, browser: browserWorker, server });
 const handleSignal = () => {
+    deviceAccess.close();
     terminalStream.close();
     codexApp.close();
     inboxPush.close();
     Promise.all([
         claudeInboxBridge.close(),
-        projectTask.close(),
+        authControl.close().then(() => { auth.close(); }).finally(() => projectTask.close()),
         agentRuntime.close(),
         shutdown(),
     ]).catch(() => { });

package/dist/src/terminalStream.js

@@ -302,9 +302,24 @@ export class PaneControlStream {
         catch { /* already gone */ }
     }
 }
-export function createTerminalStream({ token, commands, spawnControl, }) {
+export function createTerminalStream({ token, commands, spawnControl, deviceAuth, }) {
     const wss = new WebSocketServer({ noServer: true, maxPayload: MAX_CLIENT_MESSAGE_BYTES });
     const streams = new Set();
+    const principals = new WeakMap();
+    const origins = new WeakMap();
+    const socketStreams = new Map();
+    const unsubscribe = deviceAuth?.service.onRevoke((deviceId) => {
+        for (const ws of wss.clients) {
+            if (principals.get(ws)?.deviceId !== deviceId)
+                continue;
+            const stream = socketStreams.get(ws);
+            stream?.close();
+            if (stream)
+                streams.delete(stream);
+            socketStreams.delete(ws);
+            ws.close(4001, 'unauthorized');
+        }
+    });
     const heartbeat = setInterval(() => {
         for (const socket of wss.clients) {
             const ws = socket;
@@ -321,12 +336,37 @@ export function createTerminalStream({ token, commands, spawnControl, }) {
     heartbeat.unref?.();
     wss.on('connection', (socket) => {
         const ws = socket;
+        let principal = principals.get(ws);
+        const stillAuthorized = () => {
+            if (!deviceAuth)
+                return true;
+            try {
+                return Boolean(principal && deviceAuth.service.isActive(principal));
+            }
+            catch {
+                return false;
+            }
+        };
         ws.isAlive = true;
-        ws.on('pong', () => { ws.isAlive = true; });
+        ws.on('pong', () => {
+            if (!stillAuthorized()) {
+                ws.close(4001, 'unauthorized');
+                return;
+            }
+            ws.isAlive = true;
+            if (principal)
+                deviceAuth?.service.touch(principal);
+        });
         const cancelSubscribeDeadline = startSubscribeDeadline(ws);
         let authenticating = false;
         let stream = null;
         ws.on('message', async (raw, binary) => {
+            if (principal && !stillAuthorized()) {
+                ws.close(4001, 'unauthorized');
+                return;
+            }
+            if (principal)
+                deviceAuth?.service.touch(principal);
             if (binary)
                 return;
             let message;
@@ -363,7 +403,24 @@ export function createTerminalStream({ token, commands, spawnControl, }) {
                 ws.close(1003, 'bad subscribe message');
                 return;
             }
-            if (!tokenEquals(message.token ?? '', token)) {
+            if (deviceAuth) {
+                const origin = origins.get(ws) ?? '';
+                const tokenPrincipal = deviceAuth.service.authenticateToken?.(message.token, origin);
+                if (!tokenPrincipal) {
+                    ws.close(4001, 'unauthorized');
+                    return;
+                }
+                // Trusted-device protection is an independent policy. When it is off,
+                // the Token principal is sufficient and becomes the socket principal.
+                if (!principal && deviceAuth.service.trustedDeviceEnabled === false) {
+                    principal = tokenPrincipal;
+                }
+                if (!principal || !stillAuthorized()) {
+                    ws.close(4001, 'unauthorized');
+                    return;
+                }
+            }
+            else if (!tokenEquals(message.token ?? '', token)) {
                 ws.close(4001, 'unauthorized');
                 return;
             }
@@ -371,13 +428,14 @@ export function createTerminalStream({ token, commands, spawnControl, }) {
             cancelSubscribeDeadline();
             try {
                 const session = await commands.paneSession(message.pane);
-                if (ws.readyState !== 1)
+                if (ws.readyState !== 1 || !stillAuthorized())
                     return;
                 stream = new PaneControlStream({
                     ws, pane: message.pane, session,
                     ...(spawnControl ? { spawnControl } : {}),
                 });
                 streams.add(stream);
+                socketStreams.set(ws, stream);
                 await stream.start();
             }
             catch {
@@ -387,6 +445,7 @@ export function createTerminalStream({ token, commands, spawnControl, }) {
         });
         ws.on('close', () => {
             cancelSubscribeDeadline();
+            socketStreams.delete(ws);
             if (stream) {
                 stream.close();
                 streams.delete(stream);
@@ -403,11 +462,37 @@ export function createTerminalStream({ token, commands, spawnControl, }) {
         }
         if (pathname !== '/api/terminal-stream')
             return false;
-        wss.handleUpgrade(req, socket, head, (ws) => wss.emit('connection', ws, req));
+        let principal = null;
+        let requestOrigin = null;
+        if (deviceAuth) {
+            try {
+                const origin = deviceAuth.resolveOrigin(req);
+                if (origin && req.headers.origin === origin) {
+                    requestOrigin = origin;
+                    principal = deviceAuth.service.authenticateRequest(req, origin);
+                }
+            }
+            catch {
+                socket.end('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');
+                return true;
+            }
+            if (!requestOrigin || (!principal && !deviceAuth.service.tokenEnabled)) {
+                socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
+                return true;
+            }
+        }
+        wss.handleUpgrade(req, socket, head, (ws) => {
+            if (principal)
+                principals.set(ws, principal);
+            if (requestOrigin)
+                origins.set(ws, requestOrigin);
+            wss.emit('connection', ws, req);
+        });
         return true;
     };
     const close = () => {
         clearInterval(heartbeat);
+        unsubscribe?.();
         for (const stream of streams)
             stream.close();
         streams.clear();

package/dist/src/tmux/commands.js

@@ -2,6 +2,7 @@ import { execFile } from 'node:child_process';
 import os from 'node:os';
 import { parseTmuxRows, tmuxFormat } from './format.js';
 import { TmuxPaneOutputCapture } from './paneOutputCapture.js';
+import { assertRequestAuthority } from '../requestAuthority.js';
 export const isPaneId = (value) => typeof value === 'string' && /^%\d+$/.test(value);
 export const isWindowId = (value) => typeof value === 'string' && /^@\d+$/.test(value);
 export const isSessionId = (value) => typeof value === 'string' && /^\$\d+$/.test(value);
@@ -21,6 +22,7 @@ export const isValidStartupCmd = (value) => typeof value === 'string' && value.l
     });
 export function runTmux(args) {
     return new Promise((resolve, reject) => {
+        assertRequestAuthority();
         execFile('tmux', args, { maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
             if (err)
                 reject(new Error(stderr?.toString() || err.message));

package/dist/src/transcriptParse.js

@@ -214,7 +214,10 @@ export function createTranscriptParser() {
                 // bubbles) — the pushed `it.text` below is the untrimmed original, so real text's internal/
                 // leading/trailing whitespace is preserved verbatim.
                 if (it.type === 'text' && typeof it.text === 'string' && it.text.trim()) {
-                    msgs.push({ i, role, type: 'text', text: it.text, ts });
+                    msgs.push({ i, role, type: 'text', text: it.text, ts,
+                        ...(o.type === 'user' && m.role === 'user' && o.promptSource === 'system'
+                            && record(o.origin)?.kind === 'task-notification' ? { source: 'task-notification' } : {}),
+                    });
                 }
                 else if (it.type === 'thinking' && typeof it.thinking === 'string' && it.thinking) {
                     msgs.push({ i, role: 'assistant', type: 'thinking', text: it.thinking, ts });