handmux 0.27.2 → 0.29.0

package/dist/src/browser/credentials.js

@@ -0,0 +1,68 @@
+import { Transform } from 'node:stream';
+export const BROWSER_DEVICE_COOKIE = 'tw_browser_device';
+export function browserCookie(raw) {
+    const cookies = String(raw || '').split(';').map((part) => part.trim());
+    const matches = cookies.filter((part) => part.startsWith(`${BROWSER_DEVICE_COOKIE}=`));
+    return matches.length === 1 ? matches[0].slice(BROWSER_DEVICE_COOKIE.length + 1) : null;
+}
+function mainCookie(name) {
+    return /^(?:__Host-)?handmux_/i.test(name);
+}
+export function stripMainCookies(headers, stripBrowser = false) {
+    const out = { ...headers };
+    if (out.cookie) {
+        out.cookie = out.cookie.split(';').map((part) => part.trim()).filter((part) => {
+            const name = part.split('=', 1)[0] || '';
+            return !mainCookie(name) && (!stripBrowser || !['tw_preview', BROWSER_DEVICE_COOKIE].includes(name));
+        }).join('; ');
+        if (!out.cookie)
+            delete out.cookie;
+    }
+    return out;
+}
+export function stripForgedCookies(headers, stripBrowser = false) {
+    const out = { ...headers };
+    if (out['set-cookie']) {
+        out['set-cookie'] = out['set-cookie'].filter((value) => {
+            const name = value.split('=', 1)[0]?.trim() || '';
+            return !mainCookie(name) && (!stripBrowser || !['tw_preview', BROWSER_DEVICE_COOKIE].includes(name));
+        });
+        if (!out['set-cookie'].length)
+            delete out['set-cookie'];
+    }
+    return out;
+}
+// The raw WebSocket tunnel must enforce the same Set-Cookie boundary as HTTP responses.
+export function createBrowserUpgradeFilter() {
+    let pending = Buffer.alloc(0);
+    let complete = false;
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            if (complete) {
+                callback(null, chunk);
+                return;
+            }
+            pending = Buffer.concat([pending, chunk]);
+            const end = pending.indexOf('\r\n\r\n');
+            if (end < 0) {
+                if (pending.length > 64 * 1024)
+                    callback(new Error('browser upgrade headers too large'));
+                else
+                    callback();
+                return;
+            }
+            const lines = pending.subarray(0, end).toString('latin1').split('\r\n');
+            const safe = lines.filter((line) => {
+                if (!/^set-cookie\s*:/i.test(line))
+                    return true;
+                const value = line.slice(line.indexOf(':') + 1).trim();
+                return Boolean(stripForgedCookies({ 'set-cookie': [value] }, true)['set-cookie']?.length);
+            });
+            complete = true;
+            this.push(Buffer.from(`${safe.join('\r\n')}\r\n\r\n`, 'latin1'));
+            this.push(pending.subarray(end + 4));
+            pending = Buffer.alloc(0);
+            callback();
+        },
+    });
+}

package/dist/src/browser/manager.js

@@ -171,6 +171,14 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
     const pools = new Map();
     const pendingPools = new Map();
     const leases = new Map();
+    const revokedDevices = new Set();
+    // Runtime access tokens rotate on restart; encrypted website profiles retain stable auth ownership.
+    const profileDevices = new Map();
+    const profileDevice = (deviceId) => profileDevices.get(deviceId) || deviceId;
+    const assertDevice = (deviceId) => {
+        if (revokedDevices.has(deviceId))
+            throw new Error('browser device authorization revoked');
+    };
     const leaseQueues = new Map();
     const publicOriginClaims = new Map();
     let poolCount = 0;
@@ -286,7 +294,7 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
         lease.pool.proxy.closeSession(lease.session);
         releasePool(lease.pool);
     };
-    const setDeviceActive = (deviceId) => cookieProfiles.setActive?.(deviceId, [...leases.values()].some((lease) => lease.deviceId === deviceId));
+    const setDeviceActive = (deviceId) => cookieProfiles.setActive?.(profileDevice(deviceId), [...leases.values()].some((lease) => lease.deviceId === deviceId));
     const release = (lease) => {
         if (!lease || leases.get(lease.key) !== lease)
             return false;
@@ -303,6 +311,7 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
     const createLease = async ({ tabId, deviceId, url, origin, channel, siteVersion, sourceUserAgent, }) => {
         if (closing)
             throw new Error('browser manager closing');
+        assertDevice(deviceId);
         const target = normalizedTarget(url);
         const publicOrigin = normalizedOrigin(origin);
         const targetOrigin = new URL(target).origin;
@@ -313,6 +322,7 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
         try {
             if (closing)
                 throw new Error('browser manager closing');
+            assertDevice(deviceId);
             const identity = siteVersionIdentity(siteVersion, sourceUserAgent);
             const createdSession = new SessionClass(channel, identity);
             session = createdSession;
@@ -327,6 +337,10 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
                     if (await rehomeNavigation(event, createdSession))
                         return;
                     const result = await policy.check(event._requestInfo.url);
+                    if (revokedDevices.has(deviceId)) {
+                        await event.setMock(new hammerhead.ResponseMock('browser device authorization revoked', 403, { 'content-type': 'text/plain' }));
+                        return;
+                    }
                     if (result.allowed) {
                         if (event.requestOptions?.headers) {
                             applySiteVersionHeaders(event.requestOptions.headers, identity);
@@ -353,7 +367,7 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
                     await event.setMock(new hammerhead.ResponseMock(JSON.stringify({ error: 'browser target blocked', reason: result.reason }), 403, { 'content-type': 'application/json; charset=utf-8' }));
                 },
             }, () => { });
-            detachCookies = cookieProfiles.attach(deviceId, createdSession.cookies);
+            detachCookies = cookieProfiles.attach(profileDevice(deviceId), createdSession.cookies);
             const publicUrl = pool.proxy.openSession(target, createdSession);
             return {
                 key: leaseKey(deviceId, tabId),
@@ -384,6 +398,7 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
     const putImpl = async ({ tabId, deviceId, url, origin, siteVersion, sourceUserAgent, }, requireExisting = false) => {
         if (!deviceId || !tabId)
             throw new Error('browser lease identity required');
+        assertDevice(deviceId);
         const key = leaseKey(deviceId, tabId);
         const existing = leases.get(key);
         if (requireExisting && !existing)
@@ -409,6 +424,10 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
             siteVersion: requestedVersion,
             sourceUserAgent,
         });
+        if (revokedDevices.has(deviceId)) {
+            disposeLease(next);
+            assertDevice(deviceId);
+        }
         leases.set(key, next);
         touch(next);
         if (existing)
@@ -475,6 +494,7 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
                     redirectStatus: 307,
                 });
                 await event.setMock(new hammerhead.ResponseMock('', 307, hammerheadRebindHeaders(bootstrapUrl)));
+                assertDevice(current.deviceId);
                 leases.set(current.key, next);
                 touch(next);
                 disposeLease(current);
@@ -492,6 +512,19 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
         return sessionId.startsWith('_browser-') ? sessionId : null;
     };
     return {
+        setProfileDevice(capability, deviceId) {
+            assertDevice(capability);
+            const existing = profileDevices.get(capability);
+            if (existing && existing !== deviceId)
+                throw new Error('browser profile ownership cannot change');
+            profileDevices.set(capability, deviceId);
+        },
+        revokeDevice(deviceId) {
+            revokedDevices.add(deviceId);
+            for (const lease of [...leases.values()])
+                if (lease.deviceId === deviceId)
+                    release(lease);
+        },
         putLease: (options) => put(options),
         navigateLease(tabId, url, deviceId, origin, siteVersion, sourceUserAgent) {
             return put({ tabId, url, deviceId, origin, siteVersion, sourceUserAgent }, true);
@@ -529,13 +562,15 @@ export async function createBrowserPreviewManager({ hammerhead = defaultHammerhe
             return { port: lease.pool.ports[0], origin: lease.publicOrigin };
         },
         configureDeviceProfile(deviceId, prefs) {
-            return cookieProfiles.configure(deviceId, prefs);
+            assertDevice(deviceId);
+            return cookieProfiles.configure(profileDevice(deviceId), prefs);
         },
         async clearDeviceProfile(deviceId, { origin }) {
-            await cookieProfiles.clear(deviceId, origin === null
+            assertDevice(deviceId);
+            await cookieProfiles.clear(profileDevice(deviceId), origin === null
                 ? {}
                 : { hostname: new URL(origin).hostname });
-            await cookieProfiles.flush?.(deviceId);
+            await cookieProfiles.flush?.(profileDevice(deviceId));
             return { closedTabIds: [] };
         },
         async close() {

package/dist/src/browser/publicProxy.js

@@ -2,6 +2,7 @@ import http from 'node:http';
 import net from 'node:net';
 import { isBrowserBootstrapPath } from './bootstrap.js';
 import { classifyIp } from './targetPolicy.js';
+import { stripMainCookies, stripForgedCookies, createBrowserUpgradeFilter } from './credentials.js';
 const SERVICE_PATHS = new Set([
     '/hammerhead.js',
     '/task.js',
@@ -82,10 +83,12 @@ function expectsDocument(req) {
     return destination === 'document' || destination === 'iframe' || accept.includes('text/html');
 }
 function upstreamHeaders(headers, port, token) {
-    const out = { ...headers, host: `127.0.0.1:${port}` };
+    const out = { ...stripMainCookies(headers, true), host: `127.0.0.1:${port}` };
     if (token && out.authorization === `Bearer ${token}`)
         delete out.authorization;
     delete out['proxy-authorization'];
+    delete out['x-handmux-browser-device'];
+    delete out['x-handmux-browser-profile-device'];
     if (out.cookie) {
         out.cookie = filteredCookie(out.cookie);
         if (!out.cookie)
@@ -103,9 +106,14 @@ export function createBrowserPublicProxy({ browser, browserBootstrap, token, req
             const bootstrap = browserBootstrap?.consume(pathname, origin);
             if (!bootstrap)
                 return res.status(403).json({ error: 'browser bootstrap unavailable' });
-            const secure = origin?.startsWith('https://') ? '; Secure' : '';
+            // The generated preview origin is embedded in the handmux page. Strict cookies are
+            // withheld from that cross-site iframe, so the redirected session loses its capability
+            // before the first document request. HTTPS is required for SameSite=None by browsers;
+            // keep the local HTTP fallback strict because it cannot safely opt into cross-site cookies.
+            const crossSite = origin?.startsWith('https://') === true;
+            const cookiePolicy = crossSite ? 'SameSite=None; Secure' : 'SameSite=Strict';
             res.setHeader('Cache-Control', 'no-store');
-            res.setHeader('Set-Cookie', `${DEVICE_COOKIE}=${bootstrap.deviceId}; Path=/; HttpOnly; SameSite=Strict${secure}`);
+            res.setHeader('Set-Cookie', `${DEVICE_COOKIE}=${bootstrap.deviceId}; Path=/; HttpOnly; ${cookiePolicy}`);
             return res.redirect(bootstrap.preserveMethod ? (bootstrap.redirectStatus || 307) : 302, bootstrap.url);
         }
         const deviceId = cookieValue(req.headers.cookie, DEVICE_COOKIE);
@@ -127,7 +135,7 @@ export function createBrowserPublicProxy({ browser, browserBootstrap, token, req
             path: req.originalUrl || req.url,
             headers: upstreamHeaders(req.headers, port, token),
         }, (incoming) => {
-            res.writeHead(incoming.statusCode || 502, incoming.headers);
+            res.writeHead(incoming.statusCode || 502, stripForgedCookies(incoming.headers, true));
             incoming.pipe(res);
             res.once('close', () => { if (!res.writableEnded)
                 incoming.destroy(); });
@@ -166,7 +174,9 @@ export function createBrowserPublicProxy({ browser, browserBootstrap, token, req
             upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
             if (head?.length)
                 upstream.write(head);
-            socket.pipe(upstream).pipe(socket);
+            const filter = createBrowserUpgradeFilter();
+            filter.once('error', () => { socket.destroy(); upstream.destroy(); });
+            socket.pipe(upstream).pipe(filter).pipe(socket);
         });
         upstream.once('error', () => socket.destroy());
         socket.once('error', () => upstream.destroy());

package/dist/src/browser/routes.js

@@ -81,6 +81,10 @@ export function browserRoutes({ browser, previewDomain = null, browserBootstrap
             return res.status(400).json({ error: 'bad browser site version' });
         try {
             const origin = wildcardOrigin(publicBase, new URL(url).origin);
+            // Ports do not isolate cookies. Proxy documents must never share the app hostname.
+            if (new URL(origin).hostname === new URL(browserRequestOrigin(req) || 'http://invalid').hostname) {
+                return res.status(400).json({ error: 'browser preview must use a different hostname from handmux' });
+            }
             const lease = await browser.putLease({
                 tabId: req.params.tabId,
                 url,
@@ -109,6 +113,9 @@ export function browserRoutes({ browser, previewDomain = null, browserBootstrap
             return res.status(400).json({ error: 'bad browser site version' });
         try {
             const origin = wildcardOrigin(publicBase, new URL(url).origin);
+            if (new URL(origin).hostname === new URL(browserRequestOrigin(req) || 'http://invalid').hostname) {
+                return res.status(400).json({ error: 'browser preview must use a different hostname from handmux' });
+            }
             const lease = await browser.navigateLease(req.params.tabId, url, deviceId(req), origin, siteVersion, req.get('user-agent') || '');
             if (!lease)
                 return res.status(404).json({ error: 'browser proxy lease not found' });

package/dist/src/browser/workerClient.js

@@ -4,17 +4,41 @@ import { randomBytes } from 'node:crypto';
 import { fork } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { claimedBrowserRequest } from './publicProxy.js';
+import { isBrowserBootstrapPath } from './bootstrap.js';
+import { browserCookie, stripMainCookies, stripForgedCookies } from './credentials.js';
 import { BROWSER_INTERNAL_HEADER } from './protocol.js';
 import { createBrowserCoordinator } from './coordinator.js';
 const WORKER_FILE = fileURLToPath(new URL('./worker.js', import.meta.url));
 function forwardedHeaders(headers, internalToken, appToken, api) {
-    const out = { ...headers, [BROWSER_INTERNAL_HEADER]: internalToken };
+    const out = { ...stripMainCookies(headers), [BROWSER_INTERNAL_HEADER]: internalToken };
     if (api || out.authorization === `Bearer ${appToken}`)
         delete out.authorization;
     delete out['proxy-authorization'];
     return out;
 }
-export function createBrowserWorkerClient({ appToken, previewDomain = null, handmuxOrigin = 'http://127.0.0.1', forkWorker = fork, request = http.request, connect = net.connect, randomToken = () => randomBytes(32).toString('base64url'), parentEnv = process.env, setTimer = setTimeout, clearTimer = clearTimeout, readyTimeoutMs = 10_000, stableAfterMs = 30_000, requestTimeoutMs = 15_000, stopTimeoutMs = 3_000, } = {}) {
+function previewHostnameFor(raw) {
+    if (!raw)
+        return null;
+    try {
+        const value = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+        return new URL(value).hostname.toLowerCase().replace(/\.$/, '');
+    }
+    catch {
+        return null;
+    }
+}
+function isGeneratedPreviewHostname(hostname, previewHostname) {
+    if (!hostname || !previewHostname)
+        return false;
+    const suffix = `.${previewHostname}`;
+    if (!hostname.endsWith(suffix))
+        return false;
+    const label = hostname.slice(0, -suffix.length);
+    // browserLabelForOrigin() emits exactly this opaque, lower-case label. Keep
+    // arbitrary subdomains on the main-host path so they cannot bypass the guard.
+    return /^b-[0-9a-z]{13}$/i.test(label);
+}
+export function createBrowserWorkerClient({ appToken, previewDomain = null, handmuxOrigin = 'http://127.0.0.1', forkWorker = fork, request = http.request, connect = net.connect, randomToken = () => randomBytes(32).toString('base64url'), parentEnv = process.env, setTimer = setTimeout, clearTimer = clearTimeout, readyTimeoutMs = 10_000, stableAfterMs = 30_000, requestTimeoutMs = 15_000, stopTimeoutMs = 3_000, deviceAuthorization, } = {}) {
     const internalToken = randomToken();
     let child = null;
     let port = null;
@@ -25,6 +49,56 @@ export function createBrowserWorkerClient({ appToken, previewDomain = null, hand
     let readyTimer = null;
     let stableTimer = null;
     const activeSockets = new Set();
+    // These are bearer capabilities, not user-supplied IDs. They die with this process/worker.
+    const browserDevices = new Map();
+    const deviceBrowsers = new Map();
+    const deviceConnections = new Map();
+    const appHostnames = new Set([new URL(handmuxOrigin).hostname]);
+    const previewHostname = previewHostnameFor(previewDomain);
+    const hostname = (req) => {
+        try {
+            return new URL(`http://${req.headers.host}`).hostname;
+        }
+        catch {
+            return null;
+        }
+    };
+    const ownerFor = (capability) => {
+        const owner = capability ? browserDevices.get(capability) : undefined;
+        return owner && deviceAuthorization?.isActive(owner) ? owner : null;
+    };
+    const track = (owner, stop) => {
+        if (!owner)
+            return () => { };
+        let connections = deviceConnections.get(owner);
+        if (!connections)
+            deviceConnections.set(owner, connections = new Set());
+        connections.add(stop);
+        return () => { connections.delete(stop); if (!connections.size)
+            deviceConnections.delete(owner); };
+    };
+    const revokeDevice = (deviceId) => {
+        const capabilities = [];
+        for (const [key, capability] of deviceBrowsers) {
+            if (key === deviceId || key.startsWith(`${deviceId}:`)) {
+                capabilities.push(capability);
+                deviceBrowsers.delete(key);
+                browserDevices.delete(capability);
+            }
+        }
+        for (const stop of deviceConnections.get(deviceId) || [])
+            stop();
+        deviceConnections.delete(deviceId);
+        if (capabilities.length && port) {
+            // The worker blocks pending async creations as well as disposing existing leases.
+            const revoke = request({ hostname: '127.0.0.1', port, method: 'POST',
+                path: `/_browser-worker/revoke/${encodeURIComponent(deviceId)}`,
+                headers: { [BROWSER_INTERNAL_HEADER]: internalToken } }, (incoming) => incoming.resume());
+            revoke.once('error', () => { });
+            revoke.setTimeout?.(requestTimeoutMs, () => revoke.destroy());
+            revoke.end();
+        }
+    };
     const workerEnv = {};
     for (const name of [
         'PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'TMPDIR', 'TMP', 'TEMP',
@@ -108,6 +182,8 @@ export function createBrowserWorkerClient({ appToken, previewDomain = null, hand
             for (const socket of activeSockets)
                 socket.destroy();
             activeSockets.clear();
+            browserDevices.clear();
+            deviceBrowsers.clear();
             scheduleRestart();
         };
         spawned.once('error', () => {
@@ -123,12 +199,34 @@ export function createBrowserWorkerClient({ appToken, previewDomain = null, hand
         spawned.once('close', finalize);
     };
     const unavailable = (res, status) => res.status(status).json({ error: 'browser unavailable' });
+    const isMainRequest = (req) => {
+        const requestHostname = hostname(req);
+        // The auth-origin resolver also accepts generated preview origins. Those
+        // requests belong to the isolated browser worker and must not be treated
+        // as requests to the handmux app itself.
+        if (isGeneratedPreviewHostname(requestHostname, previewHostname))
+            return false;
+        return Boolean(deviceAuthorization && (appHostnames.has(requestHostname || '') || deviceAuthorization.isMainRequest?.(req)));
+    };
     const proxyHttp = (api) => (req, res, next) => {
         if (!api && !claimedBrowserRequest(req))
             return next();
         const targetPort = port;
         if (!targetPort)
             return unavailable(res, api ? 503 : 502);
+        // Hammerhead's /task.js endpoint identifies the active session from the
+        // proxied document's Referer. The parent Handmux response policy is
+        // `no-referrer`, which otherwise strips that session URL and leaves the
+        // embedded page blank after the first HTML response.
+        if (!api)
+            res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+        if (isMainRequest(req)) {
+            return res.status(403).json({ error: 'browser preview must use a different hostname from handmux' });
+        }
+        const bootstrap = isBrowserBootstrapPath((req.originalUrl || req.url).split('?')[0]);
+        let owner = ownerFor(browserCookie(req.headers.cookie));
+        if (deviceAuthorization && !api && !bootstrap && !owner)
+            return res.status(403).json({ error: 'browser device authorization expired' });
         const upstream = request({
             hostname: '127.0.0.1',
             port: targetPort,
@@ -136,14 +234,30 @@ export function createBrowserWorkerClient({ appToken, previewDomain = null, hand
             path: req.originalUrl || req.url,
             headers: forwardedHeaders(req.headers, internalToken, appToken, api),
         }, (incoming) => {
-            res.writeHead(incoming.statusCode || 502, incoming.headers);
+            if (deviceAuthorization) {
+                if (bootstrap && incoming.statusCode && incoming.statusCode >= 300 && incoming.statusCode < 400) {
+                    owner = ownerFor(browserCookie((incoming.headers['set-cookie'] || []).map((value) => value.split(';')[0]).join(';')));
+                }
+                if (!owner || !deviceAuthorization.isActive(owner)) {
+                    incoming.destroy();
+                    if (!res.headersSent)
+                        res.status(403).json({ error: 'browser device authorization expired' });
+                    return;
+                }
+            }
+            const untrackResponse = track(owner, () => { incoming.destroy(); res.destroy(); });
+            res.once('close', untrackResponse);
+            res.writeHead(incoming.statusCode || 502, stripForgedCookies(incoming.headers));
             incoming.pipe(res);
+            incoming.once('aborted', () => res.destroy());
             res.once('close', () => { if (!res.writableEnded)
                 incoming.destroy(); });
         });
         if (api)
             upstream.setTimeout?.(requestTimeoutMs, () => upstream.destroy(new Error('browser worker request timeout')));
         const abort = () => { upstream.destroy(); };
+        const untrack = track(owner, () => { upstream.destroy(); res.destroy(); });
+        res.once('close', untrack);
         req.once('aborted', abort);
         res.once('close', () => { if (!res.writableEnded)
             abort(); });
@@ -163,14 +277,30 @@ export function createBrowserWorkerClient({ appToken, previewDomain = null, hand
             socket.destroy();
             return true;
         }
+        if (isMainRequest(req)) {
+            socket.destroy();
+            return true;
+        }
+        const owner = ownerFor(browserCookie(req.headers.cookie));
+        if (deviceAuthorization && !owner) {
+            socket.destroy();
+            return true;
+        }
         const upstream = connect({ host: '127.0.0.1', port: targetPort });
         activeSockets.add(socket);
         activeSockets.add(upstream);
+        const untrack = track(owner, () => { socket.destroy(); upstream.destroy(); });
         const cleanup = () => {
             activeSockets.delete(socket);
             activeSockets.delete(upstream);
+            untrack();
         };
         upstream.once('connect', () => {
+            if (owner && !deviceAuthorization?.isActive(owner)) {
+                socket.destroy();
+                upstream.destroy();
+                return;
+            }
             const headers = forwardedHeaders(req.headers, internalToken, appToken, false);
             const lines = [`${req.method || 'GET'} ${req.url} HTTP/${req.httpVersion || '1.1'}`];
             for (const [name, value] of Object.entries(headers)) {
@@ -195,6 +325,9 @@ export function createBrowserWorkerClient({ appToken, previewDomain = null, hand
         const targetPort = port;
         if (!targetPort)
             return resolve(null);
+        const owner = deviceAuthorization ? ownerFor(String(req.headers['x-handmux-browser-device'] || '')) : null;
+        if (deviceAuthorization && !owner)
+            return resolve({ status: 401, body: Buffer.from('{"error":"device authorization expired"}') });
         const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
         const headers = forwardedHeaders(req.headers, internalToken, appToken, true);
         if (payload) {
@@ -207,22 +340,53 @@ export function createBrowserWorkerClient({ appToken, previewDomain = null, hand
         }
         const upstream = request({ hostname: '127.0.0.1', port: targetPort, method, path, headers }, (incoming) => {
             const chunks = [];
+            incoming.once('aborted', () => resolve(null));
             incoming.on('data', (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
-            incoming.on('end', () => resolve({
-                status: incoming.statusCode || 502,
-                headers: incoming.headers,
-                body: Buffer.concat(chunks),
-            }));
+            incoming.on('end', () => {
+                if (owner && !deviceAuthorization?.isActive(owner)) {
+                    revokeDevice(owner);
+                    return resolve({ status: 401, body: Buffer.from('{"error":"device authorization expired"}') });
+                }
+                resolve({ status: incoming.statusCode || 502, headers: stripForgedCookies(incoming.headers), body: Buffer.concat(chunks) });
+            });
         });
         upstream.setTimeout?.(requestTimeoutMs, () => upstream.destroy(new Error('browser worker request timeout')));
         upstream.once('error', () => resolve(null));
+        const untrack = track(owner, () => { upstream.destroy(); resolve({ status: 401, body: Buffer.from('{"error":"device authorization expired"}') }); });
+        upstream.once('close', untrack);
         req.once('aborted', () => upstream.destroy());
         upstream.end(payload || undefined);
     });
-    const apiHandler = createBrowserCoordinator({
+    const coordinator = createBrowserCoordinator({
         proxyRequest,
         getStatus: () => ({ ready: port != null, generation }),
     });
+    const apiHandler = Object.assign(((req, res, next) => {
+        delete req.headers['x-handmux-browser-profile-device'];
+        if (deviceAuthorization) {
+            const principal = res.locals.deviceAuth;
+            const deviceId = principal && typeof principal === 'object' && 'deviceId' in principal && typeof principal.deviceId === 'string'
+                ? principal.deviceId : deviceAuthorization.getDeviceId(req);
+            if (!deviceId || !deviceAuthorization.isActive(deviceId))
+                return res.status(401).json({ error: 'device authorization expired' });
+            const appHostname = hostname(req);
+            if (appHostname)
+                appHostnames.add(appHostname);
+            // Token-only principals are shared by all browsers.  Include the browser's
+            // auth/session cookie in the profile key so separate browsers never share
+            // a website cookie jar while retaining a stable key across requests.
+            const sessionKey = `${deviceId}:${typeof req.headers.cookie === 'string' ? req.headers.cookie : ''}`;
+            let capability = deviceBrowsers.get(sessionKey);
+            if (!capability) {
+                capability = randomBytes(32).toString('base64url');
+                deviceBrowsers.set(sessionKey, capability);
+                browserDevices.set(capability, deviceId);
+            }
+            req.headers['x-handmux-browser-device'] = capability;
+            req.headers['x-handmux-browser-profile-device'] = deviceId;
+        }
+        return coordinator(req, res, next);
+    }), { close: () => coordinator.close() });
     if (previewDomain)
         start();
     let closePromise = null;
@@ -230,6 +394,7 @@ export function createBrowserWorkerClient({ appToken, previewDomain = null, hand
         apiHandler,
         publicHandler: proxyHttp(false),
         onUpgrade,
+        revokeDevice,
         health() {
             if (!previewDomain)
                 return { status: 'disabled', detail: null };

package/dist/src/browser/workerServer.js

@@ -36,7 +36,19 @@ export async function createBrowserWorkerServer({ internalToken, previewDomain =
         return next();
     });
     app.get('/_browser-worker/health', (_req, res) => res.json({ ok: true }));
-    app.use('/api/browser-proxy', express.json(), workerBrowserRoutes({ browser, previewDomain, browserBootstrap }));
+    app.post('/_browser-worker/revoke/:deviceId', (req, res) => {
+        browserBootstrap.revokeDevice(req.params.deviceId);
+        browser.revokeDevice?.(req.params.deviceId);
+        res.status(204).end();
+    });
+    app.use('/api/browser-proxy', express.json(), (req, _res, next) => {
+        const capability = req.headers['x-handmux-browser-device'];
+        const owner = req.headers['x-handmux-browser-profile-device'];
+        if (typeof capability === 'string' && typeof owner === 'string')
+            browser.setProfileDevice?.(capability, owner);
+        delete req.headers['x-handmux-browser-profile-device'];
+        next();
+    }, workerBrowserRoutes({ browser, previewDomain, browserBootstrap }));
     app.use(browserPublic.handler);
     const server = http.createServer(app);
     const sockets = new Set();