machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/src/worker/daemon-auth.ts

@@ -1,6 +1,15 @@
 import { DAEMON_AUTH_CHALLENGE_TTL_SECONDS, DAEMON_AUTH_SCHEME, DAEMON_PREFLIGHT_SCHEME, DAEMON_PREFLIGHT_TTL_SECONDS, daemonAuthTranscript, daemonPreflightTranscript } from "../shared/daemon-auth.mjs";
 import { safeEqual } from "./oauth-state.ts";
 import { consumeBoundedNonce } from "./nonce-store.ts";
+import {
+  decodeBase64Url,
+  parsePublicJwk,
+  publicKeyId,
+  verifyDeviceSessionCertificate,
+  verifyP256Signature,
+} from "./device-session-verifier.ts";
+
+const SESSION_CERTIFICATE_HEADER = "X-Bridge-Device-Certificate";
 
 export interface DaemonChallenge {
   scheme: typeof DAEMON_AUTH_SCHEME;
@@ -22,26 +31,39 @@ export function createDaemonChallenge(workerOrigin: string, now = Math.floor(Dat
   };
 }
 
-
 export function sanitizeDaemonChallengeAttachment(value: Record<string, unknown>): Partial<{
   authChallenge: string;
   authIssuedAt: number;
   authExpiresAt: number;
   workerOrigin: string;
+  authSessionPublicKeyJson: string;
+  authSessionKeyId: string;
+  authCertificateExpiresAt: number;
 }> {
   const authChallenge = typeof value.authChallenge === "string" && /^daemon_challenge_[A-Za-z0-9_-]{40,96}$/.test(value.authChallenge)
     ? value.authChallenge
     : undefined;
   const authIssuedAt = positiveSafeInteger(value.authIssuedAt);
   const authExpiresAt = positiveSafeInteger(value.authExpiresAt);
+  const authCertificateExpiresAt = positiveSafeInteger(value.authCertificateExpiresAt);
+  const authSessionKeyId = typeof value.authSessionKeyId === "string" && /^device_[A-Za-z0-9_-]{32}$/.test(value.authSessionKeyId)
+    ? value.authSessionKeyId
+    : undefined;
   let workerOrigin: string | undefined;
-  try { workerOrigin = normalizeWorkerOrigin(String(value.workerOrigin || "")); } catch {}
-  return { authChallenge, authIssuedAt, authExpiresAt, workerOrigin };
+  try { workerOrigin = normalizeWorkerOrigin(String(value.workerOrigin || "")); }
+  catch { /* Invalid optional persisted auth metadata remains undefined and fails the caller's completeness checks. */ }
+  let authSessionPublicKeyJson: string | undefined;
+  try { authSessionPublicKeyJson = JSON.stringify(parsePublicJwk(String(value.authSessionPublicKeyJson || ""))); }
+  catch { /* Invalid optional persisted auth metadata remains undefined and fails the caller's completeness checks. */ }
+  return { authChallenge, authIssuedAt, authExpiresAt, workerOrigin, authSessionPublicKeyJson, authSessionKeyId, authCertificateExpiresAt };
 }
 
 export interface DaemonPreflightAuthorization {
   nonce: string;
   expiresAt: number;
+  sessionPublicKeyJson: string;
+  sessionKeyId: string;
+  certificateExpiresAt: number;
 }
 
 export async function verifyDaemonPreflight(input: {
@@ -53,6 +75,15 @@ export async function verifyDaemonPreflight(input: {
   now?: number;
 }): Promise<DaemonPreflightAuthorization | null> {
   const now = Number.isSafeInteger(input.now) ? Number(input.now) : Math.floor(Date.now() / 1000);
+  const certificate = await verifyDeviceSessionCertificate({
+    encodedCertificate: input.headers.get(SESSION_CERTIFICATE_HEADER) || "",
+    rootPublicKeyJson: input.publicKeyJson,
+    workerOrigin: input.workerOrigin,
+    server: input.server,
+    version: input.version,
+    now,
+  });
+  if (!certificate) return null;
   const scheme = input.headers.get("X-Bridge-Device-Scheme") || "";
   const keyId = input.headers.get("X-Bridge-Device-Key") || "";
   const nonce = input.headers.get("X-Bridge-Device-Nonce") || "";
@@ -61,36 +92,23 @@ export async function verifyDaemonPreflight(input: {
   if (scheme !== DAEMON_PREFLIGHT_SCHEME || !signature) return null;
   if (!Number.isSafeInteger(issuedAt) || Math.abs(now - issuedAt) > DAEMON_PREFLIGHT_TTL_SECONDS) return null;
   if (!/^[A-Za-z0-9_-]{24,128}$/.test(nonce)) return null;
-  let publicJwk: JsonWebKey;
-  try { publicJwk = parsePublicJwk(input.publicKeyJson); } catch { return null; }
-  if (!(await safeEqual(keyId, await publicKeyId(publicJwk)))) return null;
+  if (!(await safeEqual(keyId, certificate.sessionKeyId))) return null;
   let transcript: string;
   try {
-    transcript = daemonPreflightTranscript({
-      workerOrigin: input.workerOrigin,
-      server: input.server,
-      version: input.version,
-      nonce,
-      issuedAt,
-    });
-  } catch {
-    return null;
-  }
-  try {
-    const key = await crypto.subtle.importKey("jwk", publicJwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
-    const valid = await crypto.subtle.verify(
-      { name: "ECDSA", hash: "SHA-256" },
-      key,
-      signature,
-      new TextEncoder().encode(transcript),
-    );
-    return valid ? { nonce, expiresAt: issuedAt + DAEMON_PREFLIGHT_TTL_SECONDS } : null;
+    transcript = daemonPreflightTranscript({ workerOrigin: input.workerOrigin, server: input.server, version: input.version, nonce, issuedAt });
   } catch {
     return null;
   }
+  if (!(await verifyP256Signature(certificate.sessionPublicJwk, transcript, signature))) return null;
+  return {
+    nonce,
+    expiresAt: issuedAt + DAEMON_PREFLIGHT_TTL_SECONDS,
+    sessionPublicKeyJson: certificate.sessionPublicKeyJson,
+    sessionKeyId: certificate.sessionKeyId,
+    certificateExpiresAt: certificate.expiresAt,
+  };
 }
 
-
 export async function consumeDaemonPreflightNonce(
   storage: DurableObjectStorage,
   authorization: DaemonPreflightAuthorization,
@@ -103,6 +121,7 @@ export async function consumeDaemonPreflightNonce(
     now,
     noncePattern: /^[A-Za-z0-9_-]{24,128}$/,
     maximum: 128,
+    maxFutureSeconds: DAEMON_PREFLIGHT_TTL_SECONDS * 2,
   });
 }
 
@@ -113,10 +132,12 @@ export async function verifyDaemonAuthentication(input: {
   server: string;
   version: string;
   instanceId: string;
+  certificateExpiresAt?: number;
   now?: number;
 }): Promise<boolean> {
   const now = Number.isSafeInteger(input.now) ? Number(input.now) : Math.floor(Date.now() / 1000);
   if (now < input.challenge.issuedAt - 5 || now > input.challenge.expiresAt) return false;
+  if (input.certificateExpiresAt !== undefined && (!Number.isSafeInteger(input.certificateExpiresAt) || now > input.certificateExpiresAt)) return false;
   if (!input.authentication || typeof input.authentication !== "object" || Array.isArray(input.authentication)) return false;
   const auth = input.authentication as Record<string, unknown>;
   if (auth.scheme !== DAEMON_AUTH_SCHEME) return false;
@@ -126,8 +147,7 @@ export async function verifyDaemonAuthentication(input: {
   if (!signature) return false;
   let publicJwk: JsonWebKey;
   try { publicJwk = parsePublicJwk(input.publicKeyJson); } catch { return false; }
-  const expectedKeyId = await publicKeyId(publicJwk);
-  if (!(await safeEqual(String(auth.key_id || ""), expectedKeyId))) return false;
+  if (!(await safeEqual(String(auth.key_id || ""), await publicKeyId(publicJwk)))) return false;
   let transcript: string;
   try {
     transcript = daemonAuthTranscript({
@@ -141,45 +161,7 @@ export async function verifyDaemonAuthentication(input: {
   } catch {
     return false;
   }
-  try {
-    const key = await crypto.subtle.importKey("jwk", publicJwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
-    return crypto.subtle.verify(
-      { name: "ECDSA", hash: "SHA-256" },
-      key,
-      signature,
-      new TextEncoder().encode(transcript),
-    );
-  } catch {
-    return false;
-  }
-}
-
-function parsePublicJwk(value: string): JsonWebKey {
-  const parsed = JSON.parse(value) as JsonWebKey;
-  if (!parsed || parsed.kty !== "EC" || parsed.crv !== "P-256") throw new Error("invalid device public key");
-  if (typeof parsed.x !== "string" || typeof parsed.y !== "string" || parsed.d !== undefined) throw new Error("invalid device public key");
-  return { kty: "EC", crv: "P-256", x: parsed.x, y: parsed.y, ext: true, key_ops: ["verify"] };
-}
-
-async function publicKeyId(jwk: JsonWebKey): Promise<string> {
-  const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
-  return `device_${base64Url(new Uint8Array(digest)).slice(0, 32)}`;
-}
-
-function decodeBase64Url(value: string, expectedBytes: number): Uint8Array<ArrayBuffer> | null {
-  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
-  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
-  const padding = "=".repeat((4 - (normalized.length % 4)) % 4);
-  try {
-    const binary = atob(normalized + padding);
-    if (binary.length !== expectedBytes) return null;
-    const bytes = new Uint8Array(expectedBytes);
-    for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
-    return bytes;
-  } catch {
-    return null;
-  }
+  return verifyP256Signature(publicJwk, transcript, signature);
 }
 
 function base64Url(bytes: Uint8Array): string {
@@ -188,7 +170,6 @@ function base64Url(bytes: Uint8Array): string {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 
-
 function positiveSafeInteger(value: unknown): number | undefined {
   const number = Number(value);
   return Number.isSafeInteger(number) && number > 0 ? number : undefined;

package/src/worker/daemon-channel.ts

@@ -0,0 +1,36 @@
+export const DAEMON_CHANNEL_OPEN = 1;
+
+export interface DaemonChannel {
+  readonly readyState: number;
+  send(data: string): void;
+  readonly daemonTransport?: "https";
+}
+
+export interface ReadyDaemonRegistry {
+  readyChannels?(): DaemonChannel[];
+  readySockets?(): DaemonChannel[];
+}
+
+export function readyDaemonChannels(registry: ReadyDaemonRegistry): DaemonChannel[] {
+  if (typeof registry.readyChannels === "function") return registry.readyChannels();
+  if (typeof registry.readySockets === "function") return registry.readySockets();
+  return [];
+}
+
+export function daemonChannelOpen(channel: DaemonChannel | undefined): boolean {
+  return Boolean(channel && channel.readyState === DAEMON_CHANNEL_OPEN);
+}
+
+export function daemonChannelTransport(channel: DaemonChannel | undefined): "https" | "websocket" {
+  return channel?.daemonTransport === "https" ? "https" : "websocket";
+}
+
+export function trySendDaemonChannel(channel: DaemonChannel | undefined, value: unknown): boolean {
+  if (!channel || channel.readyState !== DAEMON_CHANNEL_OPEN) return false;
+  try {
+    channel.send(JSON.stringify(value));
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/worker/daemon-http-auth.ts

@@ -0,0 +1,63 @@
+import {
+  DAEMON_HTTP_RELAY_SCHEME, DAEMON_HTTP_RELAY_TTL_SECONDS, daemonHttpRelayTranscript,
+} from "../shared/daemon-auth.mjs";
+import { safeEqual } from "./oauth-state.ts";
+import { consumeBoundedNonce } from "./nonce-store.ts";
+import {
+  decodeBase64Url, verifyDeviceSessionCertificate, verifyP256Signature,
+} from "./device-session-verifier.ts";
+
+const SESSION_CERTIFICATE_HEADER = "X-Bridge-Device-Certificate";
+
+export async function verifyDaemonHttpRelayRequest(input: {
+  storage: DurableObjectStorage;
+  publicKeyJson: string;
+  headers: Headers;
+  body: Uint8Array;
+  workerOrigin: string;
+  server: string;
+  version: string;
+  now?: number;
+}): Promise<boolean> {
+  const now = Number.isSafeInteger(input.now) ? Number(input.now) : Math.floor(Date.now() / 1000);
+  const certificate = await verifyDeviceSessionCertificate({
+    encodedCertificate: input.headers.get(SESSION_CERTIFICATE_HEADER) || "",
+    rootPublicKeyJson: input.publicKeyJson,
+    workerOrigin: input.workerOrigin,
+    server: input.server,
+    version: input.version,
+    now,
+  });
+  if (!certificate) return false;
+  const scheme = input.headers.get("X-Bridge-Device-Scheme") || "";
+  const keyId = input.headers.get("X-Bridge-Device-Key") || "";
+  const nonce = input.headers.get("X-Bridge-Device-Nonce") || "";
+  const issuedAt = Number(input.headers.get("X-Bridge-Device-Time"));
+  const claimedBodyHash = input.headers.get("X-Bridge-Body-SHA256") || "";
+  const signature = decodeBase64Url(input.headers.get("X-Bridge-Device-Signature") || "", 64);
+  if (scheme !== DAEMON_HTTP_RELAY_SCHEME || !signature || !/^[A-Za-z0-9_-]{43}$/.test(claimedBodyHash)) return false;
+  if (!Number.isSafeInteger(issuedAt) || Math.abs(now - issuedAt) > DAEMON_HTTP_RELAY_TTL_SECONDS) return false;
+  if (!/^[A-Za-z0-9_-]{24,128}$/.test(nonce) || !(await safeEqual(keyId, certificate.sessionKeyId))) return false;
+  const digestInput = new Uint8Array(input.body.byteLength);
+  digestInput.set(input.body);
+  const actualBodyHash = base64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", digestInput)));
+  if (!(await safeEqual(claimedBodyHash, actualBodyHash))) return false;
+  let transcript: string;
+  try {
+    transcript = daemonHttpRelayTranscript({
+      workerOrigin: input.workerOrigin, server: input.server, version: input.version,
+      nonce, issuedAt, bodySha256: claimedBodyHash,
+    });
+  } catch { return false; }
+  if (!(await verifyP256Signature(certificate.sessionPublicJwk, transcript, signature))) return false;
+  return consumeBoundedNonce(input.storage, {
+    key: "daemon-http-relay-nonces", nonce, expiresAt: issuedAt + DAEMON_HTTP_RELAY_TTL_SECONDS, now,
+    noncePattern: /^[A-Za-z0-9_-]{24,128}$/, maximum: 1024, maxFutureSeconds: DAEMON_HTTP_RELAY_TTL_SECONDS * 2,
+  });
+}
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}

package/src/worker/daemon-http-channel.ts

@@ -0,0 +1,120 @@
+import relayContract from "../shared/relay-contract.json" with { type: "json" };
+import { DAEMON_CHANNEL_OPEN, type DaemonChannel } from "./daemon-channel.ts";
+import type { DaemonAttachment } from "./daemon-socket-attachment.ts";
+import { relayDiagnosticsAfterReady } from "./daemon-relay-diagnostics.ts";
+
+type SequencedMessage = Readonly<{ seq: number; payload: unknown; bytes: number }>;
+
+export class DaemonHttpChannel implements DaemonChannel {
+  readonly daemonTransport = "https" as const;
+  readonly sessionId: string;
+  readonly activationToken: string;
+  readonly attachment: DaemonAttachment;
+  private activatedAtMs = 0;
+  private verifiedReadyAtMs = 0;
+  private lastSeenAtMs: number;
+  private nextWorkerSeq = 1;
+  private acknowledgedWorkerSeq = 0;
+  private acknowledgedDaemonSeq = 0;
+  private queuedBytes = 0;
+  private readonly outbound: SequencedMessage[] = [];
+  private closed = false;
+
+  constructor(input: {
+    sessionId: string;
+    activationToken: string;
+    attachment: DaemonAttachment;
+    now?: number;
+  }) {
+    this.sessionId = input.sessionId;
+    this.activationToken = input.activationToken;
+    this.attachment = input.attachment;
+    this.lastSeenAtMs = input.now ?? Date.now();
+  }
+
+  get readyState(): number { return !this.closed && this.verifiedReadyAtMs > 0 ? DAEMON_CHANNEL_OPEN : 0; }
+  get lastSeenMs(): number { return this.lastSeenAtMs; }
+  get activatedMs(): number { return this.activatedAtMs; }
+  get isActivated(): boolean { return !this.closed && this.activatedAtMs > 0; }
+  get daemonSequence(): number { return this.acknowledgedDaemonSeq; }
+
+  activate(now = Date.now()): void {
+    if (this.closed) throw new Error("HTTP daemon channel is closed");
+    this.activatedAtMs = now;
+    this.touch(now);
+    this.attachment.role = "probing";
+  }
+
+  verifyReady(now = Date.now()): void {
+    if (!this.isActivated) throw new Error("HTTP daemon channel was not activated");
+    this.verifiedReadyAtMs = now;
+    this.touch(now);
+    this.attachment.role = "daemon";
+    this.attachment.connectedAt = new Date(now).toISOString();
+    this.attachment.lastSeenAt = this.attachment.connectedAt;
+    this.attachment.relayDiagnostics = relayDiagnosticsAfterReady(
+      this.attachment.relayDiagnostics,
+      this.attachment.connectedAt,
+    );
+  }
+
+  touch(now = Date.now()): void {
+    this.lastSeenAtMs = now;
+    this.attachment.lastSeenAt = new Date(now).toISOString();
+  }
+
+  send(data: string): void {
+    if (!this.isActivated) throw new Error("HTTP daemon channel is not activated");
+    const bytes = new TextEncoder().encode(data).byteLength;
+    if (bytes > relayContract.httpFallbackMaximumMessageBytes
+        || this.outbound.length >= relayContract.httpFallbackMaximumQueuedMessages
+        || this.queuedBytes + bytes > relayContract.httpFallbackMaximumQueuedBytes) {
+      throw new Error("HTTP daemon relay queue capacity exceeded");
+    }
+    let payload: unknown;
+    try { payload = JSON.parse(data); } catch { throw new Error("HTTP daemon relay message is not JSON"); }
+    this.outbound.push(Object.freeze({ seq: this.nextWorkerSeq++, payload, bytes }));
+    this.queuedBytes += bytes;
+  }
+
+  acknowledgeWorker(sequence: number): boolean {
+    if (!Number.isSafeInteger(sequence) || sequence < 0 || sequence >= this.nextWorkerSeq) return false;
+    if (sequence <= this.acknowledgedWorkerSeq) return true;
+    this.acknowledgedWorkerSeq = sequence;
+    while (this.outbound[0]?.seq <= sequence) {
+      const removed = this.outbound.shift();
+      if (removed) this.queuedBytes = Math.max(0, this.queuedBytes - removed.bytes);
+    }
+    return true;
+  }
+
+  outboundMessages(): Array<{ seq: number; payload: unknown }> {
+    const selected: Array<{ seq: number; payload: unknown }> = [];
+    let bytes = 0;
+    for (const message of this.outbound) {
+      if (selected.length >= relayContract.httpFallbackMaximumQueuedMessages) break;
+      if (selected.length > 0 && bytes + message.bytes > relayContract.httpFallbackMaximumEnvelopeBytes) break;
+      selected.push({ seq: message.seq, payload: message.payload });
+      bytes += message.bytes;
+    }
+    return selected;
+  }
+
+  acceptDaemonSequence(sequence: number): "new" | "duplicate" | "gap" {
+    if (!Number.isSafeInteger(sequence) || sequence <= 0) return "gap";
+    if (sequence <= this.acknowledgedDaemonSeq) return "duplicate";
+    if (sequence !== this.acknowledgedDaemonSeq + 1) return "gap";
+    return "new";
+  }
+
+  commitDaemonSequence(sequence: number): void {
+    if (sequence !== this.acknowledgedDaemonSeq + 1) throw new Error("HTTP daemon sequence commit is not contiguous");
+    this.acknowledgedDaemonSeq = sequence;
+  }
+
+  close(): void {
+    this.closed = true;
+    this.outbound.length = 0;
+    this.queuedBytes = 0;
+  }
+}

package/src/worker/daemon-http-controller.ts

@@ -0,0 +1,163 @@
+import relayContract from "../shared/relay-contract.json" with { type: "json" };
+import { authorityRevocations, authorityRevocationWireMessage } from "./authority-revocations.ts";
+import type { DaemonChannel } from "./daemon-channel.ts";
+import { verifyDaemonHttpRelayRequest } from "./daemon-http-auth.ts";
+import type { DaemonHttpChannel } from "./daemon-http-channel.ts";
+import { normalizeDaemonHttpExchange } from "./daemon-http-protocol.ts";
+import type { DaemonRegistry } from "./daemon-registry.ts";
+import { handleReadyDaemonMessage } from "./daemon-ready-messages.ts";
+import { notifyReadyDaemon } from "./daemon-ready-waiters.ts";
+import { HttpError, json, readBoundedBytes } from "./http.ts";
+import type { WorkerObservability } from "./observability.ts";
+import type { PendingCallRegistry } from "./pending-calls.ts";
+import { sanitizeDaemonPolicy, sanitizeDaemonTools } from "./policy.ts";
+import { sanitizeDaemonRelayDiagnostics } from "./daemon-relay-diagnostics.ts";
+import { randomToken } from "./oauth-state.ts";
+
+export async function handleDaemonHttpRelay(input: {
+  request: Request;
+  storage: DurableObjectStorage;
+  registry: DaemonRegistry;
+  pending: PendingCallRegistry;
+  observability: WorkerObservability;
+  publicKeyJson: string;
+  server: string;
+  version: string;
+  scheduleAlarm: () => Promise<void>;
+  detachChannel: (channel: DaemonChannel, message: string) => Promise<void>;
+  retireWebSocket: (socket: WebSocket, message: string) => Promise<void>;
+}): Promise<Response> {
+  const bodyBytes = await readBoundedBytes(input.request, relayContract.httpFallbackMaximumEnvelopeBytes);
+  const workerOrigin = new URL(input.request.url).origin;
+  if (!(await verifyDaemonHttpRelayRequest({
+    storage: input.storage, publicKeyJson: input.publicKeyJson, headers: input.request.headers,
+    body: bodyBytes, workerOrigin, server: input.server, version: input.version,
+  }))) return json({ error: "daemon_http_unauthorized" }, 401);
+  const exchange = normalizeDaemonHttpExchange(parseJson(bodyBytes));
+  if (!exchange) return json({ error: "invalid_daemon_http_exchange" }, 400);
+
+  let channel = input.registry.http.get(exchange.sessionId);
+  if (!channel && (exchange.activationToken || exchange.ackWorkerSeq !== 0 || exchange.messages.length > 0)) {
+    return json({ error: "unknown_daemon_http_session" }, 409);
+  }
+  const readyHttpChannels = input.registry.httpReadyChannels();
+  if (!channel && readyHttpChannels.some((candidate) => candidate.attachment.instanceId !== exchange.instanceId)) {
+    return relayResponse("standby", null, 0, []);
+  }
+  const readySockets = input.registry.readySockets();
+  if (readySockets.length > 0) {
+    if (channel || !exchange.takeoverWebSocket || readySockets.some((socket) =>
+      input.registry.readyAttachment(socket)?.instanceId !== exchange.instanceId)) {
+      if (channel) input.registry.http.close(channel);
+      return relayResponse("standby", null, 0, []);
+    }
+    for (const socket of readySockets) {
+      await input.retireWebSocket(socket, "authenticated HTTPS fallback replacing same-instance WebSocket");
+    }
+  }
+
+  if (!channel) {
+    const sameInstanceChannels = [
+      ...readyHttpChannels,
+      ...input.registry.httpCandidates().filter((candidate) => candidate.sessionId !== exchange.sessionId),
+    ].filter((candidate) => candidate.attachment.instanceId === exchange.instanceId);
+    for (const previous of sameInstanceChannels) {
+      await input.detachChannel(previous, "new authenticated HTTPS fallback session replaced same-instance channel");
+      input.registry.http.close(previous);
+    }
+    const policy = sanitizeDaemonPolicy(exchange.policy);
+    const now = Date.now();
+    channel = input.registry.http.beginCandidate(exchange.sessionId, {
+      role: "candidate", connectedAt: new Date(now).toISOString(), lastSeenAt: new Date(now).toISOString(),
+      instanceId: exchange.instanceId, connectionId: randomToken("connection"), policy,
+      tools: sanitizeDaemonTools(exchange.tools, policy),
+      relayDiagnostics: sanitizeDaemonRelayDiagnostics(exchange.relayDiagnostics),
+    }, now);
+    if (!channel) return json({ error: "daemon_http_candidate_capacity" }, 503);
+    const queuedRevocations = await authorityRevocations(input.storage);
+    input.registry.http.activate(exchange.sessionId, channel.activationToken, now);
+    const rebound = input.pending.rebindInstance(exchange.instanceId, channel);
+    channel.send(JSON.stringify({ type: "resume_calls", ids: rebound }));
+    for (const revocation of queuedRevocations) channel.send(JSON.stringify(authorityRevocationWireMessage(revocation)));
+    channel.send(JSON.stringify({ type: "ready_ack", server: input.server, version: input.version }));
+    await input.scheduleAlarm();
+    return relayResponse("probing", channel.activationToken, channel.daemonSequence, channel.outboundMessages());
+  }
+  if (channel.attachment.instanceId !== exchange.instanceId) return json({ error: "daemon_http_instance_mismatch" }, 409);
+
+  if (channel.readyState !== 1) {
+    if (!channel.isActivated) {
+      input.registry.http.close(channel);
+      return json({ error: "invalid_daemon_http_candidate_state" }, 409);
+    }
+    if (exchange.activationToken !== channel.activationToken || !channel.acknowledgeWorker(exchange.ackWorkerSeq)) {
+      return json({ error: "invalid_daemon_http_acknowledgement" }, 409);
+    }
+    channel.touch();
+    for (const message of exchange.messages) {
+      const sequence = channel.acceptDaemonSequence(message.seq);
+      if (sequence === "duplicate") continue;
+      if (sequence === "gap") return invalidate(channel, input, "daemon_http_sequence_gap");
+      if (message.payload.type === "https_ready") {
+        if (channel.outboundMessages().length > 0) {
+          return invalidate(channel, input, "daemon_http_ready_before_control_ack");
+        }
+        channel.verifyReady();
+        input.registry.rememberReady(channel);
+        channel.commitDaemonSequence(message.seq);
+        const previous = input.registry.httpReadyChannels().filter((candidate) => candidate !== channel);
+        for (const old of previous) {
+          await input.detachChannel(old, "HTTPS fallback channel replaced after verified handover");
+          input.registry.http.close(old);
+        }
+        input.observability.event("info", "daemon.https_fallback.ready", { daemon_owned_calls: exchange.ownedCallIds.length });
+        notifyReadyDaemon(input.registry);
+        continue;
+      }
+      const handled = await handleReadyDaemonMessage({
+        channel, body: message.payload, pending: input.pending, storage: input.storage, observability: input.observability,
+      });
+      if (!handled.ok) return invalidate(channel, input, handled.errorCode ?? "invalid_daemon_http_message");
+      channel.commitDaemonSequence(message.seq);
+    }
+    await input.scheduleAlarm();
+    return relayResponse(channel.readyState === 1 ? "ready" : "probing", channel.activationToken, channel.daemonSequence, channel.outboundMessages());
+  }
+
+  if (exchange.activationToken !== channel.activationToken || !channel.acknowledgeWorker(exchange.ackWorkerSeq)) {
+    return json({ error: "invalid_daemon_http_acknowledgement" }, 409);
+  }
+  channel.touch();
+  for (const message of exchange.messages) {
+    const sequence = channel.acceptDaemonSequence(message.seq);
+    if (sequence === "duplicate") continue;
+    if (sequence === "gap") return invalidate(channel, input, "daemon_http_sequence_gap");
+    const handled = await handleReadyDaemonMessage({
+      channel, body: message.payload, pending: input.pending, storage: input.storage, observability: input.observability,
+    });
+    if (!handled.ok) return invalidate(channel, input, handled.errorCode ?? "invalid_daemon_http_message");
+    channel.commitDaemonSequence(message.seq);
+  }
+  await input.scheduleAlarm();
+  return relayResponse("ready", channel.activationToken, channel.daemonSequence, channel.outboundMessages());
+}
+
+async function invalidate(channel: DaemonHttpChannel, input: Parameters<typeof handleDaemonHttpRelay>[0], code: string): Promise<Response> {
+  await input.detachChannel(channel, `HTTPS fallback protocol failure: ${code}`);
+  input.registry.http.close(channel);
+  input.observability.event("warn", "daemon.https_fallback.invalidated", { error_class: code });
+  await input.scheduleAlarm();
+  return json({ error: code }, 409);
+}
+
+function relayResponse(phase: "probing" | "ready" | "standby", activationToken: string | null, ackDaemonSeq: number, messages: unknown[]): Response {
+  return json({ protocol: 1, phase, activation_token: activationToken, ack_daemon_seq: ackDaemonSeq, messages });
+}
+
+function parseJson(bytes: Uint8Array): unknown {
+  let text: string;
+  try { text = new TextDecoder("utf-8", { fatal: true }).decode(bytes); }
+  catch { throw new HttpError(400, "invalid_encoding", "daemon HTTP relay body must be UTF-8"); }
+  try { return JSON.parse(text); }
+  catch { throw new HttpError(400, "invalid_json", "daemon HTTP relay body is not valid JSON"); }
+}

package/src/worker/daemon-http-protocol.ts

@@ -0,0 +1,62 @@
+import { sanitizeDaemonInstanceId } from "./daemon-socket-attachment.ts";
+
+const SESSION_ID = /^relay_http_[A-Za-z0-9_-]{43}$/;
+const ACTIVATION_TOKEN = /^activate_[A-Za-z0-9_-]{43}$/;
+const CALL_ID = /^call_[A-Za-z0-9_-]{8,240}$/;
+
+export interface DaemonHttpExchange {
+  sessionId: string;
+  instanceId: string;
+  activationToken: string;
+  ackWorkerSeq: number;
+  takeoverWebSocket: boolean;
+  ownedCallIds: string[];
+  messages: Array<{ seq: number; payload: Record<string, unknown> }>;
+  tools: unknown;
+  policy: unknown;
+  relayDiagnostics: unknown;
+}
+
+export function normalizeDaemonHttpExchange(value: unknown): DaemonHttpExchange | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const body = value as Record<string, unknown>;
+  if (body.protocol !== 1) return null;
+  const sessionId = typeof body.session_id === "string" && SESSION_ID.test(body.session_id) ? body.session_id : "";
+  const instanceId = sanitizeDaemonInstanceId(body.instance_id) ?? "";
+  const activationToken = body.activation_token === undefined ? ""
+    : typeof body.activation_token === "string" && ACTIVATION_TOKEN.test(body.activation_token) ? body.activation_token : "invalid";
+  const ackWorkerSeq = Number(body.ack_worker_seq);
+  const takeoverWebSocket = body.takeover_websocket === undefined ? false : body.takeover_websocket;
+  const ownedCallIds = normalizeCallIds(body.owned_call_ids);
+  const messages = normalizeMessages(body.messages);
+  if (!sessionId || !instanceId || activationToken === "invalid" || !Number.isSafeInteger(ackWorkerSeq) || ackWorkerSeq < 0
+      || typeof takeoverWebSocket !== "boolean" || !ownedCallIds || !messages) return null;
+  return {
+    sessionId, instanceId, activationToken, ackWorkerSeq, takeoverWebSocket, ownedCallIds, messages,
+    tools: body.tools, policy: body.policy, relayDiagnostics: body.relay_diagnostics,
+  };
+}
+
+function normalizeCallIds(value: unknown): string[] | null {
+  if (!Array.isArray(value) || value.length > 32) return null;
+  const result: string[] = [];
+  const seen = new Set<string>();
+  for (const item of value) {
+    if (typeof item !== "string" || !CALL_ID.test(item) || seen.has(item)) return null;
+    seen.add(item); result.push(item);
+  }
+  return result;
+}
+
+function normalizeMessages(value: unknown): Array<{ seq: number; payload: Record<string, unknown> }> | null {
+  if (!Array.isArray(value) || value.length > 64) return null;
+  const result = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return null;
+    const record = item as Record<string, unknown>;
+    if (!Number.isSafeInteger(record.seq) || Number(record.seq) <= 0
+        || !record.payload || typeof record.payload !== "object" || Array.isArray(record.payload)) return null;
+    result.push({ seq: Number(record.seq), payload: record.payload as Record<string, unknown> });
+  }
+  return result;
+}