sliccy 4.22.0 → 4.23.0

package/dist/node-server/bridge-security.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Bridge security primitives for the standalone thin /cdp bridge.
+ *
+ * The standalone CLI runs a thin Express server that proxies CDP from a
+ * sliccy.ai-hosted leader tab to the local Chrome over `/cdp`. Full CDP
+ * pass-through = full control of the user's Chrome, so the WebSocket
+ * upgrade is gated by two factors plus PNA:
+ *   1. Origin allowlist (`isAllowedBridgeOrigin`).
+ *   2. Per-process subprotocol token in `Sec-WebSocket-Protocol`
+ *      (`SUBPROTOCOL_PREFIX` + token). Never appears in a query string,
+ *      so it does not leak into Referer / logs.
+ *   3. PNA preflight (`buildPnaPreflightHeaders`) — Chrome blocks
+ *      public→private WS upgrades without `Access-Control-Allow-Private-Network`.
+ *
+ * Cross-origin /api calls from the hosted leader also need CORS; see
+ * `buildCorsHeaders` for the per-request response set.
+ *
+ * Pure module (no node-only imports) so the WS gate is trivially unit
+ * testable from `tests/bridge-security.test.ts`.
+ */
+/**
+ * Origin allowlist. Production + staging worker plus the dev-mode loopback
+ * origins (parallel to chrome-extension's `BRIDGE_DEV_ORIGINS`). Add a new
+ * origin here and in the extension allowlist together — they MUST stay in
+ * sync, otherwise extension and standalone disagree on what's a leader.
+ */
+export declare const BRIDGE_ALLOWED_ORIGINS: readonly string[];
+/** Subprotocol prefix advertised by the leader; the per-process token is appended. */
+export declare const BRIDGE_SUBPROTOCOL_PREFIX = "slicc.bridge.v1.";
+/** Query-param name the launch URL uses to forward the subprotocol token to the leader. */
+export declare const BRIDGE_TOKEN_QUERY_PARAM = "bridgeToken";
+/** Query-param name the launch URL uses to forward the local /cdp WebSocket URL. */
+export declare const BRIDGE_WS_QUERY_PARAM = "bridge";
+/** True iff `origin` is in the bridge allowlist. Case-sensitive (origins are normalized lowercase). */
+export declare function isAllowedBridgeOrigin(origin: string | undefined | null): boolean;
+/**
+ * Mint a per-process bridge token. Embedded in the leader launch URL and
+ * required as the WebSocket subprotocol on /cdp. Use `crypto.randomUUID()`
+ * — 122 bits of entropy is plenty for a session-scoped capability.
+ */
+export declare function mintBridgeToken(): string;
+/**
+ * Parse the `Sec-WebSocket-Protocol` request header into a trimmed list. The
+ * header is a comma-separated list per RFC 6455; `ws` exposes it raw.
+ */
+export declare function parseSubprotocolHeader(header: string | string[] | undefined): string[];
+/**
+ * Pick the bridge subprotocol matching `expectedToken`, or null if absent.
+ * The matching protocol is what we MUST echo back in the upgrade response
+ * (RFC 6455 §1.9) — otherwise the browser closes the socket.
+ */
+export declare function selectBridgeSubprotocol(protocols: readonly string[], expectedToken: string): string | null;
+export interface BridgeUpgradeGateResult {
+    ok: boolean;
+    /**
+     * The subprotocol to echo back in the 101 response when `ok === true`.
+     * Always null when `ok === false`.
+     */
+    acceptedSubprotocol: string | null;
+    /**
+     * Reason exposed in logs for rejection. Intentionally coarse — does not
+     * tell the caller WHICH check failed, mirroring `validateBridgePin` in
+     * the chrome-extension bridge SW.
+     */
+    reason?: 'origin-not-allowed' | 'subprotocol-missing-or-mismatched';
+}
+/**
+ * Combined origin + subprotocol gate for a `/cdp` upgrade request.
+ *
+ * Returns `{ ok: true, acceptedSubprotocol }` only when BOTH the origin is
+ * in the allowlist AND a matching `slicc.bridge.v1.<expectedToken>`
+ * subprotocol was offered. Closes-the-socket-before-emit semantics live at
+ * the call site in `index.ts`.
+ */
+export declare function validateBridgeUpgrade(input: {
+    origin: string | undefined | null;
+    subprotocolHeader: string | string[] | undefined;
+    expectedToken: string;
+}): BridgeUpgradeGateResult;
+/**
+ * CORS headers for an allowlisted `Origin`. Returns `null` when the origin
+ * is not in the allowlist (caller should NOT set CORS headers).
+ *
+ * `Access-Control-Allow-Credentials: true` is included so the hosted leader
+ * can carry cookies to /api/* (e.g. auth) when that's added later. Today
+ * the bridge token is the auth factor, not cookies.
+ */
+export declare function buildCorsHeaders(origin: string | undefined | null): Record<string, string> | null;
+/**
+ * PNA preflight extras. Added on OPTIONS responses for allowlisted origins
+ * when the request carries `Access-Control-Request-Private-Network: true`
+ * — Chrome blocks public→private fetch / WS otherwise.
+ */
+export declare function buildPnaPreflightHeaders(): Record<string, string>;

package/dist/node-server/bridge-security.js

@@ -0,0 +1,132 @@
+/**
+ * Bridge security primitives for the standalone thin /cdp bridge.
+ *
+ * The standalone CLI runs a thin Express server that proxies CDP from a
+ * sliccy.ai-hosted leader tab to the local Chrome over `/cdp`. Full CDP
+ * pass-through = full control of the user's Chrome, so the WebSocket
+ * upgrade is gated by two factors plus PNA:
+ *   1. Origin allowlist (`isAllowedBridgeOrigin`).
+ *   2. Per-process subprotocol token in `Sec-WebSocket-Protocol`
+ *      (`SUBPROTOCOL_PREFIX` + token). Never appears in a query string,
+ *      so it does not leak into Referer / logs.
+ *   3. PNA preflight (`buildPnaPreflightHeaders`) — Chrome blocks
+ *      public→private WS upgrades without `Access-Control-Allow-Private-Network`.
+ *
+ * Cross-origin /api calls from the hosted leader also need CORS; see
+ * `buildCorsHeaders` for the per-request response set.
+ *
+ * Pure module (no node-only imports) so the WS gate is trivially unit
+ * testable from `tests/bridge-security.test.ts`.
+ */
+import { randomUUID } from 'node:crypto';
+/**
+ * Origin allowlist. Production + staging worker plus the dev-mode loopback
+ * origins (parallel to chrome-extension's `BRIDGE_DEV_ORIGINS`). Add a new
+ * origin here and in the extension allowlist together — they MUST stay in
+ * sync, otherwise extension and standalone disagree on what's a leader.
+ */
+export const BRIDGE_ALLOWED_ORIGINS = Object.freeze([
+    'https://www.sliccy.ai',
+    'https://slicc-tray-hub-staging.minivelos.workers.dev',
+    'http://localhost:5710',
+    'http://127.0.0.1:5710',
+]);
+/** Subprotocol prefix advertised by the leader; the per-process token is appended. */
+export const BRIDGE_SUBPROTOCOL_PREFIX = 'slicc.bridge.v1.';
+/** Query-param name the launch URL uses to forward the subprotocol token to the leader. */
+export const BRIDGE_TOKEN_QUERY_PARAM = 'bridgeToken';
+/** Query-param name the launch URL uses to forward the local /cdp WebSocket URL. */
+export const BRIDGE_WS_QUERY_PARAM = 'bridge';
+/** Headers we allow on cross-origin /api requests from the hosted leader. */
+const CORS_ALLOW_HEADERS = 'Content-Type, X-Slicc-Raw-Body, X-Session-Id, X-Bridge-Token, Authorization';
+/** Methods exposed to the hosted leader. */
+const CORS_ALLOW_METHODS = 'GET, POST, PUT, DELETE, OPTIONS';
+/** True iff `origin` is in the bridge allowlist. Case-sensitive (origins are normalized lowercase). */
+export function isAllowedBridgeOrigin(origin) {
+    if (!origin)
+        return false;
+    return BRIDGE_ALLOWED_ORIGINS.includes(origin);
+}
+/**
+ * Mint a per-process bridge token. Embedded in the leader launch URL and
+ * required as the WebSocket subprotocol on /cdp. Use `crypto.randomUUID()`
+ * — 122 bits of entropy is plenty for a session-scoped capability.
+ */
+export function mintBridgeToken() {
+    return randomUUID();
+}
+/**
+ * Parse the `Sec-WebSocket-Protocol` request header into a trimmed list. The
+ * header is a comma-separated list per RFC 6455; `ws` exposes it raw.
+ */
+export function parseSubprotocolHeader(header) {
+    if (!header)
+        return [];
+    const flat = Array.isArray(header) ? header.join(',') : header;
+    return flat
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/**
+ * Pick the bridge subprotocol matching `expectedToken`, or null if absent.
+ * The matching protocol is what we MUST echo back in the upgrade response
+ * (RFC 6455 §1.9) — otherwise the browser closes the socket.
+ */
+export function selectBridgeSubprotocol(protocols, expectedToken) {
+    if (!expectedToken)
+        return null;
+    const expected = `${BRIDGE_SUBPROTOCOL_PREFIX}${expectedToken}`;
+    return protocols.includes(expected) ? expected : null;
+}
+/**
+ * Combined origin + subprotocol gate for a `/cdp` upgrade request.
+ *
+ * Returns `{ ok: true, acceptedSubprotocol }` only when BOTH the origin is
+ * in the allowlist AND a matching `slicc.bridge.v1.<expectedToken>`
+ * subprotocol was offered. Closes-the-socket-before-emit semantics live at
+ * the call site in `index.ts`.
+ */
+export function validateBridgeUpgrade(input) {
+    if (!isAllowedBridgeOrigin(input.origin)) {
+        return { ok: false, acceptedSubprotocol: null, reason: 'origin-not-allowed' };
+    }
+    const protocols = parseSubprotocolHeader(input.subprotocolHeader);
+    const accepted = selectBridgeSubprotocol(protocols, input.expectedToken);
+    if (!accepted) {
+        return {
+            ok: false,
+            acceptedSubprotocol: null,
+            reason: 'subprotocol-missing-or-mismatched',
+        };
+    }
+    return { ok: true, acceptedSubprotocol: accepted };
+}
+/**
+ * CORS headers for an allowlisted `Origin`. Returns `null` when the origin
+ * is not in the allowlist (caller should NOT set CORS headers).
+ *
+ * `Access-Control-Allow-Credentials: true` is included so the hosted leader
+ * can carry cookies to /api/* (e.g. auth) when that's added later. Today
+ * the bridge token is the auth factor, not cookies.
+ */
+export function buildCorsHeaders(origin) {
+    if (!isAllowedBridgeOrigin(origin))
+        return null;
+    return {
+        'Access-Control-Allow-Origin': origin,
+        'Access-Control-Allow-Credentials': 'true',
+        'Access-Control-Allow-Methods': CORS_ALLOW_METHODS,
+        'Access-Control-Allow-Headers': CORS_ALLOW_HEADERS,
+        'Access-Control-Expose-Headers': 'Link',
+        Vary: 'Origin',
+    };
+}
+/**
+ * PNA preflight extras. Added on OPTIONS responses for allowlisted origins
+ * when the request carries `Access-Control-Request-Private-Network: true`
+ * — Chrome blocks public→private fetch / WS otherwise.
+ */
+export function buildPnaPreflightHeaders() {
+    return { 'Access-Control-Allow-Private-Network': 'true' };
+}

package/dist/node-server/index.js

@@ -10,6 +10,7 @@ import { homedir } from 'os';
 import { basename, dirname, join, resolve } from 'path';
 import { fileURLToPath } from 'url';
 import { WebSocket, WebSocketServer } from 'ws';
+import { buildCorsHeaders, buildPnaPreflightHeaders, mintBridgeToken, selectBridgeSubprotocol, validateBridgeUpgrade, } from './bridge-security.js';
 import { applyCdpUnmask } from './cdp-proxy/cdp-unmask.js';
 import { createCdpSessionUrlTracker } from './cdp-proxy/session-url-tracker.js';
 import { buildChromeLaunchArgs, clearStaleDevToolsActivePort, ensureQaProfileScaffold, findChromeExecutable, legacyChromeCandidates, migrateLegacyDefaultChromeProfile, planChromeSpawn, resolveChromeLaunchProfile, waitForCdpPort, } from './chrome-launch.js';
@@ -65,6 +66,13 @@ const SERVE_ONLY = RUNTIME_FLAGS.serveOnly;
 const ELECTRON_MODE = RUNTIME_FLAGS.electron;
 const ELECTRON_APP = RUNTIME_FLAGS.electronApp;
 const KILL_EXISTING_ELECTRON_APP = RUNTIME_FLAGS.kill;
+/**
+ * Standalone thin-bridge mode: production CLI with no bundled UI. The
+ * launched Chrome opens a sliccy.ai-hosted leader; node-server is a thin
+ * /cdp bridge + /api surface. Dev / electron / serve-only / hosted all
+ * keep the bundled UI path (a separate path B / hosted task covers those).
+ */
+const THIN_BRIDGE_MODE = !DEV_MODE && !SERVE_ONLY && !ELECTRON_MODE && !RUNTIME_FLAGS.hosted;
 // ---------------------------------------------------------------------------
 // File logger — persistent log file in ~/.slicc/logs/
 // ---------------------------------------------------------------------------
@@ -300,6 +308,7 @@ function createServerState() {
         overlayInjector: null,
         shuttingDown: false,
         discoveredTrayJoinUrl: RUNTIME_FLAGS.joinUrl ?? null,
+        bridgeToken: THIN_BRIDGE_MODE ? mintBridgeToken() : null,
         cdpUrl: null,
         chromeWs: null,
         activeClientWs: null,
@@ -465,15 +474,33 @@ async function launchElectronTarget(state) {
         throw error;
     }
 }
+/**
+ * Resolve the leader origin Chrome should open in thin-bridge mode. Prefers
+ * an explicit `--lead <url>` / `WORKER_BASE_URL` so dev can point at staging;
+ * defaults to production sliccy.ai.
+ */
+function resolveThinLeaderOrigin() {
+    const explicit = RUNTIME_FLAGS.leadWorkerBaseUrl ?? process.env['WORKER_BASE_URL'] ?? null;
+    if (explicit) {
+        return explicit.replace(/\/+$/, '');
+    }
+    return 'https://www.sliccy.ai';
+}
 /** Build the Chrome launch URL, appending hosted-runtime + prompt query params. */
 function buildBrowserLaunchUrl(state) {
+    // Thin-bridge standalone: Chrome opens the hosted leader directly; the
+    // local node-server serves no UI at all. Bridge coordinates ride as
+    // query params so the leader can discover + authenticate /cdp.
+    const serveOriginForLaunch = THIN_BRIDGE_MODE && state.bridgeToken ? resolveThinLeaderOrigin() : state.serveOrigin;
     let url = resolveCliBrowserLaunchUrl({
-        serveOrigin: state.serveOrigin,
+        serveOrigin: serveOriginForLaunch,
         lead: RUNTIME_FLAGS.lead,
         leadWorkerBaseUrl: RUNTIME_FLAGS.leadWorkerBaseUrl,
         envWorkerBaseUrl: process.env['WORKER_BASE_URL'] ?? null,
         join: RUNTIME_FLAGS.join,
         joinUrl: RUNTIME_FLAGS.joinUrl,
+        bridgeWsUrl: THIN_BRIDGE_MODE && state.bridgeToken ? `ws://localhost:${state.servePort}/cdp` : null,
+        bridgeToken: state.bridgeToken,
     });
     if (RUNTIME_FLAGS.hosted) {
         url += `${url.includes('?') ? '&' : '?'}runtime=hosted-leader`;
@@ -487,6 +514,11 @@ function buildBrowserLaunchUrl(state) {
     else if (RUNTIME_FLAGS.lead) {
         console.log(`Lead launch URL: ${url}`);
     }
+    else if (THIN_BRIDGE_MODE) {
+        // Print WITHOUT the bridgeToken — it's a session capability.
+        const sanitized = url.replace(/([?&])bridgeToken=[^&]+/, '$1bridgeToken=<redacted>');
+        console.log(`Thin-bridge launch URL: ${sanitized}`);
+    }
     return url;
 }
 function resolveChromeProfileOrExit(state) {
@@ -602,11 +634,56 @@ function closeWebSocketQuietly(ws) {
         /* ignore */
     }
 }
-/** Route `/cdp` and `/licks-ws` upgrades to their servers; leave others for Vite HMR. */
-function attachCdpUpgradeRouting(server, wss, lickWss) {
+/**
+ * Reject a WebSocket upgrade before `handleUpgrade` runs. Writes a minimal
+ * HTTP/1.1 response and destroys the underlying socket. RFC 6455 allows 401
+ * / 403 here; we use 401 so a caller that retries with the correct
+ * subprotocol/origin doesn't trip permanent CORS-style caches.
+ */
+function rejectUpgradeUnauthorized(socket, reason) {
+    try {
+        socket.write(`HTTP/1.1 401 Unauthorized\r\n` +
+            `Content-Type: text/plain\r\n` +
+            `Connection: close\r\n` +
+            `Content-Length: ${Buffer.byteLength(reason)}\r\n` +
+            `\r\n${reason}`);
+    }
+    catch {
+        /* socket may already be gone */
+    }
+    try {
+        socket.destroy();
+    }
+    catch {
+        /* ignore */
+    }
+}
+/**
+ * Route `/cdp` and `/licks-ws` upgrades to their servers; leave others for Vite HMR.
+ *
+ * When `bridgeToken !== null` (thin standalone mode) the `/cdp` upgrade is
+ * gated by `validateBridgeUpgrade`: bad origin or missing/wrong
+ * `Sec-WebSocket-Protocol` token = socket destroyed before
+ * `wss.emit('connection', ...)` ever fires. Legacy modes (dev / electron /
+ * serve-only / hosted) pass `null` to keep same-origin behavior unchanged.
+ * `/licks-ws` is loopback-only and stays ungated.
+ */
+function attachCdpUpgradeRouting(server, wss, lickWss, bridgeToken) {
     server.on('upgrade', (request, socket, head) => {
         const { pathname } = new URL(request.url, `http://${request.headers.host}`);
         if (pathname === '/cdp') {
+            if (bridgeToken !== null) {
+                const gate = validateBridgeUpgrade({
+                    origin: request.headers.origin,
+                    subprotocolHeader: request.headers['sec-websocket-protocol'],
+                    expectedToken: bridgeToken,
+                });
+                if (!gate.ok) {
+                    console.warn(`[cdp-proxy] /cdp upgrade rejected: ${gate.reason}`);
+                    rejectUpgradeUnauthorized(socket, gate.reason ?? 'rejected');
+                    return;
+                }
+            }
             wss.handleUpgrade(request, socket, head, (ws) => {
                 wss.emit('connection', ws, request);
             });
@@ -877,7 +954,12 @@ async function startOverlayInjector(state, cdpPort, servePort) {
 function startCdpServer(state, deps) {
     const { app, server, ctx, fileLogger, servePort, serveOrigin, cdpPort } = deps;
     server.listen(servePort, '127.0.0.1', () => {
-        console.log(`Serving UI at ${serveOrigin}`);
+        if (THIN_BRIDGE_MODE) {
+            console.log(`Thin /cdp bridge + /api at ${serveOrigin}`);
+        }
+        else {
+            console.log(`Serving UI at ${serveOrigin}`);
+        }
         console.log(`CDP proxy at ws://localhost:${servePort}/cdp`);
         fileLogger.log('info', 'CLI server started', {
             port: servePort,
@@ -889,7 +971,8 @@ function startCdpServer(state, deps) {
         if (ELECTRON_MODE) {
             void startOverlayInjector(state, cdpPort, servePort);
         }
-        else {
+        else if (!THIN_BRIDGE_MODE) {
+            // Thin-bridge mode has no local UI page to forward console output from.
             setTimeout(() => {
                 attachConsoleForwarder(cdpPort, String(servePort)).catch((err) => {
                     console.error('[page] Console forwarder error:', err);
@@ -924,6 +1007,50 @@ async function bootstrapSecrets() {
     }
     return { secretStore, secretProxy, oauthStore };
 }
+/**
+ * Thin-bridge CORS + PNA middleware. The hosted leader at sliccy.ai is a
+ * cross-origin caller, so headers go on every response for allowlisted
+ * origins (so /cdp's pre-WS preflight and every /api/* call succeed);
+ * OPTIONS from an allowlisted origin short-circuits to 204 with the PNA
+ * opt-in. Non-allowlisted origins fall through with no CORS headers, which
+ * preserves same-origin (localhost) behavior unchanged.
+ */
+function createThinBridgeCorsMiddleware() {
+    return (req, res, next) => {
+        const cors = buildCorsHeaders(req.headers.origin);
+        if (cors) {
+            for (const [k, v] of Object.entries(cors))
+                res.setHeader(k, v);
+        }
+        if (req.method === 'OPTIONS' && cors) {
+            for (const [k, v] of Object.entries(buildPnaPreflightHeaders()))
+                res.setHeader(k, v);
+            res.setHeader('Access-Control-Max-Age', '600');
+            res.status(204).end();
+            return;
+        }
+        next();
+    };
+}
+/**
+ * Build the `/cdp` `WebSocketServer`. `handleProtocols` echoes the matched
+ * bridge subprotocol back in the 101 response (RFC 6455 §1.9). Returning
+ * `false` makes the server omit the header, which makes the browser fail
+ * the upgrade when a subprotocol was offered. Legacy modes (token=null)
+ * pass the first offered subprotocol through unchanged.
+ */
+function createCdpWebSocketServer(bridgeToken) {
+    return new WebSocketServer({
+        noServer: true,
+        handleProtocols: (protocols) => {
+            if (bridgeToken !== null) {
+                return selectBridgeSubprotocol([...protocols], bridgeToken) ?? false;
+            }
+            const first = protocols.values().next();
+            return first.done ? false : first.value;
+        },
+    });
+}
 async function main() {
     // Resolve ports, launch the browser, then snapshot the now-final values that
     // the rest of boot reads. Mutable lifecycle fields stay on `state`.
@@ -938,6 +1065,9 @@ async function main() {
     app.use(requestLogger);
     // Append SLICC's standard RFC 8288 Link header set on every /api/* response.
     app.use(sliccLinksMiddleware());
+    if (THIN_BRIDGE_MODE) {
+        app.use(createThinBridgeCorsMiddleware());
+    }
     // ---------------------------------------------------------------------------
     // Lick system — WebSocket bridge for webhooks/crontasks (all logic in browser)
     // ---------------------------------------------------------------------------
@@ -1012,17 +1142,21 @@ async function main() {
     registerFetchProxyRoute(app, { secretProxy });
     // Create the HTTP server BEFORE Vite so we can register our upgrade handler first
     const server = createServer(app);
-    await attachUiServing(app, server, {
-        devMode: DEV_MODE,
-        hosted: RUNTIME_FLAGS.hosted,
-        serveOrigin: SERVE_ORIGIN,
-        uiDir: resolve(Dirname, '..', 'ui'),
-    });
+    // Thin-bridge mode: skip UI serving entirely. node-server becomes a
+    // pure /cdp bridge + /api surface; Chrome opens the sliccy.ai-hosted
+    // leader which talks to /cdp + /api cross-origin.
+    if (!THIN_BRIDGE_MODE) {
+        await attachUiServing(app, server, {
+            devMode: DEV_MODE,
+            hosted: RUNTIME_FLAGS.hosted,
+            serveOrigin: SERVE_ORIGIN,
+            uiDir: resolve(Dirname, '..', 'ui'),
+        });
+    }
     // 4. CDP WebSocket proxy at /cdp — noServer mode so Vite's dev middleware
-    //    doesn't intercept the upgrade; the per-message cap stays default (the
-    //    feedback-loop defense is Chrome→proxy only, never client→proxy).
-    const wss = new WebSocketServer({ noServer: true });
-    attachCdpUpgradeRouting(server, wss, lickWss);
+    //    doesn't intercept the upgrade.
+    const wss = createCdpWebSocketServer(state.bridgeToken);
+    attachCdpUpgradeRouting(server, wss, lickWss, state.bridgeToken);
     const cdpCtx = {
         wss,
         secretProxy,

package/dist/node-server/launch-url.d.ts

@@ -5,5 +5,12 @@ export interface CliLaunchUrlOptions {
     envWorkerBaseUrl?: string | null;
     join: boolean;
     joinUrl?: string | null;
+    /**
+     * Thin-bridge coordinates appended as query params so the hosted leader can
+     * discover + authenticate the local /cdp WebSocket. Both must be set
+     * together; both unset = no bridge params (legacy / bundled UI path).
+     */
+    bridgeWsUrl?: string | null;
+    bridgeToken?: string | null;
 }
 export declare function resolveCliBrowserLaunchUrl(options: CliLaunchUrlOptions): string;

package/dist/node-server/launch-url.js

@@ -1,4 +1,13 @@
+import { BRIDGE_TOKEN_QUERY_PARAM, BRIDGE_WS_QUERY_PARAM } from './bridge-security.js';
 import { buildCanonicalTrayLaunchUrl, normalizeTrayWorkerBaseUrl, parseTrayJoinUrl, } from './tray-url-shared.js';
+function appendBridgeParams(url, opts) {
+    if (!opts.bridgeWsUrl || !opts.bridgeToken)
+        return url;
+    const params = new URLSearchParams();
+    params.set(BRIDGE_WS_QUERY_PARAM, opts.bridgeWsUrl);
+    params.set(BRIDGE_TOKEN_QUERY_PARAM, opts.bridgeToken);
+    return `${url}${url.includes('?') ? '&' : '?'}${params.toString()}`;
+}
 function buildTrayJoinLaunchUrl(locationHref, joinUrl) {
     const parsedJoinUrl = parseTrayJoinUrl(joinUrl);
     if (!parsedJoinUrl) {
@@ -21,14 +30,14 @@ export function resolveCliBrowserLaunchUrl(options) {
         if (!options.joinUrl) {
             throw new Error('The --join launch flow requires a tray join URL via --join <url> or --join=<url>.');
         }
-        return buildTrayJoinLaunchUrl(options.serveOrigin, options.joinUrl);
+        return appendBridgeParams(buildTrayJoinLaunchUrl(options.serveOrigin, options.joinUrl), options);
     }
     if (!options.lead) {
-        return options.serveOrigin;
+        return appendBridgeParams(options.serveOrigin, options);
     }
     const workerBaseUrl = normalizeTrayWorkerBaseUrl(options.leadWorkerBaseUrl ?? options.envWorkerBaseUrl ?? null);
     if (!workerBaseUrl) {
         throw new Error('The --lead launch flow requires a tray worker base URL via --lead <url>, --lead=<url>, or WORKER_BASE_URL.');
     }
-    return buildTrayLeadLaunchUrl(options.serveOrigin, workerBaseUrl);
+    return appendBridgeParams(buildTrayLeadLaunchUrl(options.serveOrigin, workerBaseUrl), options);
 }