ssh-mcp-pro 1.1.2 → 1.1.3

package/dist/remote/agent-handler.js

@@ -0,0 +1,255 @@
+import { nowIso, verifyEnvelope } from "./crypto.js";
+import { AGENT_NONCE_TTL_MS, isRecord, pruneNonceWindow, hasSeenNonce, rememberNonce, } from "./http-util.js";
+import { parseActionResultEnvelope, parseAgentHelloEnvelope } from "./schemas.js";
+import { acceptWebSocketUpgrade } from "./websocket.js";
+/** Handles agent WebSocket connection lifecycle for RemoteControlPlane. */
+export class AgentWebSocketHandler {
+    config;
+    store;
+    agentConnections;
+    agentHelloNonces;
+    pendingActions;
+    audit;
+    constructor(config, store, agentConnections, agentHelloNonces, pendingActions, audit) {
+        this.config = config;
+        this.store = store;
+        this.agentConnections = agentConnections;
+        this.agentHelloNonces = agentHelloNonces;
+        this.pendingActions = pendingActions;
+        this.audit = audit;
+    }
+    handleUpgrade(req, socket, head, pathname) {
+        if (pathname !== this.config.agentWsPath) {
+            return false;
+        }
+        const connection = acceptWebSocketUpgrade(req, socket, head);
+        connection.onText((message) => {
+            void this.handleAgentMessage(connection, message).catch(() => {
+                connection.sendJson({
+                    type: "error",
+                    code: "INTERNAL_ERROR",
+                    message: "Agent message failed",
+                });
+                connection.close();
+            });
+        });
+        return true;
+    }
+    async handleAgentMessage(connection, message) {
+        const payload = JSON.parse(message);
+        if (!isRecord(payload)) {
+            connection.sendJson({ type: "error", code: "INTERNAL_ERROR", message: "Invalid message" });
+            connection.close();
+            return;
+        }
+        if (payload.type === "agent.hello") {
+            await this.handleAgentHello(connection, parseAgentHelloEnvelope(payload));
+            return;
+        }
+        if (payload.type === "action.result") {
+            await this.handleActionResult(connection, parseActionResultEnvelope(payload));
+            return;
+        }
+        connection.sendJson({ type: "error", code: "INTERNAL_ERROR", message: "Unknown message type" });
+        connection.close();
+    }
+    async handleAgentHello(connection, hello) {
+        const agent = this.store.getAgent(hello.agent_id);
+        if (!agent || agent.status === "revoked" || !agent.publicKey) {
+            connection.sendJson({
+                type: "error",
+                code: "AGENT_NOT_FOUND",
+                message: "Agent is not enrolled",
+            });
+            connection.close();
+            return;
+        }
+        if (!verifyEnvelope(hello, agent.publicKey)) {
+            this.audit({
+                userId: agent.userId,
+                agentId: agent.id,
+                eventType: "agent_signature_invalid",
+                severity: "warn",
+                metadata: { message_type: "agent.hello" },
+            });
+            connection.sendJson({
+                type: "error",
+                code: "SIGNATURE_INVALID",
+                message: "Agent signature is invalid",
+            });
+            connection.close();
+            return;
+        }
+        const timestampAgeMs = Math.abs(Date.now() - new Date(hello.timestamp).getTime());
+        if (timestampAgeMs > 300_000) {
+            this.audit({
+                userId: agent.userId,
+                agentId: agent.id,
+                eventType: "agent_hello_expired",
+                severity: "warn",
+                metadata: {},
+            });
+            connection.sendJson({
+                type: "error",
+                code: "ACTION_EXPIRED",
+                message: "Agent hello timestamp is stale",
+            });
+            connection.close();
+            return;
+        }
+        const now = Date.now();
+        this.cleanupEphemeralState(now);
+        const existingConnection = this.agentConnections.get(agent.id);
+        if (existingConnection?.connection === connection) {
+            this.audit({
+                userId: agent.userId,
+                agentId: agent.id,
+                eventType: "agent_duplicate_hello_rejected",
+                severity: "warn",
+                metadata: {},
+            });
+            connection.sendJson({
+                type: "error",
+                code: "ACTION_REPLAY_DETECTED",
+                message: "Agent hello was already processed on this connection",
+            });
+            connection.close();
+            return;
+        }
+        const helloNonces = this.agentHelloNonces.get(agent.id) ?? new Map();
+        if (helloNonces.has(hello.nonce)) {
+            this.audit({
+                userId: agent.userId,
+                agentId: agent.id,
+                eventType: "agent_hello_replay_detected",
+                severity: "warn",
+                metadata: {},
+            });
+            connection.sendJson({
+                type: "error",
+                code: "ACTION_REPLAY_DETECTED",
+                message: "Agent hello nonce was already used",
+            });
+            connection.close();
+            return;
+        }
+        helloNonces.set(hello.nonce, now + AGENT_NONCE_TTL_MS);
+        this.agentHelloNonces.set(agent.id, helloNonces);
+        if (existingConnection) {
+            existingConnection.connection.close();
+        }
+        const seenNonces = new Map();
+        rememberNonce(seenNonces, hello.nonce, now);
+        this.agentConnections.set(agent.id, { agent, connection, seenNonces });
+        const online = {
+            ...agent,
+            status: "online",
+            lastSeenAt: nowIso(),
+            hostMetadata: hello.host,
+            updatedAt: nowIso(),
+        };
+        this.store.updateAgent(online);
+        connection.onClose(() => {
+            const live = this.agentConnections.get(agent.id);
+            if (live?.connection !== connection) {
+                return;
+            }
+            this.agentConnections.delete(agent.id);
+            const latest = this.store.getAgent(agent.id);
+            if (latest && latest.status !== "revoked") {
+                this.store.updateAgent({ ...latest, status: "offline", updatedAt: nowIso() });
+            }
+            this.audit({
+                userId: agent.userId,
+                agentId: agent.id,
+                eventType: "agent_disconnected",
+                severity: "info",
+                metadata: {},
+            });
+        });
+        this.audit({
+            userId: agent.userId,
+            agentId: agent.id,
+            eventType: "agent_connected",
+            severity: "info",
+            metadata: { agent_version: hello.agent_version, host: hello.host.hostname },
+        });
+        connection.sendJson({ type: "agent.ready", agent_id: agent.id, policy: agent.policy });
+    }
+    async handleActionResult(connection, result) {
+        const pending = this.pendingActions.get(result.action_id);
+        if (!pending) {
+            return;
+        }
+        const agent = this.store.getAgent(result.agent_id);
+        if (!agent?.publicKey ||
+            !verifyEnvelope(result, agent.publicKey)) {
+            clearTimeout(pending.timeout);
+            this.pendingActions.delete(result.action_id);
+            this.audit({
+                userId: pending.action.userId,
+                agentId: pending.action.agentId,
+                actionId: pending.action.id,
+                eventType: "agent_result_signature_invalid",
+                severity: "warn",
+                metadata: {},
+            });
+            pending.reject(new Error("Agent result signature is invalid"));
+            return;
+        }
+        const live = this.agentConnections.get(result.agent_id);
+        if (pending.action.agentId !== result.agent_id || live?.connection !== connection) {
+            clearTimeout(pending.timeout);
+            this.pendingActions.delete(result.action_id);
+            this.audit({
+                userId: pending.action.userId,
+                agentId: pending.action.agentId,
+                actionId: pending.action.id,
+                eventType: "agent_result_connection_invalid",
+                severity: "warn",
+                metadata: {},
+            });
+            pending.reject(Object.assign(new Error("Agent result came from an unexpected connection"), {
+                code: "SIGNATURE_INVALID",
+            }));
+            return;
+        }
+        const now = Date.now();
+        if (hasSeenNonce(live.seenNonces, result.nonce, now)) {
+            clearTimeout(pending.timeout);
+            this.pendingActions.delete(result.action_id);
+            this.audit({
+                userId: pending.action.userId,
+                agentId: pending.action.agentId,
+                actionId: pending.action.id,
+                eventType: "agent_result_replay_detected",
+                severity: "warn",
+                metadata: {},
+            });
+            pending.reject(Object.assign(new Error("Agent result nonce was already used"), {
+                code: "ACTION_REPLAY_DETECTED",
+            }));
+            return;
+        }
+        rememberNonce(live.seenNonces, result.nonce, now);
+        clearTimeout(pending.timeout);
+        this.pendingActions.delete(result.action_id);
+        pending.resolve(result);
+    }
+    cleanupEphemeralState(now = Date.now()) {
+        for (const [agentId, nonces] of this.agentHelloNonces.entries()) {
+            pruneNonceWindow(nonces, now);
+            if (nonces.size === 0) {
+                this.agentHelloNonces.delete(agentId);
+            }
+        }
+        for (const live of this.agentConnections.values()) {
+            pruneNonceWindow(live.seenNonces, now);
+        }
+    }
+    /** Number of currently connected agents. */
+    get connectedAgentCount() {
+        return this.agentConnections.size;
+    }
+}
+//# sourceMappingURL=agent-handler.js.map

package/dist/remote/agent-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-handler.js","sourceRoot":"","sources":["../../src/remote/agent-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AASlF,OAAO,EAAE,sBAAsB,EAAmC,MAAM,gBAAgB,CAAC;AAezF,2EAA2E;AAC3E,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,MAA+B,EAC/B,KAAkB,EAClB,gBAA8C,EAC9C,gBAAkD,EAClD,cAA0C,EAC1C,KAA4D;QAL5D,WAAM,GAAN,MAAM,CAAyB;QAC/B,UAAK,GAAL,KAAK,CAAa;QAClB,qBAAgB,GAAhB,gBAAgB,CAA8B;QAC9C,qBAAgB,GAAhB,gBAAgB,CAAkC;QAClD,mBAAc,GAAd,cAAc,CAA4B;QAC1C,UAAK,GAAL,KAAK,CAAuD;IAC5E,CAAC;IAEJ,aAAa,CACX,GAAoB,EACpB,MAAc,EACd,IAA6B,EAC7B,QAAgB;QAEhB,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7D,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;YAC5B,KAAK,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3D,UAAU,CAAC,QAAQ,CAAC;oBAClB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,sBAAsB;iBAChC,CAAC,CAAC;gBACH,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,UAAsC,EACtC,OAAe;QAEf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC3F,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChG,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,UAAsC,EACtC,KAAyB;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC7D,UAAU,CAAC,QAAQ,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,uBAAuB;aACjC,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAA2C,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,yBAAyB;gBACpC,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE;aAC1C,CAAC,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,cAAc,GAAG,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,qBAAqB;gBAChC,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,gCAAgC;aAC1C,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,IAAI,kBAAkB,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,gCAAgC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;QACrF,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,6BAA6B;gBACxC,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,oCAAoC;aAC9C,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,kBAAkB,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,kBAAkB,EAAE,CAAC;YACvB,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAsB;YAChC,GAAG,KAAK;YACR,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,MAAM,EAAE;YACpB,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,SAAS,EAAE,MAAM,EAAE;SACpB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/B,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI,IAAI,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,oBAAoB;gBAC/B,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,iBAAiB;YAC5B,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;SAC5E,CAAC,CAAC;QACH,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,UAAsC,EACtC,MAA4B;QAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,IACE,CAAC,KAAK,EAAE,SAAS;YACjB,CAAC,cAAc,CAAC,MAA4C,EAAE,KAAK,CAAC,SAAS,CAAC,EAC9E,CAAC;YACD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;gBAC7B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;gBAC/B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;YAClF,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;gBAC7B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;gBAC/B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC3B,SAAS,EAAE,iCAAiC;gBAC5C,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CACZ,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAAE;gBAC1E,IAAI,EAAE,mBAA6C;aACpD,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YACrD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;gBAC7B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;gBAC/B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC3B,SAAS,EAAE,8BAA8B;gBACzC,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CACZ,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE;gBAC9D,IAAI,EAAE,wBAAkD;aACzD,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,qBAAqB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACpC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;YAChE,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YAClD,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;IACpC,CAAC;CACF"}

package/dist/remote/control-plane.d.ts

@@ -2,6 +2,8 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Duplex } from "node:stream";
 import { type PemKeyPair } from "./crypto.js";
 import { RemoteStore } from "./store.js";
+import { OAuthHandler } from "./oauth-handler.js";
+import { AgentWebSocketHandler } from "./agent-handler.js";
 import type { RemoteConfig } from "./types.js";
 export declare class RemoteControlPlane {
     readonly config: RemoteConfig;
@@ -13,32 +15,17 @@ export declare class RemoteControlPlane {
     private readonly cleanupInterval;
     private jwtKeyPair;
     private readonly controlPlaneKeyPair;
+    readonly oauth: OAuthHandler;
+    readonly agentHandler: AgentWebSocketHandler;
     constructor(config?: RemoteConfig);
     initialize(): Promise<void>;
     close(): void;
     private cleanupEphemeralState;
     handleHttp(req: IncomingMessage, res: ServerResponse, pathname: string): Promise<boolean>;
     handleUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer<ArrayBufferLike>, pathname: string): boolean;
-    private protectedResourceMetadata;
-    private authorizationServerMetadata;
-    private handleRegister;
-    private handleAuthorize;
-    private validateAuthorizeParams;
-    private handleGitHubCallback;
-    private fetchGitHubUser;
-    private testGitHubUser;
-    private upsertGitHubUser;
-    private isGitHubUserAllowed;
-    private issueAuthorizationCode;
-    private handleToken;
-    private userFromId;
-    private handleJwks;
     private handleMcp;
     private handleApi;
     private handleAgentEnroll;
-    private handleAgentMessage;
-    private handleAgentHello;
-    private handleActionResult;
     private authenticate;
     private sendUnauthorized;
     private callRemoteTool;

package/dist/remote/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../src/remote/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAM1C,OAAO,EAeL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAUV,YAAY,EAMb,MAAM,YAAY,CAAC;AA8MpB,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsC;IACvE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;gBAErC,MAAM,eAAqB;IAQjC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,KAAK,IAAI,IAAI;IAgBb,OAAO,CAAC,qBAAqB;IAiBvB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiD/F,aAAa,CACX,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO;IAkBV,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,2BAA2B;YAerB,cAAc;YA4Cd,eAAe;IA0D7B,OAAO,CAAC,uBAAuB;YA4BjB,oBAAoB;YAoBpB,eAAe;IAuB7B,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,sBAAsB;YAoBhB,WAAW;IA6CzB,OAAO,CAAC,UAAU;YAWJ,UAAU;YAUV,SAAS;YAsET,SAAS;YAsDT,iBAAiB;YAsDjB,kBAAkB;YAsBlB,gBAAgB;YA+HhB,kBAAkB;YAsElB,YAAY;IAiB1B,OAAO,CAAC,gBAAgB;YAWV,cAAc;IA4D5B,OAAO,CAAC,qBAAqB;IAmD7B,OAAO,CAAC,cAAc;IA8BtB,OAAO,CAAC,iBAAiB;IAsDzB,OAAO,CAAC,WAAW;YAkBL,cAAc;IA4H5B,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,iBAAiB;CAM1B;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAI5E;AAED,wBAAgB,uBAAuB,CAAC,mBAAmB,EAAE,UAAU,GAAG,MAAM,CAE/E"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../src/remote/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAWL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAkBrB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAyB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EACL,qBAAqB,EAGtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAMV,YAAY,EAKb,MAAM,YAAY,CAAC;AAKpB,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsC;IACvE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;IACjD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;gBAEjC,MAAM,eAAqB;IAuBjC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,KAAK,IAAI,IAAI;IAgBb,OAAO,CAAC,qBAAqB;IAKvB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiD/F,aAAa,CACX,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO;YAII,SAAS;YAsET,SAAS;YAsDT,iBAAiB;YAsDjB,YAAY;IAiB1B,OAAO,CAAC,gBAAgB;YAWV,cAAc;IA4D5B,OAAO,CAAC,qBAAqB;IAmD7B,OAAO,CAAC,cAAc;IA8BtB,OAAO,CAAC,iBAAiB;IAsDzB,OAAO,CAAC,WAAW;YAkBL,cAAc;IA4H5B,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,iBAAiB;CAM1B;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAI5E;AAED,wBAAgB,uBAAuB,CAAC,mBAAmB,EAAE,UAAU,GAAG,MAAM,CAE/E"}