talon-agent 5.14.0 → 5.18.2

package/src/frontend/native/bridge/server.ts

@@ -24,8 +24,14 @@ import { createServer as createTlsServer } from "node:https";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
-import { log, logError, logDebug, logWarn } from "../../../util/log.js";
-import { formatFingerprint, type BridgeTlsIdentity } from "./tls.js";
+import { log, logError, logDebug } from "../../../util/log.js";
+import {
+  formatFingerprint,
+  isLoopbackHost,
+  type BridgeTlsIdentity,
+} from "./tls.js";
+import { checkBridgeTokenStrength } from "./auth.js";
+import { AuthGuard, type AuthGuardPolicy } from "./auth-guard.js";
 import { contentTypeFor } from "../media/media.js";
 import { type BridgeEvent } from "../protocol.js";
 import { buildRoutes } from "./routes/index.js";
@@ -37,39 +43,73 @@ import {
   type RouteContext,
   type RouteHandler,
 } from "./routes/table.js";
+import {
+  describeTier,
+  hasScope,
+  resolvePrincipal,
+  routeAllows,
+  type BridgeCredentials,
+  type BridgePrincipal,
+} from "./credentials/principal.js";
 
 export type { BridgeServerHandlers, SendOptions } from "./routes/host.js";
 export { BRIDGE_ROUTE_AUTH, type BridgeRouteKey } from "./routes/table.js";
+export type { BridgeCredentials } from "./credentials/principal.js";
+
+/** One live SSE connection: the device it claimed and who opened it. */
+type StreamSession = {
+  deviceId: string | undefined;
+  principal: BridgePrincipal;
+};
 
 const SSE_PING_MS = 25_000;
 const MAX_BODY_BYTES = 256 * 1024;
 const PORT_FALLBACKS = 5;
 
-// Failed-auth lockout: after this many wrong tokens from one address inside
-// the window, that address gets 429s until the window lapses. The token's
-// 256 bits make brute force hopeless anyway — this is about not letting an
-// internet-facing bridge be hammered for free (and giving fail2ban-style
-// tooling a clean signal in the log). Only *presented-and-wrong* secrets
-// count: tokenless probes are just scanners finding a locked door.
-const AUTH_LOCKOUT_MAX_FAILURES = 20;
-const AUTH_LOCKOUT_WINDOW_MS = 15 * 60 * 1000;
-/** Hard cap on tracked addresses so the map can't become a memory lever. */
-const AUTH_LOCKOUT_MAX_TRACKED = 10_000;
+/**
+ * Server-level socket deadlines (slow-loris resistance). Node applies
+ * `requestTimeout` only until the request has been fully RECEIVED, so the
+ * long-lived SSE stream (a bodyless GET) and file downloads (response
+ * bodies) are unaffected. It does bound request bodies, and every
+ * body-reading route sits behind the bearer check (an unauthenticated
+ * request is answered 401/429 with `Connection: close` before its body is
+ * read), so the budget is sized for the largest authenticated upload
+ * (512 MB) on a slow link, not for an attacker.
+ */
+export type BridgeTimeouts = {
+  /** Whole header block must arrive within this. Node default: 60s. */
+  headersMs: number;
+  /** Whole request (headers + body) must arrive within this. Node: 300s. */
+  requestMs: number;
+  /** Idle keep-alive sockets are closed after this. */
+  keepAliveMs: number;
+  /** How often Node sweeps for expired header/request deadlines. */
+  checkIntervalMs: number;
+};
+
+export const DEFAULT_BRIDGE_TIMEOUTS: BridgeTimeouts = {
+  headersMs: 20_000,
+  requestMs: 30 * 60_000,
+  keepAliveMs: 5_000,
+  checkIntervalMs: 30_000,
+};
 
 export class BridgeServer {
   private server: Server | null = null;
   /**
    * Live SSE connections → the mesh device id each one claimed on connect
    * (undefined for clients that didn't claim one: desktop UIs, and companion
-   * builds from before the claim existed). The claim is what makes
-   * `sendToDevice` addressable rather than a shout.
+   * builds from before the claim existed) and the principal that opened it.
+   * The claim is what makes `sendToDevice` addressable rather than a shout;
+   * the principal is what lets a revocation find and drop the session.
    */
-  private clients = new Map<ServerResponse, string | undefined>();
+  private clients = new Map<ServerResponse, StreamSession>();
+  private unsubscribeRevocations: (() => void) | undefined;
   private pingTimer: ReturnType<typeof setInterval> | undefined;
   private port = 0;
   private tlsIdentity: BridgeTlsIdentity | null = null;
-  /** Wrong-token counts per remote address (behind a proxy: per proxy). */
-  private authFailures = new Map<string, { count: number; resetAt: number }>();
+  /** Backoff, lockout and the global failure budget for wrong tokens. */
+  private readonly authGuard: AuthGuard;
   /** `METHOD /path` → handler; a Map so lookups only ever hit own entries. */
   private readonly routes: ReadonlyMap<BridgeRouteKey, RouteHandler>;
 
@@ -88,9 +128,30 @@ export class BridgeServer {
        * I/O — it resolves once, inside `start()`.
        */
       tls?: () => Promise<BridgeTlsIdentity>;
+      /**
+       * Per-device credentials (core/mesh/credentials) and the migration
+       * policy. Absent: the shared `token` is the only credential, as
+       * before.
+       */
+      credentials?: BridgeCredentials;
+      /** `native.allowWeakToken`: start on a public bind despite a weak token. */
+      allowWeakToken?: boolean;
+      /** Operator alert for security events (the global auth cooldown). */
+      onSecurityAlert?: (message: string) => void;
+      /**
+       * `native.sseMaxLifetimeMs`: end each event stream after this long
+       * (±10% jitter) so clients re-authenticate. Unset = never.
+       */
+      sseMaxLifetimeMs?: number;
+      /** Overrides for tests; production uses the defaults. */
+      authPolicy?: Partial<AuthGuardPolicy>;
+      timeouts?: Partial<BridgeTimeouts>;
     },
     private readonly handlers: BridgeServerHandlers,
   ) {
+    this.authGuard = new AuthGuard(opts.authPolicy, {
+      onAlert: opts.onSecurityAlert,
+    });
     this.routes = new Map(
       Object.entries(buildRoutes(this.routeHost())) as [
         BridgeRouteKey,
@@ -113,10 +174,49 @@ export class BridgeServer {
     return this.tlsIdentity?.fingerprint ?? null;
   }
 
-  /** Push an event to every connected SSE client. */
+  /**
+   * Push an event to every connected SSE client that may see it. Chat
+   * traffic is for `client`-scoped sessions only; a device-only credential
+   * hears the mesh-wide `locate` and nothing else.
+   */
   broadcast(event: BridgeEvent): void {
     if (this.clients.size === 0) return;
-    this.write(this.clients.keys(), event);
+    const targets: ServerResponse[] = [];
+    for (const [res, session] of this.clients) {
+      if (event.kind === "locate" || hasScope(session.principal, "client")) {
+        targets.push(res);
+      }
+    }
+    this.write(targets, event);
+  }
+
+  /**
+   * End every live stream opened with one of `credentialIds` — revocation
+   * (and a scope change) must bite now, not at the client's next request.
+   */
+  dropCredentialSessions(credentialIds: readonly string[]): number {
+    let dropped = 0;
+    for (const [res, { principal }] of this.clients) {
+      if (
+        principal.kind === "device" &&
+        credentialIds.includes(principal.credentialId)
+      ) {
+        this.clients.delete(res);
+        try {
+          res.end();
+        } catch {
+          /* already gone */
+        }
+        dropped++;
+      }
+    }
+    if (dropped > 0) {
+      log(
+        "native",
+        `Dropped ${dropped} live session(s) of revoked/changed credential(s) ${credentialIds.join(", ")}`,
+      );
+    }
+    return dropped;
   }
 
   /**
@@ -138,15 +238,21 @@ export class BridgeServer {
    * target claimed nothing either: a companion build that predates the claim
    * can't be addressed, and dropping its commands would take the mesh offline
    * for it. So an updated device's traffic never reaches them — the fallback
-   * shrinks to nothing as the fleet updates.
+   * shrinks to nothing as the fleet updates. Only shared-token sessions are
+   * in that fallback: a per-device credential is its own device or nobody.
+   *
+   * With per-device credentials the claim IS enforced: a credential can
+   * only claim the device it is bound to (credentials/claims.ts).
    */
   sendToDevice(deviceId: string, event: BridgeEvent): void {
     if (this.clients.size === 0) return;
     const claimed: ServerResponse[] = [];
     const unclaimed: ServerResponse[] = [];
-    for (const [res, id] of this.clients) {
+    for (const [res, { deviceId: id, principal }] of this.clients) {
       if (id === deviceId) claimed.push(res);
-      else if (id === undefined) unclaimed.push(res);
+      else if (id === undefined && principal.kind !== "device") {
+        unclaimed.push(res);
+      }
     }
     if (claimed.length === 0) {
       logDebug(
@@ -170,6 +276,11 @@ export class BridgeServer {
 
   async start(): Promise<number> {
     if (this.server) return this.port;
+    checkBridgeTokenStrength({
+      token: this.opts.token,
+      loopback: isLoopbackHost(this.opts.host),
+      allowWeakToken: this.opts.allowWeakToken,
+    });
     this.tlsIdentity = this.opts.tls ? await this.opts.tls() : null;
     const onRequest = (req: IncomingMessage, res: ServerResponse): void => {
       this.handle(req, res).catch((err) => {
@@ -182,12 +293,23 @@ export class BridgeServer {
     };
     // https.Server extends http.Server's request/lifecycle surface — one
     // `Server`-typed field serves both transports.
+    const t = { ...DEFAULT_BRIDGE_TIMEOUTS, ...this.opts.timeouts };
+    const serverOpts = {
+      headersTimeout: t.headersMs,
+      requestTimeout: t.requestMs,
+      keepAliveTimeout: t.keepAliveMs,
+      connectionsCheckingInterval: t.checkIntervalMs,
+    };
     const server: Server = this.tlsIdentity
       ? createTlsServer(
-          { key: this.tlsIdentity.keyPem, cert: this.tlsIdentity.certPem },
+          {
+            ...serverOpts,
+            key: this.tlsIdentity.keyPem,
+            cert: this.tlsIdentity.certPem,
+          },
           onRequest,
         )
-      : createServer(onRequest);
+      : createServer(serverOpts, onRequest);
 
     this.pingTimer = setInterval(() => {
       for (const res of this.clients.keys()) {
@@ -199,6 +321,9 @@ export class BridgeServer {
       }
     }, SSE_PING_MS);
     this.pingTimer.unref?.();
+    this.unsubscribeRevocations = this.opts.credentials?.authority.onRevoked(
+      (ids) => this.dropCredentialSessions(ids),
+    );
 
     return new Promise<number>((resolve, reject) => {
       let attempt = 0;
@@ -246,6 +371,8 @@ export class BridgeServer {
 
   async stop(): Promise<void> {
     clearInterval(this.pingTimer);
+    this.unsubscribeRevocations?.();
+    this.unsubscribeRevocations = undefined;
     for (const res of this.clients.keys()) {
       try {
         res.end();
@@ -304,35 +431,34 @@ export class BridgeServer {
     }
 
     const remote = req.socket.remoteAddress ?? "unknown";
-    if (this.authLockedOut(remote)) {
-      res.writeHead(429, {
-        ...this.jsonHeaders(),
-        "Retry-After": String(Math.ceil(AUTH_LOCKOUT_WINDOW_MS / 1000)),
-      });
-      res.end(
-        JSON.stringify({ ok: false, error: "Too many failed auth attempts" }),
-      );
-      return;
-    }
-
-    const auth = this.authState(req, url);
-    if (auth === "bad") this.recordAuthFailure(remote);
-    else if (auth === "ok") this.authFailures.delete(remote);
+    const { state: auth, principal } = this.authState(req, url);
+    if (!(await this.admit(res, remote, auth))) return;
 
     const key = `${method} ${path}` as BridgeRouteKey;
     const route = this.routes.get(key);
-    const ctx: RouteContext = { req, res, url, auth };
+    const ctx: RouteContext = { req, res, url, auth, principal };
+    const tier = route ? BRIDGE_ROUTE_AUTH[key] : undefined;
 
-    if (route && BRIDGE_ROUTE_AUTH[key] === "public") {
+    if (route && tier === "public") {
       await route(ctx);
       return;
     }
     // Unknown routes are 401 before they are 404: an unauthenticated caller
     // learns nothing about the route map.
-    if (auth !== "ok") {
-      return this.json(res, 401, { ok: false, error: "Unauthorized" });
+    if (auth !== "ok" || principal === null) {
+      return this.refuse(res, 401, "Unauthorized");
+    }
+    if (!route || tier === undefined) {
+      return this.json(res, 404, { ok: false, error: "Not found" });
+    }
+    // Authenticated, but is this credential allowed HERE? The scope each
+    // route needs is declared in routes/table.ts.
+    if (!routeAllows(tier, principal)) {
+      return this.json(res, 403, {
+        ok: false,
+        error: `This credential lacks the ${describeTier(tier)} scope ${key} requires`,
+      });
     }
-    if (!route) return this.json(res, 404, { ok: false, error: "Not found" });
 
     try {
       await route(ctx);
@@ -355,7 +481,9 @@ export class BridgeServer {
       corsHeaders: () => this.corsHeaders(),
       streamFile: (res, file) => this.streamFile(res, file),
       serveMedia: (res, id) => this.serveMedia(res, id),
-      openStream: (res, deviceId) => this.openStream(res, deviceId),
+      openStream: (res, deviceId, principal) =>
+        this.openStream(res, deviceId, principal),
+      credentials: this.opts.credentials,
       unknownProvision: (res) => this.unknownProvision(res),
     };
   }
@@ -410,7 +538,13 @@ export class BridgeServer {
     }
   }
 
-  private openStream(res: ServerResponse, deviceId?: string): void {
+  private openStream(
+    res: ServerResponse,
+    deviceId: string | undefined,
+    principal: BridgePrincipal,
+  ): void {
+    // A device-only credential gets its own mesh traffic, not the chats.
+    const seesChats = hasScope(principal, "client");
     res.writeHead(200, {
       ...this.corsHeaders(),
       "Content-Type": "text/event-stream",
@@ -424,34 +558,60 @@ export class BridgeServer {
       `data: ${JSON.stringify({
         kind: "hello",
         status: this.handlers.status(),
-        chats: this.handlers.listChats(),
+        chats: seesChats ? this.handlers.listChats() : [],
       })}\n\n`,
     );
     // Replay any in-progress turn so a client that connected mid-turn (or
     // reconnected after a blip) sees the tool timeline immediately, not just
     // the tools that fire after it joined.
     try {
-      for (const event of this.handlers.liveTurnEvents()) {
+      for (const event of seesChats ? this.handlers.liveTurnEvents() : []) {
         res.write(`data: ${JSON.stringify(event)}\n\n`);
       }
     } catch (err) {
       logError("native", "Failed to replay live turn to new client", err);
     }
-    this.clients.set(res, deviceId);
+    this.clients.set(res, { deviceId, principal });
     logDebug(
       "native",
       `SSE client connected${deviceId ? ` as device ${deviceId}` : ""} (${this.clients.size} total)`,
     );
+    const lifetime = this.sseLifetimeTimer(res);
     res.on("close", () => {
+      clearTimeout(lifetime);
       this.clients.delete(res);
       logDebug("native", `SSE client left (${this.clients.size} total)`);
     });
   }
 
+  /**
+   * Optional max lifetime for an event stream: ending it makes the client
+   * reconnect and present its token again. Off unless configured —
+   * clients do reconnect, but with their own backoff, and a device command
+   * sent in that gap is lost.
+   */
+  private sseLifetimeTimer(
+    res: ServerResponse,
+  ): ReturnType<typeof setTimeout> | undefined {
+    const max = this.opts.sseMaxLifetimeMs;
+    if (!max || max <= 0) return undefined;
+    // Jitter so a fleet that connected together doesn't reconnect together.
+    const ms = Math.round(max * (0.9 + Math.random() * 0.2));
+    const timer = setTimeout(() => {
+      logDebug("native", "bridge.sse event=max_lifetime reason=expired");
+      res.end();
+    }, ms);
+    timer.unref?.();
+    return timer;
+  }
+
   // ── Helpers ──────────────────────────────────────────────────────────────
 
-  private authState(req: IncomingMessage, url: URL): AuthState {
-    if (!this.opts.token) return "ok";
+  private authState(
+    req: IncomingMessage,
+    url: URL,
+  ): { state: AuthState; principal: BridgePrincipal | null } {
+    if (!this.opts.token) return { state: "ok", principal: { kind: "open" } };
     const header = req.headers["authorization"];
     const fromHeader =
       typeof header === "string" && header.startsWith("Bearer ")
@@ -459,45 +619,68 @@ export class BridgeServer {
         : null;
     // EventSource can't set headers, so SSE clients pass ?token=… instead.
     const candidate = fromHeader ?? url.searchParams.get("token");
-    if (candidate === null) return "anonymous";
-    return this.tokenMatches(candidate) ? "ok" : "bad";
+    if (candidate === null) return { state: "anonymous", principal: null };
+    // The shared token or a per-device credential (credentials/principal.ts).
+    const principal = resolvePrincipal(
+      candidate,
+      req,
+      (c) => this.tokenMatches(c),
+      this.opts.credentials,
+    );
+    return principal
+      ? { state: "ok", principal }
+      : { state: "bad", principal: null };
   }
 
-  private authLockedOut(remote: string): boolean {
-    const entry = this.authFailures.get(remote);
-    if (!entry) return false;
-    if (Date.now() >= entry.resetAt) {
-      this.authFailures.delete(remote);
+  /**
+   * Apply the auth guard's verdict. Returns false once it has answered the
+   * request itself (429), true when routing should continue — after any
+   * backoff wait has elapsed.
+   */
+  private async admit(
+    res: ServerResponse,
+    remote: string,
+    auth: AuthState,
+  ): Promise<boolean> {
+    const verdict = this.authGuard.check(remote, auth);
+    if (verdict.kind === "reject") {
+      this.refuse(
+        res,
+        429,
+        verdict.reason === "lockout"
+          ? "Too many failed auth attempts"
+          : "Too many failed auth attempts; try again later",
+        verdict.retryAfterSec,
+      );
       return false;
     }
-    return entry.count >= AUTH_LOCKOUT_MAX_FAILURES;
+    if (verdict.kind === "delay" && !(await this.authGuard.hold(verdict.ms))) {
+      // Too many responses already held: refuse now rather than queue more.
+      this.refuse(res, 429, "Too many failed auth attempts", 1);
+      return false;
+    }
+    // The client may have hung up while we waited.
+    return !res.destroyed;
   }
 
-  private recordAuthFailure(remote: string): void {
-    const now = Date.now();
-    const entry = this.authFailures.get(remote);
-    if (!entry || now >= entry.resetAt) {
-      if (this.authFailures.size >= AUTH_LOCKOUT_MAX_TRACKED) {
-        for (const [ip, e] of this.authFailures) {
-          if (now >= e.resetAt) this.authFailures.delete(ip);
-        }
-        // Still saturated after pruning live entries — under that much churn
-        // dropping the newest attacker beats unbounded growth.
-        if (this.authFailures.size >= AUTH_LOCKOUT_MAX_TRACKED) return;
-      }
-      this.authFailures.set(remote, {
-        count: 1,
-        resetAt: now + AUTH_LOCKOUT_WINDOW_MS,
-      });
-      return;
-    }
-    entry.count++;
-    if (entry.count === AUTH_LOCKOUT_MAX_FAILURES) {
-      logWarn(
-        "native",
-        `Bridge auth lockout for ${remote} (${AUTH_LOCKOUT_MAX_FAILURES} wrong tokens in ${AUTH_LOCKOUT_WINDOW_MS / 60_000}m)`,
-      );
-    }
+  /**
+   * An auth refusal. `Connection: close` so an unauthenticated caller
+   * can't keep the socket, or dribble an unread request body into it.
+   */
+  private refuse(
+    res: ServerResponse,
+    code: 401 | 429,
+    error: string,
+    retryAfterSec?: number,
+  ): void {
+    res.writeHead(code, {
+      ...this.jsonHeaders(),
+      Connection: "close",
+      ...(retryAfterSec !== undefined
+        ? { "Retry-After": String(retryAfterSec) }
+        : {}),
+    });
+    res.end(JSON.stringify({ ok: false, error }));
   }
 
   /**

package/src/frontend/native/index.ts

@@ -17,7 +17,8 @@
 import type { TalonConfig } from "../../core/config/index.js";
 import type { ContextManager } from "../../core/types.js";
 import type { Gateway } from "../../core/engine/gateway.js";
-import { log, logError } from "../../util/log.js";
+import { log, logError, logWarn } from "../../util/log.js";
+import { notifyAdmin } from "../../core/frontend-runtime/admin-notify.js";
 import { createNativeActionHandler } from "./turn/actions.js";
 import { loadOrCreateBridgeToken } from "./bridge/auth.js";
 import { warmContextCache } from "./turn/context.js";
@@ -29,7 +30,11 @@ import { emitAssistant, emitPhoto } from "./turn/emit.js";
 import { startEmptyChatSweep } from "./chats/empty-chat-sweep.js";
 import { buildBridgeHandlers } from "./surface/handlers.js";
 import { createNativeRuntime, type NativeRuntime } from "./runtime.js";
-import { BridgeServer } from "./bridge/server.js";
+import { BridgeServer, type BridgeCredentials } from "./bridge/server.js";
+import {
+  DEFAULT_COMPANION_SCOPES,
+  type MeshScope,
+} from "../../core/mesh/credentials/index.js";
 import { isLoopbackHost, loadOrCreateBridgeTlsIdentity } from "./bridge/tls.js";
 
 export { summarizeToolResult } from "./turn/tool-result.js";
@@ -50,6 +55,8 @@ type BridgeListen = {
   port: number;
   token: string | undefined;
   tls: boolean;
+  legacySharedToken: boolean;
+  companionScopes: readonly MeshScope[];
 };
 
 /** Where the bridge listens, and how it is secured, from `config.native`. */
@@ -71,7 +78,32 @@ function bridgeListen(config: TalonConfig): BridgeListen {
   const token =
     configuredToken ??
     (isLoopbackHost(host) ? undefined : loadOrCreateBridgeToken());
-  return { host, port: nativeCfg.port ?? 19880, token, tls };
+  return {
+    host,
+    port: nativeCfg.port ?? 19880,
+    token,
+    tls,
+    legacySharedToken: nativeCfg.legacySharedToken ?? true,
+    companionScopes: nativeCfg.companionScopes ?? DEFAULT_COMPANION_SCOPES,
+  };
+}
+
+/**
+ * Per-device credentials for the bridge: only meaningful when the bridge
+ * authenticates at all (an open loopback bridge has nothing to scope).
+ */
+function bridgeCredentials(
+  listen: BridgeListen,
+  mesh: NativeRuntime["mesh"],
+): BridgeCredentials | undefined {
+  if (!listen.token || !mesh.credentials) return undefined;
+  return {
+    authority: mesh.credentials,
+    policy: {
+      legacySharedToken: listen.legacySharedToken,
+      companionScopes: listen.companionScopes,
+    },
+  };
 }
 
 /**
@@ -116,8 +148,13 @@ export function createNativeFrontend(
       port: listen.port,
       token: listen.token,
       allowedOrigins: config.native?.allowedOrigins,
+      allowWeakToken: config.native?.allowWeakToken,
+      sseMaxLifetimeMs: config.native?.sseMaxLifetimeMs,
+      // Distributed token guessing should reach a human, not just the log.
+      onSecurityAlert: (message) => void notifyAdmin(message),
       startedAt: runtime.startedAt,
       ...(listen.tls ? { tls: () => loadOrCreateBridgeTlsIdentity() } : {}),
+      credentials: bridgeCredentials(listen, mesh),
     },
     buildBridgeHandlers(runtime),
   );
@@ -176,6 +213,18 @@ export function createNativeFrontend(
       );
       stopEmptyChatSweep = startEmptyChatSweep(runtime);
       await server.start();
+      if (
+        listen.token &&
+        listen.legacySharedToken &&
+        !isLoopbackHost(listen.host)
+      ) {
+        logWarn(
+          "native",
+          "native.legacySharedToken is on: remote clients may still use the shared bridge token. " +
+            "Devices trade it for their own credential on their next connect; once `talon mesh` " +
+            "lists none on the shared token, set native.legacySharedToken to false and rotate native.token.",
+        );
+      }
       const fingerprint = server.getFingerprint();
       // Tell the mesh how this bridge is reachable — everything a generated
       // node installer needs (make_node_install_link fails cleanly without it).
@@ -188,6 +237,8 @@ export function createNativeFrontend(
         ...(config.native?.publicUrl
           ? { publicUrl: config.native.publicUrl }
           : {}),
+        legacySharedToken: listen.legacySharedToken,
+        companionScopes: listen.companionScopes,
       });
       await writeBridgeDiscovery({
         port: server.getPort(),

package/src/frontend/native/turn/turn.ts

@@ -9,6 +9,7 @@
 import type { ExecuteResult } from "../../../core/types.js";
 import type { AgentEvent } from "../../../core/agent-runtime/events.js";
 import { execute } from "../../../core/engine/dispatcher.js";
+import { LOCAL_OPERATOR_SENDER } from "../../../core/mcp-hub/guest-scope.js";
 import { toolInputToRecord } from "../../../core/agent-runtime/events.js";
 import { getBackendForChat } from "../../../core/engine/backend-controller/index.js";
 import { isDeliveryTool } from "../../../core/tools/index.js";
@@ -294,6 +295,7 @@ async function runTurn(
       numericChatId: entry.numericId,
       prompt,
       senderName: "User",
+      senderKeys: [LOCAL_OPERATOR_SENDER],
       isGroup: false,
       // Give the model the user message's id so `[msg_id:N]` is present and
       // react/reply/edit target the user's message — not the bot's.

package/src/frontend/teams/turn.ts

@@ -65,6 +65,7 @@ export function runTurn(
     numericChatId,
     prompt: `[${msg.senderName}]: ${msg.text}`,
     senderName: msg.senderName,
+    senderKeys: msg.senderId ? [`teams:${msg.senderId}`] : undefined,
     isGroup: true,
     source: "message",
     onEvent: async (event) => {