Enforce request authentication on the Tower local API

.github/workflows/test.yml

@@ -238,6 +238,14 @@ jobs:
         working-directory: packages/core
         run: pnpm build
 
+      # codev-types is a runtime dependency of codev (server-utils imports its
+      # wire constants at module load), so the install-verification install must
+      # include its tarball too — else `afx --help` crashes at boot with
+      # "Cannot find module '@cluesmith/codev-types'".
+      - name: Build types package
+        working-directory: packages/types
+        run: pnpm build
+
       - name: Build package
         working-directory: packages/codev
         run: pnpm build
@@ -250,11 +258,15 @@ jobs:
         working-directory: packages/sdk
         run: pnpm pack
 
+      - name: Pack types tarball
+        working-directory: packages/types
+        run: pnpm pack
+
       - name: Pack tarball
         working-directory: packages/codev
         run: pnpm pack
 
       - name: Verify install from tarball
         working-directory: packages/codev
-        run: node scripts/verify-install.mjs cluesmith-codev-*.tgz ../core/cluesmith-codev-core-*.tgz ../sdk/cluesmith-codev-sdk-*.tgz
+        run: node scripts/verify-install.mjs cluesmith-codev-*.tgz ../core/cluesmith-codev-core-*.tgz ../sdk/cluesmith-codev-sdk-*.tgz ../types/cluesmith-codev-types-*.tgz
 

.gitignore

@@ -48,6 +48,11 @@ test-results/
 packages/codev/dashboard-dist/
 apps/web/dist/
 
+# three.js vendored at build time from the `three` devDependency (copy-three.mjs);
+# copied into templates/vendor/ and shipped in the npm tarball, not committed.
+packages/codev/templates/vendor/three.module.js
+packages/codev/templates/vendor/three-*.js
+
 # Checklister runtime state (per-project JSON files)
 codev/checklists/*.json
 

apps/vscode/src/__tests__/terminal-adapter.test.ts

@@ -41,7 +41,7 @@ vi.mock('ws', () => {
     closed = false;
     sent: unknown[] = [];
     private handlers: Record<string, Array<(...args: unknown[]) => void>> = {};
-    constructor(public url: string) { FakeWebSocket.instances.push(this); }
+    constructor(public url: string, public protocols?: string | string[]) { FakeWebSocket.instances.push(this); }
     on(event: string, cb: (...args: unknown[]) => void): this {
       (this.handlers[event] ||= []).push(cb);
       return this;
@@ -64,7 +64,12 @@ vi.mock('@cluesmith/codev-sdk/escape-buffer', () => ({
   },
 }));
 
-vi.mock('@cluesmith/codev-types', () => ({ FRAME_CONTROL: 0x00, FRAME_DATA: 0x01 }));
+vi.mock('@cluesmith/codev-types', () => ({
+  FRAME_CONTROL: 0x00,
+  FRAME_DATA: 0x01,
+  terminalWsProtocols: (key: string | null | undefined) =>
+    (key ? ['codev.tower.v1', `codev-key.${key}`] : undefined),
+}));
 
 const FRAME_CONTROL = 0x00;
 const FRAME_DATA = 0x01;
@@ -127,12 +132,33 @@ function makeAdapter() {
   return { pty, writes };
 }
 
+/** Build an adapter with an explicit auth key (default makeAdapter uses null). */
+function makeAdapterWithKey(authKey: string | null) {
+  const pty = new (CodevPseudoterminal as unknown as new (
+    url: string, authKey: string | null, ch: unknown,
+  ) => { open(d: unknown): void }) ('ws://localhost:4100/x', authKey, fakeOutputChannel());
+  pty.open(undefined);
+  return WebSocket.instances[WebSocket.instances.length - 1] as unknown as { protocols?: string | string[] };
+}
+
 beforeEach(() => {
   vi.useFakeTimers();
   WebSocket.instances.length = 0;
   hoisted.escapeBufferCount = 0;
 });
 
+describe('WS subprotocol auth (advisory GHSA-xvjp-7748-v88v)', () => {
+  it('offers the marker + codev-key token when an auth key is present', () => {
+    const sock = makeAdapterWithKey('SECRETKEY');
+    expect(sock.protocols).toEqual(['codev.tower.v1', 'codev-key.SECRETKEY']);
+  });
+
+  it('offers no subprotocol when there is no auth key', () => {
+    const sock = makeAdapterWithKey(null);
+    expect(sock.protocols).toBeUndefined();
+  });
+});
+
 describe('PIR #936 — adapter-owned reconnect loop', () => {
   it('emits one backed-off notice per close, capping the delay at 30s', () => {
     const { writes } = makeAdapter();

apps/vscode/src/commands/tunnel.ts

@@ -31,7 +31,7 @@ export async function disconnectTunnel(connectionManager: ConnectionManager): Pr
     },
     'Disconnect',
   );
-  if (choice !== 'Disconnect') return;
+  if (choice !== 'Disconnect') {return;}
 
   await client.signalTunnel('disconnect');
   vscode.window.showInformationMessage('Codev: Tower deregistered from Codev Cloud');

apps/vscode/src/connection-manager.ts

@@ -237,6 +237,7 @@ export class ConnectionManager {
           this.scheduleReconnect();
         }
       },
+      () => this.auth.getKeySync(),
     );
     this.sse.onEvent((type, data) => {
       this.sseEventEmitter.fire({ type, data });

apps/vscode/src/sse-client.ts

@@ -1,4 +1,5 @@
 import * as vscode from 'vscode';
+import { TOWER_KEY_HEADER } from '@cluesmith/codev-types';
 
 export type SSEListener = (eventType: string, data: string) => void;
 
@@ -19,6 +20,7 @@ export class SSEClient {
     private baseUrl: string,
     private outputChannel: vscode.OutputChannel,
     private onDisconnect: () => void,
+    private getAuthKey: () => string | null = () => null,
   ) {}
 
   /**
@@ -61,9 +63,12 @@ export class SSEClient {
 
   private async startSSE(url: string): Promise<void> {
     try {
-      const response = await fetch(url, {
-        headers: { 'Accept': 'text/event-stream' },
-      });
+      // Request authentication (advisory GHSA-xvjp-7748-v88v): /api/events is a
+      // key-required route; SSE via fetch can carry the codev-tower-key header.
+      const headers: Record<string, string> = { 'Accept': 'text/event-stream' };
+      const key = this.getAuthKey();
+      if (key) { headers[TOWER_KEY_HEADER] = key; }
+      const response = await fetch(url, { headers });
 
       if (!response.ok || !response.body) {
         this.log('WARN', `SSE connection failed: ${response.status}`);

apps/vscode/src/terminal-adapter.ts

@@ -1,6 +1,6 @@
 import * as vscode from 'vscode';
 import WebSocket from 'ws';
-import { FRAME_CONTROL, FRAME_DATA, type ControlMessage } from '@cluesmith/codev-types';
+import { FRAME_CONTROL, FRAME_DATA, terminalWsProtocols, type ControlMessage } from '@cluesmith/codev-types';
 import { EscapeBuffer } from '@cluesmith/codev-sdk/escape-buffer';
 import { BackoffController, classifyUpgradeError } from '@cluesmith/codev-sdk/reconnect-policy';
 
@@ -180,7 +180,9 @@ export class CodevPseudoterminal implements vscode.Pseudoterminal {
 
     const url = this.connectUrl();
     this.log('INFO', `Connecting to ${url}`);
-    const socket = new WebSocket(url);
+    // Request authentication (advisory GHSA-xvjp-7748-v88v): the shared key
+    // travels as a Sec-WebSocket-Protocol subprotocol, validated at the upgrade.
+    const socket = new WebSocket(url, terminalWsProtocols(this.authKey));
     this.ws = socket;
     this.ws.binaryType = 'arraybuffer';
 
@@ -194,10 +196,9 @@ export class CodevPseudoterminal implements vscode.Pseudoterminal {
       // Wipe any in-progress retry notice before replayed buffer / normal
       // output resumes, so it doesn't orphan in scrollback (#1001).
       this.clearReconnectNotice();
-      // Send auth via control message (not query param)
-      if (this.authKey) {
-        this.sendControl({ type: 'ping', payload: { auth: this.authKey } });
-      }
+      // Auth is now carried by the Sec-WebSocket-Protocol subprotocol and
+      // validated at the upgrade (advisory GHSA-xvjp-7748-v88v), so no in-band
+      // auth frame is sent here.
       // Sync Tower's PTY to the dimensions VSCode reported. Without this,
       // the PTY stays at node-pty's 80×24 default until a manual resize,
       // which makes Claude Code's TUI render its input box mid-screen and

apps/web/__tests__/TabBar.test.tsx

@@ -4,6 +4,7 @@ import { TabBar, TAB_ICONS } from '../src/components/TabBar.js';
 import type { Tab } from '../src/hooks/useTabs.js';
 
 vi.mock('../src/lib/api.js', () => ({
+  getWebKey: () => null,
   deleteTab: vi.fn(() => Promise.resolve()),
 }));
 

apps/web/__tests__/Terminal.clipboard.test.tsx

@@ -59,6 +59,7 @@ vi.mock('@xterm/addon-web-links', () => ({
 const mockUploadPasteImage = vi.fn();
 vi.mock('../src/lib/api.js', () => ({
   uploadPasteImage: (...args: unknown[]) => mockUploadPasteImage(...args),
+  getWebKey: () => null,
 }));
 
 // Mock WebSocket as a class

apps/web/__tests__/analytics.test.tsx

@@ -15,6 +15,7 @@ import type { AnalyticsResponse } from '../src/lib/api.js';
 const mockFetchAnalytics = vi.fn<(range: string, refresh?: boolean) => Promise<AnalyticsResponse>>();
 
 vi.mock('../src/lib/api.js', () => ({
+  getWebKey: () => null,
   fetchAnalytics: (...args: unknown[]) => mockFetchAnalytics(...(args as [string, boolean?])),
 }));
 

apps/web/__tests__/useOverview.stability.test.ts

@@ -31,6 +31,7 @@ const mockFetchOverview = vi.fn<() => Promise<OverviewData>>();
 const mockRefreshOverview = vi.fn<() => Promise<void>>();
 
 vi.mock('../src/lib/api.js', () => ({
+  getWebKey: () => null,
   fetchOverview: (...args: unknown[]) => mockFetchOverview(...(args as [])),
   refreshOverview: (...args: unknown[]) => mockRefreshOverview(...(args as [])),
   getSSEEventsUrl: () => 'http://localhost:0/api/events',