jb/paseo
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main'

Browse Source
This commit is contained in:
Mohamed Boudra
2026-06-12 12:12:46 +07:00
parent fa800ae78e e4c966b21e
commit d84d5f66cd
21 changed files with 492 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/app/src/components/split-container.tsx
+8
View File
@@ -87,6 +87,7 @@ interface SplitContainerProps {
onCloseTab: (tabId: string) => Promise<void> | void;
onCopyResumeCommand: (agentId: string) => Promise<void> | void;
onCopyAgentId: (agentId: string) => Promise<void> | void;
onCopyFilePath: (path: string) => Promise<void> | void;
onReloadAgent: (agentId: string) => Promise<void> | void;
onRenameTab: (tab: WorkspaceTabDescriptor) => void;
onCloseTabsToLeft: (tabId: string, paneTabs: WorkspaceTabDescriptor[]) => Promise<void> | void;
@@ -365,6 +366,7 @@ export function SplitContainer({
onCloseTab,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTabsToLeft,
@@ -581,6 +583,7 @@ export function SplitContainer({
onCloseTab={onCloseTab}
onCopyResumeCommand={onCopyResumeCommand}
onCopyAgentId={onCopyAgentId}
onCopyFilePath={onCopyFilePath}
onReloadAgent={onReloadAgent}
onRenameTab={onRenameTab}
onCloseTabsToLeft={onCloseTabsToLeft}
@@ -723,6 +726,7 @@ function SplitNodeView({
onCloseTab,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTabsToLeft,
@@ -775,6 +779,7 @@ function SplitNodeView({
onCloseTab={onCloseTab}
onCopyResumeCommand={onCopyResumeCommand}
onCopyAgentId={onCopyAgentId}
onCopyFilePath={onCopyFilePath}
onReloadAgent={onReloadAgent}
onRenameTab={onRenameTab}
onCloseTabsToLeft={onCloseTabsToLeft}
@@ -820,6 +825,7 @@ function SplitNodeView({
onCloseTab={onCloseTab}
onCopyResumeCommand={onCopyResumeCommand}
onCopyAgentId={onCopyAgentId}
onCopyFilePath={onCopyFilePath}
onReloadAgent={onReloadAgent}
onRenameTab={onRenameTab}
onCloseTabsToLeft={onCloseTabsToLeft}
@@ -871,6 +877,7 @@ function SplitPaneView({
onCloseTab,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTabsToLeft,
@@ -1012,6 +1019,7 @@ function SplitPaneView({
onCloseTab={onCloseTab}
onCopyResumeCommand={onCopyResumeCommand}
onCopyAgentId={onCopyAgentId}
onCopyFilePath={onCopyFilePath}
onReloadAgent={onReloadAgent}
onRenameTab={onRenameTab}
onCloseTabsToLeft={handleCloseTabsToLeft}
packages/app/src/desktop/components/pair-device-modal.tsx
+1 -1
View File
@@ -14,7 +14,7 @@ const SNAP_POINTS: string[] = ["82%", "94%"];
export function PairDeviceModal({ visible, onClose, testID }: PairDeviceModalProps) {
const { t } = useTranslation();
const header = useMemo<SheetHeader>(
() => ({ title: t("settings.integrations.pairDevices.rowTitle") }),
() => ({ title: t("settings.host.pairDevices.rowTitle") }),
[t],
);
packages/app/src/i18n/resources/ar.ts
+11 -3
View File
@@ -433,6 +433,7 @@ export const ar: TranslationResources = {
openFor: "فتح القائمة لـ{{label}}",
copyResumeCommand: "نسخ أمر السيرة الذاتية",
copyAgentId: "نسخ معرف الوكيل",
copyFilePath: "Copy file path",
rename: "إعادة تسمية",
closeAbove: "إغلاق علامات التبويب أعلاه",
closeBelow: "إغلاق علامات التبويب أدناه",
@@ -467,6 +468,7 @@ export const ar: TranslationResources = {
copyFailed: "فشل النسخ",
agentIdCopiedLabel: "AgentID",
resumeCommandCopiedLabel: "أمر الاستئناف",
filePathCopiedLabel: "File path",
resumeIdUnavailable: "السيرة الذاتية ID غير متوفرة",
resumeCommandUnavailable: "أمر الاستئناف غير متوفر",
reloadingAgent: "وكيل إعادة التحميل...",
@@ -1294,7 +1296,7 @@ export const ar: TranslationResources = {
},
renameModal: {
rename: "إعادة تسمية",
saving: "توفير...",
saving: "جارٍ الحفظ...",
},
sidebarCallout: {
dismiss: "رفض",
@@ -1612,6 +1614,10 @@ export const ar: TranslationResources = {
sheetTitle: "إلحاق موجه النظام",
accessibilityLabel: "إلحاق موجه النظام",
placeholder: "اجعل الردود موجزة دائمًا.",
edit: "تحرير",
reset: "إعادة ضبط",
save: "حفظ",
saving: "جارٍ الحفظ...",
},
},
agents: {
@@ -1646,10 +1652,12 @@ export const ar: TranslationResources = {
editLabel: "تحرير التسمية",
title: "إعادة تسمية المضيف",
placeholder: "بلدي Host",
submit: "إعادة تسمية",
},
restart: {
title: "إعادة تشغيل البرنامج الخفي",
hint: "إعادة تشغيل عملية البرنامج الخفي. سيتم إعادة الاتصال بالتطبيق تلقائيًا",
confirm: "إعادة التشغيل",
confirmTitle: "أعد تشغيل{{name}}",
confirmMessage:
"سيؤدي هذا إلى إعادة تشغيل البرنامج الخفي. سيستمر العملاء الذين يعملون عليه؛ سيتم إعادة الاتصال بالتطبيق تلقائيًا.",
@@ -1815,9 +1823,9 @@ export const ar: TranslationResources = {
actions: {
reload: "إعادة تحميل",
tryAgain: "حاول ثانية",
save: "يحفظ",
save: "حفظ",
saved: "تم حفظ المشروع",
saving: "توفير...",
saving: "جارٍ الحفظ...",
cancel: "يلغي",
},
},
packages/app/src/i18n/resources/en.ts
+8
View File
@@ -432,6 +432,7 @@ export const en = {
openFor: "Open menu for {{label}}",
copyResumeCommand: "Copy resume command",
copyAgentId: "Copy agent id",
copyFilePath: "Copy file path",
rename: "Rename",
closeAbove: "Close tabs above",
closeBelow: "Close tabs below",
@@ -466,6 +467,7 @@ export const en = {
copyFailed: "Copy failed",
agentIdCopiedLabel: "Agent ID",
resumeCommandCopiedLabel: "resume command",
filePathCopiedLabel: "File path",
resumeIdUnavailable: "Resume ID not available",
resumeCommandUnavailable: "Resume command not available",
reloadingAgent: "Reloading agent...",
@@ -1619,6 +1621,10 @@ export const en = {
sheetTitle: "Append system prompt",
accessibilityLabel: "Append system prompt",
placeholder: "Always keep replies concise.",
edit: "Edit",
reset: "Reset",
save: "Save",
saving: "Saving...",
},
},
agents: {
@@ -1653,10 +1659,12 @@ export const en = {
editLabel: "Edit label",
title: "Rename host",
placeholder: "My Host",
submit: "Rename",
},
restart: {
title: "Restart daemon",
hint: "Restarts the daemon process. The app will reconnect automatically",
confirm: "Restart",
confirmTitle: "Restart {{name}}",
confirmMessage:
"This will restart the daemon. Agents running on it will keep going; the app will reconnect automatically.",
packages/app/src/i18n/resources/es.ts
+11 -3
View File
@@ -436,6 +436,7 @@ export const es: TranslationResources = {
openFor: "Menú abierto para{{label}}",
copyResumeCommand: "Copiar comando de reanudación",
copyAgentId: "Copiar ID del agente",
copyFilePath: "Copy file path",
rename: "Rebautizar",
closeAbove: "Cerrar pestañas arriba",
closeBelow: "Cerrar pestañas a continuación",
@@ -471,6 +472,7 @@ export const es: TranslationResources = {
copyFailed: "Copia fallida",
agentIdCopiedLabel: "AgentID",
resumeCommandCopiedLabel: "reanudar el comando",
filePathCopiedLabel: "File path",
resumeIdUnavailable: "ReanudarIDno disponible",
resumeCommandUnavailable: "Comando de reanudación no disponible",
reloadingAgent: "Agente de recarga...",
@@ -1329,7 +1331,7 @@ export const es: TranslationResources = {
},
renameModal: {
rename: "Rebautizar",
saving: "Ahorro...",
saving: "Guardando...",
},
sidebarCallout: {
dismiss: "Despedir",
@@ -1649,6 +1651,10 @@ export const es: TranslationResources = {
sheetTitle: "Agregar mensaje del sistema",
accessibilityLabel: "Agregar mensaje del sistema",
placeholder: "Mantenga siempre respuestas concisas.",
edit: "Editar",
reset: "Restablecer",
save: "Guardar",
saving: "Guardando...",
},
},
agents: {
@@ -1683,10 +1689,12 @@ export const es: TranslationResources = {
editLabel: "Editar etiqueta",
title: "Cambiar nombre de host",
placeholder: "MiHost",
submit: "Cambiar nombre",
},
restart: {
title: "Reiniciar demonio",
hint: "Reinicia el proceso del demonio. La aplicación se volverá a conectar automáticamente",
confirm: "Reiniciar",
confirmTitle: "Reiniciar{{name}}",
confirmMessage:
"Esto reiniciará el demonio. Los agentes que se ejecutan en él seguirán funcionando; la aplicación se volverá a conectar automáticamente.",
@@ -1856,9 +1864,9 @@ export const es: TranslationResources = {
actions: {
reload: "Recargar",
tryAgain: "Intentar otra vez",
save: "Ahorrar",
save: "Guardar",
saved: "Proyecto guardado",
saving: "Ahorro...",
saving: "Guardando...",
cancel: "Cancelar",
},
},
packages/app/src/i18n/resources/fr.ts
+10 -2
View File
@@ -436,6 +436,7 @@ export const fr: TranslationResources = {
openFor: "Ouvrir le menu pour{{label}}",
copyResumeCommand: "Copier la commande de reprise",
copyAgentId: "Copier l'identifiant de l'agent",
copyFilePath: "Copy file path",
rename: "Rebaptiser",
closeAbove: "Fermer les onglets ci-dessus",
closeBelow: "Fermer les onglets ci-dessous",
@@ -471,6 +472,7 @@ export const fr: TranslationResources = {
copyFailed: "Échec de la copie",
agentIdCopiedLabel: "AgentID",
resumeCommandCopiedLabel: "reprendre la commande",
filePathCopiedLabel: "File path",
resumeIdUnavailable: "ReprendreIDnon disponible",
resumeCommandUnavailable: "Commande de reprise non disponible",
reloadingAgent: "Agent de rechargement...",
@@ -1332,7 +1334,7 @@ export const fr: TranslationResources = {
},
renameModal: {
rename: "Rebaptiser",
saving: "Économie...",
saving: "Sauvegarde...",
},
sidebarCallout: {
dismiss: "Rejeter",
@@ -1655,6 +1657,10 @@ export const fr: TranslationResources = {
sheetTitle: "Ajouter une invite système",
accessibilityLabel: "Ajouter une invite système",
placeholder: "Gardez toujours des réponses concises.",
edit: "Modifier",
reset: "Réinitialiser",
save: "Sauvegarder",
saving: "Sauvegarde...",
},
},
agents: {
@@ -1689,10 +1695,12 @@ export const fr: TranslationResources = {
editLabel: "Modifier l'étiquette",
title: "Renommer l'hôte",
placeholder: "MonHost",
submit: "Renommer",
},
restart: {
title: "Redémarrer le démon",
hint: "Redémarre le processus démon. L'application se reconnectera automatiquement",
confirm: "Redémarrer",
confirmTitle: "Redémarrer{{name}}",
confirmMessage:
"Cela redémarrera le démon. Les agents qui s'y exécutent continueront à fonctionner; l'application se reconnectera automatiquement.",
@@ -1866,7 +1874,7 @@ export const fr: TranslationResources = {
tryAgain: "Essayer à nouveau",
save: "Sauvegarder",
saved: "Projet enregistré",
saving: "Économie...",
saving: "Sauvegarde...",
cancel: "Annuler",
},
},
packages/app/src/i18n/resources/ru.ts
+8
View File
@@ -436,6 +436,7 @@ export const ru: TranslationResources = {
openFor: "Открыть меню для{{label}}",
copyResumeCommand: "Копировать команду возобновления",
copyAgentId: "Скопировать идентификатор агента",
copyFilePath: "Copy file path",
rename: "Переименовать",
closeAbove: "Закрыть вкладки выше",
closeBelow: "Закройте вкладки ниже",
@@ -470,6 +471,7 @@ export const ru: TranslationResources = {
copyFailed: "Не удалось скопировать",
agentIdCopiedLabel: "AgentID",
resumeCommandCopiedLabel: "команда возобновления",
filePathCopiedLabel: "File path",
resumeIdUnavailable: "Резюме ID недоступно",
resumeCommandUnavailable: "Команда возобновления недоступна",
reloadingAgent: "Перезагрузка агента...",
@@ -1643,6 +1645,10 @@ export const ru: TranslationResources = {
sheetTitle: "Добавить системное приглашение",
accessibilityLabel: "Добавить системное приглашение",
placeholder: "Всегда отвечайте кратко.",
edit: "Редактировать",
reset: "Сбросить",
save: "Сохранить",
saving: "Сохранение...",
},
},
agents: {
@@ -1677,10 +1683,12 @@ export const ru: TranslationResources = {
editLabel: "Изменить ярлык",
title: "Переименовать хост",
placeholder: "Мой Host",
submit: "Переименовать",
},
restart: {
title: "Перезапустить демон",
hint: "Перезапускает процесс демона. Приложение автоматически переподключится",
confirm: "Перезапустить",
confirmTitle: "Перезапустите{{name}}",
confirmMessage:
"Это перезапустит демон. Агенты, работающие на нем, будут продолжать работать; приложение автоматически повторно подключится.",
packages/app/src/i18n/resources/zh-CN.ts
+8
View File
@@ -433,6 +433,7 @@ export const zhCN: TranslationResources = {
openFor: "打开 {{label}} 的菜单",
copyResumeCommand: "复制恢复命令",
copyAgentId: "复制 Agent ID",
copyFilePath: "Copy file path",
rename: "重命名",
closeAbove: "关闭上方标签",
closeBelow: "关闭下方标签",
@@ -467,6 +468,7 @@ export const zhCN: TranslationResources = {
copyFailed: "复制失败",
agentIdCopiedLabel: "Agent ID",
resumeCommandCopiedLabel: "恢复命令",
filePathCopiedLabel: "File path",
resumeIdUnavailable: "恢复 ID 不可用",
resumeCommandUnavailable: "恢复命令不可用",
reloadingAgent: "正在重新加载 Agent...",
@@ -1594,6 +1596,10 @@ export const zhCN: TranslationResources = {
sheetTitle: "追加 system prompt",
accessibilityLabel: "追加 system prompt",
placeholder: "始终保持回复简洁。",
edit: "编辑",
reset: "重置",
save: "保存",
saving: "保存中...",
},
},
agents: {
@@ -1628,10 +1634,12 @@ export const zhCN: TranslationResources = {
editLabel: "编辑标签",
title: "重命名 Host",
placeholder: "我的 Host",
submit: "重命名",
},
restart: {
title: "重启 Daemon",
hint: "重启 Daemon 进程。应用会自动重新连接",
confirm: "重启",
confirmTitle: "重启 {{name}}",
confirmMessage: "这会重启 Daemon。其上运行的 Agent 会继续运行；应用会自动重新连接。",
restarting: "正在重启...",
packages/app/src/screens/workspace/workspace-desktop-tabs-row.tsx
+9
View File
@@ -399,6 +399,7 @@ interface WorkspaceDesktopTabsRowProps {
onCloseTab: (tabId: string) => Promise<void> | void;
onCopyResumeCommand: (agentId: string) => Promise<void> | void;
onCopyAgentId: (agentId: string) => Promise<void> | void;
onCopyFilePath: (path: string) => Promise<void> | void;
onReloadAgent: (agentId: string) => Promise<void> | void;
onRenameTab: (tab: WorkspaceTabDescriptor) => void;
onCloseTabsToLeft: (tabId: string) => Promise<void> | void;
@@ -713,6 +714,7 @@ export function WorkspaceDesktopTabsRow({
onCloseTab,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTabsToLeft,
@@ -784,6 +786,7 @@ export function WorkspaceDesktopTabsRow({
() => ({
copyResumeCommand: t("workspace.tabs.menu.copyResumeCommand"),
copyAgentId: t("workspace.tabs.menu.copyAgentId"),
copyFilePath: t("workspace.tabs.menu.copyFilePath"),
rename: t("workspace.tabs.menu.rename"),
closeAbove: t("workspace.tabs.menu.closeAbove"),
closeBelow: t("workspace.tabs.menu.closeBelow"),
@@ -881,6 +884,7 @@ export function WorkspaceDesktopTabsRow({
normalizedWorkspaceId={normalizedWorkspaceId}
onCopyResumeCommand={onCopyResumeCommand}
onCopyAgentId={onCopyAgentId}
onCopyFilePath={onCopyFilePath}
onReloadAgent={onReloadAgent}
onRenameTab={onRenameTab}
onCloseTabsToLeft={onCloseTabsToLeft}
@@ -911,6 +915,7 @@ export function WorkspaceDesktopTabsRow({
onCloseTabsToLeft,
onCloseTabsToRight,
onCopyAgentId,
onCopyFilePath,
onCopyResumeCommand,
onNavigateTab,
onReloadAgent,
@@ -1003,6 +1008,7 @@ function ResolvedDesktopTabChip({
normalizedWorkspaceId,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTabsToLeft,
@@ -1028,6 +1034,7 @@ function ResolvedDesktopTabChip({
normalizedWorkspaceId: string;
onCopyResumeCommand: (agentId: string) => Promise<void> | void;
onCopyAgentId: (agentId: string) => Promise<void> | void;
onCopyFilePath: (path: string) => Promise<void> | void;
onReloadAgent: (agentId: string) => Promise<void> | void;
onRenameTab: (tab: WorkspaceTabDescriptor) => void;
onCloseTabsToLeft: (tabId: string) => Promise<void> | void;
@@ -1053,6 +1060,7 @@ function ResolvedDesktopTabChip({
tabCount,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTab,
@@ -1069,6 +1077,7 @@ function ResolvedDesktopTabChip({
onCloseTabsToLeft,
onCloseTabsToRight,
onCopyAgentId,
onCopyFilePath,
onCopyResumeCommand,
labels,
onReloadAgent,
packages/app/src/screens/workspace/workspace-screen.tsx
+25
View File
@@ -392,6 +392,7 @@ interface MobileWorkspaceTabSwitcherProps {
onSelectSwitcherTab: (key: string) => void;
onCopyResumeCommand: (agentId: string) => Promise<void> | void;
onCopyAgentId: (agentId: string) => Promise<void> | void;
onCopyFilePath: (path: string) => Promise<void> | void;
onReloadAgent: (agentId: string) => Promise<void> | void;
onRenameTab: (tab: WorkspaceTabDescriptor) => void;
onCloseTab: (tabId: string) => Promise<void> | void;
@@ -579,6 +580,7 @@ function MobileWorkspaceTabOption({
onPress,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTab,
@@ -596,6 +598,7 @@ function MobileWorkspaceTabOption({
onPress: () => void;
onCopyResumeCommand: (agentId: string) => Promise<void> | void;
onCopyAgentId: (agentId: string) => Promise<void> | void;
onCopyFilePath: (path: string) => Promise<void> | void;
onReloadAgent: (agentId: string) => Promise<void> | void;
onRenameTab: (tab: WorkspaceTabDescriptor) => void;
onCloseTab: (tabId: string) => Promise<void> | void;
@@ -608,6 +611,7 @@ function MobileWorkspaceTabOption({
() => ({
copyResumeCommand: t("workspace.tabs.menu.copyResumeCommand"),
copyAgentId: t("workspace.tabs.menu.copyAgentId"),
copyFilePath: t("workspace.tabs.menu.copyFilePath"),
rename: t("workspace.tabs.menu.rename"),
closeAbove: t("workspace.tabs.menu.closeAbove"),
closeBelow: t("workspace.tabs.menu.closeBelow"),
@@ -629,6 +633,7 @@ function MobileWorkspaceTabOption({
menuTestIDBase,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTab,
@@ -695,6 +700,7 @@ const MobileWorkspaceTabSwitcher = memo(function MobileWorkspaceTabSwitcher({
onSelectSwitcherTab,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTab,
@@ -750,6 +756,7 @@ const MobileWorkspaceTabSwitcher = memo(function MobileWorkspaceTabSwitcher({
onPress={onPress}
onCopyResumeCommand={onCopyResumeCommand}
onCopyAgentId={onCopyAgentId}
onCopyFilePath={onCopyFilePath}
onReloadAgent={onReloadAgent}
onRenameTab={onRenameTab}
onCloseTab={onCloseTab}
@@ -767,6 +774,7 @@ const MobileWorkspaceTabSwitcher = memo(function MobileWorkspaceTabSwitcher({
normalizedWorkspaceId,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTab,
@@ -2712,6 +2720,19 @@ function WorkspaceScreenContent({
[toast, t],
);
const handleCopyFilePath = useCallback(
async (path: string) => {
if (!path) return;
try {
await Clipboard.setStringAsync(path);
toast.copied(t("workspace.tabs.toasts.filePathCopiedLabel"));
} catch {
toast.error(t("workspace.tabs.toasts.copyFailed"));
}
},
[toast, t],
);
const handleCopyResumeCommand = useCallback(
async (agentId: string) => {
if (!agentId) return;
@@ -3534,6 +3555,7 @@ function WorkspaceScreenContent({
onCloseTab={handleCloseTabById}
onCopyResumeCommand={handleCopyResumeCommand}
onCopyAgentId={handleCopyAgentId}
onCopyFilePath={handleCopyFilePath}
onReloadAgent={handleReloadAgent}
onRenameTab={handleRenameTab}
onCloseTabsToLeft={handleCloseTabsToLeftInPane}
@@ -3568,6 +3590,7 @@ function WorkspaceScreenContent({
handleCloseTabById,
handleCopyResumeCommand,
handleCopyAgentId,
handleCopyFilePath,
handleReloadAgent,
handleRenameTab,
handleCloseTabsToLeftInPane,
@@ -3648,6 +3671,7 @@ function WorkspaceScreenContent({
onSelectSwitcherTab={handleSelectSwitcherTab}
onCopyResumeCommand={handleCopyResumeCommand}
onCopyAgentId={handleCopyAgentId}
onCopyFilePath={handleCopyFilePath}
onReloadAgent={handleReloadAgent}
onRenameTab={handleRenameTab}
onCloseTab={handleCloseTabById}
@@ -3669,6 +3693,7 @@ function WorkspaceScreenContent({
onCloseTab={handleCloseTabById}
onCopyResumeCommand={handleCopyResumeCommand}
onCopyAgentId={handleCopyAgentId}
onCopyFilePath={handleCopyFilePath}
onReloadAgent={handleReloadAgent}
onRenameTab={handleRenameTab}
onCloseTabsToLeft={handleCloseTabsToLeft}
packages/app/src/screens/workspace/workspace-tab-menu.test.ts
+51
View File
@@ -15,6 +15,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
it("uses desktop tab ordering labels for desktop menus", () => {
const onCopyResumeCommand = vi.fn();
const onCopyAgentId = vi.fn();
const onCopyFilePath = vi.fn();
const onReloadAgent = vi.fn();
const onRenameTab = vi.fn();
const onCloseTab = vi.fn();
@@ -30,6 +31,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
menuTestIDBase: "workspace-tab-context-agent_123",
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTab,
@@ -59,6 +61,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
menuTestIDBase: "workspace-tab-menu-agent_123",
onCopyResumeCommand: vi.fn(),
onCopyAgentId: vi.fn(),
onCopyFilePath: vi.fn(),
onReloadAgent: vi.fn(),
onRenameTab: vi.fn(),
onCloseTab: vi.fn(),
@@ -93,6 +96,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
menuTestIDBase: "workspace-tab-menu-draft_123",
onCopyResumeCommand: vi.fn(),
onCopyAgentId: vi.fn(),
onCopyFilePath: vi.fn(),
onReloadAgent: vi.fn(),
onRenameTab: vi.fn(),
onCloseTab: vi.fn(),
@@ -120,6 +124,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
menuTestIDBase: "workspace-tab-context-agent_123",
onCopyResumeCommand: vi.fn(),
onCopyAgentId: vi.fn(),
onCopyFilePath: vi.fn(),
onReloadAgent: vi.fn(),
onRenameTab: vi.fn(),
onCloseTab: vi.fn(),
@@ -148,6 +153,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
menuTestIDBase: "workspace-tab-context-agent_123",
onCopyResumeCommand: vi.fn(),
onCopyAgentId: vi.fn(),
onCopyFilePath: vi.fn(),
onReloadAgent: vi.fn(),
onRenameTab,
onCloseTab: vi.fn(),
@@ -181,6 +187,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
menuTestIDBase: "workspace-tab-context-terminal_abc",
onCopyResumeCommand: vi.fn(),
onCopyAgentId: vi.fn(),
onCopyFilePath: vi.fn(),
onReloadAgent: vi.fn(),
onRenameTab,
onCloseTab: vi.fn(),
@@ -193,6 +200,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
expect(labels[0]).toBe("Rename");
expect(labels).not.toContain("Copy resume command");
expect(labels).not.toContain("Copy agent id");
expect(labels).not.toContain("Copy file path");
expect(labels).not.toContain("Reload agent");
const renameEntry = entries.find((entry) => entry.kind === "item" && entry.label === "Rename");
@@ -203,6 +211,48 @@ describe("buildWorkspaceTabMenuEntries", () => {
expect(onRenameTab).toHaveBeenCalledWith(terminalTab);
});
it("includes copy file path for file tabs", () => {
const onCopyFilePath = vi.fn();
const fileTab: WorkspaceTabDescriptor = {
key: "file_abc",
tabId: "file_abc",
kind: "file",
target: { kind: "file", path: "/some/path.ts", lineStart: 1, lineEnd: 10 },
};
const entries = buildWorkspaceTabMenuEntries({
surface: "desktop",
tab: fileTab,
index: 0,
tabCount: 1,
menuTestIDBase: "workspace-tab-context-file_abc",
onCopyResumeCommand: vi.fn(),
onCopyAgentId: vi.fn(),
onCopyFilePath,
onReloadAgent: vi.fn(),
onRenameTab: vi.fn(),
onCloseTab: vi.fn(),
onCloseTabsBefore: vi.fn(),
onCloseTabsAfter: vi.fn(),
onCloseOtherTabs: vi.fn(),
});
const labels = entries.filter((entry) => entry.kind === "item").map((entry) => entry.label);
expect(labels[0]).toBe("Copy file path");
expect(labels).not.toContain("Copy resume command");
expect(labels).not.toContain("Copy agent id");
expect(labels).not.toContain("Rename");
expect(labels).not.toContain("Reload agent");
const copyFilePathEntry = entries.find(
(entry) => entry.kind === "item" && entry.key === "copy-file-path",
);
if (!copyFilePathEntry || copyFilePathEntry.kind !== "item") {
throw new Error("Copy file path entry missing");
}
copyFilePathEntry.onSelect();
expect(onCopyFilePath).toHaveBeenCalledWith("/some/path.ts");
});
it("uses the same rename entry shape for agent and terminal tabs", () => {
const terminalTab: WorkspaceTabDescriptor = {
key: "terminal_abc",
@@ -218,6 +268,7 @@ describe("buildWorkspaceTabMenuEntries", () => {
menuTestIDBase,
onCopyResumeCommand: vi.fn(),
onCopyAgentId: vi.fn(),
onCopyFilePath: vi.fn(),
onReloadAgent: vi.fn(),
onRenameTab: vi.fn(),
onCloseTab: vi.fn(),
packages/app/src/screens/workspace/workspace-tab-menu.ts
+20
View File
@@ -8,6 +8,7 @@ export type WorkspaceTabMenuSurface = "desktop" | "mobile";
export interface WorkspaceTabMenuLabels {
copyResumeCommand: string;
copyAgentId: string;
copyFilePath: string;
rename: string;
closeAbove: string;
closeBelow: string;
@@ -22,6 +23,7 @@ export interface WorkspaceTabMenuLabels {
export const DEFAULT_WORKSPACE_TAB_MENU_LABELS: WorkspaceTabMenuLabels = {
copyResumeCommand: i18n.t("workspace.tabs.menu.copyResumeCommand"),
copyAgentId: i18n.t("workspace.tabs.menu.copyAgentId"),
copyFilePath: i18n.t("workspace.tabs.menu.copyFilePath"),
rename: i18n.t("workspace.tabs.menu.rename"),
closeAbove: i18n.t("workspace.tabs.menu.closeAbove"),
closeBelow: i18n.t("workspace.tabs.menu.closeBelow"),
@@ -66,6 +68,7 @@ interface BuildWorkspaceTabMenuEntriesInput {
menuTestIDBase: string;
onCopyResumeCommand: (agentId: string) => Promise<void> | void;
onCopyAgentId: (agentId: string) => Promise<void> | void;
onCopyFilePath: (path: string) => Promise<void> | void;
onReloadAgent: (agentId: string) => Promise<void> | void;
onRenameTab: (tab: WorkspaceTabDescriptor) => void;
onCloseTab: (tabId: string) => Promise<void> | void;
@@ -81,6 +84,7 @@ interface BuildWorkspaceDesktopTabActionsInput {
tabCount: number;
onCopyResumeCommand: (agentId: string) => Promise<void> | void;
onCopyAgentId: (agentId: string) => Promise<void> | void;
onCopyFilePath: (path: string) => Promise<void> | void;
onReloadAgent: (agentId: string) => Promise<void> | void;
onRenameTab: (tab: WorkspaceTabDescriptor) => void;
onCloseTab: (tabId: string) => Promise<void> | void;
@@ -148,6 +152,7 @@ export function buildWorkspaceTabMenuEntries(
menuTestIDBase,
onCopyResumeCommand,
onCopyAgentId,
onCopyFilePath,
onReloadAgent,
onRenameTab,
onCloseTab,
@@ -186,6 +191,20 @@ export function buildWorkspaceTabMenuEntries(
});
}
if (tab.target.kind === "file") {
const filePath = tab.target.path;
entries.push({
kind: "item",
key: "copy-file-path",
label: labels.copyFilePath,
icon: "copy",
testID: `${menuTestIDBase}-copy-file-path`,
onSelect: () => {
void onCopyFilePath(filePath);
},
});
}
if (tab.target.kind === "agent" || tab.target.kind === "terminal") {
entries.push({
kind: "item",
@@ -278,6 +297,7 @@ export function buildWorkspaceDesktopTabActions(
menuTestIDBase: contextMenuTestId,
onCopyResumeCommand: input.onCopyResumeCommand,
onCopyAgentId: input.onCopyAgentId,
onCopyFilePath: input.onCopyFilePath,
onReloadAgent: input.onReloadAgent,
onRenameTab: input.onRenameTab,
onCloseTab: input.onCloseTab,
packages/server/src/server/agent/agent-manager.test.ts
+41
View File
@@ -992,6 +992,47 @@ test("createAgent injects paseo MCP server only into provider launch config", as
});
});
test("createAgent injects the MCP auth token as a bearer header into the launch config", async () => {
const workdir = mkdtempSync(join(tmpdir(), "agent-manager-test-"));
const storagePath = join(workdir, "agents");
const storage = new AgentStorage(storagePath, logger);
class CaptureClient extends TestAgentClient {
lastConfig: AgentSessionConfig | null = null;
override async createSession(config: AgentSessionConfig): Promise<AgentSession> {
this.lastConfig = config;
return new TestAgentSession(config);
}
}
const client = new CaptureClient();
const manager = new AgentManager({
clients: {
codex: client,
},
registry: storage,
logger,
mcpBaseUrl: "http://127.0.0.1:6767/mcp/agents",
mcpAuthToken: "cap-token",
idFactory: () => "00000000-0000-4000-8000-000000000104",
});
const snapshot = await manager.createAgent({
provider: "codex",
cwd: workdir,
});
expect(manager.getMcpAuthToken()).toBe("cap-token");
expect(client.lastConfig?.mcpServers?.paseo).toEqual({
type: "http",
url: `http://127.0.0.1:6767/mcp/agents?callerAgentId=${snapshot.id}`,
headers: { Authorization: "Bearer cap-token" },
});
rmSync(workdir, { recursive: true, force: true });
});
test("resumeAgentFromPersistence replaces stored internal paseo MCP with current runtime URL", async () => {
const workdir = mkdtempSync(join(tmpdir(), "agent-manager-test-"));
const storagePath = join(workdir, "agents");
packages/server/src/server/agent/agent-manager.ts
+14
View File
@@ -196,6 +196,7 @@ export interface AgentManagerOptions {
durableTimelineStore?: AgentTimelineStore;
terminalManager?: TerminalManager | null;
mcpBaseUrl?: string;
mcpAuthToken?: string;
appendSystemPrompt?: string;
agentStreamCoalesceWindowMs?: number;
rescueTimeouts?: AgentManagerRescueTimeouts;
@@ -482,6 +483,7 @@ export class AgentManager {
private readonly backgroundTasks = new Set<Promise<void>>();
private readonly agentStreamCoalescer: AgentStreamCoalescer;
private mcpBaseUrl: string | null;
private readonly mcpAuthToken: string | null;
private appendSystemPrompt: string;
private onAgentAttention?: AgentAttentionCallback;
private onAgentArchived?: AgentArchivedCallback;
@@ -496,6 +498,7 @@ export class AgentManager {
this.onAgentAttention = options?.onAgentAttention;
this.onWorkspaceStateMayHaveChanged = options?.onWorkspaceStateMayHaveChanged;
this.mcpBaseUrl = options?.mcpBaseUrl ?? null;
this.mcpAuthToken = options?.mcpAuthToken ?? null;
this.appendSystemPrompt = options.appendSystemPrompt ?? "";
this.logger = options.logger.child({ module: "agent", component: "agent-manager" });
this.rescueTimeouts = {
@@ -554,6 +557,16 @@ export class AgentManager {
this.mcpBaseUrl = url;
}
/**
* Capability token the daemon's own MCP clients must present to the Agent MCP
* endpoint when a daemon password is configured. Read by the per-client
* session to authenticate its own MCP connection. Stays in the daemon — never
* sent to remote clients.
*/
getMcpAuthToken(): string | null {
return this.mcpAuthToken;
}
setAppendSystemPrompt(prompt: string | null | undefined): void {
this.appendSystemPrompt = prompt ?? "";
}
@@ -3567,6 +3580,7 @@ export class AgentManager {
config: storedConfig,
agentId,
mcpBaseUrl: this.mcpBaseUrl,
mcpAuthToken: this.mcpAuthToken,
}),
);
return { storedConfig, launchConfig };
packages/server/src/server/agent/agent-mcp.e2e.test.ts
+76 -2
View File
@@ -9,6 +9,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
import pino from "pino";
import { withTimeout } from "../../utils/promise-timeout.js";
import { hashDaemonPassword } from "../auth.js";
import { createPaseoDaemon, type PaseoDaemonConfig } from "../bootstrap.js";
import { createTestAgentClients } from "../test-utils/fake-agent-client.js";
import type {
@@ -78,8 +79,11 @@ function getStructuredContent(result: McpToolResult): StructuredContent | null {
return null;
}
async function createMcpClient(url: string): Promise<McpClient> {
const transport = new StreamableHTTPClientTransport(new URL(url));
async function createMcpClient(url: string, authToken?: string): Promise<McpClient> {
const transport = new StreamableHTTPClientTransport(
new URL(url),
authToken ? { requestInit: { headers: { Authorization: `Bearer ${authToken}` } } } : undefined,
);
const rawClient = await experimental_createMCPClient({ transport });
const boundCallTool: McpClient["callTool"] = Reflect.get(rawClient, "callTool").bind(rawClient);
return { callTool: boundCallTool, close: () => rawClient.close() };
@@ -177,6 +181,76 @@ describe("agent MCP end-to-end (offline)", () => {
}
}, 30_000);
test("password-protected daemon authorizes the agent MCP via the capability token", async () => {
const paseoHome = await mkdtemp(path.join(os.tmpdir(), "paseo-home-"));
const staticDir = await mkdtemp(path.join(os.tmpdir(), "paseo-static-"));
const agentCwd = await mkdtemp(path.join(os.tmpdir(), "paseo-agent-cwd-"));
const port = await getAvailablePort();
const daemonConfig: PaseoDaemonConfig = {
listen: `127.0.0.1:${port}`,
paseoHome,
corsAllowedOrigins: [],
hostnames: true,
mcpEnabled: true,
staticDir,
mcpDebug: false,
agentClients: createTestAgentClients(),
agentStoragePath: path.join(paseoHome, "agents"),
auth: { password: hashDaemonPassword("daemon-secret") },
};
const daemon = await createPaseoDaemon(daemonConfig, pino({ level: "silent" }));
await daemon.start();
const mcpUrl = `http://127.0.0.1:${port}/mcp/agents`;
const capabilityToken = daemon.agentManager.getMcpAuthToken();
expect(typeof capabilityToken).toBe("string");
let agentId: string | null = null;
let client: McpClient | null = null;
try {
// Remote auth is not weakened: a request without credentials is rejected
// before any MCP processing.
const unauthorized = await fetch(mcpUrl, {
method: "POST",
headers: { "content-type": "application/json" },
body: "{}",
});
expect(unauthorized.status).toBe(401);
// The injected capability token authenticates the full MCP handshake:
// creating (and connecting) the client and driving a tool call both go
// through the password-gated /mcp/agents route. (The exact bearer header
// injected into a child agent's config is covered by the
// runtime-mcp-config unit test.)
client = await createMcpClient(mcpUrl, capabilityToken!);
const result = await client.callTool({
name: "create_agent",
args: {
cwd: agentCwd,
title: "Password MCP",
provider: "claude/claude-test-model",
mode: "bypassPermissions",
initialPrompt: "reply with done and stop",
background: true,
},
});
const payload = getStructuredContent(result);
agentId = typeof payload?.agentId === "string" ? payload.agentId : null;
expect(agentId).toBeTruthy();
} finally {
if (agentId) {
await client?.callTool({ name: "kill_agent", args: { agentId } });
}
await client?.close();
await daemon.stop();
await rm(paseoHome, { recursive: true, force: true });
await rm(staticDir, { recursive: true, force: true });
await rm(agentCwd, { recursive: true, force: true });
}
}, 30_000);
test("create_agent auto-injects paseo MCP by default and can be disabled", async () => {
const paseoHome = await mkdtemp(path.join(os.tmpdir(), "paseo-home-"));
const staticDir = await mkdtemp(path.join(os.tmpdir(), "paseo-static-"));
packages/server/src/server/agent/runtime-mcp-config.test.ts
+51
View File
@@ -0,0 +1,51 @@
import { describe, expect, test } from "vitest";
import type { AgentSessionConfig } from "./agent-sdk-types.js";
import { withRuntimePaseoMcpServer } from "./runtime-mcp-config.js";
const BASE_CONFIG: AgentSessionConfig = {
provider: "claude",
cwd: "/tmp/agent",
};
describe("withRuntimePaseoMcpServer", () => {
test("injects the paseo MCP server with a bearer header when a token is provided", () => {
const result = withRuntimePaseoMcpServer({
config: BASE_CONFIG,
agentId: "agent-1",
mcpBaseUrl: "http://127.0.0.1:6767/mcp/agents",
mcpAuthToken: "cap-token",
});
expect(result.mcpServers?.paseo).toEqual({
type: "http",
url: "http://127.0.0.1:6767/mcp/agents?callerAgentId=agent-1",
headers: { Authorization: "Bearer cap-token" },
});
});
test("omits the header when no token is available", () => {
const result = withRuntimePaseoMcpServer({
config: BASE_CONFIG,
agentId: "agent-1",
mcpBaseUrl: "http://127.0.0.1:6767/mcp/agents",
mcpAuthToken: null,
});
expect(result.mcpServers?.paseo).toEqual({
type: "http",
url: "http://127.0.0.1:6767/mcp/agents?callerAgentId=agent-1",
});
});
test("does not inject when no MCP base URL is configured", () => {
const result = withRuntimePaseoMcpServer({
config: BASE_CONFIG,
agentId: "agent-1",
mcpBaseUrl: null,
mcpAuthToken: "cap-token",
});
expect(result.mcpServers).toBeUndefined();
});
});
packages/server/src/server/agent/runtime-mcp-config.ts
+9
View File
@@ -30,6 +30,12 @@ export function withRuntimePaseoMcpServer(params: {
config: AgentSessionConfig;
agentId: string;
mcpBaseUrl: string | null;
/**
* Capability token authenticating the injected connection to the daemon's
* Agent MCP endpoint. The daemon password is gated off this route, so without
* this header the agent's MCP requests are rejected when a password is set.
*/
mcpAuthToken: string | null;
}): AgentSessionConfig {
const storedConfig = stripInternalPaseoMcpServer(params.config);
if (!params.mcpBaseUrl || storedConfig.mcpServers?.[PASEO_MCP_SERVER_NAME]) {
@@ -42,6 +48,9 @@ export function withRuntimePaseoMcpServer(params: {
[PASEO_MCP_SERVER_NAME]: {
type: "http",
url: `${params.mcpBaseUrl}?callerAgentId=${params.agentId}`,
...(params.mcpAuthToken
? { headers: { Authorization: `Bearer ${params.mcpAuthToken}` } }
: {}),
},
...storedConfig.mcpServers,
},
packages/server/src/server/auth.test.ts
+55
View File
@@ -5,6 +5,7 @@ import {
extractWsBearerProtocol,
extractWsBearerToken,
hashDaemonPassword,
isAgentMcpRequestAuthorized,
isBearerTokenValidAsync,
isBearerTokenValid,
shouldBypassBearerAuth,
@@ -61,8 +62,62 @@ describe("daemon bearer validator", () => {
expect(shouldBypassBearerAuth("GET", "/api/health")).toBe(true);
// Guarded by its own single-use download token, not the daemon password.
expect(shouldBypassBearerAuth("GET", "/api/files/download")).toBe(true);
// Guarded by its own per-daemon-run capability token (see
// isAgentMcpRequestAuthorized), not the daemon password.
expect(shouldBypassBearerAuth("POST", "/mcp/agents")).toBe(true);
// Everything else stays behind the daemon password.
expect(shouldBypassBearerAuth("GET", "/api/status")).toBe(false);
expect(shouldBypassBearerAuth("POST", "/api/files/upload")).toBe(false);
});
});
describe("agent MCP request authorizer", () => {
const CAPABILITY_TOKEN = "cap-token-abc123";
test("allows any request when no daemon password is configured", async () => {
expect(
await isAgentMcpRequestAuthorized({
password: undefined,
capabilityToken: CAPABILITY_TOKEN,
authorizationHeader: undefined,
}),
).toBe(true);
});
test("accepts the injected capability token", async () => {
expect(
await isAgentMcpRequestAuthorized({
password: CORRECT_PASSWORD_HASH,
capabilityToken: CAPABILITY_TOKEN,
authorizationHeader: `Bearer ${CAPABILITY_TOKEN}`,
}),
).toBe(true);
});
test("still accepts a valid daemon-password bearer", async () => {
expect(
await isAgentMcpRequestAuthorized({
password: CORRECT_PASSWORD_HASH,
capabilityToken: CAPABILITY_TOKEN,
authorizationHeader: "Bearer correct-password",
}),
).toBe(true);
});
test("rejects requests presenting neither the token nor a valid password", async () => {
expect(
await isAgentMcpRequestAuthorized({
password: CORRECT_PASSWORD_HASH,
capabilityToken: CAPABILITY_TOKEN,
authorizationHeader: undefined,
}),
).toBe(false);
expect(
await isAgentMcpRequestAuthorized({
password: CORRECT_PASSWORD_HASH,
capabilityToken: CAPABILITY_TOKEN,
authorizationHeader: "Bearer wrong-token",
}),
).toBe(false);
});
});
packages/server/src/server/auth.ts
+40
View File
@@ -1,4 +1,5 @@
import { compare, compareSync, hashSync } from "bcryptjs";
import { timingSafeEqual } from "node:crypto";
import type { RequestHandler } from "express";
export const DAEMON_PASSWORD_BCRYPT_COST = 12;
@@ -132,6 +133,16 @@ const BEARER_AUTH_BYPASS_PATHS = new Set([
// rejects requests without a valid token (400/403), so dropping the bearer
// here does not make the route unauthenticated.
"/api/files/download",
// The daemon injects its own agents' Paseo MCP connections at this endpoint
// (and connects its own per-client MCP client here). Those connections cannot
// carry the daemon password — it is only known in plaintext when set via env,
// never when set via the app — so the route authenticates them with a
// per-daemon-run capability token instead (see isAgentMcpRequestAuthorized).
// The token is injected only into local agent configs/sessions and never sent
// to remote clients, and the route still rejects callers presenting neither
// the token nor a valid daemon password, so dropping the global bearer here
// does not make the endpoint unauthenticated.
"/mcp/agents",
]);
export function shouldBypassBearerAuth(method: string, path: string): boolean {
@@ -140,3 +151,32 @@ export function shouldBypassBearerAuth(method: string, path: string): boolean {
}
return BEARER_AUTH_BYPASS_PATHS.has(path);
}
/**
* Authorizes a request to the Agent MCP endpoint (/mcp/agents), which is exempt
* from the global daemon-password middleware. Accepts either the per-daemon-run
* capability token the daemon injects into its own agents' configs and MCP
* client, or a valid daemon-password bearer (so existing password-authenticated
* callers keep working). When no daemon password is configured the endpoint is
* open, matching the global middleware's behavior.
*/
export async function isAgentMcpRequestAuthorized(input: {
password: string | undefined;
capabilityToken: string | null;
authorizationHeader: string | undefined;
}): Promise<boolean> {
if (!input.password) {
return true;
}
const token = extractHttpBearerToken(input.authorizationHeader);
if (input.capabilityToken !== null && token !== null) {
// Constant-time compare; length-guard first because timingSafeEqual throws
// on differing buffer lengths.
const provided = Buffer.from(token);
const expected = Buffer.from(input.capabilityToken);
if (provided.length === expected.length && timingSafeEqual(provided, expected)) {
return true;
}
}
return isBearerTokenValidAsync({ password: input.password, token });
}
packages/server/src/server/bootstrap.ts
+29 -1
View File
@@ -132,7 +132,11 @@ import { ScriptHealthMonitor } from "./script-health-monitor.js";
import { createScriptStatusEmitter } from "./script-status-projection.js";
import { WorkspaceScriptRuntimeStore } from "./workspace-script-runtime-store.js";
import { isHostnameAllowed, type HostnamesConfig } from "./hostnames.js";
import { createRequireBearerMiddleware, type DaemonAuthConfig } from "./auth.js";
import {
createRequireBearerMiddleware,
isAgentMcpRequestAuthorized,
type DaemonAuthConfig,
} from "./auth.js";
type AgentMcpTransportMap = Map<string, StreamableHTTPServerTransport>;
@@ -330,6 +334,15 @@ export async function createPaseoDaemon(
ttlMs: downloadTokenTtlMs,
});
// Capability token authenticating the daemon's own agents to the loopback
// Agent MCP endpoint (/mcp/agents). Random per daemon run, injected only into
// local agent configs and the daemon's own MCP client — never sent to remote
// clients — so it cannot be replayed off-box. This lets the injected MCP
// authenticate even when the daemon password is set via the app (hash only,
// no plaintext available). Mirrors the /api/files/download capability-token
// pattern.
const agentMcpAuthToken = randomUUID();
const listenTarget = parseListenString(config.listen);
const app = express();
@@ -555,6 +568,7 @@ export async function createPaseoDaemon(
onWorkspaceStateMayHaveChanged: ({ cwd }) => {
workspaceGitService.onWorkspaceStateMayHaveChanged(cwd);
},
mcpAuthToken: agentMcpAuthToken,
logger,
});
@@ -805,6 +819,20 @@ export async function createPaseoDaemon(
req: express.Request,
res: express.Response,
): Promise<void> => {
// This route is exempt from the global daemon-password middleware, so it
// authenticates here using the injected capability token (or a valid
// daemon password). Without this, a password-protected daemon would be
// wide open on its agent control plane.
if (
!(await isAgentMcpRequestAuthorized({
password: config.auth?.password,
capabilityToken: agentMcpAuthToken,
authorizationHeader: req.header("authorization"),
}))
) {
res.status(401).json({ error: "Unauthorized" });
return;
}
if (config.mcpDebug) {
logger.debug(
{
packages/server/src/server/session.ts
+7 -1
View File
@@ -1220,7 +1220,13 @@ export class Session {
);
return;
}
const transport = new StreamableHTTPClientTransport(new URL(this.mcpBaseUrl));
const authToken = this.agentManager.getMcpAuthToken();
const transport = new StreamableHTTPClientTransport(
new URL(this.mcpBaseUrl),
authToken
? { requestInit: { headers: { Authorization: `Bearer ${authToken}` } } }
: undefined,
);
this.agentMcpClient = await experimental_createMCPClient({
transport,