Propagating dashboard auth user identity to agent sessions

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

• #60745 fix(dashboard): scope chat attach tokens by session

  merged to main

  files: hermes_cli/web_server.py, tests/test_pty_keepalive_ws.py

  Show the diff

  • hermes_cli/web_server.py

    @@ -15149,7 +15149,8 @@ async def pty_ws(ws: WebSocket) -> None:
             return
     
         # --- spawn PTY ------------------------------------------------------
    -    resume = ws.query_params.get("resume") or None
    +    raw_resume = ws.query_params.get("resume") or None
    +    resume = raw_resume
         profile = ws.query_params.get("profile") or None
         channel = _channel_or_close_code(ws)
         sidecar_url = _build_sidecar_url(channel) if channel else None
    @@ -15192,6 +15193,12 @@ async def pty_ws(ws: WebSocket) -> None:
     
     
         attach_token = ws.query_params.get("attach") or None
    +    registry_resume = raw_resume
    +    if raw_resume and env:
    +        registry_resume = env.get("HERMES_TUI_RESUME") or raw_resume
    +    if attach_token is not None and (registry_resume or profile):
    +        # Key explicit resumes on their canonical target, never the active-session fallback.
    +        attach_token = f"{attach_token}\0{profile or ''}\0{registry_resume or ''}"
     
         def _spawn():
             return PtyBridge.spawn(argv, cwd=cwd, env=env)

  • tests/test_pty_keepalive_ws.py

    @@ -1,53 +1,136 @@
    +import json
    +
     import pytest
     
     from hermes_cli import web_server
     
     
    [redacted:email]
    -async def test_attach_token_reuses_same_session(monkeypatch):
    -    """Two connects with the same ?attach= token hit one spawned bridge."""
    -    spawned = []
    +class FakeBridge:
    +    def __init__(self):
    +        self.alive = True
    +
    +    def read(self, timeout):
    +        return b""        # idle forever
     
    -    class FakeBridge:
    -        def __init__(self):
    -            self.alive = True
    +    def write(self, data):
    +        pass
     
    -        def read(self, timeout):
    -            return b""        # idle forever
    +    def resize(self, cols, rows):
    +        pass
     
    -        def write(self, data):
    -            pass
    +    def close(self):
    +        self.alive = False
     
    -        def resize(self, cols, rows):
    -            pass
     
    -        def close(self):
    -            self.alive = False
    [redacted:email]
    +def pty_keepalive_harness(monkeypatch):
    +    spawned = []
     
         def fake_spawn(argv, cwd=None, env=None):
             b = FakeBridge()
    -        spawned.append(b)
    +        spawned.append(argv)
             return b
     
         monkeypatch.setattr(web_server.PtyBridge, "spawn", staticmethod(fake_spawn))
    -    # bypass auth + argv resolution for the test
         monkeypatch.setattr(web_server, "_ws_auth_reason", lambda ws: (None, "test"))
         monkeypatch.setattr(web_server, "_ws_host_origin_reason", lambda ws: None)
         monkeypatch.setattr(web_server, "_ws_client_reason", lambda ws: None)
     
         async def fake_argv(**kw):
    -        return (["x"], "/tmp", {})
    +        resume = "child" if kw.get("resume") == "parent" else kw.get("resume")
    +        env = {"HERMES_TUI_RESUME": resume} if resume else {}
    +        return (["x", resume or "fresh"], "/tmp", env)
     
         monkeypatch.setattr(web_server, "_resolve_chat_argv_async", fake_argv)
     
    -    from starlette.testclient import TestClient
    -
         try:
    -        client = TestClient(web_server.app)
    -        with client.websocket_connect("/api/pty?attach=TOK1") as ws1:
    -            ws1.send_bytes(b"hi")
    -        with client.websocket_connect("/api/pty?attach=TOK1") as ws2:
    -            ws2.send_bytes(b"again")
    -        assert len(spawned) == 1                # reattached, did not respawn
    +        yield spawned
         finally:
             web_server.PTY_REGISTRY._sessions.clear()
    +
    +
    [redacted:email]
    +async def test_attach_token_reuses_same_session(pty_keepalive_harness):
    +    """Two connects with the same ?attach= token hit one spawned bridge."""
    +    from starlette.testclient import TestClient
    +
    +    client = TestClient(web_server.app)
    +    with client.websocket_connect("/api/pty?attach=TOK1") as ws1:
    +        ws1.send_bytes(b"hi")
    +    with client.websocket_connect("/api/pty?attach=TOK1") as ws2:
    +        ws2.send_bytes(b"again")
    +    assert len(pty_keepalive_harness) == 1                # reattached, did not respawn
    +
    +
    [redacted:email]
    +async def test_attach_token_reuses_same_resume(pty_keepalive_harness):
    +    from starlette.testclient import TestClient
    +
    +    client = TestClient(web_server.app)
    +    with client.websocket_connect("/api/pty?attach=TOK1&resume=same") as ws1:
    +        ws1.send_bytes(b"hi")
    +    with client.websocket_connect("/api/pty?attach=TOK1&resume=same") as ws2:
    +        ws2.send_bytes(b"again")
    +    assert pty_keepalive_harness == [["x", "same"]]
    +
    +
    [redacted:email]
    +async def test_attach_token_does_not_reuse_different_resume(pty_keepalive_harness):
    +    """A keep-alive token must not pin /chat to an old selected session."""
    +    from starlette.testclient import TestClient
    +
    +    client = TestClient(web_server.app)
    +    with client.websocket_connect("/api/pty?attach=TOK1&resume=old") as ws1:
    +        ws1.send_bytes(b"hi")
    +    with client.websocket_connect("/api/pty?attach=TOK1&resume=new") as ws2:
    +        ws2.send_bytes(b"again")
    +    assert pty_keepalive_harness == [["x", "old"], ["x", "new"]]
    +
    +
    [redacted:email]
    +async def test_attach_token_reuses_canonical_resume(pty_keepalive_harness):
    +    from starlette.testclient import TestClient
    +
    +    client = TestClient(web_server.app)
    +    with client.websocket_connect("/api/pty?attach=TOK1&resume=parent") as ws1:
    +        ws1.send_bytes(b"hi")
    +    with client.websocket_connect("/api/pty?attach=TOK1&resume=child") as ws2:
    +        ws2.send_bytes(b"again")
    +    assert pty_keepalive_harness == [["x", "child"]]
    +
    +
    [redacted:email]
    +async def test_attach_token_does_not_reuse_different_profile(pty_keepalive_harness):
    +    from starlette.testclient import TestClient
    +
    +    client = TestClient(web_server.app)
    +    with client.websocket_connect("/api/pty?attach=TOK1&profile=alpha") as ws1:
    +        ws1.send_bytes(b"hi")
    +    with client.websocket_connect("/api/pty?attach=TOK1&profile=beta") as ws2:
    +        ws2.send_bytes(b"again")
    +    assert len(pty_keepalive_harness) == 2
    +
    +
    [redacted:email]
    +async def test_attach_token_reuses_default_chat_after_active_session_fallback(
    +    pty_keepalive_harness, tmp_path, monkeypatch
    +):
    +    from starlette.testclient import TestClient
    +
    +    active_session_file = tmp_path / "active-session.json"
    +    monkeypatch.setattr(
    +        web_server,
    +        "_active_session_file_for_channel",
    +        lambda app, channel: active_session_file,
    +    )
    +
    +    client = TestClient(web_server.app)
    +    with client.websocket_connect("/api/pty?attach=TOK1&channel=CHAT") as ws1:
    +        ws1.send_bytes(b"hi")
    +
    +    active_session_file.write_text(json.dumps({"session_id": "existing"}))
    +
    +    with client.websocket_connect("/api/pty?attach=TOK1&channel=CHAT") as ws2:
    +        ws2.send_bytes(b"again")
    +
    +    assert pty_keepalive_harness == [["x", "fresh"]]