sync: update from private repo (ea88916)

src/bridge/server.ts

@@ -88,11 +88,12 @@ import {
 } from '../ssh/session.js';
 import { SessionRegistry } from '../ssh/console-registry.js';
 import { createSshUserRouter, createSshAdminRouter, type SshApiDeps } from './ssh-api.js';
-import { setSshSubsystem } from '../engine/tools/ssh.js';
+import { setSshSubsystem, preflight as sshPreflight, type SshSubsystem } from '../engine/tools/ssh.js';
 import { __setActiveSessionLookup } from '../engine/agent-loop.js';
 import {
   attachConsoleWs,
   createConsoleStatusRouter,
+  createConsoleSessionRouter,
   type SimpleTask,
   type SimpleUser,
 } from './console-ws-api.js';
@@ -629,7 +630,11 @@ export function createCoreServer(opts: CoreServerOptions): {
           // SshDownload tools can access the same repos / session primitives /
           // crypto wrappers that the HTTP layer uses. sessionRegistry is
           // constructed above (hoisted so sshDeps.onAccessRevoked can use it).
-          setSshSubsystem({
+          // Captured in a local const (not just passed to setSshSubsystem)
+          // so the user-initiated console-session REST endpoint can call the
+          // shared openConsoleSession core with the EXACT same `sub` the
+          // agent-facing console tools use — no second SshSubsystem.
+          const sshSubsystem: SshSubsystem = {
             connectionRepo,
             auditRepo,
             abuseRepo,
@@ -651,7 +656,8 @@ export function createCoreServer(opts: CoreServerOptions): {
             config: sshConfig,
             sessionRegistry,
             openShellChannel,
-          });
+          };
+          setSshSubsystem(sshSubsystem);
 
           // Phase 4 (SSH Console): wire the registry into agent-loop so
           // buildSystemPrompt can auto-inject the live screen tail into
@@ -751,6 +757,21 @@ export function createCoreServer(opts: CoreServerOptions): {
             }),
           );
 
+          // REST user-initiated session-open endpoint:
+          // POST /api/local/tasks/:taskId/console/session. Reuses the same
+          // SshSubsystem + preflight the console tools use; the access gate
+          // runs inside openConsoleSession against task.pieceName.
+          app.use(
+            '/api',
+            express.json(),
+            createConsoleSessionRouter({
+              sub: sshSubsystem,
+              preflight: sshPreflight,
+              requireAuth: authActive ? requireAuth : (_req: Request, _res: Response, next: NextFunction) => next(),
+              resolveTask: consoleDeps.resolveTask,
+            }),
+          );
+
           // Phase 6 (SSH Console): admin list + kill endpoints. The
           // `/api/admin` prefix already has `express.json()` mounted above
           // (see Admin user management API), so POST bodies parse correctly.