sync: update from private repo (a360d15)

src/bridge/server.ts

@@ -585,6 +585,7 @@ export function createCoreServer(opts: CoreServerOptions): {
 
           const sshDeps: SshApiDeps = {
             db: repo.getDb(),
+            authActive,
             requireAuth: authActive ? requireAuth : (_req, _res, next) => next(),
             requireAdmin: authActive ? requireAdmin : (_req, _res, next) => next(),
             getUserId: (req) => (req.user as { id?: string } | undefined)?.id ?? null,
@@ -712,9 +713,11 @@ export function createCoreServer(opts: CoreServerOptions): {
             registry: sessionRegistry,
             resolveUserFromUpgrade: async (req) => {
               if (!authenticateUpgrade) {
-                // Auth disabled: no user available — reject WS attaches.
-                // (In auth-off mode the WS layer simply isn't usable.)
-                return null;
+                // No-auth single-user mode: synthesize a stable `local` admin
+                // user so the Console terminal WS attaches (admin role makes
+                // the null-owner no-auth task visible in resolveTask). Mirrors
+                // the Console REST routers and notifications-api.
+                return { id: 'local', role: 'admin' };
               }
               const u = await authenticateUpgrade(req);
               return u ? { id: u.id, role: u.role } : null;
@@ -778,6 +781,7 @@ export function createCoreServer(opts: CoreServerOptions): {
             '/api',
             createConsoleStatusRouter({
               registry: sessionRegistry,
+              authActive,
               requireAuth: authActive ? requireAuth : (_req: Request, _res: Response, next: NextFunction) => next(),
               resolveTask: consoleDeps.resolveTask,
             }),
@@ -793,6 +797,7 @@ export function createCoreServer(opts: CoreServerOptions): {
             createConsoleSessionRouter({
               sub: sshSubsystem,
               preflight: sshPreflight,
+              authActive,
               requireAuth: authActive ? requireAuth : (_req: Request, _res: Response, next: NextFunction) => next(),
               resolveTask: consoleDeps.resolveTask,
             }),
@@ -822,6 +827,7 @@ export function createCoreServer(opts: CoreServerOptions): {
   mountLocalTasksApi(app, {
     repo,
     worktreeDir,
+    authActive,
     generateTitle: opts.generateTitle,
     selectPiece: opts.selectPiece,
     pieceExists: opts.piecesDir
@@ -936,7 +942,7 @@ export function createCoreServer(opts: CoreServerOptions): {
 
   if (opts.scheduler) {
     app.use('/api/scheduled-tasks', express.json());
-    mountScheduledTasksApi(app, repo, opts.scheduler, { sessRepo });
+    mountScheduledTasksApi(app, repo, opts.scheduler, { sessRepo, authActive });
   }
 
   // Browser session API