Merge remote-tracking branch 'origin/main' into hmans/plan-next-steps-v56

* origin/main:
  fix(dev): clean up archived workspace processes (#2121)
  fix(auth): preserve legacy browser login (#2120)

Author: hmans

.conductor/settings.toml

@@ -26,6 +26,7 @@ url = "https://docs.$CONDUCTOR_WORKSPACE_NAME.localhost:42444"
 
 [scripts]
 setup = "mise trust && mise install && mise setup && (cd authling && mise trust && mise install && mise deps)"
+archive = "exec tools/stop-workspace-dev.sh"
 run_mode = "concurrent"
 
 [scripts.run.dev]

cli/internal/http_server/auth.go

@@ -66,17 +66,25 @@ func isJSONAuthenticationRequest(c *gin.Context) bool {
 }
 
 // requireBrowserAuthenticationRequest blocks login CSRF before a browser route
-// can replace ambient authentication. Plain HTML forms cannot set the required
-// custom header, and cross-origin fetches cannot pass Chatto's CORS preflight.
+// can replace ambient authentication. Plain HTML forms are rejected and the
+// Origin must match the request target or configured public origin. The mode
+// header is optional for compatibility with legacy browser requests.
 func (s *HTTPServer) requireBrowserAuthenticationRequest(c *gin.Context) {
 	if !isJSONAuthenticationRequest(c) {
 		c.AbortWithStatusJSON(http.StatusUnsupportedMediaType, gin.H{"error": "Content-Type must be application/json"})
 		return
 	}
-	if !requestsCookieOnlyAuthentication(c) || !s.requestIsSameOrigin(c.Request) {
+	mode := strings.TrimSpace(c.GetHeader(connectapi.BrowserAuthenticationModeHeader))
+	if (mode != "" && !requestsCookieOnlyAuthentication(c)) || !s.requestIsSameOrigin(c.Request) {
 		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Same-origin browser authentication required"})
 		return
 	}
+	// Browser-only routes always create cookie authority. Treat an absent header
+	// as that mode after the same-origin validation above has made the request
+	// safe.
+	if mode == "" {
+		c.Request.Header.Set(connectapi.BrowserAuthenticationModeHeader, connectapi.BrowserAuthenticationModeCookie)
+	}
 }
 
 func (s *HTTPServer) authEmailServerName() string {

cli/internal/http_server/server_test.go

@@ -794,7 +794,7 @@ func TestAuthRoutes_BrowserLoginRejectsCrossSiteAndFormRequests(t *testing.T) {
 	}{
 		{name: "plain HTML form", contentType: "text/plain", origin: "https://attacker.example", wantStatus: http.StatusUnsupportedMediaType},
 		{name: "cross-origin fetch", contentType: "application/json", origin: "https://attacker.example", mode: connectapi.BrowserAuthenticationModeCookie, wantStatus: http.StatusForbidden},
-		{name: "missing browser mode", contentType: "application/json", origin: ts.URL, wantStatus: http.StatusForbidden},
+		{name: "unsupported browser mode", contentType: "application/json", origin: ts.URL, mode: "bearer", wantStatus: http.StatusForbidden},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -824,6 +824,46 @@ func TestAuthRoutes_BrowserLoginRejectsCrossSiteAndFormRequests(t *testing.T) {
 	}
 }
 
+func TestAuthRoutes_BrowserLoginAcceptsLegacySameOriginRequest(t *testing.T) {
+	ts, client, chattoCore := setupTestHTTPServer(t)
+	ctx := testContext(t)
+	if _, err := chattoCore.CreateUser(ctx, "system", "legacy-browser-login", "Legacy Browser Login", "password123"); err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	body, _ := json.Marshal(map[string]string{"login": "legacy-browser-login", "password": "password123"})
+	req, err := http.NewRequest(http.MethodPost, ts.URL+"/auth/browser/login", bytes.NewReader(body))
+	if err != nil {
+		t.Fatalf("NewRequest: %v", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Origin", ts.URL)
+
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("legacy browser login: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		responseBody, _ := io.ReadAll(resp.Body)
+		t.Fatalf("legacy browser login status = %d, want 200: %s", resp.StatusCode, responseBody)
+	}
+	var result map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		t.Fatalf("decode legacy browser login response: %v", err)
+	}
+	for _, field := range []string{"token", "refreshToken", "expiresIn", "refreshTokenExpiresIn"} {
+		if _, exists := result[field]; exists {
+			t.Fatalf("legacy browser login response contains %q", field)
+		}
+	}
+	for _, cookie := range resp.Cookies() {
+		if isBrowserSessionCookieName(cookie.Name) {
+			return
+		}
+	}
+	t.Fatal("legacy browser login did not set a browser session cookie")
+}
+
 func TestAuthRoutes_ProgrammaticLoginRejectsFormContentType(t *testing.T) {
 	ts, client, chattoCore := setupTestHTTPServer(t)
 	ctx := testContext(t)

docs/adr/ADR-078-portless-native-development-stack.md

@@ -30,6 +30,11 @@ tasks. The existing `tools/dev-supervisor.sh` process-group wrapper forwards
 Conductor lifecycle signals and reaps the complete child tree. Stopping
 `mise dev` is the single lifecycle operation for the stack.
 
+During archive, Conductor runs `tools/stop-workspace-dev.sh`. The script records
+the workspace process tree before it sends `TERM`, then sends `KILL` to any
+recorded process that remains after the grace period. This prevents stale
+workspace ports when normal shutdown cannot complete.
+
 Portless replaces Pitchfork only as the HTTPS routing layer. Each
 browser-facing task runs its process through the mise-pinned Portless CLI. The
 tasks use Portless's direct named mode to expose Chatto, Authling,
@@ -78,8 +83,9 @@ artifacts while removing Pitchfork.
 
 - A failure in a persistent development-daemon supervisor can no longer block
   every worktree because no such supervisor owns the application processes.
-- `mise dev` and its process tree are the single lifecycle boundary; no archive
-  cleanup task or persistent route registry mutation is required.
+- `mise dev` and its process tree are the normal lifecycle boundary. Archive
+  cleanup is required to remove a tree that does not stop normally. No
+  persistent route registry mutation is required.
 - Concurrent workspaces keep separate listener ports, state, HTTPS origins,
   and Portless child registrations while sharing Portless's lightweight HTTPS
   proxy.

docs/architecture/interfaces.md

@@ -29,7 +29,7 @@ Related decisions: [ADR-044](../adr/ADR-044-connectrpc-service-conventions.md),
 | Surface | Mount | Contract | Access boundary |
 | ------- | ----- | -------- | --------------- |
 | Public ConnectRPC | `/api/connect/chatto.{auth,discovery,api,admin}.v1.*` | Unary Connect, gRPC, and gRPC-Web services | Explicit per-service public or authenticated-user policy; method-level authorization remains inside operation models |
-| Browser authentication | `GET /auth/browser/csrf`, `POST /auth/browser/login`, `POST /auth/browser/register/complete`, `POST /auth/browser/logout`, `POST /auth/browser/session/migrate`, `POST /auth/browser/session/renew`, `POST /auth/browser/revoke-bearer-session` | Bound CSRF-proof repair, cookie-only password/registration authentication, one-time 0.4 typed-cookie migration, logout, stable-handle session renewal, and removal of stored origin bearer authority | Every mutation requires JSON, the browser-auth mode header, and an exact same-origin request. Renewal and logout also require signed double-submit CSRF proof while a valid cookie authority exists. Migration uses the independent browser-route proof because it runs before a current cookie session exists. Logout can clear invalid session cookies with the same proof. The safe CSRF route requires a valid cookie session. These routes do not return bearer credentials. |
+| Browser authentication | `GET /auth/browser/csrf`, `POST /auth/browser/login`, `POST /auth/browser/register/complete`, `POST /auth/browser/logout`, `POST /auth/browser/session/migrate`, `POST /auth/browser/session/renew`, `POST /auth/browser/revoke-bearer-session` | Bound CSRF-proof repair, cookie-only password/registration authentication, one-time 0.4 typed-cookie migration, logout, stable-handle session renewal, and removal of stored origin bearer authority | Every mutation requires JSON and an exact same-origin request. A browser-auth mode header, if present, must select cookies. Browser routes treat an absent header as cookie mode. Renewal and logout also require signed double-submit CSRF proof while a valid cookie authority exists. Migration uses the independent browser-route proof because it runs before a current cookie session exists. Logout can clear invalid session cookies with the same proof. The safe CSRF route requires a valid cookie session. These routes do not return bearer credentials. |
 | Programmatic authentication | `POST /auth/login`, `POST /auth/register/complete`, `POST /auth/logout`, `POST /oauth/token` | First-party bearer issuance, stable bearer-session revocation, and OAuth code/refresh exchange | JSON is required for direct login and registration. These routes do not create, read, or clear ambient browser authentication cookies. OAuth token exchange also accepts the documented form encoding. |
 | Realtime WebSocket | `GET /api/realtime` | Binary `chatto.realtime.v1.Realtime*` frames | Bearer access token in the hello frame or same-origin cookie; exact human credentials are revalidated before subscription and once per minute; bearer expiry and cookie renewal thresholds request reconnects, while OAuth-client blocks terminate matching established sessions |
 | Server OIDC client metadata | `GET /oauth/client-metadata.json` | CIMD public-client identity and exact callbacks for Chatto server login | Public; mounted only when an OIDC provider uses this deployment's metadata URL as its client ID |

docs/fdr/FDR-023-authentication-and-sessions.md

@@ -29,7 +29,7 @@ providers, and a bootstrap path for first-boot operator setup.
 - **Chatto OAuth authorization** — cross-origin Chatto clients use `/oauth/authorize` with a stable `client_id` and PKCE to obtain a short-lived authorization code, then exchange it with that same client ID at `/oauth/token` for an opaque delegated access token plus a rotating refresh credential. The bundled multi-server client opens the remote server's authorization UI in a separate browser or Electron window, so passwords, passkeys, and external-provider sign-in remain visibly hosted by that server while the main client stays mounted. The callback returns only the authorization result to the main client, which performs the code exchange and stores the credential pair and expiries. Browser clients identify themselves through their published frontend CIMD document; Chatto validates the requested callback exactly against it. Desktop uses its fixed built-in client and callback. The first authorization shows a user consent screen and remembers approval per user + client ID. OAuth access tokens can authenticate ordinary API and realtime requests, but cannot satisfy or acquire fresh-auth status for account-security operations.
 - **Cross-origin transport** — Chatto permits browser HTTP and realtime transport from any syntactically valid origin without enabling credentialed CORS. Requests carrying an `Origin` that matches neither the direct request target nor the configured public origin never authenticate through ambient session cookies and must present a bearer token. Checking the direct target keeps direct hostname aliases usable; the configured origin covers TLS-terminating proxies without trusting forwarded headers. The `allowed_origins` and `oauth_redirect_origins` settings and origin-only OAuth flow were removed for 0.5; compatibility with pre-0.5 clients is not required.
 - **Cookie session** — on successful same-origin authentication, the server issues the opaque handle in an HttpOnly, SameSite=Lax `chatto_auth_<slot>` cookie with a 90-day default expiry. SCS manages the session lifecycle through a Chatto JetStream store adapter. The authoritative `RUNTIME_STATE` `session.{hmac}` record contains the user ID, kind `first_party_session`, presentation `cookie`, source/request metadata, auth generation, fresh-auth metadata, and explicit expiry. Each changed revision has a per-message TTL equal to its remaining explicit lifetime. Validation checks the explicit expiry and resolves the current user from projections without rewriting the record or browser cookie. In the final quarter, the bundled frontend calls the protected browser renewal route. The core advances the same record's expiry with revision-checked optimistic concurrency, and the route writes the same opaque handle in a fresh cookie slot with the new lifetime. A late response can add an older slot, but it cannot overwrite a newer session. Chatto examines at most four distinct handles, deduplicates one handle across concurrent response slots, selects the newest valid session, ignores invalid or revoked handles, and removes obsolete slots during the next authentication change. A server-provided renewal time drives an HTTP timer, and the realtime close signal provides a second trigger. Public discovery, ordinary API responses, frontend responses, immutable assets, and WebSocket upgrades do not carry authentication `Set-Cookie` headers. The separate encrypted `chatto_session` cookie normally holds only short-lived provider, invitation, and OAuth browser-flow state. During the 0.5 upgrade, the bundled frontend can use a same-origin migration route to read the immediately previous typed `runtime_credential_id` field once. The route adds explicit expiry and physical TTL to the existing record with optimistic concurrency, writes the same handle to a new SCS cookie slot, and removes the retired field. Ordinary authentication does not read the field, and the older `user_id` plus `cookie_session_id` shape remains unsupported. Remove this bridge in 0.6. The bundled SPA also revokes old stored origin bearer authority before it removes those credentials. A separately hosted client uses the OAuth flow instead of direct authentication.
-- **CSRF protection** — cookie-authenticated unsafe routes require an `X-CSRF-Token` header matching the readable `chatto_csrf` cookie, and that cookie value must be a server-signed token bound to the authenticated user session generation. Dedicated browser login, registration, migration, renewal, bearer cleanup, and logout routes also require JSON, an exact same-origin request, and `X-Chatto-Authentication-Mode: cookie`. Plain HTML forms cannot set this header. Login, registration, migration, and bearer cleanup use the origin and custom-header proof before a session exists. Renewal and logout require the signed CSRF proof while a valid cookie session exists. If every presented session is already invalid, logout uses the independent browser-route proof and clears the stale cookies. If the readable CSRF cookie expires during a longer active session, the frontend gets a new bound proof from an authenticated safe endpoint and retries the failed request once. Test endpoints, webhooks, OAuth token exchange, and ConnectRPC programmatic API traffic are exempt. Bearer-only requests are exempt because bearer credentials are not ambient browser cookies.
+- **CSRF protection** — cookie-authenticated unsafe routes require an `X-CSRF-Token` header matching the readable `chatto_csrf` cookie, and that cookie value must be a server-signed token bound to the authenticated user session generation. Dedicated browser login, registration, migration, renewal, bearer cleanup, and logout routes also require JSON and an exact same-origin request. A browser-auth mode header, if present, must select cookies. Browser routes treat an absent header as cookie mode. Plain HTML forms cannot make these requests. Login, registration, migration, and bearer cleanup use the origin proof before a session exists. Renewal and logout require the signed CSRF proof while a valid cookie session exists. If every presented session is already invalid, logout uses the independent browser-route proof and clears the stale cookies. If the readable CSRF cookie expires during a longer active session, the frontend gets a new bound proof from an authenticated safe endpoint and retries the failed request once. Test endpoints, webhooks, OAuth token exchange, and ConnectRPC programmatic API traffic are exempt. Bearer-only requests are exempt because bearer credentials are not ambient browser cookies.
 - **Bearer session** — direct password/registration flows and explicit external-identity account creation issue a renewable first-party bearer session by default for programmatic clients. These routes do not create or change browser authentication cookies. The bundled browser uses the dedicated cookie-only routes, which do not create or return bearer credentials. Cross-origin clients receive the delegated form through Chatto OAuth PKCE; matched external-provider browser login remains cookie-only and never places bearer credentials in its redirect URL. Each bearer session has a short-lived opaque `cht_AT…` access token, a rotating refresh credential, and a renewable session window. Remote registered clients store the pair in device-local browser storage and send only the access token as `Authorization: Bearer …` and in realtime hello frames. Normal refresh-credential use is rotation at `/oauth/token`; the bundled client also presents it to `/auth/logout` so logout can revoke the stable session. `RUNTIME_STATE` holds an immutable fixed-expiry `session.{hmac}` access record plus a mutable `renewable_session.{hmac}` authority. Each authority revision has a per-message TTL equal to its remaining explicit lifetime. The server stores neither raw credential nor the raw refresh-recovery nonce. Delegated records use kind `oauth_access_token` and remain bound to their client ID.
 - **WebSocket auth** — bearer-token clients pass the access token in the realtime hello frame, where it is checked before subscription. Cookie authentication is accepted only for same-origin browser connections or non-browser requests without an `Origin` header. The server revalidates the exact human credential before subscription and once per minute. A bearer socket ends at access-token expiry with a reconnecting `authentication_required` close; the bundled client rotates once and reconnects the same event bus with its in-memory projection resume cursor. A cookie socket ends at the start of the final renewal quarter with a reconnecting `session_renewal_required` close. The bundled frontend calls the browser renewal route and then opens the replacement socket without user action.
 - **API auth failures** — protected ConnectRPC methods return unauthenticated errors for missing or invalid credentials. The bundled multi-server client prefers structured error codes and keeps stable message fallbacks for compatibility with older servers.