fix(gateway): deny session-scoped clients the broad sessions.subscribe

anagnorisis2peripeteia · anagnorisis2peripeteia · commit c2b8ccdc2fd9 · 2026-07-17T22:24:13.000+01:00
A browser-copilot / SESSION_SCOPED_EVENTS connection could call the legacy broad
sessions.subscribe and join the flat sessionEventSubscribers set, which
server-session-events unions into session.message / sessions.changed recipients.
Those events are not in SESSION_SUBSCRIPTION_EVENTS, so they skip the per-tab
opt-out filter, delivering every session's live transcript to a connection the
per-tab model documents as isolated. Deny the broad path for session-scoped
clients; they subscribe per session via sessions.messages.subscribe.

Adds a regression test: browser-copilot broad sessions.subscribe is rejected and
a foreign session's transcript is not delivered.
diff --git a/src/gateway/server-methods/sessions-subscriptions.ts b/src/gateway/server-methods/sessions-subscriptions.ts
@@ -1,4 +1,8 @@
 // Session and transcript event subscription handlers.
+import {
+  GATEWAY_CLIENT_CAPS,
+  hasGatewayClientCap,
+} from "../../../packages/gateway-protocol/src/client-info.js";
 import {
   ErrorCodes,
   errorShape,
@@ -7,6 +11,7 @@ import {
 } from "../../../packages/gateway-protocol/src/index.js";
 import { resolveDefaultAgentId } from "../../agents/agent-scope.js";
 import { normalizeAgentId } from "../../routing/session-key.js";
+import { isBrowserCopilotClient } from "../../utils/message-channel.js";
 import { canReviewOperatorApproval } from "../operator-approval-authorization.js";
 import { APPROVALS_SCOPE } from "../operator-scopes.js";
 import { resolveRequestedSessionAgentId as resolveRequestedGlobalAgentId } from "../session-create-service.js";
@@ -33,6 +38,25 @@ function resolveSessionMessageSubscriptionKey(params: {
 
 export const sessionSubscriptionHandlers: GatewayRequestHandlers = {
   "sessions.subscribe": ({ client, context, respond }) => {
+    // Session-scoped clients (browser copilot / SESSION_SCOPED_EVENTS) must not join the broad
+    // sessions.changed/session.message fanout. The per-tab isolation invariant in
+    // server-broadcast.ts (SESSION_SUBSCRIPTION_EVENTS) is enforced only on the per-session
+    // subscription path; a scoped connection on the broad registry would receive every session's
+    // live transcript. Such clients subscribe per session via sessions.messages.subscribe.
+    if (
+      isBrowserCopilotClient(client?.connect?.client) ||
+      hasGatewayClientCap(client?.connect?.caps, GATEWAY_CLIENT_CAPS.SESSION_SCOPED_EVENTS)
+    ) {
+      respond(
+        false,
+        undefined,
+        errorShape(
+          ErrorCodes.INVALID_REQUEST,
+          "session-scoped clients must subscribe per session via sessions.messages.subscribe",
+        ),
+      );
+      return;
+    }
     const connId = client?.connId?.trim();
     if (connId) {
       context.subscribeSessionEvents(connId);
diff --git a/src/gateway/session-message-events.test.ts b/src/gateway/session-message-events.test.ts
@@ -305,6 +305,81 @@ describe("session.message websocket events", () => {
     }
   });
 
+  test("denies browser-copilot the broad sessions.subscribe and blocks foreign session transcript delivery", async () => {
+    const storePath = await createSessionStoreFile();
+    await writeSessionStore({
+      entries: {
+        main: { sessionId: "sess-main", updatedAt: Date.now() },
+        other: { sessionId: "sess-other", updatedAt: Date.now() },
+      },
+      storePath,
+    });
+    const copilotOrigin = "chrome-extension://abcdefghijklmnopabcdefghijklmnop";
+    const copilotClient = {
+      id: GATEWAY_CLIENT_IDS.BROWSER_COPILOT,
+      version: "test",
+      platform: "chrome",
+      deviceFamily: "extension",
+      mode: GATEWAY_CLIENT_MODES.UI,
+    };
+    const copilotIdentityPath = path.join(path.dirname(storePath), "copilot-repro-device.json");
+    const scopedCaps = [GATEWAY_CLIENT_CAPS.SESSION_SCOPED_EVENTS];
+    const pairingWs = await harness.openWs({ origin: copilotOrigin });
+    const copilotWs = await harness.openWs({ origin: copilotOrigin });
+    try {
+      const pairedHello = await connectOk(pairingWs, {
+        scopes: ["operator.read", "operator.write"],
+        caps: [...scopedCaps, GATEWAY_CLIENT_CAPS.RUN_TOOL_BINDINGS],
+        client: copilotClient,
+        deviceIdentityPath: copilotIdentityPath,
+        prePairDevice: true,
+        browserOrigin: copilotOrigin,
+      });
+      const deviceToken = (pairedHello as { auth?: { deviceToken?: string } }).auth?.deviceToken;
+      expect(deviceToken).toBeTruthy();
+      pairingWs.close();
+
+      // The NEW "session-scoped / per-tab" principal connects (dedicated paired identity+origin).
+      await connectOk(copilotWs, {
+        scopes: ["operator.read", "operator.write"],
+        caps: [...scopedCaps, GATEWAY_CLIENT_CAPS.RUN_TOOL_BINDINGS],
+        client: copilotClient,
+        deviceIdentityPath: copilotIdentityPath,
+        deviceToken,
+        skipDefaultAuth: true,
+      });
+
+      // The legacy broad sessions.subscribe must be rejected for a session-scoped principal so it
+      // cannot join the unscoped fanout that carries session.message/sessions.changed.
+      const broad = await rpcReq(copilotWs, "sessions.subscribe");
+      expect(broad.ok).toBe(false);
+      expect(broad.error?.message ?? "").toContain("sessions.messages.subscribe");
+
+      // A DIFFERENT session's live transcript must NOT reach this connection.
+      const foreignDelivery = onceMessage(
+        copilotWs,
+        (message) =>
+          message.type === "event" &&
+          message.event === "session.message" &&
+          (message.payload as { sessionKey?: string } | undefined)?.sessionKey === "agent:main:other",
+        1500,
+      ).then(
+        () => true,
+        () => false,
+      );
+      const appended = await appendAssistantMessageToSessionTranscript({
+        sessionKey: "agent:main:other",
+        text: "SECRET transcript that belongs to a different tab/session",
+        storePath,
+      });
+      expect(appended.ok).toBe(true);
+      await expect(foreignDelivery).resolves.toBe(false);
+    } finally {
+      pairingWs.close();
+      copilotWs.close();
+    }
+  });
+
   test("rejects client identity changes across a dedicated copilot pairing", async () => {
     const storePath = await createSessionStoreFile();
     const copilotOrigin = "chrome-extension://abcdefghijklmnopabcdefghijklmnop";
