[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_193":194,"_195":196},"routes/_app.x.$handle.$name",{"_97":96,"_31":43,"_106":87,"_26":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":24,"_121":122,"_123":124,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":24,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",15,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","work_auth_canary_v2.ts","latestPath","fileId","01a08293-f597-737f-affb-0db812c24a0f","name","fileType","http","content","import {\n createMcpHandler,\n McpServer,\n} from \"npm:@modelcontextprotocol/server@2\";\nimport * as z from \"npm:zod@4/v4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { verify as verifyWebBot } from \"npm:web-bot-auth@0.2.0\";\nimport { verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst PROJECT = \"mosadek/project-brain-live-v1-durable\";\nconst SCHEMA = \"EW_CHATGPT_SESSION_ATTESTATION_PROBE_V1\";\nconst CHALLENGE_TTL_MS = 120_000;\nconst META_MAX = 1024;\nconst enc = new TextEncoder();\n\nasync function sha256(s: string) {\n const d = await crypto.subtle.digest(\"SHA-256\", enc.encode(s));\n return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction b64url(bytes: Uint8Array) {\n let s = \"\";\n for (const b of bytes) s += String.fromCharCode(b);\n return btoa(s).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\nfunction safeMetaString(v: unknown): string | null {\n if (typeof v !== \"string\" || v.length < 1 || v.length > META_MAX) return null;\n if (/[\\u0000-\\u001f\\u007f]/.test(v)) return null;\n return v;\n}\n\nasync function ensureTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ew_session_attestation_probe_v1(\n challenge_hash TEXT PRIMARY KEY,\n issued_at_ms INTEGER NOT NULL,\n expires_at_ms INTEGER NOT NULL,\n consumed_at_ms INTEGER,\n session_hash TEXT,\n subject_hash TEXT,\n organization_hash TEXT,\n classification TEXT,\n receipt_json TEXT\n )`);\n}\n\nfunction result(obj: unknown, isError = false) {\n return {\n isError,\n content: [{ type: \"text\" as const, text: JSON.stringify(obj) }],\n };\n}\n\n\nconst WORK_AUTH_SCHEMA = \"PROJECT_BRAIN_CHATGPT_WORK_WEBBOT_AUTH_CANARY_V1\";\nconst OPENAI_SIGNATURE_AGENT = \"https://chatgpt.com\";\nconst OPENAI_SIGNATURE_DIRECTORY =\n \"https://chatgpt.com/.well-known/http-message-signatures-directory\";\nconst WORK_CHALLENGE_TTL_MS = 120_000;\n\nfunction jsonResponse(obj: unknown, status = 200, headers: Record = {}) {\n return new Response(JSON.stringify(obj, null, 2), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\", ...headers },\n });\n}\n\nasync function ensureWorkAuthTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS pb_work_webbot_auth_canary_v1(\n challenge_hash TEXT PRIMARY KEY,\n issued_at_ms INTEGER NOT NULL,\n expires_at_ms INTEGER NOT NULL,\n consumed_at_ms INTEGER,\n signature_hash TEXT UNIQUE,\n keyid TEXT,\n receipt_json TEXT\n )`);\n}\n\nasync function resolveOpenAIVerifier(profile: any) {\n if (\n profile?.signatureAgent?.uri !== OPENAI_SIGNATURE_AGENT ||\n profile?.signatureAgent?.type !== \"directory\" ||\n profile?.algorithm !== \"ed25519\"\n ) {\n throw new Error(\"REJECT_SIGNATURE_AGENT_PROFILE\");\n }\n\n const r = await fetch(OPENAI_SIGNATURE_DIRECTORY, {\n headers: { accept: \"application/http-message-signatures-directory+json\" },\n signal: AbortSignal.timeout(10_000),\n });\n if (!r.ok) throw new Error(\"REJECT_OPENAI_KEY_DIRECTORY_UNAVAILABLE\");\n\n const directory: any = await r.json();\n if (\n directory?.signature_agent !== OPENAI_SIGNATURE_AGENT ||\n directory?.purpose !== \"ai\" ||\n !Array.isArray(directory?.keys)\n ) {\n throw new Error(\"REJECT_OPENAI_KEY_DIRECTORY_SCHEMA\");\n }\n\n const nowSec = Math.floor(Date.now() / 1000);\n for (const key of directory.keys) {\n if (\n key?.kty !== \"OKP\" ||\n key?.crv !== \"Ed25519\" ||\n key?.use !== \"sig\" ||\n (typeof key?.nbf === \"number\" && key.nbf > nowSec) ||\n (typeof key?.exp === \"number\" && key.exp < nowSec)\n ) continue;\n\n const verifier = await verifierFromJWK(key);\n if (verifier.keyid === profile.keyid) return verifier;\n }\n throw new Error(\"REJECT_OPENAI_KEYID_NOT_CURRENT\");\n}\n\nasync function verifyChatGPTWorkRequest(req: Request) {\n const signature = req.headers.get(\"signature\");\n const signatureInput = req.headers.get(\"signature-input\");\n const signatureAgent = req.headers.get(\"signature-agent\");\n if (!signature || !signatureInput || !signatureAgent) {\n throw new Error(\"REJECT_MISSING_WEB_BOT_AUTH_HEADERS\");\n }\n\n const signatureHash = await sha256(\n `${WORK_AUTH_SCHEMA}\\0signature\\0${signature}\\0${signatureInput}\\0${signatureAgent}`,\n );\n\n const verified: any = await verifyWebBot(req, {\n maxAge: 180,\n clockSkew: 30,\n resolver: resolveOpenAIVerifier,\n validate: async (v: any) => {\n const names = new Set((v?.components ?? []).map((x: any) => x?.name));\n return (\n v?.signatureAgent?.uri === OPENAI_SIGNATURE_AGENT &&\n v?.signatureAgent?.type === \"directory\" &&\n v?.algorithm === \"ed25519\" &&\n names.has(\"@authority\") &&\n names.has(\"signature-agent\")\n );\n },\n });\n\n const componentNames = (verified?.components ?? []).map((x: any) => x?.name);\n return {\n verified,\n signatureHash,\n componentNames,\n challengeCryptographicallyBound:\n componentNames.includes(\"@query\") ||\n componentNames.includes(\"@query-param\") ||\n componentNames.includes(\"@path\") ||\n componentNames.includes(\"@request-target\") ||\n componentNames.includes(\"@target-uri\"),\n };\n}\n\nasync function issueWorkAuthChallenge(req: Request) {\n await ensureWorkAuthTable();\n const raw = new Uint8Array(32);\n crypto.getRandomValues(raw);\n const challenge = b64url(raw);\n const challengeHash = await sha256(\n `${WORK_AUTH_SCHEMA}\\0challenge\\0${PROJECT}\\0${challenge}`,\n );\n const issuedAt = Date.now();\n const expiresAt = issuedAt + WORK_CHALLENGE_TTL_MS;\n await sqlite.execute({\n sql: `INSERT INTO pb_work_webbot_auth_canary_v1\n (challenge_hash,issued_at_ms,expires_at_ms)\n VALUES(?,?,?)`,\n args: [challengeHash, issuedAt, expiresAt],\n });\n\n const attest = new URL(\"/work-auth-canary/v1/attest\", req.url);\n attest.searchParams.set(\"challenge\", challenge);\n const body = `\n Project Brain Work Auth Canary\n

Project Brain Work Auth Canary

This is candidate-only and grants no Brain authority.

Continue authenticated canary

${JSON.stringify({\n    schema: WORK_AUTH_SCHEMA,\n    challenge_sha256: challengeHash,\n    expires_at_ms: expiresAt,\n    authority: \"CANDIDATE_NONAUTHORITY\",\n    p_real_increment: 0,\n  }, null, 2)}

`;\n return new Response(body, {\n status: 200,\n headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}\n\nasync function attestWorkAuth(req: Request) {\n await ensureWorkAuthTable();\n const u = new URL(req.url);\n const challenge = u.searchParams.get(\"challenge\") ?? \"\";\n if (!/^[A-Za-z0-9_-]{40,128}$/.test(challenge)) {\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification: \"REJECT_MALFORMED_CHALLENGE\",\n production_admission: false,\n p_real_increment: 0,\n }, 400);\n }\n\n let auth: any;\n try {\n auth = await verifyChatGPTWorkRequest(req);\n } catch (e) {\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification: \"REJECT_WEB_BOT_AUTH\",\n reason: e instanceof Error ? e.message : String(e),\n production_admission: false,\n p_real_increment: 0,\n }, 401);\n }\n\n const challengeHash = await sha256(\n `${WORK_AUTH_SCHEMA}\\0challenge\\0${PROJECT}\\0${challenge}`,\n );\n const now = Date.now();\n\n let update: any;\n try {\n update = await sqlite.execute({\n sql: `UPDATE pb_work_webbot_auth_canary_v1\n SET consumed_at_ms=?,signature_hash=?,keyid=?\n WHERE challenge_hash=?\n AND consumed_at_ms IS NULL\n AND issued_at_ms<=?\n AND expires_at_ms>=?\n RETURNING issued_at_ms,expires_at_ms,consumed_at_ms`,\n args: [\n now,\n auth.signatureHash,\n auth.verified.keyid,\n challengeHash,\n now,\n now,\n ],\n });\n } catch (e) {\n const msg = e instanceof Error ? e.message : String(e);\n const replay = /UNIQUE|signature_hash/i.test(msg);\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification: replay ? \"REJECT_SIGNATURE_REPLAY\" : \"REJECT_CANARY_STATE_ERROR\",\n production_admission: false,\n p_real_increment: 0,\n }, replay ? 409 : 500);\n }\n\n if ((update?.rows ?? []).length !== 1) {\n const q: any = await sqlite.execute({\n sql: `SELECT issued_at_ms,expires_at_ms,consumed_at_ms\n FROM pb_work_webbot_auth_canary_v1 WHERE challenge_hash=?`,\n args: [challengeHash],\n });\n const row = q?.rows?.[0] ?? null;\n const classification = !row\n ? \"REJECT_UNKNOWN_CHALLENGE\"\n : row.consumed_at_ms != null\n ? \"REJECT_CHALLENGE_REPLAY\"\n : Number(row.expires_at_ms) < now\n ? \"REJECT_EXPIRED_CHALLENGE\"\n : Number(row.issued_at_ms) > now\n ? \"REJECT_FUTURE_CHALLENGE\"\n : \"REJECT_CHALLENGE_STATE_AMBIGUOUS\";\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification,\n production_admission: false,\n p_real_increment: 0,\n }, 409);\n }\n\n const receipt = {\n schema: WORK_AUTH_SCHEMA,\n ok: true,\n classification: \"AUTHENTICATED_CHATGPT_WORK_INGRESS_CANDIDATE\",\n project: PROJECT,\n observed_at_ms: now,\n challenge_sha256: challengeHash,\n signature_sha256: auth.signatureHash,\n signature_agent: OPENAI_SIGNATURE_AGENT,\n keyid: auth.verified.keyid,\n algorithm: auth.verified.algorithm,\n signed_created: auth.verified.created?.toISOString?.() ?? null,\n signed_expires: auth.verified.expires?.toISOString?.() ?? null,\n signed_components: auth.componentNames,\n host_path_authenticated: true,\n one_time_challenge_consumed: true,\n challenge_cryptographically_bound_in_http_signature: auth.challengeCryptographicallyBound,\n raw_signature_persisted: false,\n raw_challenge_persisted: false,\n execution_provenance_scope: \"CHATGPT_WORK_BROWSER_ORIGIN_LIVENESS_ONLY\",\n distinct_physical_chatgpt_execution_proven: false,\n independent_review_eligible: false,\n production_admission: false,\n authority_promotion: false,\n p_real_increment: 0,\n human_authority_approval: false,\n direct_sprites_calls: 0,\n };\n\n await sqlite.execute({\n sql: `UPDATE pb_work_webbot_auth_canary_v1\n SET receipt_json=? WHERE challenge_hash=? AND signature_hash=?`,\n args: [JSON.stringify(receipt), challengeHash, auth.signatureHash],\n });\n\n return jsonResponse(receipt, 200);\n}\n\nconst handler = createMcpHandler(() => {\n const server = new McpServer({\n name: \"ew-session-attestation-probe\",\n version: \"1.0.0-candidate\",\n });\n\n server.registerTool(\"issue-session-attestation-challenge\", {\n description:\n \"Candidate-only: issue a fresh one-time challenge for testing ChatGPT session metadata. Does not grant authority.\",\n inputSchema: z.object({}),\n annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },\n }, async () => {\n await ensureTable();\n const raw = new Uint8Array(32);\n crypto.getRandomValues(raw);\n const challenge = b64url(raw);\n const challengeHash = await sha256(`${SCHEMA}\\0challenge\\0${PROJECT}\\0${challenge}`);\n const issued = Date.now();\n const expires = issued + CHALLENGE_TTL_MS;\n await sqlite.execute({\n sql: `INSERT INTO ew_session_attestation_probe_v1\n (challenge_hash,issued_at_ms,expires_at_ms,classification)\n VALUES(?,?,?,?)`,\n args: [challengeHash, issued, expires, \"ISSUED_CANDIDATE_NONAUTHORITY\"],\n });\n return result({\n schema: SCHEMA,\n project: PROJECT,\n challenge,\n challenge_sha256: challengeHash,\n issued_at_ms: issued,\n expires_at_ms: expires,\n one_time: true,\n authority: \"CANDIDATE_NONAUTHORITY\",\n physical_execution_provenance: false,\n });\n });\n\n server.registerTool(\"attest-current-chatgpt-session\", {\n description:\n \"Candidate-only: consume a fresh challenge and hash host-provided openai/session + openai/subject request metadata server-side. Raw metadata is never returned. Metadata observation alone is NOT authenticated ChatGPT-host proof.\",\n inputSchema: z.object({\n challenge: z.string().min(40).max(128).regex(/^[A-Za-z0-9_-]+$/),\n }),\n annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },\n }, async ({ challenge }, extra: any) => {\n await ensureTable();\n const meta = extra?.mcpReq?._meta ?? extra?._meta ?? null;\n const session = safeMetaString(meta?.[\"openai/session\"]);\n const subject = safeMetaString(meta?.[\"openai/subject\"]);\n const organization = safeMetaString(meta?.[\"openai/organization\"]);\n\n if (!session || !subject) {\n return result({\n schema: SCHEMA,\n ok: false,\n classification: \"REJECT_MISSING_OR_MALFORMED_REQUIRED_HOST_METADATA\",\n observed_openai_session: !!session,\n observed_openai_subject: !!subject,\n raw_metadata_returned: false,\n physical_execution_provenance: false,\n promotion_safe: false,\n }, true);\n }\n\n const challengeHash = await sha256(`${SCHEMA}\\0challenge\\0${PROJECT}\\0${challenge}`);\n const now = Date.now();\n const sessionHash = await sha256(`${SCHEMA}\\0session\\0${PROJECT}\\0${session}`);\n const subjectHash = await sha256(`${SCHEMA}\\0subject\\0${PROJECT}\\0${subject}`);\n const organizationHash = organization\n ? await sha256(`${SCHEMA}\\0organization\\0${PROJECT}\\0${organization}`)\n : null;\n\n const receipt = {\n schema: SCHEMA,\n project: PROJECT,\n challenge_sha256: challengeHash,\n session_sha256: sessionHash,\n subject_sha256: subjectHash,\n organization_sha256: organizationHash,\n observed_from_request_meta: true,\n raw_metadata_returned: false,\n host_path_authenticated: false,\n generic_mcp_client_can_supply_meta: true,\n classification: \"HOST_METADATA_OBSERVED_NOT_AUTHENTICATED_HOST_PROOF\",\n physical_execution_provenance: false,\n promotion_safe: false,\n note:\n \"Different session hashes can be useful experimental evidence only after the caller path is independently proven to be ChatGPT-host-controlled and non-spoofable. This candidate does not make that claim.\",\n };\n const receiptJson = JSON.stringify(receipt);\n\n const u: any = await sqlite.execute({\n sql: `UPDATE ew_session_attestation_probe_v1\n SET consumed_at_ms=?,session_hash=?,subject_hash=?,organization_hash=?,\n classification=?,receipt_json=?\n WHERE challenge_hash=?\n AND consumed_at_ms IS NULL\n AND issued_at_ms<=?\n AND expires_at_ms>=?\n RETURNING issued_at_ms,expires_at_ms,consumed_at_ms`,\n args: [\n now, sessionHash, subjectHash, organizationHash,\n receipt.classification, receiptJson, challengeHash, now, now,\n ],\n });\n\n if ((u.rows ?? []).length !== 1) {\n const q: any = await sqlite.execute({\n sql: `SELECT issued_at_ms,expires_at_ms,consumed_at_ms\n FROM ew_session_attestation_probe_v1 WHERE challenge_hash=?`,\n args: [challengeHash],\n });\n const row = q.rows?.[0] ?? null;\n const classification = !row\n ? \"REJECT_UNKNOWN_CHALLENGE\"\n : row.consumed_at_ms != null\n ? \"REJECT_REPLAY_ALREADY_CONSUMED\"\n : Number(row.expires_at_ms) < now\n ? \"REJECT_EXPIRED_CHALLENGE\"\n : Number(row.issued_at_ms) > now\n ? \"REJECT_FUTURE_CHALLENGE\"\n : \"REJECT_CHALLENGE_STATE_AMBIGUOUS\";\n return result({\n schema: SCHEMA,\n ok: false,\n classification,\n challenge_sha256: challengeHash,\n raw_metadata_returned: false,\n physical_execution_provenance: false,\n promotion_safe: false,\n }, true);\n }\n\n return result({ ok: true, ...receipt });\n });\n\n return server;\n});\n\nexport default async function fetch(req: Request) {\n const u = new URL(req.url);\n if (req.method === \"GET\" && u.pathname === \"/work-auth-canary/v1/challenge\") {\n return await issueWorkAuthChallenge(req);\n }\n if (req.method === \"GET\" && u.pathname === \"/work-auth-canary/v1/attest\") {\n return await attestWorkAuth(req);\n }\n return await handler.fetch(req);\n}\n","createdAt",["D",1788897129940],"branchVersion","branchId","e3ce5705-5875-41ec-8c64-e8a442002718","id","d1ba1338-8f8e-4368-8701-5c1d5bcdc491","ew-session-attestation-probe-20260908",["D",1788885475025],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Candidate-only ChatGPT session metadata attestation probe","imageUrl","6be0fc5c-1fef-4bd6-a1e1-67a3f8c0764e","pinnedFileId","01a081e2-1f44-7010-93c8-4bdccf4cd340","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0715b-703f-741f-ab35-c85020e4a5e0","tursoName","d1ba13388f8e436887015c1d5bcdc491","tursoHostname","d1ba13388f8e436887015c1d5bcdc491-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789494036282],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":53,"_102":103,"_104":24},"branch",{"_13":86,"_31":87,"_41":40,"_88":42,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":43,"_95":96},"isOwned",29,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mosadek","handle","displayName","Mo Sadek","avatar","https://lh3.googleusercontent.com/a/ACg8ocL1eT_LHhKSg5px3nXIO6eez79aZXef466qXKh2gak-0iwrvw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":188,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":24,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":189,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":190,"_81":191,"_83":192,"_85":24},"tree",[171,172,173,174],"files",[171,172,173,174],"counts",{"_161":60,"_162":157,"_163":60,"_164":165,"_166":167},"contents",[129,130,131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_41":154,"_31":155,"_29":156,"_134":-5,"_39":40,"_38":157,"_135":124,"_36":158,"_13":60,"_32":20,"_34":159,"_23":24,"_137":-5,"_26":160},{"_41":148,"_31":149,"_29":55,"_134":-5,"_39":40,"_38":150,"_135":124,"_36":151,"_13":152,"_32":33,"_34":35,"_23":24,"_137":-5,"_26":153},{"_41":139,"_31":140,"_29":141,"_134":-5,"_39":40,"_38":142,"_135":24,"_36":143,"_13":144,"_32":145,"_34":146,"_23":24,"_137":-5,"_26":147},{"_41":133,"_31":27,"_29":30,"_134":-5,"_39":40,"_38":14,"_135":24,"_36":136,"_13":60,"_32":33,"_34":35,"_23":24,"_137":-5,"_26":138},"43ccff2b-a37b-42c3-976c-c07994ee58a5","parentId","latest",["D",1788897129940],"label",[27],"4a3fc066-b40d-48b8-aa7c-dcb2eefc6a1d","webbot_api_probe.ts","5b5f56e2-abbd-11f1-b85c-1607ee4eb77e",14,["D",1788896894891],7,"script","import { sign } from \"npm:web-bot-auth@0.2.0\";\nimport { signerFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst ORIGIN=\"https://mosadek--01a081e21f44701093c84bdccf4cd340.web.val.run\";\nconst pair:any=await crypto.subtle.generateKey({name:\"Ed25519\"},true,[\"sign\",\"verify\"]);\nconst privateJwk:any=await crypto.subtle.exportKey(\"jwk\",pair.privateKey);\nconst signer=await signerFromJWK(privateJwk);\n\nasync function freshAttestUrl(){\n const r=await fetch(ORIGIN+\"/work-auth-canary/v1/challenge\");\n const t=await r.text();\n const m=t.match(/href=\"([^\"]+\\/work-auth-canary\\/v1\\/attest\\?challenge=[^\"]+)\"/);\n if(!m) throw new Error(\"NO_ATTEST_URL\");\n return m[1].replaceAll(\"&\",\"&\");\n}\n\nasync function callUnsigned(){\n const url=await freshAttestUrl();\n const r=await fetch(url);\n return {status:r.status,body:await r.json()};\n}\n\nasync function callSigned(signatureAgent:string){\n const url=await freshAttestUrl();\n const base=new Request(url,{headers:{\"Signature-Agent\":`sig1=\"${signatureAgent}\";type=directory`}});\n const fields:any=await sign(base,{signer,created:new Date(),expires:new Date(Date.now()+60_000)});\n const req=new Request(url,{headers:{\n \"Signature-Agent\":base.headers.get(\"Signature-Agent\")!,\n \"Signature\":fields.signature,\n \"Signature-Input\":fields.signatureInput,\n }});\n const r=await fetch(req);\n return {status:r.status,body:await r.json(),signatureInput:fields.signatureInput};\n}\n\nconst unsigned=await callUnsigned();\nconst validWrongAgent=await callSigned(\"https://signature-agent.test\");\nconst forgedOpenAIIdentity=await callSigned(\"https://chatgpt.com\");\n\nconst pass =\n unsigned.status===401 &&\n unsigned.body?.classification===\"REJECT_WEB_BOT_AUTH\" &&\n unsigned.body?.reason===\"REJECT_MISSING_WEB_BOT_AUTH_HEADERS\" &&\n validWrongAgent.status===401 &&\n validWrongAgent.body?.classification===\"REJECT_WEB_BOT_AUTH\" &&\n validWrongAgent.body?.reason===\"Verifier resolution failed\" &&\n forgedOpenAIIdentity.status===401 &&\n forgedOpenAIIdentity.body?.classification===\"REJECT_WEB_BOT_AUTH\" &&\n forgedOpenAIIdentity.body?.reason===\"Verifier resolution failed\";\n\nconsole.log(JSON.stringify({\n schema:\"PROJECT_BRAIN_CHATGPT_WORK_WEBBOT_AUTH_CANARY_NEGATIVE_TEST_V1\",\n pass,\n unsigned,\n valid_wrong_signature_agent:validWrongAgent,\n valid_test_key_pretending_chatgpt:forgedOpenAIIdentity,\n ephemeral_private_key_persisted:false,\n positive_openai_signature_tested:false,\n production_admission:false,\n p_real_increment:0,\n human_authority_approval:false,\n direct_sprites_calls:0\n},null,2));",[140],"00f43aa6-0e88-4f60-a8a8-6d4fb4c2a354","main.ts",12,["D",1788896819634],5,[149],"dc40ea94-8b8f-49c9-9b3a-0ea07dd5c595","README.md","01a081e2-1f44-7010-93c8-4641009b682e",1,["D",1788885475025],"# MCP server\n\nA minimal MCP server with one example tool (that gets the current time in a\ngiven timezone).\n\nRemix this val to create your own MCP server on Val\nTown—[**_just like the MCP Core Maintainer team!_**](https://blog.val.town/mcp-core-maintainers)\n\nThis MCP server (<50 LOC in [`main.ts`](./main.ts)) is live on\n[mcp-time.val.run](https://mcp-time.val.run) if you'd like to test it\n([playground.ai.cloudflare.com](https://playground.ai.cloudflare.com) is a great\nplace to test an MCP server quickly). It's built on the v2 TypeScript SDK,\ncompatible with “MCP 2.0” (technically, the\n[2026-07-28 spec](https://modelcontextprotocol.io/specification/2026-07-28)). It\nalso supports the legacy spec, for MCP clients that haven't upgraded yet.",[155],"pulls","branches","forks","envVars",{"_168":60,"_170":60},"connections",{"_168":60,"_169":60},"count","unfilledCount","emptyCount",{"_41":154,"_31":155,"_29":156,"_134":-5,"_39":40,"_38":157,"_135":124,"_36":185,"_13":60,"_32":20,"_34":159,"_23":24,"_137":-5,"_176":186,"_26":187},{"_41":148,"_31":149,"_29":55,"_134":-5,"_39":40,"_38":150,"_135":124,"_36":182,"_13":152,"_32":33,"_34":35,"_23":24,"_137":-5,"_176":183,"_26":184},{"_41":139,"_31":140,"_29":141,"_134":-5,"_39":40,"_38":142,"_135":24,"_36":179,"_13":144,"_32":145,"_34":146,"_23":24,"_137":-5,"_176":180,"_26":181},{"_41":133,"_31":27,"_29":30,"_134":-5,"_39":40,"_38":14,"_135":24,"_36":175,"_13":60,"_32":33,"_34":35,"_23":24,"_137":-5,"_176":177,"_26":178},["D",1788897129940],"children",[],[27],["D",1788896894891],[],[140],["D",1788896819634],[],[149],["D",1788885475025],[],[155],["D",1788885475025],["D",1789494036282],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":53,"_102":103,"_104":24},{"_13":86,"_31":87,"_41":40,"_88":42,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":43,"_95":96},"ctx",{"_79":-5,"_126":226,"_227":228,"_229":230,"_231":24,"_232":24,"_233":24,"_234":124,"_235":-5,"_236":-7,"_237":-7,"_238":60,"_239":24,"_240":24,"_241":-5,"_242":24,"_243":24,"_244":24,"_245":-5},"ENV",{"_197":198,"_199":200,"_201":87,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v15