Preserve support proof during optimized session checks
Fixes application-initiated support sessions ending immediately after handoff when the optimized server session-check path omitted the original verified request context.
What changed
- Optimized native session checks retain the verified signed request so support-origin, integration-version and actor/session proofs are checked by the same native hooks as HTTP requests.
- Ordinary application actors remain ordinary users; the fix grants no native administrator authority and retains missing/forged-origin denial, native expiry, original-session revocation, safe status and cleanup.
- The published SDK 1.4.5 archive and all existing SDK/cookie/request contracts are unchanged. Applications need no dependency upgrade for this service correction.
Release provenance
release
An actual SDK handoff routed through optimized native ingress reproduced immediate null-session failure before the patch. Focused native support/session suites, forged and missing-origin denial, safe status/cleanup, service typecheck, production build and immutable SDK checks passed before deployment.
Reviewed package files: session-introspection.ts, route.ts, support-plugin.test.ts
deployment
Railway deployment 6d1ba4bc-f048-4341-9e2e-65c02b580825 of source 1fdefce701a2675f754940dd944f6f272b55d9e9 reached SUCCESS on 2026-11-06T03:02:26.177Z. Service readiness, anonymous native session response and an existing verified management session passed after deployment. Browser handoff acceptance is recorded separately.
Reviewed package files: session-introspection.ts, route.ts, support-plugin.test.ts