From 1814f82928dfe6eba2b377c3df12349ad3cfd073 Mon Sep 17 00:00:00 2001
From: Levi Neely <lneely@pascom.net>
Date: Wed, 12 Aug 2026 08:34:52 +0200
Subject: [PATCH] toolsrv: include session ID in bypass broker requests

The bypass broker requires a 'session' field in the JSON request
to identify which session is making the bypass request. The toolsrv
was sending requests without this field, causing 'denied (no session
identity)' errors.

Fix: Include OLLIE_SESSION_ID from environment in the bypass request.
---
 cmd/toolsrv/internal/exec/exec.go | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/cmd/toolsrv/internal/exec/exec.go b/cmd/toolsrv/internal/exec/exec.go
index 2c8d7a8..9900294 100644
--- a/cmd/toolsrv/internal/exec/exec.go
+++ b/cmd/toolsrv/internal/exec/exec.go
@@ -272,11 +272,12 @@ func executeBypassDirect(ctx context.Context, cmd, cwd string, envExtra map[stri
 	defer conn.Close()
 
 	reqJSON, _ := json.Marshal(struct {
-		Cmd  string            `json:"cmd"`
-		Cwd  string            `json:"cwd"`
-		Env  map[string]string `json:"env"`
-		Sudo bool              `json:"sudo,omitempty"`
-	}{Cmd: cmd, Cwd: cwd, Env: envMap, Sudo: sudo})
+		Cmd     string            `json:"cmd"`
+		Cwd     string            `json:"cwd"`
+		Env     map[string]string `json:"env"`
+		Session string            `json:"session"`
+		Sudo    bool              `json:"sudo,omitempty"`
+	}{Cmd: cmd, Cwd: cwd, Env: envMap, Session: os.Getenv("OLLIE_SESSION_ID"), Sudo: sudo})
 	reqJSON = append(reqJSON, '\n')
 
 	if _, err := conn.Write(reqJSON); err != nil {