feat(agent): add controlled task execution

tests/product/internalBridgeAuth.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "bun:test";
+
+import { isTrustedInternalBridgeRequest } from "../../src/product/internal-bridge-auth.js";
+
+const request = (headers: Record<string, string>) => ({
+  header: (name: string) => headers[name.toLowerCase()],
+});
+
+describe("internal operational-task bridge authentication", () => {
+  it("requires the server-only secret and rejects browser-originated requests", () => {
+    expect(isTrustedInternalBridgeRequest(request({ "x-agent-internal-token": "secret" }), "secret")).toBe(true);
+    expect(isTrustedInternalBridgeRequest(request({ "x-agent-internal-token": "known-session-id" }), "secret")).toBe(false);
+    expect(isTrustedInternalBridgeRequest(request({
+      "x-agent-internal-token": "secret",
+      origin: "https://tjwater.example",
+      "sec-fetch-site": "same-site",
+    }), "secret")).toBe(false);
+  });
+});