#21671 cx-dgsp: retire the legacy bearer wire subprotocol

Summary

The cmux Cloud API's wire socket still accepted a token in the bearer.<token> subprotocol. Workers invocation logs record that header (cx-dgsp). Every client also fell back to it: the Swift feed and cmux-tui on any 401 without x-cmux-wire-auth, and the TS client and dashboard on a 404 from the ticket route. So a response from something other than the API could make a current client send its token in a logged header.

This retires the path:

• API (backend/apps/api/src/wire-ticket.ts): no longer reads bearer.. It still strips it from the subprotocols forwarded to the owner object, and the 401 still names x-cmux-wire-auth.
• cmux NEXT feed (CloudFeedSource.swift) and cmux-tui (cloud_conversations_backend.rs): send the token only in Authorization. A 401 is final.
• TS cloud client and dashboard: use a single-use ticket or fail. They never send the token.
• wrangler.jsonc: invocation logs stay off in staging and production, because clients built before this change still send bearer.<token>. The comment says to turn them on once those clients have aged out.

The API tests that opened sockets with bearer. now use the Authorization header.

Compatibility: a client built before cx-dgsp's header auth (2026-10-11) can no longer open a wire socket until it updates. That covers cmux NEXT, cmux-tui daemons and any dashboard tab served before that date.

Testing

Red first (32b6f495073):

• backend/apps/api: vitest run test/wire-ticket.test.ts gives 1 failed, 8 passed.
• clients/ts/cloud: bun test test gives 1 fail, 4 pass.
• cmux-tui on hosted Linux (run 39133002845): a_401_without_header_auth_is_final_and_sends_no_token_subprotocol fails.

Green (6565913900f):

• wire-ticket.test.ts: 9 passed.
• clients/ts/cloud: 5 pass.
• The full backend/apps/api suite on Linux: 17 tests failed in one parallel run. 4 were socket tests in files my first rewrite missed; fixed in 90484ab942b. Every failing file passes when rerun alone.
• cmux-tui (run 39134805604): the test and clippy pass on hosted Linux; the macOS job was still queued when this opened.
• The Swift change has no unit test (the feed's socket loop has none). It's covered by CI compile only.

Bead: cx-dgsp.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Retires the legacy bearer.<token> wire subprotocol. The API no longer authenticates wire sockets with it, and all clients stop falling back to it when the Authorization header path fails — a fallback that any 401 from any server could trigger, sending the token in a header Workers invocation logs record. The API still strips bearer. subprotocols before forwarding to the owner object, and the 401 still names x-cmux-wire-auth.

Compatibility: clients built before header auth shipped (2026-10-11) can't open a wire socket until they update, and invocation logs stay off in staging and production until those clients age out.