feat(trios-server): UART endpoint at /api/uart for remote serial-port access

crates/trios-server/Cargo.toml

@@ -30,12 +30,16 @@ uuid = { version = "1", features = ["v4"] }
 chrono = "0.4"
 lazy_static = "1.4"
 serde = { workspace = true, features = ["derive"] }
-tokio-stream = { version = "0.1", features = ["sync"] }
+tokio-stream = { version = "0.1", features = ["sync", "time"] }
 
 rust-mcp-schema = "0.10"
 hex = "0.4"
 reqwest = { version = "0.12", features = ["json"] }
 dotenv = "0.15"
 
+# UART endpoint (see src/uart.rs)
+serialport = { version = "4.7", default-features = false }
+base64 = "0.22"
+
 [dev-dependencies]
 tempfile = { workspace = true }

crates/trios-server/src/main.rs

@@ -5,6 +5,7 @@ mod rainbow_routes;
 mod security;
 mod sse_handler;
 mod tools;
+mod uart;
 mod ws_handler;
 
 use axum::extract::State;
@@ -44,7 +45,10 @@ async fn main() -> anyhow::Result<()> {
         .allow_methods(Any)
         .allow_headers(Any);
 
-    let app = Router::new()
+    // UART bridge — only mounted if TRIOS_UART_TOKEN is set (fail-closed).
+    uart::log_startup_state();
+
+    let mut app = Router::new()
         // WebSocket (agents, internal tools)
         .route("/ws", get(ws_handler::ws_handler))
         .route("/operator", get(operator::operator_ws_handler))
@@ -58,8 +62,13 @@ async fn main() -> anyhow::Result<()> {
         .route("/health", get(health))
         .route("/", get(health))
         // Rainbow Bridge (L13 / INV-8) — see crates/trios-rainbow-bridge.
-        .merge(rainbow_routes::rainbow_routes())
-        .layer(
+        .merge(rainbow_routes::rainbow_routes());
+
+    if let Some(uart_router) = uart::router() {
+        app = app.nest("/api/uart", uart_router);
+    }
+
+    let app = app.layer(
             ServiceBuilder::new()
                 .layer(cors)
                 .layer(axum::middleware::from_fn(security::auth_middleware))

crates/trios-server/src/security.rs

@@ -67,6 +67,13 @@ pub async fn auth_middleware(request: Request, next: Next) -> Result<Response, S
         return Ok(next.run(request).await);
     }
 
+    // UART endpoints use their own bearer token (TRIOS_UART_TOKEN),
+    // enforced by `uart::uart_auth_middleware`. Bypass the global check
+    // so clients only need to present one credential.
+    if path.starts_with("/api/uart") {
+        return Ok(next.run(request).await);
+    }
+
     // If no API key is configured, allow all requests (dev mode)
     if expected_token.is_empty() {
         return Ok(next.run(request).await);
@@ -158,6 +165,23 @@ mod tests {
         assert!(result.is_ok());
     }
 
+    #[test]
+    fn test_uart_paths_bypass_global_auth_prefix() {
+        // Regression guard: the global auth middleware must skip everything
+        // under /api/uart so that UART's own token remains the single
+        // credential clients need. We assert the prefix constant here; the
+        // runtime bypass is exercised in the uart module's integration tests.
+        let paths = [
+            "/api/uart",
+            "/api/uart/ports",
+            "/api/uart/stream",
+            "/api/uart/write",
+        ];
+        for p in paths {
+            assert!(p.starts_with("/api/uart"), "prefix broke for {}", p);
+        }
+    }
+
     #[test]
     fn test_reject_file_not_directory() {
         let dir = TempDir::new().unwrap();