fix(master): recheck revocation after register, reject duplicate hello

internal/master/hub/hub.go

@@ -81,6 +81,15 @@ func (h *Hub) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	h.register(agent.ID, c)
 	defer h.unregister(agent.ID, c)
 
+	// Revoking commits revoked_at before calling Disconnect. Re-checking after
+	// register closes the window where a revoke lands between the first lookup
+	// and register, when Disconnect would find nothing to cut.
+	again, err := h.store.AgentByTokenHash(r.Context(), agenttoken.Hash(token))
+	if err != nil || again.ID != agent.ID || again.RevokedAt != nil {
+		_ = c.Close(websocket.StatusPolicyViolation, "revoked")
+		return
+	}
+
 	s := &session{hub: h, agent: agent}
 	err = s.run(r.Context(), c)
 	h.log.Info("agent_disconnected", "agent", agent.Name, "reason", err)
@@ -165,6 +174,9 @@ func (s *session) handle(ctx context.Context, env protocol.Envelope) error {
 	h := s.hub
 	switch env.Type {
 	case protocol.TypeHello:
+		if s.hello != nil {
+			return errors.New("duplicate hello")
+		}
 		v, err := protocol.Decode[protocol.Hello](env)
 		if err != nil {
 			return err