@agentconnect.md/desktop 2.6.0-rc.57 → 2.6.0-rc.62

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -171,7 +171,9 @@ inside the desktop session, as the desktop user, not root. It needs Node.js ≥
 tarball or your distribution's package).
 
 ```bash
-npx -y @agentconnect.md/cli computer install --register <token> --cp-url <exchange URL>
+npx -y @agentconnect.md/cli@latest computer install --register <token> --cp-url <exchange URL>
+# against a release-candidate Control Plane, which the console detects and shows:
+npx -y @agentconnect.md/cli@rc computer install --channel rc --register <token> --cp-url <exchange URL>
 ```
 
 The CLI downloads `@agentconnect.md/desktop` from npm, verifies its integrity, unpacks it into
@@ -191,7 +193,7 @@ agentconnect computer uninstall # service, autostart entry and versions; --purge
 
 (`npx -y @agentconnect.md/cli` stands in for `agentconnect` without a global install.) Config, the
 Computer key and the grants stay in `~/.agentconnect/desktop`, so an upgrade keeps the
-registration; a desktop installed by the earlier `install.sh` keeps its data, and `computer install`
+registration; a desktop installed by the retired Control Plane `install.sh` keeps its data, and `computer install`
 moves its service onto the store. `AGENTCONNECT_NPM_REGISTRY` points the CLI at another registry.
 
 Requirements for running from source: Node.js ≥ 24.12 (the official tarball in `~/.local/node` works), a logged-in

package/dist/agentconnect-desktop.mjs

@@ -30567,7 +30567,7 @@ var require_websocket = __commonJS({
       const request2 = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
-      opts.createConnection = opts.createConnection || (isSecure ? tlsConnect : netConnect);
+      opts.createConnection = opts.createConnection || (isSecure ? tlsConnect2 : netConnect2);
       opts.defaultPort = opts.defaultPort || defaultPort2;
       opts.port = parsedUrl.port || defaultPort2;
       opts.host = parsedUrl.hostname.startsWith("[") ? parsedUrl.hostname.slice(1, -1) : parsedUrl.hostname;
@@ -30765,11 +30765,11 @@ var require_websocket = __commonJS({
       websocket.emit("error", err5);
       websocket.emitClose();
     }
-    function netConnect(options) {
+    function netConnect2(options) {
       options.path = options.socketPath;
       return net2.connect(options);
     }
-    function tlsConnect(options) {
+    function tlsConnect2(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
         options.servername = net2.isIP(options.host) ? "" : options.host;
@@ -59957,7 +59957,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       query: void 0,
       fragment: void 0
     };
-    let isIP5 = false;
+    let isIP6 = false;
     if (options.reference === "suffix") if (options.scheme) uri = options.scheme + ":" + uri;
     else uri = "//" + uri;
     const matches = uri.match(URI_PARSE);
@@ -59973,8 +59973,8 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       if (parsed.host) if (isIPv45(parsed.host) === false) {
         const ipv6result = normalizeIPv6(parsed.host);
         parsed.host = ipv6result.host.toLowerCase();
-        isIP5 = ipv6result.isIPV6;
-      } else isIP5 = true;
+        isIP6 = ipv6result.isIPV6;
+      } else isIP6 = true;
       if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) parsed.reference = "same-document";
       else if (parsed.scheme === void 0) parsed.reference = "relative";
       else if (parsed.fragment === void 0) parsed.reference = "absolute";
@@ -59982,7 +59982,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       if (options.reference && options.reference !== "suffix" && options.reference !== parsed.reference) parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
       const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP5 === false && nonSimpleDomain(parsed.host)) try {
+        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP6 === false && nonSimpleDomain(parsed.host)) try {
           parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
@@ -65705,6 +65705,10 @@ var ComputerIceServer = external_exports.object({
 }).strict();
 var COMPUTER_ICE_SERVERS_MAX = 2;
 var ComputerStunUrl = external_exports.string().max(256).regex(/^stun:(\[[0-9a-fA-F:.]+\]|[A-Za-z0-9.-]+)(:\d{1,5})?$/, "expected stun:<host>[:<port>]");
+var ComputerTurnUrl = external_exports.string().max(256).regex(
+  /^turns?:(\[[0-9a-fA-F:.]+\]|[A-Za-z0-9.-]+)(:\d{1,5})?(\?transport=(udp|tcp))?$/,
+  "expected turn:<host>[:<port>][?transport=udp|tcp] or turns:"
+);
 var COMPUTER_STUN_URLS_MAX = 2;
 var ComputerViewerCandidate = external_exports.object({
   id: external_exports.string().min(1).max(64),
@@ -66049,6 +66053,8 @@ var ComputerCapabilitiesSchema = external_exports.object({
   viewer: external_exports.boolean().default(false),
   // The viewer accepts a view token's `stun` claim; desktops before relay STUN refuse such a token.
   viewerStun: external_exports.boolean().optional(),
+  // The browser's traffic leaves through the desktop's egress forwarder, which applies `computer/egress` (§15.4).
+  egress: external_exports.boolean().optional(),
   displays: external_exports.array(
     external_exports.object({
       id: external_exports.string().min(1).max(128),
@@ -66081,6 +66087,24 @@ var ComputerChannelCredential = external_exports.object({
   issuedAt: external_exports.string().datetime(),
   expiresAt: external_exports.string().datetime()
 });
+var ComputerEgressProxyUrl = external_exports.string().max(512).refine((raw) => {
+  try {
+    const u = new URL(raw);
+    return (u.protocol === "http:" || u.protocol === "https:") && u.hostname !== "" && u.username === "" && u.password === "" && (u.pathname === "" || u.pathname === "/") && u.search === "" && u.hash === "";
+  } catch {
+    return false;
+  }
+}, "expected http://host:port or https://host:port without credentials or a path");
+var ComputerEgress = external_exports.discriminatedUnion("mode", [
+  external_exports.object({ mode: external_exports.literal("direct") }),
+  external_exports.object({
+    mode: external_exports.literal("proxy"),
+    url: ComputerEgressProxyUrl,
+    username: external_exports.string().min(1).max(256).optional(),
+    password: external_exports.string().min(1).max(512).optional()
+  })
+]);
+var COMPUTER_EGRESS_FEATURE = "computer-egress-v1";
 var ComputerAuth = external_exports.object({
   apiKey: external_exports.string().min(1).max(256),
   desktopDaemonVersion: external_exports.string().trim().min(1).max(64)
@@ -66096,7 +66120,9 @@ var ComputerAuthOk = external_exports.object({
   // What this CP accepts on the channel beyond the base frames, such as `computer-audit-v1`.
   features: external_exports.array(external_exports.string().min(1).max(64)).max(32).optional(),
   // The retention in effect for this Computer's screenshots (§9); 0 or absent means none are stored.
-  screenshotRetentionDays: external_exports.number().int().min(0).max(COMPUTER_SCREENSHOT_RETENTION_MAX_DAYS).optional()
+  screenshotRetentionDays: external_exports.number().int().min(0).max(COMPUTER_SCREENSHOT_RETENTION_MAX_DAYS).optional(),
+  // A managed desktop's egress (§15.4); absent means direct unless `computer-egress-v1` is advertised. Secret, never logged.
+  egress: ComputerEgress.optional()
 });
 var ComputerHeartbeat = external_exports.object({
   status: external_exports.enum(COMPUTER_LIVE_STATUSES),
@@ -66125,6 +66151,7 @@ var ComputerRevoke = external_exports.object({
 var ComputerLeasePush = external_exports.object({ lease: ComputerControlLease.nullable() });
 var ComputerRelaysPush = external_exports.object({ relays: external_exports.array(ComputerRelayEntry).max(COMPUTER_RELAYS_MAX) });
 var ComputerStopPush = external_exports.object({ stop: external_exports.object({ at: external_exports.string().datetime() }).nullable() });
+var ComputerEgressPush = external_exports.object({ egress: ComputerEgress });
 var COMPUTER_CP_SCHEMAS = {
   "computer/auth": ComputerAuth,
   "computer/auth/ok": ComputerAuthOk,
@@ -66135,6 +66162,7 @@ var COMPUTER_CP_SCHEMAS = {
   "computer/lease": ComputerLeasePush,
   "computer/relays": ComputerRelaysPush,
   "computer/stop": ComputerStopPush,
+  "computer/egress": ComputerEgressPush,
   "computer/audit": ComputerAuditReport,
   "computer/audit/ok": ComputerAuditAck,
   "computer/screenshot/put": ComputerScreenshotPut,
@@ -66154,6 +66182,7 @@ var ComputerCpFrame = external_exports.discriminatedUnion("type", [
   frameSchema("computer/lease", COMPUTER_CP_SCHEMAS["computer/lease"]),
   frameSchema("computer/relays", COMPUTER_CP_SCHEMAS["computer/relays"]),
   frameSchema("computer/stop", COMPUTER_CP_SCHEMAS["computer/stop"]),
+  frameSchema("computer/egress", COMPUTER_CP_SCHEMAS["computer/egress"]),
   frameSchema("computer/audit", COMPUTER_CP_SCHEMAS["computer/audit"]),
   frameSchema("computer/audit/ok", COMPUTER_CP_SCHEMAS["computer/audit/ok"]),
   frameSchema("computer/screenshot/put", COMPUTER_CP_SCHEMAS["computer/screenshot/put"]),
@@ -74328,7 +74357,7 @@ var require_fast_uri2 = /* @__PURE__ */ __commonJSMin2(((exports, module) => {
       query: void 0,
       fragment: void 0
     };
-    let isIP5 = false;
+    let isIP6 = false;
     if (options.reference === "suffix") if (options.scheme) uri = options.scheme + ":" + uri;
     else uri = "//" + uri;
     const matches = uri.match(URI_PARSE);
@@ -74344,8 +74373,8 @@ var require_fast_uri2 = /* @__PURE__ */ __commonJSMin2(((exports, module) => {
       if (parsed.host) if (isIPv45(parsed.host) === false) {
         const ipv6result = normalizeIPv6(parsed.host);
         parsed.host = ipv6result.host.toLowerCase();
-        isIP5 = ipv6result.isIPV6;
-      } else isIP5 = true;
+        isIP6 = ipv6result.isIPV6;
+      } else isIP6 = true;
       if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) parsed.reference = "same-document";
       else if (parsed.scheme === void 0) parsed.reference = "relative";
       else if (parsed.fragment === void 0) parsed.reference = "absolute";
@@ -74353,7 +74382,7 @@ var require_fast_uri2 = /* @__PURE__ */ __commonJSMin2(((exports, module) => {
       if (options.reference && options.reference !== "suffix" && options.reference !== parsed.reference) parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
       const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP5 === false && nonSimpleDomain(parsed.host)) try {
+        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP6 === false && nonSimpleDomain(parsed.host)) try {
           parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
@@ -84717,7 +84746,7 @@ var managedEntry = () => process.env[SERVICE_ENTRY_ENV]?.trim() || void 0;
 var serviceEntry = () => managedEntry() ?? resolve(process.argv[1]);
 
 // src/version.ts
-var DESKTOP_DAEMON_VERSION = true ? "2.6.0-rc.57" : JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+var DESKTOP_DAEMON_VERSION = true ? "2.6.0-rc.62" : JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 
 // src/http-server.ts
 var CONTROL_HEADER = "x-agentconnect-desktop";
@@ -109079,6 +109108,8 @@ var ComputerCpClient = class {
     this.deps.authority.syncClock(ok.serverTime);
     this.deps.authority.accept(ok.credential);
     this.deps.onPolicy?.(ok.policy);
+    const egress = ok.egress ?? (this.features.has(COMPUTER_EGRESS_FEATURE) ? void 0 : { mode: "direct" });
+    if (egress) this.deps.onEgress?.(egress);
     this.heartbeatMs = ok.heartbeatSec * 1e3;
     this.deps.log(`computer channel: connected as ${ok.name} (${ok.computerId})`);
     this.deps.onReady?.(ok);
@@ -109114,6 +109145,9 @@ var ComputerCpClient = class {
       case "computer/stop":
         this.deps.onStop?.(frame.payload.stop);
         return;
+      case "computer/egress":
+        this.deps.onEgress?.(frame.payload.egress);
+        return;
       case "computer/revoke":
         return this.revoked(`${frame.payload.reason} by the Control Plane`);
       case "error":
@@ -109628,6 +109662,7 @@ function capabilitiesFrom(checks, display, options = {}) {
     accessibilityTree: false,
     viewer: options.webrtc !== false && ok("ffmpeg") && ok("screen capture"),
     viewerStun: true,
+    ...options.egress ? { egress: true } : {},
     displays: display && display.screenWidth > 0 && display.screenHeight > 0 ? [
       {
         id: "primary",
@@ -109767,9 +109802,210 @@ async function startPoolBootstrap(options) {
   };
 }
 
+// src/egress.ts
+import { request as httpRequest, createServer as createServer4 } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { connect as netConnect, isIP as isIP4 } from "node:net";
+import { connect as tlsConnect } from "node:tls";
+var EGRESS_PORT_ENV = "AGENTCONNECT_EGRESS_PORT";
+var CONNECT_TIMEOUT_MS = 15e3;
+var MAX_PROXY_HEADER_BYTES = 16 * 1024;
+var HOP_BY_HOP = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+function egressPort(env = process.env) {
+  const raw = env[EGRESS_PORT_ENV]?.trim();
+  if (!raw) return void 0;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error(`${EGRESS_PORT_ENV} is not a valid port: ${raw}`);
+  return port;
+}
+function connectTarget(authority) {
+  const match = /^\[?([^\]]+?)\]?:(\d{1,5})$/.exec(authority ?? "");
+  if (!match) return void 0;
+  const port = Number(match[2]);
+  return port > 0 && port <= 65535 ? { host: match[1], port } : void 0;
+}
+var basic = (egress) => egress.username !== void 0 || egress.password !== void 0 ? `Basic ${Buffer.from(`${egress.username ?? ""}:${egress.password ?? ""}`).toString("base64")}` : void 0;
+function forwardHeaders(headers) {
+  const out = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (value !== void 0 && !HOP_BY_HOP.has(name.toLowerCase())) out[name] = value;
+  }
+  return out;
+}
+var EgressForwarder = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  policy = { mode: "pending" };
+  server;
+  sockets = /* @__PURE__ */ new Set();
+  get mode() {
+    return this.policy.mode;
+  }
+  /** Apply the organization's egress; open connections keep the route they started on. */
+  apply(policy) {
+    const before = this.describe();
+    this.policy = policy;
+    const after = this.describe();
+    if (after !== before) this.opts.log(`egress: ${after}`);
+  }
+  // Never the credentials: the proxy's origin is enough to tell which one is in use.
+  describe() {
+    if (this.policy.mode !== "proxy") return this.policy.mode;
+    return `proxy ${new URL(this.policy.url).origin}`;
+  }
+  async start() {
+    const server = createServer4((req, res) => this.onRequest(req, res));
+    server.on("connect", (req, socket, head) => this.onConnect(req, socket, head));
+    server.on("connection", (socket) => {
+      this.sockets.add(socket);
+      socket.once("close", () => this.sockets.delete(socket));
+    });
+    server.on("clientError", (_err, socket) => socket.destroy());
+    await new Promise((resolve2, reject) => {
+      server.once("error", reject);
+      server.listen(this.opts.port, this.opts.host ?? "127.0.0.1", () => resolve2());
+    });
+    this.server = server;
+    const address = server.address();
+    return typeof address === "object" && address ? address.port : this.opts.port;
+  }
+  async stop() {
+    for (const socket of this.sockets) socket.destroy();
+    await new Promise((resolve2) => this.server ? this.server.close(() => resolve2()) : resolve2());
+    this.server = void 0;
+  }
+  // A tunnel (HTTPS and WebSocket traffic): straight to the target, or a CONNECT through the organization's proxy.
+  onConnect(req, client, head) {
+    const policy = this.policy;
+    const target = connectTarget(req.url);
+    const refuse = (status) => {
+      client.end(`HTTP/1.1 ${status}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+    };
+    if (!target) return refuse("400 Bad Request");
+    if (policy.mode === "pending") return refuse("503 Service Unavailable");
+    client.on("error", () => {
+    });
+    const upstream = policy.mode === "direct" ? netConnect(target.port, target.host) : this.dialProxy(new URL(policy.url));
+    let opened = false;
+    upstream.setTimeout(CONNECT_TIMEOUT_MS, () => upstream.destroy(new Error("timeout")));
+    upstream.on("error", () => {
+      if (opened) client.destroy();
+      else if (!client.destroyed) refuse("502 Bad Gateway");
+    });
+    client.once("close", () => upstream.destroy());
+    const open3 = (rest) => {
+      opened = true;
+      upstream.setTimeout(0);
+      client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+      if (rest.length > 0) client.write(rest);
+      if (head.length > 0) upstream.write(head);
+      upstream.pipe(client);
+      client.pipe(upstream);
+    };
+    if (policy.mode === "direct") {
+      upstream.once("connect", () => open3(Buffer.alloc(0)));
+      return;
+    }
+    const auth = basic(policy);
+    const authority = target.host.includes(":") ? `[${target.host}]:${target.port}` : `${target.host}:${target.port}`;
+    upstream.once(policy.url.startsWith("https:") ? "secureConnect" : "connect", () => {
+      upstream.write(
+        `CONNECT ${authority} HTTP/1.1\r
+Host: ${authority}\r
+${auth ? `Proxy-Authorization: ${auth}\r
+` : ""}\r
+`
+      );
+    });
+    let buffered = Buffer.alloc(0);
+    const onData = (chunk) => {
+      buffered = Buffer.concat([buffered, chunk]);
+      const end = buffered.indexOf("\r\n\r\n");
+      if (end < 0) {
+        if (buffered.length > MAX_PROXY_HEADER_BYTES) upstream.destroy(new Error("oversized proxy reply"));
+        return;
+      }
+      upstream.off("data", onData);
+      const status = /^HTTP\/1\.[01] (\d{3})/.exec(buffered.subarray(0, end).toString("latin1"))?.[1];
+      if (status !== "200") {
+        upstream.destroy();
+        return refuse(status === "407" ? "502 Bad Gateway (egress proxy refused the credentials)" : "502 Bad Gateway");
+      }
+      open3(buffered.subarray(end + 4));
+    };
+    upstream.on("data", onData);
+  }
+  // A plain HTTP request in absolute form: fetched directly, or handed to the organization's proxy as is.
+  onRequest(req, res) {
+    const policy = this.policy;
+    let target;
+    try {
+      target = new URL(req.url ?? "");
+    } catch {
+      res.writeHead(400).end();
+      return;
+    }
+    if (target.protocol !== "http:") return void res.writeHead(400).end();
+    if (policy.mode === "pending") return void res.writeHead(503).end("egress is not configured yet");
+    const headers = forwardHeaders(req.headers);
+    let upstream;
+    if (policy.mode === "direct") {
+      upstream = httpRequest({
+        host: target.hostname,
+        port: target.port || 80,
+        method: req.method,
+        path: `${target.pathname}${target.search}`,
+        headers
+      });
+    } else {
+      const proxy = new URL(policy.url);
+      const auth = basic(policy);
+      upstream = (proxy.protocol === "https:" ? httpsRequest : httpRequest)({
+        host: proxy.hostname,
+        port: proxy.port || (proxy.protocol === "https:" ? 443 : 80),
+        method: req.method,
+        path: target.href,
+        headers: { ...headers, ...auth ? { "proxy-authorization": auth } : {} }
+      });
+    }
+    upstream.setTimeout(CONNECT_TIMEOUT_MS, () => upstream.destroy(new Error("timeout")));
+    upstream.on("response", (answer) => {
+      upstream.setTimeout(0);
+      res.writeHead(answer.statusCode ?? 502, forwardHeaders(answer.headers));
+      answer.pipe(res);
+    });
+    upstream.on("error", () => {
+      if (!res.headersSent) res.writeHead(502).end();
+      else res.destroy();
+    });
+    req.pipe(upstream);
+  }
+  dialProxy(proxy) {
+    const port = Number(proxy.port || (proxy.protocol === "https:" ? 443 : 80));
+    return proxy.protocol === "https:" ? tlsConnect({ host: proxy.hostname, port, ...isIP4(proxy.hostname) ? {} : { servername: proxy.hostname } }) : netConnect(port, proxy.hostname);
+  }
+};
+
 // src/public-address.ts
 import { lookup } from "node:dns/promises";
-import { isIP as isIP4 } from "node:net";
+import { isIP as isIP5 } from "node:net";
 function publicBaseUrl(config2) {
   if (config2.publicUrl) return config2.publicUrl.replace(/\/+$/, "");
   if (config2.rtcAddress) return `http://${urlHost(config2.rtcAddress)}:${config2.port}`;
@@ -109779,7 +110015,7 @@ async function rtcAdvertiseAddress(config2, resolve2 = async (host) => (await lo
   if (config2.rtcAddress) return config2.rtcAddress;
   if (!config2.publicUrl) return void 0;
   const host = new URL(config2.publicUrl).hostname.replace(/^\[(.*)\]$/, "$1");
-  if (isIP4(host)) return host;
+  if (isIP5(host)) return host;
   try {
     return await resolve2(host);
   } catch (error62) {
@@ -110609,6 +110845,8 @@ Commands:
                                                H defaults to 127.0.0.1, --host 0.0.0.0 opens every interface;
                                                registers first when ${REGISTER_TOKEN_ENV}(_FILE) and
                                                AGENTCONNECT_CP_URL are set and no key for that CP is stored
+                                               (AGENTCONNECT_EGRESS_PORT runs the browser's egress forwarder,
+                                               as managed pods do)
   stdio [--expose-driver-tools]                serve MCP over stdio (agent runs on this machine)
   token add NAME | token list | token remove NAME
   status | pause | resume                      owner controls for the running daemon (loopback)
@@ -110899,7 +111137,8 @@ function startCpChannel(options) {
             capabilities: capabilitiesFrom(checks, display ?? startupDisplay, {
               session,
               webrtc: config2.webrtc,
-              keyboardActivity: local?.keyboard() ?? false
+              keyboardActivity: local?.keyboard() ?? false,
+              egress: options.egress !== void 0
             }),
             doctor: doctorReport([...checks, ...local?.checks() ?? []], doctorAt)
           } : {}
@@ -110914,6 +111153,7 @@ function startCpChannel(options) {
     onReady: (ok) => computer.rename(ok.name),
     onRelays: (relays) => relayLinks.converge(relays),
     onStop: (stop) => applyConsoleStop(stop),
+    onEgress: (egress) => options.egress?.apply(egress),
     onRevoked: (reason) => {
       relayLinks.stop();
       markRevoked(dir, reason);
@@ -111035,9 +111275,13 @@ async function registerFromPool(dir) {
 }
 async function run2(dir, initial, clientName) {
   let config2 = initial;
+  const egressAt = egressPort();
+  const egress = egressAt !== void 0 ? new EgressForwarder({ port: egressAt, log: log39 }) : void 0;
+  if (egress) log39(`egress forwarder on 127.0.0.1:${await egress.start()}`);
   await registerFromPool(dir);
   await registerFromEnvironment(dir);
   const registration = loadRegistration(dir);
+  if (!registration) egress?.apply({ mode: "direct" });
   if (config2.clients.length === 0 && !registration) {
     const issued = issueClientToken(config2, clientName);
     config2 = issued.config;
@@ -111149,7 +111393,8 @@ async function run2(dir, initial, clientName) {
     screenSize,
     createMcpServer,
     viewer,
-    local: () => live2.local
+    local: () => live2.local,
+    egress
   });
   const publicBase = publicBaseUrl(config2);
   const urls = publicBase ? [`${publicBase}/mcp`] : isWildcardHost(config2.host) ? [server.url, ...lanAddresses().map((ip) => `http://${ip}:${config2.port}/mcp`)] : [server.url];
@@ -111178,7 +111423,7 @@ async function run2(dir, initial, clientName) {
     live2.local?.close();
     authority.close();
     releaseDisplay();
-    await Promise.allSettled([server.close(), driver.close()]);
+    await Promise.allSettled([server.close(), driver.close(), egress?.stop()]);
     process.exit(exitCode);
   };
   process.once("SIGINT", () => void shutdown());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentconnect.md/desktop",
-  "version": "2.6.0-rc.57",
+  "version": "2.6.0-rc.62",
   "description": "AgentConnect computer daemon: drives a desktop through Cua Driver and serves the computer_* tools over MCP; installed and upgraded by agentconnect computer",
   "license": "Apache-2.0",
   "repository": {
@@ -16,20 +16,6 @@
     "dist/agentconnect-desktop.mjs",
     "dist/agentconnect-desktop.mjs.LEGAL.txt"
   ],
-  "scripts": {
-    "build": "pnpm --filter \"{.}...\" build:package",
-    "build:package": "node scripts/bundle.mjs --dist",
-    "bundle": "node scripts/bundle.mjs",
-    "bundle:macos": "node scripts/build-macos-app.mjs",
-    "clean": "rm -rf dist bundle",
-    "dev": "tsx src/cli.ts run",
-    "license-scan": "tsx scripts/license-scan.ts",
-    "prepack": "pnpm run build",
-    "test": "vitest run",
-    "test:unit": "vitest run",
-    "test:xvfb": "node scripts/bundle.mjs && vitest run -c vitest.xvfb.config.ts",
-    "typecheck": "tsc -p tsconfig.typecheck.json"
-  },
   "dependencies": {},
   "devDependencies": {
     "@types/node": "^24.19.1",
@@ -52,5 +38,18 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "pnpm --filter \"{.}...\" build:package",
+    "build:package": "node scripts/bundle.mjs --dist",
+    "bundle": "node scripts/bundle.mjs",
+    "bundle:macos": "node scripts/build-macos-app.mjs",
+    "clean": "rm -rf dist bundle",
+    "dev": "tsx src/cli.ts run",
+    "license-scan": "tsx scripts/license-scan.ts",
+    "test": "vitest run",
+    "test:unit": "vitest run",
+    "test:xvfb": "node scripts/bundle.mjs && vitest run -c vitest.xvfb.config.ts",
+    "typecheck": "tsc -p tsconfig.typecheck.json"
   }
-}
+}