@agentprojectcontext/apx 1.80.2 → 1.89.1

package/src/host/daemon/api/media.js

@@ -0,0 +1,283 @@
+// Attachment bytes, both directions.
+//
+//   GET  /media?path=<abs>       stream a stored attachment
+//   POST /media/upload?name=…    store one the web composer is about to send
+//
+// A photo, voice note or document that arrives over a channel is downloaded to
+// ~/.apx/media and its path recorded on the stored turn (dispatch folds it into
+// the one inbound record). This streams those bytes back so a viewer can show
+// the actual file instead of the text marker the agent was handed — a thread
+// that read "[document received: … saved to /Users/…]" told the user nothing.
+//
+// Sandboxed to that directory, like /voice/tts: the path arrives from a stored
+// record, so it is treated as untrusted input. The content type is derived from
+// the extension only — never from the request — so a stray file cannot be
+// served back as HTML.
+//
+// The web composer writes into the same directory (subdir `web/`) so a file
+// picked, pasted or dropped in the browser reaches the agent by exactly the
+// route a Telegram photo does: bytes on disk, path on the turn.
+import crypto from "node:crypto";
+import express from "express";
+import fs from "node:fs";
+import path from "node:path";
+import { APX_HOME } from "#core/config/index.js";
+
+const MIME = {
+  ".oga": "audio/ogg", ".ogg": "audio/ogg", ".opus": "audio/ogg",
+  // A voice note recorded in the browser is Opus in a WebM container. Without
+  // its own extension it would land as ".webm" → video/webm → a <video> element
+  // with no picture. `.weba` is the audio-only spelling of the same container.
+  ".weba": "audio/webm",
+  ".mp3": "audio/mpeg", ".wav": "audio/wav", ".m4a": "audio/mp4", ".aac": "audio/aac",
+  ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".gif": "image/gif",
+  ".webp": "image/webp", ".heic": "image/heic",
+  ".mp4": "video/mp4", ".mov": "video/quicktime", ".webm": "video/webm",
+  ".pdf": "application/pdf",
+  ".txt": "text/plain", ".md": "text/markdown", ".csv": "text/csv",
+  ".json": "application/json", ".log": "text/plain",
+};
+
+// What the composer may hand over. The gate is the extension — the request's
+// own content type is never trusted here either — so the set stays small and
+// purposeful: images a multimodal engine can see, audio it can transcribe,
+// documents its file tools can open. Nothing executable, and nothing a browser
+// would run if it ever escaped the Content-Disposition below.
+const UPLOAD_EXT = new Set([
+  ".jpg", ".jpeg", ".png", ".gif", ".webp", ".heic",
+  ".oga", ".ogg", ".opus", ".weba", ".mp3", ".wav", ".m4a", ".aac",
+  ".mp4", ".mov", ".webm",
+  ".pdf", ".txt", ".md", ".csv", ".json", ".log",
+]);
+
+// 25 MB. Above this the base64 an image turn carries starts to dominate the
+// model's context window, and the point of the cap is the turn, not the disk.
+const MAX_UPLOAD = 25 * 1024 * 1024;
+
+// An extension the allowlist trusts must be backed by the bytes it claims:
+// otherwise ".png" is just a four-character promise, and the file that lands in
+// the media dir is whatever the caller wanted to put there. Only the formats
+// with a stable signature are checked; the rest pass on the extension alone.
+const MAGIC = [
+  { ext: [".jpg", ".jpeg"], at: 0, bytes: [0xff, 0xd8, 0xff] },
+  { ext: [".png"], at: 0, bytes: [0x89, 0x50, 0x4e, 0x47] },
+  { ext: [".gif"], at: 0, bytes: [0x47, 0x49, 0x46, 0x38] },
+  { ext: [".webp"], at: 8, bytes: [0x57, 0x45, 0x42, 0x50] },
+  { ext: [".pdf"], at: 0, bytes: [0x25, 0x50, 0x44, 0x46] },
+];
+
+function magicMatches(ext, buf) {
+  const rule = MAGIC.find((m) => m.ext.includes(ext));
+  if (!rule) return true;
+  if (buf.length < rule.at + rule.bytes.length) return false;
+  return rule.bytes.every((b, i) => buf[rule.at + i] === b);
+}
+
+/** The media dir itself. One root for the read and the write side. */
+function mediaRoot() {
+  return path.resolve(APX_HOME, "media");
+}
+
+/** `photo` | `audio` | `video` | `document`, from the resolved mime. */
+function kindFromMime(mime) {
+  if (mime.startsWith("image/")) return "photo";
+  if (mime.startsWith("audio/")) return "audio";
+  if (mime.startsWith("video/")) return "video";
+  return "document";
+}
+
+function mimeFor(file) {
+  return MIME[path.extname(file).toLowerCase()] || "application/octet-stream";
+}
+
+/**
+ * A filename fit to store and to show. The caller's name is a display string
+ * from an untrusted client: only its basename survives, separators and control
+ * characters included, and the stem is capped so a 300-character name cannot
+ * push the stored path past the filesystem's limit.
+ */
+function safeName(raw) {
+  const base = path.basename(String(raw || "")).replace(/[^\w.\- ]+/g, "_").trim();
+  const ext = path.extname(base).toLowerCase();
+  const stem = base.slice(0, base.length - ext.length).slice(0, 60).trim() || "file";
+  return { name: `${stem}${ext}`, ext, stem };
+}
+
+// Shown in the browser rather than pushed to Downloads. Everything else gets
+// `attachment`, so an unknown type can never render in the app's own origin.
+const INLINE = /^(audio|image|video)\//;
+
+function tryRealpath(p) {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return null;
+  }
+}
+
+/** The real path of a file inside ~/.apx/media, or null if it escapes. */
+function resolveInMediaDir(raw) {
+  const root = mediaRoot();
+  const asked = path.resolve(raw);
+  // Lexical guard first, so a path from outside the media dir never reaches the
+  // filesystem at all. Both spellings of the root count: what a stored turn
+  // carries is the resolved path, and on a home behind a symlink (a macOS temp
+  // dir, a relocated ~) the unresolved root would refuse our own file.
+  const roots = [root, tryRealpath(root)].filter(Boolean);
+  if (!roots.some((r) => asked === r || asked.startsWith(r + path.sep))) return null;
+  if (!fs.existsSync(asked)) return null;
+  // Symlinks are resolved on both sides: a link inside the media dir must not
+  // become a window onto the rest of the disk.
+  const real = fs.realpathSync(asked);
+  const realRoot = fs.realpathSync(root);
+  if (!real.startsWith(realRoot + path.sep)) return null;
+  return real;
+}
+
+/**
+ * The files a turn is being sent with, resolved from the media dir.
+ *
+ * Returns what each consumer needs: `attachments` for the model (images only —
+ * a multimodal engine renders them, the others ignore the field), `markers` for
+ * the prompt (so an engine without vision still knows a file arrived and where
+ * it is), and `media` shaped as the ledger meta a stored turn carries, so a
+ * reopened thread shows the file instead of the marker. Mirrors what the
+ * Telegram inbound handlers hand to dispatch.
+ *
+ * Anything that does not resolve inside the media dir is dropped in silence:
+ * the paths come back from a client, and a turn is not the place to explain a
+ * path that a caller had no business sending.
+ */
+export function readTurnAttachments(raw) {
+  const attachments = [];
+  const markers = [];
+  let media = null;
+  for (const item of Array.isArray(raw) ? raw : []) {
+    let resolved = null;
+    try {
+      resolved = resolveInMediaDir(String(item?.path || ""));
+    } catch {
+      resolved = null;
+    }
+    if (!resolved) continue;
+    const mime = mimeFor(resolved);
+    const name = item?.name ? safeName(item.name).name : path.basename(resolved);
+    let size = null;
+    try {
+      size = fs.statSync(resolved).size;
+    } catch {
+      /* the stat is metadata; a readable file without it still goes through */
+    }
+    if (mime.startsWith("image/")) {
+      try {
+        attachments.push({
+          kind: "image",
+          mime,
+          data: fs.readFileSync(resolved).toString("base64"),
+          path: resolved,
+        });
+      } catch {
+        /* unreadable: the marker below still names the path */
+      }
+      markers.push(`[image attached — saved to ${resolved}]`);
+    } else {
+      markers.push(
+        `[file attached: ${name}, ${mime} — saved to ${resolved}. You can open it with your file tools.]`,
+      );
+    }
+    // One attachment per stored turn, as on every other channel: the ledger row
+    // holds a single file, so a turn sent with several records the first.
+    media ??= {
+      media_kind: kindFromMime(mime),
+      local_path: resolved,
+      file_name: name,
+      mime_type: mime,
+      file_size: size,
+    };
+  }
+  return { attachments, markers, media };
+}
+
+// Body parser for the upload: raw bytes, not multipart (one file per request,
+// so a boundary parser would earn nothing) and not base64 in JSON (which would
+// inflate every image by a third and fight the 2 MB global JSON limit). Its own
+// errors are answered here as JSON — the default is an HTML error page, which a
+// fetch() caller can only report as gibberish.
+const rawBody = express.raw({ type: "*/*", limit: MAX_UPLOAD });
+function readRawBody(req, res, next) {
+  rawBody(req, res, (err) => {
+    if (!err) return next();
+    if (err.type === "entity.too.large") {
+      return res.status(413).json({ error: `file too large (max ${MAX_UPLOAD / (1024 * 1024)} MB)` });
+    }
+    res.status(400).json({ error: err.message || "upload failed" });
+  });
+}
+
+export function register(api) {
+  // Store one attachment the composer is about to send. The name rides in the
+  // query because the body is the file itself; the extension it carries is the
+  // only thing that decides what this is willing to keep.
+  api.post("/media/upload", readRawBody, (req, res) => {
+    const buf = Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0);
+    if (!buf.length) return res.status(400).json({ error: "empty upload" });
+
+    const { name, ext, stem } = safeName(req.query.name);
+    if (!ext || !UPLOAD_EXT.has(ext)) {
+      return res.status(415).json({ error: `file type not allowed: ${ext || "no extension"}` });
+    }
+    if (!magicMatches(ext, buf)) {
+      return res.status(415).json({ error: `the file's bytes do not match ${ext}` });
+    }
+
+    try {
+      const dir = path.join(mediaRoot(), "web");
+      fs.mkdirSync(dir, { recursive: true });
+      // The stored name is ours, never the caller's: a random stem keeps two
+      // uploads of "image.png" apart and keeps a guessed path from reaching a
+      // file that is not the guesser's.
+      const stored = path.join(dir, `${crypto.randomUUID().slice(0, 8)}-${stem}${ext}`);
+      fs.writeFileSync(stored, buf);
+      // The real path is the canonical one: it is what the turn side resolves
+      // to (symlinks and all), so client and daemon name the same file the same
+      // way — on a macOS temp dir, /var and /private/var are the same file and
+      // two different strings.
+      const real = fs.realpathSync(stored);
+      const mime = mimeFor(real);
+      res.status(201).json({
+        path: real,
+        name,
+        mime,
+        kind: kindFromMime(mime),
+        size: buf.length,
+      });
+    } catch (e) {
+      res.status(500).json({ error: e?.message || "upload failed" });
+    }
+  });
+
+  api.get("/media", (req, res) => {
+    const raw = String(req.query.path || "");
+    if (!raw) return res.status(400).json({ error: "path required" });
+    let resolved;
+    try {
+      resolved = resolveInMediaDir(raw);
+    } catch (e) {
+      return res.status(500).json({ error: e?.message || "media read failed" });
+    }
+    if (!resolved) return res.status(404).json({ error: "not found" });
+
+    const mime = MIME[path.extname(resolved).toLowerCase()] || "application/octet-stream";
+    const name = path.basename(resolved).replace(/["\\]/g, "");
+    res.setHeader("Content-Type", mime);
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader(
+      "Content-Disposition",
+      `${INLINE.test(mime) ? "inline" : "attachment"}; filename="${name}"`,
+    );
+    res.setHeader("Cache-Control", "private, max-age=300");
+    const stream = fs.createReadStream(resolved);
+    stream.on("error", () => res.destroy());
+    stream.pipe(res);
+  });
+}

package/src/host/daemon/api/mobility.js

@@ -0,0 +1,177 @@
+import {
+  acceptMobilityEvent,
+  dispatchMobilityEvent,
+  dispatchMobilityPosition,
+} from "#core/mobility/trip-event.js";
+import { acceptMobilityPosition, lockTripErrand, tripErrand, tripPlaces } from "#core/mobility/geofence.js";
+import { answerMobilityAlert, MOBILITY_ANSWERS } from "#core/mobility/answer.js";
+import { doneTask } from "#core/stores/tasks.js";
+import { resolveLang } from "#core/i18n/index.js";
+import {
+  listMobilityAlerts,
+  mobilityContext,
+  recordMobilityAlert,
+  updateMobilityAlert,
+} from "#core/mobility/state.js";
+
+/**
+ * Close the task a proximity alert was about.
+ *
+ * The daemon's half of core/mobility/answer.js: the alert records WHICH project
+ * the task came from, so this resolves that one project rather than searching
+ * every registered one — two projects can hold tasks whose short ids share a
+ * prefix. Mirrors closeAlertTask() in the Telegram adapter, which does the same
+ * thing with the plugin's own registry handle.
+ */
+function closeAlertTaskFor(ctx, alert) {
+  if (!alert?.task_id) return false;
+  let storagePath = null;
+  try {
+    storagePath = ctx.projects?.get(alert.project_id)?.storagePath || null;
+  } catch {
+    storagePath = null;
+  }
+  if (!storagePath) return false;
+  try {
+    return Boolean(doneTask(storagePath, alert.task_id, "mobility"));
+  } catch (error) {
+    console.warn(`[mobility] could not close task ${alert.task_id}: ${error.message}`);
+    return false;
+  }
+}
+
+export function register(api, ctx) {
+  // What the phone's trip banner shows when it is tapped: the current trip and
+  // the errands APX is watching for on it. Read-only and deliberately separate
+  // from the alert path — a driver looking at the list is not being
+  // interrupted by it, so nothing here fires a reminder or spends a one-shot.
+  api.get("/mobility/trip", (req, res) => {
+    const state = mobilityContext();
+    const trip = state.trip?.active ? state.trip : null;
+    res.json({
+      trip,
+      places: trip ? tripPlaces(trip.trip_id) : [],
+    });
+  });
+
+  // A button on the NATIVE card — the phone's notification, or the head unit.
+  //
+  // This is the other half of the alert no longer depending on Telegram: the
+  // card is pushed over the events socket (core/events/bus.js) and answered
+  // here, so a install with no Telegram plugin has a complete round trip.
+  // `navigate` and `add_stop` land on the same branch as "voy": the driver did
+  // not promise to go, they started going.
+  api.post("/mobility/alerts/:id/answer", (req, res) => {
+    const action = String(req.body?.action || "").trim();
+    if (!MOBILITY_ANSWERS.includes(action)) {
+      return res.status(400).json({ error: `action must be one of ${MOBILITY_ANSWERS.join(", ")}` });
+    }
+    const result = answerMobilityAlert(req.params.id, action, {
+      lang: resolveLang(ctx.config),
+      // Closing the task needs the project registry, which core does not have.
+      closeTask: (alert) => closeAlertTaskFor(ctx, alert),
+    });
+    if (!result.ok) {
+      return res.status(result.reason === "unknown-alert" ? 404 : 400).json({ error: result.reason });
+    }
+    res.json({ ok: true, ack: result.ack, alert: result.alert });
+  });
+
+  // "Voy" / "Hoy no" pressed on the phone's own list instead of on the
+  // Telegram card. Same answer, same record, same follow-up after the trip —
+  // the surface is different, the promise is not. Answering here also burns
+  // the one-shot, which is the point: the owner has already decided, so the
+  // proximity alert for that errand has nothing left to ask.
+  api.post("/mobility/errands/answer", (req, res) => {
+    const state = mobilityContext();
+    const trip = state.trip?.active ? state.trip : null;
+    if (!trip) return res.status(409).json({ error: "no trip is running" });
+    const taskId = String(req.body?.task_id || "").trim();
+    const answer = String(req.body?.answer || "").trim();
+    if (!taskId) return res.status(400).json({ error: "task_id required" });
+    // "next" is the phone's half of «avisar en la siguiente»: same three
+    // answers the Telegram card offers, because the docs promise the two
+    // surfaces ask the same question. "skip" stays for the older APK.
+    // "done" is the car's "ya la hice": the owner read the list on the head
+    // unit and is closing the errand from there, without waiting to be asked.
+    // It closes the TASK, which is the one answer here that does.
+    if (!["go", "next", "skip", "done"].includes(answer)) {
+      return res.status(400).json({ error: "answer must be go, next, skip or done" });
+    }
+
+    const existing = listMobilityAlerts()
+      .filter((alert) => alert.trip_id === trip.trip_id && alert.task_id === taskId)
+      .pop();
+    // No alert yet means the owner is answering BEFORE being asked — reading
+    // the list and deciding on their own. That still deserves a record, or the
+    // decision would be forgotten the moment the reminder fired anyway.
+    const alert = existing || (() => {
+      const errand = tripErrand(trip.trip_id, taskId);
+      return errand ? recordMobilityAlert(errand) : null;
+    })();
+    if (!alert) return res.status(404).json({ error: "that errand is not on this trip" });
+
+    const answered_at = new Date().toISOString();
+    // "next" declines the PLACE: the errand stops counting as announced, so a
+    // different shop can raise it again later in the drive, and the outcome
+    // closes it for the after-trip follow-up — nothing was promised here.
+    // "skip" is still the whole errand, for the rest of the trip.
+    if (answer === "done") {
+      // Through core, like every other answer, so closing from the car records
+      // the same outcome as closing from the after-trip follow-up.
+      const result = answerMobilityAlert(alert.id, "done", {
+        lang: resolveLang(ctx.config),
+        closeTask: (target) => closeAlertTaskFor(ctx, target),
+      });
+      return res.json({ ok: true, alert_id: alert.id, answer, ack: result.ack });
+    }
+
+    const patch = {
+      go: { answer: "go", answered_at },
+      next: { answer: "next", answered_at, outcome: "skipped_place" },
+      skip: { answer: "skip", answered_at, outcome: "skipped" },
+    }[answer];
+    updateMobilityAlert(alert.id, patch);
+    if (answer === "go") lockTripErrand(trip.trip_id, taskId, "accepted");
+    res.json({ ok: true, alert_id: alert.id, answer });
+  });
+
+  api.post("/mobility/events", (req, res) => {
+    let event;
+    try {
+      event = acceptMobilityEvent(req.body);
+    } catch (error) {
+      return res.status(400).json({ error: error.message });
+    }
+    if (event.duplicate) return res.json({ accepted: true, duplicate: true, event_id: event.event_id });
+    res.status(202).json({ accepted: true, event_id: event.event_id });
+    const dispatch = ctx.mobilityDispatch || dispatchMobilityEvent;
+    setImmediate(() => {
+      Promise.resolve(dispatch(event, ctx)).catch((error) => {
+        console.error(`[mobility] ${error?.message || error}`);
+      });
+    });
+  });
+
+  // The live GPS stream while a trip is running. Answered before any work for
+  // the same reason the event route is: the phone is on mobile data in a
+  // moving car, and a request it has to hold open until a place search and a
+  // Telegram send have finished is a request that times out. Proximity is
+  // evaluated after the ack, and the one-alert-per-place guarantee lives in
+  // core/mobility/geofence.js, not here.
+  api.post("/mobility/positions", (req, res) => {
+    let position;
+    try {
+      position = acceptMobilityPosition(req.body);
+    } catch (error) {
+      return res.status(400).json({ error: error.message });
+    }
+    res.status(202).json({ accepted: true, trip_id: position.trip_id });
+    const dispatch = ctx.mobilityPositionDispatch || dispatchMobilityPosition;
+    setImmediate(() => {
+      Promise.resolve(dispatch(position, ctx)).catch((error) => {
+        console.error(`[mobility] ${error?.message || error}`);
+      });
+    });
+  });
+}

package/src/host/daemon/api/net.js

@@ -0,0 +1,182 @@
+// GET  /net/endpoints        every URL this daemon can be reached at
+// POST /net/tailscale/serve  publish it over HTTPS on the tailnet
+// DELETE /net/tailscale/serve  stop publishing
+//
+// One daemon, several addresses: loopback for the toolchain, a LAN address for
+// a phone on the same Wi-Fi, and — when Tailscale is up — a name that keeps
+// working from a train. The panel needs the whole list for two reasons: to show
+// you which URL to install the app from, and so a client whose address stopped
+// answering can try the others instead of just failing.
+//
+// The HTTPS one is not interchangeable with the others. Service workers (the
+// installable app), getUserMedia (voice notes) and the clipboard are all gated
+// on a secure context, so over http://192.168.x.x the browser switches them
+// off. `tailscale serve` is the only way to a real certificate here that does
+// not involve buying a domain.
+import os from "node:os";
+import { effectivePort, effectiveHost, readConfig } from "#core/config/index.js";
+import { detectLanAddresses, isLoopback, isWildcard } from "#core/net/lan.js";
+import {
+  disableTailscaleServe,
+  enableTailscaleServe,
+  tailscaleServe,
+  tailscaleStatus,
+} from "#core/net/tailscale.js";
+import { asyncRoute } from "./shared.js";
+
+/** A Tailscale address, so a LAN scan does not report the tailnet as Wi-Fi. */
+function isTailscaleAddress(address, iface) {
+  if (/^utun|^tailscale/i.test(String(iface || ""))) return true;
+  const p = String(address || "").split(".").map(Number);
+  // 100.64.0.0/10 — the CGNAT range Tailscale hands out.
+  return p[0] === 100 && p[1] >= 64 && p[1] <= 127;
+}
+
+/**
+ * Every base URL that reaches this daemon, best first.
+ *
+ * "Best" is ordered by how long it keeps working: the HTTPS tailnet name (from
+ * anywhere, and a secure context), then the tailnet IP, then the LAN, then
+ * loopback, which only ever helps the machine it runs on.
+ */
+export async function reachableEndpoints({ port, host }) {
+  const out = [];
+  const ts = await tailscaleStatus();
+  const serve = ts.running ? await tailscaleServe(port) : { serving: false, url: null };
+
+  if (serve.serving && serve.url) {
+    out.push({ url: serve.url, kind: "tailscale-https", label: ts.dnsName || "tailscale", secure: true });
+  }
+  if (ts.running && ts.ipv4) {
+    out.push({ url: `http://${ts.ipv4}:${port}`, kind: "tailscale", label: ts.hostname || "tailscale", secure: false });
+  }
+
+  // A daemon bound to one specific address is only reachable there; a wildcard
+  // (or loopback-only, which still runs the LAN listener when shared) is
+  // reachable at every interface it holds.
+  const bound = host && !isLoopback(host) && !isWildcard(host) ? host : null;
+  if (bound && !out.some((e) => e.url.includes(bound))) {
+    out.push({ url: `http://${bound}:${port}`, kind: "lan", label: "LAN", secure: false });
+  }
+  if (!bound) {
+    for (const a of detectLanAddresses()) {
+      if (isTailscaleAddress(a.address, a.iface)) continue;
+      out.push({ url: `http://${a.address}:${port}`, kind: "lan", label: a.iface, secure: false });
+    }
+  }
+
+  out.push({ url: `http://127.0.0.1:${port}`, kind: "loopback", label: os.hostname(), secure: true });
+  // Deduplicate while keeping the first (best) spelling of each URL.
+  const seen = new Set();
+  return out.filter((e) => (seen.has(e.url) ? false : seen.add(e.url)));
+}
+
+/** Hostnames that are this daemon under another name — the CORS allowlist. */
+export async function selfOrigins({ port, host }) {
+  const eps = await reachableEndpoints({ port, host });
+  return new Set(eps.map((e) => new URL(e.url).host));
+}
+
+// ── CORS, narrowly: this daemon under one of its OWN other names ───────────
+//
+// The panel installed from one address (say the LAN) can end up talking to
+// another (the tailnet) when the first stops answering. That is a cross-origin
+// request to the same process, and it needs a header to be allowed — but only
+// for hosts that ARE us. Anything else, including a page on the same port at
+// some other hostname, gets nothing.
+//
+// The allowlist is cached: building it asks Tailscale, which is far too slow to
+// do per request. Loopback and the LAN are known synchronously and seeded
+// immediately, so the first request is answered correctly even before the
+// asynchronous half lands.
+const CORS_TTL_MS = 30_000;
+let allowCache = { at: 0, hosts: null, refreshing: false };
+
+function knownHostsSync({ port, host }) {
+  const hosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+  if (host && !isLoopback(host) && !isWildcard(host)) hosts.add(`${host}:${port}`);
+  for (const a of detectLanAddresses()) hosts.add(`${a.address}:${port}`);
+  return hosts;
+}
+
+function refreshAllowed(ctx) {
+  if (allowCache.refreshing) return;
+  allowCache.refreshing = true;
+  selfOrigins(ctx)
+    .then((hosts) => {
+      allowCache = { at: Date.now(), hosts, refreshing: false };
+    })
+    .catch(() => {
+      allowCache = { ...allowCache, at: Date.now(), refreshing: false };
+    });
+}
+
+/** Express middleware allowing cross-origin calls between our own addresses. */
+export function corsBetweenOwnAddresses({ port, host }) {
+  const ctx = { port, host };
+  return function cors(req, res, next) {
+    const origin = req.headers.origin;
+    if (!origin) return next();
+    if (!allowCache.hosts || Date.now() - allowCache.at > CORS_TTL_MS) {
+      if (!allowCache.hosts) allowCache = { ...allowCache, hosts: knownHostsSync(ctx) };
+      refreshAllowed(ctx);
+    }
+    let originHost = "";
+    try {
+      originHost = new URL(origin).host;
+    } catch {
+      return next();
+    }
+    if (!allowCache.hosts.has(originHost)) return next();
+    res.setHeader("access-control-allow-origin", origin);
+    res.setHeader("vary", "Origin");
+    res.setHeader("access-control-allow-credentials", "true");
+    if (req.method === "OPTIONS") {
+      res.setHeader("access-control-allow-methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS");
+      res.setHeader(
+        "access-control-allow-headers",
+        req.headers["access-control-request-headers"] || "authorization,content-type",
+      );
+      res.setHeader("access-control-max-age", "600");
+      return res.status(204).end();
+    }
+    return next();
+  };
+}
+
+export function register(api) {
+  api.get("/net/endpoints", asyncRoute(async (_req, res) => {
+    const cfg = readConfig();
+    const port = effectivePort(cfg);
+    const host = effectiveHost(cfg);
+    const ts = await tailscaleStatus();
+    const serve = ts.installed ? await tailscaleServe(port) : { serving: false, url: null, error: null };
+    res.json({
+      port,
+      bind: host,
+      shared: !isLoopback(host),
+      endpoints: await reachableEndpoints({ port, host }),
+      tailscale: { ...ts, serving: serve.serving, serve_url: serve.url, serve_error: serve.error },
+    });
+  }));
+
+  api.post("/net/tailscale/serve", asyncRoute(async (_req, res) => {
+    const port = effectivePort(readConfig());
+    try {
+      const out = await enableTailscaleServe(port);
+      res.json({ ok: true, ...out });
+    } catch (e) {
+      res.status(400).json({ ok: false, error: e.message });
+    }
+  }));
+
+  api.delete("/net/tailscale/serve", asyncRoute(async (_req, res) => {
+    const port = effectivePort(readConfig());
+    try {
+      const out = await disableTailscaleServe(port);
+      res.json({ ok: true, ...out });
+    } catch (e) {
+      res.status(400).json({ ok: false, error: e.message });
+    }
+  }));
+}