@jossuealcala/madre 0.7.1 → 1.0.0

package/src/bridge/qr.mjs

@@ -0,0 +1,287 @@
+// The QR a phone scans to pair with this Mac: text in, a grid of dark and light modules out, and
+// an SVG of that grid the room sizes and colours with CSS.
+//
+// Zero dependencies because MADRE ships none. Byte mode only (UTF-8), versions 1–40, levels
+// L/M/Q/H, the smallest version that fits and the mask with the lowest penalty. The symbol is the
+// one the `qrcode` package draws, module for module, mask choice included: the tests pin it.
+
+// The two bits each level writes into the format information.
+const LEVELS = { L: 1, M: 0, Q: 3, H: 2 };
+
+// By level, for versions 1–40: error-correction codewords per block, and how many blocks.
+const EC_PER_BLOCK = {
+  L: [7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28, 28, 28, 30, 30, 26, 28, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+  M: [10, 16, 26, 18, 24, 16, 18, 22, 22, 26, 30, 22, 22, 24, 24, 28, 28, 26, 26, 26, 26, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28],
+  Q: [13, 22, 18, 26, 18, 24, 18, 22, 20, 24, 28, 26, 24, 20, 30, 24, 28, 28, 26, 30, 28, 30, 30, 30, 30, 28, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+  H: [17, 28, 22, 16, 22, 28, 26, 26, 24, 28, 24, 28, 22, 24, 24, 30, 28, 28, 26, 28, 30, 24, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+};
+const BLOCKS = {
+  L: [1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8, 8, 9, 9, 10, 12, 12, 12, 13, 14, 15, 16, 17, 18, 19, 19, 20, 21, 22, 24, 25],
+  M: [1, 1, 1, 2, 2, 4, 4, 4, 5, 5, 5, 8, 9, 9, 10, 10, 11, 13, 14, 16, 17, 17, 18, 20, 21, 23, 25, 26, 28, 29, 31, 33, 35, 37, 38, 40, 43, 45, 47, 49],
+  Q: [1, 1, 2, 2, 4, 4, 6, 6, 8, 8, 8, 10, 12, 16, 12, 17, 16, 18, 21, 20, 23, 23, 25, 27, 29, 34, 34, 35, 38, 40, 43, 45, 48, 51, 53, 56, 59, 62, 65, 68],
+  H: [1, 1, 2, 4, 4, 4, 5, 6, 8, 8, 11, 11, 16, 16, 18, 16, 19, 21, 25, 25, 25, 34, 30, 32, 35, 37, 40, 42, 45, 48, 51, 54, 57, 60, 63, 66, 70, 74, 77, 81],
+};
+
+// GF(256) over x^8 + x^4 + x^3 + x^2 + 1, for Reed–Solomon.
+const EXP = new Uint8Array(512);
+const LOG = new Uint8Array(256);
+for (let i = 0, x = 1; i < 255; i++, x = (x << 1) ^ (x & 0x80 ? 0x11d : 0)) {
+  EXP[i] = EXP[i + 255] = x;
+  LOG[x] = i;
+}
+const mul = (a, b) => (a && b ? EXP[LOG[a] + LOG[b]] : 0);
+
+const MASKS = [
+  (r, c) => (r + c) % 2 === 0,
+  (r) => r % 2 === 0,
+  (r, c) => c % 3 === 0,
+  (r, c) => (r + c) % 3 === 0,
+  (r, c) => (Math.floor(r / 2) + Math.floor(c / 3)) % 2 === 0,
+  (r, c) => ((r * c) % 2) + ((r * c) % 3) === 0,
+  (r, c) => (((r * c) % 2) + ((r * c) % 3)) % 2 === 0,
+  (r, c) => (((r + c) % 2) + ((r * c) % 3)) % 2 === 0,
+];
+
+const sideOf = (version) => version * 4 + 17;
+
+// Every codeword the symbol holds, data and error correction: what is left once the function
+// patterns, format and version information have taken their modules.
+function rawCodewords(version) {
+  let bits = (16 * version + 128) * version + 64;
+  if (version >= 2) {
+    const n = Math.floor(version / 7) + 2;
+    bits -= (25 * n - 10) * n - 55;
+    if (version >= 7) bits -= 36;
+  }
+  return bits >> 3;
+}
+
+const dataCodewords = (version, level) => rawCodewords(version) - EC_PER_BLOCK[level][version - 1] * BLOCKS[level][version - 1];
+
+function alignmentCentres(version) {
+  if (version === 1) return [];
+  const n = Math.floor(version / 7) + 2;
+  const step = Math.floor((version * 8 + n * 3 + 5) / (n * 4 - 4)) * 2;
+  const centres = [6];
+  for (let at = sideOf(version) - 7; centres.length < n; at -= step) centres.splice(1, 0, at);
+  return centres;
+}
+
+// The generator polynomial of the given degree, leading 1 left out.
+function generator(degree) {
+  const poly = new Uint8Array(degree);
+  poly[degree - 1] = 1;
+  for (let i = 0, root = 1; i < degree; i++, root = mul(root, 2)) {
+    for (let j = 0; j < degree; j++) poly[j] = mul(poly[j], root) ^ (j + 1 < degree ? poly[j + 1] : 0);
+  }
+  return poly;
+}
+
+function remainder(data, poly) {
+  const out = new Uint8Array(poly.length);
+  for (const byte of data) {
+    const factor = byte ^ out[0];
+    out.copyWithin(0, 1);
+    out[out.length - 1] = 0;
+    for (let i = 0; i < poly.length; i++) out[i] ^= mul(poly[i], factor);
+  }
+  return out;
+}
+
+// Mode, count, the bytes, terminator and padding; then split into blocks, each with its error
+// correction, and interleaved.
+function codewords(bytes, version, level) {
+  const capacity = dataCodewords(version, level);
+  const bits = [];
+  const put = (value, length) => {
+    for (let i = length - 1; i >= 0; i--) bits.push((value >>> i) & 1);
+  };
+  put(0b0100, 4);
+  put(bytes.length, version < 10 ? 8 : 16);
+  for (const byte of bytes) put(byte, 8);
+  put(0, Math.min(4, capacity * 8 - bits.length));
+  put(0, (8 - (bits.length % 8)) % 8);
+  const data = new Uint8Array(capacity);
+  for (let i = 0; i < bits.length; i++) data[i >> 3] |= bits[i] << (7 - (i & 7));
+  for (let i = bits.length >> 3, pad = 0xec; i < capacity; i++, pad ^= 0xec ^ 0x11) data[i] = pad;
+
+  const blocks = BLOCKS[level][version - 1];
+  const ecLength = EC_PER_BLOCK[level][version - 1];
+  const raw = rawCodewords(version);
+  const shortBlocks = blocks - (raw % blocks);
+  const shortLength = Math.floor(raw / blocks) - ecLength;
+  const poly = generator(ecLength);
+  const dataBlocks = [];
+  const ecBlocks = [];
+  for (let b = 0, at = 0; b < blocks; b++) {
+    const block = data.subarray(at, (at += shortLength + (b < shortBlocks ? 0 : 1)));
+    dataBlocks.push(block);
+    ecBlocks.push(remainder(block, poly));
+  }
+  const out = [];
+  for (let i = 0; i <= shortLength; i++) for (const block of dataBlocks) if (i < block.length) out.push(block[i]);
+  for (let i = 0; i < ecLength; i++) for (const block of ecBlocks) out.push(block[i]);
+  return out;
+}
+
+// The penalty the `qrcode` package scores a mask with: runs of five or more (N1), 2×2 blocks
+// (N2), finder-like runs inside the symbol (N3) and the share of dark modules in 5% steps (N4).
+function penalty(dark, size) {
+  let score = 0;
+  for (let a = 0; a < size; a++) {
+    for (const [start, step] of [[a * size, 1], [a, size]]) {
+      let run = 0;
+      let last = -1;
+      let window = 0;
+      for (let b = 0; b < size; b++) {
+        const on = dark[start + b * step];
+        if (on === last) run++;
+        else {
+          if (run >= 5) score += run - 2;
+          last = on;
+          run = 1;
+        }
+        window = ((window << 1) & 0x7ff) | on;
+        if (b >= 10 && (window === 0x5d0 || window === 0x05d)) score += 40;
+      }
+      if (run >= 5) score += run - 2;
+    }
+  }
+  for (let r = 0; r < size - 1; r++) {
+    for (let c = 0; c < size - 1; c++) {
+      const at = r * size + c;
+      const sum = dark[at] + dark[at + 1] + dark[at + size] + dark[at + size + 1];
+      if (sum === 0 || sum === 4) score += 3;
+    }
+  }
+  let total = 0;
+  for (const on of dark) total += on;
+  return score + Math.abs(Math.ceil(total * 100 / dark.length / 5) - 10) * 10;
+}
+
+export function qrMatrix(text, { ecc = 'M' } = {}) {
+  const level = String(ecc).toUpperCase();
+  if (!Object.hasOwn(LEVELS, level)) throw new Error(`QR: unknown error correction level ${ecc}`);
+  const bytes = new TextEncoder().encode(String(text ?? ''));
+  let version = 1;
+  while (version <= 40 && 4 + (version < 10 ? 8 : 16) + bytes.length * 8 > dataCodewords(version, level) * 8) version++;
+  if (version > 40) throw new Error(`QR: ${bytes.length} bytes do not fit at level ${level}`);
+
+  const size = sideOf(version);
+  const dark = new Uint8Array(size * size);
+  const fixed = new Uint8Array(size * size);
+  const set = (r, c, on) => {
+    dark[r * size + c] = on ? 1 : 0;
+    fixed[r * size + c] = 1;
+  };
+
+  // Finders with their light separators: rings at distance 2 and 4 from the centre are light.
+  for (const [top, left] of [[0, 0], [0, size - 7], [size - 7, 0]]) {
+    for (let r = -1; r <= 7; r++) {
+      for (let c = -1; c <= 7; c++) {
+        if (top + r < 0 || top + r >= size || left + c < 0 || left + c >= size) continue;
+        const ring = Math.max(Math.abs(r - 3), Math.abs(c - 3));
+        set(top + r, left + c, ring !== 2 && ring !== 4);
+      }
+    }
+  }
+  for (let i = 8; i < size - 8; i++) {
+    set(i, 6, i % 2 === 0);
+    set(6, i, i % 2 === 0);
+  }
+  const centres = alignmentCentres(version);
+  const last = centres.length - 1;
+  for (let i = 0; i <= last; i++) {
+    for (let j = 0; j <= last; j++) {
+      if ((i === 0 && (j === 0 || j === last)) || (i === last && j === 0)) continue;
+      for (let r = -2; r <= 2; r++) {
+        for (let c = -2; c <= 2; c++) set(centres[i] + r, centres[j] + c, Math.max(Math.abs(r), Math.abs(c)) !== 1);
+      }
+    }
+  }
+
+  // Format information: level and mask with a BCH(15,5) check, twice, plus the one dark module.
+  const format = (mask) => {
+    const data = (LEVELS[level] << 3) | mask;
+    let rem = data;
+    for (let i = 0; i < 10; i++) rem = (rem << 1) ^ ((rem >>> 9) * 0x537);
+    const bits = ((data << 10) | rem) ^ 0x5412;
+    for (let i = 0; i < 15; i++) {
+      const on = (bits >>> i) & 1;
+      set(i < 6 ? i : i < 8 ? i + 1 : size - 15 + i, 8, on);
+      set(8, i < 8 ? size - 1 - i : i === 8 ? 7 : 14 - i, on);
+    }
+    set(size - 8, 8, 1);
+  };
+  format(0);
+
+  // Version information from 7 up: the version with a Golay(18,6) check, in both corners.
+  if (version >= 7) {
+    let rem = version;
+    for (let i = 0; i < 12; i++) rem = (rem << 1) ^ ((rem >>> 11) * 0x1f25);
+    const bits = (version << 12) | rem;
+    for (let i = 0; i < 18; i++) {
+      const on = (bits >>> i) & 1;
+      const a = Math.floor(i / 3);
+      const b = size - 11 + (i % 3);
+      set(a, b, on);
+      set(b, a, on);
+    }
+  }
+
+  // Codewords zigzag up and down two columns at a time from the right, around the timing column.
+  const words = codewords(bytes, version, level);
+  for (let right = size - 1, i = 0; right >= 1; right -= 2) {
+    if (right === 6) right = 5;
+    const upward = ((right + 1) & 2) === 0;
+    for (let step = 0; step < size; step++) {
+      const r = upward ? size - 1 - step : step;
+      for (let c = right; c > right - 2; c--) {
+        if (fixed[r * size + c]) continue;
+        if (i < words.length * 8) dark[r * size + c] = (words[i >> 3] >>> (7 - (i & 7))) & 1;
+        i++;
+      }
+    }
+  }
+
+  const applyMask = (mask) => {
+    for (let r = 0; r < size; r++) {
+      for (let c = 0; c < size; c++) if (!fixed[r * size + c] && MASKS[mask](r, c)) dark[r * size + c] ^= 1;
+    }
+  };
+  let best = 0;
+  let lowest = Infinity;
+  for (let mask = 0; mask < 8; mask++) {
+    format(mask);
+    applyMask(mask);
+    const score = penalty(dark, size);
+    applyMask(mask);
+    if (score < lowest) [best, lowest] = [mask, score];
+  }
+  format(best);
+  applyMask(best);
+
+  const modules = [];
+  for (let r = 0; r < size; r++) modules.push(Array.from(dark.subarray(r * size, (r + 1) * size), Boolean));
+  return { size, modules };
+}
+
+const escapeAttribute = (value) => String(value).replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+
+// One path for every dark module, a row's runs merged into one rectangle each. No size and no
+// background: the page decides how big it is and what it sits on.
+export function qrSvg(text, { ecc = 'M', margin = 2, label = 'QR' } = {}) {
+  const { size, modules } = qrMatrix(text, { ecc });
+  const pad = Math.max(0, Math.trunc(margin) || 0);
+  let d = '';
+  modules.forEach((row, y) => {
+    for (let x = 0; x < size; x++) {
+      if (!row[x]) continue;
+      const start = x;
+      while (x < size && row[x]) x++;
+      d += `M${start + pad} ${y + pad}h${x - start}v1h-${x - start}z`;
+    }
+  });
+  const side = size + pad * 2;
+  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${side} ${side}" role="img" aria-label="${escapeAttribute(label)}"><path fill="currentColor" shape-rendering="crispEdges" d="${d}"/></svg>`;
+}

package/src/bridge/server.mjs

@@ -0,0 +1,269 @@
+// The bridge: the one thing on this Mac a phone can reach (docs/MOBILE.md, MOV-001).
+//
+// Rooms keep listening on 127.0.0.1 and keep refusing anything that does not call them by that
+// name (src/request-guard.mjs). The bridge listens on the local network, lets in only a phone that
+// was paired with a QR, and passes its requests on to the room it chose, as 127.0.0.1, under the
+// phone's policy (policy.mjs). The room's own page is served as it is: the room it belongs to is
+// picked by a cookie, so every absolute path in it keeps working behind the bridge.
+//
+// Before anything else a request has to come from a private address and name this Mac by one of
+// its own names. Everything a phone sends that changes something has to come from the bridge's own
+// pages. A phone that is not paired gets a page that says how to pair it, and nothing else.
+
+import http from 'node:http';
+import { hostname } from 'node:os';
+import { readdir, readFile } from 'node:fs/promises';
+import { extname, join, normalize, sep } from 'node:path';
+import { language, t } from '../i18n.mjs';
+import { readHandoff } from './handoff.mjs';
+import { deviceForToken, readStore, redeemInvite } from './devices.mjs';
+import { isPrivateAddress, lanAddresses } from './network.mjs';
+import { inspects, phonePolicy } from './policy.mjs';
+import { salasRoomId } from '../salas.mjs';
+
+export const BRIDGE_PORT = 4316;
+const PHONE_COOKIE = 'madre_phone';
+const ROOM_COOKIE = 'madre_room';
+const MONTH_S = 30 * 24 * 60 * 60;
+const MESSAGE_LIMIT = 1024 * 1024;
+
+const MIME = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.svg': 'image/svg+xml', '.webp': 'image/webp', '.png': 'image/png', '.woff2': 'font/woff2', '.txt': 'text/plain; charset=utf-8', '.webmanifest': 'application/manifest+json' };
+// The bridge's own files, served from the package of the room that hosts it.
+const OWN = { '/salas': 'salas.html', '/bridge/salas.js': 'salas.js', '/bridge/salas.css': 'salas.css', '/bridge/styles.css': 'styles.css', '/bridge/i18n.js': 'i18n.js', '/bridge/es.js': 'es.js', '/bridge/touch.js': 'touch.js', '/bridge/manifest.webmanifest': 'manifest.webmanifest' };
+const HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade', 'host', 'cookie', 'origin', 'referer']);
+
+const alive = (pid) => { try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; } };
+
+// Every room open on this Mac, from the marks the rooms leave (src/server.mjs, open.json).
+export async function roomsOnThisMac(root) {
+  const dir = join(root, 'rooms');
+  const names = await readdir(dir).catch(() => []);
+  const out = [];
+  for (const id of names) {
+    const mark = await readFile(join(dir, id, 'open.json'), 'utf8').then((raw) => JSON.parse(raw)).catch(() => null);
+    if (!mark || !Number.isInteger(mark.pid) || !Number.isInteger(mark.port) || mark.port < 1 || mark.port > 65535 || !alive(mark.pid)) continue;
+    out.push({ id, port: mark.port, project: typeof mark.project === 'string' ? mark.project : id.replace(/-[0-9a-f]{16}$/, ''), version: mark.version ?? null, at: mark.at ?? null });
+  }
+  return out.sort((a, b) => a.project.localeCompare(b.project));
+}
+
+export function parseCookies(header = '') {
+  const out = {};
+  for (const part of String(header).split(';')) {
+    const at = part.indexOf('=');
+    if (at < 1) continue;
+    const name = part.slice(0, at).trim();
+    if (!Object.hasOwn(out, name)) out[name] = decodeURIComponent(part.slice(at + 1).trim());
+  }
+  return out;
+}
+
+const cookie = (name, value, maxAge) => `${name}=${encodeURIComponent(value)}; Path=/; Max-Age=${maxAge}; HttpOnly; SameSite=Strict`;
+
+// The names a phone may use for this Mac: its addresses on the network, its own name, and loopback.
+export function ownHosts(port, { addresses = lanAddresses(), name = hostname() } = {}) {
+  const hosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+  for (const address of addresses) hosts.add(`${address}:${port}`);
+  if (name) {
+    const bare = name.replace(/\.local$/i, '');
+    hosts.add(`${bare}.local:${port}`.toLowerCase());
+    hosts.add(`${bare}:${port}`.toLowerCase());
+  }
+  return hosts;
+}
+
+const SECURITY = { 'x-content-type-options': 'nosniff', 'referrer-policy': 'no-referrer', 'x-frame-options': 'DENY' };
+const OWN_CSP = "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'";
+
+function sendJson(response, status, body, headers = {}) {
+  const text = JSON.stringify(body);
+  response.writeHead(status, { ...SECURITY, 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', ...headers });
+  response.end(text);
+}
+
+const escapeHtml = (text) => String(text).replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[char]));
+
+// A page of one sentence, for a phone that cannot go further.
+function sendNote(response, status, title, sentence) {
+  const html = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>MADRE</title><link rel="stylesheet" href="/bridge/styles.css"><link rel="stylesheet" href="/bridge/salas.css"></head><body class="salas note"><main><h1>${escapeHtml(title)}</h1><p>${escapeHtml(sentence)}</p></main></body></html>`;
+  response.writeHead(status, { ...SECURITY, 'content-security-policy': OWN_CSP, 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+  response.end(html);
+}
+
+const wantsPage = (request, pathname) => request.method === 'GET' && (pathname === '/' || pathname === '/salas' || String(request.headers.accept ?? '').includes('text/html'));
+
+function readBody(request, limit) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    request.on('data', (chunk) => {
+      size += chunk.length;
+      if (size > limit) { reject(Object.assign(new Error('too large'), { status: 413 })); request.destroy(); return; }
+      chunks.push(chunk);
+    });
+    request.on('end', () => resolve(Buffer.concat(chunks)));
+    request.on('error', reject);
+  });
+}
+
+// A short memory of who knocked, so a phone cannot be guessed into by trying codes or tokens.
+function limiter({ perMinute }) {
+  const seen = new Map();
+  return (key, now = Date.now()) => {
+    const bucket = seen.get(key) ?? { at: now, n: 0 };
+    if (now - bucket.at > 60_000) { bucket.at = now; bucket.n = 0; }
+    bucket.n += 1;
+    seen.set(key, bucket);
+    if (seen.size > 2000) seen.clear();
+    return bucket.n <= perMinute;
+  };
+}
+
+// What a room says about itself in one line, for the list of rooms on the phone.
+async function glance(room, device) {
+  try {
+    // The archive counted too (docs/MACROVERSO.md): on a phone the macroverse is this one line per room.
+    const response = await fetch(`http://127.0.0.1:${room.port}/api/glance?census=1`, { headers: { 'x-madre-device': device.id, 'x-madre-device-kind': device.kind }, signal: AbortSignal.timeout(1500) });
+    if (response.status === 404) return { outdated: true };
+    if (!response.ok) return { unreachable: true };
+    return await response.json();
+  } catch {
+    return { unreachable: true };
+  }
+}
+
+export function createBridge({ root, port = BRIDGE_PORT, publicDirectory, hosts = () => ownHosts(port), now = () => Date.now() }) {
+  const strangers = limiter({ perMinute: 30 });
+  const phones = limiter({ perMinute: 900 });
+
+  async function serveOwn(response, pathname) {
+    const file = OWN[pathname];
+    const body = await readFile(join(publicDirectory, file));
+    response.writeHead(200, { ...SECURITY, 'content-security-policy': OWN_CSP, 'content-type': MIME[extname(file)] ?? 'application/octet-stream', 'cache-control': 'no-cache' });
+    response.end(body);
+  }
+
+  // The package's own pictures and fonts, when this copy has them; otherwise the room's.
+  async function serveAsset(response, pathname) {
+    const relative = normalize(decodeURIComponent(pathname)).replace(/^[/\\]+/, '');
+    const file = join(publicDirectory, relative);
+    if (!file.startsWith(join(publicDirectory, 'assets') + sep)) return false;
+    const body = await readFile(file).catch(() => null);
+    if (!body) return false;
+    response.writeHead(200, { ...SECURITY, 'content-type': MIME[extname(file).toLowerCase()] ?? 'application/octet-stream', 'cache-control': 'private, max-age=3600' });
+    response.end(body);
+    return true;
+  }
+
+  async function pass(request, response, url, room, device) {
+    let buffered = null;
+    let body = null;
+    if (inspects(request.method, url.pathname)) {
+      buffered = await readBody(request, MESSAGE_LIMIT);
+      try { body = JSON.parse(buffered.toString('utf8') || '{}'); } catch { return sendJson(response, 400, { error: t('The message could not be read.') }); }
+    }
+    const verdict = phonePolicy({ method: request.method, pathname: url.pathname, body });
+    if (!verdict.allow) return sendJson(response, verdict.status, { error: verdict.error, phone: true });
+    const headers = {};
+    for (const [name, value] of Object.entries(request.headers)) {
+      if (!HOP.has(name) && !name.startsWith('x-madre-')) headers[name] = value;
+    }
+    headers.host = `127.0.0.1:${room.port}`;
+    if (request.headers.origin) headers.origin = `http://127.0.0.1:${room.port}`;
+    headers['x-madre-device'] = device.id;
+    headers['x-madre-device-kind'] = device.kind;
+    if (buffered) headers['content-length'] = String(buffered.length);
+    const upstream = http.request({ host: '127.0.0.1', port: room.port, method: request.method, path: url.pathname + url.search, headers }, (answer) => {
+      const out = { ...SECURITY };
+      for (const [name, value] of Object.entries(answer.headers)) if (!HOP.has(name) && name !== 'set-cookie') out[name] = value;
+      // Two rooms may be two versions of MADRE behind the same address: nothing of one is reused for the other.
+      if (!url.pathname.startsWith('/assets/')) out['cache-control'] = 'no-store';
+      out.vary = 'Cookie';
+      response.writeHead(answer.statusCode ?? 502, out);
+      answer.pipe(response);
+    });
+    upstream.on('error', () => { if (!response.headersSent) sendJson(response, 502, { error: t('That project did not answer. It may have just closed on your Mac.') }); else response.end(); });
+    // A phone that leaves (a stream it stops reading) takes its request to the room with it.
+    response.on('close', () => upstream.destroy());
+    if (buffered) upstream.end(buffered);
+    else request.pipe(upstream);
+  }
+
+  async function handle(request, response) {
+    const remote = request.socket.remoteAddress ?? '';
+    if (!isPrivateAddress(remote)) { request.socket.destroy(); return; }
+    const host = String(request.headers.host ?? '').toLowerCase();
+    if (!hosts().has(host)) return sendJson(response, 421, { error: t('MADRE answers only when it is called by this computer\'s name (127.0.0.1 or localhost).') });
+    const url = new URL(request.url ?? '/', `http://${host}`);
+
+    if (request.method === 'GET' && url.pathname === '/bridge/ping') return sendJson(response, 200, { madre: true });
+
+    if (request.method === 'GET' && url.pathname === '/bridge/pair') {
+      if (!strangers(`pair:${remote}`)) return sendNote(response, 429, t('Too many tries'), t('Wait a minute and scan the code again.'));
+      const paired = await redeemInvite(root, url.searchParams.get('c') ?? '', { userAgent: request.headers['user-agent'] ?? '', now: now() });
+      if (!paired) return sendNote(response, 410, t('This code no longer works'), t('Each code works once and for ten minutes. Make a new one on your Mac: MADRE on your phone, in the bar.'));
+      response.writeHead(303, { ...SECURITY, location: '/salas?listo=1', 'set-cookie': cookie(PHONE_COOKIE, paired.token, MONTH_S), 'cache-control': 'no-store' });
+      return response.end();
+    }
+    // The product's own stylesheets, for the page that tells an unpaired phone how to pair.
+    if (request.method === 'GET' && (url.pathname === '/bridge/salas.css' || url.pathname === '/bridge/styles.css')) return serveOwn(response, url.pathname);
+
+    const cookies = parseCookies(request.headers.cookie);
+    const store = await readStore(root);
+    const device = store.enabled ? await deviceForToken(root, cookies[PHONE_COOKIE], { now: now(), store }) : null;
+    if (!device) {
+      if (!strangers(`token:${remote}`)) return sendJson(response, 429, { error: t('Too many tries') });
+      if (wantsPage(request, url.pathname)) return sendNote(response, 401, t('This phone is not paired'), t('On your Mac, in the bar, press MADRE on your phone and scan the code with this phone\'s camera.'));
+      return sendJson(response, 401, { error: t('This phone is not paired.'), pair: true });
+    }
+    if (!phones(device.id)) return sendJson(response, 429, { error: t('Too many requests from this phone. Wait a moment.') });
+
+    // What changes something has to come from these pages.
+    if (!['GET', 'HEAD'].includes(request.method)) {
+      const site = request.headers['sec-fetch-site'];
+      const origin = request.headers.origin;
+      if ((site && site !== 'same-origin') || (origin && origin !== `http://${host}`)) return sendJson(response, 403, { error: t('A page from somewhere else cannot act in this project.') });
+    }
+
+    if (request.method === 'GET' && OWN[url.pathname]) {
+      if (url.pathname === '/salas') response.setHeader('set-cookie', cookie(PHONE_COOKIE, cookies[PHONE_COOKIE], MONTH_S));
+      return serveOwn(response, url.pathname);
+    }
+    if (request.method === 'GET' && url.pathname === '/bridge/rooms') {
+      const rooms = await roomsOnThisMac(root);
+      // The Coordinator's own project says so: the phone names it as Home on the Mac does.
+      const coordinator = salasRoomId(root);
+      const seen = await Promise.all(rooms.map(async (room) => ({ id: room.id, project: room.project, ...(room.id === coordinator ? { coordinator: true } : {}), ...(await glance(room, device)) })));
+      // Where the person stood on the Mac, offered when it is newer than where they stood here.
+      const where = await readHandoff(root);
+      const carry = where.mac && (!where.phone || where.mac.at > where.phone.at) && now() - where.mac.at < 12 * 60 * 60 * 1000 ? where.mac : null;
+      return sendJson(response, 200, { mac: hostname().replace(/\.local$/i, ''), language: language(), device, rooms: seen, chosen: cookies[ROOM_COOKIE] ?? null, handoff: carry });
+    }
+    if (request.method === 'POST' && url.pathname === '/bridge/open') {
+      const payload = await readBody(request, 4096).then((raw) => JSON.parse(raw.toString('utf8') || '{}')).catch(() => ({}));
+      const room = (await roomsOnThisMac(root)).find((one) => one.id === payload.room);
+      if (!room) return sendJson(response, 404, { error: t('That project is closed on your Mac.') });
+      return sendJson(response, 200, { ok: true, room: room.id }, { 'set-cookie': cookie(ROOM_COOKIE, room.id, MONTH_S) });
+    }
+    if (request.method === 'POST' && url.pathname === '/bridge/stop-all') {
+      const rooms = await roomsOnThisMac(root);
+      const stopped = await Promise.all(rooms.map((room) => fetch(`http://127.0.0.1:${room.port}/api/stop-all`, { method: 'POST', headers: { 'content-type': 'application/json', 'x-madre-device': device.id, 'x-madre-device-kind': device.kind }, body: '{}', signal: AbortSignal.timeout(3000) }).then((answer) => answer.ok).catch(() => false)));
+      return sendJson(response, 200, { rooms: rooms.length, stopped: stopped.filter(Boolean).length });
+    }
+    if (request.method === 'GET' && url.pathname.startsWith('/assets/') && await serveAsset(response, url.pathname)) return;
+
+    const room = (await roomsOnThisMac(root)).find((one) => one.id === cookies[ROOM_COOKIE]);
+    if (!room) {
+      if (wantsPage(request, url.pathname)) { response.writeHead(303, { ...SECURITY, location: '/salas', 'cache-control': 'no-store' }); return response.end(); }
+      return sendJson(response, 409, { error: t('That project is closed on your Mac.'), salas: true });
+    }
+    return pass(request, response, url, room, device);
+  }
+
+  return http.createServer((request, response) => {
+    handle(request, response).catch((error) => {
+      if (response.headersSent) { response.end(); return; }
+      sendJson(response, error.status ?? 500, { error: error.status === 413 ? t('That is too large to send from the phone.') : t('MADRE on your phone could not do that.') });
+    });
+  });
+}

package/src/capabilities.mjs

@@ -17,28 +17,28 @@ export const CAPABILITIES = {
     imageIn: { how: '-i <file>', note: 'Images attach to the prompt directly.' },
     write: { how: '-C <outdir> --sandbox workspace-write', note: 'Reads the whole project, writes only inside the lease directory.' },
     imageGen: { how: 'features.image_generation (stable, enabled)', note: 'Generated with the ChatGPT account; saved into the lease directory.' },
-    web: { how: '--search (live web_search tool)', note: 'Off until enabled in CONNECTIONS.' },
+    web: { how: '--search (live web_search tool)', note: 'Off until turned on in Settings › Agents › Web access.' },
   },
   claude: {
     read: true,
     imageIn: { how: 'Read tool on the attachment path', note: 'The attachments folder is added with --add-dir.' },
     write: { how: '--tools Write,Edit + permission rules', note: 'Write/Edit allowed only under the lease directory.' },
     imageGen: false,
-    web: { how: '--tools WebFetch,WebSearch', note: 'Off until enabled in CONNECTIONS.' },
+    web: { how: '--tools WebFetch,WebSearch', note: 'Off until turned on in Settings › Agents › Web access.' },
   },
   gemini: {
     read: true,
     imageIn: { how: 'read_file on the attachment path', note: 'The attachments folder is added with --include-directories.' },
     write: { how: 'policy: allow write_file/edit with argsPattern', note: 'Paths outside the lease directory stay denied.' },
     imageGen: false,
-    web: { how: 'policy: allow google_web_search, web_fetch', note: 'Off until enabled in CONNECTIONS.' },
+    web: { how: 'policy: allow google_web_search, web_fetch', note: 'Off until turned on in Settings › Agents › Web access.' },
   },
   opencode: {
     read: true,
     imageIn: { how: '-f <file>', note: 'Files attach to the message.' },
     write: { how: 'permission.edit patterns', note: 'Edit allowed only under the lease directory.' },
     imageGen: false,
-    web: { how: 'permission.webfetch / websearch = allow', note: 'Off until enabled in CONNECTIONS.' },
+    web: { how: 'permission.webfetch / websearch = allow', note: 'Off until turned on in Settings › Agents › Web access.' },
   },
 };
 
@@ -72,12 +72,8 @@ export function capabilitySummary(agentId) {
 }
 
 // Agents that have a capability, for routing hints in the delegation help.
-export function agentsWith(capability, agentIds) {
-  return agentIds.filter((id) => Boolean(capabilityOf(id)[capability]));
-}
-
 // Permission modes, chosen per message in the composer and capped per agent
-// in CONNECTIONS. The human's mode is the ceiling of any plan it starts.
+// in Settings › Permissions. The human's mode is the ceiling of any plan it starts.
 //   #0 GHOST     off the record: nothing enters the log or anyone's context
 //   #1 EXCHANGE  read the project, coordinate with the others (default)
 //   #2 CREATE    create files and images inside the turn's .pulse/out/ lease