@mindexec/cli 0.2.45 → 0.2.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.45",
+  "version": "0.2.47",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",

package/remote-hub.js

@@ -19,6 +19,7 @@ const REMOTE_PROTOCOL_VERSION = 1;
 const MAX_SYNTHETIC_DEVICES = 1000;
 const DEFAULT_HOST_TARGET_LEASE_MS = 30000;
 const SYNTHETIC_FRAME_DATA_URL = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAIAAAABCAYAAAD0In+KAAAADElEQVR42mP8z8AAAAMBAQDJ/pLvAAAAAElFTkSuQmCC';
+const SYNTHETIC_FRAME_PAYLOAD = Buffer.from(SYNTHETIC_FRAME_DATA_URL.split(',')[1], 'base64');
 
 function isEnabledValue(value, fallback = true) {
     if (value === undefined || value === null || value === '') {
@@ -122,7 +123,52 @@ function parseJsonLine(line) {
     return JSON.parse(text);
 }
 
-function serializeDevice(device) {
+function createFrameAccessToken() {
+    return crypto.randomBytes(18).toString('base64url');
+}
+
+function buildRemoteFramePath(deviceId, frameKind, frame) {
+    const token = safeString(frame?.accessToken, 128);
+    const frameSeq = Number(frame?.frameSeq);
+    if (!deviceId || !token || !Number.isFinite(frameSeq)) {
+        return '';
+    }
+
+    const endpoint = frameKind === 'thumbnail' ? 'thumbnail' : 'live/frame';
+    const params = new URLSearchParams({
+        format: 'binary',
+        seq: String(Math.floor(frameSeq)),
+        token
+    });
+    return `/api/remote/devices/${encodeURIComponent(deviceId)}/${endpoint}?${params.toString()}`;
+}
+
+function serializeRemoteFrame(frame, deviceId, frameKind, options = {}) {
+    if (!frame) {
+        return null;
+    }
+
+    const {
+        payload,
+        accessToken,
+        dataUrl,
+        ...publicFrame
+    } = frame;
+
+    const framePath = buildRemoteFramePath(deviceId, frameKind, frame);
+    const serialized = {
+        ...publicFrame,
+        framePath,
+        frameUrl: framePath
+    };
+    if (options.includeDataUrl !== false) {
+        serialized.dataUrl = dataUrl;
+    }
+
+    return serialized;
+}
+
+function serializeDevice(device, options = {}) {
     if (!device) {
         return null;
     }
@@ -145,8 +191,8 @@ function serializeDevice(device) {
         lastDisconnectReason: device.lastDisconnectReason,
         remoteAddress: device.remoteAddress,
         remotePort: device.remotePort,
-        latestThumbnail: device.latestThumbnail ? { ...device.latestThumbnail } : null,
-        latestLiveFrame: device.latestLiveFrame ? { ...device.latestLiveFrame } : null,
+        latestThumbnail: serializeRemoteFrame(device.latestThumbnail, device.deviceId, 'thumbnail', options),
+        latestLiveFrame: serializeRemoteFrame(device.latestLiveFrame, device.deviceId, 'live', options),
         activeLiveStream: device.activeLiveStream ? { ...device.activeLiveStream } : null,
         latestTask: device.latestTask ? { ...device.latestTask } : null,
         synthetic: device.synthetic === true,
@@ -376,9 +422,12 @@ export function createRemoteHub(options = {}) {
         };
     }
 
-    function listDevices() {
+    function listDevices(options = {}) {
+        const serializeOptions = {
+            includeDataUrl: options.includeDataUrl !== false
+        };
         return [...devices.values()]
-            .map(serializeDevice)
+            .map(device => serializeDevice(device, serializeOptions))
             .filter(Boolean)
             .sort((a, b) => {
                 const nameCompare = String(a.deviceName || '').localeCompare(String(b.deviceName || ''));
@@ -427,7 +476,10 @@ export function createRemoteHub(options = {}) {
             capturedAt: now,
             receivedAt: now,
             byteLength: 68,
-            dataUrl: SYNTHETIC_FRAME_DATA_URL
+            transport: 'synthetic',
+            dataUrl: SYNTHETIC_FRAME_DATA_URL,
+            payload: SYNTHETIC_FRAME_PAYLOAD,
+            accessToken: createFrameAccessToken()
         };
     }
 
@@ -1095,6 +1147,19 @@ export function createRemoteHub(options = {}) {
             : `data:${mimeType};base64,${frameData}`;
     }
 
+    function buildFramePayloadBuffer(framePayload, frameData) {
+        if (Buffer.isBuffer(framePayload)) {
+            return Buffer.from(framePayload);
+        }
+
+        const raw = String(frameData || '');
+        const commaIndex = raw.indexOf(',');
+        const base64 = raw.startsWith('data:') && commaIndex >= 0
+            ? raw.slice(commaIndex + 1)
+            : raw;
+        return Buffer.from(base64, 'base64');
+    }
+
     function applyThumbnailFrame(device, message, framePayload, transport = 'json-base64') {
         const frameData = Buffer.isBuffer(framePayload)
             ? ''
@@ -1115,6 +1180,7 @@ export function createRemoteHub(options = {}) {
 
         const mimeType = safeString(message.mimeType || message.format || 'image/jpeg', 80) || 'image/jpeg';
         const capturedAt = safeString(message.capturedAt, 80) || device.lastSeenAt;
+        const payload = buildFramePayloadBuffer(framePayload, frameData);
         device.latestThumbnail = {
             streamId: safeString(message.streamId, 128) || 'thumbnail',
             frameSeq,
@@ -1127,7 +1193,9 @@ export function createRemoteHub(options = {}) {
             receivedAt: device.lastSeenAt,
             byteLength,
             transport,
-            dataUrl: buildFrameDataUrl(framePayload, frameData, mimeType)
+            dataUrl: buildFrameDataUrl(framePayload, frameData, mimeType),
+            payload,
+            accessToken: createFrameAccessToken()
         };
         device.counters.thumbnailFramesReceived += 1;
         emitRemoteEvent('RemoteFrameReceived', device, {
@@ -1173,6 +1241,7 @@ export function createRemoteHub(options = {}) {
 
         const mimeType = safeString(message.mimeType || message.format || 'image/jpeg', 80) || 'image/jpeg';
         const capturedAt = safeString(message.capturedAt, 80) || device.lastSeenAt;
+        const payload = buildFramePayloadBuffer(framePayload, frameData);
         device.latestLiveFrame = {
             streamId,
             frameSeq,
@@ -1187,7 +1256,9 @@ export function createRemoteHub(options = {}) {
             receivedAt: device.lastSeenAt,
             byteLength,
             transport,
-            dataUrl: buildFrameDataUrl(framePayload, frameData, mimeType)
+            dataUrl: buildFrameDataUrl(framePayload, frameData, mimeType),
+            payload,
+            accessToken: createFrameAccessToken()
         };
         device.activeLiveStream.lastFrameAt = device.lastSeenAt;
         device.activeLiveStream.lastFrameSeq = frameSeq;
@@ -1904,14 +1975,49 @@ export function createRemoteHub(options = {}) {
         return { ok: true, commandId, streamId };
     }
 
-    function getDeviceLiveFrame(deviceId) {
+    function getDeviceLiveFrame(deviceId, options = {}) {
         const device = devices.get(String(deviceId || ''));
-        return device?.latestLiveFrame ? { ...device.latestLiveFrame } : null;
+        return serializeRemoteFrame(device?.latestLiveFrame, device?.deviceId, 'live', {
+            includeDataUrl: options.includeDataUrl !== false
+        });
+    }
+
+    function getDeviceThumbnail(deviceId, options = {}) {
+        const device = devices.get(String(deviceId || ''));
+        return serializeRemoteFrame(device?.latestThumbnail, device?.deviceId, 'thumbnail', {
+            includeDataUrl: options.includeDataUrl !== false
+        });
     }
 
-    function getDeviceThumbnail(deviceId) {
+    function getFramePayload(deviceId, frameKind, options = {}) {
         const device = devices.get(String(deviceId || ''));
-        return device?.latestThumbnail ? { ...device.latestThumbnail } : null;
+        const frame = frameKind === 'thumbnail'
+            ? device?.latestThumbnail
+            : device?.latestLiveFrame;
+        if (!frame || !Buffer.isBuffer(frame.payload)) {
+            return null;
+        }
+
+        const requestedSeq = Number(options.frameSeq);
+        if (Number.isFinite(requestedSeq) && Math.floor(requestedSeq) !== frame.frameSeq) {
+            return null;
+        }
+
+        const token = safeString(options.token, 128);
+        if (token && !timingSafeStringEqual(token, frame.accessToken)) {
+            return null;
+        }
+
+        if (options.requireToken === true && !token) {
+            return null;
+        }
+
+        return {
+            frame: serializeRemoteFrame(frame, device.deviceId, frameKind, { includeDataUrl: false }),
+            payload: frame.payload,
+            mimeType: safeString(frame.mimeType || frame.format || 'application/octet-stream', 120) || 'application/octet-stream',
+            byteLength: frame.payload.length
+        };
     }
 
     return {
@@ -1931,6 +2037,7 @@ export function createRemoteHub(options = {}) {
         stopLiveStream,
         getDeviceLiveFrame,
         getDeviceThumbnail,
+        getFramePayload,
         seedSyntheticFleet,
         clearSyntheticFleet,
         getPairToken: () => pairToken

package/scripts/remote-http-smoke.mjs

@@ -54,6 +54,26 @@ async function fetchJson(url, options = {}) {
     };
 }
 
+async function fetchBinary(url, options = {}) {
+    const response = await fetch(url, {
+        ...options,
+        headers: {
+            Accept: 'image/png,image/jpeg,image/webp,image/*',
+            ...(options.token ? { 'X-Bridge-Token': options.token } : {}),
+            ...(options.headers || {})
+        }
+    });
+
+    return {
+        status: response.status,
+        ok: response.ok,
+        contentType: response.headers.get('content-type') || '',
+        frameSeq: response.headers.get('x-mindexec-remote-frame-seq') || '',
+        streamId: response.headers.get('x-mindexec-remote-stream-id') || '',
+        payload: Buffer.from(await response.arrayBuffer())
+    };
+}
+
 async function waitForBridge(baseUrl, getFailureDetails, bridgeToken = BRIDGE_TOKEN) {
     const startedAt = Date.now();
     while (Date.now() - startedAt < 30000) {
@@ -339,6 +359,23 @@ async function runSyntheticEnabledSmoke() {
     assert.equal(thumbnail.ok, true, JSON.stringify(thumbnail.payload));
     assert.equal(thumbnail.payload?.thumbnail?.streamId, 'http-smoke-thumb');
     assert.ok(String(thumbnail.payload?.thumbnail?.dataUrl || '').startsWith('data:image/png;base64,'));
+    assert.ok(String(thumbnail.payload?.thumbnail?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail?`));
+    assert.equal(thumbnail.payload?.thumbnail?.frameUrl, thumbnail.payload?.thumbnail?.framePath);
+
+    const thumbnailBinary = await fetchBinary(`${baseUrl}${thumbnail.payload.thumbnail.framePath}`);
+    assert.equal(thumbnailBinary.ok, true, `${thumbnailBinary.status} ${thumbnailBinary.contentType}`);
+    assert.equal(thumbnailBinary.contentType, 'image/png');
+    assert.equal(thumbnailBinary.streamId, 'http-smoke-thumb');
+    assert.ok(thumbnailBinary.payload.length > 0);
+
+    const badThumbnailBinary = await fetchBinary(`${baseUrl}${thumbnail.payload.thumbnail.framePath.replace(/token=[^&]+/, 'token=wrong-token')}`);
+    assert.equal(badThumbnailBinary.status, 401);
+
+    const devicesUrlOnlyResult = await fetchJson(`${baseUrl}/api/remote/devices?frameData=url`, { token: BRIDGE_TOKEN });
+    assert.equal(devicesUrlOnlyResult.ok, true, JSON.stringify(devicesUrlOnlyResult.payload));
+    const urlOnlyThumbnailDevice = devicesUrlOnlyResult.payload?.devices?.find(device => device.deviceId === thumbnailTarget.deviceId);
+    assert.ok(urlOnlyThumbnailDevice?.latestThumbnail?.framePath);
+    assert.ok(!('dataUrl' in urlOnlyThumbnailDevice.latestThumbnail));
 
     const liveTarget = devicesResult.payload.devices.find(device =>
         device.connected && device.capabilities?.liveStream);
@@ -364,6 +401,23 @@ async function runSyntheticEnabledSmoke() {
     assert.equal(liveFrame.payload?.frame?.streamId, 'http-smoke-live');
     assert.equal(liveFrame.payload?.frame?.mode, 'remote-fast');
     assert.equal(liveFrame.payload?.frame?.fps, 20);
+    assert.ok(String(liveFrame.payload?.frame?.dataUrl || '').startsWith('data:image/png;base64,'));
+    assert.ok(String(liveFrame.payload?.frame?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?`));
+
+    const liveBinary = await fetchBinary(`${baseUrl}${liveFrame.payload.frame.framePath}`);
+    assert.equal(liveBinary.ok, true, `${liveBinary.status} ${liveBinary.contentType}`);
+    assert.equal(liveBinary.contentType, 'image/png');
+    assert.equal(liveBinary.streamId, 'http-smoke-live');
+    assert.ok(liveBinary.payload.length > 0);
+
+    const liveBinaryWithBridgeToken = await fetchBinary(
+        `${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?format=binary`,
+        { token: BRIDGE_TOKEN });
+    assert.equal(liveBinaryWithBridgeToken.ok, true, `${liveBinaryWithBridgeToken.status} ${liveBinaryWithBridgeToken.contentType}`);
+    assert.equal(liveBinaryWithBridgeToken.contentType, 'image/png');
+
+    const badLiveSeq = await fetchBinary(`${baseUrl}${liveFrame.payload.frame.framePath.replace(/seq=\d+/, 'seq=999999')}`);
+    assert.equal(badLiveSeq.status, 401);
 
     const liveStop = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/stop`, {
         method: 'POST',

package/scripts/remote-hub-smoke.mjs

@@ -152,6 +152,27 @@ try {
     assert.equal(binaryThumbnailDevice.latestThumbnail.transport, 'binary');
     assert.equal(binaryThumbnailDevice.latestThumbnail.byteLength, smokePngFrame.length);
     assert.equal(binaryThumbnailDevice.counters.thumbnailFramesReceived, 2);
+    const serializedBinaryThumbnail = hub.getDeviceThumbnail('smoke-device', { includeDataUrl: false });
+    assert.equal(serializedBinaryThumbnail.streamId, 'smoke-thumb-binary');
+    assert.equal(serializedBinaryThumbnail.frameSeq, 4);
+    assert.ok(serializedBinaryThumbnail.framePath.includes('/api/remote/devices/smoke-device/thumbnail?'));
+    assert.ok(!('dataUrl' in serializedBinaryThumbnail));
+    assert.ok(!('payload' in serializedBinaryThumbnail));
+    assert.ok(!('accessToken' in serializedBinaryThumbnail));
+    const serializedThumbnailUrl = new URL(serializedBinaryThumbnail.framePath, 'http://127.0.0.1');
+    const thumbnailPayload = hub.getFramePayload('smoke-device', 'thumbnail', {
+        token: serializedThumbnailUrl.searchParams.get('token'),
+        frameSeq: serializedThumbnailUrl.searchParams.get('seq'),
+        requireToken: true
+    });
+    assert.equal(thumbnailPayload?.mimeType, 'image/png');
+    assert.equal(thumbnailPayload?.byteLength, smokePngFrame.length);
+    assert.equal(Buffer.compare(thumbnailPayload.payload, smokePngFrame), 0);
+    assert.equal(hub.getFramePayload('smoke-device', 'thumbnail', {
+        token: 'wrong-token',
+        frameSeq: 4,
+        requireToken: true
+    }), null);
 
     const liveCommand = hub.startLiveStream('smoke-device', {
         streamId: 'smoke-live',
@@ -204,6 +225,27 @@ try {
     assert.equal(binaryLiveDevice.latestLiveFrame.transport, 'binary');
     assert.equal(binaryLiveDevice.latestLiveFrame.byteLength, smokePngFrame.length);
     assert.equal(binaryLiveDevice.counters.liveFramesReceived, 2);
+    const serializedBinaryLiveFrame = hub.getDeviceLiveFrame('smoke-device', { includeDataUrl: false });
+    assert.equal(serializedBinaryLiveFrame.streamId, 'smoke-live');
+    assert.equal(serializedBinaryLiveFrame.frameSeq, 5);
+    assert.ok(serializedBinaryLiveFrame.framePath.includes('/api/remote/devices/smoke-device/live/frame?'));
+    assert.ok(!('dataUrl' in serializedBinaryLiveFrame));
+    assert.ok(!('payload' in serializedBinaryLiveFrame));
+    assert.ok(!('accessToken' in serializedBinaryLiveFrame));
+    const serializedLiveUrl = new URL(serializedBinaryLiveFrame.framePath, 'http://127.0.0.1');
+    const livePayload = hub.getFramePayload('smoke-device', 'live', {
+        token: serializedLiveUrl.searchParams.get('token'),
+        frameSeq: serializedLiveUrl.searchParams.get('seq'),
+        requireToken: true
+    });
+    assert.equal(livePayload?.mimeType, 'image/png');
+    assert.equal(livePayload?.byteLength, smokePngFrame.length);
+    assert.equal(Buffer.compare(livePayload.payload, smokePngFrame), 0);
+    assert.equal(hub.getFramePayload('smoke-device', 'live', {
+        token: serializedLiveUrl.searchParams.get('token'),
+        frameSeq: 4,
+        requireToken: true
+    }), null);
 
     const staleFrameBefore = liveDevice.counters.liveFramesDropped;
     writeJsonLine(socket, {

package/server.js

@@ -1756,20 +1756,69 @@ const PROTECTED_BRIDGE_ROUTES = [
     { method: 'POST', exact: '/api/tool/trace' }
 ];
 
-function getBridgeTokenFromRequest(req) {
-    const headerToken = String(req.get(bridgeTokenHeader) || '').trim();
-    if (headerToken) {
-        return headerToken;
-    }
+function getBridgeTokenFromRequest(req) {
+    const headerToken = String(req.get(bridgeTokenHeader) || '').trim();
+    if (headerToken) {
+        return headerToken;
+    }
 
     const authorization = String(req.get('authorization') || '').trim();
-    const bearerMatch = authorization.match(/^Bearer\s+(.+)$/i);
-    return bearerMatch ? bearerMatch[1].trim() : '';
-}
-
-function isProtectedBridgeRoute(method, requestPath) {
-    const normalizedMethod = String(method || '').toUpperCase();
-    const normalizedPath = String(requestPath || '').toLowerCase();
+    const bearerMatch = authorization.match(/^Bearer\s+(.+)$/i);
+    return bearerMatch ? bearerMatch[1].trim() : '';
+}
+
+function isBridgeTokenAuthorized(req) {
+    return !bridgeAuthRequired || getBridgeTokenFromRequest(req) === bridgeToken;
+}
+
+function wantsRemoteFrameBinaryRequest(req) {
+    const format = String(req.query?.format || req.query?.frameData || '').trim().toLowerCase();
+    if (format === 'binary' || format === 'image' || format === 'raw') {
+        return true;
+    }
+
+    const accept = String(req.get('accept') || '').toLowerCase();
+    return /\bimage\//.test(accept) && !accept.includes('application/json');
+}
+
+function getRemoteFrameTokenRequest(req) {
+    if (String(req.method || '').toUpperCase() !== 'GET' || !wantsRemoteFrameBinaryRequest(req)) {
+        return null;
+    }
+
+    const match = String(req.path || '').match(/^\/api\/remote\/devices\/([^/]+)\/(thumbnail|live\/frame)$/i);
+    if (!match) {
+        return null;
+    }
+
+    try {
+        return {
+            deviceId: decodeURIComponent(match[1]),
+            frameKind: match[2].toLowerCase() === 'thumbnail' ? 'thumbnail' : 'live',
+            token: String(req.query?.token || '').trim(),
+            frameSeq: req.query?.seq
+        };
+    } catch {
+        return null;
+    }
+}
+
+function isAuthorizedRemoteFrameTokenRequest(req) {
+    const frameRequest = getRemoteFrameTokenRequest(req);
+    if (!frameRequest?.token) {
+        return false;
+    }
+
+    return !!remoteHub.getFramePayload(frameRequest.deviceId, frameRequest.frameKind, {
+        token: frameRequest.token,
+        frameSeq: frameRequest.frameSeq,
+        requireToken: true
+    });
+}
+
+function isProtectedBridgeRoute(method, requestPath) {
+    const normalizedMethod = String(method || '').toUpperCase();
+    const normalizedPath = String(requestPath || '').toLowerCase();
 
     return PROTECTED_BRIDGE_ROUTES.some((rule) => {
         if (rule.method && rule.method !== normalizedMethod) {
@@ -1786,13 +1835,13 @@ function isProtectedBridgeRoute(method, requestPath) {
 
         return false;
     });
-}
-
-function requireBridgeToken(req, res, next) {
-    if (!bridgeAuthRequired || getBridgeTokenFromRequest(req) === bridgeToken) {
-        next();
-        return;
-    }
+}
+
+function requireBridgeToken(req, res, next) {
+    if (isBridgeTokenAuthorized(req) || isAuthorizedRemoteFrameTokenRequest(req)) {
+        next();
+        return;
+    }
 
     res.status(401).json({
         error: 'Bridge token required',
@@ -6967,7 +7016,8 @@ app.get('/api/remote/status', (req, res) => {
 
 app.get('/api/remote/devices', (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
-    const devices = remoteHub.listDevices();
+    const includeDataUrl = !/^(0|false|no|url|metadata)$/i.test(String(req.query?.includeDataUrl ?? req.query?.frameData ?? ''));
+    const devices = remoteHub.listDevices({ includeDataUrl });
     res.json({
         total: devices.length,
         pagination: 'none',
@@ -7058,7 +7108,7 @@ app.post('/api/remote/tasks', (req, res) => {
         : [];
     const allConnected = req.body?.allConnected !== false;
     const approvalLevel = req.body?.approvalLevel === 'ai-assist' ? 'ai-assist' : 'task-only';
-    const devices = remoteHub.listDevices();
+    const devices = remoteHub.listDevices({ includeDataUrl: false });
     const targetIds = requestedDeviceIds.length > 0
         ? requestedDeviceIds
         : (allConnected
@@ -7098,9 +7148,44 @@ function isRemoteCapabilityEnabled(device, key) {
     return /^(1|true|yes|on)$/i.test(String(value || '').trim());
 }
 
+function includeRemoteFrameDataUrl(req) {
+    return !/^(0|false|no|url|metadata)$/i.test(String(req.query?.includeDataUrl ?? req.query?.frameData ?? ''));
+}
+
+function sendRemoteFrameBinary(req, res, frameKind) {
+    const bridgeAuthorized = isBridgeTokenAuthorized(req);
+    const payload = remoteHub.getFramePayload(req.params.deviceId, frameKind, {
+        token: bridgeAuthorized ? '' : req.query?.token,
+        frameSeq: req.query?.seq,
+        requireToken: !bridgeAuthorized
+    });
+    if (!payload) {
+        res.status(bridgeAuthorized ? 404 : 403).json({
+            ok: false,
+            error: bridgeAuthorized ? 'frame-payload-not-available' : 'invalid-frame-token'
+        });
+        return true;
+    }
+
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Content-Type', payload.mimeType);
+    res.setHeader('Content-Length', String(payload.byteLength));
+    res.setHeader('X-MindExec-Remote-Frame-Seq', String(payload.frame?.frameSeq || ''));
+    res.setHeader('X-MindExec-Remote-Stream-Id', String(payload.frame?.streamId || ''));
+    res.send(payload.payload);
+    return true;
+}
+
 app.get('/api/remote/devices/:deviceId/thumbnail', (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
-    const thumbnail = remoteHub.getDeviceThumbnail(req.params.deviceId);
+    if (wantsRemoteFrameBinaryRequest(req)) {
+        sendRemoteFrameBinary(req, res, 'thumbnail');
+        return;
+    }
+
+    const thumbnail = remoteHub.getDeviceThumbnail(req.params.deviceId, {
+        includeDataUrl: includeRemoteFrameDataUrl(req)
+    });
     if (!thumbnail) {
         res.status(404).json({ ok: false, error: 'thumbnail-not-available' });
         return;
@@ -7120,7 +7205,14 @@ app.post('/api/remote/devices/:deviceId/thumbnail/request', (req, res) => {
 
 app.get('/api/remote/devices/:deviceId/live/frame', (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
-    const frame = remoteHub.getDeviceLiveFrame(req.params.deviceId);
+    if (wantsRemoteFrameBinaryRequest(req)) {
+        sendRemoteFrameBinary(req, res, 'live');
+        return;
+    }
+
+    const frame = remoteHub.getDeviceLiveFrame(req.params.deviceId, {
+        includeDataUrl: includeRemoteFrameDataUrl(req)
+    });
     if (!frame) {
         res.status(404).json({ ok: false, error: 'live-frame-not-available' });
         return;

package/wwwroot/_content/MindExecution.Shared/js/mind-map-css3d-manager.js

@@ -12957,13 +12957,30 @@
     }
 
     function hasRemoteFleetThumbnail(device) {
-        const dataUrl = String(getRemoteFleetDeviceField(device, 'thumbnailDataUrl', 'ThumbnailDataUrl', ''));
-        return /^data:image\/(png|jpe?g|webp|svg\+xml);base64,/i.test(dataUrl);
+        return isRemoteFleetFrameSource(getRemoteFleetFrameSource(device, 'thumbnail'));
     }
 
     function hasRemoteFleetLiveFrame(device) {
-        const dataUrl = String(getRemoteFleetDeviceField(device, 'liveFrameDataUrl', 'LiveFrameDataUrl', ''));
-        return /^data:image\/(png|jpe?g|webp|svg\+xml);base64,/i.test(dataUrl);
+        return isRemoteFleetFrameSource(getRemoteFleetFrameSource(device, 'live'));
+    }
+
+    function isRemoteFleetFrameSource(value) {
+        const source = String(value || '').trim();
+        return /^data:image\/(png|jpe?g|webp|svg\+xml);base64,/i.test(source)
+            || /^https?:\/\/(?:127(?:\.\d{1,3}){3}|localhost|\[::1\])(?::\d+)?\/api\/remote\//i.test(source)
+            || /^\/api\/remote\//i.test(source);
+    }
+
+    function getRemoteFleetFrameSource(device, frameKind) {
+        if (frameKind === 'live') {
+            return String(
+                getRemoteFleetDeviceField(device, 'liveFrameUrl', 'LiveFrameUrl', '')
+                || getRemoteFleetDeviceField(device, 'liveFrameDataUrl', 'LiveFrameDataUrl', ''));
+        }
+
+        return String(
+            getRemoteFleetDeviceField(device, 'thumbnailFrameUrl', 'ThumbnailFrameUrl', '')
+            || getRemoteFleetDeviceField(device, 'thumbnailDataUrl', 'ThumbnailDataUrl', ''));
     }
 
     function isRemoteFleetLiveActive(device) {
@@ -13245,9 +13262,9 @@
         const liveStreamId = String(getRemoteFleetDeviceField(device, 'liveStreamId', 'LiveStreamId', ''));
         const hasLiveFrame = hasRemoteFleetLiveFrame(device);
         const hasThumbnail = hasRemoteFleetThumbnail(device);
-        const previewDataUrl = hasLiveFrame
-            ? String(getRemoteFleetDeviceField(device, 'liveFrameDataUrl', 'LiveFrameDataUrl', ''))
-            : String(getRemoteFleetDeviceField(device, 'thumbnailDataUrl', 'ThumbnailDataUrl', ''));
+        const previewSource = hasLiveFrame
+            ? getRemoteFleetFrameSource(device, 'live')
+            : getRemoteFleetFrameSource(device, 'thumbnail');
         const previewAt = hasLiveFrame
             ? String(getRemoteFleetDeviceField(device, 'liveFrameReceivedAt', 'LiveFrameReceivedAt', ''))
             : String(getRemoteFleetDeviceField(device, 'thumbnailReceivedAt', 'ThumbnailReceivedAt',
@@ -13309,7 +13326,7 @@
         `;
         if (hasLiveFrame || hasThumbnail) {
             const image = document.createElement('img');
-            image.src = previewDataUrl;
+            image.src = previewSource;
             image.alt = `${name} screen`;
             image.loading = 'lazy';
             image.decoding = 'async';
@@ -14104,7 +14121,7 @@
             const focusedId = getRemoteFleetDeviceId(focusedDevice);
             const focusedName = getRemoteFleetDeviceName(focusedDevice);
             const liveActive = isRemoteFleetLiveActive(focusedDevice);
-            const liveFrameDataUrl = String(getRemoteFleetDeviceField(focusedDevice, 'liveFrameDataUrl', 'LiveFrameDataUrl', ''));
+            const liveFrameSource = getRemoteFleetFrameSource(focusedDevice, 'live');
             const liveFrameAt = String(getRemoteFleetDeviceField(focusedDevice, 'liveFrameReceivedAt', 'LiveFrameReceivedAt', ''));
             const liveStreamId = String(getRemoteFleetDeviceField(focusedDevice, 'liveStreamId', 'LiveStreamId', ''));
             const hasLiveFrame = hasRemoteFleetLiveFrame(focusedDevice);
@@ -14135,7 +14152,7 @@
             `;
             if (hasLiveFrame) {
                 const image = document.createElement('img');
-                image.src = liveFrameDataUrl;
+                image.src = liveFrameSource;
                 image.alt = `${focusedName} live screen`;
                 image.decoding = 'async';
                 image.style.cssText = `
@@ -14238,13 +14255,13 @@
         const createDevicePreview = (device, mode = 'tile') => {
             const name = getRemoteFleetDeviceName(device);
             const connectedDevice = isRemoteFleetDeviceConnected(device);
-            const thumbnailDataUrl = String(device?.thumbnailDataUrl || device?.ThumbnailDataUrl || '');
             const thumbnailCapturedAt = String(device?.thumbnailCapturedAt || device?.ThumbnailCapturedAt || '');
-            const liveFrameDataUrl = String(device?.liveFrameDataUrl || device?.LiveFrameDataUrl || '');
             const liveFrameReceivedAt = String(device?.liveFrameReceivedAt || device?.LiveFrameReceivedAt || '');
             const hasThumbnail = hasRemoteFleetThumbnail(device);
             const hasLiveFrame = hasRemoteFleetLiveFrame(device);
-            const previewDataUrl = hasLiveFrame ? liveFrameDataUrl : thumbnailDataUrl;
+            const previewSource = hasLiveFrame
+                ? getRemoteFleetFrameSource(device, 'live')
+                : getRemoteFleetFrameSource(device, 'thumbnail');
             const previewAt = hasLiveFrame ? liveFrameReceivedAt : thumbnailCapturedAt;
             const isDetail = mode === 'detail';
 
@@ -14262,7 +14279,7 @@
 
             if (hasLiveFrame || hasThumbnail) {
                 const image = document.createElement('img');
-                image.src = previewDataUrl;
+                image.src = previewSource;
                 image.alt = hasLiveFrame ? `${name} live frame` : `${name} thumbnail`;
                 image.loading = 'lazy';
                 image.decoding = 'async';

package/wwwroot/_framework/blazor.boot.json

@@ -1,7 +1,7 @@
 {
   "mainAssemblyName": "MindExecution.Web",
   "resources": {
-    "hash": "sha256-jka0i4EGJ6iC6sOZFGMzWKJ2qqciCFD5pIUmTZ59t9I=",
+    "hash": "sha256-85uTc0gcvy3kY8SBQJxkQmIrLfblhTpX8tZWjJP3QnE=",
     "fingerprinting": {
       "Google.Protobuf.9h59ukbel7.dll": "Google.Protobuf.dll",
       "Markdig.d1j7v41cl1.dll": "Markdig.dll",
@@ -123,16 +123,16 @@
       "System.brmz7yk5qh.dll": "System.dll",
       "netstandard.yvr3prsx0x.dll": "netstandard.dll",
       "System.Private.CoreLib.ns29bor93l.dll": "System.Private.CoreLib.dll",
-      "MindExecution.Core.6rfnfdndxq.dll": "MindExecution.Core.dll",
-      "MindExecution.Kernel.z56elxihok.dll": "MindExecution.Kernel.dll",
-      "MindExecution.Plugins.Admin.p5cs4ap87v.dll": "MindExecution.Plugins.Admin.dll",
-      "MindExecution.Plugins.Business.s35og5uz44.dll": "MindExecution.Plugins.Business.dll",
-      "MindExecution.Plugins.Concept.j63qelz8rk.dll": "MindExecution.Plugins.Concept.dll",
-      "MindExecution.Plugins.Directory.y74f55e8x3.dll": "MindExecution.Plugins.Directory.dll",
-      "MindExecution.Plugins.PlanMaster.8djc50fh8g.dll": "MindExecution.Plugins.PlanMaster.dll",
-      "MindExecution.Plugins.YouTube.h6y03asuzq.dll": "MindExecution.Plugins.YouTube.dll",
-      "MindExecution.Shared.z07jle70qs.dll": "MindExecution.Shared.dll",
-      "MindExecution.Web.gq00wm14q3.dll": "MindExecution.Web.dll",
+      "MindExecution.Core.xg9yy9l5dz.dll": "MindExecution.Core.dll",
+      "MindExecution.Kernel.erg96341xf.dll": "MindExecution.Kernel.dll",
+      "MindExecution.Plugins.Admin.11j9vpdm9u.dll": "MindExecution.Plugins.Admin.dll",
+      "MindExecution.Plugins.Business.oyskf08knn.dll": "MindExecution.Plugins.Business.dll",
+      "MindExecution.Plugins.Concept.keia4ox68c.dll": "MindExecution.Plugins.Concept.dll",
+      "MindExecution.Plugins.Directory.7pus9p63ym.dll": "MindExecution.Plugins.Directory.dll",
+      "MindExecution.Plugins.PlanMaster.wr3pupzfyo.dll": "MindExecution.Plugins.PlanMaster.dll",
+      "MindExecution.Plugins.YouTube.kpfew1eggc.dll": "MindExecution.Plugins.YouTube.dll",
+      "MindExecution.Shared.kzibxbai3y.dll": "MindExecution.Shared.dll",
+      "MindExecution.Web.6fjnkr9ty4.dll": "MindExecution.Web.dll",
       "dotnet.js": "dotnet.js",
       "dotnet.native.qc8g39g30v.js": "dotnet.native.js",
       "dotnet.native.boem75ye5i.wasm": "dotnet.native.wasm",
@@ -278,18 +278,18 @@
       "System.Xml.XDocument.sn51jas17n.dll": "sha256-GNI2kFgFmPTwzuzwUn8gxK+AzGLUWRJFdg9JzIbrybQ=",
       "System.brmz7yk5qh.dll": "sha256-CfM2miyj1KHApFmqMdLYWio3S/jrdON2pW9Xr2nTwlo=",
       "netstandard.yvr3prsx0x.dll": "sha256-EksNn8Luo4bOWqJ6X7dIe9qG9oOqwOVzjH2xYyMNi+E=",
-      "MindExecution.Core.6rfnfdndxq.dll": "sha256-giL4rreoKsQoQ5gkLusNx7oL3w1l2UH52TYY1KBoIfQ=",
-      "MindExecution.Kernel.z56elxihok.dll": "sha256-STATJelRGcW9SDGgsw6YmQi6tkQje52dy4lyT3QU4qs=",
-      "MindExecution.Plugins.Concept.j63qelz8rk.dll": "sha256-ZftqLWcODF69nab4DCcdrKLyTbZmu9x1E6UZj95Lwg0=",
-      "MindExecution.Plugins.PlanMaster.8djc50fh8g.dll": "sha256-DEK18qiIEbs60obGiRs+Cmr327gBOBqEGpdculGvnpo=",
-      "MindExecution.Shared.z07jle70qs.dll": "sha256-rbi/VtbMCVX+T5mPBzy0KWJlu3VI/w5cILfCOhFXb2E=",
-      "MindExecution.Web.gq00wm14q3.dll": "sha256-SLQj0JfkJi2Krlha+Mhem6+EG90bv7pMbiQkzs3kxJA="
+      "MindExecution.Core.xg9yy9l5dz.dll": "sha256-cRrcPtFn2SUkdgWA68l7+CQbGso1QWczG5az1KYpLUU=",
+      "MindExecution.Kernel.erg96341xf.dll": "sha256-5hDopeSFSFHb5tDeLFj0jrSt6XRq4SYxB8nyFJ6H9RQ=",
+      "MindExecution.Plugins.Concept.keia4ox68c.dll": "sha256-rO8bWy0n6NZKqMzFpcIjy/p1kG8mPSuTUZ+UMTWugf8=",
+      "MindExecution.Plugins.PlanMaster.wr3pupzfyo.dll": "sha256-pE7MM4cMUkHzg5wTQtq8Vgk+RSjlQtO44T9AwQsYDqw=",
+      "MindExecution.Shared.kzibxbai3y.dll": "sha256-4CE9pNlfu9pIL+wwsbaU4ARQLcYelkl2sqkwAJD9sD4=",
+      "MindExecution.Web.6fjnkr9ty4.dll": "sha256-7o2Y3AvthOWiFF9+lHnqahGmcN/0tDuBtJhxGdcMN44="
     },
     "lazyAssembly": {
-      "MindExecution.Plugins.Admin.p5cs4ap87v.dll": "sha256-jahiJxaiE8hwMyRcg6rZGo4WBhBGFyAHYhOqlKjawWg=",
-      "MindExecution.Plugins.Business.s35og5uz44.dll": "sha256-KOyk9eC6E/Gyfz2uWucHQmAayMQbShhLTqEymZFleh4=",
-      "MindExecution.Plugins.Directory.y74f55e8x3.dll": "sha256-4gMuhIPLiX31U+jwhDT83rSPqZINONadmW+cvujfq1g=",
-      "MindExecution.Plugins.YouTube.h6y03asuzq.dll": "sha256-CTh0qytJGaYVCK0/3dOK0w8iIqQNYHmSZ5NZJW9nNgA="
+      "MindExecution.Plugins.Admin.11j9vpdm9u.dll": "sha256-lZvp68Zm2iFwt93gRGlHDKVnywJT2hHxA3JHu4Z3PfA=",
+      "MindExecution.Plugins.Business.oyskf08knn.dll": "sha256-oL53lWZ8Lp8lZuqc3UP+qIGSEVKJvVvfov+2xyQ3INg=",
+      "MindExecution.Plugins.Directory.7pus9p63ym.dll": "sha256-a1eUvklwiLwuCPBk05omRoirn1tRqVgjogVW8/UAAuc=",
+      "MindExecution.Plugins.YouTube.kpfew1eggc.dll": "sha256-COvvpOYO8nsEePBr3CCF4Wv0CWfvvOAoXn54tmikwwc="
     }
   },
   "cacheBootResources": true,

package/wwwroot/index.html

@@ -7,8 +7,8 @@
     <title>MindExec | Run your ideas as AI task graphs</title>
     <meta name="description" content="MindExec is an AI execution canvas for solo builders, researchers, developers, and creators. Start with free browser tools, then move serious work into saved MindCanvas projects." />
     <base href="/" />
-    <link rel="stylesheet" href="_content/MindExecution.Shared/css/app.css?v=20260613-template-card-inline-summary-v461" />
-    <link rel="stylesheet" href="_content/MindExecution.Shared/css/mind-map-overrides.css?v=20260613-template-card-inline-summary-v461" />
+    <link rel="stylesheet" href="_content/MindExecution.Shared/css/app.css?v=20260613-remote-binary-frame-v509" />
+    <link rel="stylesheet" href="_content/MindExecution.Shared/css/mind-map-overrides.css?v=20260613-remote-binary-frame-v509" />
     <!-- ?쇄뼹??Font Awesome (local) ?쇄뼹??-->
     <link rel="stylesheet" href="_content/MindExecution.Shared/lib/font-awesome/css/all.min.css" />
     <!-- ?꿎뼯??-->
@@ -558,7 +558,7 @@
             }
 
             const base = '_content/MindExecution.Shared/js/';
-        const scriptVersion = '20260613-remote-monitor-gap-v508';
+        const scriptVersion = '20260613-remote-binary-frame-v509';
             const scriptUrl = (script) => `${base}${script}?v=${scriptVersion}`;
             console.log(`[Script Loader] Shared JS version: ${scriptVersion}`);
             const criticalScripts = [

package/wwwroot/service-worker-assets.js

@@ -1,5 +1,5 @@
 self.assetsManifest = {
-    "version":  "tIrmi759",
+    "version":  "HB1IB45K",
     "assets":  [
                    {
                        "hash":  "sha256-+CSYMcqLNTsq3VnH11jgYyOCCdxvHzL74CBmo4sCmMU=",
@@ -86,7 +86,7 @@
                        "url":  "_content/MindExecution.Shared/js/mind-map-core.js.backup"
                    },
                    {
-                       "hash":  "sha256-I1t1myZd+2qeNcLM4ZSYetN/rCdWG1MtqBW+yKmeDfU=",
+                       "hash":  "sha256-2LFL3oGey+usyB7lpywzpKYMhBmlMhrXi9IZdtdUJZU=",
                        "url":  "_content/MindExecution.Shared/js/mind-map-css3d-manager.js"
                    },
                    {
@@ -410,44 +410,44 @@
                        "url":  "_framework/MimeMapping.og9ys58ylm.dll"
                    },
                    {
-                       "hash":  "sha256-giL4rreoKsQoQ5gkLusNx7oL3w1l2UH52TYY1KBoIfQ=",
-                       "url":  "_framework/MindExecution.Core.6rfnfdndxq.dll"
+                       "hash":  "sha256-cRrcPtFn2SUkdgWA68l7+CQbGso1QWczG5az1KYpLUU=",
+                       "url":  "_framework/MindExecution.Core.xg9yy9l5dz.dll"
                    },
                    {
-                       "hash":  "sha256-STATJelRGcW9SDGgsw6YmQi6tkQje52dy4lyT3QU4qs=",
-                       "url":  "_framework/MindExecution.Kernel.z56elxihok.dll"
+                       "hash":  "sha256-5hDopeSFSFHb5tDeLFj0jrSt6XRq4SYxB8nyFJ6H9RQ=",
+                       "url":  "_framework/MindExecution.Kernel.erg96341xf.dll"
                    },
                    {
-                       "hash":  "sha256-jahiJxaiE8hwMyRcg6rZGo4WBhBGFyAHYhOqlKjawWg=",
-                       "url":  "_framework/MindExecution.Plugins.Admin.p5cs4ap87v.dll"
+                       "hash":  "sha256-lZvp68Zm2iFwt93gRGlHDKVnywJT2hHxA3JHu4Z3PfA=",
+                       "url":  "_framework/MindExecution.Plugins.Admin.11j9vpdm9u.dll"
                    },
                    {
-                       "hash":  "sha256-KOyk9eC6E/Gyfz2uWucHQmAayMQbShhLTqEymZFleh4=",
-                       "url":  "_framework/MindExecution.Plugins.Business.s35og5uz44.dll"
+                       "hash":  "sha256-oL53lWZ8Lp8lZuqc3UP+qIGSEVKJvVvfov+2xyQ3INg=",
+                       "url":  "_framework/MindExecution.Plugins.Business.oyskf08knn.dll"
                    },
                    {
-                       "hash":  "sha256-ZftqLWcODF69nab4DCcdrKLyTbZmu9x1E6UZj95Lwg0=",
-                       "url":  "_framework/MindExecution.Plugins.Concept.j63qelz8rk.dll"
+                       "hash":  "sha256-rO8bWy0n6NZKqMzFpcIjy/p1kG8mPSuTUZ+UMTWugf8=",
+                       "url":  "_framework/MindExecution.Plugins.Concept.keia4ox68c.dll"
                    },
                    {
-                       "hash":  "sha256-4gMuhIPLiX31U+jwhDT83rSPqZINONadmW+cvujfq1g=",
-                       "url":  "_framework/MindExecution.Plugins.Directory.y74f55e8x3.dll"
+                       "hash":  "sha256-a1eUvklwiLwuCPBk05omRoirn1tRqVgjogVW8/UAAuc=",
+                       "url":  "_framework/MindExecution.Plugins.Directory.7pus9p63ym.dll"
                    },
                    {
-                       "hash":  "sha256-DEK18qiIEbs60obGiRs+Cmr327gBOBqEGpdculGvnpo=",
-                       "url":  "_framework/MindExecution.Plugins.PlanMaster.8djc50fh8g.dll"
+                       "hash":  "sha256-pE7MM4cMUkHzg5wTQtq8Vgk+RSjlQtO44T9AwQsYDqw=",
+                       "url":  "_framework/MindExecution.Plugins.PlanMaster.wr3pupzfyo.dll"
                    },
                    {
-                       "hash":  "sha256-CTh0qytJGaYVCK0/3dOK0w8iIqQNYHmSZ5NZJW9nNgA=",
-                       "url":  "_framework/MindExecution.Plugins.YouTube.h6y03asuzq.dll"
+                       "hash":  "sha256-COvvpOYO8nsEePBr3CCF4Wv0CWfvvOAoXn54tmikwwc=",
+                       "url":  "_framework/MindExecution.Plugins.YouTube.kpfew1eggc.dll"
                    },
                    {
-                       "hash":  "sha256-rbi/VtbMCVX+T5mPBzy0KWJlu3VI/w5cILfCOhFXb2E=",
-                       "url":  "_framework/MindExecution.Shared.z07jle70qs.dll"
+                       "hash":  "sha256-4CE9pNlfu9pIL+wwsbaU4ARQLcYelkl2sqkwAJD9sD4=",
+                       "url":  "_framework/MindExecution.Shared.kzibxbai3y.dll"
                    },
                    {
-                       "hash":  "sha256-SLQj0JfkJi2Krlha+Mhem6+EG90bv7pMbiQkzs3kxJA=",
-                       "url":  "_framework/MindExecution.Web.gq00wm14q3.dll"
+                       "hash":  "sha256-7o2Y3AvthOWiFF9+lHnqahGmcN/0tDuBtJhxGdcMN44=",
+                       "url":  "_framework/MindExecution.Web.6fjnkr9ty4.dll"
                    },
                    {
                        "hash":  "sha256-IsZJ91/OW+fHzNqIgEc7Y072ns8z9dGritiSyvR9Wgc=",
@@ -770,7 +770,7 @@
                        "url":  "_framework/Websocket.Client.vapounvmnl.dll"
                    },
                    {
-                       "hash":  "sha256-eLT3oE2JQu/kbNXd/DuHPNKXRyAQELmLJSyKy++j40U=",
+                       "hash":  "sha256-ZSebVg6+73YAEhmuXnGeKZGeTBILK2WJbFuyP6Ydv2Q=",
                        "url":  "_framework/blazor.boot.json"
                    },
                    {
@@ -834,7 +834,7 @@
                        "url":  "image-manifest.json"
                    },
                    {
-                       "hash":  "sha256-2DrUTlHi/psz7d4TwdXV/IjMTlDk12gJ0x81ae3fV2U=",
+                       "hash":  "sha256-4r5HCCe1b4vT4Pzfg8qixJLEq3JWH57lt3fVWc0zLPM=",
                        "url":  "index.html"
                    },
                    {

package/wwwroot/service-worker.js

@@ -1,4 +1,4 @@
-/* Manifest version: tIrmi759 */
+/* Manifest version: HB1IB45K */
 // Hosted deployments should prefer the network over stale offline caches.
 // This service worker immediately clears old Blazor offline caches and unregisters itself.