@mindexec/cli 0.2.476 → 0.2.478

package/scripts/remote-http-smoke.mjs

@@ -1,592 +1,592 @@
-#!/usr/bin/env node
-
-import assert from 'node:assert/strict';
-import net from 'node:net';
-import { spawn } from 'node:child_process';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { readFileSync } from 'node:fs';
-
-const BRIDGE_TOKEN = 'remote-http-smoke-token';
-const PAIR_TOKEN = 'remote-http-pair-token';
-const SYNTHETIC_COUNT = Number(process.env.REMOTE_HTTP_SMOKE_COUNT || 500);
-const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const LOCAL_BRIDGE_PACKAGE = JSON.parse(readFileSync(path.join(LOCAL_BRIDGE_DIR, 'package.json'), 'utf8'));
-
-function wait(ms) {
-    return new Promise(resolve => setTimeout(resolve, ms));
-}
-
-async function findFreePort() {
-    return await new Promise((resolve, reject) => {
-        const server = net.createServer();
-        server.unref();
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            const address = server.address();
-            const port = typeof address === 'object' && address ? address.port : 0;
-            server.close(() => resolve(port));
-        });
-    });
-}
-
-async function fetchJson(url, options = {}) {
-    const response = await fetch(url, {
-        ...options,
-        headers: {
-            ...(options.body ? { 'Content-Type': 'application/json' } : {}),
-            ...(options.token ? { 'X-Bridge-Token': options.token } : {}),
-            ...(options.headers || {})
-        }
-    });
-
-    let payload = null;
-    try {
-        payload = await response.json();
-    } catch {
-        // Some failure responses may be empty.
-    }
-
-    return {
-        status: response.status,
-        ok: response.ok,
-        payload
-    };
-}
-
-async function fetchBinary(url, options = {}) {
-    const response = await fetch(url, {
-        ...options,
-        headers: {
-            Accept: 'image/png,image/jpeg,image/webp,image/*',
-            ...(options.token ? { 'X-Bridge-Token': options.token } : {}),
-            ...(options.headers || {})
-        }
-    });
-
-    return {
-        status: response.status,
-        ok: response.ok,
-        contentType: response.headers.get('content-type') || '',
-        frameSeq: response.headers.get('x-mindexec-remote-frame-seq') || '',
-        streamId: response.headers.get('x-mindexec-remote-stream-id') || '',
-        payload: Buffer.from(await response.arrayBuffer())
-    };
-}
-
-async function waitForBridge(baseUrl, getFailureDetails, bridgeToken = BRIDGE_TOKEN) {
-    const startedAt = Date.now();
-    while (Date.now() - startedAt < 30000) {
-        try {
-            const result = await fetchJson(`${baseUrl}/api/remote/status`, { token: bridgeToken });
-            if (result.ok && result.payload?.started === true) {
-                return result.payload;
-            }
-        } catch {
-            // Server is still starting.
-        }
-        await wait(100);
-    }
-
-    throw new Error(`Timed out waiting for LocalBridge RemoteHub HTTP API.\n${getFailureDetails()}`);
-}
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const bridgeRoot = path.resolve(__dirname, '..');
-
-function spawnBridge({
-    bridgePort,
-    remoteHubPort,
-    bridgeToken = BRIDGE_TOKEN,
-    pairToken = PAIR_TOKEN,
-    syntheticFleetEnabled = false
-}) {
-    const env = {
-        ...process.env,
-        BRIDGE_PORT: String(bridgePort),
-        BRIDGE_TOKEN: bridgeToken,
-        BRIDGE_REQUIRE_TOKEN: '1',
-        MINDEXEC_REMOTE_HUB: '1',
-        REMOTE_HUB_HOST: '127.0.0.1',
-        REMOTE_HUB_PORT: String(remoteHubPort),
-        REMOTE_HUB_PAIR_TOKEN: pairToken,
-        NO_COLOR: '1'
-    };
-
-    delete env.MINDEXEC_REMOTE_SYNTHETIC_FLEET;
-    delete env.REMOTE_HUB_SYNTHETIC_FLEET;
-    if (syntheticFleetEnabled) {
-        env.MINDEXEC_REMOTE_SYNTHETIC_FLEET = '1';
-    }
-
-    const child = spawn(process.execPath, ['server.js'], {
-        cwd: bridgeRoot,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        windowsHide: true,
-        env
-    });
-
-    let stdout = '';
-    let stderr = '';
-    child.stdout.on('data', chunk => {
-        stdout += chunk.toString();
-    });
-    child.stderr.on('data', chunk => {
-        stderr += chunk.toString();
-    });
-
-    const exitPromise = new Promise(resolve => child.once('exit', resolve));
-    const details = () => `stdout=${stdout}\nstderr=${stderr}`;
-    const stop = async () => {
-        if (child.exitCode === null && !child.killed) {
-            child.kill('SIGTERM');
-            await Promise.race([
-                exitPromise,
-                wait(5000)
-            ]);
-            if (child.exitCode === null && !child.killed) {
-                child.kill('SIGKILL');
-            }
-        }
-    };
-
-    return {
-        baseUrl: `http://127.0.0.1:${bridgePort}`,
-        bridgePort,
-        remoteHubPort,
-        bridgeToken,
-        pairToken,
-        child,
-        details,
-        stop
-    };
-}
-
-async function runSyntheticEnabledSmoke() {
-    const bridgePort = await findFreePort();
-    const remoteHubPort = await findFreePort();
-    const bridge = spawnBridge({
-        bridgePort,
-        remoteHubPort,
-        syntheticFleetEnabled: true
-    });
-    const { baseUrl } = bridge;
-    const details = bridge.details;
-
-    try {
-    const status = await waitForBridge(baseUrl, details, bridge.bridgeToken);
-    assert.equal(status.started, true);
-    assert.equal(status.port, remoteHubPort);
-    assert.equal(status.managerPackage, '@mindexec/cli');
-    assert.equal(status.managerVersion, LOCAL_BRIDGE_PACKAGE.version);
-    assert.equal(status.agentPackage, '@mindexec/remote');
-    assert.equal(status.canvasPagination, 'none');
-    assert.equal(status.canvasDeviceListMode, 'all-devices');
-    assert.equal(status.hostTargetActive, false);
-    assert.equal(status.pairToken, PAIR_TOKEN);
-
-    const unauthorizedStatus = await fetchJson(`${baseUrl}/api/remote/status`);
-    assert.equal(unauthorizedStatus.status, 401);
-    assert.equal(unauthorizedStatus.payload?.header, 'X-Bridge-Token');
-
-    const unauthorizedDelete = await fetchJson(`${baseUrl}/api/remote/synthetic`, {
-        method: 'DELETE'
-    });
-    assert.equal(unauthorizedDelete.status, 401);
-
-    const unauthorizedHost = await fetchJson(`${baseUrl}/api/remote/host-target`, {
-        method: 'POST',
-        body: JSON.stringify({
-            nodeId: 'remote-fleet-host-unauthorized',
-            enabled: true
-        })
-    });
-    assert.equal(unauthorizedHost.status, 401);
-
-    const setHost = await fetchJson(`${baseUrl}/api/remote/host-target`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            nodeId: 'remote-fleet-monitor-a',
-            enabled: true,
-            leaseMs: 30000
-        })
-    });
-    assert.equal(setHost.ok, true, JSON.stringify(setHost.payload));
-    assert.equal(setHost.payload?.ok, true);
-    assert.equal(setHost.payload?.active, true);
-    assert.equal(setHost.payload?.hostTarget?.nodeId, 'remote-fleet-monitor-a');
-    assert.equal(setHost.payload?.hostTarget?.endpoint, `127.0.0.1:${remoteHubPort}`);
-    assert.deepEqual(setHost.payload?.hostTarget?.endpointCandidates, [`127.0.0.1:${remoteHubPort}`]);
-
-    const hostStatus = await fetchJson(`${baseUrl}/api/remote/status`, { token: BRIDGE_TOKEN });
-    assert.equal(hostStatus.ok, true, JSON.stringify(hostStatus.payload));
-    assert.equal(hostStatus.payload?.hostTargetActive, true);
-    assert.equal(hostStatus.payload?.hostTargetNodeId, 'remote-fleet-monitor-a');
-    assert.equal(hostStatus.payload?.hostTargetEndpoint, `127.0.0.1:${remoteHubPort}`);
-    assert.deepEqual(hostStatus.payload?.hostTargetEndpointCandidates, [`127.0.0.1:${remoteHubPort}`]);
-
-    const clearHostMismatch = await fetchJson(`${baseUrl}/api/remote/host-target`, {
-        method: 'DELETE',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            nodeId: 'remote-fleet-monitor-b'
-        })
-    });
-    assert.equal(clearHostMismatch.ok, true, JSON.stringify(clearHostMismatch.payload));
-    assert.equal(clearHostMismatch.payload?.ok, false);
-    assert.equal(clearHostMismatch.payload?.error, 'host-target-node-mismatch');
-
-    const clearHost = await fetchJson(`${baseUrl}/api/remote/host-target`, {
-        method: 'DELETE',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            nodeId: 'remote-fleet-monitor-a'
-        })
-    });
-    assert.equal(clearHost.ok, true, JSON.stringify(clearHost.payload));
-    assert.equal(clearHost.payload?.ok, true);
-    assert.equal(clearHost.payload?.active, false);
-
-    const seed = await fetchJson(`${baseUrl}/api/remote/synthetic/seed`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            count: SYNTHETIC_COUNT,
-            connectedRatio: 0.84,
-            thumbnailRatio: 0.72,
-            aiAssistRatio: 0.42,
-            liveCount: 8,
-            replace: true
-        })
-    });
-    assert.equal(seed.ok, true, JSON.stringify(seed.payload));
-    assert.equal(seed.payload?.ok, true);
-    assert.equal(seed.payload?.seeded, SYNTHETIC_COUNT);
-
-    const devicesResult = await fetchJson(`${baseUrl}/api/remote/devices`, { token: BRIDGE_TOKEN });
-    assert.equal(devicesResult.ok, true, JSON.stringify(devicesResult.payload));
-    assert.equal(devicesResult.payload?.total, SYNTHETIC_COUNT);
-    assert.equal(devicesResult.payload?.pagination, 'none');
-    assert.equal(devicesResult.payload?.canvasDeviceListMode, 'all-devices');
-    assert.equal(devicesResult.payload?.devices?.length, SYNTHETIC_COUNT);
-    assert.equal(devicesResult.payload.devices.some(device => device.connected === false), true);
-
-    const noControlTarget = devicesResult.payload.devices.find(device => device.connected);
-    assert.ok(noControlTarget);
-    const inputUnavailable = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(noControlTarget.deviceId)}/input`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            type: 'noop'
-        })
-    });
-    assert.equal(inputUnavailable.ok, true, JSON.stringify(inputUnavailable.payload));
-    assert.equal(inputUnavailable.payload?.ok, false);
-    assert.equal(inputUnavailable.payload?.error, 'device-input-control-unavailable');
-
-    const connectedTargets = devicesResult.payload.devices
-        .filter(device => device.connected && device.capabilities?.taskDispatch)
-        .slice(0, 500)
-        .map(device => device.deviceId);
-    assert.ok(connectedTargets.length >= 400);
-
-    const batch = await fetchJson(`${baseUrl}/api/remote/tasks`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            deviceIds: connectedTargets,
-            allConnected: false,
-            title: 'HTTP smoke task batch',
-            instruction: 'HTTP smoke batch: report current status to the manager.',
-            approvalLevel: 'task-only'
-        })
-    });
-    assert.equal(batch.ok, true, JSON.stringify(batch.payload));
-    assert.equal(batch.payload?.ok, true);
-    assert.equal(batch.payload?.total, connectedTargets.length);
-    assert.equal(batch.payload?.queued, connectedTargets.length);
-    assert.equal(batch.payload?.batch?.completed, connectedTargets.length);
-    assert.equal(batch.payload?.batch?.failed, 0);
-    assert.equal(batch.payload?.batch?.status, 'completed');
-
-    const aiTargets = devicesResult.payload.devices
-        .filter(device => device.connected && device.capabilities?.taskDispatch && device.capabilities?.aiAssist)
-        .map(device => device.deviceId);
-    assert.ok(aiTargets.length >= 200);
-    const allAiBatch = await fetchJson(`${baseUrl}/api/remote/tasks`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            allConnected: true,
-            title: 'HTTP smoke all AI task batch',
-            instruction: 'HTTP smoke AI batch: summarize fleet condition only on AI-capable agents.',
-            approvalLevel: 'ai-assist'
-        })
-    });
-    assert.equal(allAiBatch.ok, true, JSON.stringify(allAiBatch.payload));
-    assert.equal(allAiBatch.payload?.ok, true);
-    assert.equal(allAiBatch.payload?.approvalLevel, 'ai-assist');
-    assert.equal(allAiBatch.payload?.total, aiTargets.length);
-    assert.equal(allAiBatch.payload?.queued, aiTargets.length);
-    assert.equal(allAiBatch.payload?.batch?.completed, aiTargets.length);
-    assert.equal(allAiBatch.payload?.batch?.failed, 0);
-    assert.equal(allAiBatch.payload?.batch?.status, 'completed');
-    assert.deepEqual(
-        [...(allAiBatch.payload?.results || []).map(result => result.deviceId)].sort(),
-        [...aiTargets].sort());
-
-    const aiTarget = devicesResult.payload.devices.find(device =>
-        device.connected && device.capabilities?.taskDispatch && device.capabilities?.aiAssist);
-    assert.ok(aiTarget);
-    const aiTask = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(aiTarget.deviceId)}/tasks`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            title: 'HTTP smoke AI task',
-            instruction: 'HTTP smoke AI assist: summarize fleet condition.',
-            approvalLevel: 'ai-assist'
-        })
-    });
-    assert.equal(aiTask.ok, true, JSON.stringify(aiTask.payload));
-    assert.equal(aiTask.payload?.ok, true);
-    assert.equal(aiTask.payload?.approvalLevel, 'ai-assist');
-
-    const thumbnailTarget = devicesResult.payload.devices.find(device =>
-        device.connected && device.capabilities?.thumbnail);
-    assert.ok(thumbnailTarget);
-    const thumbnailRequest = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail/request`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            streamId: 'http-smoke-thumb',
-            maxWidth: 360,
-            maxHeight: 220,
-            quality: 50
-        })
-    });
-    assert.equal(thumbnailRequest.ok, true, JSON.stringify(thumbnailRequest.payload));
-    assert.equal(thumbnailRequest.payload?.ok, true);
-
-    const thumbnail = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail`, {
-        token: BRIDGE_TOKEN
-    });
-    assert.equal(thumbnail.ok, true, JSON.stringify(thumbnail.payload));
-    assert.equal(thumbnail.payload?.thumbnail?.streamId, 'http-smoke-thumb');
-    assert.ok(!('dataUrl' in thumbnail.payload.thumbnail));
-    assert.ok(String(thumbnail.payload?.thumbnail?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail?`));
-    assert.equal(thumbnail.payload?.thumbnail?.frameUrl, thumbnail.payload?.thumbnail?.framePath);
-
-    const thumbnailWithData = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail?includeDataUrl=true`, {
-        token: BRIDGE_TOKEN
-    });
-    assert.equal(thumbnailWithData.ok, true, JSON.stringify(thumbnailWithData.payload));
-    assert.ok(String(thumbnailWithData.payload?.thumbnail?.dataUrl || '').startsWith('data:image/png;base64,'));
-
-    const thumbnailBinary = await fetchBinary(`${baseUrl}${thumbnail.payload.thumbnail.framePath}`);
-    assert.equal(thumbnailBinary.ok, true, `${thumbnailBinary.status} ${thumbnailBinary.contentType}`);
-    assert.equal(thumbnailBinary.contentType, 'image/png');
-    assert.equal(thumbnailBinary.streamId, 'http-smoke-thumb');
-    assert.ok(thumbnailBinary.payload.length > 0);
-
-    const badThumbnailBinary = await fetchBinary(`${baseUrl}${thumbnail.payload.thumbnail.framePath.replace(/token=[^&]+/, 'token=wrong-token')}`);
-    assert.equal(badThumbnailBinary.status, 401);
-
-    const devicesUrlOnlyResult = await fetchJson(`${baseUrl}/api/remote/devices?frameData=url`, { token: BRIDGE_TOKEN });
-    assert.equal(devicesUrlOnlyResult.ok, true, JSON.stringify(devicesUrlOnlyResult.payload));
-    const urlOnlyThumbnailDevice = devicesUrlOnlyResult.payload?.devices?.find(device => device.deviceId === thumbnailTarget.deviceId);
-    assert.ok(urlOnlyThumbnailDevice?.latestThumbnail?.framePath);
-    assert.ok(!('dataUrl' in urlOnlyThumbnailDevice.latestThumbnail));
-
-    const thumbnailFramesOnly = await fetchJson(`${baseUrl}/api/remote/frames`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            deviceIds: [thumbnailTarget.deviceId],
-            includeThumbnail: true,
-            includeLive: true
-        })
-    });
-    assert.equal(thumbnailFramesOnly.ok, true, JSON.stringify(thumbnailFramesOnly.payload));
-    assert.equal(thumbnailFramesOnly.payload?.ok, true);
-    assert.equal(thumbnailFramesOnly.payload?.frames?.length, 1);
-    assert.equal(thumbnailFramesOnly.payload.frames[0].deviceId, thumbnailTarget.deviceId);
-    assert.equal(thumbnailFramesOnly.payload.frames[0].thumbnailEnabled, true);
-    assert.ok(String(thumbnailFramesOnly.payload.frames[0].thumbnail?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail?`));
-    assert.ok(!('dataUrl' in thumbnailFramesOnly.payload.frames[0].thumbnail));
-
-    const liveTarget = devicesResult.payload.devices.find(device =>
-        device.connected && device.capabilities?.liveStream);
-    assert.ok(liveTarget);
-    const liveStart = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/start`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            streamId: 'http-smoke-live',
-            fps: 20,
-            maxWidth: 960,
-            maxHeight: 540,
-            quality: 60
-        })
-    });
-    assert.equal(liveStart.ok, true, JSON.stringify(liveStart.payload));
-    assert.equal(liveStart.payload?.ok, true);
-
-    const liveFrame = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame`, {
-        token: BRIDGE_TOKEN
-    });
-    assert.equal(liveFrame.ok, true, JSON.stringify(liveFrame.payload));
-    assert.equal(liveFrame.payload?.frame?.streamId, 'http-smoke-live');
-    assert.equal(liveFrame.payload?.frame?.mode, 'remote-fast');
-    assert.equal(liveFrame.payload?.frame?.fps, 20);
-    assert.ok(!('dataUrl' in liveFrame.payload.frame));
-    assert.ok(String(liveFrame.payload?.frame?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?`));
-
-    const liveFrameWithData = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?includeDataUrl=true`, {
-        token: BRIDGE_TOKEN
-    });
-    assert.equal(liveFrameWithData.ok, true, JSON.stringify(liveFrameWithData.payload));
-    assert.ok(String(liveFrameWithData.payload?.frame?.dataUrl || '').startsWith('data:image/png;base64,'));
-
-    const liveBinary = await fetchBinary(`${baseUrl}${liveFrame.payload.frame.framePath}`);
-    assert.equal(liveBinary.ok, true, `${liveBinary.status} ${liveBinary.contentType}`);
-    assert.equal(liveBinary.contentType, 'image/png');
-    assert.equal(liveBinary.streamId, 'http-smoke-live');
-    assert.ok(liveBinary.payload.length > 0);
-
-    const liveBinaryWithBridgeToken = await fetchBinary(
-        `${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?format=binary`,
-        { token: BRIDGE_TOKEN });
-    assert.equal(liveBinaryWithBridgeToken.ok, true, `${liveBinaryWithBridgeToken.status} ${liveBinaryWithBridgeToken.contentType}`);
-    assert.equal(liveBinaryWithBridgeToken.contentType, 'image/png');
-
-    const badLiveSeq = await fetchBinary(`${baseUrl}${liveFrame.payload.frame.framePath.replace(/seq=\d+/, 'seq=999999')}`);
-    assert.equal(badLiveSeq.status, 401);
-
-    const liveFramesOnly = await fetchJson(`${baseUrl}/api/remote/frames`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            deviceIds: [liveTarget.deviceId],
-            includeThumbnail: true,
-            includeLive: true
-        })
-    });
-    assert.equal(liveFramesOnly.ok, true, JSON.stringify(liveFramesOnly.payload));
-    assert.equal(liveFramesOnly.payload?.ok, true);
-    assert.equal(liveFramesOnly.payload?.frames?.length, 1);
-    assert.equal(liveFramesOnly.payload.frames[0].deviceId, liveTarget.deviceId);
-    assert.equal(liveFramesOnly.payload.frames[0].liveStreamActive, true);
-    assert.ok(String(liveFramesOnly.payload.frames[0].live?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?`));
-    assert.ok(!('dataUrl' in liveFramesOnly.payload.frames[0].live));
-
-    const liveStop = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/stop`, {
-        method: 'POST',
-        token: BRIDGE_TOKEN,
-        body: JSON.stringify({
-            streamId: 'http-smoke-live'
-        })
-    });
-    assert.equal(liveStop.ok, true, JSON.stringify(liveStop.payload));
-    assert.equal(liveStop.payload?.ok, true);
-
-    const clear = await fetchJson(`${baseUrl}/api/remote/synthetic`, {
-        method: 'DELETE',
-        token: BRIDGE_TOKEN
-    });
-    assert.equal(clear.ok, true, JSON.stringify(clear.payload));
-    assert.equal(clear.payload?.ok, true);
-    assert.equal(clear.payload?.removed, SYNTHETIC_COUNT);
-
-    console.log(`RemoteHub HTTP smoke OK (${SYNTHETIC_COUNT} synthetic devices, bridge ${bridgePort}, remote ${remoteHubPort})`);
-} finally {
-    await bridge.stop();
-}
-}
-
-async function runSyntheticDisabledSmoke() {
-    const bridgePort = await findFreePort();
-    const remoteHubPort = await findFreePort();
-    const bridgeToken = `${BRIDGE_TOKEN}-disabled`;
-    const pairToken = `${PAIR_TOKEN}-disabled`;
-    const bridge = spawnBridge({
-        bridgePort,
-        remoteHubPort,
-        bridgeToken,
-        pairToken,
-        syntheticFleetEnabled: false
-    });
-    const { baseUrl } = bridge;
-
-    try {
-        const status = await waitForBridge(baseUrl, bridge.details, bridge.bridgeToken);
-        assert.equal(status.started, true);
-        assert.equal(status.port, remoteHubPort);
-        assert.equal(status.pairToken, pairToken);
-        assert.equal(status.canvasPagination, 'none');
-        assert.equal(status.canvasDeviceListMode, 'all-devices');
-        assert.equal(status.hostTargetActive, false);
-
-        const seedDenied = await fetchJson(`${baseUrl}/api/remote/synthetic/seed`, {
-            method: 'POST',
-            token: bridge.bridgeToken,
-            body: JSON.stringify({
-                count: 3,
-                replace: true
-            })
-        });
-        assert.equal(seedDenied.status, 403);
-        assert.equal(seedDenied.payload?.ok, false);
-        assert.equal(seedDenied.payload?.error, 'synthetic-fleet-disabled');
-
-        const clearDenied = await fetchJson(`${baseUrl}/api/remote/synthetic`, {
-            method: 'DELETE',
-            token: bridge.bridgeToken
-        });
-        assert.equal(clearDenied.status, 403);
-        assert.equal(clearDenied.payload?.ok, false);
-        assert.equal(clearDenied.payload?.error, 'synthetic-fleet-disabled');
-
-        const devicesResult = await fetchJson(`${baseUrl}/api/remote/devices`, { token: bridge.bridgeToken });
-        assert.equal(devicesResult.ok, true, JSON.stringify(devicesResult.payload));
-        assert.equal(devicesResult.payload?.total, 0);
-        assert.equal(devicesResult.payload?.pagination, 'none');
-        assert.equal(devicesResult.payload?.canvasDeviceListMode, 'all-devices');
-        assert.equal(devicesResult.payload?.devices?.length, 0);
-
-        const emptyBatch = await fetchJson(`${baseUrl}/api/remote/tasks`, {
-            method: 'POST',
-            token: bridge.bridgeToken,
-            body: JSON.stringify({
-                allConnected: true,
-                title: 'HTTP smoke no target batch',
-                instruction: 'This should not queue because no remote devices are connected.',
-                approvalLevel: 'task-only'
-            })
-        });
-        assert.equal(emptyBatch.ok, true, JSON.stringify(emptyBatch.payload));
-        assert.equal(emptyBatch.payload?.ok, false);
-        assert.equal(emptyBatch.payload?.total, 0);
-        assert.equal(emptyBatch.payload?.queued, 0);
-        assert.equal(emptyBatch.payload?.error, 'no-target-devices');
-
-        const hostTarget = await fetchJson(`${baseUrl}/api/remote/host-target`, {
-            method: 'POST',
-            token: bridge.bridgeToken,
-            body: JSON.stringify({
-                nodeId: 'disabled-synthetic-host',
-                enabled: true
-            })
-        });
-        assert.equal(hostTarget.ok, true, JSON.stringify(hostTarget.payload));
-        assert.equal(hostTarget.payload?.ok, true);
-        assert.equal(hostTarget.payload?.active, true);
-
-        console.log(`RemoteHub HTTP safety smoke OK (synthetic disabled, bridge ${bridgePort}, remote ${remoteHubPort})`);
-    } finally {
-        await bridge.stop();
-    }
-}
-
-await runSyntheticEnabledSmoke();
-await runSyntheticDisabledSmoke();
+#!/usr/bin/env node
+
+import assert from 'node:assert/strict';
+import net from 'node:net';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readFileSync } from 'node:fs';
+
+const BRIDGE_TOKEN = 'remote-http-smoke-token';
+const PAIR_TOKEN = 'remote-http-pair-token';
+const SYNTHETIC_COUNT = Number(process.env.REMOTE_HTTP_SMOKE_COUNT || 500);
+const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LOCAL_BRIDGE_PACKAGE = JSON.parse(readFileSync(path.join(LOCAL_BRIDGE_DIR, 'package.json'), 'utf8'));
+
+function wait(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+async function findFreePort() {
+    return await new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.unref();
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address ? address.port : 0;
+            server.close(() => resolve(port));
+        });
+    });
+}
+
+async function fetchJson(url, options = {}) {
+    const response = await fetch(url, {
+        ...options,
+        headers: {
+            ...(options.body ? { 'Content-Type': 'application/json' } : {}),
+            ...(options.token ? { 'X-Bridge-Token': options.token } : {}),
+            ...(options.headers || {})
+        }
+    });
+
+    let payload = null;
+    try {
+        payload = await response.json();
+    } catch {
+        // Some failure responses may be empty.
+    }
+
+    return {
+        status: response.status,
+        ok: response.ok,
+        payload
+    };
+}
+
+async function fetchBinary(url, options = {}) {
+    const response = await fetch(url, {
+        ...options,
+        headers: {
+            Accept: 'image/png,image/jpeg,image/webp,image/*',
+            ...(options.token ? { 'X-Bridge-Token': options.token } : {}),
+            ...(options.headers || {})
+        }
+    });
+
+    return {
+        status: response.status,
+        ok: response.ok,
+        contentType: response.headers.get('content-type') || '',
+        frameSeq: response.headers.get('x-mindexec-remote-frame-seq') || '',
+        streamId: response.headers.get('x-mindexec-remote-stream-id') || '',
+        payload: Buffer.from(await response.arrayBuffer())
+    };
+}
+
+async function waitForBridge(baseUrl, getFailureDetails, bridgeToken = BRIDGE_TOKEN) {
+    const startedAt = Date.now();
+    while (Date.now() - startedAt < 30000) {
+        try {
+            const result = await fetchJson(`${baseUrl}/api/remote/status`, { token: bridgeToken });
+            if (result.ok && result.payload?.started === true) {
+                return result.payload;
+            }
+        } catch {
+            // Server is still starting.
+        }
+        await wait(100);
+    }
+
+    throw new Error(`Timed out waiting for LocalBridge RemoteHub HTTP API.\n${getFailureDetails()}`);
+}
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const bridgeRoot = path.resolve(__dirname, '..');
+
+function spawnBridge({
+    bridgePort,
+    remoteHubPort,
+    bridgeToken = BRIDGE_TOKEN,
+    pairToken = PAIR_TOKEN,
+    syntheticFleetEnabled = false
+}) {
+    const env = {
+        ...process.env,
+        BRIDGE_PORT: String(bridgePort),
+        BRIDGE_TOKEN: bridgeToken,
+        BRIDGE_REQUIRE_TOKEN: '1',
+        MINDEXEC_REMOTE_HUB: '1',
+        REMOTE_HUB_HOST: '127.0.0.1',
+        REMOTE_HUB_PORT: String(remoteHubPort),
+        REMOTE_HUB_PAIR_TOKEN: pairToken,
+        NO_COLOR: '1'
+    };
+
+    delete env.MINDEXEC_REMOTE_SYNTHETIC_FLEET;
+    delete env.REMOTE_HUB_SYNTHETIC_FLEET;
+    if (syntheticFleetEnabled) {
+        env.MINDEXEC_REMOTE_SYNTHETIC_FLEET = '1';
+    }
+
+    const child = spawn(process.execPath, ['server.js'], {
+        cwd: bridgeRoot,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        env
+    });
+
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', chunk => {
+        stdout += chunk.toString();
+    });
+    child.stderr.on('data', chunk => {
+        stderr += chunk.toString();
+    });
+
+    const exitPromise = new Promise(resolve => child.once('exit', resolve));
+    const details = () => `stdout=${stdout}\nstderr=${stderr}`;
+    const stop = async () => {
+        if (child.exitCode === null && !child.killed) {
+            child.kill('SIGTERM');
+            await Promise.race([
+                exitPromise,
+                wait(5000)
+            ]);
+            if (child.exitCode === null && !child.killed) {
+                child.kill('SIGKILL');
+            }
+        }
+    };
+
+    return {
+        baseUrl: `http://127.0.0.1:${bridgePort}`,
+        bridgePort,
+        remoteHubPort,
+        bridgeToken,
+        pairToken,
+        child,
+        details,
+        stop
+    };
+}
+
+async function runSyntheticEnabledSmoke() {
+    const bridgePort = await findFreePort();
+    const remoteHubPort = await findFreePort();
+    const bridge = spawnBridge({
+        bridgePort,
+        remoteHubPort,
+        syntheticFleetEnabled: true
+    });
+    const { baseUrl } = bridge;
+    const details = bridge.details;
+
+    try {
+    const status = await waitForBridge(baseUrl, details, bridge.bridgeToken);
+    assert.equal(status.started, true);
+    assert.equal(status.port, remoteHubPort);
+    assert.equal(status.managerPackage, '@mindexec/cli');
+    assert.equal(status.managerVersion, LOCAL_BRIDGE_PACKAGE.version);
+    assert.equal(status.agentPackage, '@mindexec/remote');
+    assert.equal(status.canvasPagination, 'none');
+    assert.equal(status.canvasDeviceListMode, 'all-devices');
+    assert.equal(status.hostTargetActive, false);
+    assert.equal(status.pairToken, PAIR_TOKEN);
+
+    const unauthorizedStatus = await fetchJson(`${baseUrl}/api/remote/status`);
+    assert.equal(unauthorizedStatus.status, 401);
+    assert.equal(unauthorizedStatus.payload?.header, 'X-Bridge-Token');
+
+    const unauthorizedDelete = await fetchJson(`${baseUrl}/api/remote/synthetic`, {
+        method: 'DELETE'
+    });
+    assert.equal(unauthorizedDelete.status, 401);
+
+    const unauthorizedHost = await fetchJson(`${baseUrl}/api/remote/host-target`, {
+        method: 'POST',
+        body: JSON.stringify({
+            nodeId: 'remote-fleet-host-unauthorized',
+            enabled: true
+        })
+    });
+    assert.equal(unauthorizedHost.status, 401);
+
+    const setHost = await fetchJson(`${baseUrl}/api/remote/host-target`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            nodeId: 'remote-fleet-monitor-a',
+            enabled: true,
+            leaseMs: 30000
+        })
+    });
+    assert.equal(setHost.ok, true, JSON.stringify(setHost.payload));
+    assert.equal(setHost.payload?.ok, true);
+    assert.equal(setHost.payload?.active, true);
+    assert.equal(setHost.payload?.hostTarget?.nodeId, 'remote-fleet-monitor-a');
+    assert.equal(setHost.payload?.hostTarget?.endpoint, `127.0.0.1:${remoteHubPort}`);
+    assert.deepEqual(setHost.payload?.hostTarget?.endpointCandidates, [`127.0.0.1:${remoteHubPort}`]);
+
+    const hostStatus = await fetchJson(`${baseUrl}/api/remote/status`, { token: BRIDGE_TOKEN });
+    assert.equal(hostStatus.ok, true, JSON.stringify(hostStatus.payload));
+    assert.equal(hostStatus.payload?.hostTargetActive, true);
+    assert.equal(hostStatus.payload?.hostTargetNodeId, 'remote-fleet-monitor-a');
+    assert.equal(hostStatus.payload?.hostTargetEndpoint, `127.0.0.1:${remoteHubPort}`);
+    assert.deepEqual(hostStatus.payload?.hostTargetEndpointCandidates, [`127.0.0.1:${remoteHubPort}`]);
+
+    const clearHostMismatch = await fetchJson(`${baseUrl}/api/remote/host-target`, {
+        method: 'DELETE',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            nodeId: 'remote-fleet-monitor-b'
+        })
+    });
+    assert.equal(clearHostMismatch.ok, true, JSON.stringify(clearHostMismatch.payload));
+    assert.equal(clearHostMismatch.payload?.ok, false);
+    assert.equal(clearHostMismatch.payload?.error, 'host-target-node-mismatch');
+
+    const clearHost = await fetchJson(`${baseUrl}/api/remote/host-target`, {
+        method: 'DELETE',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            nodeId: 'remote-fleet-monitor-a'
+        })
+    });
+    assert.equal(clearHost.ok, true, JSON.stringify(clearHost.payload));
+    assert.equal(clearHost.payload?.ok, true);
+    assert.equal(clearHost.payload?.active, false);
+
+    const seed = await fetchJson(`${baseUrl}/api/remote/synthetic/seed`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            count: SYNTHETIC_COUNT,
+            connectedRatio: 0.84,
+            thumbnailRatio: 0.72,
+            aiAssistRatio: 0.42,
+            liveCount: 8,
+            replace: true
+        })
+    });
+    assert.equal(seed.ok, true, JSON.stringify(seed.payload));
+    assert.equal(seed.payload?.ok, true);
+    assert.equal(seed.payload?.seeded, SYNTHETIC_COUNT);
+
+    const devicesResult = await fetchJson(`${baseUrl}/api/remote/devices`, { token: BRIDGE_TOKEN });
+    assert.equal(devicesResult.ok, true, JSON.stringify(devicesResult.payload));
+    assert.equal(devicesResult.payload?.total, SYNTHETIC_COUNT);
+    assert.equal(devicesResult.payload?.pagination, 'none');
+    assert.equal(devicesResult.payload?.canvasDeviceListMode, 'all-devices');
+    assert.equal(devicesResult.payload?.devices?.length, SYNTHETIC_COUNT);
+    assert.equal(devicesResult.payload.devices.some(device => device.connected === false), true);
+
+    const noControlTarget = devicesResult.payload.devices.find(device => device.connected);
+    assert.ok(noControlTarget);
+    const inputUnavailable = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(noControlTarget.deviceId)}/input`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            type: 'noop'
+        })
+    });
+    assert.equal(inputUnavailable.ok, true, JSON.stringify(inputUnavailable.payload));
+    assert.equal(inputUnavailable.payload?.ok, false);
+    assert.equal(inputUnavailable.payload?.error, 'device-input-control-unavailable');
+
+    const connectedTargets = devicesResult.payload.devices
+        .filter(device => device.connected && device.capabilities?.taskDispatch)
+        .slice(0, 500)
+        .map(device => device.deviceId);
+    assert.ok(connectedTargets.length >= 400);
+
+    const batch = await fetchJson(`${baseUrl}/api/remote/tasks`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            deviceIds: connectedTargets,
+            allConnected: false,
+            title: 'HTTP smoke task batch',
+            instruction: 'HTTP smoke batch: report current status to the manager.',
+            approvalLevel: 'task-only'
+        })
+    });
+    assert.equal(batch.ok, true, JSON.stringify(batch.payload));
+    assert.equal(batch.payload?.ok, true);
+    assert.equal(batch.payload?.total, connectedTargets.length);
+    assert.equal(batch.payload?.queued, connectedTargets.length);
+    assert.equal(batch.payload?.batch?.completed, connectedTargets.length);
+    assert.equal(batch.payload?.batch?.failed, 0);
+    assert.equal(batch.payload?.batch?.status, 'completed');
+
+    const aiTargets = devicesResult.payload.devices
+        .filter(device => device.connected && device.capabilities?.taskDispatch && device.capabilities?.aiAssist)
+        .map(device => device.deviceId);
+    assert.ok(aiTargets.length >= 200);
+    const allAiBatch = await fetchJson(`${baseUrl}/api/remote/tasks`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            allConnected: true,
+            title: 'HTTP smoke all AI task batch',
+            instruction: 'HTTP smoke AI batch: summarize fleet condition only on AI-capable agents.',
+            approvalLevel: 'ai-assist'
+        })
+    });
+    assert.equal(allAiBatch.ok, true, JSON.stringify(allAiBatch.payload));
+    assert.equal(allAiBatch.payload?.ok, true);
+    assert.equal(allAiBatch.payload?.approvalLevel, 'ai-assist');
+    assert.equal(allAiBatch.payload?.total, aiTargets.length);
+    assert.equal(allAiBatch.payload?.queued, aiTargets.length);
+    assert.equal(allAiBatch.payload?.batch?.completed, aiTargets.length);
+    assert.equal(allAiBatch.payload?.batch?.failed, 0);
+    assert.equal(allAiBatch.payload?.batch?.status, 'completed');
+    assert.deepEqual(
+        [...(allAiBatch.payload?.results || []).map(result => result.deviceId)].sort(),
+        [...aiTargets].sort());
+
+    const aiTarget = devicesResult.payload.devices.find(device =>
+        device.connected && device.capabilities?.taskDispatch && device.capabilities?.aiAssist);
+    assert.ok(aiTarget);
+    const aiTask = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(aiTarget.deviceId)}/tasks`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            title: 'HTTP smoke AI task',
+            instruction: 'HTTP smoke AI assist: summarize fleet condition.',
+            approvalLevel: 'ai-assist'
+        })
+    });
+    assert.equal(aiTask.ok, true, JSON.stringify(aiTask.payload));
+    assert.equal(aiTask.payload?.ok, true);
+    assert.equal(aiTask.payload?.approvalLevel, 'ai-assist');
+
+    const thumbnailTarget = devicesResult.payload.devices.find(device =>
+        device.connected && device.capabilities?.thumbnail);
+    assert.ok(thumbnailTarget);
+    const thumbnailRequest = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail/request`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            streamId: 'http-smoke-thumb',
+            maxWidth: 360,
+            maxHeight: 220,
+            quality: 50
+        })
+    });
+    assert.equal(thumbnailRequest.ok, true, JSON.stringify(thumbnailRequest.payload));
+    assert.equal(thumbnailRequest.payload?.ok, true);
+
+    const thumbnail = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail`, {
+        token: BRIDGE_TOKEN
+    });
+    assert.equal(thumbnail.ok, true, JSON.stringify(thumbnail.payload));
+    assert.equal(thumbnail.payload?.thumbnail?.streamId, 'http-smoke-thumb');
+    assert.ok(!('dataUrl' in thumbnail.payload.thumbnail));
+    assert.ok(String(thumbnail.payload?.thumbnail?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail?`));
+    assert.equal(thumbnail.payload?.thumbnail?.frameUrl, thumbnail.payload?.thumbnail?.framePath);
+
+    const thumbnailWithData = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail?includeDataUrl=true`, {
+        token: BRIDGE_TOKEN
+    });
+    assert.equal(thumbnailWithData.ok, true, JSON.stringify(thumbnailWithData.payload));
+    assert.ok(String(thumbnailWithData.payload?.thumbnail?.dataUrl || '').startsWith('data:image/png;base64,'));
+
+    const thumbnailBinary = await fetchBinary(`${baseUrl}${thumbnail.payload.thumbnail.framePath}`);
+    assert.equal(thumbnailBinary.ok, true, `${thumbnailBinary.status} ${thumbnailBinary.contentType}`);
+    assert.equal(thumbnailBinary.contentType, 'image/png');
+    assert.equal(thumbnailBinary.streamId, 'http-smoke-thumb');
+    assert.ok(thumbnailBinary.payload.length > 0);
+
+    const badThumbnailBinary = await fetchBinary(`${baseUrl}${thumbnail.payload.thumbnail.framePath.replace(/token=[^&]+/, 'token=wrong-token')}`);
+    assert.equal(badThumbnailBinary.status, 401);
+
+    const devicesUrlOnlyResult = await fetchJson(`${baseUrl}/api/remote/devices?frameData=url`, { token: BRIDGE_TOKEN });
+    assert.equal(devicesUrlOnlyResult.ok, true, JSON.stringify(devicesUrlOnlyResult.payload));
+    const urlOnlyThumbnailDevice = devicesUrlOnlyResult.payload?.devices?.find(device => device.deviceId === thumbnailTarget.deviceId);
+    assert.ok(urlOnlyThumbnailDevice?.latestThumbnail?.framePath);
+    assert.ok(!('dataUrl' in urlOnlyThumbnailDevice.latestThumbnail));
+
+    const thumbnailFramesOnly = await fetchJson(`${baseUrl}/api/remote/frames`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            deviceIds: [thumbnailTarget.deviceId],
+            includeThumbnail: true,
+            includeLive: true
+        })
+    });
+    assert.equal(thumbnailFramesOnly.ok, true, JSON.stringify(thumbnailFramesOnly.payload));
+    assert.equal(thumbnailFramesOnly.payload?.ok, true);
+    assert.equal(thumbnailFramesOnly.payload?.frames?.length, 1);
+    assert.equal(thumbnailFramesOnly.payload.frames[0].deviceId, thumbnailTarget.deviceId);
+    assert.equal(thumbnailFramesOnly.payload.frames[0].thumbnailEnabled, true);
+    assert.ok(String(thumbnailFramesOnly.payload.frames[0].thumbnail?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(thumbnailTarget.deviceId)}/thumbnail?`));
+    assert.ok(!('dataUrl' in thumbnailFramesOnly.payload.frames[0].thumbnail));
+
+    const liveTarget = devicesResult.payload.devices.find(device =>
+        device.connected && device.capabilities?.liveStream);
+    assert.ok(liveTarget);
+    const liveStart = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/start`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            streamId: 'http-smoke-live',
+            fps: 20,
+            maxWidth: 960,
+            maxHeight: 540,
+            quality: 60
+        })
+    });
+    assert.equal(liveStart.ok, true, JSON.stringify(liveStart.payload));
+    assert.equal(liveStart.payload?.ok, true);
+
+    const liveFrame = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame`, {
+        token: BRIDGE_TOKEN
+    });
+    assert.equal(liveFrame.ok, true, JSON.stringify(liveFrame.payload));
+    assert.equal(liveFrame.payload?.frame?.streamId, 'http-smoke-live');
+    assert.equal(liveFrame.payload?.frame?.mode, 'remote-fast');
+    assert.equal(liveFrame.payload?.frame?.fps, 20);
+    assert.ok(!('dataUrl' in liveFrame.payload.frame));
+    assert.ok(String(liveFrame.payload?.frame?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?`));
+
+    const liveFrameWithData = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?includeDataUrl=true`, {
+        token: BRIDGE_TOKEN
+    });
+    assert.equal(liveFrameWithData.ok, true, JSON.stringify(liveFrameWithData.payload));
+    assert.ok(String(liveFrameWithData.payload?.frame?.dataUrl || '').startsWith('data:image/png;base64,'));
+
+    const liveBinary = await fetchBinary(`${baseUrl}${liveFrame.payload.frame.framePath}`);
+    assert.equal(liveBinary.ok, true, `${liveBinary.status} ${liveBinary.contentType}`);
+    assert.equal(liveBinary.contentType, 'image/png');
+    assert.equal(liveBinary.streamId, 'http-smoke-live');
+    assert.ok(liveBinary.payload.length > 0);
+
+    const liveBinaryWithBridgeToken = await fetchBinary(
+        `${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?format=binary`,
+        { token: BRIDGE_TOKEN });
+    assert.equal(liveBinaryWithBridgeToken.ok, true, `${liveBinaryWithBridgeToken.status} ${liveBinaryWithBridgeToken.contentType}`);
+    assert.equal(liveBinaryWithBridgeToken.contentType, 'image/png');
+
+    const badLiveSeq = await fetchBinary(`${baseUrl}${liveFrame.payload.frame.framePath.replace(/seq=\d+/, 'seq=999999')}`);
+    assert.equal(badLiveSeq.status, 401);
+
+    const liveFramesOnly = await fetchJson(`${baseUrl}/api/remote/frames`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            deviceIds: [liveTarget.deviceId],
+            includeThumbnail: true,
+            includeLive: true
+        })
+    });
+    assert.equal(liveFramesOnly.ok, true, JSON.stringify(liveFramesOnly.payload));
+    assert.equal(liveFramesOnly.payload?.ok, true);
+    assert.equal(liveFramesOnly.payload?.frames?.length, 1);
+    assert.equal(liveFramesOnly.payload.frames[0].deviceId, liveTarget.deviceId);
+    assert.equal(liveFramesOnly.payload.frames[0].liveStreamActive, true);
+    assert.ok(String(liveFramesOnly.payload.frames[0].live?.framePath || '').includes(`/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/frame?`));
+    assert.ok(!('dataUrl' in liveFramesOnly.payload.frames[0].live));
+
+    const liveStop = await fetchJson(`${baseUrl}/api/remote/devices/${encodeURIComponent(liveTarget.deviceId)}/live/stop`, {
+        method: 'POST',
+        token: BRIDGE_TOKEN,
+        body: JSON.stringify({
+            streamId: 'http-smoke-live'
+        })
+    });
+    assert.equal(liveStop.ok, true, JSON.stringify(liveStop.payload));
+    assert.equal(liveStop.payload?.ok, true);
+
+    const clear = await fetchJson(`${baseUrl}/api/remote/synthetic`, {
+        method: 'DELETE',
+        token: BRIDGE_TOKEN
+    });
+    assert.equal(clear.ok, true, JSON.stringify(clear.payload));
+    assert.equal(clear.payload?.ok, true);
+    assert.equal(clear.payload?.removed, SYNTHETIC_COUNT);
+
+    console.log(`RemoteHub HTTP smoke OK (${SYNTHETIC_COUNT} synthetic devices, bridge ${bridgePort}, remote ${remoteHubPort})`);
+} finally {
+    await bridge.stop();
+}
+}
+
+async function runSyntheticDisabledSmoke() {
+    const bridgePort = await findFreePort();
+    const remoteHubPort = await findFreePort();
+    const bridgeToken = `${BRIDGE_TOKEN}-disabled`;
+    const pairToken = `${PAIR_TOKEN}-disabled`;
+    const bridge = spawnBridge({
+        bridgePort,
+        remoteHubPort,
+        bridgeToken,
+        pairToken,
+        syntheticFleetEnabled: false
+    });
+    const { baseUrl } = bridge;
+
+    try {
+        const status = await waitForBridge(baseUrl, bridge.details, bridge.bridgeToken);
+        assert.equal(status.started, true);
+        assert.equal(status.port, remoteHubPort);
+        assert.equal(status.pairToken, pairToken);
+        assert.equal(status.canvasPagination, 'none');
+        assert.equal(status.canvasDeviceListMode, 'all-devices');
+        assert.equal(status.hostTargetActive, false);
+
+        const seedDenied = await fetchJson(`${baseUrl}/api/remote/synthetic/seed`, {
+            method: 'POST',
+            token: bridge.bridgeToken,
+            body: JSON.stringify({
+                count: 3,
+                replace: true
+            })
+        });
+        assert.equal(seedDenied.status, 403);
+        assert.equal(seedDenied.payload?.ok, false);
+        assert.equal(seedDenied.payload?.error, 'synthetic-fleet-disabled');
+
+        const clearDenied = await fetchJson(`${baseUrl}/api/remote/synthetic`, {
+            method: 'DELETE',
+            token: bridge.bridgeToken
+        });
+        assert.equal(clearDenied.status, 403);
+        assert.equal(clearDenied.payload?.ok, false);
+        assert.equal(clearDenied.payload?.error, 'synthetic-fleet-disabled');
+
+        const devicesResult = await fetchJson(`${baseUrl}/api/remote/devices`, { token: bridge.bridgeToken });
+        assert.equal(devicesResult.ok, true, JSON.stringify(devicesResult.payload));
+        assert.equal(devicesResult.payload?.total, 0);
+        assert.equal(devicesResult.payload?.pagination, 'none');
+        assert.equal(devicesResult.payload?.canvasDeviceListMode, 'all-devices');
+        assert.equal(devicesResult.payload?.devices?.length, 0);
+
+        const emptyBatch = await fetchJson(`${baseUrl}/api/remote/tasks`, {
+            method: 'POST',
+            token: bridge.bridgeToken,
+            body: JSON.stringify({
+                allConnected: true,
+                title: 'HTTP smoke no target batch',
+                instruction: 'This should not queue because no remote devices are connected.',
+                approvalLevel: 'task-only'
+            })
+        });
+        assert.equal(emptyBatch.ok, true, JSON.stringify(emptyBatch.payload));
+        assert.equal(emptyBatch.payload?.ok, false);
+        assert.equal(emptyBatch.payload?.total, 0);
+        assert.equal(emptyBatch.payload?.queued, 0);
+        assert.equal(emptyBatch.payload?.error, 'no-target-devices');
+
+        const hostTarget = await fetchJson(`${baseUrl}/api/remote/host-target`, {
+            method: 'POST',
+            token: bridge.bridgeToken,
+            body: JSON.stringify({
+                nodeId: 'disabled-synthetic-host',
+                enabled: true
+            })
+        });
+        assert.equal(hostTarget.ok, true, JSON.stringify(hostTarget.payload));
+        assert.equal(hostTarget.payload?.ok, true);
+        assert.equal(hostTarget.payload?.active, true);
+
+        console.log(`RemoteHub HTTP safety smoke OK (synthetic disabled, bridge ${bridgePort}, remote ${remoteHubPort})`);
+    } finally {
+        await bridge.stop();
+    }
+}
+
+await runSyntheticEnabledSmoke();
+await runSyntheticDisabledSmoke();