@monster-orange/den 0.4.1 → 0.4.3

package/src/ui/server/public/local-dev.html

@@ -1371,6 +1371,34 @@
       }
       .agent-form select {
         max-width: 320px;
+        min-width: 0;
+      }
+      .agent-form-help {
+        flex-basis: 100%;
+        margin: 0;
+        font-size: 12px;
+        color: var(--muted);
+        overflow-wrap: anywhere;
+      }
+      .agent-form-help[hidden],
+      .agent-form-ready[hidden] {
+        display: none;
+      }
+      /* AG-0.2: the runtime it will run, or why it can't (the mock's .helpl). */
+      .agent-form-ready {
+        flex-basis: 100%;
+        order: 1;
+        margin: 0;
+        font-size: 12px;
+        line-height: 1.4;
+        color: var(--faint);
+        overflow-wrap: anywhere;
+      }
+      .agent-form-ready[data-tone="warn"] {
+        color: var(--warn);
+      }
+      .agent-form-ready .mono {
+        font-family: var(--mono);
       }
       .agent-cwd {
         max-width: 280px;
@@ -1518,8 +1546,9 @@
             .replace(/"/g, """);
 
         // ── The lock (R8): the shell's lock chip and popover (topbar.js) ──────────
-        // requireSudo() is this page's lock rule, shared with every page: true
-        // when unlocked; otherwise the lock popover opens on its password
+        // requireSudo() is this page's lock rule, shared with every page
+        // (async): true when unlocked, after asking the server and the vault
+        // (LK-2, LK-3); otherwise the lock popover opens on its password
         // field and the command doesn't run.
         function requireSudo() {
           return requireUnlock();
@@ -3021,8 +3050,8 @@
 
         // ── Workspace-level command (SSE) ─────────────────────────────────────────
         // Routes output to each service's own tab as `label` events arrive.
-        window.runWorkspaceSync = function () {
-          if (!requireSudo()) return;
+        window.runWorkspaceSync = async function () {
+          if (!(await requireSudo())) return;
           setAllButtons(true);
           setWsStatus("syncing…");
           const es = new EventSource("/api/workspace/sync");
@@ -3073,8 +3102,8 @@
         // rather than a shared pane, so it sits with everything else for that
         // system. Buttons are not globally disabled: it is one repo.
         const _syncing = new Set();
-        window.runRepoSync = function (repo) {
-          if (!requireSudo()) return;
+        window.runRepoSync = async function (repo) {
+          if (!(await requireSudo())) return;
           if (_syncing.has(repo)) return; // already in flight — ignore re-entry
           _syncing.add(repo);
 
@@ -3126,8 +3155,8 @@
           };
         };
 
-        window.runWorkspaceCmd = function (cmd, addresses) {
-          if (!requireSudo()) return;
+        window.runWorkspaceCmd = async function (cmd, addresses) {
+          if (!(await requireSudo())) return;
           const only =
             Array.isArray(addresses) && addresses.length
               ? `&addresses=${encodeURIComponent(addresses.join(","))}`
@@ -3240,8 +3269,8 @@
         // is derived on the SERVER (see the `seed` param in /api/workspace/exec):
         // its rules are load-bearing, and the already-healthy skip it relies on is
         // suppressed whenever an explicit address list is sent.
-        window.runUpWithDeps = function (repo) {
-          if (!requireSudo()) return;
+        window.runUpWithDeps = async function (repo) {
+          if (!(await requireSudo())) return;
           void runWorkspaceCmdAsync("up", null, {
             seed: repo,
             undismiss: true,
@@ -3252,16 +3281,16 @@
         // same closure as "up with deps", reversed. Derived server-side for the
         // same reason as its counterpart: the already-stopped skip is suppressed
         // when an explicit address list is sent.
-        window.runDownWithDeps = function (repo) {
-          if (!requireSudo()) return;
+        window.runDownWithDeps = async function (repo) {
+          if (!(await requireSudo())) return;
           void runWorkspaceCmdAsync("down", null, {
             seed: repo,
             undismiss: true,
           });
         };
 
-        window.runCmd = function (address, repo, service, cmd) {
-          if (!requireSudo()) return;
+        window.runCmd = async function (address, repo, service, cmd) {
+          if (!(await requireSudo())) return;
           // Explicit single-service action — undo any prior dismissal so its pane returns.
           clearDismissed(address);
           // up/restart/down go through the workspace-exec runner: it uses the full

package/src/ui/server/public/settings-registry.js

@@ -472,7 +472,7 @@ export const DEN_SETTINGS = [
     category: "cli",
     label: "Browser sign-in",
     description:
-      "Signing in is needed only when this server is reached beyond this machine (the edge, or a LAN address); on localhost nothing asks for it. __DEN_CLI__ web login prints a sign-in link; __DEN_CLI__ web sessions lists signed-in browsers.",
+      "Signing in is needed only when this server is reached from another machine (through the edge, or a LAN address); on localhost, and through the edge from this machine, nothing asks for it. __DEN_CLI__ web login prints a sign-in link; __DEN_CLI__ web sessions lists signed-in browsers.",
     keywords: ["sign in", "sign out", "login", "logout", "session", "browser"],
     scope: "user",
     control: {

package/src/ui/server/public/shell.js

@@ -444,6 +444,7 @@
     "ag.persona": "Persona",
     "ag.runtime": "Runtime",
     "ag.runtime.auto": "The persona's",
+    "ag.runtime.default": "{name} (persona default)",
     "ag.unavailable": "unavailable",
     "ag.go": "Start",
     "ag.starting": "Starting…",
@@ -484,6 +485,16 @@
     "ag.pal": "Agents › {ws} / {name}",
     "ag.palStart": "Start agent…",
     "ag.cap": "Up to 4 panes: {id}'s closed to make room (it keeps running)",
+    "ag.rt.ready": "Starts {name} {version} from",
+    "ag.rt.readyNoVer": "Starts {name} from",
+    "ag.rt.notFound": "{name} not found.",
+    "ag.rt.searched": "Searched:",
+    "ag.rt.more": "and {n} more",
+    "ag.rt.nowhere": "no directories",
+    "ag.rt.refused": "{name} can't start: {why}.",
+    "ag.rt.fix":
+      "Install it, or set {key} to its path in {file}, or run {cmd}.",
+    "ag.rt.unknown": "No runtime {id} here.",
   };
   // The languages the UI has a catalog for, each named in itself (a name is
   // never translated). The server's list is ui-language.ts's UI_LANGUAGES.
@@ -3361,6 +3372,31 @@
     }
   }
 
+  // 0.4.3: the edge is reachable from other machines (the server fills
+  // data-edge-exposed on #den-shell). One line; dismissed per browser.
+  var EDGE_LS = "den.edgeExposed.dismissed";
+  var edgeDismissed = false;
+  try {
+    edgeDismissed = localStorage.getItem(EDGE_LS) === "1";
+  } catch (e) {
+    edgeDismissed = false;
+  }
+  if (host.dataset.edgeExposed && !edgeDismissed)
+    showBanner("edge-exposed", {
+      text: host.dataset.edgeExposed,
+      action: {
+        label: t("api.close"),
+        run: function () {
+          try {
+            localStorage.setItem(EDGE_LS, "1");
+          } catch (e) {
+            /* no storage: dismissed for this page only */
+          }
+          hideBanner("edge-exposed");
+        },
+      },
+    });
+
   // The config fails validation (0.4.1): the server marks every page it
   // serves while it does (data-config-invalid on #den-shell), and the first
   // /api answer of 422 config_invalid marks it too. From then on the shell
@@ -3817,6 +3853,10 @@
     "  max-height: calc(100vh - 72px); overflow-y: auto; box-sizing: border-box;",
     "  font: 14px/1.45 var(--sans); color: var(--text); }",
     ".den-pop:focus { outline: none; }",
+    // LK-1: the lock popover is a <dialog> in the top layer (a popover, or
+    // a modal over another modal): placed by its top/left, no UA box.
+    "dialog.den-pop { margin: 0; inset: auto; max-width: none; }",
+    "dialog.den-pop::backdrop { background: transparent; }",
     ".den-pop :focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }",
     ".den-pop .den-ml { font: 11px var(--mono); color: var(--faint); text-transform: uppercase;",
     "  letter-spacing: .07em; padding: 6px 8px 2px; }",

package/src/ui/server/public/topbar.js

@@ -15,9 +15,18 @@
  *                     form in a popover (Local Dev's sudo banner, moved)
  *
  * Exports for pages (through header.js): requireUnlock() (Local Dev's lock
- * rule: true when unlocked, else the lock popover opens), isUnlocked(),
- * onLockChange(fn), setServiceRunner(fn) (the page that runs Start and
- * Restart itself), takePendingAction().
+ * rule, async: true when unlocked, else the lock popover opens), and
+ * checkUnlock() and unlockWith(password) for a modal that asks inline
+ * (LK-1), isUnlocked(), onLockChange(fn), setServiceRunner(fn) (the page
+ * that runs Start and Restart itself), takePendingAction().
+ *
+ * The lock (LK, 0.4.3): the page's own idea of it is never the last word.
+ * When it thinks it's locked, an action asks the server again first
+ * (another tab or device may have unlocked it, LK-2), then, when a
+ * password is stored in the vault, loads it from there (LK-3, once a page,
+ * on any page; a page view alone never wakes the vault). The popover is in
+ * the top layer (a popover, or its own modal <dialog> when a modal is
+ * open), so no modal ever covers it (LK-1).
  *
  * The pure parts (statusSummary, statusChip, problemCards, drawerGroups,
  * checkLine, rankCommands, runOf) take plain data, so tests need no
@@ -745,9 +754,9 @@ export function setServiceRunner(fn) {
  * stores it for this tab (sessionStorage, not a link anyone could open)
  * and Local Dev takes it once (takePendingAction).
  */
-export function runServiceAction(cmd, svc) {
+export async function runServiceAction(cmd, svc) {
   if (serviceRunner) return serviceRunner(cmd, svc);
-  if (!requireUnlock()) return;
+  if (!(await requireUnlock())) return;
   try {
     sessionStorage.setItem(
       SS_PENDING,
@@ -1135,15 +1144,88 @@ export function onLockChange(fn) {
 }
 
 /**
- * Local Dev's lock rule, for every page: true when unlocked; otherwise the
- * lock popover opens on its password field and the action doesn't run.
+ * Whether the lock is open, asking before saying no (never prompts): the
+ * server's status (LK-2), then, when a password is stored, the vault, once
+ * a page (LK-3). Resolves true when unlocked.
+ */
+let rechecking = null;
+let vaultTried = false;
+export function checkUnlock() {
+  if (lock.unlocked) return Promise.resolve(true);
+  rechecking ??= (async () => {
+    const st = await getJson("/api/sudo-password/status", null);
+    if (st && (st.set || st.passwordless)) {
+      setUnlocked(true, !!st.passwordless && !st.set);
+      return true;
+    }
+    if (!vaultTried) {
+      await checkVault();
+      if (
+        !lock.unlocked &&
+        lock.vault.backendAvailable &&
+        lock.vault.hasStored
+      ) {
+        vaultTried = true;
+        const loaded = await getJson(
+          "/api/sudo-password/load-from-vault",
+          { ok: false },
+          { method: "POST" },
+        );
+        if (loaded.ok && !lock.unlocked) setUnlocked(true);
+      }
+    }
+    return lock.unlocked;
+  })().finally(() => {
+    rechecking = null;
+  });
+  return rechecking;
+}
+
+/**
+ * Local Dev's lock rule, for every page (async): true when unlocked, after
+ * checkUnlock; otherwise the lock popover opens on its password field and
+ * the action doesn't run.
  */
-export function requireUnlock() {
-  if (lock.unlocked) return true;
+export async function requireUnlock() {
+  if (await checkUnlock()) return true;
   openLock();
   return false;
 }
 
+/**
+ * Unlock with `password` (the popover's form, or a modal's own field):
+ * { ok, savedToVault?, vaultError?, error? }. On success every page
+ * subscriber hears it (onLockChange). Never logs the password.
+ */
+export async function unlockWith(password, { saveToVault = false } = {}) {
+  if (!password) return { ok: false, error: t("lock.wrong") };
+  try {
+    const r = await fetch("/api/sudo-password", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ password, saveToVault }),
+    });
+    const data = await r.json().catch(() => ({}));
+    if (r.ok) {
+      if (data.savedToVault) lock.vault.hasStored = true;
+      setUnlocked(true);
+      return {
+        ok: true,
+        savedToVault: !!data.savedToVault,
+        ...(data.vaultError ? { vaultError: data.vaultError } : {}),
+      };
+    }
+    // A wrong password is said in the page's language; another refusal
+    // is the server's own message.
+    return {
+      ok: false,
+      error: r.status === 401 || !data.error ? t("lock.wrong") : data.error,
+    };
+  } catch {
+    return { ok: false, error: t("lock.reqFailed") };
+  }
+}
+
 function setUnlocked(unlocked, passwordless = false) {
   const changed = lock.unlocked !== unlocked || !lock.known;
   lock.known = true;
@@ -1250,6 +1332,7 @@ async function initLock() {
   await checkVault();
   if (!lock.vault.backendAvailable || !lock.vault.hasStored || lock.unlocked)
     return;
+  vaultTried = true;
   const loaded = await getJson(
     "/api/sudo-password/load-from-vault",
     { ok: false },
@@ -1300,7 +1383,10 @@ function openLock() {
   closeOverlay(false);
   sh()?.closeMenu?.();
   if (!lock.unlocked) void checkVault();
-  const pop = document.createElement("div");
+  // LK-1: in the top layer, so no modal covers it. Under an open modal
+  // <dialog> only another modal is reachable (a popover there is inert),
+  // so it opens as its own modal; elsewhere it is a popover.
+  const pop = document.createElement("dialog");
   pop.className = "den-pop den-lock-pop";
   pop.id = "den-lock-pop";
   pop.setAttribute("role", "dialog");
@@ -1335,38 +1421,25 @@ function openLock() {
     err.hidden = true;
     const saveToVault = !!(lock.vault.backendAvailable && saveCb?.checked);
     try {
-      const r = await fetch("/api/sudo-password", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ password: pw, saveToVault }),
-      });
-      const data = await r.json();
-      if (r.ok) {
+      const res = await unlockWith(pw, { saveToVault });
+      if (res.ok) {
         input.value = "";
-        if (data.savedToVault) lock.vault.hasStored = true;
         forceForm = false;
-        setUnlocked(true);
         closeOverlay(true);
         toast(
-          saveToVault && data.vaultError
+          saveToVault && res.vaultError
             ? t("lock.saveFailed", {
                 s: lock.vault.label || lock.vault.backend,
-                err: data.vaultError,
+                err: res.vaultError,
               })
             : t("lock.session"),
         );
         return;
       }
-      // A wrong password is said in the page's language; another refusal
-      // is the server's own message.
-      err.textContent =
-        r.status === 401 || !data.error ? t("lock.wrong") : data.error;
+      err.textContent = res.error;
       err.hidden = false;
       input.value = "";
       input.focus();
-    } catch {
-      err.textContent = t("lock.reqFailed");
-      err.hidden = false;
     } finally {
       if (btn.isConnected) {
         btn.textContent = t("lock.go");
@@ -1376,6 +1449,23 @@ function openLock() {
   };
   draw();
   document.body.appendChild(pop);
+  const underModal = [...document.querySelectorAll("dialog")].some(
+    (d) => d !== pop && d.open && d.matches(":modal"),
+  );
+  try {
+    if (underModal) pop.showModal();
+    else if (typeof pop.showPopover === "function") {
+      pop.setAttribute("popover", "manual");
+      pop.showPopover();
+    } else pop.show();
+  } catch {
+    pop.setAttribute("open", "");
+  }
+  // A cancel (Escape on a modal) closes it as the chip would.
+  pop.addEventListener("cancel", (e) => {
+    e.preventDefault();
+    closeOverlay(true);
+  });
   const r = chip.getBoundingClientRect();
   pop.style.top = `${r.bottom + 6}px`;
   pop.style.left = `${Math.max(8, Math.min(r.left, window.innerWidth - pop.offsetWidth - 8))}px`;
@@ -1441,6 +1531,15 @@ export function initTopbar(opts = {}) {
   $("den-lock")?.addEventListener("click", () =>
     overlay?.kind === "lock" ? closeOverlay(true) : openLock(),
   );
+  // LK-2: back on this tab, the lock may have been opened elsewhere.
+  document.addEventListener("visibilitychange", () => {
+    if (document.visibilityState !== "visible" || lock.unlocked) return;
+    if (sh()?.apiOff?.() === true) return;
+    void getJson("/api/sudo-password/status", null).then((st) => {
+      if (st && (st.set || st.passwordless))
+        setUnlocked(true, !!st.passwordless && !st.set);
+    });
+  });
   document.addEventListener("keydown", (e) => {
     if ((e.metaKey || e.ctrlKey) && !e.altKey && e.key.toLowerCase() === "k") {
       e.preventDefault();

package/src/ui/server/request-guard.ts

@@ -19,12 +19,17 @@
  *    session's /api/sessions/<id>/*: agent start and resume mint tokens.
  *    403 `agent_forbidden`. WS-3a (0.4.2) adds the workspace check at
  *    agentRefusal's seam.
- *  - Sign-in (§4, route-classes.ts): beyond loopback (the edge hostname, a
- *    LAN name, or a peer that isn't loopback) every route needs a session
- *    or a bearer. Otherwise 401 `signin_required`. On loopback no route
- *    does, shell-grade ones included (Ward, 2026-11-06: the lock, R8, is
- *    the only prompt there; Host, Origin and CSRF cover CSRF and DNS
- *    rebinding). SIGNIN_FREE routes never need one.
+ *  - Sign-in (§4, route-classes.ts): beyond loopback (a LAN name, a peer
+ *    that isn't loopback, or the edge hostname for a client on another
+ *    machine) every route needs a session or a bearer. Otherwise 401
+ *    `signin_required`. On loopback no route does, shell-grade ones
+ *    included (Ward, 2026-11-06: the lock, R8, is the only prompt there;
+ *    Host, Origin and CSRF cover CSRF and DNS rebinding). SIGNIN_FREE
+ *    routes never need one.
+ *  - The edge counts as local (0.4.3, edgeClientIsLocal): the edge hostname
+ *    from an edge peer gets loopback's treatment unless the edge's
+ *    X-Forwarded-For names another machine, or this server is deliberately
+ *    exposed (`exposed`: a non-loopback DEN_BIND_HOST bind).
  *  - Origin, on POST/PUT/PATCH/DELETE and every WebSocket upgrade: an
  *    allowed host (http or https). No Origin needs a valid bearer.
  *    Otherwise 403 `origin_rejected`.
@@ -45,6 +50,7 @@
 import { randomBytes, timingSafeEqual, createHash } from "crypto";
 import type * as http from "http";
 import * as net from "net";
+import * as os from "os";
 import {
   actorFromHeaders,
   type Actor,
@@ -125,6 +131,18 @@ export interface GuardContext {
    * server's port gets 421. Unset: taken as yes (a unit test).
    */
   peerIsEdge?: (req: http.IncomingMessage) => boolean;
+  /**
+   * This machine's own addresses and container/VM bridges (localNet), for
+   * telling whether an edge request's client is this machine. Unset: none
+   * (a unit test): only loopback and the Docker ranges count as local.
+   */
+  localNet?: () => LocalNet;
+  /**
+   * A deliberate network exposure (a non-loopback DEN_BIND_HOST bind other
+   * than the Docker bridge the edge uses on Linux): the edge hostname
+   * needs a sign-in too, as before 0.4.3.
+   */
+  exposed?: boolean;
 }
 
 export type GuardResult =
@@ -263,6 +281,97 @@ export function isEdgePeer(addr: string | undefined): boolean {
   );
 }
 
+/** An address without its zone, IPv4-mapped prefix or brackets, lowercase. */
+function normAddress(a: string): string {
+  return a
+    .trim()
+    .toLowerCase()
+    .replace(/^\[|\]$/g, "")
+    .replace(/%.*$/, "")
+    .replace(/^::ffff:(?=\d+\.)/, "");
+}
+
+/** This machine's own addresses, and the container/VM bridges it hosts. */
+export interface LocalNet {
+  /** Every interface address (loopback, LAN, a VPN's such as Tailscale's 100.x). */
+  own: readonly string[];
+  /** IPv4 subnets of its container/VM bridges (Docker, OrbStack, VMs). */
+  bridges: readonly { address: string; netmask: string }[];
+}
+
+/** Interface names of container/VM bridges: their peers are this machine's. */
+const BRIDGE_IFACE =
+  /^(docker\d*|br-|bridge\d+|vmnet|virbr|veth|cni|podman|vboxnet)/;
+
+/** localNet from os.networkInterfaces() (or a given table, in a test). */
+export function localNet(
+  ifaces: ReturnType<typeof os.networkInterfaces> = os.networkInterfaces(),
+): LocalNet {
+  const own: string[] = [];
+  const bridges: { address: string; netmask: string }[] = [];
+  for (const [name, list] of Object.entries(ifaces))
+    for (const a of list ?? []) {
+      own.push(normAddress(a.address));
+      if (a.family === "IPv4" && BRIDGE_IFACE.test(name))
+        bridges.push({ address: a.address, netmask: a.netmask });
+    }
+  return { own: [...new Set(own)], bridges };
+}
+
+function ipv4(a: string): number {
+  return a.split(".").reduce((n, o) => n * 256 + Number(o), 0);
+}
+function inSubnet(a: string, net4: { address: string; netmask: string }) {
+  if (!net.isIPv4(a) || !net.isIPv4(net4.address)) return false;
+  const m = ipv4(net4.netmask);
+  // Unsigned compare of the masked halves (no 32-bit sign games).
+  const lo = (x: number) => x - (x % (2 ** 32 - m));
+  return m > 0 && lo(ipv4(a)) === lo(ipv4(net4.address));
+}
+
+/**
+ * The original client X-Forwarded-For names: its left-most entry, as an
+ * IP (a port or brackets dropped), or undefined when there is none.
+ */
+export function forwardedClient(xff: string | undefined): string | undefined {
+  const first = xff?.split(",")[0]?.trim();
+  if (!first) return undefined;
+  let a = first;
+  const b = /^\[([^\]]+)\](?::\d+)?$/.exec(a);
+  if (b) a = b[1];
+  else if (/^\d+\.\d+\.\d+\.\d+:\d+$/.test(a)) a = a.replace(/:\d+$/, "");
+  a = normAddress(a);
+  return net.isIP(a) ? a : undefined;
+}
+
+/**
+ * The edge counts as local (0.4.3): whether an edge request (the edge
+ * hostname from an edge peer) comes from this machine, by the left-most
+ * X-Forwarded-For entry (the original client):
+ *  - loopback, or one of this machine's own interface addresses (its LAN
+ *    or VPN address, a Tailscale 100.x one included): local;
+ *  - missing, unreadable, or a container/VM network's address (the Docker
+ *    ranges isEdgePeer takes, a subnet of one of this machine's bridges,
+ *    one of the edge's own Docker networks, or OrbStack's 0.250.250.254):
+ *    we can't tell (Docker Desktop and OrbStack on macOS hand the
+ *    edge their gateway's address, and a TCP passthrough in front hides the
+ *    client), so local;
+ *  - anything else: another machine, beyond loopback (sign-in required).
+ * The edge's own page warns when it is reachable beyond this machine
+ * (edge-exposure.ts): with no sign-in, anyone who reaches it is local.
+ */
+export function edgeClientIsLocal(
+  xff: string | undefined,
+  local: LocalNet = { own: [], bridges: [] },
+): boolean {
+  const c = forwardedClient(xff);
+  if (!c || isEdgePeer(c) || local.own.includes(c)) return true;
+  // 0.0.0.0/8 ("this network") is never a client on another machine:
+  // OrbStack presents the host to its containers as 0.250.250.254.
+  if (net.isIPv4(c) && c.startsWith("0.")) return true;
+  return local.bridges.some((b) => inSubnet(c, b));
+}
+
 /**
  * Whether the request came over HTTPS: the socket's own encryption, or,
  * only for the edge hostname from an edge peer, `X-Forwarded-Proto: https`.
@@ -370,7 +479,13 @@ export function checkRequest(
         "127.0.0.1, [::1] with its port, or its edge hostname).",
     };
   const peerLoopback = ctx.peerIsLoopback ? ctx.peerIsLoopback(req) : true;
-  const beyond = via !== "loopback" || !peerLoopback;
+  // The edge from this machine (edgeClientIsLocal) is local, unless this
+  // server is deliberately exposed; a LAN name or peer is beyond.
+  const beyond =
+    via === "edge"
+      ? !!ctx.exposed ||
+        !edgeClientIsLocal(header(req, "x-forwarded-for"), ctx.localNet?.())
+      : via !== "loopback" || !peerLoopback;
 
   let principal: Principal | null = null;
   const auth = header(req, "authorization");

package/src/ui/server/ui-assets.ts

@@ -34,6 +34,8 @@ export const UI_MODULES: readonly string[] = [
   "/error-page.js",
   "/agents-section.js",
   "/agents-page.js",
+  // The Start agent form's choices, shared by both (AG-10.0).
+  "/agent-start.js",
   // The UI's catalogs other than English (R19; en is in shell.js).
   "/i18n/ja.js",
   "/i18n/es.js",