@openagt/dashboard 0.10.0 → 0.11.0

package/dist/module-types/src/dashboard/remote-run.d.ts

@@ -3,50 +3,90 @@ import type { OpenAgentEvent } from '../events.js';
 import type { AgentMeta } from '../store/index.js';
 import type { StartAgentOptions, StartAgentResult } from './types.js';
 /**
- * The server-side half of "run on a connected device" (#1067). The local daemon holds the saved
- * device's token, so it - not the browser - drives the remote daemon: it POSTs the agent to the
+ * The server-side half of "run on a saved machine" (#1067). The local daemon holds this computer's
+ * key on the saved machine, so it - not the browser - drives the remote daemon: it POSTs the agent to the
  * remote's `/_relay/start` and then fetch-streams the remote's `/_relay/events` back into a local
  * {@link EventStream}, which the dashboard reads over its normal same-origin `onEvents` channel. So
- * the browser never talks cross-origin and the token never leaves the two daemons (issue #1067 (b)).
+ * the browser never talks cross-origin and the key never leaves the two daemons (issue #1067 (b)).
  *
- * Authentication is the shared-token cookie (#1051), sent daemon-to-daemon: `Cookie: oa_daemon=<token>` with no
- * `Origin` header. The remote's guard admits a matching cookie without the browser-only `?token=`
- * 302, and its `/_rpc` CSRF check (absent Origin passes) is not even on these raw routes.
+ * Every call but the ping names its project, by its repository's address
+ * (repository-address.ts): a project's folder, and so its id, is another one on each machine.
+ *
+ * The other OpenAgent listens on its own computer only. What answers at a machine's address is
+ * whatever that computer opened to the network, which lets this computer in once, with the code
+ * a machine's link carries ({@link enterRemote}), answers a key of this computer's own, and from
+ * then on passes each call that carries the key (`Authorization: Bearer`, no `Origin`) to its
+ * OpenAgent as that computer's own browser would have made it.
  */
-/** Where a relayed agent executes: the remote daemon's origin and its #1051 token. Memory-only. */
-export interface RemoteTarget {
+/** How a machine is reached: where its OpenAgent answers, this computer's key there, and what the machine's own key is known by when its link said. */
+export interface MachineAccess {
     url: string;
-    token: string;
+    key: string;
+    pin?: string;
+}
+/** Where a relayed agent works: a machine, and the project there, by its repository's address. */
+export interface RemoteTarget extends MachineAccess {
+    project: string;
 }
-/** The body a relay start forwards to the remote's `/_relay/start`. */
+/** What a relay start forwards to the remote's `/_relay/start`, beside the project. */
 export interface RelayStartBody {
     prompt: string;
     options: StartAgentOptions;
 }
 /**
- * Health-check a saved device (#1072): a cookie'd `GET /_relay/ping`, true on any 2xx, false on a
- * non-2xx, an unreachable host, or the timeout. The token stays in memory for the check only, never
- * persisted, same as {@link startRemoteAgent}. This is how the browser's status dots learn reachable
- * from not: it has the tokens, the daemon does the cross-origin request.
+ * What a machine answers a relayed start with: a Start's own outcome, or `noProject` when it has
+ * no project cloned from the address the start named.
+ */
+export type RelayStartResult = StartAgentResult | {
+    ok: false;
+    error: string;
+    noProject: true;
+};
+/**
+ * Health-check a saved machine (#1072): true when it answers this computer's key. This is how
+ * the browser's status dots learn reachable from not.
+ */
+export declare function pingRemote(target: MachineAccess): Promise<boolean>;
+/** The OpenAgent a saved machine runs, as its ping tells it; nothing for a machine that does not answer, or does not say. */
+export declare function remoteVersion(target: MachineAccess): Promise<string | undefined>;
+/** What asking to be let in came to: this computer's key there, or why not, in words. */
+export type EnterResult = {
+    ok: true;
+    key: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Ask a machine to let this computer in, with the code its link carries, under `name`. The code
+ * is good once: a link used before, or older than a few minutes, is refused.
+ */
+export declare function enterRemote(door: string, code: string, name: string, pin?: string): Promise<EnterResult>;
+/**
+ * Take this computer out of a machine: its key there stops working. Whether the machine did;
+ * one that cannot be reached keeps the key until this computer is removed there by hand.
  */
-export declare function pingRemote(target: RemoteTarget): Promise<boolean>;
+export declare function leaveRemote(machine: MachineAccess & {
+    door: string;
+}): Promise<boolean>;
 /**
- * Start an agent on the remote daemon and return its {@link StartAgentResult} (with the remote's own run
- * id). A non-2xx or a transport failure surfaces as an `ok: false` result the dashboard shows, the
- * same shape a local refusal has, so the caller does not special-case remote errors.
+ * Start an agent on the remote daemon, in its project cloned from `target.project`, and return
+ * what it answered (with the remote's own run id). A non-2xx or a transport failure surfaces as an
+ * `ok: false` result the dashboard shows, the same shape a local refusal has, so the caller does
+ * not special-case remote errors.
  */
-export declare function startRemoteAgent(target: RemoteTarget, body: RelayStartBody): Promise<StartAgentResult>;
+export declare function startRemoteAgent(target: RemoteTarget, body: RelayStartBody): Promise<RelayStartResult>;
 /**
- * Relay one run-scoped RPC to the device that owns a remote agent (#1067 slice 2). The local daemon
- * holds the device token, so a read/diff/handoff/push/PR for a relayed agent runs ON the device: POST
- * {fn, args} to the remote's /_relay/rpc over the shared-token cookie (#1051) (no Origin), returning the device's
- * result. Throws on an unreachable device or a non-2xx so the caller falls back to its own empty/error
+ * Relay one run-scoped RPC to the machine that owns a remote agent (#1067 slice 2). The local daemon
+ * holds this computer's key there, so a read/diff/handoff/push/PR for a relayed agent runs ON the machine: POST
+ * {fn, args} to the remote's /_relay/rpc with the key (no Origin), returning the machine's
+ * result. Throws on an unreachable machine or a non-2xx so the caller falls back to its own empty/error
  * shape, the same way a failed local read does.
  */
 export declare function relayRpc(target: RemoteTarget, fn: string, args: unknown[]): Promise<unknown>;
 /**
  * Fetch-stream a remote agent's newline-delimited events into `onEvent` until the remote closes the
- * body, the agent ends, or `cancel()` is called. A 401 (the token was rotated) ends the stream
+ * body, the agent ends, or `cancel()` is called. A 401 (this computer was removed there) ends the stream
  * cleanly rather than as an error, so the dashboard sees a normal `done`, not a lost connection.
  * Returns a cancel function; calling it aborts the fetch and releases the reader.
  */
@@ -54,11 +94,12 @@ export declare function streamRemoteEvents(target: RemoteTarget, agentId: string
 /**
  * The local daemon's live relayed runs (#1067), keyed by the remote agent id. Registering an agent opens
  * an {@link EventStream} the dashboard reads through `onEvents`, fed by {@link streamRemoteEvents}
- * from the remote. This map is where a saved device's token lives daemon-side: in memory, for the
- * run's lifetime.
+ * from the remote. The target is the saved machine as it was at the Start. A machine is not
+ * removed while a run is at work on it ({@link working}); the runs that ended there before it
+ * was removed read as unreachable, and one added again answers for them with its new key ({@link rekey}).
  *
  * The `targets` map outlives the event pump (#1067 slice 2): a finished remote agent's post-run reads,
- * open-PR and merge still have to reach the device after its event stream has ended, so the device
+ * open-PR and merge still have to reach the machine after its event stream has ended, so the machine
  * target is kept until {@link dispose} clears it, not dropped when the stream closes.
  *
  * The `metas` map (#1077) holds a local {@link AgentMeta} stub per relayed agent so `onAgents` can show a
@@ -73,22 +114,26 @@ export declare class RelayedAgents {
     register(agentId: string, target: RemoteTarget, meta: AgentMeta, projectId: string): void;
     /** The live event stream for a relayed agent, or undefined when this daemon is not relaying it. */
     get(agentId: string | undefined): EventStream<OpenAgentEvent> | undefined;
-    /** The device a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
+    /** The machine a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
     target(agentId: string | undefined): RemoteTarget | undefined;
+    /** Whether a run this daemon follows is still at work on the machine at `url`: its events still stream. */
+    working(url: string): boolean;
+    /** How the machine at `url` is reached since it was added again, for the runs kept from before: this computer's new key there, and the key the machine is known by. */
+    rekey(url: string, key: string, pin?: string): void;
     /** A project's relayed run stubs (#1077), newest-first, so `onAgents` can surface them in the list. */
     list(projectId: string): AgentMeta[];
     /** Fold each relayed event into the agent's list row via the store's own reducer (#1077), so the
-     *  local stub mirrors the device: the terminal status on `end`, the waiting flag while it is parked
+     *  local stub mirrors the machine: the terminal status on `end`, the waiting flag while it is parked
      *  (#785), the driver once its session starts. Events carry no write time, so this stamps its own. */
     private apply;
     /** Close a relayed agent's event stream (not its target). Idempotent. */
     private endStream;
-    /** Stop every pump, close every stream, and forget every device target + list stub, on daemon shutdown. */
+    /** Stop every pump, close every stream, and forget every machine target + list stub, on daemon shutdown. */
     dispose(): void;
 }
 /**
- * Fold one relayed event into the memory-only row of a run on a device: what the device's own
- * card would say, kept here because that card is on the device. The events are the ones a run's
+ * Fold one relayed event into the memory-only row of a run on a machine: what the machine's own
+ * card would say, kept here because that card is on the machine. The events are the ones a run's
  * diary yields: the agent's session id, its cost, its end.
  */
 export declare function foldRelayedEvent(meta: AgentMeta, event: OpenAgentEvent, at: string): AgentMeta;

package/dist/module-types/src/dashboard/rpc-serve.d.ts

@@ -7,6 +7,7 @@ import type { BridgeBrowserOwner } from '../bridge-browser.js';
 import type { ProjectErrorsReader } from '../project-errors.js';
 import type { AddProjectResult, RemoveProjectResult, StartAgentOptions, StartAgentResult } from './types.js';
 import type { AgentMeta } from '../store/index.js';
+import type { RemoteTarget } from './remote-run.js';
 /** Wired by the daemon so `sendStart` can reach the daemon's own `startAgent` closure. */
 export type StartAgentHandler = (prompt: string, options: StartAgentOptions, projectId?: string) => StartAgentResult | Promise<StartAgentResult>;
 /** Wired by the daemon so `sendAddProject` can install + register a repo (#433). */
@@ -14,19 +15,20 @@ export type AddProjectHandler = (path: string, share: boolean) => AddProjectResu
 /** Wired by the daemon so `sendRemoveProject` can take a project off the list, by its id, and with `files` remove what OpenAgent left in its folder. */
 export type RemoveProjectHandler = (projectId: string, files: boolean) => RemoveProjectResult | Promise<RemoveProjectResult>;
 /** Resolve an agent to its live event stream: the relay feeds `onEvents` from its own in-memory stream
- * rather than a file on disk (#426), and the daemon feeds an agent it is relaying from a device (#1067).
+ * rather than a file on disk (#426), and the daemon feeds an agent it is relaying from a machine (#1067).
  * Returns undefined when there is no in-memory stream, so `onEvents` falls back to tailing the log. */
 export type EventsSource = (projectId: string, agentId?: string) => AsyncIterable<OpenAgentEvent> | undefined;
-/** Look up the device a relayed agent (#1067) executes on, or undefined for an ordinary local agent. The
+/** Look up the machine a relayed agent (#1067) executes on, or undefined for an ordinary local agent. The
  *  daemon wires this from its live relayed-agent map; a run-scoped RPC uses it to forward a remote agent's
- *  read/steer/handoff to that device instead of resolving a (nonexistent) local checkout. */
+ *  read/steer/handoff to that machine instead of resolving a (nonexistent) local checkout. */
 export interface RemoteAgents {
-    target(agentId: string | undefined): {
-        url: string;
-        token: string;
-    } | undefined;
+    target(agentId: string | undefined): RemoteTarget | undefined;
     /** A project's relayed run stubs (#1077), so `onAgents` can show a remote agent in the list and re-open it after a reload. */
     list(projectId: string): AgentMeta[];
+    /** Whether a run relayed from here is still at work on the machine at `url`. */
+    working(url: string): boolean;
+    /** How the machine at `url` is reached since it was added again, for the runs kept from before. */
+    rekey(url: string, key: string, pin?: string): void;
 }
 /**
  * What every RPC acts through.
@@ -40,10 +42,10 @@ export interface DashboardContext {
     startAgent: StartAgentHandler;
     addProject: AddProjectHandler;
     removeProject: RemoveProjectHandler;
-    /** The in-memory event stream for an agent relayed from a connected device (#1067), else undefined. */
+    /** The in-memory event stream for an agent relayed from a saved machine (#1067), else undefined. */
     eventsSource: EventsSource;
     /** The relayed-agent lookup (#1067 slice 2), so a run-scoped RPC can tell a local agent from one
-     *  running on a connected device and forward the call there. */
+     *  running on a saved machine and forward the call there. */
     remote: RemoteAgents;
     /** The user-preferences store (#410), over the registry file. */
     preferences: PreferencesStore;
@@ -72,16 +74,12 @@ export declare function isSameOriginRequest(req: IncomingMessage): boolean;
  * the mount, `sendStart` included, is reachable from a page the user merely visited.
  *
  * The `Host` header is what still gives the attacker away: it carries the name the browser was
- * asked for (`evil.com`), not the address it resolved to. So when we are bound to loopback, the
- * only `Host` a real user's browser can send is a loopback one (or the bound address itself) —
- * anything else is a rebound name and is rejected. An absent `Host` is rejected too when we are
- * enforcing: HTTP/1.1 requires it, and every browser sends it.
- *
- * A non-loopback bind (`--host`, #1051) is reached by a hostname we cannot predict, so there is
- * no allowlist to check against; that case gates behind the shared daemon token instead. Hosts
- * that never pass a bind host at all (the relay, which serves a public domain) are unaffected.
+ * asked for (`evil.com`), not the address it resolved to. The dashboard listens on this
+ * computer's own address only, so the only `Host` a real user's browser can send is a loopback
+ * one — anything else is a rebound name and is rejected. An absent `Host` is rejected too:
+ * HTTP/1.1 requires it, and every browser sends it.
  */
-export declare function isExpectedHost(req: IncomingMessage, boundHost: string | undefined): boolean;
+export declare function isExpectedHost(req: IncomingMessage): boolean;
 /** Where the dashboard's RPCs live. One prefix, so the static handler can decline it by path. */
 export declare const RPC_PREFIX = "/_rpc";
 /**
@@ -90,16 +88,12 @@ export declare const RPC_PREFIX = "/_rpc";
  * `sendStart` reaches the daemon's own `startAgent` through the wired {@link DashboardContext}.
  *
  * Cross-origin POSTs are rejected (CSRF: a page on evil.com must not steer or start a session), as
- * are requests carrying someone else's `Host` when we are bound to loopback (DNS rebinding: the
- * same page must not reach us by pointing its own name at `127.0.0.1`). Pass `opts.host` — the
- * address the server is bound to — to enable that second check. Returns whether the request was
- * the RPC surface's.
+ * are requests carrying someone else's `Host` (DNS rebinding: the same page must not reach us by
+ * pointing its own name at `127.0.0.1`). Returns whether the request was the RPC surface's.
  *
  * This replaced Telefunc (F3), which required a build-time transform over every `.telefunc.ts`
  * file, a registration table pinning each RPC to the client-baked key of the *dashboard* source
  * path it was re-exported from, and a request-context indirection for wiring that never varied
  * per request. What it bought over this was type-safety across a package boundary that A7 removed.
  */
-export declare function makeRpcMount(context: DashboardContext, opts?: {
-    host?: string;
-}): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+export declare function makeRpcMount(context: DashboardContext): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;

package/dist/module-types/src/dashboard/types.d.ts

@@ -75,7 +75,7 @@ export interface StartAgentOptions {
     /**
      * The branch the agent's own branch starts from, as this machine has it, commits that are not
      * pushed included: the launcher's "My local branch" pick. Absent, origin's default branch. A
-     * word that is no branch name refuses the Start. Not sent to a device: its branches are its own.
+     * word that is no branch name refuses the Start. Not sent to another machine: its branches are its own.
      */
     base?: string;
     /**
@@ -84,20 +84,12 @@ export interface StartAgentOptions {
      */
     then?: string;
     /**
-     * Run this session on a connected device (#1067): the local daemon relays the start to the remote
-     * daemon at `url` (authenticating with `token` as the `oa_daemon` cookie) and streams its events
-     * back into the local agent view. The device `label` rides along (memory-only, like `url`/`token`) so
-     * the local session list + notice can show which device the agent is on after a reload (#1077).
-     * Memory-only relay config the dashboard sets at submit time from a saved device. NEVER persisted to
-     * Preferences or the registry: a device token is a per-browser secret. Absent = run locally.
-     * Stripped before the start is forwarded, so the remote starts an ordinary local run and does not
-     * relay onward.
+     * Run this session on a saved machine (#1067), named by its id: the local daemon relays the
+     * start to that machine's daemon, which starts it in its own copy of the project, and streams
+     * its events back into the local agent view. Absent = run on this machine. Stripped before the
+     * start is forwarded, so the machine starts an ordinary local run and does not relay onward.
      */
-    remote?: {
-        url: string;
-        token: string;
-        label?: string;
-    };
+    machine?: string;
 }
 /** The outcome of a Start attempt (#345): the id of the run the project's start hook began, or why there is none. */
 export type StartAgentResult = {

package/dist/module-types/src/dashboard-rpc/context.d.ts

@@ -22,18 +22,18 @@ export declare function resolveProjectPath(projectId: string): Promise<string |
 export declare function resolveAgentPath(projectId: string, agentId?: string): Promise<string | undefined>;
 /**
  * The in-memory {@link EventsSource} (#426). It answers only for a run this daemon is relaying
- * from a connected device (#1067) — such a run has no diary on this machine, since it works in a
+ * from a saved machine (#1067) — such a run has no diary on this machine, since it works in a
  * checkout over there — and returns undefined for an ordinary local run, whose diary `onEvents`
  * tails off disk.
  */
 export declare function contextEventsSource(): EventsSource;
 /**
  * The relayed-agent lookup (#1067 slice 2). A run-scoped RPC uses it to tell an ordinary local agent
- * (resolve a local checkout) from one running on a connected device (forward the call there).
+ * (resolve a local checkout) from one running on a saved machine (forward the call there).
  *
  * The one accessor with a default rather than a throw, because "unwired" has a real meaning here:
- * a call arriving over `/_relay/rpc` is the *device* side of the relay, and the agent it names is
- * local to that device. Forwarding it onward would be a loop, so the honest answer there is that
+ * a call arriving over `/_relay/rpc` is the *machine* side of the relay, and the agent it names is
+ * local to that machine. Forwarding it onward would be a loop, so the honest answer there is that
  * nothing is relayed from here.
  */
 export declare function contextRemote(): RemoteAgents;

package/dist/module-types/src/dashboard-rpc/control.d.ts

@@ -65,7 +65,7 @@ export declare function sendRemoveWorktree(projectId: string, agentId: string):
 export declare function sendDeleteAgent(projectId: string, agentId: string): Promise<DeleteAgentResult>;
 /**
  * Start a run in the project (#405, #1774): the project's own `start` hook line, reached through
- * the daemon's wired `startAgent` (which relays to a connected device when the options name
+ * the daemon's wired `startAgent` (which relays to a saved machine when the options name
  * one). Answers the id of the run the hook began, or why there is none: a project without the
  * line cannot start a run from here.
  */

package/dist/module-types/src/dashboard-rpc/events.d.ts

@@ -28,7 +28,7 @@ export type LiveFeedEvent = OpenAgentEvent | StreamSync | PartialMessage;
  * The `agentId` names the run whose diary is followed; without one there is nothing to stream.
  *
  * Two sources, chosen by what is wired. An in-memory stream wins: an agent the daemon is relaying
- * from a device (#1067). Otherwise the on-disk log. The daemon's source answers only for relayed
+ * from a machine (#1067). Otherwise the on-disk log. The daemon's source answers only for relayed
  * runs, so an ordinary local agent falls through to tailing the log.
  *
  * Only the on-disk tail sends the {@link StreamSync} marker: the in-memory sources have no replay

package/dist/module-types/src/dashboard-rpc/index.d.ts

@@ -6,7 +6,7 @@ export { onPreferences, savePreferences, patchPreferences, onProjectPresets, sav
 export { type EditorInfo } from '../dashboard/open-in-app.js';
 export { onQuota } from './quota.js';
 export { onModels } from './models.js';
-export { checkDevices, type DeviceCheck } from './devices.js';
+export { onMachines, sendAddMachine, sendRemoveMachine, onMachinesReachable, onMachineVersions, type Machine, type AddMachineResult, type MachineVersions } from './machines.js';
 export { onModules, runModuleCommand, readModule, type DashboardModule, type ModuleCommandResult, type ModuleReadResult } from './modules.js';
 export { onProjectSkills, sendChangeSkills, sendCommitSkills, type ProjectSkills, type ProjectSkill, type ChangeSkillsResult } from './skills.js';
 import { streamAgentEvents } from './events.js';

package/dist/module-types/src/dashboard-rpc/machines.d.ts

@@ -0,0 +1,51 @@
+/** A saved machine as the browser sees it: no key. */
+export interface Machine {
+    id: string;
+    label: string;
+    url: string;
+}
+export type AddMachineResult = {
+    ok: true;
+    machine: Machine;
+} | {
+    ok: false;
+    error: string;
+};
+/** The saved machines, newest first. */
+export declare function onMachines(): Promise<Machine[]>;
+/**
+ * Save the machine a pasted link names: the link another OpenAgent gives for a new device. This
+ * computer is let in there with the link's code, once, and keeps the key it is answered. Adding
+ * a machine again, with a new link, replaces its name and the key, and the key it had there
+ * before is taken out.
+ */
+export declare function sendAddMachine(pasted: string, label?: string): Promise<AddMachineResult>;
+export type RemoveMachineResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Take a saved machine off the list, and this computer out of the machine: its key there stops
+ * working. Not while a run is at work there, which is read with that key. Taking the key out is
+ * not waited for: a machine that cannot be reached right now keeps it until this computer is
+ * removed there, among its devices.
+ */
+export declare function sendRemoveMachine(id: string): Promise<RemoveMachineResult>;
+/** Whether each saved machine answers right now, by id: one short call to each, with this computer's key. */
+export declare function onMachinesReachable(): Promise<Record<string, boolean>>;
+/** This computer's OpenAgent, and the one each saved machine runs. */
+export interface MachineVersions {
+    /** This computer's own. */
+    version: string;
+    /** Each saved machine, with its version when it answers and says. */
+    machines: (Machine & {
+        version?: string;
+    })[];
+}
+/**
+ * The saved machines with the OpenAgent each runs, beside this computer's own: how a page tells
+ * that a machine fell behind this computer. One short call to each, with this computer's key.
+ */
+export declare function onMachineVersions(): Promise<MachineVersions>;

package/dist/module-types/src/dashboard-rpc/modules.d.ts

@@ -38,7 +38,7 @@ export declare function runModuleCommand(projectId: string, pkg: string, args: s
  * Call read `name` of a module's server part in one project: how a module's browser part reads
  * what a command cannot answer fast enough. Refused for an unknown project, a package that is not
  * a module of that project, and a module with no server part. A read whose input names a run this
- * daemon relays to a connected device (`input.agentId`) is read over there, by that device's own
+ * daemon relays to a saved machine (`input.agentId`) is read over there, by that machine's own
  * copy of the module, since the run's checkout is there.
  */
 export declare function readModule(projectId: string, pkg: string, name: string, input: unknown): Promise<ModuleReadResult>;

package/dist/module-types/src/dashboard-rpc/projects.d.ts

@@ -58,6 +58,8 @@ export interface ProjectLauncher {
     gitHost: boolean;
     /** Whether the project's repository has an `origin` remote; without one nothing can be published, so the publish menu stops at the commit. */
     remote: boolean;
+    /** The address the project's repository was cloned from, the name another machine knows the project by; absent, the project cannot be sent to one. */
+    address?: string;
     /**
      * The two branches an agent can start from here, for the launcher's "start from" chip: `main`,
      * the name of origin's default branch, and `local`, the branch the project's folder is on now.

package/dist/module-types/src/dashboard-rpc/reads.d.ts

@@ -31,7 +31,7 @@ import type { BridgeAnswer, BridgeContact, BridgeVersion } from '../dashboard/br
  * may have just self-healed a dead agent to `stopped` (#716), and that freshly-archived row can
  * lag `listAgents` by a poll — keeping it regardless leaves the row visible with no flicker.
  *
- * An agent relayed to a connected device (#1067) lives only in the daemon's memory, never on disk, so
+ * An agent relayed to a saved machine (#1067) lives only in the daemon's memory, never on disk, so
  * its in-memory stub is merged in too (#1077): that is what re-opens it after a dashboard reload
  * instead of losing it.
  */
@@ -168,9 +168,8 @@ export declare function onBridgeStatus(): Promise<{
  *
  * Only while the bridge is on, so a daemon with the feature off never hands the secret to a
  * page. Revealing it here is not a new exposure: anyone who can load this dashboard can already
- * start runs on this machine, and on a non-loopback bind their browser is holding the same token
- * as a cookie. What it replaces is the alternative, which was telling people to open
- * `~/.openagent.json` and copy a field out of it.
+ * start runs on this machine. What it replaces is the alternative, which was telling people to
+ * open `~/.openagent.json` and copy a field out of it.
  */
 export declare function onBridgeToken(): Promise<string | null>;
 /**

package/dist/module-types/src/dashboard-rpc/relay-agent.d.ts

@@ -1,8 +1,8 @@
 /**
- * Run a run-scoped RPC locally, or relay it to the device when `agentId` names an agent this daemon is
- * relaying to a connected one (#1067 slice 2). For an ordinary local agent the remote lookup is empty and
+ * Run a run-scoped RPC locally, or relay it to the machine when `agentId` names an agent this daemon is
+ * relaying to a saved one (#1067 slice 2). For an ordinary local agent the remote lookup is empty and
  * `local()` runs unchanged. For a remote agent there is no local checkout, so the call is forwarded to the
- * device over the token; if the device is unreachable, `unreachable` is returned - the same empty/error
+ * machine with this computer's key there; if the machine is unreachable, or no longer lets this computer in, `unreachable` is returned - the same empty/error
  * shape `local()` gives on a failed read - so the caller never special-cases a remote agent.
  */
 export declare function relayOr<T>(agentId: string | undefined, fn: string, args: unknown[], local: () => Promise<T>, unreachable: T): Promise<T>;

package/dist/module-types/src/events.d.ts

@@ -102,11 +102,12 @@ export type OpenAgentEvent = {
     event: DriverEvent;
 }
 /**
- * A live screen something the agent ran is showing: a page on this machine's loopback, shown in
- * the chat where the line is, while it is the newest open screen at that address and the run
+ * A live screen something the agent ran is showing: where it answers, on the loopback of the
+ * computer the run is on, live while it is the newest open screen at that address and the run
  * has not ended. `label` names what it showed then. The same address with `ended` says the
  * screen has gone. A diary line a command appends itself (agent-driver's `DIARY_ENV`);
- * OpenAgent knows nothing of what the page is.
+ * OpenAgent passes a watcher's calls on to the address (dashboard/screen.ts) and knows nothing
+ * of what the screen is.
  */
  | {
     kind: 'screen';

package/dist/module-types/src/loopback-host.d.ts

@@ -1,11 +1,9 @@
 /**
- * Loopback-address helpers, shared by the daemon (deciding whether a bind gates behind the
- * token, #1051) and the RPC mount (rejecting a rebound `Host`). A leaf module on purpose:
- * `daemon.ts` imports the dashboard, so the mount cannot import these back out of it.
+ * Loopback-address helpers, for the RPC mount (rejecting a cross-origin page and a rebound `Host`).
  */
 /**
- * True when `host` is a loopback address the browser reaches without leaving the machine (#1051).
- * A bind-all (`0.0.0.0`, `::`) or a routable address is not, and gates behind the shared token.
+ * True when `host` is a loopback address the browser reaches without leaving the machine.
+ * A bind-all (`0.0.0.0`, `::`) or a routable address is not.
  *
  * The IPv4 check matches the whole `127.0.0.0/8` range but only as an address: a bare
  * `startsWith('127.')` also accepts a *registrable name* like `127.evil.com`, which is exactly the

package/dist/module-types/src/machine-link.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Read the link another computer's OpenAgent gives for a new device (its Settings, Devices, Add
+ * device): where this computer is let in, and the code that lets it in once. The code rides the
+ * link after the `#`. A server's link carries one thing more after the code and a dot: what the
+ * server's key is known by. Not a web address is `null`, and so is a link with no code.
+ *
+ * A leaf with no Node in it: the dashboard reads a paste with it as the person types, and the
+ * daemon reads it again before it asks to be let in.
+ */
+export interface MachineLink {
+    /** Where the other OpenAgent answers, as an origin (`http://studio.local:4201`). */
+    url: string;
+    /** Where this computer asks to be let in, and later takes itself out: the link without its code. */
+    door: string;
+    /** The code, good once. */
+    code: string;
+    /** What the machine's key is known by, when the link says: a call then goes only to a machine that shows that key. */
+    pin?: string;
+}
+export declare function parseMachineLink(pasted: string): MachineLink | null;