@openagt/dashboard 0.10.0 → 0.11.0

package/dist/dashboard/relay-endpoints.js

@@ -1,27 +1,39 @@
 import { end, readJsonBody, requireGet, sendJson } from './http.js';
+import { passToScreen, screenCallOf } from './screen.js';
+import { isRunId } from '../store/index.js';
+import { openagentVersion } from '../version.js';
 /**
- * The device-side of the remote-agent relay (#1067): the two endpoints a daemon exposes so another
- * daemon (holding this device's token) can run a session here and watch it. They live under
- * `/_relay`, behind the shared-token guard (#1051) in {@link startDashboard}. The guard admits a matching
- * `oa_daemon` cookie without the browser-only `?token=` 302, so a daemon-to-daemon call passes with
- * a cookie and a token-less caller is already 401'd before it reaches here.
+ * The machine-side of the remote-agent relay (#1067): the endpoints through which another
+ * machine's daemon runs a session here and watches it. They live under `/_relay`. This daemon
+ * listens on its own computer only: a call from another machine reaches them through whatever
+ * this computer opened to the network, which lets in only a machine that holds a key of its own
+ * and passes its call on as this computer's own would arrive.
  *
- * - `POST /_relay/start`  starts an ordinary local agent and returns its {@link StartAgentResult}. It
- *   runs in this device's own home checkout (slice 1); which project it targets is a later slice.
- * - `GET  /_relay/events?run=<id>` streams that agent's events as newline-delimited JSON until it
- *   ends or the caller disconnects.
- * - `GET  /_relay/ping` (#1072) a cookie-guarded reachability probe: 200 and an empty body, starts
- *   nothing. The online/offline status the dashboard shows is the local daemon calling this on each
- *   saved device with its token; a token-less caller is already 401'd by the shared-token guard (#1051) above.
+ * - `POST /_relay/start`  starts an ordinary local agent and returns its {@link StartAgentResult}.
+ * - `GET  /_relay/events?run=<id>&project=<address>` streams that agent's events as
+ *   newline-delimited JSON until it ends or the caller disconnects.
+ * - `GET  /_relay/ping` (#1072) a reachability probe: 200 and this OpenAgent's version, starts nothing. The
+ *   online/offline status the dashboard shows is the local daemon calling this on each saved
+ *   machine with its key there.
  * - `POST /_relay/rpc` (#1067 slice 2) runs one whitelisted run-scoped RPC (a read/diff/steer/handoff/
- *   push/PR) against this device's own checkout for the daemon relaying an agent here, answering {result}.
+ *   push/PR) against this machine's own checkout for the daemon relaying an agent here, answering {result}.
+ * - `GET /_relay/screen/stream?run=<id>&project=<address>` and `POST /_relay/screen/input?…` pass
+ *   one call on to the live screen of a run here (screen.ts), for the daemon whose person watches it.
+ *
+ * All but the ping name their project by its repository's address, and work in this machine's own
+ * project cloned from it. A call that names none, or one this machine does not have, starts and
+ * reads nothing: there is no project a call falls back to.
  */
 export const RELAY_PREFIX = '/_relay';
+/** This machine's id for the project a call names, or undefined: no address, or no such project here. */
+async function projectNamed(handlers, address) {
+    return typeof address === 'string' && address ? handlers.project(address) : undefined;
+}
 const MAX_START_BODY = 256 * 1024;
 /** Route a `/_relay/*` request. A host that wired no relay handlers 404s every relay route. */
 export async function handleRelayRequest(req, res, pathname, handlers) {
-    // Ping is a pure reachability + auth probe (#1072): it needs no wired handlers and starts nothing,
-    // so it answers even on a host that enabled no relay. Reaching here means the cookie already passed.
+    // Ping is a pure reachability probe (#1072): it needs no wired handlers and starts nothing,
+    // so it answers even on a host that enabled no relay.
     if (pathname === `${RELAY_PREFIX}/ping`)
         return handlePing(req, res);
     if (!handlers)
@@ -32,14 +44,31 @@ export async function handleRelayRequest(req, res, pathname, handlers) {
         return handleEvents(req, res, handlers);
     if (pathname === `${RELAY_PREFIX}/rpc`)
         return handleRpc(req, res, handlers);
+    const screenCall = screenCallOf(pathname, `${RELAY_PREFIX}/screen`);
+    if (screenCall)
+        return handleScreen(req, res, handlers, screenCall);
     end(res, 404, 'not found');
 }
-/** `GET /_relay/ping` (#1072): answer 200 with an empty body. Starts nothing; only proves this
- * daemon is reachable and the caller's cookie is valid (the shared-token guard (#1051) already enforced that). */
+/** `/_relay/screen/<call>?run=<id>&project=<address>`: pass the call on to the run's live screen here. */
+async function handleScreen(req, res, handlers, call) {
+    if (!handlers.screen)
+        return end(res, 404, 'relay screen not enabled');
+    const query = new URL(req.url ?? '/', 'http://localhost').searchParams;
+    const agentId = query.get('run');
+    if (!agentId || !isRunId(agentId))
+        return end(res, 400, 'missing run id');
+    const projectId = await projectNamed(handlers, query.get('project')).catch(() => undefined);
+    if (projectId === undefined)
+        return end(res, 404, 'no such project on this machine');
+    await passToScreen(req, res, call, await handlers.screen(projectId, agentId).catch(() => undefined));
+}
+/** `GET /_relay/ping` (#1072): answer 200 with this OpenAgent's version. Starts nothing; it proves this
+ * daemon is reachable, and to another machine that its key still lets it in, and tells that
+ * machine whether this one fell behind it. */
 function handlePing(req, res) {
     if (!requireGet(req, res))
         return;
-    end(res, 200, '');
+    sendJson(res, { version: openagentVersion() });
 }
 /** `POST /_relay/start`: read the agent request, start it locally, and answer with the result JSON. */
 async function handleStart(req, res, handlers) {
@@ -55,26 +84,37 @@ async function handleStart(req, res, handlers) {
     const prompt = typeof body.prompt === 'string' ? body.prompt : '';
     const options = (body.options && typeof body.options === 'object' ? body.options : {});
     // Never relay onward from a relayed agent: strip any nested target before starting it here.
-    // And a start relayed to a device never names a branch: the caller's branches are not this machine's.
-    const { remote: _drop, base: _callers, ...local } = options;
+    // And a start relayed to a machine never names a branch: the caller's branches are not this machine's.
+    const { machine: _drop, base: _callers, ...local } = options;
     let result;
     try {
-        result = await handlers.start(prompt, local, undefined);
+        const projectId = await projectNamed(handlers, body.project);
+        result =
+            projectId === undefined
+                ? { ok: false, error: `no project on this machine is cloned from ${String(body.project)}`, noProject: true }
+                : await handlers.start(prompt, local, projectId);
     }
     catch (err) {
         result = { ok: false, error: err instanceof Error ? err.message : String(err) };
     }
     sendJson(res, result);
 }
-/** `GET /_relay/events?run=<id>`: stream the agent's events as newline-delimited JSON. */
-function handleEvents(req, res, handlers) {
+/** `GET /_relay/events?run=<id>&project=<address>`: stream the agent's events as newline-delimited JSON. */
+async function handleEvents(req, res, handlers) {
     if (!requireGet(req, res))
         return;
-    const agentId = new URL(req.url ?? '/', 'http://localhost').searchParams.get('run');
+    const query = new URL(req.url ?? '/', 'http://localhost').searchParams;
+    const agentId = query.get('run');
     if (!agentId)
         return end(res, 400, 'missing run id');
+    const projectId = await projectNamed(handlers, query.get('project')).catch(() => undefined);
+    if (projectId === undefined)
+        return end(res, 404, 'no such project on this machine');
+    // The caller went away while the project was looked up: a tail started now would never be stopped.
+    if (res.destroyed || req.socket.destroyed)
+        return;
     res.writeHead(200, { 'content-type': 'application/x-ndjson', 'cache-control': 'no-cache' });
-    const stop = handlers.tailEvents(agentId, event => {
+    const stop = handlers.tailEvents(projectId, agentId, event => {
         // A dropped write (the caller went away mid-line) must not throw out of the tail callback.
         try {
             res.write(`${JSON.stringify(event)}\n`);
@@ -88,7 +128,7 @@ function handleEvents(req, res, handlers) {
     req.on('close', close);
 }
 const MAX_RPC_BODY = 256 * 1024;
-/** POST /_relay/rpc: run one whitelisted RPC on this device and answer {result}. */
+/** POST /_relay/rpc: run one whitelisted RPC on this machine and answer {result}. */
 async function handleRpc(req, res, handlers) {
     if (req.method !== 'POST')
         return end(res, 405, 'method not allowed', { allow: 'POST' });
@@ -106,7 +146,10 @@ async function handleRpc(req, res, handlers) {
     if (!fn)
         return end(res, 400, 'missing rpc name');
     try {
-        sendJson(res, { result: await handlers.rpc(fn, args) });
+        const projectId = await projectNamed(handlers, body.project);
+        if (projectId === undefined)
+            return end(res, 404, 'no such project on this machine');
+        sendJson(res, { result: await handlers.rpc(projectId, fn, args) });
     }
     catch (err) {
         end(res, 500, err instanceof Error ? err.message : 'rpc failed');

package/dist/dashboard/relay-endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-endpoints.js","sourceRoot":"","sources":["../../src/dashboard/relay-endpoints.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEnE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAA;AAiBrC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAA;AAEjC,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAoB,EACpB,GAAmB,EACnB,QAAgB,EAChB,QAAmC;IAEnC,mGAAmG;IACnG,qGAAqG;IACrG,IAAI,QAAQ,KAAK,GAAG,YAAY,OAAO;QAAE,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,QAAQ,KAAK,GAAG,YAAY,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAChF,IAAI,QAAQ,KAAK,GAAG,YAAY,SAAS;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAClF,IAAI,QAAQ,KAAK,GAAG,YAAY,MAAM;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC5E,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;AAC5B,CAAC;AAED;kHACkH;AAClH,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB;IAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACjC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;AACnB,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,IAAI,IAAoB,CAAA;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAmB,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAsB,CAAA;IAC3G,4FAA4F;IAC5F,sGAAsG;IACtG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IAC3D,IAAI,MAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACjF,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AACvB,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IACtF,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACnF,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;QAChD,2FAA2F;QAC3F,IAAI,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,CAAA;AAC/B,oFAAoF;AACpF,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IACzF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAA;IAChE,IAAI,IAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAqC,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAA;IACjD,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAClE,CAAC;AACH,CAAC"}
+{"version":3,"file":"relay-endpoints.js","sourceRoot":"","sources":["../../src/dashboard/relay-endpoints.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAmB,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEhD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAA;AAsBrC,yGAAyG;AACzG,KAAK,UAAU,YAAY,CAAC,QAAuB,EAAE,OAAgB;IACnE,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvF,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAA;AAEjC,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAoB,EACpB,GAAmB,EACnB,QAAgB,EAChB,QAAmC;IAEnC,4FAA4F;IAC5F,sDAAsD;IACtD,IAAI,QAAQ,KAAK,GAAG,YAAY,OAAO;QAAE,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,QAAQ,KAAK,GAAG,YAAY,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAChF,IAAI,QAAQ,KAAK,GAAG,YAAY,SAAS;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAClF,IAAI,QAAQ,KAAK,GAAG,YAAY,MAAM;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC5E,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,YAAY,SAAS,CAAC,CAAA;IACnE,IAAI,UAAU;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;IACnE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;AAC5B,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB,EAAE,IAAgB;IAC9G,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAA;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3F,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAA;IACpF,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;AACtG,CAAC;AAED;;8CAE8C;AAC9C,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB;IAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACjC,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,IAAI,IAAoB,CAAA;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAmB,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAsB,CAAA;IAC3G,4FAA4F;IAC5F,uGAAuG;IACvG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IAC5D,IAAI,MAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5D,MAAM;YACJ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC5G,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACjF,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AACvB,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IAC5F,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAA;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3F,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAA;IACpF,mGAAmG;IACnG,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS;QAAE,OAAM;IACjD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;QAC3D,2FAA2F;QAC3F,IAAI,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,CAAA;AAC/B,qFAAqF;AACrF,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IACzF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAA;IAChE,IAAI,IAAyD,CAAA;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAwD,CAAA;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAA;QACpF,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAClE,CAAC;AACH,CAAC"}

package/dist/dashboard/remote-run.d.ts

@@ -3,50 +3,90 @@ import type { OpenAgentEvent } from '../events.js';
 import type { AgentMeta } from '../store/index.js';
 import type { StartAgentOptions, StartAgentResult } from './types.js';
 /**
- * The server-side half of "run on a connected device" (#1067). The local daemon holds the saved
- * device's token, so it - not the browser - drives the remote daemon: it POSTs the agent to the
+ * The server-side half of "run on a saved machine" (#1067). The local daemon holds this computer's
+ * key on the saved machine, so it - not the browser - drives the remote daemon: it POSTs the agent to the
  * remote's `/_relay/start` and then fetch-streams the remote's `/_relay/events` back into a local
  * {@link EventStream}, which the dashboard reads over its normal same-origin `onEvents` channel. So
- * the browser never talks cross-origin and the token never leaves the two daemons (issue #1067 (b)).
+ * the browser never talks cross-origin and the key never leaves the two daemons (issue #1067 (b)).
  *
- * Authentication is the shared-token cookie (#1051), sent daemon-to-daemon: `Cookie: oa_daemon=<token>` with no
- * `Origin` header. The remote's guard admits a matching cookie without the browser-only `?token=`
- * 302, and its `/_rpc` CSRF check (absent Origin passes) is not even on these raw routes.
+ * Every call but the ping names its project, by its repository's address
+ * (repository-address.ts): a project's folder, and so its id, is another one on each machine.
+ *
+ * The other OpenAgent listens on its own computer only. What answers at a machine's address is
+ * whatever that computer opened to the network, which lets this computer in once, with the code
+ * a machine's link carries ({@link enterRemote}), answers a key of this computer's own, and from
+ * then on passes each call that carries the key (`Authorization: Bearer`, no `Origin`) to its
+ * OpenAgent as that computer's own browser would have made it.
  */
-/** Where a relayed agent executes: the remote daemon's origin and its #1051 token. Memory-only. */
-export interface RemoteTarget {
+/** How a machine is reached: where its OpenAgent answers, this computer's key there, and what the machine's own key is known by when its link said. */
+export interface MachineAccess {
     url: string;
-    token: string;
+    key: string;
+    pin?: string;
+}
+/** Where a relayed agent works: a machine, and the project there, by its repository's address. */
+export interface RemoteTarget extends MachineAccess {
+    project: string;
 }
-/** The body a relay start forwards to the remote's `/_relay/start`. */
+/** What a relay start forwards to the remote's `/_relay/start`, beside the project. */
 export interface RelayStartBody {
     prompt: string;
     options: StartAgentOptions;
 }
 /**
- * Health-check a saved device (#1072): a cookie'd `GET /_relay/ping`, true on any 2xx, false on a
- * non-2xx, an unreachable host, or the timeout. The token stays in memory for the check only, never
- * persisted, same as {@link startRemoteAgent}. This is how the browser's status dots learn reachable
- * from not: it has the tokens, the daemon does the cross-origin request.
+ * What a machine answers a relayed start with: a Start's own outcome, or `noProject` when it has
+ * no project cloned from the address the start named.
+ */
+export type RelayStartResult = StartAgentResult | {
+    ok: false;
+    error: string;
+    noProject: true;
+};
+/**
+ * Health-check a saved machine (#1072): true when it answers this computer's key. This is how
+ * the browser's status dots learn reachable from not.
+ */
+export declare function pingRemote(target: MachineAccess): Promise<boolean>;
+/** The OpenAgent a saved machine runs, as its ping tells it; nothing for a machine that does not answer, or does not say. */
+export declare function remoteVersion(target: MachineAccess): Promise<string | undefined>;
+/** What asking to be let in came to: this computer's key there, or why not, in words. */
+export type EnterResult = {
+    ok: true;
+    key: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Ask a machine to let this computer in, with the code its link carries, under `name`. The code
+ * is good once: a link used before, or older than a few minutes, is refused.
+ */
+export declare function enterRemote(door: string, code: string, name: string, pin?: string): Promise<EnterResult>;
+/**
+ * Take this computer out of a machine: its key there stops working. Whether the machine did;
+ * one that cannot be reached keeps the key until this computer is removed there by hand.
  */
-export declare function pingRemote(target: RemoteTarget): Promise<boolean>;
+export declare function leaveRemote(machine: MachineAccess & {
+    door: string;
+}): Promise<boolean>;
 /**
- * Start an agent on the remote daemon and return its {@link StartAgentResult} (with the remote's own run
- * id). A non-2xx or a transport failure surfaces as an `ok: false` result the dashboard shows, the
- * same shape a local refusal has, so the caller does not special-case remote errors.
+ * Start an agent on the remote daemon, in its project cloned from `target.project`, and return
+ * what it answered (with the remote's own run id). A non-2xx or a transport failure surfaces as an
+ * `ok: false` result the dashboard shows, the same shape a local refusal has, so the caller does
+ * not special-case remote errors.
  */
-export declare function startRemoteAgent(target: RemoteTarget, body: RelayStartBody): Promise<StartAgentResult>;
+export declare function startRemoteAgent(target: RemoteTarget, body: RelayStartBody): Promise<RelayStartResult>;
 /**
- * Relay one run-scoped RPC to the device that owns a remote agent (#1067 slice 2). The local daemon
- * holds the device token, so a read/diff/handoff/push/PR for a relayed agent runs ON the device: POST
- * {fn, args} to the remote's /_relay/rpc over the shared-token cookie (#1051) (no Origin), returning the device's
- * result. Throws on an unreachable device or a non-2xx so the caller falls back to its own empty/error
+ * Relay one run-scoped RPC to the machine that owns a remote agent (#1067 slice 2). The local daemon
+ * holds this computer's key there, so a read/diff/handoff/push/PR for a relayed agent runs ON the machine: POST
+ * {fn, args} to the remote's /_relay/rpc with the key (no Origin), returning the machine's
+ * result. Throws on an unreachable machine or a non-2xx so the caller falls back to its own empty/error
  * shape, the same way a failed local read does.
  */
 export declare function relayRpc(target: RemoteTarget, fn: string, args: unknown[]): Promise<unknown>;
 /**
  * Fetch-stream a remote agent's newline-delimited events into `onEvent` until the remote closes the
- * body, the agent ends, or `cancel()` is called. A 401 (the token was rotated) ends the stream
+ * body, the agent ends, or `cancel()` is called. A 401 (this computer was removed there) ends the stream
  * cleanly rather than as an error, so the dashboard sees a normal `done`, not a lost connection.
  * Returns a cancel function; calling it aborts the fetch and releases the reader.
  */
@@ -54,11 +94,12 @@ export declare function streamRemoteEvents(target: RemoteTarget, agentId: string
 /**
  * The local daemon's live relayed runs (#1067), keyed by the remote agent id. Registering an agent opens
  * an {@link EventStream} the dashboard reads through `onEvents`, fed by {@link streamRemoteEvents}
- * from the remote. This map is where a saved device's token lives daemon-side: in memory, for the
- * run's lifetime.
+ * from the remote. The target is the saved machine as it was at the Start. A machine is not
+ * removed while a run is at work on it ({@link working}); the runs that ended there before it
+ * was removed read as unreachable, and one added again answers for them with its new key ({@link rekey}).
  *
  * The `targets` map outlives the event pump (#1067 slice 2): a finished remote agent's post-run reads,
- * open-PR and merge still have to reach the device after its event stream has ended, so the device
+ * open-PR and merge still have to reach the machine after its event stream has ended, so the machine
  * target is kept until {@link dispose} clears it, not dropped when the stream closes.
  *
  * The `metas` map (#1077) holds a local {@link AgentMeta} stub per relayed agent so `onAgents` can show a
@@ -73,22 +114,26 @@ export declare class RelayedAgents {
     register(agentId: string, target: RemoteTarget, meta: AgentMeta, projectId: string): void;
     /** The live event stream for a relayed agent, or undefined when this daemon is not relaying it. */
     get(agentId: string | undefined): EventStream<OpenAgentEvent> | undefined;
-    /** The device a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
+    /** The machine a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
     target(agentId: string | undefined): RemoteTarget | undefined;
+    /** Whether a run this daemon follows is still at work on the machine at `url`: its events still stream. */
+    working(url: string): boolean;
+    /** How the machine at `url` is reached since it was added again, for the runs kept from before: this computer's new key there, and the key the machine is known by. */
+    rekey(url: string, key: string, pin?: string): void;
     /** A project's relayed run stubs (#1077), newest-first, so `onAgents` can surface them in the list. */
     list(projectId: string): AgentMeta[];
     /** Fold each relayed event into the agent's list row via the store's own reducer (#1077), so the
-     *  local stub mirrors the device: the terminal status on `end`, the waiting flag while it is parked
+     *  local stub mirrors the machine: the terminal status on `end`, the waiting flag while it is parked
      *  (#785), the driver once its session starts. Events carry no write time, so this stamps its own. */
     private apply;
     /** Close a relayed agent's event stream (not its target). Idempotent. */
     private endStream;
-    /** Stop every pump, close every stream, and forget every device target + list stub, on daemon shutdown. */
+    /** Stop every pump, close every stream, and forget every machine target + list stub, on daemon shutdown. */
     dispose(): void;
 }
 /**
- * Fold one relayed event into the memory-only row of a run on a device: what the device's own
- * card would say, kept here because that card is on the device. The events are the ones a run's
+ * Fold one relayed event into the memory-only row of a run on a machine: what the machine's own
+ * card would say, kept here because that card is on the machine. The events are the ones a run's
  * diary yields: the agent's session id, its cost, its end.
  */
 export declare function foldRelayedEvent(meta: AgentMeta, event: OpenAgentEvent, at: string): AgentMeta;

package/dist/dashboard/remote-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-run.d.ts","sourceRoot":"","sources":["../../src/dashboard/remote-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGrE;;;;;;;;;;GAUG;AAEH,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAOD;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAUvE;AAOD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAa5G;AAID;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACxC,KAAK,CAAC,EAAE,MAAM,IAAI,GACjB,MAAM,IAAI,CAwCZ;AAmBD;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAG1D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAElF,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUxF;IAED,mGAAmG;IACnG,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,SAAS,CAExE;IAED,yGAAyG;IACzG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAE5D;IAED,uGAAuG;IACvG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAKnC;IAED;;0GAEsG;IACtG,OAAO,CAAC,KAAK;IAMb,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAUjB,2GAA2G;IAC3G,OAAO,IAAI,IAAI,CAQd;CACF;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAS9F"}
+{"version":3,"file":"remote-run.d.ts","sourceRoot":"","sources":["../../src/dashboard/remote-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAIrE;;;;;;;;;;;;;;;GAeG;AAEH,uJAAuJ;AACvJ,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAA;AAoB/F;;;GAGG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAExE;AAED,6HAA6H;AAC7H,wBAAsB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAKtF;AAgBD,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAElF;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAsB9G;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAO7F;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAc5G;AAID;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACxC,KAAK,CAAC,EAAE,MAAM,IAAI,GACjB,MAAM,IAAI,CAwCZ;AAmBD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAG1D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAElF,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUxF;IAED,mGAAmG;IACnG,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,SAAS,CAExE;IAED,0GAA0G;IAC1G,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAE5D;IAED,2GAA2G;IAC3G,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG5B;IAED,uKAAuK;IACvK,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAIlD;IAED,uGAAuG;IACvG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAKnC;IAED;;0GAEsG;IACtG,OAAO,CAAC,KAAK;IAMb,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAUjB,4GAA4G;IAC5G,OAAO,IAAI,IAAI,CAQd;CACF;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAS9F"}

package/dist/dashboard/remote-run.js

@@ -1,74 +1,137 @@
 import { EventStream } from '../event-stream.js';
 import { errorMessage } from '../error-message.js';
+import { machineFetch } from './machine-call.js';
 const START_TIMEOUT_MS = 15_000;
-/** How long a status ping waits before calling a device offline (#1072): short, since it polls. */
+/** How long a status ping waits before calling a machine offline (#1072): short, since it polls. */
 const PING_TIMEOUT_MS = 3_000;
+/** One `GET /_relay/ping` with this computer's key: the answer when it is a 2xx, else nothing (the key no longer lets in, the host is unreachable, the time is up). */
+async function ping(target) {
+    try {
+        const res = await machineFetch(`${trimSlashes(target.url)}/_relay/ping`, target.pin, {
+            headers: { authorization: `Bearer ${target.key}` },
+            signal: AbortSignal.timeout(PING_TIMEOUT_MS),
+        });
+        return res.ok ? res : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
- * Health-check a saved device (#1072): a cookie'd `GET /_relay/ping`, true on any 2xx, false on a
- * non-2xx, an unreachable host, or the timeout. The token stays in memory for the check only, never
- * persisted, same as {@link startRemoteAgent}. This is how the browser's status dots learn reachable
- * from not: it has the tokens, the daemon does the cross-origin request.
+ * Health-check a saved machine (#1072): true when it answers this computer's key. This is how
+ * the browser's status dots learn reachable from not.
  */
 export async function pingRemote(target) {
+    return (await ping(target)) !== undefined;
+}
+/** The OpenAgent a saved machine runs, as its ping tells it; nothing for a machine that does not answer, or does not say. */
+export async function remoteVersion(target) {
+    const said = await (await ping(target))?.json().catch(() => undefined);
+    const version = said && typeof said === 'object' ? said.version : undefined;
+    // What a machine says is shown on a page: only what reads as a version is one.
+    return typeof version === 'string' && /^[0-9A-Za-z.+-]{1,64}$/.test(version) ? version : undefined;
+}
+/** The two headers every relay request carries: JSON, and this computer's key there. No Origin on purpose. */
+function relayHeaders(key) {
+    return { 'content-type': 'application/json', authorization: `Bearer ${key}` };
+}
+/** What a machine says when this computer's key no longer lets it in: it was removed there. */
+const NOT_IN = 'this computer is no longer in on the machine: add the machine again, with a new link';
+const ENTER_TIMEOUT_MS = 10_000;
+/** How long a machine gets to take this computer out: it is not waited for by a person. */
+const LEAVE_TIMEOUT_MS = 5_000;
+/** What a machine answers to a code that was used before or is too old. */
+const CODE_SPENT = 'this code no longer works';
+/**
+ * Ask a machine to let this computer in, with the code its link carries, under `name`. The code
+ * is good once: a link used before, or older than a few minutes, is refused.
+ */
+export async function enterRemote(door, code, name, pin) {
+    let res;
     try {
-        const res = await fetch(`${trimSlashes(target.url)}/_relay/ping`, {
-            headers: { cookie: `oa_daemon=${target.token}` },
-            signal: AbortSignal.timeout(PING_TIMEOUT_MS),
+        res = await machineFetch(door, pin, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ code, computer: name }),
+            signal: AbortSignal.timeout(ENTER_TIMEOUT_MS),
         });
+    }
+    catch (err) {
+        return { ok: false, error: `The machine did not answer: ${errorMessage(err)}` };
+    }
+    if (res.status === 403) {
+        // The machine says why in words: a link that was used is one reason among others (this
+        // computer is on another network than the machine, the machine's list is full).
+        const why = (await res.text().catch(() => '')).trim().slice(0, 200);
+        if (why === CODE_SPENT)
+            return { ok: false, error: 'This link no longer works. A link works once, and for a short time: make a new one on the other machine.' };
+        return { ok: false, error: why ? `The machine refused: ${why}.` : 'The machine refused.' };
+    }
+    if (!res.ok)
+        return { ok: false, error: `The machine refused (${res.status}).` };
+    const key = await res.json().then(body => body?.key, () => undefined);
+    return typeof key === 'string' && key ? { ok: true, key } : { ok: false, error: 'What answered at this link is not an OpenAgent that lets a machine in.' };
+}
+/**
+ * Take this computer out of a machine: its key there stops working. Whether the machine did;
+ * one that cannot be reached keeps the key until this computer is removed there by hand.
+ */
+export async function leaveRemote(machine) {
+    try {
+        const res = await machineFetch(machine.door, machine.pin, { method: 'DELETE', headers: { authorization: `Bearer ${machine.key}` }, signal: AbortSignal.timeout(LEAVE_TIMEOUT_MS) });
         return res.ok;
     }
     catch {
         return false;
     }
 }
-/** The two headers every relay request carries: JSON, and the shared-token cookie (#1051). No Origin on purpose. */
-function relayHeaders(token) {
-    return { 'content-type': 'application/json', cookie: `oa_daemon=${token}` };
-}
 /**
- * Start an agent on the remote daemon and return its {@link StartAgentResult} (with the remote's own run
- * id). A non-2xx or a transport failure surfaces as an `ok: false` result the dashboard shows, the
- * same shape a local refusal has, so the caller does not special-case remote errors.
+ * Start an agent on the remote daemon, in its project cloned from `target.project`, and return
+ * what it answered (with the remote's own run id). A non-2xx or a transport failure surfaces as an
+ * `ok: false` result the dashboard shows, the same shape a local refusal has, so the caller does
+ * not special-case remote errors.
  */
 export async function startRemoteAgent(target, body) {
     try {
-        const res = await fetch(`${trimSlashes(target.url)}/_relay/start`, {
+        const res = await machineFetch(`${trimSlashes(target.url)}/_relay/start`, target.pin, {
             method: 'POST',
-            headers: relayHeaders(target.token),
-            body: JSON.stringify(body),
+            headers: relayHeaders(target.key),
+            body: JSON.stringify({ ...body, project: target.project }),
             signal: AbortSignal.timeout(START_TIMEOUT_MS),
         });
+        if (res.status === 401)
+            return { ok: false, error: NOT_IN };
         if (!res.ok)
-            return { ok: false, error: `the device refused the run (${res.status})` };
+            return { ok: false, error: `the machine refused the run (${res.status})` };
         return (await res.json());
     }
     catch (err) {
-        return { ok: false, error: `could not reach the device: ${errorMessage(err)}` };
+        return { ok: false, error: `could not reach the machine: ${errorMessage(err)}` };
     }
 }
-const RPC_TIMEOUT_MS = 60_000; // a relayed git push/PR runs over the network on the device
+const RPC_TIMEOUT_MS = 60_000; // a relayed git push/PR runs over the network on the machine
 /**
- * Relay one run-scoped RPC to the device that owns a remote agent (#1067 slice 2). The local daemon
- * holds the device token, so a read/diff/handoff/push/PR for a relayed agent runs ON the device: POST
- * {fn, args} to the remote's /_relay/rpc over the shared-token cookie (#1051) (no Origin), returning the device's
- * result. Throws on an unreachable device or a non-2xx so the caller falls back to its own empty/error
+ * Relay one run-scoped RPC to the machine that owns a remote agent (#1067 slice 2). The local daemon
+ * holds this computer's key there, so a read/diff/handoff/push/PR for a relayed agent runs ON the machine: POST
+ * {fn, args} to the remote's /_relay/rpc with the key (no Origin), returning the machine's
+ * result. Throws on an unreachable machine or a non-2xx so the caller falls back to its own empty/error
  * shape, the same way a failed local read does.
  */
 export async function relayRpc(target, fn, args) {
-    const res = await fetch(`${trimSlashes(target.url)}/_relay/rpc`, {
+    const res = await machineFetch(`${trimSlashes(target.url)}/_relay/rpc`, target.pin, {
         method: 'POST',
-        headers: relayHeaders(target.token),
-        body: JSON.stringify({ fn, args }),
+        headers: relayHeaders(target.key),
+        body: JSON.stringify({ fn, args, project: target.project }),
         signal: AbortSignal.timeout(RPC_TIMEOUT_MS),
     });
     if (!res.ok)
-        throw new Error(`the device refused the request (${res.status})`);
+        throw new Error(`the machine refused the request (${res.status})`);
     const body = (await res.json());
     return body.result;
 }
 /**
  * Fetch-stream a remote agent's newline-delimited events into `onEvent` until the remote closes the
- * body, the agent ends, or `cancel()` is called. A 401 (the token was rotated) ends the stream
+ * body, the agent ends, or `cancel()` is called. A 401 (this computer was removed there) ends the stream
  * cleanly rather than as an error, so the dashboard sees a normal `done`, not a lost connection.
  * Returns a cancel function; calling it aborts the fetch and releases the reader.
  */
@@ -83,9 +146,9 @@ export function streamRemoteEvents(target, agentId, onEvent, onEnd) {
     };
     void (async () => {
         try {
-            const url = `${trimSlashes(target.url)}/_relay/events?run=${encodeURIComponent(agentId)}`;
-            const res = await fetch(url, { headers: relayHeaders(target.token), signal: controller.signal });
-            // 401 = the device rotated its token. Nothing more will stream; end cleanly (a done, not a loss).
+            const url = `${trimSlashes(target.url)}/_relay/events?run=${encodeURIComponent(agentId)}&project=${encodeURIComponent(target.project)}`;
+            const res = await machineFetch(url, target.pin, { headers: relayHeaders(target.key), signal: controller.signal });
+            // 401 = this computer was removed on the machine. Nothing more will stream; end cleanly (a done, not a loss).
             if (!res.ok || !res.body)
                 return end();
             const reader = res.body.getReader();
@@ -133,11 +196,12 @@ function emitLine(line, onEvent) {
 /**
  * The local daemon's live relayed runs (#1067), keyed by the remote agent id. Registering an agent opens
  * an {@link EventStream} the dashboard reads through `onEvents`, fed by {@link streamRemoteEvents}
- * from the remote. This map is where a saved device's token lives daemon-side: in memory, for the
- * run's lifetime.
+ * from the remote. The target is the saved machine as it was at the Start. A machine is not
+ * removed while a run is at work on it ({@link working}); the runs that ended there before it
+ * was removed read as unreachable, and one added again answers for them with its new key ({@link rekey}).
  *
  * The `targets` map outlives the event pump (#1067 slice 2): a finished remote agent's post-run reads,
- * open-PR and merge still have to reach the device after its event stream has ended, so the device
+ * open-PR and merge still have to reach the machine after its event stream has ended, so the machine
  * target is kept until {@link dispose} clears it, not dropped when the stream closes.
  *
  * The `metas` map (#1077) holds a local {@link AgentMeta} stub per relayed agent so `onAgents` can show a
@@ -158,7 +222,7 @@ export class RelayedAgents {
         const stream = new EventStream();
         const cancel = streamRemoteEvents(target, agentId, event => {
             stream.push(event);
-            this.apply(agentId, event); // fold the event into the run's list row, mirroring the device
+            this.apply(agentId, event); // fold the event into the run's list row, mirroring the machine
         }, () => this.endStream(agentId));
         this.agents.set(agentId, { target, stream, cancel });
     }
@@ -166,10 +230,24 @@ export class RelayedAgents {
     get(agentId) {
         return agentId ? this.agents.get(agentId)?.stream : undefined;
     }
-    /** The device a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
+    /** The machine a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
     target(agentId) {
         return agentId ? this.targets.get(agentId) : undefined;
     }
+    /** Whether a run this daemon follows is still at work on the machine at `url`: its events still stream. */
+    working(url) {
+        for (const agent of this.agents.values())
+            if (agent.target.url === url)
+                return true;
+        return false;
+    }
+    /** How the machine at `url` is reached since it was added again, for the runs kept from before: this computer's new key there, and the key the machine is known by. */
+    rekey(url, key, pin) {
+        for (const [agentId, target] of this.targets) {
+            if (target.url === url)
+                this.targets.set(agentId, { url, key, ...(pin ? { pin } : {}), project: target.project });
+        }
+    }
     /** A project's relayed run stubs (#1077), newest-first, so `onAgents` can surface them in the list. */
     list(projectId) {
         const rows = [];
@@ -180,7 +258,7 @@ export class RelayedAgents {
         return rows.sort((a, b) => (a.startedAt < b.startedAt ? 1 : a.startedAt > b.startedAt ? -1 : 0));
     }
     /** Fold each relayed event into the agent's list row via the store's own reducer (#1077), so the
-     *  local stub mirrors the device: the terminal status on `end`, the waiting flag while it is parked
+     *  local stub mirrors the machine: the terminal status on `end`, the waiting flag while it is parked
      *  (#785), the driver once its session starts. Events carry no write time, so this stamps its own. */
     apply(agentId, event) {
         const entry = this.metas.get(agentId);
@@ -200,7 +278,7 @@ export class RelayedAgents {
         if (entry && entry.meta.status === 'running')
             entry.meta.status = 'stopped';
     }
-    /** Stop every pump, close every stream, and forget every device target + list stub, on daemon shutdown. */
+    /** Stop every pump, close every stream, and forget every machine target + list stub, on daemon shutdown. */
     dispose() {
         for (const [agentId, agent] of this.agents) {
             agent.cancel();
@@ -216,8 +294,8 @@ function trimSlashes(url) {
     return url.replace(/\/+$/, '');
 }
 /**
- * Fold one relayed event into the memory-only row of a run on a device: what the device's own
- * card would say, kept here because that card is on the device. The events are the ones a run's
+ * Fold one relayed event into the memory-only row of a run on a machine: what the machine's own
+ * card would say, kept here because that card is on the machine. The events are the ones a run's
  * diary yields: the agent's session id, its cost, its end.
  */
 export function foldRelayedEvent(meta, event, at) {