@openagt/dashboard 0.10.0 → 0.12.0

package/dist/dashboard/remote-run.d.ts

@@ -3,50 +3,90 @@ import type { OpenAgentEvent } from '../events.js';
 import type { AgentMeta } from '../store/index.js';
 import type { StartAgentOptions, StartAgentResult } from './types.js';
 /**
- * The server-side half of "run on a connected device" (#1067). The local daemon holds the saved
- * device's token, so it - not the browser - drives the remote daemon: it POSTs the agent to the
+ * The server-side half of "run on a saved machine" (#1067). The local daemon holds this computer's
+ * key on the saved machine, so it - not the browser - drives the remote daemon: it POSTs the agent to the
  * remote's `/_relay/start` and then fetch-streams the remote's `/_relay/events` back into a local
  * {@link EventStream}, which the dashboard reads over its normal same-origin `onEvents` channel. So
- * the browser never talks cross-origin and the token never leaves the two daemons (issue #1067 (b)).
+ * the browser never talks cross-origin and the key never leaves the two daemons (issue #1067 (b)).
  *
- * Authentication is the shared-token cookie (#1051), sent daemon-to-daemon: `Cookie: oa_daemon=<token>` with no
- * `Origin` header. The remote's guard admits a matching cookie without the browser-only `?token=`
- * 302, and its `/_rpc` CSRF check (absent Origin passes) is not even on these raw routes.
+ * Every call but the ping names its project, by its repository's address
+ * (repository-address.ts): a project's folder, and so its id, is another one on each machine.
+ *
+ * The other OpenAgent listens on its own computer only. What answers at a machine's address is
+ * whatever that computer opened to the network, which lets this computer in once, with the code
+ * a machine's link carries ({@link enterRemote}), answers a key of this computer's own, and from
+ * then on passes each call that carries the key (`Authorization: Bearer`, no `Origin`) to its
+ * OpenAgent as that computer's own browser would have made it.
  */
-/** Where a relayed agent executes: the remote daemon's origin and its #1051 token. Memory-only. */
-export interface RemoteTarget {
+/** How a machine is reached: where its OpenAgent answers, this computer's key there, and what the machine's own key is known by when its link said. */
+export interface MachineAccess {
     url: string;
-    token: string;
+    key: string;
+    pin?: string;
+}
+/** Where a relayed agent works: a machine, and the project there, by its repository's address. */
+export interface RemoteTarget extends MachineAccess {
+    project: string;
 }
-/** The body a relay start forwards to the remote's `/_relay/start`. */
+/** What a relay start forwards to the remote's `/_relay/start`, beside the project. */
 export interface RelayStartBody {
     prompt: string;
     options: StartAgentOptions;
 }
 /**
- * Health-check a saved device (#1072): a cookie'd `GET /_relay/ping`, true on any 2xx, false on a
- * non-2xx, an unreachable host, or the timeout. The token stays in memory for the check only, never
- * persisted, same as {@link startRemoteAgent}. This is how the browser's status dots learn reachable
- * from not: it has the tokens, the daemon does the cross-origin request.
+ * What a machine answers a relayed start with: a Start's own outcome, or `noProject` when it has
+ * no project cloned from the address the start named.
+ */
+export type RelayStartResult = StartAgentResult | {
+    ok: false;
+    error: string;
+    noProject: true;
+};
+/**
+ * Health-check a saved machine (#1072): true when it answers this computer's key. This is how
+ * the browser's status dots learn reachable from not.
+ */
+export declare function pingRemote(target: MachineAccess): Promise<boolean>;
+/** The OpenAgent a saved machine runs, as its ping tells it; nothing for a machine that does not answer, or does not say. */
+export declare function remoteVersion(target: MachineAccess): Promise<string | undefined>;
+/** What asking to be let in came to: this computer's key there, or why not, in words. */
+export type EnterResult = {
+    ok: true;
+    key: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Ask a machine to let this computer in, with the code its link carries, under `name`. The code
+ * is good once: a link used before, or older than a few minutes, is refused.
+ */
+export declare function enterRemote(door: string, code: string, name: string, pin?: string): Promise<EnterResult>;
+/**
+ * Take this computer out of a machine: its key there stops working. Whether the machine did;
+ * one that cannot be reached keeps the key until this computer is removed there by hand.
  */
-export declare function pingRemote(target: RemoteTarget): Promise<boolean>;
+export declare function leaveRemote(machine: MachineAccess & {
+    door: string;
+}): Promise<boolean>;
 /**
- * Start an agent on the remote daemon and return its {@link StartAgentResult} (with the remote's own run
- * id). A non-2xx or a transport failure surfaces as an `ok: false` result the dashboard shows, the
- * same shape a local refusal has, so the caller does not special-case remote errors.
+ * Start an agent on the remote daemon, in its project cloned from `target.project`, and return
+ * what it answered (with the remote's own run id). A non-2xx or a transport failure surfaces as an
+ * `ok: false` result the dashboard shows, the same shape a local refusal has, so the caller does
+ * not special-case remote errors.
  */
-export declare function startRemoteAgent(target: RemoteTarget, body: RelayStartBody): Promise<StartAgentResult>;
+export declare function startRemoteAgent(target: RemoteTarget, body: RelayStartBody): Promise<RelayStartResult>;
 /**
- * Relay one run-scoped RPC to the device that owns a remote agent (#1067 slice 2). The local daemon
- * holds the device token, so a read/diff/handoff/push/PR for a relayed agent runs ON the device: POST
- * {fn, args} to the remote's /_relay/rpc over the shared-token cookie (#1051) (no Origin), returning the device's
- * result. Throws on an unreachable device or a non-2xx so the caller falls back to its own empty/error
+ * Relay one run-scoped RPC to the machine that owns a remote agent (#1067 slice 2). The local daemon
+ * holds this computer's key there, so a read/diff/handoff/push/PR for a relayed agent runs ON the machine: POST
+ * {fn, args} to the remote's /_relay/rpc with the key (no Origin), returning the machine's
+ * result. Throws on an unreachable machine or a non-2xx so the caller falls back to its own empty/error
  * shape, the same way a failed local read does.
  */
 export declare function relayRpc(target: RemoteTarget, fn: string, args: unknown[]): Promise<unknown>;
 /**
  * Fetch-stream a remote agent's newline-delimited events into `onEvent` until the remote closes the
- * body, the agent ends, or `cancel()` is called. A 401 (the token was rotated) ends the stream
+ * body, the agent ends, or `cancel()` is called. A 401 (this computer was removed there) ends the stream
  * cleanly rather than as an error, so the dashboard sees a normal `done`, not a lost connection.
  * Returns a cancel function; calling it aborts the fetch and releases the reader.
  */
@@ -54,11 +94,12 @@ export declare function streamRemoteEvents(target: RemoteTarget, agentId: string
 /**
  * The local daemon's live relayed runs (#1067), keyed by the remote agent id. Registering an agent opens
  * an {@link EventStream} the dashboard reads through `onEvents`, fed by {@link streamRemoteEvents}
- * from the remote. This map is where a saved device's token lives daemon-side: in memory, for the
- * run's lifetime.
+ * from the remote. The target is the saved machine as it was at the Start. A machine is not
+ * removed while a run is at work on it ({@link working}); the runs that ended there before it
+ * was removed read as unreachable, and one added again answers for them with its new key ({@link rekey}).
  *
  * The `targets` map outlives the event pump (#1067 slice 2): a finished remote agent's post-run reads,
- * open-PR and merge still have to reach the device after its event stream has ended, so the device
+ * open-PR and merge still have to reach the machine after its event stream has ended, so the machine
  * target is kept until {@link dispose} clears it, not dropped when the stream closes.
  *
  * The `metas` map (#1077) holds a local {@link AgentMeta} stub per relayed agent so `onAgents` can show a
@@ -73,22 +114,26 @@ export declare class RelayedAgents {
     register(agentId: string, target: RemoteTarget, meta: AgentMeta, projectId: string): void;
     /** The live event stream for a relayed agent, or undefined when this daemon is not relaying it. */
     get(agentId: string | undefined): EventStream<OpenAgentEvent> | undefined;
-    /** The device a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
+    /** The machine a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
     target(agentId: string | undefined): RemoteTarget | undefined;
+    /** Whether a run this daemon follows is still at work on the machine at `url`: its events still stream. */
+    working(url: string): boolean;
+    /** How the machine at `url` is reached since it was added again, for the runs kept from before: this computer's new key there, and the key the machine is known by. */
+    rekey(url: string, key: string, pin?: string): void;
     /** A project's relayed run stubs (#1077), newest-first, so `onAgents` can surface them in the list. */
     list(projectId: string): AgentMeta[];
     /** Fold each relayed event into the agent's list row via the store's own reducer (#1077), so the
-     *  local stub mirrors the device: the terminal status on `end`, the waiting flag while it is parked
+     *  local stub mirrors the machine: the terminal status on `end`, the waiting flag while it is parked
      *  (#785), the driver once its session starts. Events carry no write time, so this stamps its own. */
     private apply;
     /** Close a relayed agent's event stream (not its target). Idempotent. */
     private endStream;
-    /** Stop every pump, close every stream, and forget every device target + list stub, on daemon shutdown. */
+    /** Stop every pump, close every stream, and forget every machine target + list stub, on daemon shutdown. */
     dispose(): void;
 }
 /**
- * Fold one relayed event into the memory-only row of a run on a device: what the device's own
- * card would say, kept here because that card is on the device. The events are the ones a run's
+ * Fold one relayed event into the memory-only row of a run on a machine: what the machine's own
+ * card would say, kept here because that card is on the machine. The events are the ones a run's
  * diary yields: the agent's session id, its cost, its end.
  */
 export declare function foldRelayedEvent(meta: AgentMeta, event: OpenAgentEvent, at: string): AgentMeta;

package/dist/dashboard/remote-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-run.d.ts","sourceRoot":"","sources":["../../src/dashboard/remote-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGrE;;;;;;;;;;GAUG;AAEH,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAOD;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAUvE;AAOD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAa5G;AAID;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACxC,KAAK,CAAC,EAAE,MAAM,IAAI,GACjB,MAAM,IAAI,CAwCZ;AAmBD;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAG1D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAElF,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUxF;IAED,mGAAmG;IACnG,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,SAAS,CAExE;IAED,yGAAyG;IACzG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAE5D;IAED,uGAAuG;IACvG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAKnC;IAED;;0GAEsG;IACtG,OAAO,CAAC,KAAK;IAMb,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAUjB,2GAA2G;IAC3G,OAAO,IAAI,IAAI,CAQd;CACF;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAS9F"}
+{"version":3,"file":"remote-run.d.ts","sourceRoot":"","sources":["../../src/dashboard/remote-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAIrE;;;;;;;;;;;;;;;GAeG;AAEH,uJAAuJ;AACvJ,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAA;AAoB/F;;;GAGG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAExE;AAED,6HAA6H;AAC7H,wBAAsB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAKtF;AAgBD,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAElF;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAsB9G;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAO7F;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAc5G;AAID;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACxC,KAAK,CAAC,EAAE,MAAM,IAAI,GACjB,MAAM,IAAI,CAwCZ;AAmBD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAG1D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAElF,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUxF;IAED,mGAAmG;IACnG,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,SAAS,CAExE;IAED,0GAA0G;IAC1G,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAE5D;IAED,2GAA2G;IAC3G,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG5B;IAED,uKAAuK;IACvK,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAIlD;IAED,uGAAuG;IACvG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAKnC;IAED;;0GAEsG;IACtG,OAAO,CAAC,KAAK;IAMb,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAUjB,4GAA4G;IAC5G,OAAO,IAAI,IAAI,CAQd;CACF;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAS9F"}

package/dist/dashboard/remote-run.js

@@ -1,74 +1,137 @@
 import { EventStream } from '../event-stream.js';
 import { errorMessage } from '../error-message.js';
+import { machineFetch } from './machine-call.js';
 const START_TIMEOUT_MS = 15_000;
-/** How long a status ping waits before calling a device offline (#1072): short, since it polls. */
+/** How long a status ping waits before calling a machine offline (#1072): short, since it polls. */
 const PING_TIMEOUT_MS = 3_000;
+/** One `GET /_relay/ping` with this computer's key: the answer when it is a 2xx, else nothing (the key no longer lets in, the host is unreachable, the time is up). */
+async function ping(target) {
+    try {
+        const res = await machineFetch(`${trimSlashes(target.url)}/_relay/ping`, target.pin, {
+            headers: { authorization: `Bearer ${target.key}` },
+            signal: AbortSignal.timeout(PING_TIMEOUT_MS),
+        });
+        return res.ok ? res : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
- * Health-check a saved device (#1072): a cookie'd `GET /_relay/ping`, true on any 2xx, false on a
- * non-2xx, an unreachable host, or the timeout. The token stays in memory for the check only, never
- * persisted, same as {@link startRemoteAgent}. This is how the browser's status dots learn reachable
- * from not: it has the tokens, the daemon does the cross-origin request.
+ * Health-check a saved machine (#1072): true when it answers this computer's key. This is how
+ * the browser's status dots learn reachable from not.
  */
 export async function pingRemote(target) {
+    return (await ping(target)) !== undefined;
+}
+/** The OpenAgent a saved machine runs, as its ping tells it; nothing for a machine that does not answer, or does not say. */
+export async function remoteVersion(target) {
+    const said = await (await ping(target))?.json().catch(() => undefined);
+    const version = said && typeof said === 'object' ? said.version : undefined;
+    // What a machine says is shown on a page: only what reads as a version is one.
+    return typeof version === 'string' && /^[0-9A-Za-z.+-]{1,64}$/.test(version) ? version : undefined;
+}
+/** The two headers every relay request carries: JSON, and this computer's key there. No Origin on purpose. */
+function relayHeaders(key) {
+    return { 'content-type': 'application/json', authorization: `Bearer ${key}` };
+}
+/** What a machine says when this computer's key no longer lets it in: it was removed there. */
+const NOT_IN = 'this computer is no longer in on the machine: add the machine again, with a new link';
+const ENTER_TIMEOUT_MS = 10_000;
+/** How long a machine gets to take this computer out: it is not waited for by a person. */
+const LEAVE_TIMEOUT_MS = 5_000;
+/** What a machine answers to a code that was used before or is too old. */
+const CODE_SPENT = 'this code no longer works';
+/**
+ * Ask a machine to let this computer in, with the code its link carries, under `name`. The code
+ * is good once: a link used before, or older than a few minutes, is refused.
+ */
+export async function enterRemote(door, code, name, pin) {
+    let res;
     try {
-        const res = await fetch(`${trimSlashes(target.url)}/_relay/ping`, {
-            headers: { cookie: `oa_daemon=${target.token}` },
-            signal: AbortSignal.timeout(PING_TIMEOUT_MS),
+        res = await machineFetch(door, pin, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ code, computer: name }),
+            signal: AbortSignal.timeout(ENTER_TIMEOUT_MS),
         });
+    }
+    catch (err) {
+        return { ok: false, error: `The machine did not answer: ${errorMessage(err)}` };
+    }
+    if (res.status === 403) {
+        // The machine says why in words: a link that was used is one reason among others (this
+        // computer is on another network than the machine, the machine's list is full).
+        const why = (await res.text().catch(() => '')).trim().slice(0, 200);
+        if (why === CODE_SPENT)
+            return { ok: false, error: 'This link no longer works. A link works once, and for a short time: make a new one on the other machine.' };
+        return { ok: false, error: why ? `The machine refused: ${why}.` : 'The machine refused.' };
+    }
+    if (!res.ok)
+        return { ok: false, error: `The machine refused (${res.status}).` };
+    const key = await res.json().then(body => body?.key, () => undefined);
+    return typeof key === 'string' && key ? { ok: true, key } : { ok: false, error: 'What answered at this link is not an OpenAgent that lets a machine in.' };
+}
+/**
+ * Take this computer out of a machine: its key there stops working. Whether the machine did;
+ * one that cannot be reached keeps the key until this computer is removed there by hand.
+ */
+export async function leaveRemote(machine) {
+    try {
+        const res = await machineFetch(machine.door, machine.pin, { method: 'DELETE', headers: { authorization: `Bearer ${machine.key}` }, signal: AbortSignal.timeout(LEAVE_TIMEOUT_MS) });
         return res.ok;
     }
     catch {
         return false;
     }
 }
-/** The two headers every relay request carries: JSON, and the shared-token cookie (#1051). No Origin on purpose. */
-function relayHeaders(token) {
-    return { 'content-type': 'application/json', cookie: `oa_daemon=${token}` };
-}
 /**
- * Start an agent on the remote daemon and return its {@link StartAgentResult} (with the remote's own run
- * id). A non-2xx or a transport failure surfaces as an `ok: false` result the dashboard shows, the
- * same shape a local refusal has, so the caller does not special-case remote errors.
+ * Start an agent on the remote daemon, in its project cloned from `target.project`, and return
+ * what it answered (with the remote's own run id). A non-2xx or a transport failure surfaces as an
+ * `ok: false` result the dashboard shows, the same shape a local refusal has, so the caller does
+ * not special-case remote errors.
  */
 export async function startRemoteAgent(target, body) {
     try {
-        const res = await fetch(`${trimSlashes(target.url)}/_relay/start`, {
+        const res = await machineFetch(`${trimSlashes(target.url)}/_relay/start`, target.pin, {
             method: 'POST',
-            headers: relayHeaders(target.token),
-            body: JSON.stringify(body),
+            headers: relayHeaders(target.key),
+            body: JSON.stringify({ ...body, project: target.project }),
             signal: AbortSignal.timeout(START_TIMEOUT_MS),
         });
+        if (res.status === 401)
+            return { ok: false, error: NOT_IN };
         if (!res.ok)
-            return { ok: false, error: `the device refused the run (${res.status})` };
+            return { ok: false, error: `the machine refused the run (${res.status})` };
         return (await res.json());
     }
     catch (err) {
-        return { ok: false, error: `could not reach the device: ${errorMessage(err)}` };
+        return { ok: false, error: `could not reach the machine: ${errorMessage(err)}` };
     }
 }
-const RPC_TIMEOUT_MS = 60_000; // a relayed git push/PR runs over the network on the device
+const RPC_TIMEOUT_MS = 60_000; // a relayed git push/PR runs over the network on the machine
 /**
- * Relay one run-scoped RPC to the device that owns a remote agent (#1067 slice 2). The local daemon
- * holds the device token, so a read/diff/handoff/push/PR for a relayed agent runs ON the device: POST
- * {fn, args} to the remote's /_relay/rpc over the shared-token cookie (#1051) (no Origin), returning the device's
- * result. Throws on an unreachable device or a non-2xx so the caller falls back to its own empty/error
+ * Relay one run-scoped RPC to the machine that owns a remote agent (#1067 slice 2). The local daemon
+ * holds this computer's key there, so a read/diff/handoff/push/PR for a relayed agent runs ON the machine: POST
+ * {fn, args} to the remote's /_relay/rpc with the key (no Origin), returning the machine's
+ * result. Throws on an unreachable machine or a non-2xx so the caller falls back to its own empty/error
  * shape, the same way a failed local read does.
  */
 export async function relayRpc(target, fn, args) {
-    const res = await fetch(`${trimSlashes(target.url)}/_relay/rpc`, {
+    const res = await machineFetch(`${trimSlashes(target.url)}/_relay/rpc`, target.pin, {
         method: 'POST',
-        headers: relayHeaders(target.token),
-        body: JSON.stringify({ fn, args }),
+        headers: relayHeaders(target.key),
+        body: JSON.stringify({ fn, args, project: target.project }),
         signal: AbortSignal.timeout(RPC_TIMEOUT_MS),
     });
     if (!res.ok)
-        throw new Error(`the device refused the request (${res.status})`);
+        throw new Error(`the machine refused the request (${res.status})`);
     const body = (await res.json());
     return body.result;
 }
 /**
  * Fetch-stream a remote agent's newline-delimited events into `onEvent` until the remote closes the
- * body, the agent ends, or `cancel()` is called. A 401 (the token was rotated) ends the stream
+ * body, the agent ends, or `cancel()` is called. A 401 (this computer was removed there) ends the stream
  * cleanly rather than as an error, so the dashboard sees a normal `done`, not a lost connection.
  * Returns a cancel function; calling it aborts the fetch and releases the reader.
  */
@@ -83,9 +146,9 @@ export function streamRemoteEvents(target, agentId, onEvent, onEnd) {
     };
     void (async () => {
         try {
-            const url = `${trimSlashes(target.url)}/_relay/events?run=${encodeURIComponent(agentId)}`;
-            const res = await fetch(url, { headers: relayHeaders(target.token), signal: controller.signal });
-            // 401 = the device rotated its token. Nothing more will stream; end cleanly (a done, not a loss).
+            const url = `${trimSlashes(target.url)}/_relay/events?run=${encodeURIComponent(agentId)}&project=${encodeURIComponent(target.project)}`;
+            const res = await machineFetch(url, target.pin, { headers: relayHeaders(target.key), signal: controller.signal });
+            // 401 = this computer was removed on the machine. Nothing more will stream; end cleanly (a done, not a loss).
             if (!res.ok || !res.body)
                 return end();
             const reader = res.body.getReader();
@@ -133,11 +196,12 @@ function emitLine(line, onEvent) {
 /**
  * The local daemon's live relayed runs (#1067), keyed by the remote agent id. Registering an agent opens
  * an {@link EventStream} the dashboard reads through `onEvents`, fed by {@link streamRemoteEvents}
- * from the remote. This map is where a saved device's token lives daemon-side: in memory, for the
- * run's lifetime.
+ * from the remote. The target is the saved machine as it was at the Start. A machine is not
+ * removed while a run is at work on it ({@link working}); the runs that ended there before it
+ * was removed read as unreachable, and one added again answers for them with its new key ({@link rekey}).
  *
  * The `targets` map outlives the event pump (#1067 slice 2): a finished remote agent's post-run reads,
- * open-PR and merge still have to reach the device after its event stream has ended, so the device
+ * open-PR and merge still have to reach the machine after its event stream has ended, so the machine
  * target is kept until {@link dispose} clears it, not dropped when the stream closes.
  *
  * The `metas` map (#1077) holds a local {@link AgentMeta} stub per relayed agent so `onAgents` can show a
@@ -158,7 +222,7 @@ export class RelayedAgents {
         const stream = new EventStream();
         const cancel = streamRemoteEvents(target, agentId, event => {
             stream.push(event);
-            this.apply(agentId, event); // fold the event into the run's list row, mirroring the device
+            this.apply(agentId, event); // fold the event into the run's list row, mirroring the machine
         }, () => this.endStream(agentId));
         this.agents.set(agentId, { target, stream, cancel });
     }
@@ -166,10 +230,24 @@ export class RelayedAgents {
     get(agentId) {
         return agentId ? this.agents.get(agentId)?.stream : undefined;
     }
-    /** The device a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
+    /** The machine a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
     target(agentId) {
         return agentId ? this.targets.get(agentId) : undefined;
     }
+    /** Whether a run this daemon follows is still at work on the machine at `url`: its events still stream. */
+    working(url) {
+        for (const agent of this.agents.values())
+            if (agent.target.url === url)
+                return true;
+        return false;
+    }
+    /** How the machine at `url` is reached since it was added again, for the runs kept from before: this computer's new key there, and the key the machine is known by. */
+    rekey(url, key, pin) {
+        for (const [agentId, target] of this.targets) {
+            if (target.url === url)
+                this.targets.set(agentId, { url, key, ...(pin ? { pin } : {}), project: target.project });
+        }
+    }
     /** A project's relayed run stubs (#1077), newest-first, so `onAgents` can surface them in the list. */
     list(projectId) {
         const rows = [];
@@ -180,7 +258,7 @@ export class RelayedAgents {
         return rows.sort((a, b) => (a.startedAt < b.startedAt ? 1 : a.startedAt > b.startedAt ? -1 : 0));
     }
     /** Fold each relayed event into the agent's list row via the store's own reducer (#1077), so the
-     *  local stub mirrors the device: the terminal status on `end`, the waiting flag while it is parked
+     *  local stub mirrors the machine: the terminal status on `end`, the waiting flag while it is parked
      *  (#785), the driver once its session starts. Events carry no write time, so this stamps its own. */
     apply(agentId, event) {
         const entry = this.metas.get(agentId);
@@ -200,7 +278,7 @@ export class RelayedAgents {
         if (entry && entry.meta.status === 'running')
             entry.meta.status = 'stopped';
     }
-    /** Stop every pump, close every stream, and forget every device target + list stub, on daemon shutdown. */
+    /** Stop every pump, close every stream, and forget every machine target + list stub, on daemon shutdown. */
     dispose() {
         for (const [agentId, agent] of this.agents) {
             agent.cancel();
@@ -216,8 +294,8 @@ function trimSlashes(url) {
     return url.replace(/\/+$/, '');
 }
 /**
- * Fold one relayed event into the memory-only row of a run on a device: what the device's own
- * card would say, kept here because that card is on the device. The events are the ones a run's
+ * Fold one relayed event into the memory-only row of a run on a machine: what the machine's own
+ * card would say, kept here because that card is on the machine. The events are the ones a run's
  * diary yields: the agent's session id, its cost, its end.
  */
 export function foldRelayedEvent(meta, event, at) {

package/dist/dashboard/remote-run.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-run.js","sourceRoot":"","sources":["../../src/dashboard/remote-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AA0BlD,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B,mGAAmG;AACnG,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE;YAChE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,MAAM,CAAC,KAAK,EAAE,EAAE;YAChD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,oHAAoH;AACpH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,KAAK,EAAE,EAAE,CAAA;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAoB,EAAE,IAAoB;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAA;QACtF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IACjF,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAA,CAAC,4DAA4D;AAE1F;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAoB,EAAE,EAAU,EAAE,IAAe;IAC9E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC9E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAA;IACvD,OAAO,IAAI,CAAC,MAAM,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAoB,EACpB,OAAe,EACf,OAAwC,EACxC,KAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,GAAG,GAAG,GAAS,EAAE;QACrB,IAAI,KAAK;YAAE,OAAM;QACjB,KAAK,GAAG,IAAI,CAAA;QACZ,KAAK,EAAE,EAAE,CAAA;IACX,CAAC,CAAA;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAA;YACzF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YAChG,kGAAkG;YAClG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,OAAO,GAAG,EAAE,CAAA;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,SAAS,CAAC;gBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI;oBAAE,MAAK;gBACf,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjD,6EAA6E;gBAC7E,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAClC,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;oBACtB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;oBAC3C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;oBAClC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAChC,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA,CAAC,wCAAwC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;gBAAS,CAAC;YACT,GAAG,EAAE,CAAA;QACP,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,GAAG,EAAE;QACV,UAAU,CAAC,KAAK,EAAE,CAAA;QAClB,GAAG,EAAE,CAAA;IACP,CAAC,CAAA;AACH,CAAC;AAED,8GAA8G;AAC9G,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAwC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAM;IACpB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;AACH,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,aAAa;IACP,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAA;IACxC,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC1D,2GAA2G;IAC3G,2GAA2G;IAC1F,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAA;IAElF,4FAA4F;IAC5F,QAAQ,CAAC,OAAe,EAAE,MAAoB,EAAE,IAAe,EAAE,SAAiB;QAChF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,6DAA6D;QAC/F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA,CAAC,2DAA2D;QACxG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA,CAAC,gDAAgD;QACnF,MAAM,MAAM,GAAG,IAAI,WAAW,EAAkB,CAAA;QAChD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;YACzD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA,CAAC,+DAA+D;QAC5F,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,mGAAmG;IACnG,GAAG,CAAC,OAA2B;QAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,CAAC;IAED,yGAAyG;IACzG,MAAM,CAAC,OAA2B;QAChC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,CAAC;IAED,uGAAuG;IACvG,IAAI,CAAC,SAAiB;QACpB,MAAM,IAAI,GAAgB,EAAE,CAAA;QAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjG,oFAAoF;QACpF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAClG,CAAC;IAED;;0GAEsG;IAC9F,KAAK,CAAC,OAAe,EAAE,KAAqB;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,KAAK,CAAC,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,yEAAyE;IACjE,SAAS,CAAC,OAAe;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA,CAAC,qEAAqE;QAC1F,sGAAsG;QACtG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;IAC7E,CAAC;IAED,2GAA2G;IAC3G,OAAO;QACL,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,KAAK,CAAC,MAAM,EAAE,CAAA;YACd,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;CACF;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAe,EAAE,KAAqB,EAAE,EAAU;IACjF,MAAM,IAAI,GAAc,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAClD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;SAChE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAA;SACxE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAA;QAClG,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;IACnB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"remote-run.js","sourceRoot":"","sources":["../../src/dashboard/remote-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AA2ChD,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B,oGAAoG;AACpG,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B,uKAAuK;AACvK,KAAK,UAAU,IAAI,CAAC,MAAqB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,EAAE;YACnF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE,EAAE;YAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAqB;IACpD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,CAAA;AAC3C,CAAC;AAED,6HAA6H;AAC7H,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAqB;IACvD,MAAM,IAAI,GAAY,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA8B,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACtG,+EAA+E;IAC/E,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACpG,CAAC;AAED,8GAA8G;AAC9G,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,CAAA;AAC/E,CAAC;AAED,+FAA+F;AAC/F,MAAM,MAAM,GAAG,sFAAsF,CAAA;AAErG,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAC9B,2EAA2E;AAC3E,MAAM,UAAU,GAAG,2BAA2B,CAAA;AAK9C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,GAAY;IACtF,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IACjF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,uFAAuF;QACvF,gFAAgF;QAChF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACnE,IAAI,GAAG,KAAK,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0GAA0G,EAAE,CAAA;QAC/J,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,GAAG,CAAC,MAAM,IAAI,EAAE,CAAA;IAChF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAE,IAAiC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACnG,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wEAAwE,EAAE,CAAA;AAC5J,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAyC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACnL,OAAO,GAAG,CAAC,EAAE,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAoB,EAAE,IAAoB;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,EAAE;YACpF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAC3D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAA;QACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IAClF,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAA,CAAC,6DAA6D;AAE3F;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAoB,EAAE,EAAU,EAAE,IAAe;IAC9E,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE;QAClF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC/E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAA;IACvD,OAAO,IAAI,CAAC,MAAM,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAoB,EACpB,OAAe,EACf,OAAwC,EACxC,KAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,GAAG,GAAG,GAAS,EAAE;QACrB,IAAI,KAAK;YAAE,OAAM;QACjB,KAAK,GAAG,IAAI,CAAA;QACZ,KAAK,EAAE,EAAE,CAAA;IACX,CAAC,CAAA;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,kBAAkB,CAAC,OAAO,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA;YACvI,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YACjH,8GAA8G;YAC9G,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,OAAO,GAAG,EAAE,CAAA;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,SAAS,CAAC;gBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI;oBAAE,MAAK;gBACf,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjD,6EAA6E;gBAC7E,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAClC,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;oBACtB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;oBAC3C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;oBAClC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAChC,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA,CAAC,wCAAwC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;gBAAS,CAAC;YACT,GAAG,EAAE,CAAA;QACP,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,GAAG,EAAE;QACV,UAAU,CAAC,KAAK,EAAE,CAAA;QAClB,GAAG,EAAE,CAAA;IACP,CAAC,CAAA;AACH,CAAC;AAED,8GAA8G;AAC9G,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAwC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAM;IACpB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;AACH,CAAC;AAQD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,aAAa;IACP,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAA;IACxC,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC1D,2GAA2G;IAC3G,2GAA2G;IAC1F,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAA;IAElF,4FAA4F;IAC5F,QAAQ,CAAC,OAAe,EAAE,MAAoB,EAAE,IAAe,EAAE,SAAiB;QAChF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,6DAA6D;QAC/F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA,CAAC,2DAA2D;QACxG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA,CAAC,gDAAgD;QACnF,MAAM,MAAM,GAAG,IAAI,WAAW,EAAkB,CAAA;QAChD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;YACzD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA,CAAC,gEAAgE;QAC7F,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,mGAAmG;IACnG,GAAG,CAAC,OAA2B;QAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,CAAC;IAED,0GAA0G;IAC1G,MAAM,CAAC,OAA2B;QAChC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,CAAC;IAED,2GAA2G;IAC3G,OAAO,CAAC,GAAW;QACjB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;QACnF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uKAAuK;IACvK,KAAK,CAAC,GAAW,EAAE,GAAW,EAAE,GAAY;QAC1C,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QACnH,CAAC;IACH,CAAC;IAED,uGAAuG;IACvG,IAAI,CAAC,SAAiB;QACpB,MAAM,IAAI,GAAgB,EAAE,CAAA;QAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjG,oFAAoF;QACpF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAClG,CAAC;IAED;;0GAEsG;IAC9F,KAAK,CAAC,OAAe,EAAE,KAAqB;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,KAAK,CAAC,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,yEAAyE;IACjE,SAAS,CAAC,OAAe;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA,CAAC,qEAAqE;QAC1F,sGAAsG;QACtG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;IAC7E,CAAC;IAED,4GAA4G;IAC5G,OAAO;QACL,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,KAAK,CAAC,MAAM,EAAE,CAAA;YACd,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;CACF;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAe,EAAE,KAAqB,EAAE,EAAU;IACjF,MAAM,IAAI,GAAc,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAClD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;SAChE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAA;SACxE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAA;QAClG,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;IACnB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/dashboard/rpc-serve.d.ts

@@ -7,6 +7,7 @@ import type { BridgeBrowserOwner } from '../bridge-browser.js';
 import type { ProjectErrorsReader } from '../project-errors.js';
 import type { AddProjectResult, RemoveProjectResult, StartAgentOptions, StartAgentResult } from './types.js';
 import type { AgentMeta } from '../store/index.js';
+import type { RemoteTarget } from './remote-run.js';
 /** Wired by the daemon so `sendStart` can reach the daemon's own `startAgent` closure. */
 export type StartAgentHandler = (prompt: string, options: StartAgentOptions, projectId?: string) => StartAgentResult | Promise<StartAgentResult>;
 /** Wired by the daemon so `sendAddProject` can install + register a repo (#433). */
@@ -14,19 +15,20 @@ export type AddProjectHandler = (path: string, share: boolean) => AddProjectResu
 /** Wired by the daemon so `sendRemoveProject` can take a project off the list, by its id, and with `files` remove what OpenAgent left in its folder. */
 export type RemoveProjectHandler = (projectId: string, files: boolean) => RemoveProjectResult | Promise<RemoveProjectResult>;
 /** Resolve an agent to its live event stream: the relay feeds `onEvents` from its own in-memory stream
- * rather than a file on disk (#426), and the daemon feeds an agent it is relaying from a device (#1067).
+ * rather than a file on disk (#426), and the daemon feeds an agent it is relaying from a machine (#1067).
  * Returns undefined when there is no in-memory stream, so `onEvents` falls back to tailing the log. */
 export type EventsSource = (projectId: string, agentId?: string) => AsyncIterable<OpenAgentEvent> | undefined;
-/** Look up the device a relayed agent (#1067) executes on, or undefined for an ordinary local agent. The
+/** Look up the machine a relayed agent (#1067) executes on, or undefined for an ordinary local agent. The
  *  daemon wires this from its live relayed-agent map; a run-scoped RPC uses it to forward a remote agent's
- *  read/steer/handoff to that device instead of resolving a (nonexistent) local checkout. */
+ *  read/steer/handoff to that machine instead of resolving a (nonexistent) local checkout. */
 export interface RemoteAgents {
-    target(agentId: string | undefined): {
-        url: string;
-        token: string;
-    } | undefined;
+    target(agentId: string | undefined): RemoteTarget | undefined;
     /** A project's relayed run stubs (#1077), so `onAgents` can show a remote agent in the list and re-open it after a reload. */
     list(projectId: string): AgentMeta[];
+    /** Whether a run relayed from here is still at work on the machine at `url`. */
+    working(url: string): boolean;
+    /** How the machine at `url` is reached since it was added again, for the runs kept from before. */
+    rekey(url: string, key: string, pin?: string): void;
 }
 /**
  * What every RPC acts through.
@@ -40,10 +42,10 @@ export interface DashboardContext {
     startAgent: StartAgentHandler;
     addProject: AddProjectHandler;
     removeProject: RemoveProjectHandler;
-    /** The in-memory event stream for an agent relayed from a connected device (#1067), else undefined. */
+    /** The in-memory event stream for an agent relayed from a saved machine (#1067), else undefined. */
     eventsSource: EventsSource;
     /** The relayed-agent lookup (#1067 slice 2), so a run-scoped RPC can tell a local agent from one
-     *  running on a connected device and forward the call there. */
+     *  running on a saved machine and forward the call there. */
     remote: RemoteAgents;
     /** The user-preferences store (#410), over the registry file. */
     preferences: PreferencesStore;
@@ -65,6 +67,15 @@ export interface DashboardContext {
  * the mount, its only caller.
  */
 export declare function isSameOriginRequest(req: IncomingMessage): boolean;
+/**
+ * The third guard: a call says its body is JSON. {@link isSameOriginRequest} lets every loopback
+ * origin pass, whatever its port, so a page another program serves on this computer (an app an
+ * agent previews, a dev server) is let through it. A browser sends such a page's POST without
+ * asking only while its content type is one a plain form can have, and JSON is none of them:
+ * with JSON it asks first, this server never says yes, and the call is not sent. So a call that
+ * is not JSON is refused, and no page of another origin can make one, not even blind.
+ */
+export declare function isJsonRequest(req: IncomingMessage): boolean;
 /**
  * DNS-rebinding guard, the other half of the CSRF check above. A page on `evil.com` whose DNS
  * re-answers as `127.0.0.1` is *same-origin* with this server as far as the browser is concerned,
@@ -72,16 +83,12 @@ export declare function isSameOriginRequest(req: IncomingMessage): boolean;
  * the mount, `sendStart` included, is reachable from a page the user merely visited.
  *
  * The `Host` header is what still gives the attacker away: it carries the name the browser was
- * asked for (`evil.com`), not the address it resolved to. So when we are bound to loopback, the
- * only `Host` a real user's browser can send is a loopback one (or the bound address itself) —
- * anything else is a rebound name and is rejected. An absent `Host` is rejected too when we are
- * enforcing: HTTP/1.1 requires it, and every browser sends it.
- *
- * A non-loopback bind (`--host`, #1051) is reached by a hostname we cannot predict, so there is
- * no allowlist to check against; that case gates behind the shared daemon token instead. Hosts
- * that never pass a bind host at all (the relay, which serves a public domain) are unaffected.
+ * asked for (`evil.com`), not the address it resolved to. The dashboard listens on this
+ * computer's own address only, so the only `Host` a real user's browser can send is a loopback
+ * one — anything else is a rebound name and is rejected. An absent `Host` is rejected too:
+ * HTTP/1.1 requires it, and every browser sends it.
  */
-export declare function isExpectedHost(req: IncomingMessage, boundHost: string | undefined): boolean;
+export declare function isExpectedHost(req: IncomingMessage): boolean;
 /** Where the dashboard's RPCs live. One prefix, so the static handler can decline it by path. */
 export declare const RPC_PREFIX = "/_rpc";
 /**
@@ -90,17 +97,13 @@ export declare const RPC_PREFIX = "/_rpc";
  * `sendStart` reaches the daemon's own `startAgent` through the wired {@link DashboardContext}.
  *
  * Cross-origin POSTs are rejected (CSRF: a page on evil.com must not steer or start a session), as
- * are requests carrying someone else's `Host` when we are bound to loopback (DNS rebinding: the
- * same page must not reach us by pointing its own name at `127.0.0.1`). Pass `opts.host` — the
- * address the server is bound to — to enable that second check. Returns whether the request was
- * the RPC surface's.
+ * are requests carrying someone else's `Host` (DNS rebinding: the same page must not reach us by
+ * pointing its own name at `127.0.0.1`). Returns whether the request was the RPC surface's.
  *
  * This replaced Telefunc (F3), which required a build-time transform over every `.telefunc.ts`
  * file, a registration table pinning each RPC to the client-baked key of the *dashboard* source
  * path it was re-exported from, and a request-context indirection for wiring that never varied
  * per request. What it bought over this was type-safety across a package boundary that A7 removed.
  */
-export declare function makeRpcMount(context: DashboardContext, opts?: {
-    host?: string;
-}): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+export declare function makeRpcMount(context: DashboardContext): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
 //# sourceMappingURL=rpc-serve.d.ts.map

package/dist/dashboard/rpc-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-serve.d.ts","sourceRoot":"","sources":["../../src/dashboard/rpc-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAKhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,SAAS,CAAC,EAAE,MAAM,KACf,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAEjD,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAE9G,wJAAwJ;AACxJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;AAE5H;;uGAEuG;AACvG,MAAM,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,aAAa,CAAC,cAAc,CAAC,GAAG,SAAS,CAAA;AAE7G;;6FAE6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;IAC/E,8HAA8H;IAC9H,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAAA;CACrC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,iBAAiB,CAAA;IAC7B,UAAU,EAAE,iBAAiB,CAAA;IAC7B,aAAa,EAAE,oBAAoB,CAAA;IACnC,uGAAuG;IACvG,YAAY,EAAE,YAAY,CAAA;IAC1B;oEACgE;IAChE,MAAM,EAAE,YAAY,CAAA;IACpB,iEAAiE;IACjE,WAAW,EAAE,gBAAgB,CAAA;IAC7B,sDAAsD;IACtD,KAAK,EAAE,WAAW,CAAA;IAClB,2EAA2E;IAC3E,MAAM,EAAE,YAAY,CAAA;IACpB,iGAAiG;IACjG,aAAa,EAAE,mBAAmB,CAAA;IAClC,yFAAyF;IACzF,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAYjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAM3F;AAED,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAU,CAAA;AAmEjC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,gBAAgB,EACzB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CA6CjE"}
+{"version":3,"file":"rpc-serve.d.ts","sourceRoot":"","sources":["../../src/dashboard/rpc-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAKhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,SAAS,CAAC,EAAE,MAAM,KACf,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAEjD,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAE9G,wJAAwJ;AACxJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;AAE5H;;uGAEuG;AACvG,MAAM,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,aAAa,CAAC,cAAc,CAAC,GAAG,SAAS,CAAA;AAE7G;;8FAE8F;AAC9F,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAA;IAC7D,8HAA8H;IAC9H,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAAA;IACpC,gFAAgF;IAChF,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAC7B,mGAAmG;IACnG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,iBAAiB,CAAA;IAC7B,UAAU,EAAE,iBAAiB,CAAA;IAC7B,aAAa,EAAE,oBAAoB,CAAA;IACnC,oGAAoG;IACpG,YAAY,EAAE,YAAY,CAAA;IAC1B;iEAC6D;IAC7D,MAAM,EAAE,YAAY,CAAA;IACpB,iEAAiE;IACjE,WAAW,EAAE,gBAAgB,CAAA;IAC7B,sDAAsD;IACtD,KAAK,EAAE,WAAW,CAAA;IAClB,2EAA2E;IAC3E,MAAM,EAAE,YAAY,CAAA;IACpB,iGAAiG;IACjG,aAAa,EAAE,mBAAmB,CAAA;IAClC,yFAAyF;IACzF,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAYjE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAG5D;AAED,iGAAiG;AACjG,eAAO,MAAM,UAAU,UAAU,CAAA;AAmEjC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAiDvH"}