@openagt/dashboard 0.10.0 → 0.12.0

package/dist/dashboard/rpc-serve.js

@@ -26,6 +26,17 @@ export function isSameOriginRequest(req) {
     }
     return isLoopbackHost(hostname);
 }
+/**
+ * The third guard: a call says its body is JSON. {@link isSameOriginRequest} lets every loopback
+ * origin pass, whatever its port, so a page another program serves on this computer (an app an
+ * agent previews, a dev server) is let through it. A browser sends such a page's POST without
+ * asking only while its content type is one a plain form can have, and JSON is none of them:
+ * with JSON it asks first, this server never says yes, and the call is not sent. So a call that
+ * is not JSON is refused, and no page of another origin can make one, not even blind.
+ */
+export function isJsonRequest(req) {
+    return /^application\/json\s*(;|$)/i.test(req.headers['content-type'] ?? '');
+}
 /**
  * DNS-rebinding guard, the other half of the CSRF check above. A page on `evil.com` whose DNS
  * re-answers as `127.0.0.1` is *same-origin* with this server as far as the browser is concerned,
@@ -33,23 +44,14 @@ export function isSameOriginRequest(req) {
  * the mount, `sendStart` included, is reachable from a page the user merely visited.
  *
  * The `Host` header is what still gives the attacker away: it carries the name the browser was
- * asked for (`evil.com`), not the address it resolved to. So when we are bound to loopback, the
- * only `Host` a real user's browser can send is a loopback one (or the bound address itself) —
- * anything else is a rebound name and is rejected. An absent `Host` is rejected too when we are
- * enforcing: HTTP/1.1 requires it, and every browser sends it.
- *
- * A non-loopback bind (`--host`, #1051) is reached by a hostname we cannot predict, so there is
- * no allowlist to check against; that case gates behind the shared daemon token instead. Hosts
- * that never pass a bind host at all (the relay, which serves a public domain) are unaffected.
+ * asked for (`evil.com`), not the address it resolved to. The dashboard listens on this
+ * computer's own address only, so the only `Host` a real user's browser can send is a loopback
+ * one — anything else is a rebound name and is rejected. An absent `Host` is rejected too:
+ * HTTP/1.1 requires it, and every browser sends it.
  */
-export function isExpectedHost(req, boundHost) {
-    if (boundHost === undefined || !isLoopbackHost(boundHost))
-        return true;
+export function isExpectedHost(req) {
     const header = req.headers.host;
-    if (!header)
-        return false;
-    const hostname = hostnameFromHostHeader(header);
-    return isLoopbackHost(hostname) || hostname === boundHost;
+    return header !== undefined && header !== '' && isLoopbackHost(hostnameFromHostHeader(header));
 }
 /** Where the dashboard's RPCs live. One prefix, so the static handler can decline it by path. */
 export const RPC_PREFIX = '/_rpc';
@@ -87,7 +89,7 @@ async function serveEventStream(req, res, url) {
         'content-type': 'text/event-stream',
         'cache-control': 'no-store',
         connection: 'keep-alive',
-        // The daemon is behind nothing, but a proxy in front of a `--host` bind would otherwise buffer.
+        // What passes a device's request on to the daemon must not hold the lines back.
         'x-accel-buffering': 'no',
     });
     let finished = false;
@@ -118,17 +120,15 @@ async function serveEventStream(req, res, url) {
  * `sendStart` reaches the daemon's own `startAgent` through the wired {@link DashboardContext}.
  *
  * Cross-origin POSTs are rejected (CSRF: a page on evil.com must not steer or start a session), as
- * are requests carrying someone else's `Host` when we are bound to loopback (DNS rebinding: the
- * same page must not reach us by pointing its own name at `127.0.0.1`). Pass `opts.host` — the
- * address the server is bound to — to enable that second check. Returns whether the request was
- * the RPC surface's.
+ * are requests carrying someone else's `Host` (DNS rebinding: the same page must not reach us by
+ * pointing its own name at `127.0.0.1`). Returns whether the request was the RPC surface's.
  *
  * This replaced Telefunc (F3), which required a build-time transform over every `.telefunc.ts`
  * file, a registration table pinning each RPC to the client-baked key of the *dashboard* source
  * path it was re-exported from, and a request-context indirection for wiring that never varied
  * per request. What it bought over this was type-safety across a package boundary that A7 removed.
  */
-export function makeRpcMount(context, opts = {}) {
+export function makeRpcMount(context) {
     setDashboardContext(context);
     return async (req, res) => {
         // A fixed base, like every other request parse here: only the path and the query are read,
@@ -142,7 +142,7 @@ export function makeRpcMount(context, opts = {}) {
             res.end('cross-origin request forbidden');
             return true;
         }
-        if (!isExpectedHost(req, opts.host)) {
+        if (!isExpectedHost(req)) {
             res.writeHead(403, { 'content-type': 'text/plain' });
             res.end('unexpected Host header');
             return true;
@@ -158,6 +158,10 @@ export function makeRpcMount(context, opts = {}) {
                 sendJson(res, 404, { error: `no such RPC: ${name}` });
                 return true;
             }
+            if (!isJsonRequest(req)) {
+                sendJson(res, 415, { error: 'a call is sent as application/json' });
+                return true;
+            }
             const raw = await readBody(req);
             const args = raw ? JSON.parse(raw) : [];
             if (!Array.isArray(args)) {

package/dist/dashboard/rpc-serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-serve.js","sourceRoot":"","sources":["../../src/dashboard/rpc-serve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAkElD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,IAAI,MAAM,KAAK,WAAW,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IACtF,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,0CAA0C;IACzD,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,SAA6B;IAChF,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAA;AAC3D,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAA;AAEjC,gGAAgG;AAChG,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;IACnE,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAA;QAC3B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAA;QAClB,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ;IACjF,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;IAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,mBAAmB;QACnC,eAAe,EAAE,UAAU;QAC3B,UAAU,EAAE,YAAY;QACxB,gGAAgG;QAChG,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAA;IACF,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,SAAS,EACT,OAAO,EACP,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,EACD,GAAG,EAAE;QACH,QAAQ,GAAG,IAAI,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CACF,CAAA;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,0FAA0F;QAC1F,8EAA8E;QAC9E,GAAG,CAAC,GAAG,EAAE,CAAA;QACT,OAAM;IACR,CAAC;IACD,IAAI,QAAQ;QAAE,OAAM,CAAC,oDAAoD;IACzE,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,EAAE,CAAA;QACN,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAA;IACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAyB,EACzB,IAAI,GAAsB,EAAE;IAE5B,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC5B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,2FAA2F;QAC3F,8FAA8F;QAC9F,4FAA4F;QAC5F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3F,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBACrC,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC,CAAA;gBACrD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC/B,MAAM,IAAI,GAAc,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC,CAAC,CAAC,EAAE,CAAA;YACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAA;gBACnF,OAAO,IAAI,CAAA;YACb,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,GAAI,IAAgB,CAAC,EAAE,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yFAAyF;YACzF,0EAA0E;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAA;QAChB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"rpc-serve.js","sourceRoot":"","sources":["../../src/dashboard/rpc-serve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAuElD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,IAAI,MAAM,KAAK,WAAW,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IACtF,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,0CAA0C;IACzD,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,OAAO,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAA;AAC9E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IAC/B,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,IAAI,cAAc,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;AAChG,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAA;AAEjC,gGAAgG;AAChG,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;IACnE,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAA;QAC3B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAA;QAClB,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ;IACjF,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;IAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,mBAAmB;QACnC,eAAe,EAAE,UAAU;QAC3B,UAAU,EAAE,YAAY;QACxB,gFAAgF;QAChF,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAA;IACF,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,SAAS,EACT,OAAO,EACP,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,EACD,GAAG,EAAE;QACH,QAAQ,GAAG,IAAI,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CACF,CAAA;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,0FAA0F;QAC1F,8EAA8E;QAC9E,GAAG,CAAC,GAAG,EAAE,CAAA;QACT,OAAM;IACR,CAAC;IACD,IAAI,QAAQ;QAAE,OAAM,CAAC,oDAAoD;IACzE,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,EAAE,CAAA;QACN,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAA;IACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,OAAyB;IACpD,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC5B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,2FAA2F;QAC3F,8FAA8F;QAC9F,4FAA4F;QAC5F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3F,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBACrC,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC,CAAA;gBACrD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAA;gBACnE,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC/B,MAAM,IAAI,GAAc,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC,CAAC,CAAC,EAAE,CAAA;YACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAA;gBACnF,OAAO,IAAI,CAAA;YACb,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,GAAI,IAAgB,CAAC,EAAE,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yFAAyF;YACzF,0EAA0E;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAA;QAChB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC"}

package/dist/dashboard/screen.d.ts

@@ -0,0 +1,53 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RemoteTarget } from './remote-run.js';
+/**
+ * A run's live screen, for whoever watches the run from this OpenAgent: on this computer, on a
+ * phone that got in, or on another computer that follows the run. A `screen` line in the run's
+ * diary names where the screen answers, on the loopback of the computer the run is on. That
+ * address is reached by nothing but the OpenAgent of that computer, which passes on two calls
+ * and no other:
+ *
+ * - `GET  /_screen/stream?project=<id>&run=<id>`: what the screen shows, as the screen's own bytes.
+ * - `POST /_screen/input?project=<id>&run=<id>`: what the person did on it, as JSON.
+ *
+ * For a run this computer follows on another machine, both are asked of that machine
+ * (`/_relay/screen/…`), with this computer's key there.
+ *
+ * What a screen answers is written by whatever the agent ran, and for a run on another machine
+ * it comes from that machine. So it is never a page here: the bytes are answered as bytes no
+ * browser renders or runs, and the answer to an input is its status alone. What draws the screen
+ * is this OpenAgent's own.
+ */
+export declare const SCREEN_PREFIX = "/_screen";
+/** The two calls a screen takes. */
+export type ScreenCall = 'stream' | 'input';
+export interface ScreenHandlers {
+    /** Where the live screen of a run on this computer answers; nothing when the run has none. */
+    local: (projectId: string, agentId: string) => Promise<string | undefined>;
+    /** The machine a run this computer follows is on; nothing for a run of this computer's own. */
+    remote: (agentId: string) => RemoteTarget | undefined;
+}
+/** The call a path names, when it names one. */
+export declare function screenCallOf(pathname: string, prefix: string): ScreenCall | undefined;
+/**
+ * The address one call to a screen goes to. Only a screen on this computer's own loopback is
+ * called, at its own two paths: the line that names it was written by whatever the agent ran.
+ */
+export declare function screenCallAddress(screen: string, call: ScreenCall): string | undefined;
+/**
+ * Where the live screen of the run whose diary is the file at `diary` answers; nothing when it
+ * has none, or no diary. Only the lines that can say so are read as JSON, a screen's and a run's
+ * end: a diary is as long as the run, and this is asked for as long as someone looks.
+ */
+export declare function screenInDiary(diary: string): Promise<string | undefined>;
+/**
+ * `find`, asked at most once in a while for the same run, and once for all who ask at the same
+ * moment: where a screen answers changes only when a browser opens or closes. Only a run's own
+ * screen is kept: an ask that found none is asked again, and keeps nothing.
+ */
+export declare function kept(find: ScreenHandlers['local'], now?: () => number): ScreenHandlers['local'];
+/** Route a `/_screen/*` request of this computer's own dashboard, or of a device that got in. */
+export declare function handleScreenRequest(req: IncomingMessage, res: ServerResponse, pathname: string, handlers: ScreenHandlers | undefined): Promise<void>;
+/** Pass one call on to the screen at `screen`, on this computer; a 404 when there is none. */
+export declare function passToScreen(req: IncomingMessage, res: ServerResponse, call: ScreenCall, screen: string | undefined): Promise<void>;
+//# sourceMappingURL=screen.d.ts.map

package/dist/dashboard/screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/dashboard/screen.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAMhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa,aAAa,CAAA;AAEvC,oCAAoC;AACpC,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA;AAE3C,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1E,+FAA+F;IAC/F,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,CAAA;CACtD;AAeD,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAGrF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAStF;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW9E;AAKD;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,cAAc,CAAC,OAAO,CAAC,CAmBzG;AAED,iGAAiG;AACjG,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAY1J;AAED,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzI"}

package/dist/dashboard/screen.js

@@ -0,0 +1,175 @@
+import { readFile } from 'node:fs/promises';
+import { Readable } from 'node:stream';
+import { eventsOf, isRunId } from '../store/index.js';
+import { liveScreen } from '../screens.js';
+import { end, readJsonBody } from './http.js';
+import { machineFetch } from './machine-call.js';
+/**
+ * A run's live screen, for whoever watches the run from this OpenAgent: on this computer, on a
+ * phone that got in, or on another computer that follows the run. A `screen` line in the run's
+ * diary names where the screen answers, on the loopback of the computer the run is on. That
+ * address is reached by nothing but the OpenAgent of that computer, which passes on two calls
+ * and no other:
+ *
+ * - `GET  /_screen/stream?project=<id>&run=<id>`: what the screen shows, as the screen's own bytes.
+ * - `POST /_screen/input?project=<id>&run=<id>`: what the person did on it, as JSON.
+ *
+ * For a run this computer follows on another machine, both are asked of that machine
+ * (`/_relay/screen/…`), with this computer's key there.
+ *
+ * What a screen answers is written by whatever the agent ran, and for a run on another machine
+ * it comes from that machine. So it is never a page here: the bytes are answered as bytes no
+ * browser renders or runs, and the answer to an input is its status alone. What draws the screen
+ * is this OpenAgent's own.
+ */
+export const SCREEN_PREFIX = '/_screen';
+/** A person's click or a few typed letters, generously. */
+const MAX_INPUT = 16 * 1024;
+/** How long a screen gets to take an input. */
+const INPUT_TIMEOUT_MS = 15_000;
+/** The headers of every answer: bytes, kept by nobody, that no browser takes for a page or runs. */
+const INERT = {
+    'content-type': 'application/octet-stream',
+    'cache-control': 'no-store',
+    'x-content-type-options': 'nosniff',
+    'content-security-policy': "sandbox; default-src 'none'",
+};
+/** The call a path names, when it names one. */
+export function screenCallOf(pathname, prefix) {
+    const rest = pathname.slice(prefix.length + 1);
+    return pathname.startsWith(`${prefix}/`) && (rest === 'stream' || rest === 'input') ? rest : undefined;
+}
+/**
+ * The address one call to a screen goes to. Only a screen on this computer's own loopback is
+ * called, at its own two paths: the line that names it was written by whatever the agent ran.
+ */
+export function screenCallAddress(screen, call) {
+    let at;
+    try {
+        at = new URL(screen);
+    }
+    catch {
+        return undefined;
+    }
+    if (at.protocol !== 'http:' || at.hostname !== '127.0.0.1' || !at.port || at.pathname !== '/')
+        return undefined;
+    return `http://127.0.0.1:${at.port}/${call}${at.search}`;
+}
+/**
+ * Where the live screen of the run whose diary is the file at `diary` answers; nothing when it
+ * has none, or no diary. Only the lines that can say so are read as JSON, a screen's and a run's
+ * end: a diary is as long as the run, and this is asked for as long as someone looks.
+ */
+export async function screenInDiary(diary) {
+    const text = await readFile(diary, 'utf8').catch(() => '');
+    const lines = text.split('\n').flatMap(line => {
+        if (!line.includes('"screen"') && !line.includes('"ended"'))
+            return [];
+        try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        }
+    });
+    return liveScreen(eventsOf(lines));
+}
+/** How long an answer of {@link kept} is good for: a person's clicks come in bursts, and each would read the whole diary. */
+const KEPT_MS = 2_000;
+/**
+ * `find`, asked at most once in a while for the same run, and once for all who ask at the same
+ * moment: where a screen answers changes only when a browser opens or closes. Only a run's own
+ * screen is kept: an ask that found none is asked again, and keeps nothing.
+ */
+export function kept(find, now = Date.now) {
+    const answers = new Map();
+    return (projectId, agentId) => {
+        const key = `${projectId}\n${agentId}`;
+        const answer = answers.get(key);
+        if (answer && answer.until > now())
+            return answer.screen;
+        for (const [old, { until }] of answers)
+            if (until <= now())
+                answers.delete(old);
+        const screen = find(projectId, agentId);
+        answers.set(key, { screen, until: now() + KEPT_MS });
+        void screen.then(found => {
+            if (found === undefined && answers.get(key)?.screen === screen)
+                answers.delete(key);
+        }, () => {
+            if (answers.get(key)?.screen === screen)
+                answers.delete(key);
+        });
+        return screen;
+    };
+}
+/** Route a `/_screen/*` request of this computer's own dashboard, or of a device that got in. */
+export async function handleScreenRequest(req, res, pathname, handlers) {
+    const call = screenCallOf(pathname, SCREEN_PREFIX);
+    if (!handlers || !call)
+        return end(res, 404, 'not found');
+    const query = new URL(req.url ?? '/', 'http://localhost').searchParams;
+    const projectId = query.get('project');
+    const agentId = query.get('run');
+    if (!projectId || !agentId)
+        return end(res, 400, 'missing project or run');
+    if (!isRunId(agentId))
+        return end(res, 400, 'not a run');
+    const remote = handlers.remote(agentId);
+    if (!remote)
+        return passToScreen(req, res, call, await handlers.local(projectId, agentId).catch(() => undefined));
+    const at = `${remote.url.replace(/\/+$/, '')}/_relay/screen/${call}?run=${encodeURIComponent(agentId)}&project=${encodeURIComponent(remote.project)}`;
+    await pass(req, res, call, init => machineFetch(at, remote.pin, { ...init, headers: { ...init.headers, authorization: `Bearer ${remote.key}` } }));
+}
+/** Pass one call on to the screen at `screen`, on this computer; a 404 when there is none. */
+export async function passToScreen(req, res, call, screen) {
+    const at = screen === undefined ? undefined : screenCallAddress(screen, call);
+    if (at === undefined)
+        return end(res, 404, 'no screen');
+    await pass(req, res, call, init => fetch(at, { ...init, redirect: 'error' }));
+}
+/** Make the call with `ask`, and answer what it came to: a stream as inert bytes, an input as its status alone. */
+async function pass(req, res, call, ask) {
+    const method = call === 'stream' ? 'GET' : 'POST';
+    if (req.method !== method)
+        return end(res, 405, 'method not allowed', { allow: method });
+    // Whoever asked going away ends the call: a screen nobody watches is asked for nothing.
+    const gone = new AbortController();
+    res.once('close', () => gone.abort());
+    if (call === 'input') {
+        let body;
+        try {
+            body = await readJsonBody(req, MAX_INPUT);
+        }
+        catch {
+            return end(res, 400, 'invalid request body');
+        }
+        const answer = await ask({
+            method,
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.any([gone.signal, AbortSignal.timeout(INPUT_TIMEOUT_MS)]),
+        }).catch(() => undefined);
+        void answer?.body?.cancel().catch(() => { });
+        if (!answer)
+            return end(res, 502, 'the screen did not answer');
+        if (answer.status === 404)
+            return end(res, 404, 'no screen');
+        return end(res, answer.ok ? 204 : answer.status === 400 ? 400 : 502, '');
+    }
+    const answer = await ask({ method, headers: {}, signal: gone.signal }).catch(() => undefined);
+    if (res.destroyed)
+        return void answer?.body?.cancel().catch(() => { });
+    if (!answer?.ok || !answer.body) {
+        void answer?.body?.cancel().catch(() => { });
+        return end(res, answer?.status === 404 ? 404 : 502, answer?.status === 404 ? 'no screen' : 'the screen did not answer');
+    }
+    res.writeHead(200, INERT);
+    // The first picture may be a while away: the headers go now.
+    res.flushHeaders();
+    const bytes = Readable.fromWeb(answer.body);
+    // A screen that went away mid-stream ends the answer, so the watcher asks again instead of waiting for ever.
+    bytes.once('error', () => res.destroy());
+    bytes.pipe(res);
+}
+//# sourceMappingURL=screen.js.map

package/dist/dashboard/screen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../src/dashboard/screen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAqB,MAAM,mBAAmB,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGhD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAA;AAYvC,2DAA2D;AAC3D,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3B,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B,oGAAoG;AACpG,MAAM,KAAK,GAAG;IACZ,cAAc,EAAE,0BAA0B;IAC1C,eAAe,EAAE,UAAU;IAC3B,wBAAwB,EAAE,SAAS;IACnC,yBAAyB,EAAE,6BAA6B;CACzD,CAAA;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9C,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACxG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAgB;IAChE,IAAI,EAAO,CAAA;IACX,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,KAAK,OAAO,IAAI,EAAE,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC/G,OAAO,oBAAoB,EAAE,CAAC,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAA;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAA;QACtE,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;AACpC,CAAC;AAED,6HAA6H;AAC7H,MAAM,OAAO,GAAG,KAAK,CAAA;AAErB;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,IAA6B,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkE,CAAA;IACzF,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,GAAG,SAAS,KAAK,OAAO,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,MAAM,CAAA;QACxD,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,OAAO;YAAE,IAAI,KAAK,IAAI,GAAG,EAAE;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACvC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QACpD,KAAK,MAAM,CAAC,IAAI,CACd,KAAK,CAAC,EAAE;YACN,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACrF,CAAC,EACD,GAAG,EAAE;YACH,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9D,CAAC,CACF,CAAA;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAgB,EAAE,QAAoC;IACzI,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAA;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAA;IAC1E,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IACjH,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,IAAI,QAAQ,kBAAkB,CAAC,OAAO,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA;IACrJ,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AACpJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAgB,EAAE,MAA0B;IACxH,MAAM,EAAE,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC7E,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACvD,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;AAC/E,CAAC;AASD,mHAAmH;AACnH,KAAK,UAAU,IAAI,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAgB,EAAE,GAA4C;IAC3H,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;IACjD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,wFAAwF;IACxF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAErC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;SAC9E,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzB,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAA;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC5D,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC7F,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3C,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAA;IACzH,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACzB,6DAA6D;IAC7D,GAAG,CAAC,YAAY,EAAE,CAAA;IAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAA4D,CAAC,CAAA;IACnG,6GAA6G;IAC7G,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IACxC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjB,CAAC"}

package/dist/dashboard/server.d.ts

@@ -9,8 +9,6 @@ import type { EventsSource, RemoteAgents } from './rpc-serve.js';
 export interface DashboardOptions {
     /** Port to bind. Default `4200`; pass `0` for an ephemeral port. */
     port?: number;
-    /** Host to bind. Default `127.0.0.1` (localhost only). */
-    host?: string;
     /**
      * Called when the browser starts a run (#345): the `sendStart` RPC reaches this through the
      * wired dashboard context. Wire it to the project's start hook.
@@ -44,40 +42,41 @@ export interface DashboardOptions {
      */
     clientBundleDir?: string;
     /**
-     * The shared token that guards a non-loopback bind (#1051): with it set, every route (static
-     * bundle, `/_rpc`, `/_relay`) needs a valid `oa_daemon` cookie or a matching
-     * `?token=`, else 401. Omit for a loopback bind, where the guard is a no-op and local UX is
-     * byte-identical. A separate concern from the CSRF origin check in rpc-serve.ts.
-     */
-    token?: string;
-    /**
-     * The live-events source for a run this daemon is relaying from a connected device (#1067):
+     * The live-events source for a run this daemon is relaying from a saved machine (#1067):
      * a stream for such a run, else undefined so `onEvents` tails the run's diary off disk.
      */
     eventsSource: EventsSource;
     /**
      * The relayed-agent lookup the read RPCs consult (#1067 slice 2). A run-scoped RPC uses it to
-     * forward a remote agent's read/steer/handoff to the device that owns it.
+     * forward a remote agent's read/steer/handoff to the machine that owns it.
      */
     remote: RemoteAgents;
     /**
      * Serve a relay-started run's events back to the daemon that relayed it here (#1067): the
-     * `/_relay/*` endpoints (start + events, plus the slice-2 `rpc`). All are fronted by the same
-     * `token` guard above, so a device without the cookie cannot start or read a run.
+     * `/_relay/*` endpoints (start + events, plus the slice-2 `rpc`). The daemon listens on its
+     * own computer only, so a call from another machine reaches them through whatever this
+     * computer opened to the network, which lets in only a machine that holds a key of its own.
      */
     relay?: {
-        tailEvents: (agentId: string, onEvent: (event: import('../events.js').OpenAgentEvent) => void) => () => void;
+        /** This machine's own id for its project cloned from an address, which is how a relayed call names one. */
+        project: (address: string) => Promise<string | undefined>;
+        tailEvents: (projectId: string, agentId: string, onEvent: (event: import('../events.js').OpenAgentEvent) => void) => () => void;
         /** Run one whitelisted run-scoped RPC against this daemon's own checkout (#1067 slice 2). */
-        rpc?: (fn: string, args: unknown[]) => Promise<unknown>;
+        rpc?: (projectId: string, fn: string, args: unknown[]) => Promise<unknown>;
     };
+    /**
+     * Where the live screen of a run on this computer answers (screen.ts): what the `/_screen/*`
+     * routes, and the relay's for another machine, pass a watcher's calls on to. Absent leaves
+     * every screen route 404.
+     */
+    screen?: (projectId: string, agentId: string) => Promise<string | undefined>;
     /**
      * The browser bridge (#1237): the token a Claude web extension presents to report the question
      * its cloud session is parked on. Absent leaves every `/_bridge/*` route 404, which is default.
      *
-     * Deliberately not {@link token}. That one guards a non-loopback bind and is absent on a normal
-     * loopback daemon, where what keeps other origins out of `/_rpc` is the same-origin check.
-     * The bridge is the one route meant to be reached from another origin, so neither protects it
-     * and it authenticates on its own.
+     * What keeps other origins out of `/_rpc` is the same-origin check. The bridge is the one
+     * route meant to be reached from another origin, so that check does not protect it and it
+     * authenticates on its own.
      */
     bridgeToken?: string;
     /**

package/dist/dashboard/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAK9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5G,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAOhE,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,OAAO,EAAE,CACP,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,SAAS,CAAC,EAAE,MAAM,KACf,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACjD;;;OAGG;IACH,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAC5F,+HAA+H;IAC/H,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAA;IAC1G;;;OAGG;IACH,WAAW,EAAE,gBAAgB,CAAA;IAC7B,yDAAyD;IACzD,KAAK,EAAE,WAAW,CAAA;IAClB,2EAA2E;IAC3E,MAAM,EAAE,YAAY,CAAA;IACpB,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,iHAAiH;IACjH,aAAa,EAAE,kBAAkB,CAAA;IACjC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAA;IAC1B;;;OAGG;IACH,MAAM,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,cAAc,EAAE,cAAc,KAAK,IAAI,KAAK,MAAM,IAAI,CAAA;QAC5G,6FAA6F;QAC7F,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;KACxD,CAAA;IACD;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAA;CAChF;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,uBAAuB;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAwIzE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAK9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5G,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAQhE,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,OAAO,EAAE,CACP,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,SAAS,CAAC,EAAE,MAAM,KACf,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACjD;;;OAGG;IACH,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAC5F,+HAA+H;IAC/H,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAA;IAC1G;;;OAGG;IACH,WAAW,EAAE,gBAAgB,CAAA;IAC7B,yDAAyD;IACzD,KAAK,EAAE,WAAW,CAAA;IAClB,2EAA2E;IAC3E,MAAM,EAAE,YAAY,CAAA;IACpB,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,iHAAiH;IACjH,aAAa,EAAE,kBAAkB,CAAA;IACjC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAA;IAC1B;;;OAGG;IACH,MAAM,EAAE,YAAY,CAAA;IACpB;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,2GAA2G;QAC3G,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;QACzD,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,cAAc,EAAE,cAAc,KAAK,IAAI,KAAK,MAAM,IAAI,CAAA;QAC/H,6FAA6F;QAC7F,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;KAC3E,CAAA;IACD;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC5E;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAA;CAChF;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,uBAAuB;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAwIzE"}