@openagt/dashboard 0.9.0 → 0.11.0

package/dist/dashboard/machine-call.js

@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto';
+import { request } from 'node:https';
+import { isIP } from 'node:net';
+import { Readable } from 'node:stream';
+import { connect } from 'node:tls';
+/**
+ * One call to a saved machine. A machine reached over HTTPS whose link carried what its key is
+ * known by is known by that key alone: the connection is made, the key the machine shows is
+ * compared, and only then is anything sent, so a key and a prompt never reach whoever holds the
+ * machine's address next. The key stays when the machine renews its certificate, and a
+ * certificate that ran out while its office could not be reached does not cut the machine off.
+ *
+ * Any other machine (one on the same Wi-Fi, over plain HTTP) is called as it always was. Neither
+ * kind of call follows a redirect.
+ */
+/** What a key is known by: the SHA-256 of its public half, URL-safe. */
+function fingerprintOf(socket) {
+    const shown = socket.getPeerX509Certificate();
+    return shown && createHash('sha256').update(shown.publicKey.export({ type: 'spki', format: 'der' })).digest('base64url');
+}
+/** What a call says when the machine at the address shows another key than the one it was added with. */
+export const NOT_THE_MACHINE = 'what answers at this address is not the machine that was added: add the machine again, with a new link';
+/** How long a machine gets to show its key once it took the connection. */
+const HANDSHAKE_MS = 10_000;
+export function machineFetch(url, pin, init = {}) {
+    const target = new URL(url);
+    if (target.protocol !== 'https:' || pin === undefined)
+        return fetch(url, { ...init, redirect: 'error' });
+    return new Promise((resolve, reject) => {
+        const host = target.hostname.replace(/^\[|\]$/g, '');
+        const signal = init.signal;
+        const givenUp = () => (signal?.reason instanceof Error ? signal.reason : new Error('the call was given up on'));
+        // A call given up on before the machine took the connection ends here: the request itself
+        // says nothing until it has a connection.
+        signal?.addEventListener('abort', () => reject(givenUp()), { once: true });
+        const req = request(target, {
+            method: init.method ?? 'GET',
+            headers: init.headers ?? {},
+            ...(signal ? { signal } : {}),
+            // The connection is made here, by no agent, and handed over only once the machine has
+            // shown the key it is known by: one connection for one call.
+            createConnection: (_options, handOver) => {
+                const socket = connect({ host, port: Number(target.port) || 443, ...(isIP(host) ? {} : { servername: host }), rejectUnauthorized: false });
+                // The connection goes with the call: one that is given up on, and one a machine takes
+                // and then says nothing on, is not left open.
+                const drop = () => void socket.destroy(givenUp());
+                if (signal?.aborted)
+                    drop();
+                else
+                    signal?.addEventListener('abort', drop, { once: true });
+                socket.once('close', () => signal?.removeEventListener('abort', drop));
+                socket.setTimeout(HANDSHAKE_MS, () => socket.destroy(new Error('the machine took the connection and did not go on')));
+                socket.once('error', err => handOver(err, socket));
+                socket.once('secureConnect', () => {
+                    socket.setTimeout(0);
+                    if (fingerprintOf(socket) === pin)
+                        return handOver(null, socket);
+                    socket.destroy();
+                    handOver(new Error(NOT_THE_MACHINE), socket);
+                });
+                return undefined;
+            },
+        }, res => {
+            const headers = new Headers();
+            for (const [name, value] of Object.entries(res.headers))
+                for (const one of Array.isArray(value) ? value : value === undefined ? [] : [value])
+                    headers.append(name, one);
+            const status = res.statusCode ?? 502;
+            // A status with no body is answered without one: `Response` refuses a body there.
+            const empty = status === 204 || status === 205 || status === 304 || init.method === 'HEAD';
+            if (empty)
+                res.resume();
+            try {
+                resolve(new Response(empty ? null : Readable.toWeb(res), { status, headers }));
+            }
+            catch (err) {
+                // A status no answer can carry: the machine's fault, told as a failed call.
+                res.destroy();
+                reject(err);
+            }
+        });
+        req.once('error', reject);
+        req.end(init.body);
+    });
+}
+//# sourceMappingURL=machine-call.js.map

package/dist/dashboard/machine-call.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-call.js","sourceRoot":"","sources":["../../src/dashboard/machine-call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,OAAO,EAAkB,MAAM,UAAU,CAAA;AAElD;;;;;;;;;GASG;AAEH,wEAAwE;AACxE,SAAS,aAAa,CAAC,MAAiB;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAA;IAC7C,OAAO,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAC1H,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,wGAAwG,CAAA;AAEvI,2EAA2E;AAC3E,MAAM,YAAY,GAAG,MAAM,CAAA;AAS3B,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAuB,EAAE,IAAI,GAAgB,EAAE;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACxG,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,MAAM,OAAO,GAAG,GAAU,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAA;QACtH,0FAA0F;QAC1F,0CAA0C;QAC1C,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1E,MAAM,GAAG,GAAG,OAAO,CACjB,MAAM,EACN;YACE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,sFAAsF;YACtF,6DAA6D;YAC7D,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;gBACvC,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC1I,sFAAsF;gBACtF,8CAA8C;gBAC9C,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;gBACvD,IAAI,MAAM,EAAE,OAAO;oBAAE,IAAI,EAAE,CAAA;;oBACtB,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC5D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;gBACtE,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC,CAAA;gBACrH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;gBAClD,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;oBAChC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;oBACpB,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,GAAG;wBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;oBAChE,MAAM,CAAC,OAAO,EAAE,CAAA;oBAChB,QAAQ,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAA;gBAC9C,CAAC,CAAC,CAAA;gBACF,OAAO,SAAkB,CAAA;YAC3B,CAAC;SACF,EACD,GAAG,CAAC,EAAE;YACJ,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;YAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YACvK,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAA;YACpC,kFAAkF;YAClF,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAA;YAC1F,IAAI,KAAK;gBAAE,GAAG,CAAC,MAAM,EAAE,CAAA;YACvB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAgC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;YAChH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4EAA4E;gBAC5E,GAAG,CAAC,OAAO,EAAE,CAAA;gBACb,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;QACH,CAAC,CACF,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/dashboard/relay-endpoints.d.ts

@@ -2,30 +2,39 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { OpenAgentEvent } from '../events.js';
 import type { StartAgentOptions, StartAgentResult } from './types.js';
 /**
- * The device-side of the remote-agent relay (#1067): the two endpoints a daemon exposes so another
- * daemon (holding this device's token) can run a session here and watch it. They live under
- * `/_relay`, behind the shared-token guard (#1051) in {@link startDashboard}. The guard admits a matching
- * `oa_daemon` cookie without the browser-only `?token=` 302, so a daemon-to-daemon call passes with
- * a cookie and a token-less caller is already 401'd before it reaches here.
+ * The machine-side of the remote-agent relay (#1067): the endpoints through which another
+ * machine's daemon runs a session here and watches it. They live under `/_relay`. This daemon
+ * listens on its own computer only: a call from another machine reaches them through whatever
+ * this computer opened to the network, which lets in only a machine that holds a key of its own
+ * and passes its call on as this computer's own would arrive.
  *
- * - `POST /_relay/start`  starts an ordinary local agent and returns its {@link StartAgentResult}. It
- *   runs in this device's own home checkout (slice 1); which project it targets is a later slice.
- * - `GET  /_relay/events?run=<id>` streams that agent's events as newline-delimited JSON until it
- *   ends or the caller disconnects.
- * - `GET  /_relay/ping` (#1072) a cookie-guarded reachability probe: 200 and an empty body, starts
- *   nothing. The online/offline status the dashboard shows is the local daemon calling this on each
- *   saved device with its token; a token-less caller is already 401'd by the shared-token guard (#1051) above.
+ * - `POST /_relay/start`  starts an ordinary local agent and returns its {@link StartAgentResult}.
+ * - `GET  /_relay/events?run=<id>&project=<address>` streams that agent's events as
+ *   newline-delimited JSON until it ends or the caller disconnects.
+ * - `GET  /_relay/ping` (#1072) a reachability probe: 200 and this OpenAgent's version, starts nothing. The
+ *   online/offline status the dashboard shows is the local daemon calling this on each saved
+ *   machine with its key there.
  * - `POST /_relay/rpc` (#1067 slice 2) runs one whitelisted run-scoped RPC (a read/diff/steer/handoff/
- *   push/PR) against this device's own checkout for the daemon relaying an agent here, answering {result}.
+ *   push/PR) against this machine's own checkout for the daemon relaying an agent here, answering {result}.
+ * - `GET /_relay/screen/stream?run=<id>&project=<address>` and `POST /_relay/screen/input?…` pass
+ *   one call on to the live screen of a run here (screen.ts), for the daemon whose person watches it.
+ *
+ * All but the ping name their project by its repository's address, and work in this machine's own
+ * project cloned from it. A call that names none, or one this machine does not have, starts and
+ * reads nothing: there is no project a call falls back to.
  */
 export declare const RELAY_PREFIX = "/_relay";
 /** What the daemon wires behind the relay endpoints: its own start closure and an events tail. */
 export interface RelayHandlers {
-    start: (prompt: string, options: StartAgentOptions, projectId?: string) => StartAgentResult | Promise<StartAgentResult>;
-    tailEvents: (agentId: string, onEvent: (event: OpenAgentEvent) => void) => () => void;
-    /** Run one whitelisted read/steer/handoff RPC against THIS device's own checkout, for the daemon
+    /** This machine's own id for its project cloned from `address`, or undefined when it has none. */
+    project: (address: string) => Promise<string | undefined>;
+    start: (prompt: string, options: StartAgentOptions, projectId: string) => StartAgentResult | Promise<StartAgentResult>;
+    tailEvents: (projectId: string, agentId: string, onEvent: (event: OpenAgentEvent) => void) => () => void;
+    /** Run one whitelisted read/steer/handoff RPC against THIS machine's own checkout, for the daemon
      *  relaying an agent here (#1067 slice 2); the caller wraps the result as {result}. */
-    rpc?: (fn: string, args: unknown[]) => Promise<unknown>;
+    rpc?: (projectId: string, fn: string, args: unknown[]) => Promise<unknown>;
+    /** Where the live screen of a run here answers; nothing when the run has none. */
+    screen?: (projectId: string, agentId: string) => Promise<string | undefined>;
 }
 /** Route a `/_relay/*` request. A host that wired no relay handlers 404s every relay route. */
 export declare function handleRelayRequest(req: IncomingMessage, res: ServerResponse, pathname: string, handlers: RelayHandlers | undefined): Promise<void>;

package/dist/dashboard/relay-endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relay-endpoints.d.ts","sourceRoot":"","sources":["../../src/dashboard/relay-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGrE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,YAAY,CAAA;AAErC,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACvH,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,KAAK,MAAM,IAAI,CAAA;IACrF;2FACuF;IACvF,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAUD,+FAA+F;AAC/F,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,aAAa,GAAG,SAAS,GAClC,OAAO,CAAC,IAAI,CAAC,CASf"}
+{"version":3,"file":"relay-endpoints.d.ts","sourceRoot":"","sources":["../../src/dashboard/relay-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAOrE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,YAAY,YAAY,CAAA;AAErC,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,kGAAkG;IAClG,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACzD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,KAAK,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACtH,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,KAAK,MAAM,IAAI,CAAA;IACxG;2FACuF;IACvF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1E,kFAAkF;IAClF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAC7E;AAgBD,+FAA+F;AAC/F,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,aAAa,GAAG,SAAS,GAClC,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/dashboard/relay-endpoints.js

@@ -1,27 +1,39 @@
 import { end, readJsonBody, requireGet, sendJson } from './http.js';
+import { passToScreen, screenCallOf } from './screen.js';
+import { isRunId } from '../store/index.js';
+import { openagentVersion } from '../version.js';
 /**
- * The device-side of the remote-agent relay (#1067): the two endpoints a daemon exposes so another
- * daemon (holding this device's token) can run a session here and watch it. They live under
- * `/_relay`, behind the shared-token guard (#1051) in {@link startDashboard}. The guard admits a matching
- * `oa_daemon` cookie without the browser-only `?token=` 302, so a daemon-to-daemon call passes with
- * a cookie and a token-less caller is already 401'd before it reaches here.
+ * The machine-side of the remote-agent relay (#1067): the endpoints through which another
+ * machine's daemon runs a session here and watches it. They live under `/_relay`. This daemon
+ * listens on its own computer only: a call from another machine reaches them through whatever
+ * this computer opened to the network, which lets in only a machine that holds a key of its own
+ * and passes its call on as this computer's own would arrive.
  *
- * - `POST /_relay/start`  starts an ordinary local agent and returns its {@link StartAgentResult}. It
- *   runs in this device's own home checkout (slice 1); which project it targets is a later slice.
- * - `GET  /_relay/events?run=<id>` streams that agent's events as newline-delimited JSON until it
- *   ends or the caller disconnects.
- * - `GET  /_relay/ping` (#1072) a cookie-guarded reachability probe: 200 and an empty body, starts
- *   nothing. The online/offline status the dashboard shows is the local daemon calling this on each
- *   saved device with its token; a token-less caller is already 401'd by the shared-token guard (#1051) above.
+ * - `POST /_relay/start`  starts an ordinary local agent and returns its {@link StartAgentResult}.
+ * - `GET  /_relay/events?run=<id>&project=<address>` streams that agent's events as
+ *   newline-delimited JSON until it ends or the caller disconnects.
+ * - `GET  /_relay/ping` (#1072) a reachability probe: 200 and this OpenAgent's version, starts nothing. The
+ *   online/offline status the dashboard shows is the local daemon calling this on each saved
+ *   machine with its key there.
  * - `POST /_relay/rpc` (#1067 slice 2) runs one whitelisted run-scoped RPC (a read/diff/steer/handoff/
- *   push/PR) against this device's own checkout for the daemon relaying an agent here, answering {result}.
+ *   push/PR) against this machine's own checkout for the daemon relaying an agent here, answering {result}.
+ * - `GET /_relay/screen/stream?run=<id>&project=<address>` and `POST /_relay/screen/input?…` pass
+ *   one call on to the live screen of a run here (screen.ts), for the daemon whose person watches it.
+ *
+ * All but the ping name their project by its repository's address, and work in this machine's own
+ * project cloned from it. A call that names none, or one this machine does not have, starts and
+ * reads nothing: there is no project a call falls back to.
  */
 export const RELAY_PREFIX = '/_relay';
+/** This machine's id for the project a call names, or undefined: no address, or no such project here. */
+async function projectNamed(handlers, address) {
+    return typeof address === 'string' && address ? handlers.project(address) : undefined;
+}
 const MAX_START_BODY = 256 * 1024;
 /** Route a `/_relay/*` request. A host that wired no relay handlers 404s every relay route. */
 export async function handleRelayRequest(req, res, pathname, handlers) {
-    // Ping is a pure reachability + auth probe (#1072): it needs no wired handlers and starts nothing,
-    // so it answers even on a host that enabled no relay. Reaching here means the cookie already passed.
+    // Ping is a pure reachability probe (#1072): it needs no wired handlers and starts nothing,
+    // so it answers even on a host that enabled no relay.
     if (pathname === `${RELAY_PREFIX}/ping`)
         return handlePing(req, res);
     if (!handlers)
@@ -32,14 +44,31 @@ export async function handleRelayRequest(req, res, pathname, handlers) {
         return handleEvents(req, res, handlers);
     if (pathname === `${RELAY_PREFIX}/rpc`)
         return handleRpc(req, res, handlers);
+    const screenCall = screenCallOf(pathname, `${RELAY_PREFIX}/screen`);
+    if (screenCall)
+        return handleScreen(req, res, handlers, screenCall);
     end(res, 404, 'not found');
 }
-/** `GET /_relay/ping` (#1072): answer 200 with an empty body. Starts nothing; only proves this
- * daemon is reachable and the caller's cookie is valid (the shared-token guard (#1051) already enforced that). */
+/** `/_relay/screen/<call>?run=<id>&project=<address>`: pass the call on to the run's live screen here. */
+async function handleScreen(req, res, handlers, call) {
+    if (!handlers.screen)
+        return end(res, 404, 'relay screen not enabled');
+    const query = new URL(req.url ?? '/', 'http://localhost').searchParams;
+    const agentId = query.get('run');
+    if (!agentId || !isRunId(agentId))
+        return end(res, 400, 'missing run id');
+    const projectId = await projectNamed(handlers, query.get('project')).catch(() => undefined);
+    if (projectId === undefined)
+        return end(res, 404, 'no such project on this machine');
+    await passToScreen(req, res, call, await handlers.screen(projectId, agentId).catch(() => undefined));
+}
+/** `GET /_relay/ping` (#1072): answer 200 with this OpenAgent's version. Starts nothing; it proves this
+ * daemon is reachable, and to another machine that its key still lets it in, and tells that
+ * machine whether this one fell behind it. */
 function handlePing(req, res) {
     if (!requireGet(req, res))
         return;
-    end(res, 200, '');
+    sendJson(res, { version: openagentVersion() });
 }
 /** `POST /_relay/start`: read the agent request, start it locally, and answer with the result JSON. */
 async function handleStart(req, res, handlers) {
@@ -55,26 +84,37 @@ async function handleStart(req, res, handlers) {
     const prompt = typeof body.prompt === 'string' ? body.prompt : '';
     const options = (body.options && typeof body.options === 'object' ? body.options : {});
     // Never relay onward from a relayed agent: strip any nested target before starting it here.
-    // And a start relayed to a device never names a branch: the caller's branches are not this machine's.
-    const { remote: _drop, base: _callers, ...local } = options;
+    // And a start relayed to a machine never names a branch: the caller's branches are not this machine's.
+    const { machine: _drop, base: _callers, ...local } = options;
     let result;
     try {
-        result = await handlers.start(prompt, local, undefined);
+        const projectId = await projectNamed(handlers, body.project);
+        result =
+            projectId === undefined
+                ? { ok: false, error: `no project on this machine is cloned from ${String(body.project)}`, noProject: true }
+                : await handlers.start(prompt, local, projectId);
     }
     catch (err) {
         result = { ok: false, error: err instanceof Error ? err.message : String(err) };
     }
     sendJson(res, result);
 }
-/** `GET /_relay/events?run=<id>`: stream the agent's events as newline-delimited JSON. */
-function handleEvents(req, res, handlers) {
+/** `GET /_relay/events?run=<id>&project=<address>`: stream the agent's events as newline-delimited JSON. */
+async function handleEvents(req, res, handlers) {
     if (!requireGet(req, res))
         return;
-    const agentId = new URL(req.url ?? '/', 'http://localhost').searchParams.get('run');
+    const query = new URL(req.url ?? '/', 'http://localhost').searchParams;
+    const agentId = query.get('run');
     if (!agentId)
         return end(res, 400, 'missing run id');
+    const projectId = await projectNamed(handlers, query.get('project')).catch(() => undefined);
+    if (projectId === undefined)
+        return end(res, 404, 'no such project on this machine');
+    // The caller went away while the project was looked up: a tail started now would never be stopped.
+    if (res.destroyed || req.socket.destroyed)
+        return;
     res.writeHead(200, { 'content-type': 'application/x-ndjson', 'cache-control': 'no-cache' });
-    const stop = handlers.tailEvents(agentId, event => {
+    const stop = handlers.tailEvents(projectId, agentId, event => {
         // A dropped write (the caller went away mid-line) must not throw out of the tail callback.
         try {
             res.write(`${JSON.stringify(event)}\n`);
@@ -88,7 +128,7 @@ function handleEvents(req, res, handlers) {
     req.on('close', close);
 }
 const MAX_RPC_BODY = 256 * 1024;
-/** POST /_relay/rpc: run one whitelisted RPC on this device and answer {result}. */
+/** POST /_relay/rpc: run one whitelisted RPC on this machine and answer {result}. */
 async function handleRpc(req, res, handlers) {
     if (req.method !== 'POST')
         return end(res, 405, 'method not allowed', { allow: 'POST' });
@@ -106,7 +146,10 @@ async function handleRpc(req, res, handlers) {
     if (!fn)
         return end(res, 400, 'missing rpc name');
     try {
-        sendJson(res, { result: await handlers.rpc(fn, args) });
+        const projectId = await projectNamed(handlers, body.project);
+        if (projectId === undefined)
+            return end(res, 404, 'no such project on this machine');
+        sendJson(res, { result: await handlers.rpc(projectId, fn, args) });
     }
     catch (err) {
         end(res, 500, err instanceof Error ? err.message : 'rpc failed');

package/dist/dashboard/relay-endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-endpoints.js","sourceRoot":"","sources":["../../src/dashboard/relay-endpoints.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEnE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAA;AAiBrC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAA;AAEjC,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAoB,EACpB,GAAmB,EACnB,QAAgB,EAChB,QAAmC;IAEnC,mGAAmG;IACnG,qGAAqG;IACrG,IAAI,QAAQ,KAAK,GAAG,YAAY,OAAO;QAAE,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,QAAQ,KAAK,GAAG,YAAY,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAChF,IAAI,QAAQ,KAAK,GAAG,YAAY,SAAS;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAClF,IAAI,QAAQ,KAAK,GAAG,YAAY,MAAM;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC5E,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;AAC5B,CAAC;AAED;kHACkH;AAClH,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB;IAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACjC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;AACnB,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,IAAI,IAAoB,CAAA;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAmB,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAsB,CAAA;IAC3G,4FAA4F;IAC5F,sGAAsG;IACtG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IAC3D,IAAI,MAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACjF,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AACvB,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IACtF,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACnF,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;QAChD,2FAA2F;QAC3F,IAAI,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,CAAA;AAC/B,oFAAoF;AACpF,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IACzF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAA;IAChE,IAAI,IAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAqC,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAA;IACjD,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAClE,CAAC;AACH,CAAC"}
+{"version":3,"file":"relay-endpoints.js","sourceRoot":"","sources":["../../src/dashboard/relay-endpoints.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAmB,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEhD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAA;AAsBrC,yGAAyG;AACzG,KAAK,UAAU,YAAY,CAAC,QAAuB,EAAE,OAAgB;IACnE,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvF,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAA;AAEjC,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAoB,EACpB,GAAmB,EACnB,QAAgB,EAChB,QAAmC;IAEnC,4FAA4F;IAC5F,sDAAsD;IACtD,IAAI,QAAQ,KAAK,GAAG,YAAY,OAAO;QAAE,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,QAAQ,KAAK,GAAG,YAAY,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAChF,IAAI,QAAQ,KAAK,GAAG,YAAY,SAAS;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAClF,IAAI,QAAQ,KAAK,GAAG,YAAY,MAAM;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC5E,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,YAAY,SAAS,CAAC,CAAA;IACnE,IAAI,UAAU;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;IACnE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;AAC5B,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB,EAAE,IAAgB;IAC9G,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAA;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3F,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAA;IACpF,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;AACtG,CAAC;AAED;;8CAE8C;AAC9C,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB;IAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACjC,QAAQ,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,IAAI,IAAoB,CAAA;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAmB,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAsB,CAAA;IAC3G,4FAA4F;IAC5F,uGAAuG;IACvG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IAC5D,IAAI,MAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5D,MAAM;YACJ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC5G,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACjF,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AACvB,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IAC5F,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAA;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3F,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAA;IACpF,mGAAmG;IACnG,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS;QAAE,OAAM;IACjD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;QAC3D,2FAA2F;QAC3F,IAAI,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,CAAA;AAC/B,qFAAqF;AACrF,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAuB;IACzF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAA;IAChE,IAAI,IAAyD,CAAA;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAwD,CAAA;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAA;QACpF,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAClE,CAAC;AACH,CAAC"}

package/dist/dashboard/remote-run.d.ts

@@ -3,50 +3,90 @@ import type { OpenAgentEvent } from '../events.js';
 import type { AgentMeta } from '../store/index.js';
 import type { StartAgentOptions, StartAgentResult } from './types.js';
 /**
- * The server-side half of "run on a connected device" (#1067). The local daemon holds the saved
- * device's token, so it - not the browser - drives the remote daemon: it POSTs the agent to the
+ * The server-side half of "run on a saved machine" (#1067). The local daemon holds this computer's
+ * key on the saved machine, so it - not the browser - drives the remote daemon: it POSTs the agent to the
  * remote's `/_relay/start` and then fetch-streams the remote's `/_relay/events` back into a local
  * {@link EventStream}, which the dashboard reads over its normal same-origin `onEvents` channel. So
- * the browser never talks cross-origin and the token never leaves the two daemons (issue #1067 (b)).
+ * the browser never talks cross-origin and the key never leaves the two daemons (issue #1067 (b)).
  *
- * Authentication is the shared-token cookie (#1051), sent daemon-to-daemon: `Cookie: oa_daemon=<token>` with no
- * `Origin` header. The remote's guard admits a matching cookie without the browser-only `?token=`
- * 302, and its `/_rpc` CSRF check (absent Origin passes) is not even on these raw routes.
+ * Every call but the ping names its project, by its repository's address
+ * (repository-address.ts): a project's folder, and so its id, is another one on each machine.
+ *
+ * The other OpenAgent listens on its own computer only. What answers at a machine's address is
+ * whatever that computer opened to the network, which lets this computer in once, with the code
+ * a machine's link carries ({@link enterRemote}), answers a key of this computer's own, and from
+ * then on passes each call that carries the key (`Authorization: Bearer`, no `Origin`) to its
+ * OpenAgent as that computer's own browser would have made it.
  */
-/** Where a relayed agent executes: the remote daemon's origin and its #1051 token. Memory-only. */
-export interface RemoteTarget {
+/** How a machine is reached: where its OpenAgent answers, this computer's key there, and what the machine's own key is known by when its link said. */
+export interface MachineAccess {
     url: string;
-    token: string;
+    key: string;
+    pin?: string;
+}
+/** Where a relayed agent works: a machine, and the project there, by its repository's address. */
+export interface RemoteTarget extends MachineAccess {
+    project: string;
 }
-/** The body a relay start forwards to the remote's `/_relay/start`. */
+/** What a relay start forwards to the remote's `/_relay/start`, beside the project. */
 export interface RelayStartBody {
     prompt: string;
     options: StartAgentOptions;
 }
 /**
- * Health-check a saved device (#1072): a cookie'd `GET /_relay/ping`, true on any 2xx, false on a
- * non-2xx, an unreachable host, or the timeout. The token stays in memory for the check only, never
- * persisted, same as {@link startRemoteAgent}. This is how the browser's status dots learn reachable
- * from not: it has the tokens, the daemon does the cross-origin request.
+ * What a machine answers a relayed start with: a Start's own outcome, or `noProject` when it has
+ * no project cloned from the address the start named.
+ */
+export type RelayStartResult = StartAgentResult | {
+    ok: false;
+    error: string;
+    noProject: true;
+};
+/**
+ * Health-check a saved machine (#1072): true when it answers this computer's key. This is how
+ * the browser's status dots learn reachable from not.
+ */
+export declare function pingRemote(target: MachineAccess): Promise<boolean>;
+/** The OpenAgent a saved machine runs, as its ping tells it; nothing for a machine that does not answer, or does not say. */
+export declare function remoteVersion(target: MachineAccess): Promise<string | undefined>;
+/** What asking to be let in came to: this computer's key there, or why not, in words. */
+export type EnterResult = {
+    ok: true;
+    key: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Ask a machine to let this computer in, with the code its link carries, under `name`. The code
+ * is good once: a link used before, or older than a few minutes, is refused.
+ */
+export declare function enterRemote(door: string, code: string, name: string, pin?: string): Promise<EnterResult>;
+/**
+ * Take this computer out of a machine: its key there stops working. Whether the machine did;
+ * one that cannot be reached keeps the key until this computer is removed there by hand.
  */
-export declare function pingRemote(target: RemoteTarget): Promise<boolean>;
+export declare function leaveRemote(machine: MachineAccess & {
+    door: string;
+}): Promise<boolean>;
 /**
- * Start an agent on the remote daemon and return its {@link StartAgentResult} (with the remote's own run
- * id). A non-2xx or a transport failure surfaces as an `ok: false` result the dashboard shows, the
- * same shape a local refusal has, so the caller does not special-case remote errors.
+ * Start an agent on the remote daemon, in its project cloned from `target.project`, and return
+ * what it answered (with the remote's own run id). A non-2xx or a transport failure surfaces as an
+ * `ok: false` result the dashboard shows, the same shape a local refusal has, so the caller does
+ * not special-case remote errors.
  */
-export declare function startRemoteAgent(target: RemoteTarget, body: RelayStartBody): Promise<StartAgentResult>;
+export declare function startRemoteAgent(target: RemoteTarget, body: RelayStartBody): Promise<RelayStartResult>;
 /**
- * Relay one run-scoped RPC to the device that owns a remote agent (#1067 slice 2). The local daemon
- * holds the device token, so a read/diff/handoff/push/PR for a relayed agent runs ON the device: POST
- * {fn, args} to the remote's /_relay/rpc over the shared-token cookie (#1051) (no Origin), returning the device's
- * result. Throws on an unreachable device or a non-2xx so the caller falls back to its own empty/error
+ * Relay one run-scoped RPC to the machine that owns a remote agent (#1067 slice 2). The local daemon
+ * holds this computer's key there, so a read/diff/handoff/push/PR for a relayed agent runs ON the machine: POST
+ * {fn, args} to the remote's /_relay/rpc with the key (no Origin), returning the machine's
+ * result. Throws on an unreachable machine or a non-2xx so the caller falls back to its own empty/error
  * shape, the same way a failed local read does.
  */
 export declare function relayRpc(target: RemoteTarget, fn: string, args: unknown[]): Promise<unknown>;
 /**
  * Fetch-stream a remote agent's newline-delimited events into `onEvent` until the remote closes the
- * body, the agent ends, or `cancel()` is called. A 401 (the token was rotated) ends the stream
+ * body, the agent ends, or `cancel()` is called. A 401 (this computer was removed there) ends the stream
  * cleanly rather than as an error, so the dashboard sees a normal `done`, not a lost connection.
  * Returns a cancel function; calling it aborts the fetch and releases the reader.
  */
@@ -54,11 +94,12 @@ export declare function streamRemoteEvents(target: RemoteTarget, agentId: string
 /**
  * The local daemon's live relayed runs (#1067), keyed by the remote agent id. Registering an agent opens
  * an {@link EventStream} the dashboard reads through `onEvents`, fed by {@link streamRemoteEvents}
- * from the remote. This map is where a saved device's token lives daemon-side: in memory, for the
- * run's lifetime.
+ * from the remote. The target is the saved machine as it was at the Start. A machine is not
+ * removed while a run is at work on it ({@link working}); the runs that ended there before it
+ * was removed read as unreachable, and one added again answers for them with its new key ({@link rekey}).
  *
  * The `targets` map outlives the event pump (#1067 slice 2): a finished remote agent's post-run reads,
- * open-PR and merge still have to reach the device after its event stream has ended, so the device
+ * open-PR and merge still have to reach the machine after its event stream has ended, so the machine
  * target is kept until {@link dispose} clears it, not dropped when the stream closes.
  *
  * The `metas` map (#1077) holds a local {@link AgentMeta} stub per relayed agent so `onAgents` can show a
@@ -73,22 +114,26 @@ export declare class RelayedAgents {
     register(agentId: string, target: RemoteTarget, meta: AgentMeta, projectId: string): void;
     /** The live event stream for a relayed agent, or undefined when this daemon is not relaying it. */
     get(agentId: string | undefined): EventStream<OpenAgentEvent> | undefined;
-    /** The device a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
+    /** The machine a relayed agent runs on, kept past the event stream so post-run push/PR still reach it. */
     target(agentId: string | undefined): RemoteTarget | undefined;
+    /** Whether a run this daemon follows is still at work on the machine at `url`: its events still stream. */
+    working(url: string): boolean;
+    /** How the machine at `url` is reached since it was added again, for the runs kept from before: this computer's new key there, and the key the machine is known by. */
+    rekey(url: string, key: string, pin?: string): void;
     /** A project's relayed run stubs (#1077), newest-first, so `onAgents` can surface them in the list. */
     list(projectId: string): AgentMeta[];
     /** Fold each relayed event into the agent's list row via the store's own reducer (#1077), so the
-     *  local stub mirrors the device: the terminal status on `end`, the waiting flag while it is parked
+     *  local stub mirrors the machine: the terminal status on `end`, the waiting flag while it is parked
      *  (#785), the driver once its session starts. Events carry no write time, so this stamps its own. */
     private apply;
     /** Close a relayed agent's event stream (not its target). Idempotent. */
     private endStream;
-    /** Stop every pump, close every stream, and forget every device target + list stub, on daemon shutdown. */
+    /** Stop every pump, close every stream, and forget every machine target + list stub, on daemon shutdown. */
     dispose(): void;
 }
 /**
- * Fold one relayed event into the memory-only row of a run on a device: what the device's own
- * card would say, kept here because that card is on the device. The events are the ones a run's
+ * Fold one relayed event into the memory-only row of a run on a machine: what the machine's own
+ * card would say, kept here because that card is on the machine. The events are the ones a run's
  * diary yields: the agent's session id, its cost, its end.
  */
 export declare function foldRelayedEvent(meta: AgentMeta, event: OpenAgentEvent, at: string): AgentMeta;

package/dist/dashboard/remote-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-run.d.ts","sourceRoot":"","sources":["../../src/dashboard/remote-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGrE;;;;;;;;;;GAUG;AAEH,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAOD;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAUvE;AAOD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAa5G;AAID;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACxC,KAAK,CAAC,EAAE,MAAM,IAAI,GACjB,MAAM,IAAI,CAwCZ;AAmBD;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAG1D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAElF,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUxF;IAED,mGAAmG;IACnG,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,SAAS,CAExE;IAED,yGAAyG;IACzG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAE5D;IAED,uGAAuG;IACvG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAKnC;IAED;;0GAEsG;IACtG,OAAO,CAAC,KAAK;IAMb,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAUjB,2GAA2G;IAC3G,OAAO,IAAI,IAAI,CAQd;CACF;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAS9F"}
+{"version":3,"file":"remote-run.d.ts","sourceRoot":"","sources":["../../src/dashboard/remote-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAIrE;;;;;;;;;;;;;;;GAeG;AAEH,uJAAuJ;AACvJ,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAA;AAoB/F;;;GAGG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAExE;AAED,6HAA6H;AAC7H,wBAAsB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAKtF;AAgBD,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAElF;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAsB9G;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAO7F;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAc5G;AAID;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACxC,KAAK,CAAC,EAAE,MAAM,IAAI,GACjB,MAAM,IAAI,CAwCZ;AAmBD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAG1D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAElF,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUxF;IAED,mGAAmG;IACnG,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,SAAS,CAExE;IAED,0GAA0G;IAC1G,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAE5D;IAED,2GAA2G;IAC3G,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG5B;IAED,uKAAuK;IACvK,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAIlD;IAED,uGAAuG;IACvG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAKnC;IAED;;0GAEsG;IACtG,OAAO,CAAC,KAAK;IAMb,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAUjB,4GAA4G;IAC5G,OAAO,IAAI,IAAI,CAQd;CACF;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAS9F"}