@openscout/scout 0.2.63 → 0.2.64

package/dist/scout-web-server.mjs

@@ -10827,6 +10827,7 @@ class CodexAppServerSession {
   key;
   threadIdPath;
   statePath;
+  replyContextPath;
   stdoutLogPath;
   stderrLogPath;
   process = null;
@@ -10844,6 +10845,7 @@ class CodexAppServerSession {
     this.key = sessionKey2(options);
     this.threadIdPath = join16(options.runtimeDirectory, "codex-thread-id.txt");
     this.statePath = join16(options.runtimeDirectory, "state.json");
+    this.replyContextPath = join16(options.runtimeDirectory, "scout-reply-context.json");
     this.stdoutLogPath = join16(options.logsDirectory, "stdout.log");
     this.stderrLogPath = join16(options.logsDirectory, "stderr.log");
     this.lastConfigSignature = this.configSignature(options);
@@ -10867,7 +10869,7 @@ class CodexAppServerSession {
       threadId: this.threadId
     };
   }
-  async invoke(prompt, timeoutMs = 5 * 60000) {
+  async invoke(prompt, timeoutMs = 5 * 60000, replyContext) {
     return this.enqueue(async () => {
       await this.ensureStarted();
       if (!this.threadId) {
@@ -10876,6 +10878,7 @@ class CodexAppServerSession {
       const output = await new Promise(async (resolve7, reject) => {
         const turn = this.createActiveTurn(resolve7, reject, timeoutMs);
         try {
+          await this.writeReplyContext(replyContext ?? null);
           const response = await this.request("turn/start", {
             threadId: this.threadId,
             cwd: this.options.cwd,
@@ -10890,6 +10893,7 @@ class CodexAppServerSession {
           turn.turnId = response.turn.id;
           await this.persistState();
         } catch (error) {
+          await this.clearReplyContext();
           this.clearActiveTurn(turn);
           reject(error instanceof Error ? error : new Error(errorMessage3(error)));
         }
@@ -11038,6 +11042,7 @@ class CodexAppServerSession {
       currentDirectory: this.options.cwd,
       baseEnv: process.env
     });
+    env.OPENSCOUT_REPLY_CONTEXT_FILE = this.replyContextPath;
     const child = spawn4(codexExecutable, [
       "app-server",
       ...buildScoutMcpCodexLaunchArgs({
@@ -11280,6 +11285,20 @@ class CodexAppServerSession {
       error: buildUnsupportedServerRequestError2(message)
     });
   }
+  async writeReplyContext(context) {
+    if (!context) {
+      await this.clearReplyContext();
+      return;
+    }
+    await mkdir5(this.options.runtimeDirectory, { recursive: true });
+    await writeFile5(this.replyContextPath, `${JSON.stringify(context, null, 2)}
+`, "utf8");
+  }
+  async clearReplyContext() {
+    await rm4(this.replyContextPath, { force: true }).catch(() => {
+      return;
+    });
+  }
   handleNotification(message) {
     const method = message.method;
     const params = message.params ?? {};
@@ -11334,6 +11353,7 @@ class CodexAppServerSession {
       return;
     }
     if (method === "turn/completed") {
+      this.clearReplyContext();
       this.completeTurn(params);
       return;
     }
@@ -11503,7 +11523,7 @@ async function ensureCodexAppServerAgentOnline(options) {
 async function invokeCodexAppServerAgent(options) {
   const session = getOrCreateSession2(options);
   session.update(options);
-  return session.invoke(options.prompt, options.timeoutMs);
+  return session.invoke(options.prompt, options.timeoutMs, options.replyContext);
 }
 async function sendCodexAppServerAgent(options) {
   const session = getOrCreateSession2(options);
@@ -11511,7 +11531,7 @@ async function sendCodexAppServerAgent(options) {
   if (session.hasActiveTurn()) {
     return session.steerAndWait(options.prompt, options.timeoutMs);
   }
-  return session.invoke(options.prompt, options.timeoutMs);
+  return session.invoke(options.prompt, options.timeoutMs, options.replyContext);
 }
 function isCodexAppServerAgentAlive(options) {
   const session = sessions2.get(sessionKey2(options));
@@ -11697,6 +11717,7 @@ __export(exports_local_agents, {
   ensureLocalSessionEndpointOnline: () => ensureLocalSessionEndpointOnline,
   ensureLocalAgentBindingOnline: () => ensureLocalAgentBindingOnline,
   buildTmuxLaunchShellCommand: () => buildTmuxLaunchShellCommand,
+  buildScoutReplyContext: () => buildScoutReplyContext,
   buildLocalAgentSystemPromptTemplate: () => buildLocalAgentSystemPromptTemplate,
   buildLocalAgentSystemPrompt: () => buildLocalAgentSystemPrompt,
   buildLocalAgentNudge: () => buildLocalAgentNudge,
@@ -12589,7 +12610,7 @@ function endpointInvocationPrompt(endpoint, agentName, invocation) {
   const externalSource = endpointMetadataString(endpoint, "externalSource");
   const attachedTransport = endpointMetadataString(endpoint, "attachedTransport");
   const sessionBacked = endpoint.metadata?.sessionBacked === true;
-  if (invocation.action === "consult" && (sessionBacked || source === "local-session" || externalSource === "local-session" || attachedTransport === "codex_app_server" || attachedTransport === "claude_stream_json")) {
+  if (invocation.action === "consult" && !invocation.conversationId && !invocation.messageId && (sessionBacked || source === "local-session" || externalSource === "local-session" || attachedTransport === "codex_app_server" || attachedTransport === "claude_stream_json")) {
     return invocation.task;
   }
   if (sessionBacked) {
@@ -12727,6 +12748,46 @@ function buildInvocationHeadline(agentName, invocation) {
     summarizeInvocationTask(invocation.task)
   ].join(" ");
 }
+function buildScoutReplyContext(agentName, invocation) {
+  if (!invocation.conversationId || !invocation.messageId) {
+    return null;
+  }
+  return {
+    mode: "broker_reply",
+    fromAgentId: invocation.requesterId,
+    toAgentId: agentName,
+    conversationId: invocation.conversationId,
+    messageId: invocation.messageId,
+    replyToMessageId: invocation.messageId,
+    replyPath: "final_response",
+    action: invocation.action
+  };
+}
+function buildScoutReplyContextPrompt(context) {
+  const header = [
+    "SCOUT BROKER REPLY MODE",
+    "",
+    "You are answering a Scout ask. Your final assistant message will be delivered back through the Scout broker.",
+    "Do not call scout send, messages_send, or invocations_ask to answer this request.",
+    "Only use Scout tools if you need to ask or delegate to another agent."
+  ];
+  if (!context) {
+    return header;
+  }
+  return [
+    ...header,
+    "",
+    "ScoutReplyContext:",
+    `- mode: ${context.mode}`,
+    `- fromAgentId: ${context.fromAgentId}`,
+    `- toAgentId: ${context.toAgentId}`,
+    `- conversationId: ${context.conversationId}`,
+    `- messageId: ${context.messageId}`,
+    `- replyToMessageId: ${context.replyToMessageId}`,
+    `- replyPath: ${context.replyPath}`,
+    ...context.action ? [`- action: ${context.action}`] : []
+  ];
+}
 function buildInvocationMetadataLines(agentName, invocation) {
   const referenceParts = [
     invocation.conversationId ? `convo=${invocation.conversationId}` : undefined,
@@ -12742,13 +12803,16 @@ function buildLocalAgentDirectInvocationPrompt(agentName, invocation) {
   const collaborationContract = buildCollaborationContractPrompt(agentName);
   const collaborationContext = buildInvocationCollaborationContextPrompt(invocation);
   const actionRules = invocation.action === "execute" ? "You may inspect and modify the workspace when needed. End with the concise broker-visible reply for the requester." : "Do not modify files unless the request explicitly requires it. End with the concise broker-visible reply for the requester.";
+  const replyContext = buildScoutReplyContext(agentName, invocation);
   return [
+    ...buildScoutReplyContextPrompt(replyContext),
+    "",
     buildInvocationHeadline(agentName, invocation),
     ...buildInvocationMetadataLines(agentName, invocation),
     "",
     actionRules,
     collaborationContract,
-    "Return only the reply that should be delivered back through the broker.",
+    "Return only the broker-visible reply for the requester.",
     "",
     collaborationContext,
     contextLines.length > 0 ? `Context:
@@ -12761,10 +12825,13 @@ ${contextLines.join(`
 }
 function buildAttachedSessionInvocationPrompt(invocation, agentName = invocation.targetAgentId) {
   const contextLines = Object.entries(invocation.context ?? {}).map(([key, value]) => `- ${key}: ${String(value)}`);
+  const replyContext = buildScoutReplyContext(agentName, invocation);
   return [
+    ...buildScoutReplyContextPrompt(replyContext),
+    "",
     buildInvocationHeadline(agentName, invocation),
     ...buildInvocationMetadataLines(agentName, invocation),
-    "Treat this as a direct message to the current session and reply normally as yourself in this session.",
+    "Treat this as a direct message to the current session, but return only the broker-visible reply for Scout delivery.",
     contextLines.length > 0 ? `Context:
 ${contextLines.join(`
 `)}` : undefined,
@@ -13601,6 +13668,7 @@ async function invokeLocalAgentEndpoint(endpoint, invocation) {
   const agentRuntimeId = endpoint.agentId;
   const definitionId = String(endpoint.metadata?.definitionId ?? endpoint.metadata?.agentName ?? endpoint.agentId);
   const prompt = endpointInvocationPrompt(endpoint, definitionId, invocation);
+  const replyContext = buildScoutReplyContext(agentRuntimeId, invocation);
   const registry = await readLocalAgentRegistry();
   const existing = registry[agentRuntimeId];
   if (!existing && endpoint.transport === "codex_app_server") {
@@ -13609,7 +13677,8 @@ async function invokeLocalAgentEndpoint(endpoint, invocation) {
     const result = await invoke({
       ...buildCodexEndpointSessionOptions(endpoint),
       prompt,
-      timeoutMs: invocation.timeoutMs
+      timeoutMs: invocation.timeoutMs,
+      replyContext
     });
     return {
       output: result.output
@@ -13658,7 +13727,8 @@ async function invokeLocalAgentEndpoint(endpoint, invocation) {
     const result = await invokeCodexAppServerAgent({
       ...buildCodexAgentSessionOptions(agentRuntimeId, onlineRecord, renderLocalAgentSystemPromptTemplate(onlineRecord.systemPrompt || buildLocalAgentSystemPromptTemplate(), buildLocalAgentTemplateContext(definitionId, onlineRecord.project, onlineRecord.cwd), { transport: "codex_app_server" })),
       prompt,
-      timeoutMs: invocation.timeoutMs
+      timeoutMs: invocation.timeoutMs,
+      replyContext
     });
     return {
       output: result.output
@@ -13730,7 +13800,7 @@ import {
   renameSync,
   writeFileSync
 } from "fs";
-import { homedir } from "os";
+import { homedir, hostname as osHostname } from "os";
 import { dirname, join } from "path";
 var LOCAL_CONFIG_VERSION = 1;
 var DEFAULT_LOCAL_CONFIG = {
@@ -13742,6 +13812,14 @@ var DEFAULT_LOCAL_CONFIG = {
     pairing: 7888
   }
 };
+function normalizeLocalHostnameLabel(value) {
+  const firstLabel = value?.trim().replace(/\.local\.?$/i, "").split(".").find((part) => part.trim().length > 0)?.trim();
+  const normalized = firstLabel?.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-");
+  return normalized || "localhost";
+}
+function resolveScoutWebMdnsHostname(hostname = osHostname()) {
+  return `scout.${normalizeLocalHostnameLabel(hostname)}.local`;
+}
 function localConfigHome() {
   return process.env.OPENSCOUT_HOME ?? join(homedir(), ".openscout");
 }
@@ -16314,16 +16392,32 @@ function isTrustedLoopbackHostname(hostname2) {
   const normalized = normalizeHostname(hostname2);
   return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || LOOPBACK_IPV4_HOST_PATTERN.test(normalized);
 }
-function isTrustedApiRequest(c) {
+function normalizeOrigin(origin) {
+  try {
+    return new URL(origin).origin.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function trustedHostSet(options) {
+  return new Set((options.trustedHosts ?? []).map(normalizeHostname).filter(Boolean));
+}
+function trustedOriginSet(options) {
+  return new Set((options.trustedOrigins ?? []).map(normalizeOrigin).filter((origin) => Boolean(origin)));
+}
+function isTrustedApiHostname(hostname2, options) {
+  return isTrustedLoopbackHostname(hostname2) || trustedHostSet(options).has(normalizeHostname(hostname2));
+}
+function isTrustedApiRequest(c, options) {
   const requestUrl = new URL(c.req.url);
-  if (!isTrustedLoopbackHostname(requestUrl.hostname)) {
+  if (!isTrustedApiHostname(requestUrl.hostname, options)) {
     return false;
   }
   const origin = c.req.header("origin");
   if (origin) {
     try {
       const originUrl = new URL(origin);
-      if (!isTrustedLoopbackHostname(originUrl.hostname) || originUrl.origin !== requestUrl.origin) {
+      if (!isTrustedApiHostname(originUrl.hostname, options) || originUrl.origin !== requestUrl.origin && !trustedOriginSet(options).has(originUrl.origin.toLowerCase())) {
         return false;
       }
     } catch {
@@ -16376,9 +16470,9 @@ function createCachedSnapshot(load, ttlMs) {
     peek: () => cached?.value ?? null
   };
 }
-function installScoutApiMiddleware(app, label = "api") {
+function installScoutApiMiddleware(app, label = "api", options = {}) {
   app.use("/api/*", async (c, next) => {
-    if (!isTrustedApiRequest(c)) {
+    if (!isTrustedApiRequest(c, options)) {
       return c.json({ error: "forbidden" }, 403);
     }
     c.header("Cross-Origin-Resource-Policy", "same-origin");
@@ -21035,7 +21129,10 @@ async function createOpenScoutWebServer(options) {
   ensureOpenScoutVoxOrigins();
   const app = new Hono2;
   const shellStateCache = createCachedSnapshot(loadOpenScoutWebShellState, shellTtl);
-  installScoutApiMiddleware(app, "openscout-web api");
+  installScoutApiMiddleware(app, "openscout-web api", {
+    trustedHosts: options.trustedHosts,
+    trustedOrigins: options.trustedOrigins
+  });
   app.get(routes.bootstrapScriptPath, (c) => new Response(serializeOpenScoutWebBootstrap(process.env), {
     headers: {
       "cache-control": "no-store",
@@ -21045,7 +21142,9 @@ async function createOpenScoutWebServer(options) {
   app.get(routes.healthPath, (c) => c.json({
     ok: true,
     surface: "openscout-web",
-    currentDirectory
+    currentDirectory,
+    advertisedHost: options.advertisedHost,
+    publicOrigin: options.publicOrigin
   }));
   app.get(routes.terminalRelayHealthPath, async (c) => {
     const ok = await (options.terminalRelayHealthcheck?.() ?? Promise.resolve(false));
@@ -21482,6 +21581,53 @@ async function createOpenScoutWebServer(options) {
   return { app, warmupCaches };
 }
 
+// packages/web/server/app-server-origin.ts
+import { hostname as osHostname2 } from "os";
+function splitList(value) {
+  return (value ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function hostFromOrigin(value) {
+  if (!value?.trim()) {
+    return null;
+  }
+  try {
+    return new URL(value).hostname;
+  } catch {
+    return null;
+  }
+}
+function uniq(values) {
+  const seen = new Set;
+  const out = [];
+  for (const value of values) {
+    const normalized = value?.trim().toLowerCase();
+    if (!normalized || seen.has(normalized)) {
+      continue;
+    }
+    seen.add(normalized);
+    out.push(normalized);
+  }
+  return out;
+}
+function resolveOpenScoutWebApplicationServerIdentity(env = process.env, machineHostname = osHostname2()) {
+  const advertisedHost = env.OPENSCOUT_WEB_ADVERTISED_HOST?.trim() || resolveScoutWebMdnsHostname(machineHostname);
+  const publicOrigin = env.OPENSCOUT_WEB_PUBLIC_ORIGIN?.trim() || undefined;
+  const publicOriginHost = hostFromOrigin(publicOrigin);
+  return {
+    advertisedHost,
+    publicOrigin,
+    trustedHosts: uniq([
+      advertisedHost,
+      publicOriginHost,
+      ...splitList(env.OPENSCOUT_WEB_TRUSTED_HOSTS)
+    ]),
+    trustedOrigins: uniq([
+      publicOrigin,
+      ...splitList(env.OPENSCOUT_WEB_TRUSTED_ORIGINS)
+    ])
+  };
+}
+
 // packages/web/server/relay.ts
 import { mkdir as mkdir7 } from "fs/promises";
 import { join as join22 } from "path";
@@ -21765,6 +21911,7 @@ function resolveStaticRoot2() {
 var staticRoot = resolveStaticRoot2();
 var viteDevUrl = process.env.OPENSCOUT_WEB_VITE_URL?.trim() || undefined;
 var useViteProxy = Boolean(viteDevUrl) || !staticRoot;
+var applicationServerIdentity = resolveOpenScoutWebApplicationServerIdentity(process.env);
 var idleTimeoutSeconds = Number.parseInt(process.env.OPENSCOUT_WEB_IDLE_TIMEOUT_SECONDS?.trim() || (useViteProxy ? "180" : "30"), 10);
 function toWebSocketUrl(httpUrl, pathname, search = "") {
   const target = new URL(pathname, httpUrl);
@@ -21788,6 +21935,10 @@ var { app, warmupCaches } = await createOpenScoutWebServer({
   assetMode: useViteProxy ? "vite-proxy" : "static",
   viteDevUrl,
   staticRoot,
+  advertisedHost: applicationServerIdentity.advertisedHost,
+  publicOrigin: applicationServerIdentity.publicOrigin,
+  trustedHosts: applicationServerIdentity.trustedHosts,
+  trustedOrigins: applicationServerIdentity.trustedOrigins,
   runTerminalCommand: terminalRelay?.queueCommand,
   terminalRelayHealthcheck: terminalRelay?.healthcheck
 });
@@ -21850,5 +22001,6 @@ var shutdown = () => {
 process.on("SIGINT", shutdown);
 process.on("SIGTERM", shutdown);
 console.log(`OpenScout Web -> http://${hostname2}:${server.port}`);
+console.log(`OpenScout LAN -> ${applicationServerIdentity.publicOrigin ?? `http://${applicationServerIdentity.advertisedHost}:${server.port}`}`);
 console.log(`Relay WebSocket -> ws://${hostname2}:${server.port}${routes.terminalRelayPath}`);
 warmupCaches();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openscout/scout",
-  "version": "0.2.63",
+  "version": "0.2.64",
   "description": "Published Scout package that installs the `scout` command",
   "license": "UNLICENSED",
   "type": "module",
@@ -23,6 +23,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@openscout/runtime": "0.2.63"
+    "@openscout/runtime": "0.2.64"
   }
 }