@songsid/agend 2.1.9 → 2.1.10-beta.2

package/dist/tunnel/public-fetch.js

@@ -0,0 +1,156 @@
+/**
+ * The readiness probe's way of seeing a tunnel the way a phone does.
+ *
+ * A brand-new `*.trycloudflare.com` name resolves instantly through a public
+ * resolver and, on a corporate or WSL network, can take a minute or more
+ * through the machine's own forwarder (measured: 1.1.1.1 in ~13 ms, the system
+ * resolver 60 s+). Probing through the system resolver therefore reports a
+ * tunnel that works as "never became reachable". So the probe asks a public
+ * resolver, then connects to the address it was given with the real hostname
+ * as SNI and `Host` — certificate verification still runs against the
+ * hostname, so a wrong or forged answer yields a TLS failure, never a page.
+ *
+ * Only the probe does this. The browser that actually uses the tunnel resolves
+ * however it resolves. The one thing that leaves the machine is a DNS query
+ * for the tunnel's random hostname, sent to Cloudflare, who is already
+ * carrying the tunnel.
+ *
+ * The system resolver stays as the fallback: a network that blocks outbound
+ * DNS to 1.1.1.1 must not make a working tunnel look dead.
+ */
+import { isIPv4 } from "node:net";
+import { request as httpsRequest } from "node:https";
+import { Resolver } from "node:dns/promises";
+export const PUBLIC_RESOLVERS = ["1.1.1.1", "1.0.0.1"];
+/** One DNS attempt is short: the caller retries, and the whole probe has a deadline. */
+const RESOLVE_TIMEOUT_MS = 3_000;
+/** The probe wants a page, not a download. Exactly this many bytes are accepted; one more is refused. */
+export const MAX_PROBE_BODY = 256 * 1024;
+/** Addresses a public resolver has no business returning for a Cloudflare edge name. */
+export function isPublicIPv4(ip) {
+    if (!isIPv4(ip))
+        return false;
+    const [a, b] = ip.split(".").map(Number);
+    if (a === 0 || a === 10 || a === 127)
+        return false;
+    if (a === 100 && b >= 64 && b <= 127)
+        return false; // CGNAT
+    if (a === 169 && b === 254)
+        return false; // link-local
+    if (a === 172 && b >= 16 && b <= 31)
+        return false;
+    if (a === 192 && b === 168)
+        return false;
+    if (a >= 224)
+        return false; // multicast / reserved
+    return true;
+}
+function defaultResolve4(resolvers) {
+    const resolver = new Resolver({ timeout: RESOLVE_TIMEOUT_MS, tries: 1 });
+    resolver.setServers([...resolvers]);
+    return host => resolver.resolve4(host);
+}
+export async function fetchViaPublicResolver(url, signal, deps) {
+    const resolvers = deps.resolvers ?? PUBLIC_RESOLVERS;
+    let target;
+    try {
+        target = new URL(url);
+    }
+    catch {
+        return deps.fallback(url, signal);
+    }
+    if (resolvers.length === 0 || target.protocol !== "https:")
+        return deps.fallback(url, signal);
+    let address;
+    try {
+        const resolve4 = deps.resolve4 ?? defaultResolve4(resolvers);
+        address = (await resolve4(target.hostname)).find(isPublicIPv4);
+    }
+    catch {
+        address = undefined;
+    }
+    // No usable answer from the public resolver: say nothing about the tunnel,
+    // just let the ordinary path try.
+    if (!address)
+        return deps.fallback(url, signal);
+    return requestAt(address, target, signal, deps.request ?? httpsRequest);
+}
+function requestAt(address, target, signal, request) {
+    return new Promise((resolve, reject) => {
+        const options = {
+            host: address,
+            port: 443,
+            method: "GET",
+            path: `${target.pathname}${target.search}`,
+            // Both, and the hostname for both purposes: SNI picks the certificate,
+            // `servername` is also what the certificate is verified against, and
+            // `Host` is what the edge routes on. Never `rejectUnauthorized: false`.
+            servername: target.hostname,
+            headers: { host: target.hostname, "cache-control": "no-store" },
+            signal,
+        };
+        const req = request(options, res => {
+            const status = res.statusCode ?? 0;
+            const contentType = String(res.headers["content-type"] ?? "");
+            res.on("error", reject);
+            // Only a 200 can be the page. Any other body is discarded as it arrives, not collected.
+            if (status !== 200) {
+                res.on("end", () => resolve({ status, contentType, body: "" }));
+                res.resume();
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            res.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_PROBE_BODY) {
+                    req.destroy(new Error("probe response too large"));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.on("end", () => resolve({ status, contentType, body: Buffer.concat(chunks).toString("utf8") }));
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+/**
+ * The ordinary path — the system resolver, a plain `fetch` — with the same limits as the public one.
+ *
+ * `res.text()` has no ceiling, and this is the path taken exactly when public DNS is unavailable, so the
+ * cap has to live here too. A redirect is not this page, and following one would let the edge decide
+ * what we call ready.
+ */
+export async function fetchViaSystemResolver(url, signal, fetchImpl = fetch) {
+    const res = await fetchImpl(url, { signal, redirect: "manual", cache: "no-store" });
+    const contentType = res.headers.get("content-type") ?? "";
+    if (res.status !== 200) {
+        await res.body?.cancel().catch(() => { });
+        return { status: res.status, contentType, body: "" };
+    }
+    return { status: 200, contentType, body: await readBoundedText(res.body) };
+}
+async function readBoundedText(body) {
+    if (!body)
+        return "";
+    const reader = body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_PROBE_BODY)
+                throw new Error("probe response too large");
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+//# sourceMappingURL=public-fetch.js.map

package/dist/tunnel/public-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-fetch.js","sourceRoot":"","sources":["../../src/tunnel/public-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAE1E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,yGAAyG;AACzG,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAezC,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqB,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,CAAK,QAAQ;IAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,CAAe,aAAa;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,CAA6B,uBAAuB;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,SAA4B;IACnD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,MAAmB,EACnB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACrD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9F,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,2EAA2E;IAC3E,kCAAkC;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,MAAW,EAAE,MAAmB,EAAE,OAA4B;IAChG,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,OAAO,GAAmB;YAC9B,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,UAAU,EAAE,MAAM,CAAC,QAAQ;YAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;YAC/D,MAAM;SACP,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACjC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,wFAAwF;YACxF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBAChE,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;oBAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACtG,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,MAAmB,EACnB,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAuC;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA0B,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/dist/tunnel/types.d.ts

@@ -111,8 +111,14 @@ export declare class TunnelStartError extends Error {
         readonly identity: string | null;
     } | undefined);
 }
-/** One wall-clock budget for spawn, URL and readiness together — not per step. */
-export declare const TUNNEL_STARTUP_DEADLINE_MS = 30000;
+/**
+ * One wall-clock budget for spawn, URL and readiness together — not per step.
+ *
+ * A minute: with QUIC blocked and a slow resolver in between, a tunnel that does
+ * work can take well over thirty seconds to become reachable, and giving up on it
+ * is a worse outcome than waiting for it.
+ */
+export declare const TUNNEL_STARTUP_DEADLINE_MS = 60000;
 /** Preflight is a stat, not a network call. */
 export declare const TUNNEL_PREFLIGHT_TIMEOUT_MS = 5000;
 /** How long a polite stop is given before escalating, and again before giving up. */

package/dist/tunnel/types.js

@@ -24,8 +24,14 @@ export class TunnelStartError extends Error {
         this.name = "TunnelStartError";
     }
 }
-/** One wall-clock budget for spawn, URL and readiness together — not per step. */
-export const TUNNEL_STARTUP_DEADLINE_MS = 30_000;
+/**
+ * One wall-clock budget for spawn, URL and readiness together — not per step.
+ *
+ * A minute: with QUIC blocked and a slow resolver in between, a tunnel that does
+ * work can take well over thirty seconds to become reachable, and giving up on it
+ * is a worse outcome than waiting for it.
+ */
+export const TUNNEL_STARTUP_DEADLINE_MS = 60_000;
 /** Preflight is a stat, not a network call. */
 export const TUNNEL_PREFLIGHT_TIMEOUT_MS = 5_000;
 /** How long a polite stop is given before escalating, and again before giving up. */

package/dist/tunnel/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tunnel/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoGH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IAGA;IAJX,YACW,SAA0B,EACnC,OAAe;IACf,6EAA6E;IACpE,WAA+E;QAExF,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,cAAS,GAAT,SAAS,CAAiB;QAG1B,gBAAW,GAAX,WAAW,CAAoE;QAGxF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tunnel/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoGH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IAGA;IAJX,YACW,SAA0B,EACnC,OAAe;IACf,6EAA6E;IACpE,WAA+E;QAExF,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,cAAS,GAAT,SAAS,CAAiB;QAG1B,gBAAW,GAAX,WAAW,CAAoE;QAGxF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC"}

package/dist/types.d.ts

@@ -318,12 +318,34 @@ export interface WebConfig {
     usage_panel?: boolean;
     /** Expose provider API-key verify/apply endpoints (default false until dark-shipped). */
     provider_secrets?: boolean;
+    /**
+     * Extra `Host` names the dashboard answers to, for a reverse proxy or port
+     * forward that presents a name other than localhost / 127.0.0.1 / [::1] / `hostname`.
+     * Names only (a port is ignored); anything not listed is refused with 403.
+     */
+    allowed_hosts?: string[];
 }
 /** `login:` section — remote /login behaviour. */
 export interface LoginConfig {
     /** web (default): token-gated browser terminal. relay: the pre-2.1.5 chat relay, kept for rollback in 2.1.5 only. */
     mode?: "web" | "relay";
 }
+/**
+ * `web_terminal.tunnel:` — the escape hatch for finishing a /login from somewhere that cannot
+ * reach this machine (a phone away from the desk). Off unless `allow_public` is true, and even
+ * then each login asks first and only flows marked `tunnelOk` may use it.
+ */
+export interface WebTerminalTunnelConfig {
+    /** The only provider today: a Cloudflare Quick Tunnel. */
+    provider?: "cloudflared";
+    /**
+     * Whether /login may offer to open a temporary public HTTPS link to its terminal.
+     * Default false — nothing is ever exposed beyond this machine unless you set it.
+     */
+    allow_public?: boolean;
+    /** How cloudflared reaches Cloudflare. Default http2 (QUIC is blocked on many networks); auto lets cloudflared choose. */
+    protocol?: "http2" | "quic" | "auto";
+}
 /** `web_terminal:` section — the browser terminal behind /login and /install-cli. */
 export interface WebTerminalConfig {
     /** Default true. false makes /login refuse in web mode. */
@@ -332,6 +354,8 @@ export interface WebTerminalConfig {
     bind?: string;
     /** Session time limit. 1..20 (engine hard cap 20), default 10. */
     ttl_minutes?: number;
+    /** Optional public link for /login (see WebTerminalTunnelConfig). Absent = never. */
+    tunnel?: WebTerminalTunnelConfig;
 }
 export interface FleetConfig {
     channel?: ChannelConfig;

package/dist/ui/settings.html

@@ -306,7 +306,7 @@
       restartFleetWaiting: "AgEnD is restarting. This page keeps checking and will say when it is back — there is nothing to press.",
       working: "Working…", restartFleetRefused: "Restart refused: {0}",
       restartFleetRateLimited: "Restart refused: {0} (try again in about {1} minutes)",
-      signatureMismatch: "fleet.yaml and the running configuration disagree on: {0}. Restarting will not clear this — check fleet.log first.",
+      signatureMismatch: "fleet.yaml and the running configuration disagree on: {0}. Restarting will not clear this — check daemon.log first.",
       applyStillWorking: "Still restarting ({0}s) — AgEnD is still working; this page keeps checking.",
       applyLostJob: "Lost track of this apply (the fleet may have restarted). Reload the page to see the current state.",
       changesPending: "{0} change(s) not applied", impactNow: "⚡ Immediately", impactAgent: "🔄 Restart this Agent", impactFleet: "🔄🔄 Restart AgEnD", queued: "Queued: {0}", applyFailed: "Apply failed", changesApplied: "✓ Changes applied. AgEnD is reconciling affected Agents.", reviewChanges: "Review changes", readyApply: "Ready to apply", copied: "Copied", expectedMapping: "expected a mapping", configLoadFailed: "Failed to load config — open the Settings link again.",
@@ -365,7 +365,7 @@
       restartFleetWaiting: "AgEnD 正在重新啟動。此頁面會持續確認，恢復後會告訴你 —— 不需要再按任何按鈕。",
       working: "執行中…", restartFleetRefused: "重新啟動被拒絕：{0}",
       restartFleetRateLimited: "重新啟動被拒絕：{0}（約 {1} 分鐘後可再試）",
-      signatureMismatch: "fleet.yaml 與執行中的設定在這些項目上不一致：{0}。重新啟動無法解決，請先查看 fleet.log。",
+      signatureMismatch: "fleet.yaml 與執行中的設定在這些項目上不一致：{0}。重新啟動無法解決，請先查看 daemon.log。",
       applyStillWorking: "仍在重啟中（{0} 秒）—— AgEnD 還在處理，此頁面會持續確認。",
       applyLostJob: "已追蹤不到這次套用（AgEnD 可能重啟過）。請重新整理頁面查看目前狀態。",
       changesPending: "有 {0} 項變更尚未套用", impactNow: "⚡ 立即生效", impactAgent: "🔄 重新啟動此 Agent", impactFleet: "🔄🔄 重新啟動 AgEnD", queued: "已加入待套用：{0}", applyFailed: "套用失敗", changesApplied: "✓ 變更已套用，AgEnD 正在協調受影響的 Agent。", reviewChanges: "檢查變更", readyApply: "可套用變更", copied: "已複製", expectedMapping: "預期為 mapping", configLoadFailed: "載入設定失敗 — 請重新開啟 Settings 連結。",

package/dist/ui/view.html

@@ -18,6 +18,20 @@
   #sidebar { width: 240px; flex: 0 0 240px; background: var(--panel); border-right: 1px solid var(--border); display: flex; flex-direction: column; overflow: hidden; }
   /* The list scrolls; the filter stays pinned to the bottom of the sidebar. */
   #list { flex: 1 1 auto; min-height: 0; overflow-y: auto; }
+  /* The UA's default scrollbar is a light grey bar with arrows on this dark panel.
+     Tinted from the sidebar's own --dim; scoped to #list so the terminal's own
+     scrollbar (#term) is left alone. WebKit/Blink get the pseudo-elements (thin,
+     rounded, no arrows, a hover state); Chromium 121+ would ignore them if
+     scrollbar-color were also set, so the standard properties are Firefox-only. */
+  #list::-webkit-scrollbar { width: 10px; }
+  #list::-webkit-scrollbar-track { background: transparent; }
+  #list::-webkit-scrollbar-button { display: none; }
+  #list::-webkit-scrollbar-thumb { background: color-mix(in srgb, var(--dim) 35%, transparent); background-clip: padding-box; border: 2px solid transparent; border-radius: 5px; }
+  #list::-webkit-scrollbar-thumb:hover { background: color-mix(in srgb, var(--dim) 70%, transparent); background-clip: padding-box; }
+  @supports (-moz-appearance: none) {
+    #list { scrollbar-width: thin; scrollbar-color: color-mix(in srgb, var(--dim) 35%, transparent) transparent; }
+    #list:hover { scrollbar-color: color-mix(in srgb, var(--dim) 70%, transparent) transparent; }
+  }
   #filterBar { flex: 0 0 auto; border-top: 1px solid var(--border); padding: 8px 10px 9px; background: var(--panel); }
   .filter-wrap { position: relative; display: flex; align-items: center; }
   .filter-wrap .filter-icon { position: absolute; left: 8px; width: 13px; height: 13px; color: var(--dim); pointer-events: none; }

package/dist/ui/web-terminal/terminal.html

@@ -4,6 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
 <meta name="referrer" content="no-referrer">
+<meta name="agend-terminal" content="__AGEND_TERMINAL_MARKER__">
 <title>AgEnD terminal</title>
 <link rel="stylesheet" href="assets/xterm.css">
 <link rel="stylesheet" href="assets/terminal.css">

package/dist/wake-coordinator.d.ts

@@ -1,18 +1,3 @@
-/**
- * Phase 2b (docs/design/phase2-submit-contract.md §1.2–§1.6, §3.1): the one
- * owner that wakes a paused target because durable work is waiting for it.
- *
- * Before this, the only code that woke a target for a queued cross-instance
- * message ran *after* the outbox pump had claimed the row, and the pump never
- * claims a target without a live daemon — so a marker-only paused instance
- * (paused across a fleet restart) was never woken: Bug1, the attempt_0
- * deadlock. The coordinator wakes first; the pump stays the only claimer and
- * only claims targets that are awake. Nothing here writes a pane or claims a
- * row.
- *
- * Active only for targets whose `delivery_worker` is `wake_only` or `on`;
- * `off` (the default) leaves every path as it was.
- */
 import type { DeliveryWorkerMode } from "./types.js";
 import type { OutboxDelivery } from "./delivery-outbox.js";
 import type { PauseReason } from "./pause-marker.js";

package/dist/wake-coordinator.js

@@ -1,3 +1,19 @@
+/**
+ * Phase 2b (docs/design/phase2-submit-contract.md §1.2–§1.6, §3.1): the one
+ * owner that wakes a paused target because durable work is waiting for it.
+ *
+ * Before this, the only code that woke a target for a queued cross-instance
+ * message ran *after* the outbox pump had claimed the row, and the pump never
+ * claims a target without a live daemon — so a marker-only paused instance
+ * (paused across a fleet restart) was never woken: Bug1, the attempt_0
+ * deadlock. The coordinator wakes first; the pump stays the only claimer and
+ * only claims targets that are awake. Nothing here writes a pane or claims a
+ * row.
+ *
+ * Active only for targets whose `delivery_worker` is `wake_only` or `on`;
+ * `off` (the default) leaves every path as it was.
+ */
+import { t } from "./locale.js";
 /** Row kinds that never warrant waking a target. Empty: every current kind asks for action (§1.2). */
 export const PASSIVE_KINDS = new Set();
 export const isWakeEligibleKind = (kind) => !PASSIVE_KINDS.has(kind);
@@ -202,7 +218,7 @@ export class WakeCoordinator {
                 if (this.deps.pauseReason(target) === "auth") {
                     if (!s.authNoticeSent) {
                         s.authNoticeSent = true;
-                        this.deps.notifyTarget(target, `⏸️ ${target} is paused because its login failed; ${waiting.length} queued message(s) are waiting. Fix the login and /wake it.`);
+                        this.deps.notifyTarget(target, t("delivery.wake_auth", target, waiting.length));
                     }
                     continue;
                 }
@@ -254,7 +270,7 @@ export class WakeCoordinator {
             const reason = this.deps.notAcceptingReason(target);
             if (reason) {
                 s.claimBlockNoticeSent = true;
-                this.deps.notifyTarget(target, `⚠️ ${target} has ${waiting.length} queued message(s) waiting ${Math.round(headAge / 60_000)} min: ${reason}.`);
+                this.deps.notifyTarget(target, t("delivery.wake_waiting", target, waiting.length, Math.round(headAge / 60_000), reason));
             }
         }
     }
@@ -302,7 +318,7 @@ export class WakeCoordinator {
             this.deps.logger.warn({ target, failures: s.failures, retryInMs: delay, err: message }, "Wake for queued durable work failed; rows stay queued");
             if (s.failures >= WAKE_FAILURE_NOTICE_AFTER && !s.failureNoticeSent) {
                 s.failureNoticeSent = true;
-                const text = `⚠️ ${target} could not be woken (${s.failures} attempts): ${message}. ${waiting.length} message(s) are still queued and will be retried.`;
+                const text = t("delivery.wake_failed", target, s.failures, waiting.length, message);
                 this.deps.notifyTarget(target, text);
                 for (const source of new Set(waiting.map(r => r.sourceInstance))) {
                     if (source && source !== target && source !== "agend-system")

package/dist/wake-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"wake-coordinator.js","sourceRoot":"","sources":["../src/wake-coordinator.ts"],"names":[],"mappings":"AAmBA,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,EAAU,CAAC;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,uFAAuF;AACvF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AACvC,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AAChD,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAiD3C,MAAM,OAAO,eAAe;IAQG;IAPZ,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzD,0FAA0F;IACzE,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,SAAS,GAAyC,IAAI,CAAC;IACvD,QAAQ,GAA0C,IAAI,CAAC;IACvD,OAAO,GAAG,KAAK,CAAC;IAExB,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;IAAG,CAAC;IAE1D,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,qEAAqE;IACrE,IAAI,CAAC,OAAO,GAAG,CAAC;QACd,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACpD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO;YACxB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,MAAc;QAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG;gBACF,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK;gBACvE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK;aACnG,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,MAAc;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAClH,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,wFAAwF;IACxF,WAAW,CAAC,MAAc;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,MAAc;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED,mFAAmF;IACnF,aAAa,CAAC,MAAc;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC5B,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC,oBAAoB,GAAG,KAAK,CAAC;IACjC,CAAC;IAED,8EAA8E;IACtE,SAAS;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACzD,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3F,OAAO,IAAI,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,MAAc;QACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,MAAc,EAAE,KAAa;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;gBAAE,SAAS;YAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QACD,4CAA4C;QAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,CAAC;QAClG,IAAI,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACvC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;YACnF,oDAAoD;YACpD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,CAAC,CAAC,oBAAoB,GAAG,KAAK,CAAC;gBAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;wBACtB,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC;wBACxB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,MAAM,wCAAwC,OAAO,CAAC,MAAM,6DAA6D,CAAC,CAAC;oBAClK,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAClF,IAAI,CAAC,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACpF,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC;YACzB,aAAa,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC;QACpE,yEAAyE;QACzE,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,MAAc,EAAE,CAAc,EAAE,IAAsB,EAAE,OAAyB,EAAE,GAAW;QACrH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,CAAC;QACtI,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,WAAW,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,kBAAkB,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;YAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,yDAAyD,CAAC;YACjH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;YACpE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC,CAAC,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC;YAC3B,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,qEAAqE,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,GAAG,WAAW,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,MAAM,QAAQ,OAAO,CAAC,MAAM,8BAA8B,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,SAAS,MAAM,GAAG,CAAC,CAAC;YACjJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,gBAAgB;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,OAAyB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAC5G,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/B,IAAI,IAAI,CAAC,gBAAgB,EAAE;gBAAE,OAAO;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;YACnB,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC9B,CAAC,EAAE,CAAC,GAAY,EAAE,EAAE;YAClB,IAAI,IAAI,CAAC,gBAAgB,EAAE;gBAAE,OAAO;YACpC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1F,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,CAAC,QAAQ,IAAI,yBAAyB,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;gBACpE,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,wBAAwB,CAAC,CAAC,QAAQ,eAAe,OAAO,KAAK,OAAO,CAAC,MAAM,mDAAmD,CAAC;gBACxJ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrC,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;oBACjE,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,cAAc;wBAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,4CAA4C,CAAC,CAAC;QACzI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"wake-coordinator.js","sourceRoot":"","sources":["../src/wake-coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAKhC,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,EAAU,CAAC;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,uFAAuF;AACvF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AACvC,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AAChD,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAiD3C,MAAM,OAAO,eAAe;IAQG;IAPZ,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzD,0FAA0F;IACzE,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,SAAS,GAAyC,IAAI,CAAC;IACvD,QAAQ,GAA0C,IAAI,CAAC;IACvD,OAAO,GAAG,KAAK,CAAC;IAExB,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;IAAG,CAAC;IAE1D,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,qEAAqE;IACrE,IAAI,CAAC,OAAO,GAAG,CAAC;QACd,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACpD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO;YACxB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,MAAc;QAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG;gBACF,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK;gBACvE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK;aACnG,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,MAAc;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAClH,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,wFAAwF;IACxF,WAAW,CAAC,MAAc;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,MAAc;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED,mFAAmF;IACnF,aAAa,CAAC,MAAc;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC5B,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC,oBAAoB,GAAG,KAAK,CAAC;IACjC,CAAC;IAED,8EAA8E;IACtE,SAAS;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACzD,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3F,OAAO,IAAI,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,MAAc;QACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,MAAc,EAAE,KAAa;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;gBAAE,SAAS;YAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QACD,4CAA4C;QAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,CAAC;QAClG,IAAI,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACvC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;YACnF,oDAAoD;YACpD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,CAAC,CAAC,oBAAoB,GAAG,KAAK,CAAC;gBAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;wBACtB,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC;wBACxB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,oBAAoB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClF,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAClF,IAAI,CAAC,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACpF,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC;YACzB,aAAa,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC;QACpE,yEAAyE;QACzE,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,MAAc,EAAE,CAAc,EAAE,IAAsB,EAAE,OAAyB,EAAE,GAAW;QACrH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,CAAC;QACtI,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,WAAW,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,kBAAkB,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;YAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,yDAAyD,CAAC;YACjH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;YACpE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC,CAAC,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC;YAC3B,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,qEAAqE,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,GAAG,WAAW,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,uBAAuB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,gBAAgB;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,OAAyB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAC5G,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/B,IAAI,IAAI,CAAC,gBAAgB,EAAE;gBAAE,OAAO;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;YACnB,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC9B,CAAC,EAAE,CAAC,GAAY,EAAE,EAAE;YAClB,IAAI,IAAI,CAAC,gBAAgB,EAAE;gBAAE,OAAO;YACpC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1F,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,CAAC,QAAQ,IAAI,yBAAyB,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;gBACpE,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACpF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrC,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;oBACjE,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,cAAc;wBAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,4CAA4C,CAAC,CAAC;QACzI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/web-host-guard.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Which `Host` values the dashboard/health listener answers to, and the
+ * response headers every one of its answers carries.
+ *
+ * Binding to 127.0.0.1 is not a boundary against a web page. DNS rebinding
+ * points an attacker's own domain at 127.0.0.1 after the browser has loaded
+ * their page, so the page's requests reach this listener with
+ * `Origin == Host == attacker.example` — which is exactly what the same-origin
+ * check accepts — and the routes that need no cookie (`/view`'s pane capture,
+ * the roster, usage) can be read from script. The one thing the attacker cannot
+ * change is the name the browser puts in `Host`, so that name is the check.
+ *
+ * Port is deliberately not compared: a port-forward or a reverse proxy changes
+ * it legitimately, and the attack does not depend on it.
+ */
+import type { ServerResponse } from "node:http";
+export declare const WEB_HOST_REJECTED_MESSAGE = "Host not allowed \u2014 if you reach AgEnD through a reverse proxy or another name, add it to web.allowed_hosts in fleet.yaml";
+/** Names a browser on this machine uses for a loopback listener. */
+export declare const LOOPBACK_HOST_NAMES: readonly string[];
+/**
+ * The host name in a `Host` header (or a configured host), lower-cased and
+ * without port, or null for anything that is not a plain name/IP.
+ *
+ * Strict on purpose: userinfo, paths, whitespace and scheme have no business in
+ * a Host header, and a value that only *contains* an allowed name must not be
+ * mistaken for it.
+ */
+export declare function hostnameOf(value: string): string | null;
+export interface HostGuardConfig {
+    hostname?: string;
+    web?: {
+        allowed_hosts?: unknown;
+    } | null;
+}
+/** Loopback names, the `hostname:` handed out in /dashboard links, and `web.allowed_hosts`. */
+export declare function allowedHostNames(config: HostGuardConfig | null | undefined): Set<string>;
+/** A missing or malformed Host is refused: every real browser sends one. */
+export declare function isHostAllowed(hostHeader: string | string[] | undefined, allowed: ReadonlySet<string>): boolean;
+/**
+ * Headers for every response the listener sends, set before routing so the
+ * rejections carry them too.
+ *
+ * `Cache-Control: no-store` is a default, not a mandate: a route that writes its
+ * own Cache-Control in `writeHead` (the avatar, the SSE stream) wins, because
+ * Node merges `writeHead` headers over `setHeader` ones.
+ */
+export declare function applyWebSecurityHeaders(res: ServerResponse): void;

package/dist/web-host-guard.js

@@ -0,0 +1,75 @@
+export const WEB_HOST_REJECTED_MESSAGE = "Host not allowed — if you reach AgEnD through a reverse proxy or another name, add it to web.allowed_hosts in fleet.yaml";
+/** Names a browser on this machine uses for a loopback listener. */
+export const LOOPBACK_HOST_NAMES = ["localhost", "127.0.0.1", "[::1]"];
+/**
+ * The host name in a `Host` header (or a configured host), lower-cased and
+ * without port, or null for anything that is not a plain name/IP.
+ *
+ * Strict on purpose: userinfo, paths, whitespace and scheme have no business in
+ * a Host header, and a value that only *contains* an allowed name must not be
+ * mistaken for it.
+ */
+export function hostnameOf(value) {
+    const host = value.trim().toLowerCase();
+    if (!host || host.length > 255)
+        return null;
+    if (host.startsWith("[")) {
+        const end = host.indexOf("]");
+        if (end < 0)
+            return null;
+        const rest = host.slice(end + 1);
+        if (rest && !/^:\d{1,5}$/.test(rest))
+            return null;
+        const literal = host.slice(0, end + 1);
+        return /^\[[0-9a-f:.]+\]$/.test(literal) ? literal : null;
+    }
+    const match = /^([a-z0-9._-]+)(?::\d{1,5})?$/.exec(host);
+    if (!match)
+        return null;
+    // `localhost.` is the same name; an absolute FQDN must not be a bypass in
+    // either direction.
+    return match[1].replace(/\.$/, "") || null;
+}
+/** Loopback names, the `hostname:` handed out in /dashboard links, and `web.allowed_hosts`. */
+export function allowedHostNames(config) {
+    const names = new Set(LOOPBACK_HOST_NAMES);
+    const add = (candidate) => {
+        if (typeof candidate !== "string")
+            return;
+        const name = hostnameOf(candidate);
+        if (name)
+            names.add(name);
+    };
+    add(config?.hostname);
+    const extra = config?.web?.allowed_hosts;
+    if (Array.isArray(extra))
+        for (const entry of extra)
+            add(entry);
+    return names;
+}
+/** A missing or malformed Host is refused: every real browser sends one. */
+export function isHostAllowed(hostHeader, allowed) {
+    if (typeof hostHeader !== "string")
+        return false;
+    const name = hostnameOf(hostHeader);
+    return name !== null && allowed.has(name);
+}
+/**
+ * Headers for every response the listener sends, set before routing so the
+ * rejections carry them too.
+ *
+ * `Cache-Control: no-store` is a default, not a mandate: a route that writes its
+ * own Cache-Control in `writeHead` (the avatar, the SSE stream) wins, because
+ * Node merges `writeHead` headers over `setHeader` ones.
+ */
+export function applyWebSecurityHeaders(res) {
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    // These pages have buttons that restart instances and change configuration;
+    // a page that can be framed can be clicked through.
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
+    // Authorization now depends on a cookie, so a shared cache (a tunnel, a
+    // corporate proxy) must not keep or replay any of it.
+    res.setHeader("Cache-Control", "no-store");
+}
+//# sourceMappingURL=web-host-guard.js.map

package/dist/web-host-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-host-guard.js","sourceRoot":"","sources":["../src/web-host-guard.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,yBAAyB,GACpC,0HAA0H,CAAC;AAE7H,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAE1F;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,0EAA0E;IAC1E,oBAAoB;IACpB,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAOD,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,MAA0C;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,SAAkB,EAAQ,EAAE;QACvC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,UAAyC,EAAE,OAA4B;IACnG,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAmB;IACzD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,4EAA4E;IAC5E,oDAAoD;IACpD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;IACnE,wEAAwE;IACxE,sDAAsD;IACtD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC"}

package/dist/web-terminal-http.d.ts

@@ -7,6 +7,13 @@ export interface WebTerminalHttpOptions {
     /** Host name used in the URL handed to the admin (fleet `hostname`, default "localhost"). */
     hostname?: string;
     assetsDir?: string;
+    /**
+     * The `Host` names this listener answers to (see `allowedHostNames` in web-host-guard.ts):
+     * loopback, the fleet's `hostname:` and `web.allowed_hosts`. Anything else — a rebinding
+     * page, a scanner, a tunnel nobody told it about — is refused before the path is looked at.
+     * Default: loopback names plus `hostname`.
+     */
+    allowedHosts?: ReadonlySet<string>;
 }
 /**
  * The request target as a plain path, or null when it is not a valid
@@ -25,11 +32,34 @@ export declare class WebTerminalHttpServer {
     private readonly assetsDir;
     private readonly bind;
     private readonly hostname;
+    private readonly allowedHosts;
+    /** The one extra name a tunnel in front of this listener answers on — set only while that tunnel is up. */
+    private externalHost;
+    /** Distinct refused names already logged; bounded so a scanner cannot grow it. */
+    private readonly rejectedHostsLogged;
     private unsubscribeFinished;
     /** Immutable assets, read once at listen() — no per-request disk I/O (M3). */
     private readonly assetCache;
     constructor(session: WebTerminalSession, logger: TerminalLogger, opts?: WebTerminalHttpOptions);
+    /**
+     * Let exactly one more name through — the public host of a tunnel pointed at this listener — and
+     * treat requests that arrive on it as https. `null` takes it away again.
+     *
+     * One exact name, set when the tunnel is known and cleared when it is not: a wildcard such as
+     * `*.trycloudflare.com` would also admit every other tunnel on that domain, and a stale name
+     * would admit whoever is handed this port number next.
+     */
+    setExternalHost(host: string | null): void;
     get pagePath(): string;
+    /**
+     * A string that appears in this session's page and nowhere else.
+     *
+     * The tunnel's readiness probe fetches the page back through the public URL and
+     * looks for this: "the edge reaches the exact listener we meant", not just "some
+     * server answered". It is derived from the sid, which is already in the page's
+     * own path, so it adds nothing a link holder does not have.
+     */
+    get readinessMarker(): string;
     /**
      * The URL handed to the admin ends with "/" on purpose: terminal.html loads
      * `assets/…` relative to the document, and relative resolution drops the last
@@ -54,6 +84,10 @@ export declare class WebTerminalHttpServer {
     private cookie;
     /** Origin must be present and its host must equal the Host header (what the browser typed). */
     private originMatchesHost;
+    /** Exact match on the parsed host name (port ignored); a missing or malformed `Host` is refused. */
+    private hostAllowed;
+    /** Say once per name why a request was refused; only the parsed name is logged, never the raw header. */
+    private noteRejectedHost;
     private isHttps;
     private redirect;
     private text;