@songsid/agend 2.3.3-beta.9 → 2.3.4-beta.1

package/dist/selection-card.d.ts

@@ -0,0 +1,21 @@
+/**
+ * #2910 D4: a CLI's own numbered-choice dialog (Claude Code's Bash or tool permission, its trust / Bypass screens it
+ * did not recognise, "Background work is running", "Switch model?"; Codex's selections; any numbered prompt the
+ * #1691 catch-all holds), read from the pane as a #2675 question card — so that on a web-only fleet the person answers it
+ * from the dashboard: the card's own options as buttons, keyed in by remote-card-answer.ts on a verified cursor.
+ *
+ * Pure. Bottom-anchored like unrecognised-prompt.ts: the cursor (`❯`/`›`) is on a numbered option in a run of
+ * consecutive options at the bottom of the screen (at most a short footer below), so a transcript quoting a dialog is
+ * never one. The dialog's own words above the options (up to its top border) are its question — what a person needs to
+ * decide (for a Bash permission: the command and its description). Esc is never offered: on some of these dialogs it is
+ * not a harmless skip (Claude's trust screen exits the CLI), and the dialog's own options say every choice there is.
+ */
+import type { RemoteQuestionCard } from "./backend/types.js";
+/** Rows of the dialog's words kept, and their length. */
+export declare const SELECTION_BODY_LINES = 10;
+export declare const SELECTION_LINE_MAX = 200;
+/**
+ * The numbered-choice dialog at the bottom of `pane`, as a question card titled `title` (the CLI's name), or null.
+ * `rowWidth` is unused here (no typed answer); the card offers no Esc (`noSkip`) and is posted only on a web-only fleet.
+ */
+export declare function selectionCard(pane: string, title: string): RemoteQuestionCard | null;

package/dist/selection-card.js

@@ -0,0 +1,129 @@
+const ANSI = /\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
+const CURSOR_OPTION = /^([ \t]*)[❯›][ \t]*(\d{1,2})[.)][ \t]+(\S.*)$/;
+const OPTION = /^([ \t]*)(?:[❯›][ \t]*)?(\d{1,2})[.)][ \t]+(\S.*)$/;
+/**
+ * The dialog's own top border: a plain rule (Claude's `─`/`▔`). Never a box row with corners (`╭─…╮`, `╰─…╯`): that is
+ * Codex's session header above the transcript, not the top of a dialog (#2928 review).
+ */
+const BORDER = /^[ \t]*[─━═▔▁]{8,}[ \t]*$/;
+/** A box's top or bottom row (Codex's session header): what is above or in it is never the dialog's words — reading stops. */
+const BOX_EDGE = /^[ \t]*[╭╰┌└][─━═]{6,}[╮╯┐┘]?[ \t]*$/;
+/** A separator inside the dialog (Claude's dashed rule around a command): skipped, not a boundary. */
+const SEPARATOR = /^[ \t]*[╌┄┈\-]{8,}[ \t]*$/;
+/** A box's side borders around a row (Codex): stripped. */
+const SIDES = /^[ \t]*[│┃][ \t]?(.*?)[ \t]*[│┃]?[ \t]*$/;
+/** Rows a dialog may have below its last option (a hint footer: "Esc to cancel · Tab to amend"). */
+const FOOTER_ROWS = 3;
+/** How far above the first option the dialog's words are read. */
+const BODY_ROWS = 14;
+/** Rows of the dialog's words kept, and their length. */
+export const SELECTION_BODY_LINES = 10;
+export const SELECTION_LINE_MAX = 200;
+/** An option's text, at most. */
+const OPTION_MAX = 160;
+function clean(raw, max = SELECTION_LINE_MAX) {
+    const text = raw.replace(/[\x00-\x1f\x7f]/g, " ").replace(/\s+/g, " ").trim();
+    return text.length > max ? `${text.slice(0, max - 1)}…` : text;
+}
+/** A countdown in the dialog's words ("auto-deny in 30s", "block this request in 1:55") never makes the card another card. */
+const COUNTDOWN = /\b\d+\s*(?:s|sec|secs|seconds?)\b|\b\d{1,2}:\d{2}\b/gi;
+/**
+ * The numbered-choice dialog at the bottom of `pane`, as a question card titled `title` (the CLI's name), or null.
+ * `rowWidth` is unused here (no typed answer); the card offers no Esc (`noSkip`) and is posted only on a web-only fleet.
+ */
+export function selectionCard(pane, title) {
+    const rows = pane.replace(ANSI, "").replace(/\r/g, "").split("\n").map(r => r.trimEnd()).map(r => SIDES.exec(r)?.[1] ?? r);
+    let lastFilled = rows.length - 1;
+    while (lastFilled >= 0 && rows[lastFilled].trim() === "")
+        lastFilled--;
+    if (lastFilled < 0)
+        return null;
+    // The cursor row: the lowest one, within the bottom of the screen.
+    let at = -1;
+    for (let i = lastFilled, filled = 0; i >= 0 && filled < 24; i--) {
+        if (rows[i].trim() === "")
+            continue;
+        filled++;
+        if (CURSOR_OPTION.test(rows[i])) {
+            at = i;
+            break;
+        }
+    }
+    if (at < 0)
+        return null;
+    // The run of options around it: numbered rows, each perhaps continued on deeper-indented rows (a wrapped option).
+    const indentOf = (r) => (/^[ \t]*/.exec(r)[0].length);
+    const optionIndent = indentOf(rows[at].replace(/[❯›]/, " "));
+    const isOption = (r) => OPTION.test(r) && Math.abs(indentOf(r.replace(/[❯›]/, " ")) - optionIndent) <= 2;
+    const isContinuation = (r) => r.trim() !== "" && !OPTION.test(r) && indentOf(r) > optionIndent;
+    let first = at;
+    for (let i = at - 1; i >= 0; i--) {
+        if (isOption(rows[i])) {
+            first = i;
+            continue;
+        }
+        if (isContinuation(rows[i]) && i > 0 && (isOption(rows[i - 1]) || isContinuation(rows[i - 1])))
+            continue;
+        break;
+    }
+    let last = at;
+    for (let i = at + 1; i < rows.length; i++) {
+        if (isOption(rows[i]) || (isContinuation(rows[i]) && last === i - 1)) {
+            last = i;
+            continue;
+        }
+        break;
+    }
+    let below = 0;
+    for (let i = last + 1; i <= lastFilled; i++)
+        if (rows[i].trim() !== "")
+            below++;
+    if (below > FOOTER_ROWS)
+        return null;
+    const options = [];
+    let cursor = null;
+    for (let i = first; i <= last; i++) {
+        const m = OPTION.exec(rows[i]);
+        if (m && isOption(rows[i])) {
+            if (CURSOR_OPTION.test(rows[i]))
+                cursor = options.length;
+            options.push({ n: Number(m[2]), title: m[3], recommended: false, description: null });
+        }
+        else if (options.length) {
+            options[options.length - 1].title += ` ${rows[i].trim()}`;
+        }
+    }
+    if (options.length < 2 || cursor === null || !options.every((o, i) => o.n === i + 1))
+        return null;
+    for (const o of options)
+        o.title = clean(o.title, OPTION_MAX);
+    // The dialog's words: up from the first option to its top border (Claude's plain rule — its words may hold a double blank
+    // row, as the dangerous-rm dialog does), separators skipped; a dialog with no such border (Codex) ends at a double blank
+    // row — never the transcript above it (#2928 review).
+    let border = -1;
+    for (let i = first - 1; i >= 0 && first - i <= BODY_ROWS; i--)
+        if (BORDER.test(rows[i])) {
+            border = i;
+            break;
+        }
+    const body = [];
+    for (let i = first - 1, blanks = 0; i > border && first - i <= BODY_ROWS; i--) {
+        const r = rows[i];
+        if (r.trim() === "") {
+            if (border < 0 && ++blanks >= 2 && body.length)
+                break;
+            continue;
+        }
+        blanks = 0;
+        if (BOX_EDGE.test(r))
+            break;
+        if (SEPARATOR.test(r))
+            continue;
+        body.unshift(clean(r));
+    }
+    const words = body.slice(-SELECTION_BODY_LINES);
+    const question = words.join("\n");
+    const identity = ["selection", title, question.replace(COUNTDOWN, "#s"), ...options.map(o => `${o.n}. ${o.title.replace(COUNTDOWN, "#s")}`)].join("\n");
+    return { kind: "question", identity, title, question, page: "options", options, freeText: false, cursor, typed: null, rowWidth: 0, noSkip: true, webOnly: true };
+}
+//# sourceMappingURL=selection-card.js.map

package/dist/selection-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection-card.js","sourceRoot":"","sources":["../src/selection-card.ts"],"names":[],"mappings":"AAcA,MAAM,IAAI,GAAG,8DAA8D,CAAC;AAC5E,MAAM,aAAa,GAAG,+CAA+C,CAAC;AACtE,MAAM,MAAM,GAAG,oDAAoD,CAAC;AACpE;;;GAGG;AACH,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAC3C,8HAA8H;AAC9H,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,sGAAsG;AACtG,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAC9C,2DAA2D;AAC3D,MAAM,KAAK,GAAG,0CAA0C,CAAC;AACzD,oGAAoG;AACpG,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,kEAAkE;AAClE,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,iCAAiC;AACjC,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,SAAS,KAAK,CAAC,GAAW,EAAE,GAAG,GAAG,kBAAkB;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,8HAA8H;AAC9H,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAE1E;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3H,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,OAAO,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAE,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,UAAU,EAAE,CAAC;IACxE,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,mEAAmE;IACnE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAChE,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACrC,MAAM,EAAE,CAAC;QACT,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;IACtD,CAAC;IACD,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAExB,kHAAkH;IAClH,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjH,MAAM,cAAc,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;IACvG,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAAC,KAAK,GAAG,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAChD,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC;YAAE,SAAS;QAC5G,MAAM;IACR,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/F,MAAM;IACR,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,KAAK,EAAE,CAAC;IACjF,IAAI,KAAK,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAC5B,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;gBAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAE9D,0HAA0H;IAC1H,yHAAyH;IACzH,sDAAsD;IACtD,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC,EAAE;QAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;IAChH,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAAC,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM;YAAC,SAAS;QAAC,CAAC;QACzF,MAAM,GAAG,CAAC,CAAC;QACX,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM;QAC5B,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnK,CAAC"}

package/dist/settings-api.d.ts

@@ -40,6 +40,16 @@ export interface SettingsApiContext extends AppShellContext {
         queued: boolean;
         already_running?: boolean;
     };
+    /** #2906: the fixed address's Test connection (closed step codes only; never the token). */
+    testNamedLink?(input: {
+        hostname: unknown;
+        port: unknown;
+        protocol: unknown;
+        token?: unknown;
+        current?: () => boolean;
+    }): Promise<import("./tunnel/named-link-test.js").NamedTestResult | {
+        busy: true;
+    }>;
     /** #1920 phase 3: Settings → Web sign-ins → Guests. */
     guestOverview?(): unknown;
     /** #2667: the ClassicBot rooms' instance names — a guest grant may name one, so a save's validation knows them. */

package/dist/settings-api.js

@@ -346,6 +346,47 @@ export function handleSettingsRequest(req, res, url, ctx) {
         }
         return true;
     }
+    // #2906 (the user, 2026-11-01): Settings → Access → Test connection, on the fixed-address values as filled in. Admin
+    // only and never over the public link, like the rest of Access; the typed token is read from the body once, used
+    // only in the test connector's environment, and never echoed — the answer is closed step codes.
+    if (method === "POST" && path === "/api/settings/public-link/test") {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "web_settings_not_over_public_link" }, true);
+            return true;
+        }
+        const caller = guestSettingsCaller(req, url, ctx);
+        if (!caller) {
+            json(res, 403, { error: "An admin sign-in is required" }, true);
+            return true;
+        }
+        if (!ctx.testNamedLink) {
+            json(res, 501, { error: "test unavailable" }, true);
+            return true;
+        }
+        // #2907 review: the same admin, still current, after the body's await — and again before anything is started.
+        const current = () => guestSettingsCaller(req, url, ctx) === caller;
+        readBody(req, 16 * 1024).then(async (buf) => {
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            if (!current())
+                return json(res, 401, { error: "no longer authorized" }, true);
+            let body;
+            try {
+                body = JSON.parse(buf.toString("utf-8") || "{}");
+            }
+            catch {
+                return json(res, 400, { error: "invalid JSON" }, true);
+            }
+            if (!body || typeof body !== "object" || Array.isArray(body))
+                return json(res, 400, { error: "invalid body" }, true);
+            const result = await ctx.testNamedLink({ hostname: body.hostname, port: body.origin_port, protocol: body.protocol, token: body.token, current });
+            if ("busy" in result)
+                return json(res, 409, { error: "test_running" }, true);
+            json(res, 200, { steps: result.steps, hostname: result.hostname, port: result.port, ...(result.cleanup ? { cleanup: result.cleanup } : {}) }, true);
+        }).catch(() => { if (!res.headersSent)
+            json(res, 400, { error: "bad request" }, true); });
+        return true;
+    }
     // Generic provider API-key registry.  Unlike the legacy connection token
     // routes, this endpoint accepts a code-owned spec id only; env key, origin,
     // auth header and verifier are resolved server-side.  The body is consumed
@@ -923,6 +964,10 @@ export function handleSettingsRequest(req, res, url, ctx) {
                 web.office_levels = parsed.officeLevels;
                 changes.push({ path: ["web", "office_levels"], value: parsed.officeLevels });
             }
+            if (parsed.previewCdn !== undefined) {
+                web.preview_cdn = parsed.previewCdn;
+                changes.push({ path: ["web", "preview_cdn"], value: parsed.previewCdn });
+            }
             if (parsed.publicLink) {
                 if (Object.keys(parsed.publicLink).length)
                     web.public_link = { ...web.public_link, ...parsed.publicLink };