@staix/agent-console 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-11-04
+
+### Added
+
+- H2 static shell (#46): `acon build --static --nodes id=https://origin[,id=origin] [--out dist]`, fixed credential-free assets and Vercel/Workers static config, per-node bearer/Access auth, namespaced tools, node-owned actions and allowlisted credentialed CORS. Node-specific expiring GET-only grants serve authenticated modules/assets without exposing bearer tokens in URLs. Two-node ui-check covers ownership and distinct offline/origin-refused states. Hosted preview readback remains unverified.
+- H1 follow-ups (#45): `acon serve --read-only` / `ACON_READ_ONLY=1` refuses every plugin action (403 `read-only node`, no plugin call, no confirm token, a replayed token is not honoured), reports `readOnly: true` in `/tools`, and the shell shows a Read-only chip with verb, answer and confirm buttons disabled. `acon token new [--file] [--force]` writes a 0600 base64url bearer token and prints only its path. `acon setup launchd [--label] [--apply]` prints (or installs) a LaunchAgent for `acon serve` with auth passed as env names and file paths. The Dockerfile carries OCI `source` and `revision` labels.
+- Release images (#45): behind `IMAGE_PUBLISH_ENABLED`, tagged releases push multi-arch (`linux/amd64`, `linux/arm64`) images to `ghcr.io/staixbwlb/agent-console:<version>` (and `latest` for stable versions) with OCI labels, read the manifest back and run `--version` on amd64.
+
 ## [0.1.0] - 2026-11-04
 
 ### Compatibility

package/README.md

@@ -2,7 +2,7 @@
 
 `acon` is a local web console for the agent tool family: agent-hub (agents and tasks), agent-mem (memory) and vault-mem (knowledge vault). Each tool contributes panels as a plugin. The console adds what no single tool has: one inbox of everything waiting for you, a command palette across tools, and one confirm dialog for every destructive action.
 
-Status: H0 (`acon ui`, local mode) and H1 (`acon serve`, an authenticated resident node). vault-mem and agent-hub register their plugins; a fixture plugin in `test/fixtures/` shows the contract. The static multi-node shell (H2) is not implemented.
+Status: H0 (`acon ui`, local mode) and H1 (`acon serve`, an authenticated resident node). vault-mem and agent-hub register their plugins; a fixture plugin in `test/fixtures/` shows the contract. H2 (`acon build --static`) serves a credential-free shell over independently authenticated H1 nodes.
 
 ## Use
 
@@ -113,7 +113,7 @@ Rules:
 `acon serve` (H1) is the resident form of the console for a node behind a reverse tunnel or on an internal server. `acon ui` is unchanged.
 
 ```sh
-acon serve [--host 127.0.0.1] [--port 8787] [--origin https://console.example.com]... [--json]
+acon serve [--host 127.0.0.1] [--port 8787] [--origin https://console.example.com]... [--read-only] [--json]
 ```
 
 - No ticket link, no idle exit and no browser opening. The process stays up until it is stopped. `--port` defaults to `ACON_PORT`, or 8787 when that is unset.
@@ -121,16 +121,47 @@ acon serve [--host 127.0.0.1] [--port 8787] [--origin https://console.example.co
 - `GET /healthz` answers 204 with no body and no authentication. Every other route, the shell files included, needs authentication.
 - Authentication is required unless `--host` is a loopback address. Starting on another address without it is refused. There are two modes:
   - Cloudflare Access: set `ACON_ACCESS_TEAM` (the team domain, `<team>.cloudflareaccess.com`) and `ACON_ACCESS_AUD` (the Access application's AUD tag). Each request's `Cf-Access-Jwt-Assertion` must verify as RS256 against `https://<team>/cdn-cgi/access/certs`. The keys are cached and refetched on an unknown `kid`. The checks are `aud` contains the AUD, `iss` is `https://<team>`, `exp`/`nbf` hold with 60 s skew, and `sub` (or `email`) is present.
-  - Bearer token: set `ACON_TOKEN_FILE` to a file with mode 0600 holding one random token of at least 32 characters, for example from `openssl rand -hex 32`. Requests send `Authorization: Bearer <token>`. The comparison is constant-time. A file readable by group or others is refused.
+  - Bearer token: set `ACON_TOKEN_FILE` to a file with mode 0600 holding one random token of at least 32 characters. `acon token new [--file PATH] [--force]` writes one (32 random bytes, base64url) to `$AGENTHUB_HOME/console/token` by default. It creates the file exclusively with mode 0600, refuses an existing file unless `--force` is given, and prints only the path, never the token. Requests send `Authorization: Bearer <token>`. The comparison is constant-time. A file readable by group or others is refused.
 - The verified identity (the Access `sub`, or `bearer`) takes the place of the ticket session. Confirm tokens for destructive actions are bound to it, so a preview confirmed by another identity is refused. The page skips the ticket step because `/session` answers `{ok: true, mode: "serve"}`.
 - CSP, headers, plugins, the confirm path and the 32 KB body limit are the same as under `acon ui`.
+- Read-only node: `--read-only` or `ACON_READ_ONLY=1`. Every `/p/<tool>/action` answers 403 `{ok: false, error: "read-only node"}` before any confirm-token lookup, without calling the plugin and without issuing a confirm token. `/tools` reports `readOnly: true`, and the shell shows a "Read-only" chip and disables verb, answer and confirm buttons. Snapshots, search and assets are unchanged. Authentication rules do not change.
+
+### LaunchAgent (macOS)
+
+```sh
+acon setup launchd [--label acon.serve] [--apply] [--host H] [--port P] [--origin https://host]... [--read-only]
+```
+
+Prints a LaunchAgent plist that runs the absolute `bun` and this checkout's `bin/acon.js serve` with the given flags, with `RunAtLoad`, `KeepAlive` and logs in `$AGENTHUB_HOME/console/logs/<label>.{out,err}.log`. It applies the same refusals as `acon serve` first. Auth is copied as environment names that point to files or settings (`ACON_TOKEN_FILE` as an absolute path, `ACON_ACCESS_TEAM`, `ACON_ACCESS_AUD`, `ACON_ORIGINS`, `ACON_PORT`, `ACON_READ_ONLY`), never a token value. Without `--apply` nothing is written. `--apply` writes `~/Library/LaunchAgents/<label>.plist`, runs `launchctl bootout` then `bootstrap` in `gui/<uid>`, and prints `launchctl print`. A tunnel agent is not part of this.
 
 ### Versioned install
 
 From a checkout, `bun scripts/install-release.ts [--home DIR] [--json]` copies the committed package files (not uncommitted changes) into `$AGENTHUB_HOME/console/releases/<version>-<commit>/`, then points `console/current` at it by atomic rename and keeps `console/previous`. An existing release is reused, never changed. Start the resident console from `console/current/bin/acon.js`: an install leaves a running process on the release it started from, and a restart switches it. Roll back by pointing `current` at `previous` and restarting.
 
+### Static multi-node shell (H2)
+
+Build into a new output directory (an existing destination is refused):
+
+```sh
+acon build --static --nodes desk=https://desk.example.com,dgx=https://dgx.example.com --out dist
+```
+
+Each URL must be an exact HTTPS origin, without credentials, paths, queries or fragments. HTTP is allowed only for loopback development. Configure each H1 node with both its public origin and the shell origin, for example `acon serve --origin https://desk.example.com --origin https://console.example.com`, and its own bearer token file or Cloudflare Access application. The node origin also registers its public Host value; the shell origin permits CORS. Keep authentication enabled off loopback.
+
+Build one static shell only over equally trusted nodes (such as your own nodes). Each node's panel modules execute with the shell's authority; a compromised node or plugin can use every node's credentials in that tab while it is open. Use separate builds for nodes with different trust.
+
+The output contains fixed shell/vendor files, public `config.json`, `_headers`, `vercel.json`, an assets-only `wrangler.jsonc` and `.assetsignore`. It contains no plugin data or credentials. Upload the complete directory to a preview with the supplied header configuration. Main-document CSP permits connections, scripts and images only from self and the configured node origins; plugin styles are fetched with node auth into constructed stylesheets, and attachments use a local sandboxed viewer. The sandboxed visual/attachment documents have separate header policies.
+
+In System, each node has its own bearer-token form and Access sign-in/reconnect controls. Bearer tokens stay in that tab's `sessionStorage`; Access uses that node's cookies with credentialed requests. Access CORS/cookie policy must also permit the shell origin. Authenticated nodes issue short-lived GET-only resource grants for panel modules and attachments because native module/image requests cannot carry bearer headers. These runtime grants are node-specific, contain no bearer token and never authorize actions. Keep node access logs private, since runtime resource URLs contain these grants. The "Open attachment" link also includes a GET-only grant and can leave it in browser history for its remaining lifetime (at most 1 hour); keep that history private too.
+
+Tools are namespaced `node:tool`; panel `host.node` identifies the owner and `host.tool` keeps its original tool id. All actions, confirmations and read-only restrictions stay on that owner. System distinguishes online, offline, unauthorized and `refused (origin)` nodes. A bounded opaque health probe distinguishes an unreachable node from a reachable node blocked by CORS; persistent failures refresh at most once per tool-list interval, without repeated prompts. Use System to reconnect after fixing a URL, token or `--origin`.
+
+Vercel and Workers preview URL/CSP readback is **unverified** until the person supplies logins. No production deployment or Access application configuration is performed by the build command.
+
 ### Docker
 
+When the repository variable `IMAGE_PUBLISH_ENABLED` is `true`, a tagged release (after npm publish) pushes `ghcr.io/staixbwlb/agent-console:<version>`, plus `latest` for stable versions, for `linux/amd64` and `linux/arm64`, with OCI `source`, `revision` and `version` labels. The release job reads the manifest back for both architectures, checks the revision label and runs `--version` on amd64.
+
 The `Dockerfile` builds a pinned `oven/bun` image that runs `acon serve --host 0.0.0.0` as the non-root `bun` user. `AGENTHUB_HOME=/data` is a volume holding plugins, pets and asset packs, and a `HEALTHCHECK` probes `/healthz`. The image holds no credentials:
 
 ```sh
@@ -305,6 +336,8 @@ bun run check   # typecheck, boundary, tests, pack dry-run
 
 Before UI PRs, run `node scripts/ui-check.mjs`. It finds an existing Playwright install at run time, starts isolated fixture servers and writes screenshots plus `ui-check/report.json`. It checks 375/768/1024/1440 px, both themes and 100%/200% text, including Space with two tools, an explicit synthetic pet/pack and a no-pack fallback. Mini (`#/local/mini`) is captured in every cell, at the 320x440 pop-out size (light and dark, 100% and 200% text, rendered in the page, not a Picture-in-Picture window) and once with no pack and the pet off; it checks the pet sprite, Tab order with visible focus over item and footer buttons, and that a pet-less Mini requests nothing under `/pets/`. It checks namespace keys, roster parity, navigation and unchanged-poll DOM writes. It exits non-zero on browser errors, text clipping (including the search label), overlap or horizontal overflow. It also checks that the skip link is completely offscreen until focused, reachable by keyboard and moves focus to main when activated. Playwright is a development tool supplied by the person running the check, not a package dependency or CI gate.
 
+The full probe also runs a two-node static-shell matrix at 375/1440 px in both themes and text sizes, checking node ownership, auth, offline and origin-refused states. `--static-only` runs that focused matrix.
+
 Use `PLAYWRIGHT_MODULE` for an absolute Playwright or playwright-core module path, `PLAYWRIGHT_EXECUTABLE_PATH` for an existing Chromium executable, and `BUN_BIN` for Bun when it is not on PATH. `--output <dir>` changes the artifact directory; `--baseline <report.json>` compares 100% text metrics against an earlier run (1 px tolerance). `--force-overflow` is a negative control and must exit non-zero. Use the workspace's remote runner when local browser workloads are deferred.
 
 `--space-views-only` runs the Room/3D camera checks at 375 and 1440 px in both themes and 100%/200% text. It verifies lazy vendor requests, preserved focus order, projected overlay centres within 8 px after rotation, model loading, context-loss and absent-WebGL2 fallbacks, and zero additional canvas renders across a settled 10-second window. Depth-ordered scene buttons can occlude each other in projected views; their geometry and equivalent keyboard/roster access are checked separately from the shell's normal strict overlap checks. The full run includes both view and motion checks. For a separate published-art compatibility run, use `--space-views-only --art-root <directory>` with explicit `assets/` and `pets/` subdirectories; the probe never scans a real agent home.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-console",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Local-first web console that composes agent-hub, agent-mem and vault-mem as plugin panels",
   "license": "MIT",
   "type": "module",

package/shell/asset-viewer.css

@@ -0,0 +1,5 @@
+:root { color-scheme: light dark; font: 1rem system-ui, sans-serif; }
+body { margin: 0; }
+img, iframe { display: block; width: 100%; border: 0; }
+iframe { height: 90vh; }
+pre { white-space: pre-wrap; overflow-wrap: anywhere; padding: 1rem; }

package/shell/asset-viewer.html

@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Attachment</title>
+<link rel="stylesheet" href="/asset-viewer.css">
+<script src="/asset-viewer.js" defer></script>
+</head>
+<body><main id="asset" role="status">Loading attachment...</main></body>
+</html>

package/shell/asset-viewer.js

@@ -0,0 +1,23 @@
+// Opaque sandbox: only the parent may supply bounded, allowlisted attachment bytes.
+const types = new Set(['application/pdf', 'image/png', 'image/jpeg', 'text/plain', 'text/csv']);
+let objectUrl;
+window.addEventListener('message', (event) => {
+  if (event.source !== parent || event.origin !== location.origin || event.data?.kind !== 'acon-asset') return;
+  const { mime, bytes } = event.data;
+  if (!types.has(mime) || !(bytes instanceof ArrayBuffer) || bytes.byteLength > 32 * 1024 * 1024) return;
+  const root = document.getElementById('asset');
+  if (objectUrl) URL.revokeObjectURL(objectUrl);
+  if (mime.startsWith('text/')) {
+    const pre = document.createElement('pre');
+    pre.textContent = new TextDecoder().decode(bytes);
+    root.replaceChildren(pre);
+  } else {
+    objectUrl = URL.createObjectURL(new Blob([bytes], { type: mime }));
+    const child = document.createElement(mime === 'application/pdf' ? 'iframe' : 'img');
+    child.src = objectUrl;
+    if (child.tagName === 'IMG') child.alt = 'Attachment';
+    else child.title = 'PDF attachment';
+    root.replaceChildren(child);
+  }
+});
+parent.postMessage({ kind: 'acon-asset-ready' }, location.origin);

package/shell/index.html

@@ -20,6 +20,7 @@
     <header class="top">
       <div class="crumbs" id="crumbs"></div>
       <button type="button" class="search-open" id="palette-open" aria-keyshortcuts="Meta+K Control+K" aria-label="Search or run a command"><span class="search-label" aria-hidden="true">Search or run a command</span><kbd id="palette-key">Ctrl K</kbd></button>
+      <span class="chip warn read-only" id="read-only" title="Actions are turned off on this console" hidden>Read-only</span>
       <span class="live" id="live" role="status" aria-live="off"></span>
       <button type="button" class="pet" id="pet" hidden></button>
       <button type="button" class="icon-btn" id="mini-open" aria-label="Pop out Mini" title="Pop out Mini"></button>

package/shell/shell.js

@@ -710,8 +710,8 @@ function visualView(payload, kit, frames, theme) {
 // `route` maps a plugin path to the load this page uses (#26), so assets come from the same version as the panel.
 // `o` holds shell hooks for kit parts that need them (review: openSheet, onError; visual: theme, onTheme).
 function kitFor(tool, hash, route = (path) => path, o = {}) {
-  const { openSheet, onError, theme = () => "light", onTheme = () => {} } = o;
-  const assetUrl = (id) => `${route(`/p/${tool}/asset`)}?id=${encodeURIComponent(id)}`;
+  const { openSheet, onError, frameAsset, theme = () => "light", onTheme = () => {} } = o;
+  const assetUrl = (id) => route(`/p/${tool}/asset?id=${encodeURIComponent(id)}`);
   let frames = null;
   // One theme subscription per kit: diagrams on screen redraw in the new theme.
   onTheme(() => { if (frames) for (const entry of [...frames.live]) entry.retheme(theme()); });
@@ -725,6 +725,7 @@ function kitFor(tool, hash, route = (path) => path, o = {}) {
     },
     frame(o) {
       const id = assetId(o);
+      if (frameAsset) return frameAsset(assetUrl(id), String(o.title ?? "Attachment"));
       return h("iframe", { class: "ui-frame", src: assetUrl(id), title: String(o.title ?? "Attachment"), referrerpolicy: "no-referrer" });
     },
     link(to, text) {
@@ -775,10 +776,17 @@ function store(key, value) {
 
 // ---------- network ----------
 // A page keeps the plugin load it first saw (#26): a version registered later serves pages opened after it.
+let staticTransport = null;
 const pinnedRefs = new Map();
-const pluginPath = (path) => path.replace(/^\/p\/([a-z][a-z0-9-]{1,15})\//, (whole, id) => (pinnedRefs.has(id) ? `/p/${pinnedRefs.get(id)}/` : whole));
+const pluginPath = (path) => staticTransport ? staticTransport.resource(path, pinnedRefs) : path.replace(/^\/p\/([a-z][a-z0-9-]{1,15})\//, (whole, id) => (pinnedRefs.has(id) ? `/p/${pinnedRefs.get(id)}/` : whole));
 
 async function post(path, body = {}) {
+  if (staticTransport) {
+    state.lastRequest = Date.now();
+    const response = await staticTransport.post(path, body, pinnedRefs);
+    if (response.status === 200) state.lastOk = Date.now();
+    return response;
+  }
   path = pluginPath(path);
   state.lastRequest = Date.now();
   let res;
@@ -856,6 +864,7 @@ function route() {
   const prev = state.route;
   state.route = parseRoute();
   const r = state.route;
+  updateReadOnly();
   if (prev.tool && prev.tool !== r.tool) { const p = state.panels.get(prev.tool); if (p?.instance) safe(prev.tool, "hide", () => p.instance.hide?.()); }
   $("view-inbox").hidden = r.area !== "inbox";
   $("view-system").hidden = r.area !== "system";
@@ -949,6 +958,13 @@ function renderLive() {
   const el = $("live");
   const age = Math.round((Date.now() - state.lastOk) / 1000);
   const kind = state.offline ? "offline" : age > 15 ? "stale" : "live";
+  if (staticTransport) {
+    const online = staticTransport.nodes.filter((node) => node.status === "online").length;
+    el.className = `live ${online ? "live" : "offline"}`;
+    el.textContent = `${online}/${staticTransport.nodes.length} nodes online`;
+    el.title = "Open System for each node's status and authentication";
+    return;
+  }
   const text = kind === "offline" ? "Offline · retrying" : kind === "stale" ? `Stale ${age} s` : `Live · ${age} s ago`;
   el.className = `live ${kind}`;
   if (el.dataset.text !== text) { el.dataset.text = text; el.replaceChildren(h("span", { class: "dot", "aria-hidden": "true" }), h("span", { text })); }
@@ -1014,7 +1030,7 @@ function renderInbox(force = false) {
   const view = $("view-inbox");
   const items = sortedItems();
   const failed = [...state.inbox].filter(([, e]) => e.failed).map(([t]) => toolById(t)?.title ?? t);
-  const sig = JSON.stringify([items, failed, state.selectedKey, readyTools().length]);
+  const sig = JSON.stringify([items, failed, state.selectedKey, readyTools().length, readOnly()]);
   if (!force && sig === state.inboxSig) return;
   state.inboxSig = sig;
   const focusRow = document.activeElement?.closest?.(".row");
@@ -1035,7 +1051,7 @@ function renderInbox(force = false) {
     if (!group.length) continue;
     kids.push(h("section", { class: "group", "aria-labelledby": `g-${g}` },
       h("h2", { id: `g-${g}` }, h("span", { text: label }), h("span", { class: "badge", text: String(group.length) }),
-        g === "result" && group.some((i) => i.seen) ? h("button", { type: "button", class: "btn group-command", onclick: () => markAllRead(group), text: "Mark all read" }) : null),
+        g === "result" && group.some((i) => i.seen) ? h("button", { type: "button", class: "btn group-command", disabled: readOnly(), title: readOnly() ? RO_TITLE : undefined, onclick: () => markAllRead(group), text: "Mark all read" }) : null),
       h("ul", { class: "rows" }, group.map(rowFor))));
   }
   view.replaceChildren(...kids);
@@ -1053,10 +1069,21 @@ function whose(item) {
 function subline(item) {
   return [item.kind, item.project, item.actor ? `from ${item.actor}` : "", toolById(item.tool)?.title, ago(item.at)].filter(Boolean).join(" · ");
 }
+// #45: a read-only node refuses every action; verbs and confirm stay visible but disabled.
+const readOnly = (tool = state.route.tool) => state.readOnly === true || Boolean(tool && state.tools.find((t) => t.tool === tool)?.readOnly === true);
+function updateReadOnly() {
+  const chip = $("read-only");
+  const nodes = staticTransport ? staticTransport.nodes.filter((node) => node.data?.readOnly).map((node) => node.id) : [];
+  const routed = readOnly();
+  chip.hidden = !routed && !nodes.length;
+  chip.textContent = routed ? "Read-only" : `${nodes.length} read-only ${nodes.length === 1 ? "node" : "nodes"}`;
+  chip.title = nodes.length ? `Read-only nodes: ${nodes.join(", ")}. Actions remain available on writable nodes.` : "Actions are turned off on this console";
+}
+const RO_TITLE = "This console is read-only";
 function verbButtons(item, max) {
   const verbs = [...item.verbs].sort((a, b) => Number(Boolean(b.primary)) - Number(Boolean(a.primary))).slice(0, max);
   return verbs.map((v, i) => h("button", {
-    type: "button", class: `btn${v.primary ? " primary" : ""}${v.destructive ? " danger" : ""}`,
+    type: "button", class: `btn${v.primary ? " primary" : ""}${v.destructive ? " danger" : ""}`, disabled: readOnly(item.tool), title: readOnly(item.tool) ? RO_TITLE : undefined,
     onclick: (e) => { e.stopPropagation(); runVerb(item, v); },
   }, h("span", { text: v.label }), max <= 2 ? h("kbd", { "aria-hidden": "true", text: String(i + 1) }) : null));
 }
@@ -1226,7 +1253,7 @@ function answerForm(item, verb, draft, submit, redraw) {
         str(draft.reason).trim() ? [h("dt", { text: "Reason" }), h("dd", { text: str(draft.reason).trim() })] : []),
       error,
       h("div", { class: "sheet-verbs" },
-        h("button", { type: "button", class: "btn primary answer-submit", onclick: () => submit(r.answers), text: `Submit: ${verb.label}` }),
+        h("button", { type: "button", class: "btn primary answer-submit", disabled: readOnly(item.tool), onclick: () => submit(r.answers), text: `Submit: ${verb.label}` }),
         h("button", { type: "button", class: "btn", onclick: () => { draft.step = "edit"; redraw(true); }, text: "Back" })));
     return el;
   }
@@ -1263,7 +1290,7 @@ function answerForm(item, verb, draft, submit, redraw) {
   verb.reason ? h("label", { class: "answer-opt answer-other" }, h("span", { class: "answer-label", text: `Reason${verb.reason === "required" ? " (required)" : " (optional)"}` }),
     h("input", { type: "text", class: "answer-other-text answer-reason", maxlength: "500", autocomplete: "off", value: str(draft.reason), oninput: (e) => { draft.reason = e.target.value; } })) : null,
   error,
-  h("div", { class: "sheet-verbs" }, h("button", { type: "submit", class: "btn primary answer-submit", text: form.questions.length > 1 ? "Review answers" : `Submit: ${verb.label}` })));
+  h("div", { class: "sheet-verbs" }, h("button", { type: "submit", class: "btn primary answer-submit", disabled: readOnly(item.tool), text: form.questions.length > 1 ? "Review answers" : `Submit: ${verb.label}` })));
   return el;
 }
 function openAnswer(item, verb) {
@@ -1331,7 +1358,9 @@ function watchSeen(key) {
   }, 250) : null;
 }
 async function sendSeen(key, explicit) {
+  // A read-only node refuses every action, seen receipts included: send nothing, record nothing.
   const item = visibleItems().find((i) => i.key === key);
+  if (readOnly(item?.tool)) return false;
   if (!item?.seen) return false;
   readResults.set(key, item);
   const r = await post(`/p/${item.tool}/action`, { action: item.seen.action, id: item.id, seenAt: new Date().toISOString(), ...(explicit ? { explicit: true } : {}) });
@@ -1340,7 +1369,7 @@ async function sendSeen(key, explicit) {
   return true;
 }
 async function markAllRead(group) {
-  const items = group.filter((i) => i.seen);
+  const items = group.filter((i) => i.seen && !readOnly(i.tool));
   const sent = await Promise.all(items.map((i) => { seen.done.add(i.key); return sendSeen(i.key, true); }));
   await pollInbox();
   toast(`Marked ${plural(sent.filter(Boolean).length, "result")} read`);
@@ -1393,7 +1422,7 @@ function renderPeek() {
   const live = sortedItems().find((i) => i.key === key);
   // A result that was just marked seen stays readable in the open peek.
   const item = live ?? readResults.get(key);
-  const sig = JSON.stringify([key, item ?? null, Boolean(live)]);
+  const sig = JSON.stringify([key, item ?? null, Boolean(live), readOnly()]);
   if (sig === peekSig && !$("sheet").hidden) return;
   peekSig = sig;
   // Keep keyboard focus on the same control when the data changes under it.
@@ -1438,16 +1467,50 @@ function renderPeek() {
 function safe(tool, where, run) {
   try { return run(); } catch (error) { clientError(tool, where, error); return undefined; }
 }
+function staticAssetFrame(url, title) {
+  const frame = h("iframe", { class: "ui-frame", src: "/asset-viewer.html", sandbox: "allow-scripts", title, referrerpolicy: "no-referrer" });
+  const status = h("p", { class: "sub", role: "status", text: "Loading attachment..." });
+  const wrapper = h("div", {}, frame, status, h("a", { class: "ui-link", href: url, target: "_blank", rel: "noopener noreferrer", text: "Open attachment" }));
+  const receive = async (event) => {
+    if (event.source !== frame.contentWindow || event.data?.kind !== "acon-asset-ready") return;
+    window.removeEventListener("message", receive);
+    try {
+      const response = await fetch(url, { credentials: "include", signal: AbortSignal.timeout(10000), redirect: "error" });
+      const mime = response.headers.get("content-type")?.split(";")[0];
+      if (!response.ok || !["application/pdf", "image/png", "image/jpeg", "text/plain", "text/csv"].includes(mime)) throw new Error("unavailable attachment");
+      const chunks = [];
+      let length = 0;
+      const reader = response.body.getReader();
+      for (;;) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        length += value.byteLength;
+        if (length > 32 * 1024 * 1024) { await reader.cancel(); throw new Error("oversized attachment"); }
+        chunks.push(value);
+      }
+      const bytes = new Uint8Array(length);
+      let at = 0;
+      for (const chunk of chunks) { bytes.set(chunk, at); at += chunk.byteLength; }
+      frame.contentWindow.postMessage({ kind: "acon-asset", mime, bytes: bytes.buffer }, "*", [bytes.buffer]);
+      status.textContent = "";
+    } catch { status.textContent = "Attachment unavailable; check this node's authentication in System or use Open attachment."; }
+  };
+  window.addEventListener("message", receive);
+  setTimeout(() => window.removeEventListener("message", receive), 15000);
+  frame.addEventListener("load", () => { if (!frame.isConnected) window.removeEventListener("message", receive); });
+  return wrapper;
+}
+
 function hostFor(tool, p) {
   return {
-    tool: tool.tool,
-    node: NODE,
+    tool: tool.rawTool ?? tool.tool,
+    node: tool.node ?? NODE,
     mount: p.body,
-    ui: kitFor(tool.tool, hashFor, pluginPath, { openSheet: (title) => { peekSig = ""; const b = showSheet(String(title), `panel:${tool.tool}`, true); b.replaceChildren(); return b; }, onError: (error) => clientError(tool.tool, "review comment", error), theme: () => currentTheme().mode, onTheme: (cb) => { p.themeListeners.push(cb); } }),
+    ui: kitFor(tool.tool, hashFor, pluginPath, { frameAsset: staticTransport ? staticAssetFrame : undefined, openSheet: (title) => { peekSig = ""; const b = showSheet(String(title), `panel:${tool.tool}`, true); b.replaceChildren(); return b; }, onError: (error) => clientError(tool.tool, "review comment", error), theme: () => currentTheme().mode, onTheme: (cb) => { p.themeListeners.push(cb); } }),
     get theme() { return currentTheme(); },
     snapshot: async (extra = {}) => (await post(`/p/${tool.tool}/snapshot`, { after: 0, panel: p.panel ?? panelsOf(tool)[0].id, ...extra })).data,
     action: (input) => runAction(tool.tool, input, {}),
-    navigate: (t, panel, params) => navigate(t, panel, params),
+    navigate: (t, panel, params) => navigate(tool.node && !t.includes(":") ? `${tool.node}:${t}` : t, panel, params),
     onSnapshot: (cb) => { p.snapListeners.push(cb); },
     onTheme: (cb) => { p.themeListeners.push(cb); },
     toast: (text, options = {}) => toast(String(text), options),
@@ -1463,8 +1526,8 @@ async function showTool(r) {
     p = { tool: tool.tool, mount: h("div", { class: "panel-mount", "data-tool": tool.tool }, banner, body), banner, body, snapListeners: [], themeListeners: [], instance: null, panel: null, cursor: 0, next: 0, busy: false, loading: null, view: "", gen: 0, lastSig: "" };
     state.panels.set(tool.tool, p);
     $("main").append(p.mount);
-    document.head.append(h("link", { rel: "stylesheet", href: pluginPath(`/p/${tool.tool}/panel.css`) }));
-    p.loading = import(pluginPath(`/p/${tool.tool}/panel.js`)).then((mod) => {
+    const styleReady = staticTransport ? staticTransport.loadStyle(`/p/${tool.tool}/panel.css`, pinnedRefs) : Promise.resolve(document.head.append(h("link", { rel: "stylesheet", href: pluginPath(`/p/${tool.tool}/panel.css`) })));
+    p.loading = styleReady.then(() => import(pluginPath(`/p/${tool.tool}/panel.js`))).then((mod) => {
       if (typeof mod.default !== "function") throw new Error("panel.js has no default export");
       p.instance = mod.default(hostFor(tool, p));
     }).catch((error) => {
@@ -1513,6 +1576,7 @@ async function pollPanel() {
 
 // ---------- actions and confirm ----------
 async function runAction(tool, input, opts) {
+  if (readOnly(tool)) { toast("This console is read-only; actions are turned off.", { tone: "err" }); return { ok: false, readOnly: true }; }
   const r = await post(`/p/${tool}/action`, input);
   const d = r.data;
   if (d?.needsConfirm) {
@@ -1586,7 +1650,7 @@ function showConfirm(tool, d, note, opts) {
       const left = Math.max(0, Math.ceil((deadline - Date.now()) / 1000));
       validity.className = `validity${expired() ? " expired" : ""}`;
       validity.textContent = expired() ? `Preview of version ${shortFp(str(d.fingerprint))} expired.` : `Preview of version ${shortFp(str(d.fingerprint))} · valid ${left} s`;
-      ok.disabled = expired() || (typed && typedInput.value !== typed);
+      ok.disabled = readOnly(tool) || expired() || (typed && typedInput.value !== typed);
       refresh.hidden = !expired();
     };
     function finish(choice) {
@@ -1666,7 +1730,7 @@ function commandOptions(q) {
   const add = (title, sub, run, iconName = "go") => { if (matches(q, title, sub)) out.push({ title, sub, run, icon: iconName }); };
   add("Go to Inbox", "Everything waiting for you", () => navigate("inbox"), "inbox");
   for (const t of readyTools()) {
-    if (q.tool && q.tool !== t.tool) continue;
+    if ((q.tool && q.tool !== t.tool && q.tool !== t.rawTool) || (q.node && q.node !== (t.node ?? NODE))) continue;
     for (const p of panelsOf(t)) add(`Go to ${t.title} / ${p.title}`, t.tool, () => navigate(t.tool, p.id), toolIcon(t));
   }
   if (!q.tool) {
@@ -1680,15 +1744,15 @@ function commandOptions(q) {
 }
 // Plugin commands run through action(), so a destructive one gets the same confirm dialog as a verb.
 function pluginCommandSections(q) {
-  if (q.needsMe || q.id || (q.node && q.node !== NODE)) return [];
-  return readyTools().filter((t) => !q.tool || q.tool === t.tool).map((t) => [`${t.title} commands`,
+  if (q.needsMe || q.id || (!staticTransport && q.node && q.node !== NODE)) return [];
+  return readyTools().filter((t) => (!q.tool || q.tool === t.tool || q.tool === t.rawTool) && (!q.node || q.node === (t.node ?? NODE))).map((t) => [`${t.title} commands`,
     (Array.isArray(t.commands) ? t.commands : []).filter((c) => c && str(c.id) && str(c.title) && str(c.action) && matches(q, c.title, c.hint, t.title))
       .map((c) => ({ title: c.title, sub: [t.title, str(c.hint)].filter(Boolean).join(" · "), icon: toolIcon(t),
         run: () => runAction(t.tool, { ...(c.input && typeof c.input === "object" ? c.input : {}), action: c.action }, { label: c.title }) }))]);
 }
 function inboxOptions(q) {
-  if (q.node && q.node !== NODE) return [];
-  return sortedItems().filter((i) => (!q.tool || q.tool === i.tool) && (!q.needsMe || NEEDS_ME.has(i.group)) && (!q.id || i.id === q.id) && matches(q, i.title, i.kind, i.project, i.actor))
+  if (!staticTransport && q.node && q.node !== NODE) return [];
+  return sortedItems().filter((i) => (!q.node || q.node === (toolById(i.tool)?.node ?? NODE)) && (!q.tool || q.tool === i.tool || q.tool === toolById(i.tool)?.rawTool) && (!q.needsMe || NEEDS_ME.has(i.group)) && (!q.id || i.id === q.id) && matches(q, i.title, i.kind, i.project, i.actor))
     .slice(0, 8).map((i) => ({ title: i.title, sub: subline(i), icon: i.group === "alert" ? "alert" : i.group === "decision" ? "you" : i.group, run: () => { navigate("inbox", undefined, { id: i.key }); }, peek: () => { navigate("inbox"); selectKey(i.key); openPeek(i.key); } }));
 }
 function renderPalette(searchGroups) {
@@ -1724,7 +1788,7 @@ async function searchPalette() {
   const seq = ++palSeq;
   const q = parseQuery($("palette-input").value);
   const text = q.words.join(" ");
-  const tools = readyTools().filter((t) => t.capabilities?.search && (!q.tool || q.tool === t.tool) && !q.needsMe && !q.id && (!q.node || q.node === NODE));
+  const tools = readyTools().filter((t) => t.capabilities?.search && (!q.tool || q.tool === t.tool || q.tool === t.rawTool) && !q.needsMe && !q.id && (!q.node || q.node === (t.node ?? NODE)));
   if (text.length < 2 || !tools.length) { renderPalette([]); return; }
   renderPalette([]);
   const groups = await Promise.all(tools.map(async (t) => {
@@ -1864,7 +1928,7 @@ let miniSig = "";
 function renderMini(force = false) {
   if (miniView.hidden && !pip) return;
   const pet = petChoice(), pose = petState(), items = needsMe(), shown = items.slice(0, 5);
-  const sig = JSON.stringify([pet?.id, pose, shown, items.length, Boolean(pip)]);
+  const sig = JSON.stringify([pet?.id, pose, shown, items.length, Boolean(pip), readOnly()]);
   if (!force && sig === miniSig) return;
   miniSig = sig;
   const fkey = miniView.contains(miniView.ownerDocument.activeElement) ? miniView.ownerDocument.activeElement.dataset.fid : undefined;
@@ -1878,7 +1942,7 @@ function renderMini(force = false) {
       return h("li", { class: "mini-item" },
         h("span", { class: "row-text" }, h("span", { class: "row-title", text: item.title }), h("span", { class: "row-sub", text: [toolById(item.tool)?.title ?? item.tool, ago(item.at)].join(" · ") })),
         h("span", { class: "mini-verbs" },
-          verb ? h("button", { type: "button", class: "btn primary", "data-fid": `v:${item.key}`, onclick: () => runVerb(item, verb, undefined, { mini: true }), text: verb.label }) : null,
+          verb ? h("button", { type: "button", class: "btn primary", "data-fid": `v:${item.key}`, disabled: readOnly(item.tool), onclick: () => runVerb(item, verb, undefined, { mini: true }), text: verb.label }) : null,
           h("button", { type: "button", class: "btn", "data-fid": `o:${item.key}`, "aria-label": `Open ${item.title}`, onclick: () => openInConsole(item), text: "Open" })));
     })) : null,
     items.length > shown.length ? h("p", { class: "sub", text: `${items.length - shown.length} more in the inbox.` }) : null,
@@ -1930,8 +1994,31 @@ async function popOutMini() {
 
 // ---------- system ----------
 let systemSig = "";
+function staticNodeCards() {
+  return staticTransport.nodes.map((node) => {
+    const input = h("input", { type: "password", autocomplete: "off", "data-fid": `token-${node.id}`, "aria-label": `Bearer token for ${node.id}`, oninput: (event) => { node.draft = event.target.value; } });
+    input.value = node.draft ?? "";
+    const reconnect = async (token) => {
+      staticTransport.setToken(node.id, token);
+      node.draft = "";
+      await loadTools();
+      route();
+      await pollInbox();
+    };
+    return h("section", { class: "card", "data-node": node.id },
+      h("h2", { text: node.id }),
+      h("p", { class: "mono", text: node.url }),
+      h("p", { role: "status", "data-node-status": node.id, text: `${node.status}: ${node.detail}` }),
+      h("form", { class: "ui-form", onsubmit: (event) => { event.preventDefault(); void reconnect(input.value); } },
+        h("label", {}, `Bearer token for ${node.id} (this tab only)`, input),
+        h("button", { type: "submit", class: "btn primary", text: "Connect with token" })),
+      h("p", {}, h("a", { href: node.url, target: "_blank", rel: "noopener noreferrer", text: "Open node to sign in with Access" })),
+      h("button", { type: "button", class: "btn", onclick: () => { void reconnect(""); }, text: "Reconnect with Access cookies" }));
+  });
+}
+
 function renderSystem(force = false) {
-  const sig = JSON.stringify([state.node, state.tools, state.serverErrors, state.clientErrors, themeChoice(), state.offline, state.pets, petChoice()?.id ?? "off"]);
+  const sig = JSON.stringify([state.node, state.tools, state.serverErrors, state.clientErrors, themeChoice(), state.offline, state.pets, petChoice()?.id ?? "off", staticTransport?.nodes.map((n) => [n.id, n.status, n.detail])]);
   if (!force && sig === systemSig && $("view-system").childElementCount) return;
   systemSig = sig;
   // Keep keyboard focus on the same control across re-renders.
@@ -1945,7 +2032,8 @@ function renderSystem(force = false) {
     h("dt", { text: "Plugins" }), h("dd", { class: "mono", text: str(node.pluginsDir) }));
   $("view-system").replaceChildren(
     h("h1", { class: "lead", id: "system-title", text: "System" }),
-    h("p", { class: "sub", text: "The console runs on this computer and stops 5 minutes after the last open tab goes away." }),
+    h("p", { class: "sub", text: staticTransport ? "This static shell connects directly to each node. Credentials stay in this tab; actions run on their owner node." : "The console runs on this computer and stops 5 minutes after the last open tab goes away." }),
+    ...(staticTransport ? staticNodeCards() : []),
     h("div", { class: "cards" },
       h("section", { class: "card" }, h("h2", { text: "Node" }), dl),
       h("section", { class: "card" }, h("h2", { text: "Appearance" }),
@@ -1980,6 +2068,8 @@ async function loadTools() {
     return kept ? { ...kept, update: str(t.version) } : t;
   });
   state.node = r.data.node ?? null;
+  state.readOnly = r.data.readOnly === true;
+  updateReadOnly();
   state.pets = Array.isArray(r.data.pets) ? r.data.pets.filter((p) => p && PET_ID.test(str(p.id)) && str(p.name)) : [];
   state.assetPacks = Array.isArray(r.data.assetPacks) ? r.data.assetPacks.filter((p) => p && PET_ID.test(str(p.id)) && Array.isArray(p.images) && p.images.every((id) => PET_ID.test(str(id))) && Array.isArray(p.tile) && p.tile.length === 2 && p.tile.every((n) => Number.isSafeInteger(n) && n > 0)) : [];
   state.serverErrors = Array.isArray(r.data.errors) ? r.data.errors : [];
@@ -2085,6 +2175,24 @@ function tick() {
 
 async function boot() {
   applyTheme();
+  if (document.documentElement.dataset.static === "true") {
+    try {
+      const response = await fetch("/config.json", { cache: "no-store", credentials: "omit" });
+      if (!response.ok) throw new Error("config.json could not load; rebuild and upload the complete static output.");
+      const { createStaticTransport } = await import("./static.js");
+      staticTransport = createStaticTransport(await response.json(), () => { if (state.route.area === "system") renderSystem(true); });
+    } catch (error) { endSession(String(error.message)); return; }
+    state.serve = true;
+    await loadTools();
+    if (!readyTools().length) location.hash = hashFor("system");
+    route();
+    state.nextTools = Date.now() + TOOLS_MS;
+    state.nextInbox = Date.now() + INBOX_MS;
+    setInterval(tick, 1000);
+    await pollInbox();
+    renderLive();
+    return;
+  }
   const m = /^#([0-9a-f]{64})$/.exec(location.hash);
   if (m) {
     history.replaceState(null, "", "/#/local/inbox");

package/shell/static.js

@@ -0,0 +1,111 @@
+// H2 transport. Credentials live only in this tab; the static host serves no node data.
+const NODE_ID = /^[a-z][a-z0-9-]{0,31}$/;
+const TOOL_ID = /^[a-z][a-z0-9-]{1,15}$/;
+const loopback = (host) => host === 'localhost' || host === '[::1]' || /^127\.\d+\.\d+\.\d+$/.test(host);
+
+export function createStaticTransport(config, onStatus = () => {}) {
+  if (config?.api !== 1 || !Array.isArray(config.nodes) || !config.nodes.length || config.nodes.length > 32) throw new Error('Invalid static config; rebuild with acon build --static --nodes id=https://node.example');
+  const ids = new Set();
+  const nodes = config.nodes.map((input) => {
+    let url;
+    try { url = new URL(input?.url); } catch { throw new Error("Invalid node URL in config.json; rebuild with acon build --static --nodes id=https://node.example"); }
+    if (!NODE_ID.test(input.id) || ids.has(input.id) || url.origin !== input.url || (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback(url.hostname)))) throw new Error('Invalid node id or origin in config.json; rebuild with unique ids and exact HTTPS origins');
+    ids.add(input.id);
+    const key = `acon.auth:${input.id}:${url.origin}`;
+    let token = '';
+    try { token = sessionStorage.getItem(key) ?? ''; } catch { /* this tab may disallow storage */ }
+    return { id: input.id, url: url.origin, key, token, status: 'connecting', detail: 'Connecting to node', grant: '', grantUntil: 0, data: null, busy: null };
+  });
+  const notify = (node, status, detail) => { node.status = status; node.detail = detail; onStatus(); };
+  const headersFor = (node, json = true) => ({ ...(json ? { 'Content-Type': 'application/json' } : {}), ...(node.token ? { Authorization: `Bearer ${node.token}` } : {}) });
+  const failed = async (node) => {
+    // A failed CORS fetch and a stopped node look identical to JavaScript. An opaque,
+    // bounded health probe establishes reachability without reading cross-origin data.
+    try {
+      await fetch(`${node.url}/healthz`, { mode: 'no-cors', credentials: 'omit', cache: 'no-store', signal: AbortSignal.timeout(3000) });
+      notify(node, 'refused (origin)', 'Node reachable but browser access refused; add this shell origin to acon serve --origin and check the Access CORS settings.');
+    } catch { notify(node, 'offline', 'Node is unreachable; start acon serve and check the node URL and network.'); }
+    return { status: 0, data: { ok: false, error: node.detail } };
+  };
+  const request = async (node, path, body) => {
+    const action = body !== undefined && /^\/p\/[^/]+\/action$/.test(path);
+    const signal = AbortSignal.timeout(action ? 35000 : 8000);
+    const uncertain = () => ({ status: 0, data: { ok: false, uncertain: true, error: 'The action outcome is unknown because its response was interrupted or invalid; check the node System log and current result before repeating the action.' } });
+    let response;
+    let data = null;
+    try {
+      response = await fetch(`${node.url}${path}`, { method: body === undefined ? 'GET' : 'POST', headers: headersFor(node, body !== undefined), ...(body === undefined ? {} : { body: JSON.stringify(body) }), credentials: 'include', cache: 'no-store', signal, redirect: 'error' });
+      try { data = await response.json(); }
+      catch { if (action && response.status !== 401 && response.status !== 403) return uncertain(); }
+    } catch { return action ? uncertain() : failed(node); }
+    if (response.status === 401 || (response.status === 403 && data?.readOnly !== true)) {
+      node.grant = '';
+      notify(node, 'unauthorized', 'Authentication refused; enter this node\'s bearer token or sign in to its Access application, then reconnect.');
+    } else notify(node, 'online', 'Connected');
+    return { status: response.status, data: data ?? { ok: false, error: `Node answered HTTP ${response.status} without JSON; check its System log.` } };
+  };
+  const connect = async (node) => {
+    if (!node.grant || Date.now() >= node.grantUntil) {
+      const session = await request(node, '/session', { resources: true });
+      if (session.status !== 200 || !/^[0-9a-f]{64}$/.test(session.data.resourceToken ?? '')) return null;
+      node.grant = session.data.resourceToken;
+      node.grantUntil = Date.now() + Math.min(Number(session.data.expiresIn) || 0, 3600000) - 10000;
+    }
+    const result = await request(node, '/tools', {});
+    node.data = result.status === 200 ? result.data : null;
+    return node.data;
+  };
+  const owner = (key) => nodes.find((node) => key.startsWith(`${node.id}:`));
+  const resolve = (path, refs = new Map()) => {
+    const match = /^\/p\/([^/]+)\/(.*)$/.exec(path);
+    if (!match) return null;
+    const node = owner(match[1]);
+    if (!node) return null;
+    const raw = match[1].slice(node.id.length + 1);
+    if (!TOOL_ID.test(raw)) return null;
+    const ref = refs.get(match[1]) ?? raw;
+    if (!new RegExp(`^${raw}(?:@[0-9a-f]{12})?$`).test(ref)) return null;
+    return { node, path: `/p/${ref}/${match[2]}` };
+  };
+  return {
+    nodes,
+    async tools() {
+      // One bounded refresh per node, with no nested retry loop or repeated auth prompt.
+      await Promise.all(nodes.map((node) => node.busy ??= connect(node).finally(() => { node.busy = null; })));
+      const tools = nodes.flatMap((node) => (node.data?.tools ?? []).filter((tool) => TOOL_ID.test(tool?.tool)).map((tool) => ({ ...tool, tool: `${node.id}:${tool.tool}`, rawTool: tool.tool, node: node.id, title: `${node.id}: ${tool.title ?? tool.tool}`, readOnly: node.data.readOnly === true, ...(node.status === 'online' ? {} : { status: 'offline', reason: node.detail }) })));
+      return { status: 200, data: { tools, pets: [], assetPacks: [], node: { id: 'static', version: 'H2' }, errors: [], readOnly: false } };
+    },
+    async post(path, body, refs) {
+      if (path === '/tools') return this.tools();
+      if (path === '/ping') return { status: 200, data: { ok: true } };
+      const route = resolve(path, refs);
+      if (!route) return { status: 404, data: { ok: false, error: 'Unknown node/tool route; reload the static console.' } };
+      if (route.node.status !== "online") return { status: 0, data: { ok: false, error: route.node.detail } };
+      return request(route.node, route.path, body);
+    },
+    resource(path, refs) {
+      const route = resolve(path, refs);
+      if (!route) return path;
+      const url = new URL(route.path, route.node.url);
+      url.searchParams.set('acon_resource', route.node.grant);
+      return url.href;
+    },
+    async loadStyle(path, refs) {
+      const route = resolve(path, refs);
+      if (!route) throw new Error('Unknown plugin stylesheet node; reload the console.');
+      const response = await fetch(this.resource(path, refs), { headers: headersFor(route.node, false), credentials: 'include', signal: AbortSignal.timeout(8000), redirect: 'error' });
+      if (!response.ok) throw new Error('Plugin stylesheet could not load; check this node\'s authentication in System.');
+      // Constructed sheets preserve style-src self: no remote link or inline style element.
+      const sheet = new CSSStyleSheet();
+      sheet.replaceSync(await response.text());
+      document.adoptedStyleSheets = [...document.adoptedStyleSheets, sheet];
+    },
+    setToken(id, token) {
+      const node = nodes.find((item) => item.id === id);
+      if (!node) return;
+      node.token = token.trim(); node.grant = ''; node.data = null;
+      try { if (node.token) sessionStorage.setItem(node.key, node.token); else sessionStorage.removeItem(node.key); } catch { /* memory-only tab */ }
+      notify(node, 'connecting', 'Reconnecting');
+    },
+  };
+}

package/src/cli.ts

@@ -1,18 +1,28 @@
 import pkg from "../package.json" with { type: "json" };
 import { familyHome, loadPlugins, scanPlugins, type PluginEntry } from "./plugins.ts";
 import { startServer } from "./server.ts";
+import { buildStatic } from "./static.ts";
 import { loadPets, petDirs } from "./pets.ts";
 import { loadAssetPacks } from "./assets.ts";
-import { join } from "node:path";
 import { DEFAULT_INDEX, fetchIndex, installPackage, InstallError, printable } from "./install.ts";
-import { serveConfig, type ServeOptions } from "./serve.ts";
+import { serveConfig, type ServeArgs, type ServeOptions } from "./serve.ts";
+import { LABEL, LAUNCHD_ENV, launchdPlist, newTokenFile, tokenPath } from "./setup.ts";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { mkdirSync, realpathSync, writeFileSync } from "node:fs";
 
 const USAGE = `acon ${pkg.version}: local console for agent-hub, agent-mem and vault-mem
 
 Usage:
   acon ui [--no-open] [--json]   serve the console on 127.0.0.1 and print a one-time link
-  acon serve [--host H] [--port P] [--origin https://host]... [--json]
+  acon serve [--host H] [--port P] [--origin https://host]... [--read-only] [--json]
                                  resident console behind Cloudflare Access or a bearer token
+  acon build --static --nodes id=https://origin[,id=origin] [--out dist]
+                                 write the static multi-node shell (no credentials or plugin data)
+  acon token new [--file PATH] [--force]
+                                 write a 0600 bearer token file (default $AGENTHUB_HOME/console/token); prints the path only
+  acon setup launchd [--label ID] [--apply] [serve flags]
+                                 print a LaunchAgent plist for acon serve; --apply installs and loads it
   acon plugins [--json]          list registered plugins and verify their module hashes
   acon install <name|https URL|dir> [--force]
                                  install a pet or asset package
@@ -22,10 +32,12 @@ Usage:
 Plugins register a manifest under $AGENTHUB_HOME/console/plugins (default ~/.agenthub).
 Packages install to $AGENTHUB_HOME/console/pets/<id> or console/assets/<id>; ACON_ASSETS_INDEX overrides the index URL.
 serve auth: ACON_ACCESS_TEAM + ACON_ACCESS_AUD (Cloudflare Access) or ACON_TOKEN_FILE (bearer); required off loopback.
+--read-only or ACON_READ_ONLY=1 refuses every plugin action; snapshots, search and assets keep working.
 The ui server exits 5 minutes after the last request; serve stays up.`;
 
-const COMMANDS: Record<string, string[]> = { ui: ["--no-open", "--json"], plugins: ["--json"], install: ["--list", "--force", "--json"], serve: ["--json"] };
-const VALUED: Record<string, string[]> = { serve: ["--host", "--port", "--origin"] };
+const COMMANDS: Record<string, string[]> = { ui: ["--no-open", "--json"], plugins: ["--json"], install: ["--list", "--force", "--json"], serve: ["--json", "--read-only"], token: ["--force"], setup: ["--apply", "--read-only"], build: ["--static"] };
+const VALUED: Record<string, string[]> = { serve: ["--host", "--port", "--origin"], token: ["--file"], setup: ["--host", "--port", "--origin", "--label"], build: ["--nodes", "--out"] };
+const SUBCOMMANDS: Record<string, string> = { token: "new", setup: "launchd" };
 
 function parse(argv: string[]): { command: string; flags: Set<string>; args: string[]; values: Record<string, string[]> } | string {
   const [command = "help", ...all] = argv;
@@ -43,7 +55,10 @@ function parse(argv: string[]): { command: string; flags: Set<string>; args: str
       (values[name] ??= []).push(value);
     } else rest.push(arg);
   }
-  for (const name of ["--host", "--port"]) if ((values[name]?.length ?? 0) > 1) return `${name} may be given once`;
+  for (const name of ["--host", "--port", "--file", "--label", "--nodes", "--out"]) if ((values[name]?.length ?? 0) > 1) return `${name} may be given once`;
+  const sub = SUBCOMMANDS[command];
+  if (sub && rest[0] !== sub) return `${command} takes the subcommand ${sub}: acon ${command} ${sub}`;
+  if (sub) rest.shift();
   const args = command === "install" ? rest.filter((arg) => !arg.startsWith("--")) : [];
   const unknown = rest.find((arg) => !args.includes(arg) && !allowed.includes(arg));
   if (unknown) return `unknown option for ${command}: ${unknown}`;
@@ -51,6 +66,7 @@ function parse(argv: string[]): { command: string; flags: Set<string>; args: str
   if (command === "install") {
     if (flags.has("--list") ? args.length > 0 || flags.has("--force") : args.length !== 1) return "install takes one package name, https URL or directory, or --list";
   }
+  if (command === "build" && (!flags.has("--static") || !values["--nodes"])) return "build needs --static and --nodes id=https://origin; run acon build --static --nodes desk=https://node.example.com";
   return { command, flags, args, values };
 }
 
@@ -89,17 +105,92 @@ async function install(home: string, source: string | undefined, flags: Set<stri
   }
 }
 
+const serveArgs = (values: Record<string, string[]>, flags: Set<string>): ServeArgs => ({ host: values["--host"]?.[0], port: values["--port"]?.[0], origins: values["--origin"] ?? [], readOnly: flags.has("--read-only") });
+
+function token(home: string, file: string | undefined, force: boolean): number {
+  const path = file ? resolve(file) : tokenPath(home);
+  try { newTokenFile(path, force); }
+  catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    console.error(`acon: ${code === "EEXIST" ? `${path} already exists; it was not changed (use --force to replace it)` : `could not write ${path} (${code ?? (error as Error).message})`}`);
+    return 1;
+  }
+  console.log(path);
+  return 0;
+}
+
+function setupLaunchd(home: string, values: Record<string, string[]>, flags: Set<string>): number {
+  const label = values["--label"]?.[0] ?? "acon.serve";
+  if (!LABEL.test(label)) return fail(`--label ${label} must be letters, digits, dots and hyphens`);
+  // The same refusals as acon serve, checked now rather than in a crash-looping agent.
+  const config = serveConfig(serveArgs(values, flags), process.env);
+  if (typeof config === "string") return fail(config);
+  const env: Record<string, string> = { AGENTHUB_HOME: resolve(home), PATH: "/usr/bin:/bin:/usr/sbin:/sbin" };
+  for (const name of LAUNCHD_ENV) {
+    const value = process.env[name];
+    if (value) env[name] = name === "ACON_TOKEN_FILE" ? resolve(value) : value;
+  }
+  const args = [
+    ...(values["--host"] ? ["--host", values["--host"][0]!] : []), ...(values["--port"] ? ["--port", values["--port"][0]!] : []),
+    ...(values["--origin"] ?? []).flatMap((o) => ["--origin", o]), ...(flags.has("--read-only") ? ["--read-only"] : []),
+  ];
+  const bun = process.execPath;
+  if (!isAbsolute(bun)) return fail(`the bun path ${bun} is not absolute`);
+  const plist = launchdPlist({ label, bun, script: launchScript(resolve(home)), args, env, logDir: join(resolve(home), "console", "logs") });
+  if (!flags.has("--apply")) { process.stdout.write(plist); return 0; }
+  if (process.platform !== "darwin") return fail("--apply needs macOS (launchctl)");
+  const uid = process.getuid?.();
+  if (uid === undefined) return fail("could not read the user id");
+  mkdirSync(join(resolve(home), "console", "logs"), { recursive: true, mode: 0o700 });
+  const dir = join(homedir(), "Library", "LaunchAgents");
+  mkdirSync(dir, { recursive: true });
+  const file = join(dir, `${label}.plist`);
+  writeFileSync(file, plist, { mode: 0o644 });
+  const run = (...argv: string[]) => Bun.spawnSync(["launchctl", ...argv], { stdout: "pipe", stderr: "pipe" });
+  run("bootout", `gui/${uid}/${label}`); // not loaded yet is fine
+  const boot = run("bootstrap", `gui/${uid}`, file);
+  if (boot.exitCode !== 0) return fail(`launchctl bootstrap failed (${boot.exitCode}): ${boot.stderr.toString().trim()}`);
+  const print = run("print", `gui/${uid}/${label}`);
+  console.log(`acon: wrote ${file} and loaded gui/${uid}/${label}`);
+  process.stdout.write(print.stdout.toString());
+  return print.exitCode === 0 ? 0 : 1;
+}
+
+/**
+ * Bun resolves symlinks in import.meta.dir, so a run through the versioned install's `console/current` link reports the
+ * release directory. Pin the link itself in that case, so the agent follows `install-release.ts` to the next release.
+ */
+export function launchScript(home: string, packageRoot = resolve(import.meta.dir, "..")): string {
+  const current = join(home, "console", "current");
+  try { if (realpathSync(current) === realpathSync(packageRoot)) return join(current, "bin", "acon.js"); } catch { /* no versioned install */ }
+  return join(packageRoot, "bin", "acon.js");
+}
+
+const fail = (message: string): number => { console.error(`acon: ${message}`); return 2; };
+
 export async function main(argv: string[]): Promise<number> {
   const parsed = parse(argv);
   if (typeof parsed === "string") { console.error(`acon: ${parsed}\n\n${USAGE}`); return 2; }
   const { command, flags, args, values } = parsed;
   if (["--version", "-v", "version"].includes(command)) { console.log(pkg.version); return 0; }
   if (["help", "--help", "-h"].includes(command)) { console.log(USAGE); return 0; }
+  if (command === "build") {
+    try {
+      const result = await buildStatic(values["--nodes"]![0]!, values["--out"]?.[0]);
+      console.log(`acon: static shell written to ${result.out}; serve that directory over https and allow its origin on each acon serve node`);
+      return 0;
+    } catch (error) {
+      console.error(`acon: static build failed: ${(error as Error).message}; check --nodes and choose an unused --out directory`);
+      return 2;
+    }
+  }
   const home = familyHome();
   if (command === "install") return await install(home, args[0], flags);
+  if (command === "token") return token(home, values["--file"]?.[0], flags.has("--force"));
+  if (command === "setup") return setupLaunchd(home, values, flags);
   let serve: ServeOptions | undefined;
   if (command === "serve") {
-    const config = serveConfig({ host: values["--host"]?.[0], port: values["--port"]?.[0], origins: values["--origin"] ?? [] }, process.env);
+    const config = serveConfig(serveArgs(values, flags), process.env);
     if (typeof config === "string") { console.error(`acon: ${config}`); return 2; }
     serve = config;
   }
@@ -134,10 +225,10 @@ export async function main(argv: string[]): Promise<number> {
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
   if (serve) {
-    const info = { origin: server.origin, port: server.port, mode: serve.mode, origins: serve.origins, pid: process.pid, plugins: plugins.map(summary) };
+    const info = { origin: server.origin, port: server.port, mode: serve.mode, readOnly: Boolean(serve.readOnly), origins: serve.origins, pid: process.pid, plugins: plugins.map(summary) };
     if (flags.has("--json")) console.log(JSON.stringify(info));
     else {
-      console.log(`acon: serving on ${serve.hostname}:${server.port} (${serve.mode === "access" ? "Cloudflare Access" : serve.mode === "bearer" ? "bearer token" : "loopback, no auth"}); allowed origins: ${serve.origins.join(", ")}`);
+      console.log(`acon: serving on ${serve.hostname}:${server.port} (${serve.mode === "access" ? "Cloudflare Access" : serve.mode === "bearer" ? "bearer token" : "loopback, no auth"})${serve.readOnly ? ", read-only" : ""}; allowed origins: ${serve.origins.join(", ")}`);
       if (scan.error) log(scan.error);
       for (const p of plugins) if (p.status !== "ready") log(`${p.tool} not loaded (${p.status}): ${p.reason}`);
     }

package/src/serve.ts

@@ -10,12 +10,14 @@ export type Authenticate = (req: Request) => Promise<string | null>;
 export interface ServeOptions {
   hostname: string;
   port: number;
-  /** Exact browser origins allowed for POST; their hosts (plus the bind address) are the allowed Host values. */
+  /** Exact browser origins allowed for POST and credentialed CORS; include the node public origin too, since their hosts (plus the bind address) are the allowed Host values. */
   origins: string[];
   hosts: string[];
   /** Returns the verified principal (the session key confirm tokens bind to) or null for 401. */
   authenticate: Authenticate;
   mode: "access" | "bearer" | "loopback";
+  /** #45: every plugin action is refused without calling the plugin; snapshots, search and assets are unchanged. */
+  readOnly?: boolean;
 }
 
 const SKEW_S = 60;
@@ -131,10 +133,17 @@ export function bearerVerifier(file: string): ((header: string | null) => boolea
   };
 }
 
-export interface ServeArgs { host?: string; port?: string; origins: string[] }
+export interface ServeArgs { host?: string; port?: string; origins: string[]; readOnly?: boolean }
 
 /** Builds the serve options from flags and the environment; a string is a refusal to print. */
 export function serveConfig(args: ServeArgs, env: Record<string, string | undefined>, certsUrl?: string): ServeOptions | string {
+  const raw = env.ACON_READ_ONLY;
+  if (raw !== undefined && raw !== "" && raw !== "0" && raw !== "1") return "ACON_READ_ONLY must be 1 (read-only) or 0";
+  const config = authConfig(args, env, certsUrl);
+  return typeof config === "string" || !(args.readOnly || raw === "1") ? config : { ...config, readOnly: true };
+}
+
+function authConfig(args: ServeArgs, env: Record<string, string | undefined>, certsUrl?: string): ServeOptions | string {
   const hostname = args.host ?? "127.0.0.1";
   if (!/^[A-Za-z0-9.:[\]-]+$/.test(hostname)) return `--host ${hostname} is not a host name or address`;
   const port = Number(args.port ?? (env.ACON_PORT || "8787"));

package/src/server.ts

@@ -128,6 +128,7 @@ export function startServer(options: ServerOptions) {
   };
   const tickets = new Map<string, { expires: number }>();
   const sessions = new Map<string, { expires: number }>();
+  const resources = new Map<string, { expires: number; principal: string; origin: string }>();
   const confirms = new Map<string, { expires: number; session: string; tool: string; input: string; fingerprint: string }>();
   const errors: ConsoleError[] = [];
   let lastSeen = now();
@@ -208,6 +209,8 @@ export function startServer(options: ServerOptions) {
   }
 
   async function action(entry: PluginEntry, session: string, input: Record<string, unknown>, meta: ActionMeta) {
+    // #45: first, before any token lookup, so a replayed confirm token is neither honoured nor consumed.
+    if (serve?.readOnly) return reject(403, "read-only node", { readOnly: true });
     const name = input.action;
     if (typeof name !== "string" || !ACTION_ID.test(name)) return reject(400, "invalid action");
     const declared = entry.manifest!.capabilities?.actions;
@@ -255,15 +258,10 @@ export function startServer(options: ServerOptions) {
     return json(result);
   }
 
-  const server = Bun.serve({
-    hostname: serve ? serve.hostname.replace(/^\[(.*)\]$/, "$1") : "127.0.0.1",
-    port: serve?.port ?? 0,
-    maxRequestBodySize: 32 * 1024,
-    idleTimeout: 60,
-    async fetch(req): Promise<Response> {
+  async function handle(req: Request): Promise<Response> {
       const url = new URL(req.url);
       const path = url.pathname;
-      // H1 health probe: no auth, no body, before every other check so container and tunnel probes work.
+      // H1 health probe stays public, including the opaque reachability probe used by H2.
       if (serve && path === "/healthz" && (req.method === "GET" || req.method === "HEAD")) return new Response(null, { status: 204, headers: HEADERS });
       lastSeen = now();
       if (!serve) armIdle();
@@ -271,8 +269,18 @@ export function startServer(options: ServerOptions) {
       const requestOrigin = req.headers.get("origin");
       const originOk = requestOrigin !== null && (serve ? serve.origins.includes(requestOrigin) : requestOrigin === origin);
       if (requestOrigin !== null && !originOk) return reject(403, "forbidden origin");
-      // Under serve the verified identity is the session: every route needs it, the shell files too.
-      const principal = serve ? await serve.authenticate(req) : null;
+      if (serve && req.method === "OPTIONS") {
+        const method = req.headers.get("access-control-request-method");
+        const headers = (req.headers.get("access-control-request-headers") ?? "").toLowerCase().split(",").map((h) => h.trim()).filter(Boolean);
+        if (!originOk || !["GET", "POST"].includes(method ?? "") || headers.some((h) => !["authorization", "content-type"].includes(h))) return reject(403, "CORS preflight refused; use a configured --origin and GET or POST with authorization/content-type only");
+        return new Response(null, { status: 204, headers: { ...HEADERS, "Access-Control-Allow-Methods": "GET, POST", "Access-Control-Allow-Headers": "Authorization, Content-Type", "Access-Control-Max-Age": "300" } });
+      }
+      prune(resources);
+      const grant = resources.get(url.searchParams.get("acon_resource") ?? "");
+      const resourcePath = /^\/(?:p\/[^/]+\/(?:panel\.js|panel\.css|asset)|pets\/[^/]+\/sheet|assets\/[^/]+\/[^/]+|models\/[^/]+\/[^/]+)$/.test(path);
+      const resourceGrant = serve && req.method === "GET" && resourcePath && grant && (!requestOrigin || requestOrigin === grant.origin) && serve.origins.includes(grant.origin) ? grant : undefined;
+      // A resource grant is GET-only. It cannot authenticate JSON, action or session requests.
+      const principal = serve ? (resourceGrant?.principal ?? await serve.authenticate(req)) : null;
       if (serve && principal === null) return reject(401, "authentication required");
       prune(tickets);
       prune(sessions);
@@ -301,7 +309,7 @@ export function startServer(options: ServerOptions) {
           if (!live) return reject(401, "session expired or missing; run acon ui");
           // Same-origin fetches and frames only; the SameSite=Strict cookie already keeps cross-site requests out.
           const site = req.headers.get("sec-fetch-site");
-          if (site !== null && site !== "same-origin" && site !== "none") return reject(403, "cross-site asset request");
+          if (!resourceGrant && !(serve && originOk) && site !== null && site !== "same-origin" && site !== "none") return reject(403, "cross-site asset request");
           const entry = pluginEntry();
           if (!entry) return unknownTool();
           return pluginAsset(entry, url.searchParams.get("id"));
@@ -352,7 +360,16 @@ export function startServer(options: ServerOptions) {
       // Every accepted body has a canonical form; this refuses numbers like 1e400 that would collide with null.
       try { canonical(input); } catch { return reject(400, "numbers must be finite"); }
       if (path === "/session") {
-        if (serve) return json({ ok: true, mode: "serve" });
+        if (serve) {
+          if (input.resources === true) {
+            if (!originOk) return reject(403, "resource grants need a configured browser --origin; add the static shell origin to acon serve");
+            cap(resources);
+            const resourceToken = secret();
+            resources.set(resourceToken, { expires: now() + SESSION_MS, principal: principal!, origin: requestOrigin! });
+            return json({ ok: true, mode: "serve", resourceToken, expiresIn: SESSION_MS });
+          }
+          return json({ ok: true, mode: "serve" });
+        }
         const ticket = typeof input.ticket === "string" ? input.ticket : "";
         if (!tickets.delete(ticket)) return reject(401, "this link was already used or has expired; run acon ui");
         cap(sessions);
@@ -363,15 +380,30 @@ export function startServer(options: ServerOptions) {
       if (path === "/ping") return json({ ok: true });
       if (path === "/tools") {
         await refresh();
-        return json({ ok: true, node: { id: "local", version: options.version, startedAt, pluginsDir: options.pluginsDir, pluginsError: options.pluginsError }, tools: toolList(), pets: pets.map(({ id, name, description }) => ({ id, name, ...(description ? { description } : {}) })), assetPacks: assetPacks.map(({ id, name, version, tile, images, models }) => ({ id, name, version, tile, images: Object.keys(images), ...(models ? { models: Object.keys(models) } : {}) })), errors });
+        return json({ ok: true, ...(serve?.readOnly ? { readOnly: true } : {}), node: { id: "local", version: options.version, startedAt, pluginsDir: options.pluginsDir, pluginsError: options.pluginsError }, tools: toolList(), pets: pets.map(({ id, name, description }) => ({ id, name, ...(description ? { description } : {}) })), assetPacks: assetPacks.map(({ id, name, version, tile, images, models }) => ({ id, name, version, tile, images: Object.keys(images), ...(models ? { models: Object.keys(models) } : {}) })), errors });
       }
       const entry = pluginEntry();
       if (!entry) return unknownTool();
       return plugin![2] === "snapshot" ? snapshot(entry, input) : action(entry, cookie!, input, { identity: serve ? principal! : "local", node: "local", via: "console" });
-    },
-    error(error) {
-      log(`request failed: ${error.message}`);
-      return reject(500, "console request failed");
+  }
+  const server = Bun.serve({
+    hostname: serve ? serve.hostname.replace(/^\[(.*)\]$/, "$1") : "127.0.0.1",
+    port: serve?.port ?? 0,
+    maxRequestBodySize: 32 * 1024,
+    idleTimeout: 60,
+    async fetch(req): Promise<Response> {
+      let response: Response;
+      try { response = await handle(req); }
+      catch (error) { log(`request failed: ${(error as Error).message}`); response = reject(500, "console request failed"); }
+      if (serve) {
+        response.headers.set("Vary", "Origin");
+        const requestOrigin = req.headers.get("origin");
+        if (requestOrigin && serve.origins.includes(requestOrigin)) {
+          response.headers.set("Access-Control-Allow-Origin", requestOrigin);
+          response.headers.set("Access-Control-Allow-Credentials", "true");
+        }
+      }
+      return response;
     },
   });
   const host = `127.0.0.1:${server.port}`;
@@ -393,6 +425,7 @@ export function startServer(options: ServerOptions) {
     tickets.clear();
     sessions.clear();
     confirms.clear();
+    resources.clear();
     server.stop(true);
     // Each provider gets 5 s to close; a hanging one never keeps the process alive.
     await Promise.all([...refs.values()].map((entry) => withTimeout(Promise.resolve().then(() => entry.provider!.close?.()), 5_000, `${entry.tool} close`)

package/src/setup.ts

@@ -0,0 +1,74 @@
+import { randomBytes } from "node:crypto";
+import { closeSync, fchmodSync, mkdirSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+/**
+ * #45 follow-ups of `acon serve` (H1): a bearer token file and a macOS LaunchAgent.
+ * Neither prints or embeds a token value.
+ */
+
+export const tokenPath = (home: string): string => join(home, "console", "token");
+
+/**
+ * Writes 32 random bytes as base64url, mode 0600. Without `force` the file is created with O_EXCL, so an existing
+ * file (or a symlink) is refused and left as it was; with `force` a new file replaces it by rename.
+ */
+export function newTokenFile(path: string, force: boolean): void {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  const token = `${randomBytes(32).toString("base64url")}\n`;
+  const target = force ? `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp` : path;
+  const fd = openSync(target, "wx", 0o600);
+  try {
+    fchmodSync(fd, 0o600); // independent of the umask
+    writeSync(fd, token);
+  } catch (error) {
+    closeSync(fd);
+    rmSync(target, { force: true });
+    throw error;
+  }
+  closeSync(fd);
+  if (force) {
+    try { renameSync(target, path); } catch (error) { rmSync(target, { force: true }); throw error; }
+  }
+}
+
+export const LABEL = /^[A-Za-z0-9][A-Za-z0-9.-]{0,127}$/;
+/** Environment names `setup launchd` copies into the plist. ACON_TOKEN_FILE is a path; no token value is ever copied. */
+export const LAUNCHD_ENV = ["ACON_TOKEN_FILE", "ACON_ACCESS_TEAM", "ACON_ACCESS_AUD", "ACON_ORIGINS", "ACON_PORT", "ACON_READ_ONLY"] as const;
+
+const xml = (s: string) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+const str = (s: string) => `<string>${xml(s)}</string>`;
+
+export interface LaunchdOptions { label: string; bun: string; script: string; args: string[]; env: Record<string, string>; logDir: string }
+
+/** A LaunchAgent that keeps `bun bin/acon.js serve ...` running, with logs under `logDir`. */
+export function launchdPlist(o: LaunchdOptions): string {
+  const env = Object.entries(o.env).map(([k, v]) => `\t\t<key>${xml(k)}</key>\n\t\t${str(v)}`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+\t<key>Label</key>
+\t${str(o.label)}
+\t<key>ProgramArguments</key>
+\t<array>
+${[o.bun, o.script, "serve", ...o.args].map((a) => `\t\t${str(a)}`).join("\n")}
+\t</array>
+\t<key>EnvironmentVariables</key>
+\t<dict>
+${env}
+\t</dict>
+\t<key>RunAtLoad</key>
+\t<true/>
+\t<key>KeepAlive</key>
+\t<true/>
+\t<key>ProcessType</key>
+\t<string>Background</string>
+\t<key>StandardOutPath</key>
+\t${str(join(o.logDir, `${o.label}.out.log`))}
+\t<key>StandardErrorPath</key>
+\t${str(join(o.logDir, `${o.label}.err.log`))}
+</dict>
+</plist>
+`;
+}

package/src/static.ts

@@ -0,0 +1,102 @@
+import { lstat, mkdir, mkdtemp, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { isLoopback } from "./serve.ts";
+import { FRAME_CSP } from "./server.ts";
+
+export interface StaticNode { id: string; url: string }
+export interface StaticConfig { api: 1; nodes: StaticNode[] }
+export interface StaticBuild { out: string; config: StaticConfig }
+const NODE_ID = /^[a-z][a-z0-9-]{0,31}$/;
+const MAX_NODES = 32;
+
+/** Build configuration contains public origins only, never credentials, paths or plugin records. */
+export function parseStaticNodes(raw: string): StaticConfig {
+  if (!raw || raw.length > 8192) throw new Error("--nodes needs 1-32 id=https://origin entries; pass --nodes desk=https://node.example.com");
+  const parts = raw.split(",");
+  if (parts.length > MAX_NODES) throw new Error("--nodes has more than 32 nodes; split the build into at most 32 nodes");
+  const ids = new Set<string>();
+  const nodes = parts.map((part): StaticNode => {
+    const equal = part.indexOf("=");
+    const id = part.slice(0, equal);
+    const address = part.slice(equal + 1);
+    if (equal < 1 || !NODE_ID.test(id) || ids.has(id)) throw new Error("--nodes needs unique lowercase node ids (1-32 letters, digits or hyphens, starting with a letter); correct the id=origin entries");
+    let url: URL;
+    try { url = new URL(address); }
+    catch { throw new Error("--nodes contains an invalid URL; use an exact https origin such as desk=https://node.example.com"); }
+    if (address.length > 1024 || url.username || url.password || url.search || url.hash || url.origin !== address.replace(/\/$/, "") ||
+      (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback(url.hostname)))) {
+      throw new Error("--nodes accepts exact https origins without credentials, paths, queries or fragments (http only for loopback); correct the node URL before building");
+    }
+    ids.add(id);
+    return { id, url: url.origin };
+  });
+  return { api: 1, nodes };
+}
+
+export function staticCsp(config: StaticConfig): string {
+  const origins = [...new Set(config.nodes.map((node) => node.url))].join(" ");
+  return `default-src 'none'; script-src 'self' ${origins}; style-src 'self'; connect-src 'self' ${origins}; img-src 'self' data: ${origins}; base-uri 'none'; form-action 'none'; frame-src 'self'; frame-ancestors 'none'`;
+}
+
+const FILES: [string, string][] = [
+  ...["shell.js", "static.js", "shell.css", "space.js", "space-view.js", "space3d.js", "icon.svg", "asset-viewer.html", "asset-viewer.js", "asset-viewer.css"].map((file): [string, string] => [file, file]),
+  ...["three.module.js", "three.core.js", "GLTFLoader.js", "BufferGeometryUtils.js", "SkeletonUtils.js", "NOTICE", "manifest.json"].map((file): [string, string] => [`vendor/${file}`, `vendor/${file}`]),
+  ["visual-frame.html", "visual/frame.html"], ["visual-frame.css", "visual/frame.css"], ["visual-frame.js", "visual/frame.js"],
+  ["vendor/mermaid/mermaid.js", "visual/mermaid.js"], ["vendor/mermaid/NOTICE", "visual/NOTICE"], ["vendor/mermaid/manifest.json", "visual/manifest.json"],
+];
+export const VIEWER_CSP = "default-src 'none'; script-src 'self'; style-src 'self'; img-src blob:; frame-src blob:; base-uri 'none'; form-action 'none'; frame-ancestors 'self'";
+const BASE_HEADERS = {
+  "Cache-Control": "no-store", "Referrer-Policy": "no-referrer", "X-Content-Type-Options": "nosniff",
+};
+const headerLines = (headers: Record<string, string>) => Object.entries(headers).map(([key, value]) => `  ${key}: ${value}`).join("\n");
+
+/** Write a fixed, credential-free shell into a new destination, publishing only a complete staged tree. */
+export async function buildStatic(raw: string, out = "dist"): Promise<StaticBuild> {
+  const config = parseStaticNodes(raw);
+  const target = resolve(out);
+  try { await lstat(target); throw new Error("static output already exists; choose a new --out directory or move the existing output first"); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+  await mkdir(dirname(target), { recursive: true });
+  const parent = await realpath(dirname(target));
+  const destination = join(parent, target.slice(dirname(target).length + 1));
+  const stage = await mkdtemp(join(parent, ".acon-static-"));
+  try {
+    const csp = staticCsp(config);
+    // frame-ancestors is header-only; browsers report it as ignored in a meta policy.
+    const metaCsp = csp.replace("; frame-ancestors 'none'", "");
+    const shellRoot = new URL("../shell/", import.meta.url);
+    const source = await readFile(new URL("index.html", shellRoot), "utf8");
+    const index = source.replace('<html lang="en">', '<html lang="en" data-static="true">').replace('<meta charset="utf-8">', `<meta charset="utf-8">\n<meta http-equiv="Content-Security-Policy" content="${metaCsp}">`);
+    await writeFile(join(stage, "index.html"), index);
+    for (const [sourceName, destinationName] of FILES) {
+      const sourceUrl = new URL(sourceName, shellRoot);
+      const info = await lstat(sourceUrl);
+      if (!info.isFile() || info.isSymbolicLink()) throw new Error("a static shell source is not a regular file; reinstall the console package before building");
+      const file = join(stage, destinationName);
+      await mkdir(dirname(file), { recursive: true });
+      await writeFile(file, await readFile(sourceUrl));
+    }
+    await writeFile(join(stage, "config.json"), `${JSON.stringify(config, null, 2)}\n`);
+    // Keep document policies disjoint: Workers joins duplicate matching header values, so a broad CSP would
+    // also restrict the sandboxed frame's separate measuring policy.
+    const documents = ["/", "/index.html"];
+    const frameDocuments = ["/visual/frame", "/visual/frame.html"];
+    const viewerDocuments = ["/asset-viewer", "/asset-viewer.html"];
+    const headers = `/*\n${headerLines(BASE_HEADERS)}\n\n${documents.map((path) => `${path}\n${headerLines({ "Content-Security-Policy": csp, "X-Frame-Options": "DENY" })}`).join("\n\n")}\n\n${frameDocuments.map((path) => `${path}\n${headerLines({ "Content-Security-Policy": FRAME_CSP, "X-Frame-Options": "SAMEORIGIN" })}`).join("\n\n")}\n\n${viewerDocuments.map((path) => `${path}\n${headerLines({ "Content-Security-Policy": VIEWER_CSP, "X-Frame-Options": "SAMEORIGIN" })}`).join("\n\n")}\n`;
+    await writeFile(join(stage, "_headers"), headers);
+    await writeFile(join(stage, "vercel.json"), `${JSON.stringify({ version: 2, cleanUrls: true, headers: [
+      { source: "/(.*)", headers: Object.entries(BASE_HEADERS).map(([key, value]) => ({ key, value })) },
+      ...documents.map((path) => ({ source: path, headers: [{ key: "Content-Security-Policy", value: csp }, { key: "X-Frame-Options", value: "DENY" }] })),
+      ...frameDocuments.map((path) => ({ source: path, headers: [{ key: "Content-Security-Policy", value: FRAME_CSP }, { key: "X-Frame-Options", value: "SAMEORIGIN" }] })),
+      ...viewerDocuments.map((path) => ({ source: path, headers: [{ key: "Content-Security-Policy", value: VIEWER_CSP }, { key: "X-Frame-Options", value: "SAMEORIGIN" }] })),
+    ] }, null, 2)}\n`);
+    await writeFile(join(stage, "wrangler.jsonc"), `${JSON.stringify({ name: "acon-static-shell", compatibility_date: "2026-11-04", assets: { directory: ".", html_handling: "auto-trailing-slash", not_found_handling: "none" } }, null, 2)}\n`);
+    await writeFile(join(stage, ".assetsignore"), "vercel.json\nwrangler.jsonc\n.assetsignore\n");
+    // rename refuses a nonempty directory, file or symlink that appeared while staging; no existing content is removed.
+    await rename(stage, destination);
+    return { out: destination, config };
+  } catch (error) {
+    await rm(stage, { recursive: true, force: true });
+    throw error;
+  }
+}