@tickernelz/paperclip-pro-server 2026.1017.2 → 2026.1021.0

package/dist/routes/local-browser.js

@@ -0,0 +1,282 @@
+import { Router } from "express";
+import { z } from "zod";
+import { LOCAL_BROWSER_VIEWER_FRAME_INTERVAL_MS, localBrowserInputSchema, localBrowserPairingStartSchema, localBrowserSettingsSchema, localBrowserViewerEventSchema, } from "@tickernelz/paperclip-pro-shared";
+import { badRequest, forbidden, notFound, payloadTooLarge } from "../errors.js";
+import { assertBoard, assertCompanyAccess, getActorInfo } from "./authz.js";
+import { localBrowserFailure } from "../services/local-browser/errors.js";
+import { createPairing, pairingResult, pairingStatusForCompany } from "../services/local-browser/pairing.js";
+import { subscribeViewer, viewerCount } from "../services/local-browser/registry.js";
+import { localBrowserService } from "../services/local-browser/service.js";
+const MAX_INPUT_BODY_BYTES = 16 * 1024;
+export const LOCAL_BROWSER_JSON_BODY_LIMIT = "16kb";
+const SSE_KEEPALIVE_MS = 15_000;
+const sessionIdSchema = z.string().uuid();
+export function localBrowserBodyLimit() {
+    return (req, res, next) => {
+        const declared = Number(req.get("content-length") ?? "0");
+        if (Number.isFinite(declared) && declared > MAX_INPUT_BODY_BYTES) {
+            res.status(413).json({ error: "Local browser requests are limited to " + MAX_INPUT_BODY_BYTES + " bytes" });
+            return;
+        }
+        next();
+    };
+}
+export function localBrowserBodyErrorHandler() {
+    return (err, _req, res, next) => {
+        const candidate = err;
+        if (candidate && (candidate.type === "entity.too.large" || candidate.status === 413)) {
+            res.status(413).json({ error: "Local browser requests are limited to " + MAX_INPUT_BODY_BYTES + " bytes" });
+            return;
+        }
+        next(err);
+    };
+}
+function assertBoardUser(req) {
+    if (req.actor.type !== "board") {
+        throw forbidden("Local browser takeover requires a signed-in board user");
+    }
+    assertBoard(req);
+}
+function auditActor(req) {
+    if (req.actor.type === "agent") {
+        return { actorType: "agent", actorId: req.actor.agentId ?? req.actor.userId ?? "agent" };
+    }
+    if (req.actor.type === "board") {
+        return { actorType: "user", actorId: req.actor.userId ?? "board-user" };
+    }
+    return { actorType: "system", actorId: "local-browser" };
+}
+function resolveCompanyId(req) {
+    const raw = req.query.companyId;
+    const requested = typeof raw === "string" && raw.trim().length > 0 ? raw.trim() : null;
+    if (requested) {
+        assertCompanyAccess(req, requested);
+        return requested;
+    }
+    if (req.actor.type === "agent" && req.actor.companyId)
+        return req.actor.companyId;
+    const companies = req.actor.companyIds ?? [];
+    if (companies.length === 1) {
+        assertCompanyAccess(req, companies[0]);
+        return companies[0];
+    }
+    throw badRequest("companyId is required when the actor belongs to more than one company");
+}
+function bridgeConnectUrls(req, code) {
+    const forwardedProto = String(req.get("x-forwarded-proto") ?? "").split(",")[0]?.trim();
+    const proto = forwardedProto || req.protocol || "http";
+    const host = req.get("host") ?? "localhost";
+    const httpUrl = proto + "://" + host + "/api/local-browser/bridge?code=" + encodeURIComponent(code);
+    const wsUrl = (proto === "https" ? "wss" : "ws") + "://" + host + "/api/local-browser/bridge?code=" + encodeURIComponent(code);
+    return [wsUrl, httpUrl];
+}
+export function localBrowserRoutes(db, service = localBrowserService(db)) {
+    const router = Router();
+    router.use("/local-browser", (req, res, next) => {
+        assertBoard(req);
+        res.setHeader("Cache-Control", "no-store");
+        next();
+    });
+    router.post("/local-browser/pairing", async (req, res) => {
+        const companyId = resolveCompanyId(req);
+        const body = localBrowserPairingStartSchema.parse(req.body ?? {});
+        const actor = getActorInfo(req);
+        const pairing = createPairing({
+            companyId,
+            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+            createdByAgentId: actor.actorType === "agent" ? actor.actorId : null,
+            label: body.label ?? null,
+            client: body.client ?? null,
+        });
+        res.status(201).json(pairingResult(pairing, bridgeConnectUrls(req, pairing.code)));
+    });
+    router.get("/local-browser/pairing/:code", async (req, res) => {
+        const companyId = resolveCompanyId(req);
+        const code = String(req.params.code ?? "").trim();
+        res.json(pairingStatusForCompany(code, companyId));
+    });
+    router.get("/local-browser/sessions", async (req, res) => {
+        const companyId = resolveCompanyId(req);
+        res.json({ sessions: service.listSessions(companyId) });
+    });
+    router.delete("/local-browser/sessions/:id", async (req, res) => {
+        const companyId = resolveCompanyId(req);
+        const sessionId = sessionIdSchema.parse(req.params.id);
+        const live = service.getSessionForCompany(companyId, sessionId);
+        if (!live)
+            throw notFound("Browser session is not connected");
+        await service.disconnect(sessionId);
+        res.json({ ok: true });
+    });
+    router.get("/local-browser/sessions/:id/viewer", async (req, res) => {
+        assertBoardUser(req);
+        const companyId = resolveCompanyId(req);
+        const sessionId = sessionIdSchema.parse(req.params.id);
+        const session = service.getSessionForCompany(companyId, sessionId);
+        if (!session)
+            throw notFound("Browser session is not connected");
+        res.status(200);
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-store, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.setHeader("X-Accel-Buffering", "no");
+        res.setHeader("Referrer-Policy", "no-referrer");
+        res.flushHeaders?.();
+        let finished = false;
+        let keepalive = null;
+        let unsubscribe = () => { };
+        const stopFrames = () => {
+            void service
+                .sendInternalCall(session, "local_browser_viewer", { op: "stop" })
+                .catch(() => undefined);
+        };
+        const finish = () => {
+            if (finished)
+                return;
+            finished = true;
+            if (keepalive)
+                clearInterval(keepalive);
+            unsubscribe();
+            if (viewerCount(session) === 0)
+                stopFrames();
+            if (!res.writableEnded)
+                res.end();
+        };
+        const write = (payload) => {
+            const parsed = localBrowserViewerEventSchema.safeParse(payload);
+            if (!parsed.success)
+                return;
+            if (!res.writableEnded)
+                res.write("data: " + JSON.stringify(parsed.data) + "\n\n");
+            if (parsed.data.type === "state" && parsed.data.state === "disconnected")
+                finish();
+        };
+        write({ type: "state", state: "connected" });
+        const wasIdle = viewerCount(session) === 0;
+        const actor = auditActor(req);
+        unsubscribe = subscribeViewer(session, write);
+        if (wasIdle) {
+            const startedAt = Date.now();
+            void service
+                .sendInternalCall(session, "local_browser_viewer", {
+                op: "start",
+                intervalMs: LOCAL_BROWSER_VIEWER_FRAME_INTERVAL_MS,
+            })
+                .then(() => service.auditInternal({
+                companyId,
+                tool: "local_browser_viewer",
+                sessionId,
+                tabId: null,
+                origin: null,
+                tier: session.tier,
+                ok: true,
+                durationMs: Date.now() - startedAt,
+                errorCode: null,
+                ...actor,
+            }))
+                .catch((error) => {
+                const code = error && typeof error === "object" && "code" in error
+                    ? String(error.code)
+                    : "local_browser_protocol_error";
+                write({ type: "state", state: "viewer_unavailable", message: "Live view is unavailable: " + code });
+                return service.auditInternal({
+                    companyId,
+                    tool: "local_browser_viewer",
+                    sessionId,
+                    tabId: null,
+                    origin: null,
+                    tier: session.tier,
+                    ok: false,
+                    durationMs: Date.now() - startedAt,
+                    errorCode: code,
+                    ...actor,
+                });
+            });
+        }
+        keepalive = setInterval(() => {
+            if (!res.writableEnded)
+                res.write(": keepalive\n\n");
+        }, SSE_KEEPALIVE_MS);
+        keepalive.unref?.();
+        req.on("close", finish);
+    });
+    router.post("/local-browser/sessions/:id/input", async (req, res) => {
+        assertBoardUser(req);
+        const companyId = resolveCompanyId(req);
+        const sessionId = sessionIdSchema.parse(req.params.id);
+        const session = service.getSessionForCompany(companyId, sessionId);
+        if (!session) {
+            throw localBrowserFailure("local_browser_extension_unavailable", "Browser session is not connected", {
+                retryable: true,
+            });
+        }
+        const raw = req.body ?? {};
+        const size = Buffer.byteLength(JSON.stringify(raw), "utf8");
+        if (size > MAX_INPUT_BODY_BYTES) {
+            throw payloadTooLarge("Viewer input is limited to " + MAX_INPUT_BODY_BYTES + " bytes");
+        }
+        const parsedInput = localBrowserInputSchema.safeParse(raw);
+        if (!parsedInput.success) {
+            res.status(400).json({
+                error: "Invalid viewer input",
+                issues: parsedInput.error.issues.map((issue) => ({ path: issue.path, message: issue.message })),
+            });
+            return;
+        }
+        const body = parsedInput.data;
+        const actor = auditActor(req);
+        const startedAt = Date.now();
+        try {
+            await service.sendInternalCall(session, "local_browser_input", { ...body });
+        }
+        catch (error) {
+            const code = error && typeof error === "object" && "code" in error
+                ? String(error.code)
+                : "local_browser_protocol_error";
+            await service.auditInternal({
+                companyId,
+                tool: "local_browser_input",
+                sessionId,
+                tabId: null,
+                origin: null,
+                tier: session.tier,
+                ok: false,
+                durationMs: Date.now() - startedAt,
+                errorCode: code,
+                ...actor,
+            });
+            throw error;
+        }
+        await service.auditInternal({
+            companyId,
+            tool: "local_browser_input",
+            sessionId,
+            tabId: null,
+            origin: null,
+            tier: session.tier,
+            ok: true,
+            durationMs: Date.now() - startedAt,
+            errorCode: null,
+            ...actor,
+        });
+        res.json({ ok: true });
+    });
+    router.get("/local-browser/settings", async (req, res) => {
+        const companyId = resolveCompanyId(req);
+        res.json(await service.getSettings(companyId));
+    });
+    router.post("/local-browser/settings", async (req, res) => {
+        const companyId = resolveCompanyId(req);
+        const settings = localBrowserSettingsSchema.parse(req.body ?? {});
+        const actor = getActorInfo(req);
+        res.json(await service.updateSettings(companyId, settings, {
+            userId: actor.actorType === "user" ? actor.actorId : null,
+            agentId: actor.actorType === "agent" ? actor.actorId : null,
+        }));
+    });
+    return router;
+}
+export function localBrowserRouteInternals() {
+    return { resolveCompanyId, bridgeConnectUrls, MAX_INPUT_BODY_BYTES };
+}
+//# sourceMappingURL=local-browser.js.map

package/dist/routes/local-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-browser.js","sourceRoot":"","sources":["../../src/routes/local-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,sCAAsC,EACtC,uBAAuB,EACvB,8BAA8B,EAC9B,0BAA0B,EAC1B,6BAA6B,GAE9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAE1C,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAY,EAAE,GAA+B,EAAE,IAAoC,EAAE,EAAE;QAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,GAAG,oBAAoB,GAAG,QAAQ,EAAE,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO,CAAC,GAAY,EAAE,IAAa,EAAE,GAA+B,EAAE,IAAoC,EAAE,EAAE;QAC5G,MAAM,SAAS,GAAG,GAAkD,CAAC;QACrE,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,kBAAkB,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,GAAG,oBAAoB,GAAG,QAAQ,EAAE,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,SAAS,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;IAChC,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,IAAI,SAAS,EAAE,CAAC;QACd,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;IAClF,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;QACxC,OAAO,SAAS,CAAC,CAAC,CAAE,CAAC;IACvB,CAAC;IACD,MAAM,UAAU,CAAC,uEAAuE,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY,EAAE,IAAY;IACnD,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,cAAc,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,iCAAiC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,iCAAiC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/H,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAM,EAAE,OAAO,GAAG,mBAAmB,CAAC,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9C,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,8BAA8B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,aAAa,CAAC;YAC5B,SAAS;YACT,eAAe,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAClE,gBAAgB,EAAE,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACpE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI;YAAE,MAAM,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QAC9D,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClE,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,MAAM,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QAEjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;QAErB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAS,GAA0C,IAAI,CAAC;QAC5D,IAAI,WAAW,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QAE3B,MAAM,UAAU,GAAG,GAAG,EAAE;YACtB,KAAK,OAAO;iBACT,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;iBACjE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,SAAS;gBAAE,aAAa,CAAC,SAAS,CAAC,CAAC;YACxC,WAAW,EAAE,CAAC;YACd,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QACpC,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,OAAgC,EAAE,EAAE;YACjD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YAC5B,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YACnF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,cAAc;gBAAE,MAAM,EAAE,CAAC;QACrF,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,WAAW,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,KAAK,OAAO;iBACT,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,EAAE;gBACjD,EAAE,EAAE,OAAO;gBACX,UAAU,EAAE,sCAAsC;aACnD,CAAC;iBACD,IAAI,CAAC,GAAG,EAAE,CACT,OAAO,CAAC,aAAa,CAAC;gBACpB,SAAS;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,SAAS;gBACT,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,EAAE,EAAE,IAAI;gBACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,SAAS,EAAE,IAAI;gBACf,GAAG,KAAK;aACT,CAAC,CACH;iBACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;oBACnD,CAAC,CAAC,MAAM,CAAE,KAA2B,CAAC,IAAI,CAAC;oBAC3C,CAAC,CAAC,8BAA8B,CAAC;gBACrC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,4BAA4B,GAAG,IAAI,EAAE,CAAC,CAAC;gBACpG,OAAO,OAAO,CAAC,aAAa,CAAC;oBAC3B,SAAS;oBACT,IAAI,EAAE,sBAAsB;oBAC5B,SAAS;oBACT,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,IAAI;oBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,EAAE,EAAE,KAAK;oBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAClC,SAAS,EAAE,IAAI;oBACf,GAAG,KAAK;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QAED,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAEpB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClE,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,mBAAmB,CAAC,qCAAqC,EAAE,kCAAkC,EAAE;gBACnG,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,IAAI,GAAG,oBAAoB,EAAE,CAAC;YAChC,MAAM,eAAe,CAAC,6BAA6B,GAAG,oBAAoB,GAAG,QAAQ,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,WAAW,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;aAChG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;gBACnD,CAAC,CAAC,MAAM,CAAE,KAA2B,CAAC,IAAI,CAAC;gBAC3C,CAAC,CAAC,8BAA8B,CAAC;YACrC,MAAM,OAAO,CAAC,aAAa,CAAC;gBAC1B,SAAS;gBACT,IAAI,EAAE,qBAAqB;gBAC3B,SAAS;gBACT,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,SAAS,EAAE,IAAI;gBACf,GAAG,KAAK;aACT,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,CAAC,aAAa,CAAC;YAC1B,SAAS;YACT,IAAI,EAAE,qBAAqB;YAC3B,SAAS;YACT,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,SAAS,EAAE,IAAI;YACf,GAAG,KAAK;SACT,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CACN,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE;YAChD,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACzD,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;AACvE,CAAC"}

package/dist/routes/openapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/routes/openapi.ts"],"names":[],"mappings":"AAslaA,wBAAgB,oBAAoB,IAAI,GAAG,CAY1C;AAED,eAAO,MAAM,gBAAgB,6BAAuB,CAAC;AAErD,wBAAgB,aAAa,+CAM5B"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/routes/openapi.ts"],"names":[],"mappings":"AAsnaA,wBAAgB,oBAAoB,IAAI,GAAG,CAY1C;AAED,eAAO,MAAM,gBAAgB,6BAAuB,CAAC;AAErD,wBAAgB,aAAa,+CAM5B"}

package/dist/routes/openapi.js

@@ -6,7 +6,7 @@ import { experimentalApiPaths, experimentalApiQueries, } from "./experimental-ap
 import { Router } from "express";
 import { subscriptionPriceSchema, mergeSubscriptionsSchema } from "@tickernelz/paperclip-pro-shared";
 import { z } from "zod";
-import { gitHubRepositoryPageQuerySchema, toggleAllGitHubRepositoriesSchema, createAiConnectionSchema, ENVIRONMENT_DRIVERS, ENVIRONMENT_LEASE_STATUSES, ENVIRONMENT_STATUSES, FEEDBACK_TARGET_TYPES, FEEDBACK_TRACE_STATUSES, FEEDBACK_VOTE_VALUES, PLUGIN_JOB_STATUSES, PLUGIN_STATUSES, TOOL_ACTION_REQUEST_STATUSES, catalogSkillListQuerySchema, catalogTeamListQuerySchema, updateDecisionModelSchema, aiConnectionPoolConfigSchema, localAiConnectionSchema, localAiLoginStartSchema, browserCodeSchema, emailEndpointSetupSchema, emailConnectionSchema, emailAddressCheckSchema, emailSendSchema, browserUseControlSchema, browserUseSettingsSchema, browserUseViewportSchema, browserUseViewerSchema, startVoiceSessionSchema, voiceCallbackPreferenceSchema, voicePhoneConfigurationSchema, voiceInboundDecisionSchema, VOICE_SESSION_STATES, slackToolCallSchema, openwaToolCallSchema, slackSearchConfigSchema, 
+import { gitHubRepositoryPageQuerySchema, toggleAllGitHubRepositoriesSchema, createAiConnectionSchema, ENVIRONMENT_DRIVERS, ENVIRONMENT_LEASE_STATUSES, ENVIRONMENT_STATUSES, FEEDBACK_TARGET_TYPES, FEEDBACK_TRACE_STATUSES, FEEDBACK_VOTE_VALUES, PLUGIN_JOB_STATUSES, PLUGIN_STATUSES, TOOL_ACTION_REQUEST_STATUSES, catalogSkillListQuerySchema, catalogTeamListQuerySchema, updateDecisionModelSchema, aiConnectionPoolConfigSchema, localAiConnectionSchema, localAiLoginStartSchema, browserCodeSchema, emailEndpointSetupSchema, emailConnectionSchema, emailAddressCheckSchema, emailSendSchema, browserUseControlSchema, browserUseSettingsSchema, browserUseViewportSchema, browserUseViewerSchema, localBrowserInputSchema, localBrowserPairingStartSchema, localBrowserSettingsSchema, startVoiceSessionSchema, voiceCallbackPreferenceSchema, voicePhoneConfigurationSchema, voiceInboundDecisionSchema, VOICE_SESSION_STATES, slackToolCallSchema, openwaToolCallSchema, slackSearchConfigSchema, 
 // Agent
 submitAgentCommentarySchema, AGENT_PALETTE_IDS, AGENT_AVATAR_SIZES, CHARACTER_STATES, agentAppearanceSchema, setAgentAvatarSchema, createAgentSchema, createAgentHireSchema, updateAgentSchema, updatePrimaryAgentSchema, updateAgentPermissionsSchema, agentAdapterConfigBatchPreviewSchema, agentAdapterConfigBatchUpdateSchema, updateAgentInstructionsPathSchema, updateAgentInstructionsBundleSchema, upsertAgentInstructionsFileSchema, restoreAgentInstructionSchema, resolveAgentInstructionCandidateSchema, createAgentKeySchema, builtInAgentEmptyMutationSchema, builtInAgentProvisionSchema, generateSummarySlotSchema, writeSummarySlotSchema, createStatusCardSchema, patchStatusCardSchema, refreshStatusCardSchema, writeStatusCardQuerySchema, writeStatusCardSummarySchema, wakeAgentSchema, resetAgentSessionSchema, agentSkillSyncSchema, testAdapterEnvironmentSchema, agentMineInboxQuerySchema, 
 // Issue
@@ -1045,6 +1045,16 @@ const browserUseOperations = [
     ["get", "/api/companies/{companyId}/browser-use-cloud/grants/{grantId}/settings", "Read browser credential settings", undefined],
     ["put", "/api/companies/{companyId}/browser-use-cloud/grants/{grantId}/settings", "Update browser credential settings", browserUseSettingsSchema],
 ];
+const localBrowserOperations = [
+    ["post", "/api/local-browser/pairing", "Start pairing a local browser", localBrowserPairingStartSchema],
+    ["get", "/api/local-browser/pairing/{code}", "Read a pairing code status", undefined],
+    ["get", "/api/local-browser/sessions", "List connected local browsers", undefined],
+    ["delete", "/api/local-browser/sessions/{id}", "Disconnect a local browser", undefined],
+    ["get", "/api/local-browser/sessions/{id}/viewer", "Watch the tab a local browser is driving", undefined],
+    ["post", "/api/local-browser/sessions/{id}/input", "Take over a local browser tab", localBrowserInputSchema],
+    ["get", "/api/local-browser/settings", "Read local browser tier and origin settings", undefined],
+    ["post", "/api/local-browser/settings", "Update local browser tier and origin settings", localBrowserSettingsSchema],
+];
 const BOARD_ONLY_OPERATIONS = new Set([
     "PATCH /api/issues/{id}/comments/{commentId}/public-share",
     "GET /api/companies/{companyId}/fast-response",
@@ -1056,6 +1066,7 @@ const BOARD_ONLY_OPERATIONS = new Set([
     "PUT /api/companies/{companyId}/decision-model",
     "POST /api/companies/{companyId}/decision-model/test",
     ...browserUseOperations.map(([method, path]) => `${method.toUpperCase()} ${path}`),
+    ...localBrowserOperations.map(([method, path]) => `${method.toUpperCase()} ${path}`),
     "GET /api/companies/{companyId}/ai-connections",
     "POST /api/companies/{companyId}/ai-connections",
     "POST /api/companies/{companyId}/ai-connections/local",
@@ -1898,6 +1909,12 @@ for (const [method, path, summary, body] of browserUseOperations) {
         responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict },
     });
 }
+for (const [method, path, summary, body] of localBrowserOperations) {
+    registerCurrentRoute({
+        method, path, summary, body, tags: ["Local Browser"],
+        responses: { 200: r.ok(), 201: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict, 413: r.badRequest },
+    });
+}
 // Voice endpoints accept current authenticated board sessions (or local implicit board),
 // never agent keys or board API keys. Provider callbacks use signatures and are
 // intentionally documented separately from this board API contract.
@@ -5943,8 +5960,18 @@ registry.registerPath({
     path: "/api/companies/{companyId}/pending-decisions",
     tags: ["inbox"],
     summary: "List decisions waiting on a human",
-    description: "The Decisions-desk cards, board approvals and agent decisions still waiting for a person, limited to issues the caller can read. Each item has its issue, card kind, prompt, options or questions, requester, link, and whether an agent may relay the owner's answer with paperclipAnswerDecisionForOwner (relayBlockedReason says why not).",
-    request: { params: z.object({ companyId: z.string() }) },
+    description: "Default scope=relay is a partial list: the cards, board approvals and agent decisions an owner's answer can be relayed for (prompt, options or questions, requester, relayable and relayBlockedReason); it omits recovery, review, blocked-dependency, failed-run, budget, agent-error and join-request items, so an empty list does not mean an empty Decisions desk. scope=desk returns the same ranked feed as the Decisions page for the responsible owner, every sourceKind with severity, issue, title, age, entry and exit rule, href, open flag, relayable and relayBlockedReason; counts, ordering and the queue, includeDismissed, sort, cursor and limit filters match GET /attention. scope=desk needs a full-profile run the owner started; other runs get 403 decisions_desk_forbidden.",
+    request: {
+        params: z.object({ companyId: z.string() }),
+        query: z.object({
+            scope: z.enum(["relay", "desk"]).optional(),
+            includeDismissed: z.enum(["true", "false"]).optional(),
+            queue: z.string().min(1).optional(),
+            sort: z.enum(["activity", "decide"]).optional(),
+            cursor: z.string().min(1).optional(),
+            limit: z.coerce.number().int().min(1).max(100).optional(),
+        }),
+    },
     responses: { 200: r.ok(), 401: r.unauthorized, 403: r.forbidden },
 });
 // ─── Decisions ──────────────────────────────────────────────────────────────