@withbuddi/buddi 0.1.0-pre.37 → 0.1.0-pre.39

package/packages/gateway/dist/web/server.js

@@ -56,7 +56,6 @@ import { carryOverDeps } from '../surfaces/carry-over.js';
 import { deleteCarryOver } from '../surfaces/browser-handoff.js';
 import { ProviderSettingsError } from '../providers.js';
 import { ProviderAccountError } from '../provider-accounts.js';
-import { listBrowserProfiles, listInstalledApps } from './apps.js';
 import { agentSearchPath, EXAMPLES_AGENTS_DIR } from '../agents/catalog.js';
 import { setDelegatesFromWeb } from './write.js';
 import { mlxhBaseUrl, probeMlxh } from '../mlxh.js';
@@ -65,7 +64,7 @@ import { OnboardingRefusal, WEB_ONBOARDING_STEPS, WEB_ONBOARDING_SURFACE, claimO
 import { TakeOnRefusal, readTakeOn, startTakeOn } from './take-on.js';
 import { TelegramWebError, saveTelegramToken, telegramBot, telegramDevices, telegramPairing, telegramStatus, unpairTelegramDevice, } from './telegram.js';
 import { PAGE_ROUTE, sendPageFile, actOnPage, actRateLimited, listPageDescriptors, runPageQuery, } from './pages.js';
-import { listSecrets, secretUses, secretsAct } from './secrets.js';
+import { listSecrets, ownerLoginKey, ownerLoginNames, ownerLoginStore, secretUses, secretsAct } from './secrets.js';
 import { sayRoute, transcribeRoute } from './speech.js';
 import { createServer } from 'node:http';
 import { asksEachTime, getAction, idleRolloverMs, inRecovery, listMissions, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding, snoozeFindings, unmuteFindings } from '@buddi/core';
@@ -77,6 +76,7 @@ import { hostService } from '@buddi/tool-host';
 import { listToolPermissions, revokeToolPermission, getArtifact, readArtifactBytes, artifactBytesExist, discardUnreferencedUpload, listLibrary, getLibraryEntry, decodeCursor, filterKey, textPreviewable, readArtifactPrefix, FILE_FAMILIES, LIBRARY_PAGE_MAX, getOwnerProfile, saveOwnerProfile, isKnownTimezone, listGroups, getGroup, createGroup, updateGroup, archiveGroup, deleteGroup, restoreGroup, clearGroupHistory, groupHistorySize, GROUP_UNDO_MS, GroupRefusal, createGroupConversation, listGroupConversations, latestGroupConversation, openGroupRequest, conversationGroup } from '@buddi/core';
 import { EXPORT_MIME, MAX_EXPORT_SOURCE_BYTES, exportFormats, exportName } from '../export/document.js';
 import { ExportRefused, runExport } from '../export/convert.js';
+import { createVault } from '@buddi/core';
 import { beginOnboarding, completeOnboarding, markStepDone, setOnboardingDetails, skipOnboarding, readWebSetting, writeWebSetting, isAssetKey, readPluginAsset } from '@buddi/core';
 import { listMemory, setPreference, forgetPreference, updateNote, forgetNote } from '@buddi/tool-memory';
 import { purgeGroups, stopGroupWork } from './group-lifecycle.js';
@@ -94,7 +94,14 @@ import { ATTACHMENTS_UNAVAILABLE, CHAT_CONVERSATIONS_LIMIT, CHAT_UNAVAILABLE, WE
 import { readAgentAttention, streamAttention } from './attention.js';
 import { PreviewApp, PreviewTickets, parsePreviewApiPath } from './preview.js';
 import { allowedOrigins, isLoopback, webAssetsDir, webUrl } from './config.js';
-import { TAILSCALE_SETTING_KEY, daemonWhois, isLoginRefusal, isUnansweredRefusal, plausibleLogin, proxiedThroughTailscale, sameLogin, tailscaleIdentity, tailscaleRefusalReason, tailscaleSelf, toTailscaleSetting, } from './tailscale.js';
+import { TAILSCALE_SETTING_KEY, daemonWhois, plausibleLogin, proxiedThroughTailscale, tailscaleProvider, tailscaleSelf, tailscaleServeCommand, } from './access/tailscale.js';
+import { CLOUDFLARE_SETTING_KEY, cloudflareProvider, createJwks, normalizeTeamDomain, plausibleTeamDomain, validateCloudflareInput, } from './access/cloudflare.js';
+import { arrivalOf } from './access/arrival.js';
+import { CloudflareApiError, createCloudflareApi, CLOUDFLARE_PERMISSION_LINES, CLOUDFLARE_TOKEN_URL } from './access/cloudflare-api.js';
+import { CLOUDFLARE_SETUP_KEY, checkSetupInput, claimSetupOperation, freshProgress, setupBusySentence, setupOperation, removeCloudflareSetup, runCloudflareSetup, } from './access/cloudflare-setup.js';
+import { ownerSecretTokenStore } from './access/cloudflare-token.js';
+import { createAccessRegistry } from './access/registry.js';
+import { createIngress } from './access/ingress.js';
 import { clientKey } from './client-key.js';
 import { retryHref, sendSignedOut, wantsSignedOutPage } from './signed-out.js';
 import { extensionEndpoint } from './extension.js';
@@ -116,6 +123,7 @@ import { createRequirements } from '../plugins/requires.js';
 import { placesList, placesRoute } from './places.js';
 import { peopleRoute } from './people.js';
 import { syncDateMissions } from '../missions/dates.js';
+import { resumeParkedForPage } from '../missions/parked.js';
 import { OWNER_DATE_FORMATS, OWNER_TIME_FORMATS, validDayMonth } from '@buddi/core';
 import { readFacts, webSettingsStore } from '../tips/facts.js';
 import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers } from './agent-offers.js';
@@ -160,6 +168,21 @@ const PREVIEW_APPS = new WeakMap();
  * reloads once the next process answers `/_buddi/ready` with a new `boot`.
  */
 const CLOSING_SAYS = new WeakMap();
+/** Each server's ingress listener (web/access/ingress.ts). */
+const INGRESS_OF = new WeakMap();
+/** Each server's request handler, for a listener without a socket of its own (the relay, provider 3). */
+const DISPATCH_OF = new WeakMap();
+/** The ingress listener belonging to a server built by `createWebApp`. */
+export function ingressOf(server) {
+    return INGRESS_OF.get(server);
+}
+/**
+ * The request handler of a server built by `createWebApp`: what an in-process
+ * listener hands a request to after tagging its arrival (`markRequestArrival`).
+ */
+export function dispatchOf(server) {
+    return DISPATCH_OF.get(server);
+}
 /** How long a closing frame may take to reach the pages before the sockets go. */
 const CLOSING_FLUSH_MS = 250;
 /** The chat surface this server is running, if any. */
@@ -270,13 +293,13 @@ export function createWebApp(deps) {
             // A locked dashboard drives nothing (docs/dashboard.md, "Lock screen").
             if (await lock.locked(session))
                 return null;
-            if (session.via === 'tailscale') {
-                let refusal;
-                const confirmed = await identityOf(req, now, (reason) => { refusal = reason; });
-                if (!confirmed || !sameLogin(confirmed.login, session.tailscaleLogin)) {
-                    // "Could not ask" is not an answer: no socket now, but the session stays.
-                    if (!confirmed && isUnansweredRefusal(refusal))
-                        return null;
+            if (session.via === 'provider') {
+                const confirmed = await access.confirm(session, req, now);
+                // "Could not ask", or a stray request without the provider's proof:
+                // no socket now, but the session stays.
+                if (confirmed.answer === 'unanswered' || confirmed.answer === 'refuse')
+                    return null;
+                if (confirmed.answer === 'end') {
                     await sessions.destroy(session.id).catch(() => { });
                     return null;
                 }
@@ -427,6 +450,7 @@ export function createWebApp(deps) {
             now: deps.now,
             get timezone() { return deps.timezone; },
             log,
+            browser: deps.browser ?? browserHost(deps.env ?? process.env),
             ...deps.chat,
         })
         : undefined;
@@ -438,6 +462,27 @@ export function createWebApp(deps) {
      * Failures are the recovery's own business and land in the log.
      */
     void chat?.recoverPendingInput().catch((err) => log(`web chat: recovering queued input failed: ${err instanceof Error ? err.message : String(err)}`));
+    /*
+     * Give it back: the run that waited on the page carries on. A mission parked
+     * on it wakes (missions/parked.ts); otherwise the conversation the take-over
+     * held gets its turn. Either way with no message from the owner.
+     */
+    const offGiveBack = (deps.browser ?? browserHost(deps.env ?? process.env)).onGiveBack?.((info) => {
+        void (async () => {
+            if (await resumeParkedForPage(deps.pool, info.conversationId, deps.now()))
+                return;
+            await chat?.continueAfterGiveBack({ conversationId: info.conversationId, agentId: info.agentId });
+        })().catch((err) => log(`browser: carrying on after the page was given back failed: ${err instanceof Error ? err.message : String(err)}`));
+    });
+    /*
+     * A sign-in the owner made on a page they held, kept when they say Save
+     * (docs/browser.md, "Saving a sign-in"): the browser host's keeper hands the
+     * pair to core's owner-secret store, as the owner, and to nothing else.
+     */
+    {
+        const loginDeps = { pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now };
+        (deps.browser ?? browserHost(deps.env ?? process.env)).logins?.useStore(ownerLoginStore(loginDeps), ownerLoginNames(loginDeps), ownerLoginKey(deps.env ?? process.env));
+    }
     const streams = new StreamBudget();
     // A bundle script's run asks every time: its card offers no standing permission (`asksEachTime`).
     const permissionScopes = (tool, envelope) => deps.registry.lookup(tool)?.reusableApproval && !asksEachTime(envelope)
@@ -483,55 +528,204 @@ export function createWebApp(deps) {
     // ticket-and-session gate. The override is a test seam, nothing more.
     const openAccess = deps.openAccess ?? (deps.env?.BUDDI_WEB_REQUIRE_AUTH !== '1' && isLoopback(deps.config.host));
     /*
-     * Signing in through Tailscale: the daemon this process asks.
+     * Trusted access providers (web/access/): something in front of buddi
+     * proves who is knocking, buddi checks the proof itself, and its own
+     * `remote` session rules apply. Tailscale (provider 1) asks the local
+     * daemon; Cloudflare Access (provider 2) verifies the JWT Access signs.
      *
      * Which sessions were established that way is a field on the session itself
-     * (`via`), not a map beside it — provenance that can drift out of step with
-     * the session it describes is provenance that eventually lies. It is what
-     * keeps a tailnet session from widening its own access (`PUT /api/tailscale`
+     * (`via: 'provider'` and `provider`), not a map beside it. It is what keeps
+     * a provider session from widening its own access (changing a provider
      * wants a session from this machine) and what lets `/api/session` say how
      * the browser got in.
      */
     const whois = deps.tailscale?.whois ?? daemonWhois();
     const tailscaleSelfOf = deps.tailscale?.self ?? (() => tailscaleSelf());
+    const jwks = deps.cloudflare?.jwks ?? createJwks({ log });
+    const boundPort = () => server.address()?.port ?? deps.config.port;
+    const accessCtx = {
+        dashboardPort: boundPort,
+        ingressPort: () => ingress.port(),
+        publicOrigin: () => deps.config.publicOrigin,
+    };
+    const tailscale = tailscaleProvider({ whois, self: tailscaleSelfOf, log });
+    const cloudflare = cloudflareProvider({ jwks, log, ingressProblem: () => ingress.problem() });
+    const access = createAccessRegistry({
+        providers: [tailscale, cloudflare],
+        readSetting: (key) => readWebSetting(deps.pool, key),
+    });
+    /** The command that publishes this dashboard on the tailnet, with this installation's own ports. */
+    const serveCommand = () => tailscaleServeCommand(boundPort(), deps.config.publicOrigin);
+    const readTailscaleSetting = async () => access.settingOf(tailscale);
+    /*
+     * The Cloudflare setting as last read, so the synchronous Origin check can
+     * honour the public address the panel stored. Refreshed on every read.
+     */
+    let cloudflareSeen = null;
+    const readCloudflareSetting = async () => {
+        cloudflareSeen = await access.settingOf(cloudflare);
+        return cloudflareSeen;
+    };
+    /** Did this request come through a provider, or does it hold a session one minted? Then the block is read-only. */
+    const throughProvider = (req, session) => session.via === 'provider' || arrivalOf(req) !== 'main' || proxiedThroughTailscale(req);
+    /** The Tailscale panel's whole payload (unchanged by the move behind the provider interface). */
+    const tailscaleView = async (req, session) => {
+        const stored = await readTailscaleSetting();
+        const daemon = await tailscaleSelfOf();
+        return {
+            enabled: stored.enabled,
+            login: stored.login,
+            available: daemon.available,
+            self: daemon.self,
+            proxied: throughProvider(req, session),
+            // What the owner has to run on this machine, with this installation's own two ports in it.
+            serveCommand: serveCommand(),
+        };
+    };
+    /** The Cloudflare panel's payload: the stored fields, the status, the setup copy with the real ingress port. */
+    const cloudflareView = async (req, session) => {
+        const stored = await readCloudflareSetting();
+        const status = await cloudflare.status(stored, accessCtx);
+        const visit = cloudflare.lastVisit();
+        return {
+            enabled: stored.enabled,
+            teamDomain: stored.teamDomain,
+            aud: stored.aud,
+            email: stored.email,
+            publicOrigin: stored.publicOrigin,
+            status,
+            ingressPort: ingress.port() ?? accessCtx.dashboardPort() + 2,
+            listening: ingress.port() !== null,
+            lastVisit: visit ? { at: visit.at.toISOString(), email: visit.email } : null,
+            setup: cloudflare.setup(stored, accessCtx),
+            proxied: throughProvider(req, session),
+        };
+    };
     /**
-     * The command that publishes this dashboard on the tailnet, with this
-     * installation's own numbers in it: the HTTPS port of the configured public
-     * origin, and the port the gateway is actually listening on.
+     * Store a Cloudflare setting and do what a Save does: end the sessions it
+     * admitted unless the same person, team and application stay on, then bind
+     * or close the ingress listener. The panel's Save and "Set it up for me"
+     * both come through here.
      */
-    const serveCommand = () => {
-        const bound = server.address()?.port ?? deps.config.port;
-        let https = 443;
-        if (deps.config.publicOrigin) {
-            const port = new URL(deps.config.publicOrigin).port;
-            if (port !== '')
-                https = Number(port);
+    const applyCloudflareSetting = async (value) => {
+        const before = await readCloudflareSetting();
+        await writeWebSetting(deps.pool, CLOUDFLARE_SETTING_KEY, value);
+        await readCloudflareSetting();
+        const same = before.enabled && value.enabled && before.email.toLowerCase() === value.email.toLowerCase()
+            && before.teamDomain === value.teamDomain && before.aud === value.aud;
+        if (!same) {
+            const forgotten = new Set();
+            await sessions.forget((s) => { const drop = s.via === 'provider' && s.provider === 'cloudflare-access'; if (drop && s.id)
+                forgotten.add(s.id); return drop; });
+            hand.revoke((lease) => forgotten.has(lease), 'Cloudflare access changed. Sign in again.');
         }
-        return `tailscale serve --bg --https=${https} http://127.0.0.1:${bound}`;
+        await ingress.sync();
     };
-    const readTailscaleSetting = async () => toTailscaleSetting(await readWebSetting(deps.pool, TAILSCALE_SETTING_KEY).catch(() => null));
-    /**
-     * Who the daemon says this request is, with the sign-in budget in front of
-     * the daemon. Used to mint a session and, on every later request, to confirm
-     * the one the browser is holding.
+    /*
+     * "Set it up for me" (access/cloudflare-setup.ts): one run at a time, in
+     * the background — the health wait lasts as long as the owner takes to run
+     * one command — and its progress kept here for the panel to poll. The token
+     * is an owner secret, read once per run.
+     */
+    let cfTokens = deps.cloudflare?.tokens ?? null;
+    const tokenStore = () => (cfTokens ??= ownerSecretTokenStore(deps.pool, createVault({ env: deps.env ?? process.env })));
+    let setupRun = null;
+    const readSetupRecord = async () => {
+        const row = await readWebSetting(deps.pool, CLOUDFLARE_SETUP_KEY);
+        return row && typeof row === 'object' && typeof row.host === 'string' ? row : null;
+    };
+    const setupDepsFor = (token, lease, signal) => ({
+        api: createCloudflareApi({ token, transport: deps.cloudflare?.api?.transport, baseUrl: deps.cloudflare?.api?.baseUrl }),
+        ingressPort: ingress.port() ?? (askedIngressPort() || null) ?? accessCtx.dashboardPort() + 2,
+        platform: deps.cloudflare?.platform ?? process.platform,
+        readSetting: readCloudflareSetting,
+        saveSetting: applyCloudflareSetting,
+        readRecord: readSetupRecord,
+        saveRecord: (record) => writeWebSetting(deps.pool, CLOUDFLARE_SETUP_KEY, record),
+        test: (team) => jwks.refresh(team),
+        ...(deps.cloudflare?.setup ?? {}),
+        signal,
+        lease,
+    });
+    const setupView = async () => {
+        const record = await readSetupRecord();
+        return {
+            progress: setupRun?.progress ?? freshProgress(record?.host ?? '', record?.email ?? ''),
+            tokenStored: await tokenStore().has().catch(() => false),
+            record: record ? { host: record.host, email: record.email, zone: record.zone.name, teamDomain: record.teamDomain } : null,
+            permissions: CLOUDFLARE_PERMISSION_LINES,
+            tokenUrl: CLOUDFLARE_TOKEN_URL,
+            ingressPort: ingress.port() ?? (askedIngressPort() || null) ?? accessCtx.dashboardPort() + 2,
+        };
+    };
+    /** Run in the background; the lease (claimed by the caller) goes when the run ends. */
+    const startSetup = (lease, job, first) => {
+        const abort = new AbortController();
+        const run = { progress: first, abort, done: Promise.resolve() };
+        setupRun = run;
+        run.done = job((p) => { run.progress = p; }, abort.signal)
+            .then((p) => { run.progress = p; })
+            .catch(() => { run.progress = { ...run.progress, state: 'failed', error: 'The setup stopped unexpectedly. Try again.' }; })
+            .finally(() => lease.release());
+    };
+    /*
+     * A setting written elsewhere (`buddi access cloudflare setup` writes the
+     * database directly) reaches the ingress listener here: bound or closed
+     * within a quarter of a minute.
      */
-    const identityOf = (req, now, onRefusal) => tailscaleIdentity(req, {
-        setting: readTailscaleSetting,
-        whois,
+    const ingressResync = setInterval(() => {
+        void readCloudflareSetting().then((setting) => {
+            if (setting.enabled !== (ingress.port() !== null))
+                return ingress.sync();
+            return undefined;
+        }).catch(() => undefined);
+    }, 15_000);
+    ingressResync.unref?.();
+    /** Every provider's row, for "Sign in from elsewhere". */
+    const accessView = async (req, session) => ({
+        proxied: throughProvider(req, session),
+        providers: await Promise.all(access.providers.map(async (p) => {
+            const setting = await access.settingOf(p);
+            return { id: p.id, title: p.title, identity: p.identity, proxy: p.proxy, enabled: p.enabled(setting), status: await p.status(setting, accessCtx) };
+        })),
+    });
+    /*
+     * The ingress listener (specs/trusted-access.md §3.3): a second loopback
+     * listener, the dashboard's port + 2 (or `BUDDI_INGRESS_PORT`), bound only
+     * while a this-machine provider other than Tailscale is on. Every request
+     * on it is remote, whatever its headers or Host say, and it never passes a
+     * loopback-only check. cloudflared points here, never at the dashboard's
+     * own port, so a tunnel arrival can never be mistaken for this machine.
+     */
+    /** `BUDDI_INGRESS_PORT`, when it names a port. */
+    function askedIngressPort() {
+        const raw = (deps.env ?? process.env).BUDDI_INGRESS_PORT?.trim();
+        const asked = raw ? Number(raw) : NaN;
+        return Number.isInteger(asked) && asked >= 0 && asked <= 65535 ? asked : null;
+    }
+    const ingress = createIngress({
+        onRequest: (req, res) => onRequest(req, res),
+        onUpgrade: (req, socket, head) => { server.emit('upgrade', req, socket, head); },
+        port: () => askedIngressPort() ?? (deps.config.port === 0 ? 0 : boundPort() + 2),
+        wanted: async () => (await readCloudflareSetting()).enabled,
         log,
-        now: () => now,
-        onRefusal,
     });
     /**
      * The pair a browser holds: the HttpOnly session and the readable CSRF value
      * the page has to echo back in a header. Both carry the same `Max-Age`, which
      * is the lifetime this session's scope earned it.
      */
+    /*
+     * Secure cookies for a remote session behind an HTTPS proxy: the configured
+     * public origin, or anything on the ingress listener (Cloudflare's edge
+     * always speaks HTTPS to the browser).
+     */
+    const secureCookies = (req, scope) => scope === 'remote' && (!!deps.config.publicOrigin || arrivalOf(req) === 'ingress');
     const sessionCookies = (req, session) => {
         const maxAgeSeconds = SessionStore.maxAgeSeconds(session);
         return [
-            cookieHeader(sessionCookieName(cookiePort(req)), session.id, { httpOnly: true, maxAgeSeconds, secure: session.scope === 'remote' && !!deps.config.publicOrigin }),
-            cookieHeader(csrfCookieName(cookiePort(req)), session.csrf, { httpOnly: false, maxAgeSeconds, secure: session.scope === 'remote' && !!deps.config.publicOrigin }),
+            cookieHeader(sessionCookieName(cookiePort(req)), session.id, { httpOnly: true, maxAgeSeconds, secure: secureCookies(req, session.scope) }),
+            cookieHeader(csrfCookieName(cookiePort(req)), session.csrf, { httpOnly: false, maxAgeSeconds, secure: secureCookies(req, session.scope) }),
         ];
     };
     /**
@@ -540,7 +734,7 @@ export function createWebApp(deps) {
      * polling page then sends no credential at all, which counts as nothing.
      */
     const expiredCookies = (req) => {
-        const secure = requestScope(req) === 'remote' && !!deps.config.publicOrigin;
+        const secure = secureCookies(req, requestScope(req));
         return [
             cookieHeader(sessionCookieName(cookiePort(req)), '', { httpOnly: true, maxAgeSeconds: 0, secure }),
             cookieHeader(csrfCookieName(cookiePort(req)), '', { httpOnly: false, maxAgeSeconds: 0, secure }),
@@ -548,9 +742,23 @@ export function createWebApp(deps) {
     };
     /**
      * What the signed-out page should offer this request: how it arrived,
-     * whether Tailscale can sign it in, and whether a lockout is running.
+     * which provider can sign it in, why it could not, and whether a lockout is
+     * running.
      */
-    const signedOutFor = async (req, pathname, search, now, refusal) => {
+    const signedOutFor = async (req, pathname, search, now, refused, key) => {
+        const lockedForMs = limiter.retryAfterMs(key, now);
+        const locked = lockedForMs > 0 ? { lockedForMs } : {};
+        if (arrivalOf(req) === 'ingress') {
+            return {
+                retry: retryHref(pathname, search),
+                arrived: 'remote',
+                provider: {
+                    title: cloudflare.title,
+                    ...(refused?.provider === 'cloudflare-access' ? { refusal: refused.refusal.refusal, kind: refused.refusal.kind } : { refusal: 'no-assertion', kind: 'other' }),
+                },
+                ...locked,
+            };
+        }
         const proxied = proxiedThroughTailscale(req);
         let publicHost;
         try {
@@ -569,14 +777,14 @@ export function createWebApp(deps) {
         const scope = requestScope(req);
         const arrived = proxied || (publicHost !== undefined && host === publicHost) ? 'tailnet' : scope === 'local' ? 'local' : 'remote';
         const setting = arrived === 'tailnet' ? await readTailscaleSetting() : null;
-        const lockedForMs = limiter.retryAfterMs(clientKey(req), now);
+        const tailscaleRefusal = refused?.provider === 'tailscale' ? refused.refusal : undefined;
         return {
             retry: retryHref(pathname, search),
             arrived,
-            tailscaleSignIn: !!setting?.enabled && !isLoginRefusal(refusal),
-            ...(isLoginRefusal(refusal) ? { tailscaleRefusal: tailscaleRefusalReason(refusal) } : {}),
-            ...(isUnansweredRefusal(refusal) ? { tailscaleUnanswered: true } : {}),
-            ...(lockedForMs > 0 ? { lockedForMs } : {}),
+            tailscaleSignIn: !!setting?.enabled && tailscaleRefusal?.kind !== 'login',
+            ...(tailscaleRefusal?.kind === 'login' ? { tailscaleRefusal: tailscaleRefusal.sentence } : {}),
+            ...(tailscaleRefusal?.kind === 'unanswered' ? { tailscaleUnanswered: true } : {}),
+            ...locked,
         };
     };
     /**
@@ -585,7 +793,16 @@ export function createWebApp(deps) {
      * loopback page and the tailnet page each keep their own pair. Set, read and
      * checked through this one function.
      */
-    const cookiePort = (req) => requestPort(req, server.address()?.port ?? deps.config.port, deps.config.publicOrigin);
+    const cookiePort = (req) => {
+        // Cloudflare's edge serves the page on HTTPS's own port, whatever
+        // cloudflared says on the way in; the page names its cookie by it.
+        if (arrivalOf(req) === 'ingress') {
+            const host = req.headers.host ?? '';
+            if (!/:\d+$/.test(host.replace(/^\[[^\]]*\]/, '')))
+                return 443;
+        }
+        return requestPort(req, server.address()?.port ?? deps.config.port, deps.config.publicOrigin);
+    };
     /**
      * The origins a write may claim, resolved against the port actually bound.
      *
@@ -596,8 +813,13 @@ export function createWebApp(deps) {
     let originCache;
     const allowed = () => {
         const bound = server.address()?.port ?? deps.config.port;
-        if (originCache?.port !== bound) {
-            originCache = { port: bound, set: new Set(allowedOrigins({ ...deps.config, port: bound })) };
+        // The public address the Cloudflare panel stored, while that provider is on.
+        const extra = cloudflareSeen?.enabled ? cloudflareSeen.publicOrigin : '';
+        if (originCache?.port !== bound || originCache.extra !== extra) {
+            const set = new Set(allowedOrigins({ ...deps.config, port: bound }));
+            if (extra)
+                set.add(extra);
+            originCache = { port: bound, extra, set };
         }
         return originCache.set;
     };
@@ -605,7 +827,7 @@ export function createWebApp(deps) {
     // caller that needs to drain it on shutdown (or in a test) can, without
     // `createWebApp` growing a second return value every existing caller would
     // have to unpack.
-    const server = createServer((req, res) => {
+    function onRequest(req, res) {
         handle(req, res).catch((err) => {
             // The lock could not say whether this request may pass: refused, never let in (web/lock.ts).
             if (err instanceof LockUnavailable) {
@@ -622,9 +844,14 @@ export function createWebApp(deps) {
             else
                 res.end();
         });
-    });
+    }
+    const server = createServer(onRequest);
     if (chat)
         WEB_CHATS.set(server, chat);
+    INGRESS_OF.set(server, ingress);
+    // The seam the relay (provider 3) hands its in-process requests to,
+    // tagged `markRequestArrival(req, 'relay')` first. Never replayed as HTTP to 127.0.0.1.
+    DISPATCH_OF.set(server, onRequest);
     PREVIEW_APPS.set(server, previews);
     CLOSING_SAYS.set(server, async () => {
         const said = frame('closing', goingAway === undefined ? {} : { for: goingAway });
@@ -655,13 +882,25 @@ export function createWebApp(deps) {
     // rather than in `startWebServer` so every caller, tests included, has it.
     extension.attach(server);
     extension.attachPath(REMOTE_HAND_SOCKET_PATH, (req, socket, head) => hand.upgrade(req, socket, head));
-    server.once('close', () => { extension.shutdown(); hand.shutdown(); clearInterval(idleSweep); });
+    server.once('close', () => { extension.shutdown(); hand.shutdown(); clearInterval(idleSweep); clearInterval(ingressResync); setupRun?.abort.abort(); void ingress.close(); });
+    server.once('close', () => offGiveBack?.());
     return server;
     async function handle(req, res) {
         const now = deps.now();
         const method = (req.method ?? 'GET').toUpperCase();
         const url = parseUrl(req);
-        const key = clientKey(req);
+        /*
+         * The bucket failed sign-ins count against (client-key.ts, §7.5): by the
+         * arrival path, so a stranger behind a tunnel can never lock out this
+         * machine or the tailnet. A request on the ingress listener is asked of
+         * its provider at once — a JWT check against cached keys — because its
+         * bucket depends on it: `cf:unverified` until it verifies, then the
+         * client's own address.
+         */
+        let key = access.bucketOf(req) ?? clientKey(req);
+        const early = arrivalOf(req) === 'main' ? null : await access.identify(req, now);
+        if (early?.result.ok && early.result.identity.bucket)
+            key = early.result.identity.bucket;
         // No CORS, and therefore no preflight.
         if (method === 'OPTIONS')
             return sendEmpty(res, 405);
@@ -763,12 +1002,12 @@ export function createWebApp(deps) {
         const presentedSession = cookies[sessionCookieName(cookiePort(req))];
         let session = await sessions.resolve(presentedSession, scope, now);
         /*
-         * Why Tailscale gave this request no identity, when it was asked. Only
-         * "this login is not the one allowed" changes what the signed-out page
-         * says; every other reason is the ordinary "you're signed out".
+         * Why a provider gave this request no identity, when it was asked. Only
+         * "this person is not the one allowed" and "could not ask" change what
+         * the signed-out page says; every other reason is the ordinary "you're
+         * signed out".
          */
-        let refusal;
-        const noteRefusal = (reason) => { refusal = reason; };
+        let refused = early && !early.result.ok ? { provider: early.provider.id, refusal: early.result } : undefined;
         /*
          * Set when the browser presented a session that is gone: the refusal then
          * expires its cookies, so it stops presenting them (and stops counting).
@@ -777,7 +1016,7 @@ export function createWebApp(deps) {
         /*
          * The answer to a refused request: the signed-out page for a person
          * opening a page, the empty status for everything else (docs/web.md).
-         * 401 is "signed out", 429 "too many tries from here", 503 "Tailscale
+         * 401 is "signed out", 429 "too many tries from here", 503 "the provider
          * could not be asked; the session is still good, try again".
          */
         const refuse = async (status = 401) => {
@@ -788,33 +1027,40 @@ export function createWebApp(deps) {
                 headers['Retry-After'] = '5';
             if (!wantsSignedOutPage(req, method, url.pathname))
                 return sendEmpty(res, status, headers);
-            return sendSignedOut(res, await signedOutFor(req, url.pathname, url.search, now, refusal), headers, status);
+            return sendSignedOut(res, await signedOutFor(req, url.pathname, url.search, now, refused, key), headers, status);
         };
-        /* A Tailscale session this request ended: not a guess, so never a failed sign-in. */
+        /* A provider session this request ended: not a guess, so never a failed sign-in. */
         let revoked = false;
         /*
-         * A Tailscale session is re-confirmed on every single request.
+         * A provider session is re-confirmed on every single request.
          *
-         * A cookie on its own would be a bearer token the tailnet identity is only
-         * loosely related to: it would outlive the setting being turned off, the
-         * allowed login being changed, and the device being handed to somebody
-         * else. So the daemon is asked again — cheap, because a whois answer is
-         * reused for a minute — and the login it names now must be the login this
-         * session was minted for. Anything else and the session is gone, not
-         * merely ignored: the browser is 401 and has to sign in again, which it
-         * can only do if it is still the person the owner allowed.
+         * A cookie on its own would be a bearer token the provider's identity is
+         * only loosely related to: it would outlive the setting being turned off,
+         * the allowed login being changed, and the device being handed to somebody
+         * else. So the provider is asked again — Tailscale's daemon (a whois
+         * answer is reused for a minute), Cloudflare's JWT on this very request —
+         * and the person it names now must be the one this session was minted
+         * for. Anything else and the session is gone, not merely ignored.
          */
-        if (session?.via === 'tailscale') {
-            const confirmed = await identityOf(req, now, noteRefusal);
-            if (!confirmed || !sameLogin(confirmed.login, session.tailscaleLogin)) {
-                /*
-                 * The daemon could not be asked (busy, starting, timed out). That is
-                 * not an answer about anyone, so the session is not ended for it —
-                 * a restart's first burst of requests used to end every tailnet
-                 * session this way — and nothing is counted. This request waits.
-                 */
-                if (!confirmed && isUnansweredRefusal(refusal))
-                    return refuse(503);
+        if (session?.via === 'provider') {
+            const confirmed = await access.confirm(session, req, now);
+            if (confirmed.refusal)
+                refused = { provider: session.provider, refusal: confirmed.refusal };
+            /*
+             * The provider could not be asked (a daemon busy or starting, keys that
+             * could not be fetched). That is not an answer about anyone, so the
+             * session is not ended for it and nothing is counted. This request waits.
+             */
+            if (confirmed.answer === 'unanswered')
+                return refuse(503);
+            /*
+             * This request lacks the provider's proof (Cloudflare's header), but
+             * the session is not ended for it: a stray request without the header
+             * must not sign the owner out. Nothing is counted either.
+             */
+            if (confirmed.answer === 'refuse')
+                return refuse(401);
+            if (confirmed.answer === 'end') {
                 const ended = session.id;
                 // A hand this session was holding does not outlive the session.
                 hand.revoke((lease) => lease === ended);
@@ -823,7 +1069,7 @@ export function createWebApp(deps) {
                 revoked = true;
                 forgetCookies = true;
                 // The identity on this very request may still earn a new session below.
-                refusal = undefined;
+                refused = undefined;
             }
         }
         /*
@@ -848,26 +1094,32 @@ export function createWebApp(deps) {
             res.setHeader('Set-Cookie', sessionCookies(req, session));
         }
         /*
-         * Signed in through Tailscale.
+         * Signed in through a trusted access provider.
          *
-         * The proxy runs on this machine and the daemon on this machine confirms
-         * who is behind the forwarded address; when that agrees with the login the
-         * owner allowed, this is the owner's own tailnet identity arriving and the
-         * request gets a `remote` session exactly as the ticket exchange would
-         * have minted one — same cookies, same 12 hours, same CSRF on every write.
-         * Anything less returns null and the request falls through to the 401
-         * below, which is what it would have got before this existed.
+         * Tailscale: the proxy runs on this machine and the daemon confirms who
+         * is behind the forwarded address. Cloudflare Access: the JWT Access
+         * signed verifies against the team's keys, for this application, naming
+         * the allowed email, and it arrived on the ingress listener. When that
+         * agrees with the person the owner allowed, the request gets a `remote`
+         * session exactly as the ticket exchange would have minted one — same
+         * cookies, same 12 hours, same CSRF on every write. Anything less falls
+         * through to the 401 below. A provider identity signs in during a lockout.
          */
         if (!session) {
-            const identity = await identityOf(req, now, noteRefusal);
-            if (identity) {
+            const asked = early ?? await access.identify(req, now);
+            if (asked && !asked.result.ok)
+                refused = { provider: asked.provider.id, refusal: asked.result };
+            if (asked?.result.ok) {
+                const identity = asked.result.identity;
                 limiter.reset(key);
                 const locked = await lock.startLocked('browser');
+                const capMs = Math.min(asked.provider.absoluteCapMs, identity.expiresAt ? Math.max(0, identity.expiresAt.getTime() - now.getTime()) : asked.provider.absoluteCapMs);
                 session = sessions.create('remote', now, {
-                    via: 'tailscale',
-                    tailscaleLogin: identity.login,
-                    tailscaleAddress: identity.address,
-                    tailscaleName: identity.name,
+                    via: 'provider',
+                    provider: identity.provider,
+                    providerSubject: identity.subject,
+                    ...(identity.detail ? { providerDetail: identity.detail } : {}),
+                    absoluteCapMs: capMs,
                 }, locked ? { locked } : {});
                 res.setHeader('Set-Cookie', sessionCookies(req, session));
             }
@@ -882,14 +1134,26 @@ export function createWebApp(deps) {
             // the same stale cookie counts once however often it is sent: all tailnet
             // and tunnel traffic shares 127.0.0.1, so a forgotten tab must not be
             // able to lock the owner out of every way in.
-            if (!presentedSession)
+            //
+            // A provider's credential that failed (a Cloudflare assertion that does
+            // not verify) is an attempt too, cookie or not, in the bucket the
+            // provider names (per Cf-Connecting-Ip). No assertion at all, or keys
+            // that could not be fetched, carry no attempt.
+            const tried = refused?.refusal.attempt;
+            if (!presentedSession && !tried)
                 return refuse();
-            forgetCookies = true;
+            if (tried)
+                key = tried.bucket;
+            if (presentedSession)
+                forgetCookies = true;
             if (revoked)
                 return refuse();
             if (limiter.blocked(key, now))
                 return refuse(429);
-            limiter.failCredential(key, presentedSession, now);
+            if (tried)
+                limiter.failCredential(key, tried.credential, now);
+            if (presentedSession)
+                limiter.failCredential(key, presentedSession, now);
             return refuse();
         }
         /*
@@ -964,7 +1228,7 @@ export function createWebApp(deps) {
             agentIds: () => deps.catalog.list().map((a) => a.id),
         });
         /** The Keys and secrets page (docs/owner-secrets.md §6): core's own queries and ownerOnly tools. */
-        const secretsDeps = () => ({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now });
+        const secretsDeps = () => ({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now, ...(browser.logins ? { logins: browser.logins } : {}) });
         /** Talking to buddi on the dashboard: the speech plugin's two tools, as the owner. */
         const speechDeps = () => ({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now, agents: () => deps.catalog.list() });
         /** The same, for the version and upgrade routes. */
@@ -1088,6 +1352,10 @@ export function createWebApp(deps) {
                     now: deps.now,
                     agents: () => deps.catalog.list(),
                     plugins: () => deps.registry.manifests().map((m) => m.name),
+                    appsWithoutPlugin: () => {
+                        const apps = browser.status().routes?.find((route) => route.kind === 'apps');
+                        return apps !== undefined && apps.installed === false && apps.mode !== undefined && apps.mode !== 'off';
+                    },
                     needsSetup: async () => {
                         const out = [];
                         for (const manifest of deps.registry.manifests()) {
@@ -1387,15 +1655,16 @@ export function createWebApp(deps) {
                     const permissions = (await listToolPermissions(deps.pool, deps.ctx.ownerId)).filter(p => p.tool === 'host.exec' && (!agentId || p.agentId === agentId) && (!conversationId || !p.conversationId || p.conversationId === conversationId));
                     return sendJson(res, 200, { permissions, runs: host.runs(deps.ctx.ownerId, agentId, conversationId) });
                 }
-                case '/api/host/apps':
-                    return sendJson(res, 200, { apps: await listInstalledApps() });
-                case '/api/host/browser-profiles':
-                    return sendJson(res, 200, { profiles: await listBrowserProfiles(q.get('app') ?? '') });
                 case '/api/extension':
                     return sendJson(res, 200, await extension.view());
                 case '/api/browser':
                     return sendJson(res, 200, q.has('conversationId') && q.has('agentId')
                         ? browser.status({ agentId: q.get('agentId'), conversationId: q.get('conversationId') }) : browser.status());
+                case '/api/browser/telemetry': {
+                    // Stops by cause, cards and routes over the last week: how flakiness is seen to fall.
+                    const summary = browser.telemetrySummary?.(Number(q.get('days') ?? '7') || 7);
+                    return sendJson(res, 200, summary ?? { days: 7, tasks: 0, stops: 0, cards: 0, byCause: [], routes: {}, stopsPerTask: 0 });
+                }
                 case '/api/browser/screenshot': {
                     const expectedSession = url.searchParams.get('sessionId');
                     const current = browser.status(expectedSession !== null ? { sessionId: expectedSession } : undefined);
@@ -1434,10 +1703,14 @@ export function createWebApp(deps) {
                         // from the page rather than implied by a number in a source file.
                         scope: session.scope,
                         // How this browser got in. `local` is the open loopback mint,
-                        // `ticket` the five-minute ticket exchange, `tailscale` an identity the
-                        // local daemon confirmed — and then the name to greet.
-                        signedInThrough: session.via,
-                        ...(session.via === 'tailscale' ? { tailscaleName: session.tailscaleName, tailscaleLogin: session.tailscaleLogin } : {}),
+                        // `ticket` the five-minute ticket exchange, or the provider that
+                        // verified it (`tailscale`, `cloudflare-access`) — and then the
+                        // name to greet.
+                        signedInThrough: session.via === 'provider' ? session.provider : session.via,
+                        ...(session.via === 'provider' ? { provider: session.provider, providerSubject: session.providerSubject } : {}),
+                        ...(session.via === 'provider' && session.provider === 'tailscale'
+                            ? { tailscaleName: session.providerDetail?.name ?? session.providerSubject, tailscaleLogin: session.providerSubject }
+                            : {}),
                         expiresAt: session.expiresAt.toISOString(),
                         // What this gateway is running. The page keeps it across an
                         // upgrade so that "it came back" can be told from "it is still
@@ -1452,20 +1725,24 @@ export function createWebApp(deps) {
                  * memory), and whether this very request came through the proxy —
                  * which is what disables the switch on a tailnet browser.
                  */
-                case '/api/tailscale': {
-                    const stored = await readTailscaleSetting();
-                    const daemon = await tailscaleSelfOf();
-                    return sendJson(res, 200, {
-                        enabled: stored.enabled,
-                        login: stored.login,
-                        available: daemon.available,
-                        self: daemon.self,
-                        proxied: session.via === 'tailscale' || proxiedThroughTailscale(req),
-                        // What the owner has to run on this machine, with this
-                        // installation's own two ports in it.
-                        serveCommand: serveCommand(),
-                    });
-                }
+                // `/api/tailscale` stays one release as an alias (docs/api.md).
+                case '/api/tailscale':
+                case '/api/access/tailscale':
+                    return sendJson(res, 200, await tailscaleView(req, session));
+                /*
+                 * "Sign in from elsewhere": every provider's row — its status in one
+                 * line — and whether this very request came through one, which makes
+                 * the whole block read-only.
+                 */
+                case '/api/access':
+                    return sendJson(res, 200, await accessView(req, session));
+                case '/api/access/cloudflare-access':
+                    return sendJson(res, 200, await cloudflareView(req, session));
+                case '/api/access/cloudflare-access/setup':
+                    // The install line holds the tunnel's connector token: this machine only.
+                    if (session.via !== 'local')
+                        return sendJson(res, 403, { error: 'Change this from the computer buddi runs on.' });
+                    return sendJson(res, 200, await setupView());
                 case '/api/overview':
                     return sendJson(res, 200, {
                         ...(await readOverview({
@@ -2225,7 +2502,7 @@ export function createWebApp(deps) {
          * everything else.
          */
         if (method === 'PUT') {
-            const puttable = ['/api/backups/schedule', '/api/backups/passphrase', '/api/version/check', '/api/tailscale', '/api/notifications/settings', '/api/notifications/focus'];
+            const puttable = ['/api/backups/schedule', '/api/backups/passphrase', '/api/version/check', '/api/tailscale', '/api/access/tailscale', '/api/access/cloudflare-access', '/api/notifications/settings', '/api/notifications/focus'];
             if (!puttable.includes(path))
                 return sendEmpty(res, 405);
             let put;
@@ -2235,7 +2512,20 @@ export function createWebApp(deps) {
             catch {
                 return sendJson(res, 400, { error: 'request body must be JSON' });
             }
-            if (path === '/api/tailscale') {
+            if (path === '/api/access/cloudflare-access') {
+                // Who may widen access: only a browser on this machine, as for Tailscale below.
+                if (session.via !== 'local') {
+                    return sendJson(res, 403, { error: 'Change this from the computer buddi runs on.' });
+                }
+                const checked = validateCloudflareInput(put);
+                if (!checked.ok)
+                    return sendJson(res, 400, { error: checked.error });
+                await applyCloudflareSetting(checked.value);
+                // On Save buddi fetches the team's keys once and says whether it worked.
+                const test = checked.value.enabled ? await jwks.refresh(checked.value.teamDomain) : null;
+                return sendJson(res, 200, { ...(await cloudflareView(req, session)), ...(test ? { test } : {}) });
+            }
+            if (path === '/api/tailscale' || path === '/api/access/tailscale') {
                 /*
                  * Who may widen access: only a browser that is already on this
                  * machine.
@@ -2272,20 +2562,11 @@ export function createWebApp(deps) {
                  * in a browser on the far side of the tailnet.
                  */
                 const forgotten = new Set();
-                await sessions.forget((s) => { const drop = s.via === 'tailscale'; if (drop && s.id)
+                await sessions.forget((s) => { const drop = s.via === 'provider' && s.provider === 'tailscale'; if (drop && s.id)
                     forgotten.add(s.id); return drop; });
                 // Including whichever of them had a hand on the owner's browser.
                 hand.revoke((lease) => forgotten.has(lease), 'Tailscale access changed. Sign in again.');
-                const daemon = await tailscaleSelfOf();
-                const stored = toTailscaleSetting({ enabled, login });
-                return sendJson(res, 200, {
-                    enabled: stored.enabled,
-                    login: stored.login,
-                    available: daemon.available,
-                    self: daemon.self,
-                    proxied: false,
-                    serveCommand: serveCommand(),
-                });
+                return sendJson(res, 200, await tailscaleView(req, session));
             }
             if (path === '/api/version/check')
                 return reply(res, await versionCheckRoute(versionDeps(), 'PUT', put));
@@ -2299,6 +2580,155 @@ export function createWebApp(deps) {
         }
         if (method !== 'POST')
             return sendEmpty(res, 405);
+        /*
+         * "Test my setup": fetch the team's signing keys for the domain in the
+         * form (saved or not) and say what came back. Nothing is stored. From
+         * this machine only, like the setting itself: it makes this computer
+         * fetch a URL the caller names part of.
+         */
+        /*
+         * "Set it up for me": start a run (202, then poll GET …/setup), stop the
+         * health wait, remove what buddi made, or forget the kept API token. From
+         * this machine only, like the setting it fills in.
+         */
+        if (path === '/api/access/cloudflare-access/setup' || path === '/api/access/cloudflare-access/setup/stop' || path === '/api/access/cloudflare-access/setup/remove' || path === '/api/access/cloudflare-access/setup/forget-token') {
+            if (session.via !== 'local')
+                return sendJson(res, 403, { error: 'Change this from the computer buddi runs on.' });
+            /*
+             * Forget the token: drop the owner secret. Not while a run holds it.
+             * Cloudflare still honours it until the owner revokes it there.
+             */
+            if (path.endsWith('/forget-token')) {
+                const lease = claimSetupOperation('setup');
+                if (!lease)
+                    return sendJson(res, 409, { error: setupBusySentence(setupOperation()) });
+                try {
+                    try {
+                        await tokenStore().remove();
+                    }
+                    catch {
+                        return sendJson(res, 409, { error: 'The token could not be forgotten. Check that the vault is unlocked, then try again.' });
+                    }
+                    return sendJson(res, 200, await setupView());
+                }
+                finally {
+                    lease.release();
+                }
+            }
+            /*
+             * One operation at a time (cloudflare-setup's lock, claimed before the
+             * first await and held to the end): a second setup or a removal while
+             * one runs is a 409, and so is Stop while a removal runs.
+             */
+            if (path.endsWith('/stop')) {
+                const going = setupOperation();
+                if (going === 'remove')
+                    return sendJson(res, 409, { error: setupBusySentence(going) });
+                const lease = going === null ? claimSetupOperation('setup') : null;
+                try {
+                    setupRun?.abort.abort();
+                    await setupRun?.done;
+                    return sendJson(res, 200, await setupView());
+                }
+                finally {
+                    lease?.release();
+                }
+            }
+            const lease = claimSetupOperation(path.endsWith('/remove') ? 'remove' : 'setup');
+            if (!lease)
+                return sendJson(res, 409, { error: setupBusySentence(setupOperation()) });
+            let handedOff = false;
+            try {
+                const body = await readJsonBody(req).catch(() => ({}));
+                const str = (v) => (typeof v === 'string' ? v.trim() : '');
+                const tokens = tokenStore();
+                const pasted = str(body.token);
+                if (path.endsWith('/remove')) {
+                    const token = pasted || await tokens.use().catch(() => null);
+                    if (!token)
+                        return sendJson(res, 400, { error: 'Paste the Cloudflare API token again: buddi needs it to remove what it made.' });
+                    const run = {
+                        progress: { ...freshProgress(), state: 'removing', steps: [] }, abort: new AbortController(), done: Promise.resolve(),
+                    };
+                    setupRun = run;
+                    const progress = await removeCloudflareSetup({ ...setupDepsFor(token, lease), host: str(body.host) || undefined }, (p) => { run.progress = p; });
+                    run.progress = progress;
+                    // The token stays kept: the panel offers to forget it (…/setup/forget-token), and Set it up again reuses it.
+                    return sendJson(res, 200, await setupView());
+                }
+                const input = { host: str(body.host), email: str(body.email), zone: str(body.zone) || undefined, adopt: body.adopt === true };
+                const invalid = checkSetupInput(input);
+                if (invalid)
+                    return sendJson(res, 400, { error: invalid });
+                if (pasted) {
+                    if (/\s/.test(pasted) || pasted.length < 20 || pasted.length > 400)
+                        return sendJson(res, 400, { error: 'That doesn’t look like a Cloudflare API token.' });
+                    try {
+                        await tokens.put(pasted);
+                    }
+                    catch {
+                        return sendJson(res, 409, { error: 'The token could not be kept in the vault. Check that the vault is unlocked, then try again.' });
+                    }
+                }
+                const token = pasted || await tokens.use().catch(() => null);
+                if (!token)
+                    return sendJson(res, 400, { error: 'Paste a Cloudflare API token.' });
+                const first = { ...freshProgress(input.host, input.email), state: 'running' };
+                startSetup(lease, (onProgress, signal) => runCloudflareSetup(input, setupDepsFor(token, lease, signal), onProgress), first);
+                handedOff = true;
+                return sendJson(res, 202, await setupView());
+            }
+            finally {
+                if (!handedOff)
+                    lease.release();
+            }
+        }
+        /*
+         * The setup form's domain choice: check the token and list the zones it
+         * can see. The pasted token is only used for these two calls — keeping it
+         * stays with setup — and never goes back out, not even in an error.
+         */
+        if (path === '/api/access/cloudflare-access/zones') {
+            if (session.via !== 'local')
+                return sendJson(res, 403, { error: 'Change this from the computer buddi runs on.' });
+            const body = await readJsonBody(req).catch(() => ({}));
+            const pasted = typeof body?.token === 'string' ? body.token.trim() : '';
+            if (pasted && (/\s/.test(pasted) || pasted.length < 20 || pasted.length > 400))
+                return sendJson(res, 400, { error: 'That doesn’t look like a Cloudflare API token.' });
+            const token = pasted || await tokenStore().use().catch(() => null);
+            if (!token)
+                return sendJson(res, 400, { error: 'Paste a Cloudflare API token.' });
+            const api = createCloudflareApi({ token, transport: deps.cloudflare?.api?.transport, baseUrl: deps.cloudflare?.api?.baseUrl });
+            try {
+                if (await api.verifyToken() === 'inactive')
+                    return sendJson(res, 400, { error: 'Cloudflare says this API token is not active. Check that it has not expired or been turned off.' });
+                const zones = await api.zones();
+                return sendJson(res, 200, { zones: zones.map((z) => ({ id: z.id, name: z.name })) });
+            }
+            catch (error) {
+                if (!(error instanceof CloudflareApiError))
+                    throw error;
+                const refused = error.status === 401 || error.permission !== undefined || (error.status >= 400 && error.status < 500 && error.status !== 429);
+                return sendJson(res, refused ? 400 : 502, { error: error.message });
+            }
+        }
+        if (path === '/api/access/cloudflare-access/test') {
+            if (session.via !== 'local')
+                return sendJson(res, 403, { error: 'Change this from the computer buddi runs on.' });
+            const body = await readJsonBody(req).catch(() => ({}));
+            const team = normalizeTeamDomain(typeof body.teamDomain === 'string' ? body.teamDomain : (await readCloudflareSetting()).teamDomain);
+            if (!plausibleTeamDomain(team)) {
+                return sendJson(res, 400, { error: 'That is not a Cloudflare team domain. It looks like yourteam.cloudflareaccess.com, under Zero Trust → Settings.' });
+            }
+            const result = await jwks.refresh(team);
+            return sendJson(res, 200, {
+                ...result,
+                teamDomain: team,
+                sentence: result.ok ? `${team} answered with ${result.keys} signing key${result.keys === 1 ? '' : 's'}.` : result.error,
+                listening: ingress.port() !== null,
+                ingressPort: ingress.port(),
+            });
+        }
         if (path === '/api/extension/pair') {
             // A six-digit code is worth guessing at scale, so a wrong one costs a
             // budget — this session's pairing budget, not the shared sign-in one.
@@ -2345,24 +2775,71 @@ export function createWebApp(deps) {
                 return sendJson(res, 200, { ok: false, message: error instanceof Error ? error.message : String(error) });
             }
         }
-        if (path === '/api/browser/settings' || path === '/api/browser/permissions') {
+        if (path === '/api/browser/settings') {
             const body = await readJsonBody(req);
             try {
-                if (path.endsWith('/settings')) {
-                    if (!browser.configure)
-                        return sendJson(res, 409, { error: 'This host does not support changing control modes.' });
-                    return sendJson(res, 200, await browser.configure(body));
-                }
-                if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some((key) => key !== 'prompt') || ('prompt' in body && typeof body.prompt !== 'boolean'))
-                    return sendJson(res, 400, { error: 'Expected {prompt: boolean}' });
-                if (!browser.checkPermissions)
-                    return sendJson(res, 409, { error: 'This host does not support native permission checks.' });
-                return sendJson(res, 200, await browser.checkPermissions(body.prompt === true));
+                if (!browser.configure)
+                    return sendJson(res, 409, { error: 'This host does not support changing control modes.' });
+                return sendJson(res, 200, await browser.configure(body));
             }
             catch (error) {
                 return sendJson(res, 409, { error: error instanceof Error ? error.message : String(error) });
             }
         }
+        /*
+         * Pin one conversation to a route (the chip under the composer,
+         * `/use browser:chrome`), or clear it with `auto`. A pin narrows; it never
+         * allows a route the owner's switches forbid.
+         */
+        if (path === '/api/browser/pin') {
+            const body = await readJsonBody(req);
+            if (typeof body?.conversationId !== 'string' || typeof body.route !== 'string')
+                return sendJson(res, 400, { error: 'Expected {conversationId: string, route: auto|own|chrome|apps}' });
+            if (!browser.pin)
+                return sendJson(res, 409, { error: 'This host cannot pin a route.' });
+            try {
+                return sendJson(res, 200, await browser.pin(body.conversationId, body.route));
+            }
+            catch (error) {
+                return sendJson(res, 400, { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        /*
+         * A tap on a browser card (Look, Keep going, Take over, Use my Chrome,
+         * Resume) from a page that draws its own buttons: the same as the owner
+         * sending the label in the chat, without a message.
+         */
+        if (path === '/api/browser/card') {
+            const body = await readJsonBody(req);
+            if (typeof body?.conversationId !== 'string' || typeof body.answer !== 'string' || body.answer.length > 80)
+                return sendJson(res, 400, { error: 'Expected {conversationId: string, answer: string}' });
+            const answered = await browser.touch?.({ conversationId: body.conversationId, text: body.answer });
+            return sendJson(res, 200, { ...(answered && 'answered' in answered ? answered : {}), status: browser.status({ conversationId: body.conversationId }) });
+        }
+        /*
+         * "Save this login for amazon.com?" answered in the Page tab: Save, Not
+         * now or Never for this site. The owner's session and CSRF, like every
+         * write here; the body names the question, never a password — that is in
+         * the browser host's keeper, which hands it to the owner-secret store on
+         * Save and drops it otherwise.
+         */
+        if (path === '/api/browser/login') {
+            const body = await readJsonBody(req);
+            const decision = body?.decision;
+            if (typeof body?.id !== 'string' || body.id.length > 80 || (decision !== 'save' && decision !== 'later' && decision !== 'never')) {
+                return sendJson(res, 400, { error: 'Expected {id: string, decision: save|later|never}' });
+            }
+            if (!browser.logins)
+                return sendJson(res, 409, { error: 'This host keeps no sign-ins.' });
+            try {
+                const answer = await browser.logins.decide(body.id, decision);
+                return sendJson(res, 200, { outcome: answer.outcome, ...(answer.saved ? { saved: { name: answer.saved.name, site: answer.saved.site, username: answer.saved.username, savedAt: answer.saved.savedAt } } : {}) });
+            }
+            catch {
+                // Never the error's own words: they are the store's, and the store had the password.
+                return sendJson(res, 409, { error: 'buddi could not keep that login. Add it in Settings → Keys and secrets.' });
+            }
+        }
         const control = /^\/api\/browser\/(stop|takeover|resume|release)$/.exec(path);
         if (control) {
             const body = await readJsonBody(req);
@@ -2377,10 +2854,14 @@ export function createWebApp(deps) {
                 // frozen picture.
                 if (action !== 'takeover')
                     await hand.close(action === 'stop' ? undefined : sessionId, action === 'resume' ? 'You gave the screen back.' : 'That session was released.');
-                const status = await browser.control(action, sessionId);
+                // Stop agents' browsing expires (an hour by default); `forever` is "until I say".
+                const status = await browser.control(action, sessionId, action === 'stop' && body?.forever === true ? { forever: true } : undefined);
                 // Whether this screen can be driven from here at all. The dashboard
                 // shows the mode's own sentence when it cannot.
                 const taken = sessionId ?? status.session?.id;
+                // A page in the owner's Chrome is taken over where it is: its tab came to the front there, so no frame will come.
+                if (action === 'takeover' && status.held)
+                    return sendJson(res, 200, { ...status, hand: false });
                 const offer = action === 'takeover' && taken ? browser.hand?.({ sessionId: taken }) : undefined;
                 /*
                  * "Your browser" with Chrome closed: the take-over itself succeeds (the
@@ -2388,7 +2869,7 @@ export function createWebApp(deps) {
                  * as that, with a reason the dashboard offers its ways out on, rather
                  * than the mode's "use this conversation's host tab".
                  */
-                if (offer && offer.supported && !offer.hand && status.mode === 'extension' && !extension.connected()) {
+                if (offer && offer.supported && !offer.hand && (status.route === 'chrome' || status.mode === 'extension') && !extension.connected()) {
                     return sendJson(res, 200, { ...status, hand: false, handReason: 'browser-offline', handMessage: 'Your browser isn’t connected.' });
                 }
                 return sendJson(res, 200, offer
@@ -3724,6 +4205,10 @@ export async function startWebServer(deps) {
      */
     if (previewPort !== null)
         publishPreviewPort(deps.env ?? process.env, previewPort);
+    // The ingress listener, after the previews have taken their port: bound
+    // now when Cloudflare Access is on, and from then on as the setting changes.
+    const ingress = ingressOf(server);
+    await ingress.sync();
     /*
      * An approval nobody decides expires, and a delegation waiting on one is
      * handed the expiry as its failure: the approval's own lifetime is the
@@ -3741,6 +4226,7 @@ export async function startWebServer(deps) {
         server,
         port,
         previewPort,
+        ingress,
         url: webUrl({ host: deps.config.host, port }),
         chat: webChatOf(server),
         close: async () => {
@@ -3752,6 +4238,7 @@ export async function startWebServer(deps) {
             // still held, and the next thing to want it — the next test, the
             // gateway coming back up — finds it taken.
             await Promise.all([
+                ingress.close(),
                 new Promise((resolve) => {
                     if (!previews || previewPort === null)
                         return resolve();