agent-yes 1.302.2 → 1.303.0

package/dist/webrtcRemote-RmkbzY6Y.js

@@ -0,0 +1,683 @@
+import { a as computeTranscriptHash, c as open, d as randomHex, f as seal, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, s as deriveDirKeys } from "./e2e-BdLf8DvY.js";
+import { a as parseWebrtcLink, i as isWebrtcSpec, n as SIGNAL_SUBPROTOCOL } from "./webrtcLink-bWxiCBTV.js";
+import { hostname } from "os";
+import { RTCPeerConnection } from "node-datachannel/polyfill";
+
+//#region ts/signalingHint.ts
+/**
+* Reach the signaling host over ordinary HTTPS. ANY HTTP response counts as
+* reachable — a 404 or a 400 still proves egress, TLS and DNS all worked, which
+* is the whole question. Never throws; a failure IS the answer.
+*/
+async function probeSignalingHost(host, timeoutMs = 4e3, doFetch = fetch) {
+	try {
+		await doFetch(`https://${host}/`, {
+			method: "HEAD",
+			signal: AbortSignal.timeout(timeoutMs),
+			redirect: "manual"
+		});
+		return "https-ok";
+	} catch {
+		return "https-failed";
+	}
+}
+/**
+* The operator-facing explanation, given the original error and what the probe
+* found. Pure, so the wording is testable without a network.
+*
+* Every branch keeps the original error text: it is the only part that is
+* certainly true, and a hint that replaces evidence is worse than no hint.
+*/
+function signalingFailureHint(cause, probe, host) {
+	const head = `cannot reach the signaling host ${host}: ${cause}`;
+	switch (probe) {
+		case "https-ok": return `${head}\n  HTTPS to ${host} works from here, so DNS, TLS and egress are fine and the\n  server is up — only the WebSocket did not connect. Something in between is\n  allowing HTTPS and refusing the upgrade, which is what a coding-agent\n  sandbox or an intercepting proxy does.\n  If you are running inside a sandbox (Codex and similar): re-run with\n  escalated / external-network permission. If you are behind a corporate\n  proxy: it must allow WebSocket upgrades to ${host}.`;
+		case "https-failed": return `${head}\n  HTTPS to ${host} does not work from here either, so this is not specific to\n  WebSockets — either this environment has no outbound network, or the host\n  is genuinely unreachable.\n  If you are running inside a sandbox (Codex and similar): re-run with\n  escalated / external-network permission. Otherwise check connectivity and\n  whether ${host} is up.`;
+		default: return `${head}\n  If you are running inside a coding-agent sandbox, outbound WebSockets are\n  often blocked — re-run with escalated / external-network permission.`;
+	}
+}
+
+//#endregion
+//#region ts/webrtcSignal.ts
+var ConnectError = class extends Error {
+	constructor(phase, message) {
+		super(message);
+		this.phase = phase;
+		this.name = "ConnectError";
+	}
+};
+/** Classify one signaling frame against the current state. */
+function reduceSignal(state, m) {
+	if (!m || typeof m !== "object") return { kind: "ignore" };
+	switch (m.type) {
+		case "welcome":
+			if (m.hostPresent === false) return {
+				kind: "fail",
+				error: new ConnectError("no-host", "the room is open but no host is attached to it")
+			};
+			return { kind: "ignore" };
+		case "offer":
+			if (state.offered) return { kind: "duplicate-offer" };
+			return {
+				kind: "offer",
+				sdp: m.sdp,
+				iceServers: m.iceServers || [],
+				from: m.from
+			};
+		case "candidate": return {
+			kind: "candidate",
+			candidate: m.candidate,
+			queue: !state.offered
+		};
+		default: return { kind: "ignore" };
+	}
+}
+/** The error for a socket that closed before the channel was confirmed. */
+function closeError(state, code, reason) {
+	const why = `signaling closed (code ${code}${reason ? `: ${reason}` : ""})`;
+	if (!state.opened) return new ConnectError("ws-not-open", `${why} before the socket opened`);
+	if (code === 1008 || reason) return new ConnectError("rejected", why);
+	if (!state.offered) return new ConnectError("no-host", `${why} before the host offered`);
+	return new ConnectError("ice-timeout", `${why} during the WebRTC handshake`);
+}
+/** The error for the connect deadline expiring. */
+function timeoutError(state, timeoutMs) {
+	const s = `${Math.round(timeoutMs / 1e3)}s`;
+	if (!state.opened) return new ConnectError("ws-not-open", `signaling did not open within ${s}`);
+	if (!state.offered) return new ConnectError("no-host", `no host answered the join within ${s}`);
+	return new ConnectError("ice-timeout", `no WebRTC data channel came up within ${s}`);
+}
+/** The error for a WebSocket `error` event. */
+function socketError(state, detail) {
+	return state.opened ? new ConnectError("rejected", `signaling error after connect: ${detail}`) : new ConnectError("ws-not-open", `signaling error: ${detail}`);
+}
+/**
+* The operator-facing explanation. `sandboxHint` is the HTTPS-probe-derived
+* note from signalingHint.ts and is consulted ONLY for a socket that never
+* opened: every later phase proves the WebSocket upgrade worked, so blaming a
+* sandbox or proxy there would be wrong — and sent one reader down exactly
+* that path.
+*/
+function describeConnectFailure(err, host, sandboxHint) {
+	const phase = err instanceof ConnectError ? err.phase : "ws-not-open";
+	const cause = err.message;
+	switch (phase) {
+		case "no-host": return Promise.resolve(`no host in the room at ${host}: ${cause}\n  The signaling server is reachable and accepted the join — the daemon on the\n  other machine is not attached to this room. There, run \`ay share status\`:\n  if it prints a different link, the room rotated (or the daemon was\n  reinstalled) and this saved remote is stale — re-add it with the new link.`);
+		case "rejected": return Promise.resolve(`join rejected by the signaling host ${host}: ${cause}\n  The room id or secret in this saved remote no longer matches what the host\n  serves (it rotated, or the link was copied from a different machine).\n  On the host run \`ay share status\` and re-add the remote with that link.`);
+		case "ice-timeout": return Promise.resolve(`WebRTC handshake with the host behind ${host} failed: ${cause}\n  Signaling worked and the host answered, so this is not a sandbox or proxy\n  problem — the two machines could not open a data channel. Usual cause: a\n  host behind Docker Desktop or another symmetric NAT. There, publish one UDP\n  port and set AGENT_YES_ICE_UDP_PORT + AGENT_YES_ICE_PUBLIC_IPS, or set\n  AGENT_YES_SIGNAL_RELAY=1 on both ends to relay through the signaling server.`);
+		default: return sandboxHint(cause);
+	}
+}
+/**
+* The sender of a host frame. A signaling server without multi-host rooms
+* does not tag host frames; its one host is "host".
+*/
+function memberOf(m) {
+	return typeof m?.from === "string" && m.from ? m.from : "host";
+}
+/**
+* Which members a `<alias>:<keyword>` reference names, when the keyword starts
+* with a member's name (`<alias>:<member>:<keyword>`). Returns the member and
+* the rest of the keyword, or null when the first segment names no member.
+*/
+function splitMemberKeyword(keyword, members) {
+	const i = keyword.indexOf(":");
+	const head = i === -1 ? keyword : keyword.slice(0, i);
+	const member = members.find((m) => m.name === head || m.peer === head);
+	if (!member) return null;
+	return {
+		member,
+		keyword: (i === -1 ? "" : keyword.slice(i + 1)) || void 0
+	};
+}
+/**
+* The members a viewer should talk to: everyone but the machine it runs on
+* (a member listing its own room would show its agents twice), unless that
+* would leave nobody.
+*/
+function otherMembers(members, selfName) {
+	const others = members.filter((m) => m.name !== selfName);
+	return others.length ? others : members;
+}
+/** `/api/ls` rows from several members, each row tagged with its member. */
+function mergeMemberLs(parts) {
+	const out = [];
+	for (const { member, rows } of parts) if (Array.isArray(rows)) {
+		for (const r of rows) if (r && typeof r === "object") out.push({
+			...r,
+			member: member.name || member.peer
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region ts/webrtcRemote.ts
+const CONNECT_TIMEOUT_MS = 25e3;
+const RELAY_AFTER_MS = 8e3;
+const signalRelayEnabled = () => [
+	"1",
+	"true",
+	"yes"
+].includes((process.env.AGENT_YES_SIGNAL_RELAY ?? "").trim());
+/**
+* A live, key-confirmed WebRTC connection to one host (member) of a share
+* room. Its signaling travels over the room's shared socket (RoomSignal).
+*/
+var HostConn = class {
+	pc = null;
+	dc = null;
+	send = { sendCtr: 0n };
+	recv = { lastSeen: -1n };
+	keyC2H = null;
+	keyH2C = null;
+	th = null;
+	myNonce = randomHex(16);
+	confirmedIn = false;
+	confirmedOut = false;
+	confirmed = false;
+	sig = {
+		opened: true,
+		offered: false,
+		confirmed: false
+	};
+	earlyCandidates = [];
+	sendChain = Promise.resolve();
+	recvChain = Promise.resolve();
+	idCounter = 0;
+	pending = /* @__PURE__ */ new Map();
+	ready;
+	resolveReady;
+	rejectReady;
+	constructor(link, member, signal) {
+		this.link = link;
+		this.member = member;
+		this.signal = signal;
+		this.ready = new Promise((res, rej) => {
+			this.resolveReady = res;
+			this.rejectReady = rej;
+		});
+		this.ready.then(() => this.state = "ok", (e) => (this.state = "failed", this.error = e));
+		const timer = setTimeout(() => this.rejectReady(timeoutError(this.sig, CONNECT_TIMEOUT_MS)), CONNECT_TIMEOUT_MS);
+		this.ready.then(() => clearTimeout(timer), () => clearTimeout(timer));
+	}
+	get isConfirmed() {
+		return this.confirmed;
+	}
+	/** Frames go over the signaling socket (see RelayState in rs/src/serve/share.rs). */
+	relayed = false;
+	/** A sealed frame the host relayed over signaling. */
+	onRelay(data) {
+		if (!this.relayed) return;
+		const bytes = Buffer.from(data, "base64");
+		this.recvChain = this.recvChain.then(() => this.onFrame(bytes)).catch(() => {});
+	}
+	state = "pending";
+	error = null;
+	async onCandidate(candidate) {
+		if (!this.pc) this.earlyCandidates.push(candidate);
+		else await this.pc.addIceCandidate(candidate).catch(() => {});
+	}
+	async onOffer(sdp, iceServers, relay = false) {
+		if (this.sig.offered) return;
+		this.sig.offered = true;
+		const pc = new RTCPeerConnection({ iceServers: iceServers || [] });
+		this.pc = pc;
+		let held = [];
+		const sendCandidate = (candidate) => this.signal({
+			type: "candidate",
+			candidate
+		});
+		pc.onicecandidate = (e) => {
+			if (!e.candidate) return;
+			if (held) held.push(e.candidate);
+			else sendCandidate(e.candidate);
+		};
+		pc.ondatachannel = (e) => {
+			const dc = e.channel;
+			this.dc = dc;
+			dc.binaryType = "arraybuffer";
+			dc.onopen = () => {
+				if (!this.relayed) this.enqueueSeal(FLAG_CONFIRM, {
+					t: "confirm",
+					nonce: this.myNonce
+				});
+			};
+			dc.onmessage = (ev2) => {
+				this.recvChain = this.recvChain.then(() => this.onFrame(ev2.data)).catch(() => {});
+			};
+		};
+		await pc.setRemoteDescription({
+			type: "offer",
+			sdp
+		});
+		const early = this.earlyCandidates;
+		this.earlyCandidates = [];
+		for (const c of early) await pc.addIceCandidate(c).catch(() => {});
+		const answer = await pc.createAnswer();
+		await pc.setLocalDescription(answer);
+		this.th = await computeTranscriptHash(sdp, pc.localDescription.sdp);
+		const keys = await deriveDirKeys(this.link.s, this.th);
+		this.keyC2H = keys.keyC2H;
+		this.keyH2C = keys.keyH2C;
+		this.signal({
+			type: "answer",
+			sdp: pc.localDescription.sdp
+		});
+		const queued = held;
+		held = null;
+		for (const c of queued) sendCandidate(c);
+		if (relay && signalRelayEnabled()) setTimeout(() => {
+			if (this.confirmed || this.dc?.readyState === "open") return;
+			process.stderr.write(`[webrtc] no direct path to ${this.member.name || this.member.peer}; using the signaling relay\n`);
+			this.relayed = true;
+			this.enqueueSeal(FLAG_CONFIRM, {
+				t: "confirm",
+				nonce: this.myNonce
+			});
+		}, RELAY_AFTER_MS).unref?.();
+	}
+	enqueueSeal(flags, obj) {
+		this.sendChain = this.sendChain.then(async () => {
+			if (!this.keyC2H || !this.th) return;
+			if (!this.relayed && (!this.dc || this.dc.readyState !== "open")) return;
+			const frame = await seal(this.keyC2H, this.send, flags, this.th, packEnvelope(obj));
+			if (this.relayed) {
+				this.signal({
+					type: "relay",
+					data: Buffer.from(frame).toString("base64")
+				});
+				return;
+			}
+			try {
+				this.dc.send(frame);
+			} catch {}
+		});
+		return this.sendChain;
+	}
+	async onFrame(data) {
+		if (typeof data === "string" || !this.keyH2C || !this.th) return;
+		let env;
+		try {
+			const { plaintext } = await open(this.keyH2C, data, this.th, this.recv);
+			env = unpackEnvelope(plaintext);
+		} catch {
+			return;
+		}
+		if (!this.confirmed) {
+			if (!env || env.t !== "confirm") return;
+			if (typeof env.nonce === "string" && !this.confirmedOut) {
+				await this.enqueueSeal(FLAG_CONFIRM, {
+					t: "confirm",
+					nonce: this.myNonce,
+					echo: env.nonce
+				});
+				this.confirmedOut = true;
+			}
+			if (env.echo && env.echo === this.myNonce) this.confirmedIn = true;
+			if (this.confirmedIn && this.confirmedOut) {
+				this.confirmed = true;
+				this.sig.confirmed = true;
+				this.resolveReady();
+			}
+			return;
+		}
+		if (!env || env.t === "confirm") return;
+		const p = this.pending.get(env.id);
+		if (!p) return;
+		if (env.t === "res") p.onRes(env.status, env.ct);
+		else if (env.t === "data") p.onData(env.chunk);
+		else if (env.t === "end") p.onEnd(env.error);
+	}
+	/**
+	* Issue one request over the channel. Resolves once the response head (status,
+	* content-type) arrives; the body is a ReadableStream fed by `data` frames as
+	* they land, so streaming endpoints (SSE `tail`) flow without buffering.
+	*/
+	request(method, path, body) {
+		const id = String(++this.idCounter);
+		return new Promise((resolve, reject) => {
+			let controller;
+			const enc = new TextEncoder();
+			let head = false;
+			const stream = new ReadableStream({
+				start: (c) => {
+					controller = c;
+				},
+				cancel: () => {
+					this.pending.delete(id);
+					this.enqueueSeal(0, {
+						t: "abort",
+						id
+					});
+				}
+			});
+			this.pending.set(id, {
+				onRes: (status, ct) => {
+					if (!head) {
+						head = true;
+						resolve({
+							status,
+							ct,
+							stream
+						});
+					}
+				},
+				onData: (chunk) => {
+					try {
+						controller.enqueue(enc.encode(chunk));
+					} catch {}
+				},
+				onEnd: (error) => {
+					this.pending.delete(id);
+					if (error) {
+						if (!head) {
+							head = true;
+							reject(new Error(error));
+						}
+						try {
+							controller.error(new Error(error));
+						} catch {}
+					} else try {
+						controller.close();
+					} catch {}
+				}
+			});
+			this.enqueueSeal(0, {
+				t: "req",
+				id,
+				method,
+				path,
+				body
+			});
+		});
+	}
+	close() {
+		try {
+			this.pc?.close();
+		} catch {}
+	}
+};
+/**
+* The room's signaling socket, shared by one HostConn per member. A room can
+* have several hosts (lab/ui/cf/roomRouting.ts); the welcome lists them, and
+* each one offers to us on its own. An older signaling server lists nobody and
+* has one host, "host".
+*/
+var RoomSignal = class {
+	ws;
+	sig = {
+		opened: false,
+		offered: false,
+		confirmed: false
+	};
+	/** Members the welcome named; null until it arrives or when the server predates rooms with several hosts. */
+	roster = null;
+	conns = /* @__PURE__ */ new Map();
+	settled = false;
+	/** Resolves with the members that connected, once every one has connected or failed. */
+	ready;
+	resolveReady;
+	rejectReady;
+	constructor(link, skip) {
+		this.link = link;
+		this.skip = skip;
+		this.ready = new Promise((res, rej) => {
+			this.resolveReady = res;
+			this.rejectReady = rej;
+		});
+		const timer = setTimeout(() => this.fail(timeoutError(this.sig, CONNECT_TIMEOUT_MS)), CONNECT_TIMEOUT_MS + 1e3);
+		this.ready.then(() => clearTimeout(timer), () => clearTimeout(timer));
+		this.ws = this.dial();
+	}
+	fail(e) {
+		if (this.settled) return;
+		if (this.connected().length) return this.settle();
+		this.settled = true;
+		for (const c of this.conns.values()) c.rejectReady(e);
+		this.rejectReady(e);
+	}
+	connected() {
+		return [...this.conns.values()].filter((c) => c.isConfirmed);
+	}
+	settle() {
+		if (this.settled) return;
+		this.settled = true;
+		this.resolveReady(this.connected());
+	}
+	/** Settle once every member we expect has connected or failed. */
+	check() {
+		if (this.settled || !this.roster) return;
+		const expected = this.roster.filter((m) => !this.skip(m));
+		const conns = expected.map((m) => this.conns.get(m.peer));
+		if (!expected.length || conns.some((c) => !c || c.state === "pending")) return;
+		if (this.connected().length) return this.settle();
+		this.fail(conns.find((c) => c.error)?.error ?? /* @__PURE__ */ new Error("no host connected"));
+	}
+	dial() {
+		const { room, host } = this.link;
+		const scheme = /^(localhost|127\.)/.test(host) ? "ws" : "wss";
+		const ws = new WebSocket(`${scheme}://${host}/${room}`, [SIGNAL_SUBPROTOCOL]);
+		ws.onopen = async () => {
+			this.sig.opened = true;
+			const authToken = await deriveAuthToken(this.link.s, room, host);
+			ws.send(JSON.stringify({
+				type: "hello",
+				role: "client",
+				v: 2,
+				token: authToken,
+				multi: true
+			}));
+		};
+		ws.onerror = (e) => this.fail(socketError(this.sig, String(e?.message ?? e)));
+		ws.onclose = (ev) => {
+			this.fail(closeError(this.sig, Number(ev?.code ?? 0), String(ev?.reason ?? "")));
+		};
+		ws.onmessage = (ev) => void this.onSignal(ev);
+		return ws;
+	}
+	memberConn(peer) {
+		let c = this.conns.get(peer);
+		if (c) return c;
+		if (this.settled) return null;
+		const member = this.roster?.find((m) => m.peer === peer) ?? {
+			peer,
+			name: ""
+		};
+		if (this.skip(member)) return null;
+		c = new HostConn(this.link, member, (msg) => this.ws.send(JSON.stringify({
+			...msg,
+			to: peer
+		})));
+		this.conns.set(peer, c);
+		c.ready.then(() => this.check(), () => this.check());
+		if (!this.roster) c.ready.then(() => this.settle(), (e) => this.fail(e));
+		return c;
+	}
+	async onSignal(ev) {
+		const m = JSON.parse(typeof ev.data === "string" ? ev.data : await ev.data.text());
+		if (m?.type === "welcome") {
+			if (Array.isArray(m.hosts)) {
+				this.roster = m.hosts.filter((h) => h && typeof h.peer === "string").map((h) => ({
+					peer: h.peer,
+					name: String(h.name ?? "")
+				}));
+				for (const h of this.roster) this.join(h);
+			}
+			const action = reduceSignal(this.sig, m);
+			if (action.kind === "fail") this.fail(action.error);
+			return;
+		}
+		if (m?.type === "host-join" && this.roster && typeof m.peer === "string") {
+			if (!this.roster.some((h) => h.peer === m.peer)) {
+				const h = {
+					peer: m.peer,
+					name: String(m.name ?? "")
+				};
+				this.roster.push(h);
+				this.join(h);
+			}
+			return;
+		}
+		if (m?.type === "host-leave" && this.roster && typeof m.peer === "string") {
+			this.roster = this.roster.filter((h) => h.peer !== m.peer);
+			this.conns.get(m.peer)?.rejectReady(new ConnectError("no-host", "the host left the room"));
+			this.check();
+			return;
+		}
+		if (m?.type === "offer") {
+			this.sig.offered = true;
+			await this.memberConn(memberOf(m))?.onOffer(m.sdp, m.iceServers || [], m.relay === true);
+		} else if (m?.type === "candidate") await this.memberConn(memberOf(m))?.onCandidate(m.candidate);
+		else if (m?.type === "relay" && typeof m.data === "string") this.conns.get(memberOf(m))?.onRelay(m.data);
+	}
+	join(m) {
+		if (this.settled || this.skip(m) || this.conns.has(m.peer)) return;
+		this.ws.send(JSON.stringify({
+			type: "join",
+			to: m.peer
+		}));
+	}
+	/** Every member the room listed (or the one that offered, on an older server). */
+	members() {
+		return this.roster ?? [...this.conns.values()].map((c) => c.member);
+	}
+	/** Drop the members we will not use, so their hosts can free the peer. */
+	keepOnly(keep) {
+		for (const [peer, c] of this.conns) if (!keep.includes(c)) {
+			c.close();
+			this.conns.delete(peer);
+		}
+	}
+	close() {
+		try {
+			this.ws.close();
+		} catch {}
+		for (const c of this.conns.values()) c.close();
+	}
+};
+/** This machine's member name, as ayrs reports it (rs/src/serve/room_member.rs). */
+function selfMemberName() {
+	return process.env.AY_NAME?.trim() || hostname();
+}
+async function readJson(conn, path) {
+	const { status, stream } = await conn.request("GET", path);
+	const text = await new Response(stream).text();
+	if (status < 200 || status >= 300) throw new Error(`${status} ${text.slice(0, 200)}`);
+	return JSON.parse(text);
+}
+/**
+* The member a `<alias>:<keyword>` reference means in a room with several
+* hosts: the one named by a leading `<member>:`, else the only one with an
+* agent matching the keyword. Throws with the candidates when that is not
+* exactly one.
+*/
+async function chooseMember(conns, keyword) {
+	const named = splitMemberKeyword(keyword, conns.map((c) => c.member));
+	if (named) return {
+		conn: conns.find((c) => c.member === named.member),
+		keyword: named.keyword
+	};
+	const q = `/api/ls?all=1&keyword=${encodeURIComponent(keyword)}`;
+	const found = (await Promise.all(conns.map(async (c) => {
+		const rows = await readJson(c, q).catch(() => []);
+		return Array.isArray(rows) && rows.length ? c : null;
+	}))).filter((c) => !!c);
+	if (found.length === 1) return {
+		conn: found[0],
+		keyword
+	};
+	const names = (found.length ? found : conns).map((c) => c.member.name || c.member.peer);
+	throw new Error(found.length ? `"${keyword}" matches agents on several hosts in this room: ${names.join(", ")} — say which as <remote>:<host>:${keyword}` : `no agent matches "${keyword}" on any host in this room (${names.join(", ")})`);
+}
+/**
+* Connect to a share room and start a local HTTP server that forwards every
+* request over the encrypted DataChannel. Returns the loopback base URL the
+* existing remote commands can `fetch()` against. The process owns teardown:
+* `ay` subcommands `process.exit()` when done, which closes the socket/peer.
+*
+* A room with several hosts: with a `keyword`, the bridge talks to the one
+* member it means (see chooseMember); without one, `GET /api/ls` lists every
+* member's agents (each row tagged `member`) and anything else is refused
+* with a hint to name the member.
+*/
+async function startWebrtcBridge(link, opts = {}) {
+	const parsed = parseWebrtcLink(link);
+	if (!parsed) throw new Error(`not a WebRTC share link: ${link}`);
+	const self = selfMemberName();
+	const room = new RoomSignal(parsed, (m) => m.name === self && otherMembers(room?.members?.() ?? [m], self).every((o) => o.peer !== m.peer));
+	let conns;
+	try {
+		conns = await room.ready;
+	} catch (e) {
+		room.close();
+		const err = e instanceof Error ? e : new Error(String(e));
+		throw new Error(await describeConnectFailure(err, parsed.host, async (cause) => signalingFailureHint(cause, await probeSignalingHost(parsed.host), parsed.host)));
+	}
+	let keyword = opts.keyword;
+	const named = keyword ? splitMemberKeyword(keyword, room.members()) : null;
+	if (named) {
+		const conn = conns.find((c) => c.member.peer === named.member.peer);
+		if (!conn) {
+			room.close();
+			throw new Error(named.member.name === self ? `"${named.member.name}" is this machine — address its agents locally (ay send <agent>)` : `room member "${named.member.name || named.member.peer}" did not connect`);
+		}
+		conns = [conn];
+		keyword = named.keyword;
+	} else if (conns.length > 1 && keyword) try {
+		const pick = await chooseMember(conns, keyword);
+		conns = [pick.conn];
+		keyword = pick.keyword;
+	} catch (e) {
+		room.close();
+		throw e;
+	}
+	room.keepOnly(conns);
+	const members = room.members();
+	const server = Bun.serve({
+		port: 0,
+		hostname: "127.0.0.1",
+		idleTimeout: 0,
+		async fetch(req) {
+			const u = new URL(req.url);
+			const pathWithQuery = u.pathname + u.search;
+			const body = req.method !== "GET" && req.method !== "HEAD" ? await req.text() : void 0;
+			if (conns.length > 1) {
+				if (req.method === "GET" && u.pathname === "/api/ls") {
+					const parts = await Promise.all(conns.map(async (c) => ({
+						member: c.member,
+						rows: await readJson(c, pathWithQuery).catch(() => [])
+					})));
+					return Response.json(mergeMemberLs(parts));
+				}
+				const names = conns.map((c) => c.member.name || c.member.peer).join(", ");
+				return new Response(`this room has several hosts (${names}); address one as <remote>:<host>:<agent>`, { status: 409 });
+			}
+			try {
+				const { status, ct, stream } = await conns[0].request(req.method, pathWithQuery, body);
+				return new Response(stream, {
+					status,
+					headers: ct ? { "content-type": ct } : {}
+				});
+			} catch (e) {
+				return new Response(String(e?.message ?? e), { status: 502 });
+			}
+		}
+	});
+	return {
+		baseUrl: `http://127.0.0.1:${server.port}`,
+		token: "webrtc",
+		members,
+		keyword,
+		close: () => {
+			try {
+				server.stop(true);
+			} catch {}
+			room.close();
+		}
+	};
+}
+
+//#endregion
+export { startWebrtcBridge };
+//# sourceMappingURL=webrtcRemote-RmkbzY6Y.js.map

package/dist/{widget-CvcvPWF9.js → widget-C6-P26Ue.js}

@@ -28,7 +28,7 @@ function parseFlags(args, known) {
 }
 /** Resolve the local daemon base URL + token (flags override discovery). */
 async function daemonTarget(flags) {
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-DdHbUWtG.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-BWy7zL7j.js");
 	const base = typeof flags.base === "string" ? flags.base : await resolveDaemonHttpBase();
 	if (!base) throw new Error("no running ay serve daemon found — start `ay serve` or pass --base <url> (e.g. http://127.0.0.1:PORT)");
 	const token = typeof flags.token === "string" ? flags.token : await loadTokenReadOnly() ?? "";
@@ -186,7 +186,7 @@ async function cmdMint(args) {
 	const bad = caps.filter((c) => !KNOWN_CAPS.has(c));
 	if (bad.length) throw new Error(`unknown cap(s): ${bad.join(", ")} (valid: ${[...KNOWN_CAPS].join(", ")})`);
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
-	const { mintScopedTermToken } = await import("./serve-DdHbUWtG.js");
+	const { mintScopedTermToken } = await import("./serve-BWy7zL7j.js");
 	const r = await mintScopedTermToken(target, {
 		ttlSec,
 		caps
@@ -202,4 +202,4 @@ async function cmdMint(args) {
 
 //#endregion
 export { cmdMint, cmdWidget };
-//# sourceMappingURL=widget-CvcvPWF9.js.map
+//# sourceMappingURL=widget-C6-P26Ue.js.map