ai-or-die 0.1.89 → 0.1.91

package/mesh/go.mod

@@ -1,4 +1,4 @@
-module aiordie-mesh
+module ai-or-die-mesh
 
 go 1.23
 

package/mesh/main.go

@@ -1,4 +1,4 @@
-// Command aiordie-mesh is the userspace mesh sidecar for ai-or-die. It joins a
+// Command ai-or-die-mesh is the userspace mesh sidecar for ai-or-die. It joins a
 // Tailscale tailnet entirely in userspace via tsnet (no kernel TUN, no admin,
 // no system service) and reverse-proxies the tailnet listener to ai-or-die's
 // local HTTP/WebSocket port. Only this one port is exposed on the mesh; the
@@ -18,16 +18,24 @@
 //   MESH-URL http://<name>       node is up, but TLS certs unavailable (degraded)
 //   MESH-NOCERT                  hint: enable HTTPS Certificates in the tailnet
 //   MESH-PEERS {"self":...,"peers":[...]} tagged fleet peers snapshot
+//   MESH-EGRESS http://127.0.0.1:<port> <token>  loopback CONNECT proxy for a
+//                                same-box conductor to reach tagged tailnet peers
+//   MESH-UNTAGGED <selfTagged> <total> <tagged>  tailnet peers exist but none are
+//                                tagged tag:aiordie — discovery will stay empty
 //   MESH-NEEDLOGIN <url>         no/!valid key — operator must enroll
 //   MESH-ERR <msg>               fatal
 package main
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/subtle"
 	"crypto/tls"
+	"encoding/hex"
 	"encoding/json"
 	"flag"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httputil"
@@ -35,6 +43,7 @@ import (
 	"os"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"tailscale.com/ipn/ipnstate"
@@ -93,6 +102,10 @@ func main() {
 
 	if lc, err := s.LocalClient(); err == nil {
 		go emitMeshPeersLoop(context.Background(), lc)
+		// Loopback egress: lets a same-box conductor (github-router) reach tagged
+		// tailnet peers over WireGuard without the host OS joining the tailnet.
+		// Best-effort — a failure here never blocks serving.
+		startEgressProxy(s, lc)
 	}
 
 	name := *host
@@ -223,6 +236,29 @@ func emitMeshPeers(ctx context.Context, lc statusClient) {
 		return
 	}
 	fmt.Printf("MESH-PEERS %s\n", b)
+
+	// Diagnostic: tailnet peers exist but none are tagged tag:aiordie, so the
+	// snapshot above is empty and fleet discovery will surface nothing. Emit a
+	// machine-parseable line the manager turns into an actionable hint — the
+	// silent-empty-peers state is the exact failure this whole path guards against.
+	total, tagged := peerCounts(status)
+	if total > 0 && tagged == 0 {
+		selfTagged := status.Self != nil && peerHasTag(status.Self, meshPeerTag)
+		fmt.Printf("MESH-UNTAGGED %t %d %d\n", selfTagged, total, tagged)
+	}
+}
+
+func peerCounts(status *ipnstate.Status) (total, tagged int) {
+	for _, ps := range status.Peer {
+		if ps == nil {
+			continue
+		}
+		total++
+		if peerHasTag(ps, meshPeerTag) {
+			tagged++
+		}
+	}
+	return total, tagged
 }
 
 func meshPeersFromStatus(status *ipnstate.Status) meshPeersSnapshot {
@@ -339,3 +375,135 @@ func newEdgeProxy(target *url.URL, name string, proto *string, proxyBearer strin
 	}
 	return rp
 }
+
+// startEgressProxy stands up a loopback HTTP CONNECT proxy so a same-box conductor
+// process (github-router) can reach TAGGED tailnet peers over the sidecar's
+// in-process WireGuard — the host OS never joins the tailnet. It is bound to
+// loopback, gated by a random per-process bearer, and restricted to tagged
+// .ts.net peers on the served ports, so a stray local process can neither turn it
+// into a generic tailnet egress nor learn the token off the wire. The endpoint +
+// token are announced via MESH-EGRESS for the manager to persist (0600).
+// Best-effort: any failure here never blocks serving.
+func startEgressProxy(s *tsnet.Server, lc statusClient) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return
+	}
+	token, err := randToken()
+	if err != nil {
+		_ = ln.Close()
+		return
+	}
+	fmt.Printf("MESH-EGRESS http://%s %s\n", ln.Addr().String(), token)
+	srv := &http.Server{Handler: egressHandler(s.Dial, lc, token)}
+	go func() { _ = srv.Serve(ln) }()
+}
+
+// dialFunc dials a tailnet address (tsnet.Server.Dial); injectable for tests.
+type dialFunc func(ctx context.Context, network, addr string) (net.Conn, error)
+
+func egressHandler(dial dialFunc, lc statusClient, token string) http.Handler {
+	want := "Bearer " + token
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodConnect {
+			http.Error(w, "only CONNECT is supported", http.StatusMethodNotAllowed)
+			return
+		}
+		// Constant-time bearer check on the proxy hop so a stray local process
+		// cannot use the tailnet egress without the per-process token.
+		got := r.Header.Get("Proxy-Authorization")
+		if subtle.ConstantTimeCompare([]byte(got), []byte(want)) != 1 {
+			w.Header().Set("Proxy-Authenticate", "Bearer")
+			http.Error(w, "proxy authorization required", http.StatusProxyAuthRequired)
+			return
+		}
+		host, port, err := net.SplitHostPort(r.Host)
+		if err != nil {
+			http.Error(w, "bad CONNECT target", http.StatusBadRequest)
+			return
+		}
+		if !egressTargetAllowed(lc, host, port) {
+			http.Error(w, "forbidden CONNECT target", http.StatusForbidden)
+			return
+		}
+		upstream, err := dial(r.Context(), "tcp", net.JoinHostPort(host, port))
+		if err != nil {
+			http.Error(w, "upstream dial failed", http.StatusBadGateway)
+			return
+		}
+		hj, ok := w.(http.Hijacker)
+		if !ok {
+			_ = upstream.Close()
+			http.Error(w, "hijack unsupported", http.StatusInternalServerError)
+			return
+		}
+		clientConn, _, err := hj.Hijack()
+		if err != nil {
+			_ = upstream.Close()
+			return
+		}
+		_, _ = clientConn.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
+		// Splice both directions. Half-close each write end on its own EOF (so a
+		// one-way FIN — e.g. an HTTP/1.1 request with Connection: close — does not
+		// truncate the reply mid-flight), then fully close once BOTH directions
+		// have drained. net.Pipe and other non-TCP conns lack CloseWrite; the type
+		// assertion simply skips the half-close for them.
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			defer wg.Done()
+			_, _ = io.Copy(upstream, clientConn)
+			if cw, ok := upstream.(interface{ CloseWrite() error }); ok {
+				_ = cw.CloseWrite()
+			}
+		}()
+		go func() {
+			defer wg.Done()
+			_, _ = io.Copy(clientConn, upstream)
+			if cw, ok := clientConn.(interface{ CloseWrite() error }); ok {
+				_ = cw.CloseWrite()
+			}
+		}()
+		wg.Wait()
+		_ = clientConn.Close()
+		_ = upstream.Close()
+	})
+}
+
+// egressTargetAllowed permits CONNECT only to a TAGGED same-tailnet .ts.net peer
+// (exact DNSName match, never a suffix) on a served port, and rejects IP-literal
+// targets — so the loopback proxy can never be turned into a generic tailnet
+// egress, preserving the ACL's instance-isolation posture.
+func egressTargetAllowed(lc statusClient, host, port string) bool {
+	if port != "443" && port != "7777" {
+		return false
+	}
+	if net.ParseIP(host) != nil {
+		return false // no raw IPs — only MagicDNS names bound to a known tagged peer
+	}
+	want := normalizeDNSName(host)
+	if want == "" {
+		return false
+	}
+	status, err := lc.Status(context.Background())
+	if err != nil || status == nil {
+		return false
+	}
+	for _, ps := range status.Peer {
+		if ps == nil || !peerHasTag(ps, meshPeerTag) {
+			continue
+		}
+		if normalizeDNSName(ps.DNSName) == want {
+			return true
+		}
+	}
+	return false
+}
+
+func randToken() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}

package/mesh-sidecar.lock.json

@@ -1,12 +1,12 @@
 {
   "version": "1.0.0",
-  "contentHash": "dbf60b5215ebb0b0947edf8fa47906280dd1fea12ef7e1181918fecfe7d9bcc0",
+  "contentHash": "15ca95fdba8ba0d81c2e49f8f9707d2fb124f51ee3982dea3a87d11b140ab279",
   "assets": {
-    "aiordie-mesh-windows-amd64.exe": "3be314f27ddf69560cb34b40b70302609f28fe6feba7600580e68ce04a811a71",
-    "aiordie-mesh-windows-arm64.exe": "3169f41dc835522c42dc4766dcd9a608a65430fb3797120bcd1ae9e58014942c",
-    "aiordie-mesh-linux-amd64": "7fb0d9c624c85759fb20e789886d1f4e0e2b5621f8ee6105634c7e73fd44d049",
-    "aiordie-mesh-linux-arm64": "7d23eb2d8c4c9632f37ad8f11f8c8523ce7d6ce58d0607b4c73fb9ccbc261239",
-    "aiordie-mesh-darwin-amd64": "69336be9137a98d8a3409ea87702502fa82d573875041111ea46f65b2fd22442",
-    "aiordie-mesh-darwin-arm64": "f73bcb5a6107ac3c0da8a39f06af6620e2db6e66b4e3c135740d9081703fd938"
+    "ai-or-die-mesh-windows-amd64.exe": "8b194d82257e7d99e9e0f770830b2baf1ccc17f82c8aad6097fa9c7594ddc89b",
+    "ai-or-die-mesh-windows-arm64.exe": "7dc1fe73117a95b9e4889457b9f97f8a59bb547e53c2f64499e998cf2a0016e2",
+    "ai-or-die-mesh-linux-amd64": "abf133b731dd2c0dcdefaf157cb0f026d741554e1f0332d329fb2bac542d0645",
+    "ai-or-die-mesh-linux-arm64": "d63cd407521ef7e7c72dac90b5cf5ac18c92aa8243046ba7dc7b8c4da58fc468",
+    "ai-or-die-mesh-darwin-amd64": "669e36de903fedb5e5d2dc0152971c828582bf25622310f559eefb226f4221de",
+    "ai-or-die-mesh-darwin-arm64": "7f0f3fc766a87e110ecc5e908e6b86333e56f3d0517b81ce4dc582963dadad11"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-or-die",
-  "version": "0.1.89",
+  "version": "0.1.91",
   "description": "Universal AI coding terminal — Claude, Copilot, Gemini & more in your browser",
   "main": "src/server.js",
   "bin": {

package/src/artifact-review.js

@@ -9,6 +9,9 @@ const { EventEmitter } = require('events');
 const DEFAULT_POLL_HOLD_MS = 25000;
 const DEFAULT_POLL_HEARTBEAT_MS = 5000;
 const DEFAULT_SSE_HEARTBEAT_MS = 15000;
+// Bound the artifact-push await so a stalled PTY write can't hold the /prompts
+// HTTP response open. On timeout we treat the push as failed and re-queue.
+const PUSH_TIMEOUT_MS = 4000;
 
 function realpathOrResolve(file) {
   let resolved = path.resolve(file);
@@ -81,6 +84,65 @@ function feedbackHasData(snapshot) {
   );
 }
 
+// Render queued human prompts into a single message suitable for injecting into
+// the CLI as a new user turn (the artifact-push path). Pure + exported so the
+// gate decision and wording are unit-testable without a live PTY. Accepts both
+// the panel's prompt objects ({prompt, text, sourceLine}) and bare-string prompts
+// (curl/legacy). Returns '' when there is nothing actionable to push (caller
+// skips injection on empty).
+function normalizeFeedbackPrompt(p) {
+  if (typeof p === 'string') {
+    return p.trim() ? { prompt: p.trim() } : null;
+  }
+  if (p && typeof p.prompt === 'string' && p.prompt.trim()) {
+    return {
+      prompt: p.prompt.trim(),
+      text: typeof p.text === 'string' ? p.text : '',
+      sourceLine: typeof p.sourceLine === 'number' ? p.sourceLine : undefined,
+    };
+  }
+  return null;
+}
+function formatFeedbackForAgent(prompts) {
+  const items = (Array.isArray(prompts) ? prompts : [])
+    .map(normalizeFeedbackPrompt)
+    .filter(Boolean);
+  if (items.length === 0) return '';
+  const lines = items.map((p, i) => {
+    const quoted = p.text && p.text.trim()
+      ? ' (re: "' + p.text.trim().slice(0, 160) + '")'
+      : '';
+    const where = typeof p.sourceLine === 'number' ? ' [line ' + p.sourceLine + ']' : '';
+    return (i + 1) + '.' + where + quoted + ' ' + p.prompt;
+  });
+  return (
+    'Human review feedback from the artifact panel (you were idle, so this was '
+    + 'delivered as a new turn instead of through artifact_poll). Address these in '
+    + 'the open artifact, then reply with the artifact_reply tool:\n'
+    + lines.join('\n')
+  );
+}
+
+// Build the raw bytes to inject into the CLI PTY for an artifact push. Pure +
+// exported so the security-sensitive sanitization is unit-testable. Strips ALL
+// C0 control bytes and DEL except TAB and LF (this removes ESC, so the bracketed-
+// paste markers and any other escape/CSI sequence in the human text cannot
+// survive), which also drops CR so the only submit is the trailing CR we add.
+// Wraps in a bracketed paste so multi-line feedback enters the composer
+// atomically; size-capped to bound a single injection.
+function buildArtifactPushPayload(text) {
+  if (!text || typeof text !== 'string') return '';
+  const safe = text.replace(/[\x00-\x08\x0b-\x1f\x7f]/g, ' ').slice(0, 4000);
+  return '\x1b[200~' + safe + '\x1b[201~\r';
+}
+
+// Whether the artifact-push feature is enabled from its env var. Default ON:
+// only an explicit falsy value (0 / false / off / no) disables it. Pure +
+// exported so the default-on / opt-out contract is unit-tested.
+function artifactPushEnabledFromEnv(raw) {
+  return !/^(0|false|off|no)$/i.test(String(raw == null ? '' : raw).trim());
+}
+
 class ArtifactReviewStore extends EventEmitter {
   constructor() {
     super();
@@ -214,6 +276,25 @@ class ArtifactReviewStore extends EventEmitter {
     return review;
   }
 
+  // Restore prompts that were claimed (acked) for a push that then failed, back to
+  // the FRONT of the queue so order is preserved (FIFO) ahead of any prompts that
+  // arrived during the push window. Re-emits 'feedback' so an in-flight poll picks
+  // them up. Used only by the artifact-push re-queue path.
+  restoreClaimedFeedback(aiSessionId, snapshot) {
+    const review = this._reviews.get(aiSessionId);
+    if (!review || !snapshot) return null;
+    const prompts = cloneArray(snapshot.prompts);
+    if (prompts.length > 0) {
+      review.queuedPrompts.unshift(...prompts);
+      if (snapshot.dom_snapshot !== undefined && review.domSnapshot == null) {
+        review.domSnapshot = snapshot.dom_snapshot;
+      }
+      review.updatedAt = nowIso();
+      this.emit('feedback', { aiSessionId, kind: 'prompts', review });
+    }
+    return review;
+  }
+
   addAgentReply(aiSessionId, text) {
     const review = this._reviews.get(aiSessionId);
     if (!review) return null;
@@ -567,6 +648,27 @@ function createArtifactReviewRouter(options) {
   const sseHeartbeatMs = typeof options.sseHeartbeatMs === 'number'
     ? options.sseHeartbeatMs
     : DEFAULT_SSE_HEARTBEAT_MS;
+  // Optional artifact-push hook (default off). When provided, panel feedback that
+  // arrives while NO agent poll is in flight is pushed into the CLI as a new turn
+  // (so an idle agent reacts without the human switching to the terminal). The
+  // server supplies this only when AIORDIE_ARTIFACT_PUSH is enabled; it returns a
+  // truthy value when it actually injected, so we can consume the queued prompts.
+  const pushToAgent = typeof options.pushToAgent === 'function'
+    ? options.pushToAgent
+    : null;
+  const pushTimeoutMs = typeof options.pushTimeoutMs === 'number' && options.pushTimeoutMs > 0
+    ? options.pushTimeoutMs
+    : PUSH_TIMEOUT_MS;
+
+  // Count of in-flight long-poll requests per session. Non-zero means the agent
+  // is actively waiting on artifact_poll, so a queued prompt is delivered by that
+  // poll and must NOT be injected (injecting mid-turn would race the CLI's TUI).
+  const activePolls = new Map();
+  function pollDelta(sessionId, delta) {
+    const next = (activePolls.get(sessionId) || 0) + delta;
+    if (next > 0) activePolls.set(sessionId, next);
+    else activePolls.delete(sessionId);
+  }
 
   if (!store) throw new TypeError('Artifact review store is required');
   if (typeof validatePath !== 'function') throw new TypeError('validatePath is required');
@@ -731,15 +833,60 @@ function createArtifactReviewRouter(options) {
     res.sendFile(resolved.path);
   });
 
-  router.post('/:sessionId/prompts', (req, res) => {
+  router.post('/:sessionId/prompts', async (req, res) => {
     const sessionId = req.params.sessionId;
     if (!store.get(sessionId)) return res.status(404).json({ error: 'artifact review not found' });
 
     const prompts = req.body && req.body.prompts;
     if (!Array.isArray(prompts)) return res.status(400).json({ error: 'prompts must be an array' });
 
+    // Snapshot whether a poll is in flight BEFORE queuing: queuePrompts emits
+    // 'feedback' synchronously, which makes an in-flight poll deliver + tear down
+    // (decrementing the count to 0) before we could observe it. Reading the count
+    // first is the correct "was the agent waiting when this arrived?" signal.
+    const hadActivePoll = (activePolls.get(sessionId) || 0) > 0;
+
     const review = store.queuePrompts(sessionId, prompts, req.body ? req.body.domSnapshot : undefined);
-    res.json({ ok: true, queued: review ? review.queuedPrompts.length : 0 });
+
+    // Artifact push (default off; pushToAgent is null unless enabled). If the
+    // agent was NOT waiting on a poll, the queued feedback would otherwise sit
+    // until the agent next polls. Push it into the CLI as a new turn so an idle
+    // agent reacts. When a poll WAS in flight the queue path already delivers it,
+    // so we never inject then (injecting mid-turn would race the TUI).
+    //
+    // We CLAIM the feedback (ackFeedback) synchronously BEFORE the await, so a
+    // poll that arrives during the push window sees an empty queue and cannot
+    // also deliver the same feedback (no double-delivery). If the push then fails
+    // or times out we re-queue exactly what we claimed, so feedback is never lost
+    // and the poll path still works. The server hook applies its own PTY-quiet
+    // idle check and may decline.
+    let pushed = false;
+    if (pushToAgent && !hadActivePoll) {
+      const snapshot = store.peekFeedback(sessionId);
+      const text = feedbackHasData(snapshot) ? formatFeedbackForAgent(snapshot.prompts) : '';
+      if (text) {
+        store.ackFeedback(sessionId, snapshot); // claim before await
+        try {
+          pushed = !!(await Promise.race([
+            Promise.resolve(pushToAgent(sessionId, text)),
+            new Promise((resolve) => setTimeout(() => resolve(false), pushTimeoutMs)),
+          ]));
+        } catch (_) {
+          pushed = false;
+        }
+        if (!pushed) {
+          // Re-queue what we claimed (to the FRONT, preserving order) so the poll
+          // path still delivers it.
+          store.restoreClaimedFeedback(sessionId, snapshot);
+        }
+      }
+    }
+
+    res.json({
+      ok: true,
+      pushed,
+      queued: pushed ? 0 : (review ? review.queuedPrompts.length : 0),
+    });
   });
 
   router.post('/:sessionId/layout-warnings', (req, res) => {
@@ -849,11 +996,18 @@ function createArtifactReviewRouter(options) {
     res.setHeader('X-Accel-Buffering', 'no');
     if (typeof res.flushHeaders === 'function') res.flushHeaders();
 
+    // This request is now an in-flight poll; mark the agent as actively waiting
+    // so concurrent /prompts feedback is delivered HERE (not injected into the
+    // PTY). Decremented exactly once on teardown.
+    let pollCounted = true;
+    pollDelta(sessionId, 1);
+
     let done = false;
     let snapshotToAck = null;
     let timeout = null;
     let heartbeat = null;
     function cleanup() {
+      if (pollCounted) { pollCounted = false; pollDelta(sessionId, -1); }
       if (timeout) clearTimeout(timeout);
       if (heartbeat) clearInterval(heartbeat);
       store.removeListener('feedback', onFeedback);
@@ -924,6 +1078,9 @@ module.exports = {
   createAssetTokenSigner,
   createArtifactReviewRouter,
   feedbackHasData,
+  formatFeedbackForAgent,
+  buildArtifactPushPayload,
+  artifactPushEnabledFromEnv,
   injectLavishSdk,
   isMarkdownFile,
   markdownArtifactShell,

package/src/base-bridge.js

@@ -320,6 +320,10 @@ class BaseBridge {
         workingDir,
         created: new Date(),
         active: true,
+        // Epoch ms of the most recent PTY output, updated in the onData handler.
+        // Used by the artifact-push idle gate (msSinceLastOutput) to avoid
+        // injecting input while the CLI is actively rendering. Seeded at spawn.
+        lastOutputAt: Date.now(),
         killTimeout: null,
         writeQueue: Promise.resolve(),
         // PTY listener handles registered against ptyProcess.{onData,onExit,on('error')}.
@@ -382,6 +386,7 @@ class BaseBridge {
           receivedLifeSign = true;
           clearTimeout(spawnWatchdog);
         }
+        session.lastOutputAt = Date.now();
 
         if (process.env.DEBUG) {
           console.log(`${this.toolName} session ${sessionId} output:`, data);
@@ -558,6 +563,19 @@ class BaseBridge {
     return session.writeQueue;
   }
 
+  /**
+   * Milliseconds since this session's PTY last emitted output, or null if there
+   * is no active session. Used by the artifact-push idle gate to skip injecting
+   * input while the CLI is actively rendering (a proxy for "not mid-turn").
+   * @param {string} sessionId
+   * @returns {number|null}
+   */
+  msSinceLastOutput(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session || !session.active) return null;
+    return Date.now() - (session.lastOutputAt || 0);
+  }
+
   /**
    * Write data to the PTY in chunks to prevent kernel buffer overflow.
    * @private

package/src/mesh-manager.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // MeshManager — permanent reachability over a Tailscale tailnet via the
-// aiordie-mesh sidecar (tsnet in USERSPACE: no kernel TUN, no admin, no system
+// ai-or-die-mesh sidecar (tsnet in USERSPACE: no kernel TUN, no admin, no system
 // service). Only ai-or-die's own port joins the mesh; the rest of the machine
 // stays off it. Mirrors TunnelManager's lifecycle (detect → start → backoff →
 // stop) so bin/ai-or-die.js supervises it like the dev tunnel. Verified E2E:
@@ -11,6 +11,7 @@ const { spawn } = require('child_process');
 const os = require('os');
 const path = require('path');
 const fs = require('fs');
+const crypto = require('crypto');
 
 const URL_TIMEOUT_MS = 60000;          // enroll + name can take ~30s on first run
 const STABILITY_THRESHOLD_MS = 60000;  // 60s up = reset retry budget
@@ -38,11 +39,11 @@ class MeshManager {
       ? path.join(localApp, 'ai-or-die')
       : path.join(os.homedir(), '.ai-or-die');
     this.stateDir = options.stateDir || path.join(this._appBase, 'ts-state');
-    // The sidecar binary is content-addressed: its path embeds the lock's
-    // contentHash so a new build installs alongside the old one (no overwrite of
-    // a running .exe). Derived from the installer's lock + path helpers.
+    // The sidecar is LAUNCHED from a stable, hash-free path (ai-or-die-mesh[.exe])
+    // so a single-file WDAC/AppLocker allow-list rule matches the executed image
+    // across versions (ADR-0036). The installer verifies + replaces it in place.
     this._installer = options._installer || require('./utils/sidecar-installer');
-    this.sidecar = options.sidecar || this._sidecarPathFromLock(this._appBase);
+    this.sidecar = options.sidecar || this._stableSidecarPath(this._appBase);
     this.hostname = (options.hostname || `aiordie-${os.hostname()}`).toLowerCase().replace(/[^a-z0-9-]/g, '');
 
     this.proc = null;
@@ -59,12 +60,16 @@ class MeshManager {
     this._stabilityThresholdMs = options._stabilityThresholdMs || STABILITY_THRESHOLD_MS;
     this._stdoutBuffer = '';
     this.peers = null;
+    this._untaggedWarned = false;
   }
 
   /** Never throws — degrades to localhost/devtunnel on any failure. */
   async start() {
     console.log('\n  Connecting mesh (Tailscale userspace)...');
     this.stopping = false;
+    // Clear any egress.json left by a crashed/kill -9'd prior run BEFORE (re)spawn,
+    // so a consumer can't route to a freed loopback port a local process squatted.
+    this._deleteEgressFile();
     if (!fs.existsSync(this.sidecar)) {
       if (!(await this._ensureSidecar())) { this._printMissing(this._lastError); return; }
     }
@@ -73,13 +78,12 @@ class MeshManager {
     await this._spawn();
   }
 
-  /** Content-addressed sidecar path from the committed lock; safe fallback. */
-  _sidecarPathFromLock(base) {
+  /** Stable, hash-free sidecar path from the installer; safe fallback. */
+  _stableSidecarPath(base) {
     try {
-      const lock = this._installer.loadLock();
-      return this._installer.sidecarPath(lock.contentHash);
+      return this._installer.stableSidecarPath();
     } catch (_) {
-      const exe = process.platform === 'win32' ? 'aiordie-mesh.exe' : 'aiordie-mesh';
+      const exe = process.platform === 'win32' ? 'ai-or-die-mesh.exe' : 'ai-or-die-mesh';
       return path.join(base, 'bin', exe);
     }
   }
@@ -113,6 +117,7 @@ class MeshManager {
   async stop() {
     this.stopping = true;
     this._deletePeersFile();
+    this._deleteEgressFile();
     this._clearStabilityTimer();
     clearTimeout(this._restartDelayTimer);
     if (this._restartDelayResolve) { this._restartDelayResolve(); this._restartDelayResolve = null; }
@@ -156,6 +161,7 @@ class MeshManager {
           }
           if (/^MESH-NEEDLOGIN\b/.test(line)) {
             this._deletePeersFile();
+            this._deleteEgressFile();
             this._printNotEnrolled();
             if (!done) { done = true; clearTimeout(timer); resolve(); }
           }
@@ -164,7 +170,7 @@ class MeshManager {
       this.proc.stderr.on('data', (d) => { if (this.dev) process.stderr.write(`  [mesh] ${d}`); });
       this.proc.on('error', (e) => { console.error(`  \x1b[31mmesh sidecar failed: ${e.message}\x1b[0m`); this.proc = null; if (!done) { done = true; clearTimeout(timer); resolve(); } });
       this.proc.on('exit', (code) => {
-        this._clearStabilityTimer(); this.proc = null; this.dnsName = null; this._deletePeersFile();
+        this._clearStabilityTimer(); this.proc = null; this.dnsName = null; this._deletePeersFile(); this._deleteEgressFile();
         if (!this.stopping && code !== 0) this._restart();
       });
     });
@@ -189,7 +195,9 @@ class MeshManager {
 
   _handleStdoutLine(line) {
     try {
-      if (/^MESH-NEEDLOGIN\b/.test(line)) this._deletePeersFile();
+      if (/^MESH-NEEDLOGIN\b/.test(line)) { this._deletePeersFile(); this._deleteEgressFile(); return; }
+      if (/^MESH-EGRESS\b/.test(line)) { this._handleEgressLine(line); return; }
+      if (/^MESH-UNTAGGED\b/.test(line)) { this._handleUntaggedLine(line); return; }
       const match = /^MESH-PEERS\s+(.+)$/.exec(line);
       if (!match) return;
       const raw = match[1];
@@ -206,6 +214,8 @@ class MeshManager {
       const normalized = this._validatePeersPayload(parsed);
       if (!normalized) return;
       this.peers = normalized;
+      // Recovered: tagged peers are visible again, so re-arm the untagged warning.
+      if (normalized.peers.length > 0) this._untaggedWarned = false;
       this._writePeersFile(normalized);
     } catch (_) {}
   }
@@ -249,6 +259,70 @@ class MeshManager {
     try { fs.rmSync(this.peersFilePath(), { force: true }); } catch (_) {}
   }
 
+  egressFilePath() {
+    return path.join(this._appBase, 'mesh', 'egress.json');
+  }
+
+  // Parse `MESH-EGRESS <url> <token>` and persist the loopback CONNECT-proxy
+  // endpoint + local secret for a same-box conductor (github-router) to consume.
+  // Only a loopback http URL is ever accepted; the token is a local credential.
+  _handleEgressLine(line) {
+    const m = /^MESH-EGRESS\s+(\S+)\s+(\S+)\s*$/.exec(line);
+    if (!m) return;
+    const url = m[1];
+    const token = m[2];
+    let u;
+    try { u = new URL(url); } catch (_) { return; }
+    if (u.protocol !== 'http:') return;
+    const host = u.hostname.replace(/^\[/, '').replace(/\]$/, '');
+    // Only a numeric loopback literal — never `localhost`, whose resolution a
+    // consumer's DNS/hosts config could rebind off-host.
+    if (host !== '127.0.0.1' && host !== '::1') return;
+    if (!token || /\s/.test(token)) return;
+    this._writeEgressFile(url, token);
+  }
+
+  _writeEgressFile(url, token) {
+    const file = this.egressFilePath();
+    const dir = path.dirname(file);
+    // Random, exclusive-create tmp so a pre-planted symlink at a predictable path
+    // can't redirect the write (TOCTOU / symlink clobber).
+    const tmp = path.join(dir, `egress.json.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(tmp, JSON.stringify({
+        version: 1,
+        pid: this.proc ? this.proc.pid : process.pid,
+        updatedAt: Date.now(),
+        url,
+        token,
+      }), { mode: 0o600, flag: 'wx' });
+      fs.chmodSync(tmp, 0o600);
+      fs.renameSync(tmp, file);
+    } catch (_) {
+      try { fs.rmSync(tmp, { force: true }); } catch (_) {}
+    }
+  }
+
+  _deleteEgressFile() {
+    try { fs.rmSync(this.egressFilePath(), { force: true }); } catch (_) {}
+  }
+
+  // Actionable one-shot hint: tailnet peers exist but none carry tag:aiordie, so
+  // fleet discovery will surface nothing until they are tagged. The exact failure
+  // this whole path guards against — surfaced, not silent.
+  _handleUntaggedLine(line) {
+    if (this._untaggedWarned) return;
+    const m = /^MESH-UNTAGGED\s+(\S+)\s+(\d+)\s+(\d+)\s*$/.exec(line);
+    if (!m) return;
+    this._untaggedWarned = true;
+    const total = m[2];
+    console.log(`\n  \x1b[33mMesh: ${total} tailnet device(s) visible but \x1b[1m0 tagged tag:aiordie\x1b[0m\x1b[33m.\x1b[0m`);
+    console.log('    Fleet discovery stays EMPTY until instances carry the tag:');
+    console.log('    • enroll with a REUSABLE + TAGGED key (tag:aiordie), or retag each device in the admin console;');
+    console.log('    • ensure the ACL allows your conductor → tag:aiordie on the served ports (docs/mesh-acl.example.hujson).');
+  }
+
   _printMissing(err) {
     const code = err && err.code;
     const map = {

package/src/public/components/artifact-panel.css

@@ -212,3 +212,60 @@
     linear-gradient(135deg, transparent 0 50%, var(--border-hover, #484f58) 50% 60%, transparent 60% 70%, var(--border-hover, #484f58) 70% 80%, transparent 80%);
 }
 .artifact-panel__resize[hidden] { display: none; }
+
+/* Maximized layout: horizontal split. Artifact content is the large flexible
+   pane; chat is a fixed 360px right rail (the lavish-axi / mainstream artifact-UI
+   model). Maximizing is a request for content WIDTH, so spend the reclaimed
+   space on the artifact, not on a wide chat. CSS grid (not a JS reparent) places
+   pillbar / chat / chatbar into the rail in source order: pills at the rail top,
+   chat filling the middle, the composer at the bottom. Reverts to the default
+   vertical stack under 1024px, where a narrow window reads better stacked. */
+.artifact-panel--maximized .artifact-panel__body {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) 360px;
+  grid-template-rows: auto minmax(0, 1fr) auto;
+}
+.artifact-panel--maximized .artifact-panel__frame {
+  grid-column: 1;
+  grid-row: 1 / 4; /* content spans the full height on the left */
+  /* The frame is an <iframe> (a replaced element): it uses its intrinsic size and
+     does NOT stretch to fill a grid cell like a normal block, so it needs explicit
+     100% dimensions (the old flex layout filled it via `flex: 1`). */
+  width: 100%;
+  height: 100%;
+}
+.artifact-panel--maximized .artifact-panel__pillbar {
+  grid-column: 2;
+  grid-row: 1;
+  border-left: 1px solid var(--panel-border, #33363f);
+}
+.artifact-panel--maximized .artifact-panel__chat {
+  grid-column: 2;
+  grid-row: 2;
+  max-height: none; /* fill the rail middle row instead of the 30% cap */
+  border-left: 1px solid var(--panel-border, #33363f);
+}
+.artifact-panel--maximized .artifact-panel__chatbar {
+  grid-column: 2;
+  grid-row: 3;
+  border-left: 1px solid var(--panel-border, #33363f);
+}
+
+/* Narrow viewport: revert the maximized panel to the vertical stack so the
+   content is not squeezed into a sliver beside a 360px rail. */
+@media (max-width: 1024px) {
+  .artifact-panel--maximized .artifact-panel__body {
+    display: flex;
+    flex-direction: column;
+  }
+  .artifact-panel--maximized .artifact-panel__frame,
+  .artifact-panel--maximized .artifact-panel__pillbar,
+  .artifact-panel--maximized .artifact-panel__chat,
+  .artifact-panel--maximized .artifact-panel__chatbar {
+    grid-column: auto;
+    grid-row: auto;
+    border-left: none;
+  }
+  .artifact-panel--maximized .artifact-panel__frame { width: 100%; }
+  .artifact-panel--maximized .artifact-panel__chat { max-height: 30%; }
+}

package/src/server.js

@@ -37,7 +37,7 @@ const KeepaliveManager = require('./keepalive-manager');
 const { ControlEventBus, EVENT_KINDS: CONTROL_EVENT_KINDS } = require('./control/event-bus');
 const TranscriptBuffer = require('./sticky-note-transcript');
 const { createControlRouter } = require('./control/routes');
-const { ArtifactReviewStore, createArtifactReviewRouter, createAssetTokenSigner } = require('./artifact-review');
+const { ArtifactReviewStore, createArtifactReviewRouter, createAssetTokenSigner, buildArtifactPushPayload, artifactPushEnabledFromEnv } = require('./artifact-review');
 const { deriveStatus, awaitingKindForPendingTool, awaitingFromScreen, TRUST_PROMPT_REGEX, DEFAULT_UNBOUND_QUIET_MS } = require('./control/session-status');
 const { detectAwaiting } = require('./control/jsonl-awaiting');
 
@@ -166,6 +166,14 @@ class ClaudeCodeWebServer {
     this.artifactPollHoldMs = options.artifactPollHoldMs || 25000;
     this.artifactPollHeartbeatMs = options.artifactPollHeartbeatMs || 5000;
     this.artifactSseHeartbeatMs = options.artifactSseHeartbeatMs || 15000;
+    // Artifact push (default ON): panel feedback that arrives while the agent is
+    // idle (no in-flight poll + PTY quiet) is injected into the CLI as a new turn,
+    // so the composer works without the human switching to the terminal or the
+    // agent having to poll. Opt OUT with AIORDIE_ARTIFACT_PUSH=0 (or false/off/no).
+    // The idle-gate + residual TUI-timing risk are recorded in docs/adrs/0035.
+    this._artifactPushEnabled = artifactPushEnabledFromEnv(process.env.AIORDIE_ARTIFACT_PUSH);
+    const quietRaw = Number(process.env.AIORDIE_ARTIFACT_PUSH_QUIET_MS);
+    this._artifactPushQuietMs = Number.isFinite(quietRaw) && quietRaw > 0 ? quietRaw : 1500;
     // PROC-04: min-heap of {id, lastActivity} pairs keyed by lastActivity.
     // Used by _evictStaleSessions to find the oldest session in O(log n)
     // rather than scanning the full Map every 5 min. Lazy-tombstone protocol
@@ -1270,6 +1278,9 @@ class ClaudeCodeWebServer {
       pollHoldMs: this.artifactPollHoldMs,
       pollHeartbeatMs: this.artifactPollHeartbeatMs,
       sseHeartbeatMs: this.artifactSseHeartbeatMs,
+      pushToAgent: this._artifactPushEnabled
+        ? (sessionId, text) => this._pushArtifactFeedbackToAgent(sessionId, text)
+        : null,
     }));
 
     // Commands API removed
@@ -4101,6 +4112,48 @@ class ClaudeCodeWebServer {
     return bridges[agentType] || null;
   }
 
+  // Return the bridge that currently owns a live PTY for `sessionId`, or null.
+  // Uses msSinceLastOutput (null when the session is absent/inactive) so we
+  // don't reach into a bridge's private session map.
+  _bridgeForSession(sessionId) {
+    const bridges = [
+      this.claudeBridge, this.terminalBridge,
+      this.codexBridge, this.copilotBridge, this.geminiBridge,
+    ];
+    for (const bridge of bridges) {
+      if (bridge && typeof bridge.msSinceLastOutput === 'function'
+          && bridge.msSinceLastOutput(sessionId) !== null) {
+        return bridge;
+      }
+    }
+    return null;
+  }
+
+  // Artifact-push hook (wired only when AIORDIE_ARTIFACT_PUSH is enabled). Inject
+  // panel feedback into the idle CLI as a NEW turn. Returns true only if it
+  // actually wrote to the PTY (the caller then consumes the queued prompts).
+  // Idle gate: decline when the session's PTY emitted output within the quiet
+  // window (likely mid-render / mid-turn), a heuristic, hence opt-in. Bracketed
+  // paste keeps multi-line feedback atomic; a trailing CR submits the turn.
+  async _pushArtifactFeedbackToAgent(sessionId, text) {
+    if (!text || typeof text !== 'string') return false;
+    const bridge = this._bridgeForSession(sessionId);
+    if (!bridge) return false;
+    const quietMs = bridge.msSinceLastOutput(sessionId);
+    if (quietMs === null || quietMs < this._artifactPushQuietMs) return false;
+    // Sanitize + bracketed-paste-wrap the human text (pure helper, unit-tested in
+    // artifact-review): strips ESC/control bytes so nothing can break out of the
+    // paste envelope, and a trailing CR submits the turn.
+    const payload = buildArtifactPushPayload(text);
+    if (!payload) return false;
+    try {
+      await bridge.sendInput(sessionId, payload);
+      return true;
+    } catch (_) {
+      return false;
+    }
+  }
+
   _buildControlDeps() {
     return {
       sessions: this.claudeSessions,

package/src/utils/sidecar-installer.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Sidecar installer — fetches the prebuilt aiordie-mesh tsnet binary for the
+// Sidecar installer — fetches the prebuilt ai-or-die-mesh tsnet binary for the
 // current platform and verifies it against a SHA-256 that ships INSIDE this npm
 // package (mesh-sidecar.lock.json). Trust is therefore anchored by the signed
 // npm artifact, not by a checksums file fetched from the same mutable GitHub
@@ -12,7 +12,7 @@
 // CI only rebuilds when the source — and thus the hash — changes.
 //
 // Asset convention (published by .github/workflows/release-on-main.yml):
-//   aiordie-mesh-<plat>-<arch>[.exe]   plat: windows|linux|darwin  arch: amd64|arm64
+//   ai-or-die-mesh-<plat>-<arch>[.exe]   plat: windows|linux|darwin  arch: amd64|arm64
 
 const fs = require('fs');
 const fsp = require('fs').promises;
@@ -44,7 +44,7 @@ function assetName() {
   const plat = PLAT[process.platform];
   const arch = ARCH[process.arch];
   if (!plat || !arch) return null;
-  return `aiordie-mesh-${plat}-${arch}${process.platform === 'win32' ? '.exe' : ''}`;
+  return `ai-or-die-mesh-${plat}-${arch}${process.platform === 'win32' ? '.exe' : ''}`;
 }
 
 function baseDir() {
@@ -52,11 +52,32 @@ function baseDir() {
   return process.platform === 'win32' ? path.join(localApp, 'ai-or-die') : path.join(os.homedir(), '.ai-or-die');
 }
 
-// Versioned path: a new contentHash installs alongside the old one, so we never
-// rename over a binary that a running sidecar still has open (Windows EPERM).
-function sidecarPath(contentHash) {
+// Stable runnable path (NO content hash): the manager LAUNCHES this path, so a
+// single-file WDAC/AppLocker allow-list rule matches the executed image across
+// every version. This trades ADR-0035's install-alongside for that match; it is
+// safe because the stable file is free at process start (the prior ai-or-die and
+// its sidecar have exited), and the MOTW/quarantine mark is stripped after the
+// SHA-256 verify so a re-download is not re-gated. See ADR-0036.
+function stableSidecarPath() {
   const ext = process.platform === 'win32' ? '.exe' : '';
-  return path.join(baseDir(), 'bin', `aiordie-mesh-${contentHash}${ext}`);
+  return path.join(baseDir(), 'bin', `ai-or-die-mesh${ext}`);
+}
+
+// Best-effort provenance strip AFTER the SHA-256 verify: remove Windows
+// mark-of-the-web (Zone.Identifier ADS) / macOS Gatekeeper quarantine so the
+// freshly-verified binary is not re-gated by SmartScreen/Gatekeeper on each new
+// version. We verified the bytes against the checksum shipped in the signed npm
+// package, so this de-gates only a binary we already trust. Never throws.
+function stripProvenance(file) {
+  try {
+    if (process.platform === 'win32') {
+      fs.rmSync(`${file}:Zone.Identifier`, { force: true });
+    } else if (process.platform === 'darwin') {
+      try {
+        require('child_process').execFileSync('xattr', ['-d', 'com.apple.quarantine', file], { stdio: 'ignore' });
+      } catch (_) { /* xattr absent or attribute not set */ }
+    }
+  } catch (_) { /* best-effort */ }
 }
 
 // The release ref to fetch from. Defaults to mesh-<contentHash>; an explicit
@@ -127,11 +148,11 @@ async function ensureSidecar(dest, opts = {}) {
     throw new SidecarError('lock-unfinalized', `mesh-sidecar.lock.json has no checksum for ${name} (built without the mesh asset pipeline?)`);
   }
 
-  dest = dest || sidecarPath(lock.contentHash);
+  dest = dest || stableSidecarPath();
 
   // Existing file: trust only if it matches; otherwise replace it.
   if (fs.existsSync(dest)) {
-    if ((await _sha256(dest)).toLowerCase() === want) return dest;
+    if ((await _sha256(dest)).toLowerCase() === want) { stripProvenance(dest); return dest; }
     try { await fsp.unlink(dest); }
     catch (e) {
       if (e.code === 'EPERM' || e.code === 'EBUSY' || e.code === 'EACCES') {
@@ -157,7 +178,7 @@ async function ensureSidecar(dest, opts = {}) {
     } catch (e) {
       // Lost a race to a concurrent installer (or the file is locked). If the
       // destination is now present and valid, accept it; otherwise surface it.
-      if (fs.existsSync(dest) && (await _sha256(dest)).toLowerCase() === want) return dest;
+      if (fs.existsSync(dest) && (await _sha256(dest)).toLowerCase() === want) { stripProvenance(dest); return dest; }
       if (e.code === 'EPERM' || e.code === 'EBUSY' || e.code === 'EACCES') {
         throw new SidecarError('locked-binary', `cannot install sidecar at ${dest} (${e.code})`);
       }
@@ -166,7 +187,8 @@ async function ensureSidecar(dest, opts = {}) {
   } finally {
     try { await fsp.unlink(tmp); } catch (_) {}
   }
+  stripProvenance(dest);
   return dest;
 }
 
-module.exports = { ensureSidecar, sidecarPath, assetName, loadLock, SidecarError };
+module.exports = { ensureSidecar, stableSidecarPath, assetName, loadLock, SidecarError };

package/mesh/main_test.go

@@ -1,123 +0,0 @@
-package main
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"testing"
-)
-
-func TestResolveBackend(t *testing.T) {
-	cases := []struct {
-		name      string
-		backend   string
-		port      string
-		wantErr   bool
-		wantHost  string // expected resolved u.Host when no error
-	}{
-		{"default port → loopback", "", "7777", false, "127.0.0.1:7777"},
-		{"explicit loopback v4", "http://127.0.0.1:8080", "0", false, "127.0.0.1:8080"},
-		{"loopback v6", "http://[::1]:8080", "0", false, "[::1]:8080"},
-		{"ipv4-mapped loopback", "http://[::ffff:127.0.0.1]:8080", "0", false, "[::ffff:127.0.0.1]:8080"},
-		{"localhost normalized to 127.0.0.1", "http://localhost:9000", "0", false, "127.0.0.1:9000"},
-		{"https loopback allowed", "https://127.0.0.1:8443", "0", false, "127.0.0.1:8443"},
-		{"off-host private ip rejected", "http://10.0.0.5:80", "0", true, ""},
-		{"0.0.0.0 rejected", "http://0.0.0.0:80", "0", true, ""},
-		{"public ip rejected", "http://93.184.216.34:80", "0", true, ""},
-		{"arbitrary dns rejected", "http://evil.example.com:80", "0", true, ""},
-		{"non-loopback v6 rejected", "http://[2001:db8::1]:80", "0", true, ""},
-		{"bad scheme rejected", "ftp://127.0.0.1:80", "0", true, ""},
-		{"file scheme rejected", "file:///etc/passwd", "0", true, ""},
-		{"garbage rejected", "://nope", "0", true, ""},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			u, err := resolveBackend(c.backend, c.port)
-			if c.wantErr {
-				if err == nil {
-					t.Fatalf("expected error for backend=%q, got host=%q", c.backend, u.Host)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error for backend=%q: %v", c.backend, err)
-			}
-			if u.Host != c.wantHost {
-				t.Fatalf("backend=%q → host=%q, want %q", c.backend, u.Host, c.wantHost)
-			}
-		})
-	}
-}
-
-func TestIsLoopbackHost(t *testing.T) {
-	loop := []string{"localhost", "127.0.0.1", "127.0.0.2", "::1", "::ffff:127.0.0.1"}
-	notLoop := []string{"0.0.0.0", "10.0.0.1", "192.168.1.1", "93.184.216.34", "2001:db8::1", "example.com", ""}
-	for _, h := range loop {
-		if !isLoopbackHost(h) {
-			t.Errorf("isLoopbackHost(%q) = false, want true", h)
-		}
-	}
-	for _, h := range notLoop {
-		if isLoopbackHost(h) {
-			t.Errorf("isLoopbackHost(%q) = true, want false", h)
-		}
-	}
-}
-
-// End-to-end through the actual reverse proxy (no tailnet): a real loopback
-// backend must receive the X-Forwarded-Proto/Host the edge stamps, the app
-// bearer, and the pointer-captured proto must reflect the post-TLS decision.
-func TestEdgeProxyForwardsProtoHostAndAuth(t *testing.T) {
-	var gotProto, gotHost, gotAuth, gotBody string
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotProto = r.Header.Get("X-Forwarded-Proto")
-		gotHost = r.Header.Get("X-Forwarded-Host")
-		gotAuth = r.Header.Get("Authorization")
-		io.WriteString(w, "backend-ok")
-	}))
-	defer backend.Close()
-
-	target, _ := url.Parse(backend.URL) // 127.0.0.1 loopback
-	proto := "http"                      // default before the TLS decision
-	rp := newEdgeProxy(target, "node.tailnet.ts.net", &proto, "app-token")
-	proto = "https" // edge decided real TLS AFTER constructing the proxy
-
-	front := httptest.NewServer(rp)
-	defer front.Close()
-
-	res, err := http.Get(front.URL + "/app")
-	if err != nil {
-		t.Fatalf("proxy request failed: %v", err)
-	}
-	defer res.Body.Close()
-	b, _ := io.ReadAll(res.Body)
-	gotBody = string(b)
-
-	if gotProto != "https" {
-		t.Errorf("backend saw X-Forwarded-Proto=%q, want https (pointer-captured decision)", gotProto)
-	}
-	if gotHost != "node.tailnet.ts.net" {
-		t.Errorf("backend saw X-Forwarded-Host=%q, want node.tailnet.ts.net", gotHost)
-	}
-	if gotAuth != "Bearer app-token" {
-		t.Errorf("backend saw Authorization=%q, want Bearer app-token", gotAuth)
-	}
-	if gotBody != "backend-ok" {
-		t.Errorf("proxy body=%q, want backend-ok", gotBody)
-	}
-}
-
-func TestRedirectToHTTPS(t *testing.T) {
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequest("GET", "http://anything/path?q=1", nil)
-	redirectToHTTPS("node.tailnet.ts.net")(rec, req)
-	if rec.Code != http.StatusPermanentRedirect {
-		t.Fatalf("status=%d, want 308", rec.Code)
-	}
-	loc := rec.Header().Get("Location")
-	if !strings.HasPrefix(loc, "https://node.tailnet.ts.net/path") || !strings.Contains(loc, "q=1") {
-		t.Fatalf("Location=%q, want https://node.tailnet.ts.net/path?q=1", loc)
-	}
-}