ai-or-die 0.1.90 → 0.1.91

package/mesh/go.mod

@@ -1,4 +1,4 @@
-module aiordie-mesh
+module ai-or-die-mesh
 
 go 1.23
 

package/mesh/main.go

@@ -1,4 +1,4 @@
-// Command aiordie-mesh is the userspace mesh sidecar for ai-or-die. It joins a
+// Command ai-or-die-mesh is the userspace mesh sidecar for ai-or-die. It joins a
 // Tailscale tailnet entirely in userspace via tsnet (no kernel TUN, no admin,
 // no system service) and reverse-proxies the tailnet listener to ai-or-die's
 // local HTTP/WebSocket port. Only this one port is exposed on the mesh; the
@@ -18,16 +18,24 @@
 //   MESH-URL http://<name>       node is up, but TLS certs unavailable (degraded)
 //   MESH-NOCERT                  hint: enable HTTPS Certificates in the tailnet
 //   MESH-PEERS {"self":...,"peers":[...]} tagged fleet peers snapshot
+//   MESH-EGRESS http://127.0.0.1:<port> <token>  loopback CONNECT proxy for a
+//                                same-box conductor to reach tagged tailnet peers
+//   MESH-UNTAGGED <selfTagged> <total> <tagged>  tailnet peers exist but none are
+//                                tagged tag:aiordie — discovery will stay empty
 //   MESH-NEEDLOGIN <url>         no/!valid key — operator must enroll
 //   MESH-ERR <msg>               fatal
 package main
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/subtle"
 	"crypto/tls"
+	"encoding/hex"
 	"encoding/json"
 	"flag"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httputil"
@@ -35,6 +43,7 @@ import (
 	"os"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"tailscale.com/ipn/ipnstate"
@@ -93,6 +102,10 @@ func main() {
 
 	if lc, err := s.LocalClient(); err == nil {
 		go emitMeshPeersLoop(context.Background(), lc)
+		// Loopback egress: lets a same-box conductor (github-router) reach tagged
+		// tailnet peers over WireGuard without the host OS joining the tailnet.
+		// Best-effort — a failure here never blocks serving.
+		startEgressProxy(s, lc)
 	}
 
 	name := *host
@@ -223,6 +236,29 @@ func emitMeshPeers(ctx context.Context, lc statusClient) {
 		return
 	}
 	fmt.Printf("MESH-PEERS %s\n", b)
+
+	// Diagnostic: tailnet peers exist but none are tagged tag:aiordie, so the
+	// snapshot above is empty and fleet discovery will surface nothing. Emit a
+	// machine-parseable line the manager turns into an actionable hint — the
+	// silent-empty-peers state is the exact failure this whole path guards against.
+	total, tagged := peerCounts(status)
+	if total > 0 && tagged == 0 {
+		selfTagged := status.Self != nil && peerHasTag(status.Self, meshPeerTag)
+		fmt.Printf("MESH-UNTAGGED %t %d %d\n", selfTagged, total, tagged)
+	}
+}
+
+func peerCounts(status *ipnstate.Status) (total, tagged int) {
+	for _, ps := range status.Peer {
+		if ps == nil {
+			continue
+		}
+		total++
+		if peerHasTag(ps, meshPeerTag) {
+			tagged++
+		}
+	}
+	return total, tagged
 }
 
 func meshPeersFromStatus(status *ipnstate.Status) meshPeersSnapshot {
@@ -339,3 +375,135 @@ func newEdgeProxy(target *url.URL, name string, proto *string, proxyBearer strin
 	}
 	return rp
 }
+
+// startEgressProxy stands up a loopback HTTP CONNECT proxy so a same-box conductor
+// process (github-router) can reach TAGGED tailnet peers over the sidecar's
+// in-process WireGuard — the host OS never joins the tailnet. It is bound to
+// loopback, gated by a random per-process bearer, and restricted to tagged
+// .ts.net peers on the served ports, so a stray local process can neither turn it
+// into a generic tailnet egress nor learn the token off the wire. The endpoint +
+// token are announced via MESH-EGRESS for the manager to persist (0600).
+// Best-effort: any failure here never blocks serving.
+func startEgressProxy(s *tsnet.Server, lc statusClient) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return
+	}
+	token, err := randToken()
+	if err != nil {
+		_ = ln.Close()
+		return
+	}
+	fmt.Printf("MESH-EGRESS http://%s %s\n", ln.Addr().String(), token)
+	srv := &http.Server{Handler: egressHandler(s.Dial, lc, token)}
+	go func() { _ = srv.Serve(ln) }()
+}
+
+// dialFunc dials a tailnet address (tsnet.Server.Dial); injectable for tests.
+type dialFunc func(ctx context.Context, network, addr string) (net.Conn, error)
+
+func egressHandler(dial dialFunc, lc statusClient, token string) http.Handler {
+	want := "Bearer " + token
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodConnect {
+			http.Error(w, "only CONNECT is supported", http.StatusMethodNotAllowed)
+			return
+		}
+		// Constant-time bearer check on the proxy hop so a stray local process
+		// cannot use the tailnet egress without the per-process token.
+		got := r.Header.Get("Proxy-Authorization")
+		if subtle.ConstantTimeCompare([]byte(got), []byte(want)) != 1 {
+			w.Header().Set("Proxy-Authenticate", "Bearer")
+			http.Error(w, "proxy authorization required", http.StatusProxyAuthRequired)
+			return
+		}
+		host, port, err := net.SplitHostPort(r.Host)
+		if err != nil {
+			http.Error(w, "bad CONNECT target", http.StatusBadRequest)
+			return
+		}
+		if !egressTargetAllowed(lc, host, port) {
+			http.Error(w, "forbidden CONNECT target", http.StatusForbidden)
+			return
+		}
+		upstream, err := dial(r.Context(), "tcp", net.JoinHostPort(host, port))
+		if err != nil {
+			http.Error(w, "upstream dial failed", http.StatusBadGateway)
+			return
+		}
+		hj, ok := w.(http.Hijacker)
+		if !ok {
+			_ = upstream.Close()
+			http.Error(w, "hijack unsupported", http.StatusInternalServerError)
+			return
+		}
+		clientConn, _, err := hj.Hijack()
+		if err != nil {
+			_ = upstream.Close()
+			return
+		}
+		_, _ = clientConn.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
+		// Splice both directions. Half-close each write end on its own EOF (so a
+		// one-way FIN — e.g. an HTTP/1.1 request with Connection: close — does not
+		// truncate the reply mid-flight), then fully close once BOTH directions
+		// have drained. net.Pipe and other non-TCP conns lack CloseWrite; the type
+		// assertion simply skips the half-close for them.
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			defer wg.Done()
+			_, _ = io.Copy(upstream, clientConn)
+			if cw, ok := upstream.(interface{ CloseWrite() error }); ok {
+				_ = cw.CloseWrite()
+			}
+		}()
+		go func() {
+			defer wg.Done()
+			_, _ = io.Copy(clientConn, upstream)
+			if cw, ok := clientConn.(interface{ CloseWrite() error }); ok {
+				_ = cw.CloseWrite()
+			}
+		}()
+		wg.Wait()
+		_ = clientConn.Close()
+		_ = upstream.Close()
+	})
+}
+
+// egressTargetAllowed permits CONNECT only to a TAGGED same-tailnet .ts.net peer
+// (exact DNSName match, never a suffix) on a served port, and rejects IP-literal
+// targets — so the loopback proxy can never be turned into a generic tailnet
+// egress, preserving the ACL's instance-isolation posture.
+func egressTargetAllowed(lc statusClient, host, port string) bool {
+	if port != "443" && port != "7777" {
+		return false
+	}
+	if net.ParseIP(host) != nil {
+		return false // no raw IPs — only MagicDNS names bound to a known tagged peer
+	}
+	want := normalizeDNSName(host)
+	if want == "" {
+		return false
+	}
+	status, err := lc.Status(context.Background())
+	if err != nil || status == nil {
+		return false
+	}
+	for _, ps := range status.Peer {
+		if ps == nil || !peerHasTag(ps, meshPeerTag) {
+			continue
+		}
+		if normalizeDNSName(ps.DNSName) == want {
+			return true
+		}
+	}
+	return false
+}
+
+func randToken() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}

package/mesh-sidecar.lock.json

@@ -1,12 +1,12 @@
 {
   "version": "1.0.0",
-  "contentHash": "dbf60b5215ebb0b0947edf8fa47906280dd1fea12ef7e1181918fecfe7d9bcc0",
+  "contentHash": "15ca95fdba8ba0d81c2e49f8f9707d2fb124f51ee3982dea3a87d11b140ab279",
   "assets": {
-    "aiordie-mesh-windows-amd64.exe": "3be314f27ddf69560cb34b40b70302609f28fe6feba7600580e68ce04a811a71",
-    "aiordie-mesh-windows-arm64.exe": "3169f41dc835522c42dc4766dcd9a608a65430fb3797120bcd1ae9e58014942c",
-    "aiordie-mesh-linux-amd64": "7fb0d9c624c85759fb20e789886d1f4e0e2b5621f8ee6105634c7e73fd44d049",
-    "aiordie-mesh-linux-arm64": "7d23eb2d8c4c9632f37ad8f11f8c8523ce7d6ce58d0607b4c73fb9ccbc261239",
-    "aiordie-mesh-darwin-amd64": "69336be9137a98d8a3409ea87702502fa82d573875041111ea46f65b2fd22442",
-    "aiordie-mesh-darwin-arm64": "f73bcb5a6107ac3c0da8a39f06af6620e2db6e66b4e3c135740d9081703fd938"
+    "ai-or-die-mesh-windows-amd64.exe": "8b194d82257e7d99e9e0f770830b2baf1ccc17f82c8aad6097fa9c7594ddc89b",
+    "ai-or-die-mesh-windows-arm64.exe": "7dc1fe73117a95b9e4889457b9f97f8a59bb547e53c2f64499e998cf2a0016e2",
+    "ai-or-die-mesh-linux-amd64": "abf133b731dd2c0dcdefaf157cb0f026d741554e1f0332d329fb2bac542d0645",
+    "ai-or-die-mesh-linux-arm64": "d63cd407521ef7e7c72dac90b5cf5ac18c92aa8243046ba7dc7b8c4da58fc468",
+    "ai-or-die-mesh-darwin-amd64": "669e36de903fedb5e5d2dc0152971c828582bf25622310f559eefb226f4221de",
+    "ai-or-die-mesh-darwin-arm64": "7f0f3fc766a87e110ecc5e908e6b86333e56f3d0517b81ce4dc582963dadad11"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-or-die",
-  "version": "0.1.90",
+  "version": "0.1.91",
   "description": "Universal AI coding terminal — Claude, Copilot, Gemini & more in your browser",
   "main": "src/server.js",
   "bin": {

package/src/mesh-manager.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // MeshManager — permanent reachability over a Tailscale tailnet via the
-// aiordie-mesh sidecar (tsnet in USERSPACE: no kernel TUN, no admin, no system
+// ai-or-die-mesh sidecar (tsnet in USERSPACE: no kernel TUN, no admin, no system
 // service). Only ai-or-die's own port joins the mesh; the rest of the machine
 // stays off it. Mirrors TunnelManager's lifecycle (detect → start → backoff →
 // stop) so bin/ai-or-die.js supervises it like the dev tunnel. Verified E2E:
@@ -11,6 +11,7 @@ const { spawn } = require('child_process');
 const os = require('os');
 const path = require('path');
 const fs = require('fs');
+const crypto = require('crypto');
 
 const URL_TIMEOUT_MS = 60000;          // enroll + name can take ~30s on first run
 const STABILITY_THRESHOLD_MS = 60000;  // 60s up = reset retry budget
@@ -38,11 +39,11 @@ class MeshManager {
       ? path.join(localApp, 'ai-or-die')
       : path.join(os.homedir(), '.ai-or-die');
     this.stateDir = options.stateDir || path.join(this._appBase, 'ts-state');
-    // The sidecar binary is content-addressed: its path embeds the lock's
-    // contentHash so a new build installs alongside the old one (no overwrite of
-    // a running .exe). Derived from the installer's lock + path helpers.
+    // The sidecar is LAUNCHED from a stable, hash-free path (ai-or-die-mesh[.exe])
+    // so a single-file WDAC/AppLocker allow-list rule matches the executed image
+    // across versions (ADR-0036). The installer verifies + replaces it in place.
     this._installer = options._installer || require('./utils/sidecar-installer');
-    this.sidecar = options.sidecar || this._sidecarPathFromLock(this._appBase);
+    this.sidecar = options.sidecar || this._stableSidecarPath(this._appBase);
     this.hostname = (options.hostname || `aiordie-${os.hostname()}`).toLowerCase().replace(/[^a-z0-9-]/g, '');
 
     this.proc = null;
@@ -59,12 +60,16 @@ class MeshManager {
     this._stabilityThresholdMs = options._stabilityThresholdMs || STABILITY_THRESHOLD_MS;
     this._stdoutBuffer = '';
     this.peers = null;
+    this._untaggedWarned = false;
   }
 
   /** Never throws — degrades to localhost/devtunnel on any failure. */
   async start() {
     console.log('\n  Connecting mesh (Tailscale userspace)...');
     this.stopping = false;
+    // Clear any egress.json left by a crashed/kill -9'd prior run BEFORE (re)spawn,
+    // so a consumer can't route to a freed loopback port a local process squatted.
+    this._deleteEgressFile();
     if (!fs.existsSync(this.sidecar)) {
       if (!(await this._ensureSidecar())) { this._printMissing(this._lastError); return; }
     }
@@ -73,13 +78,12 @@ class MeshManager {
     await this._spawn();
   }
 
-  /** Content-addressed sidecar path from the committed lock; safe fallback. */
-  _sidecarPathFromLock(base) {
+  /** Stable, hash-free sidecar path from the installer; safe fallback. */
+  _stableSidecarPath(base) {
     try {
-      const lock = this._installer.loadLock();
-      return this._installer.sidecarPath(lock.contentHash);
+      return this._installer.stableSidecarPath();
     } catch (_) {
-      const exe = process.platform === 'win32' ? 'aiordie-mesh.exe' : 'aiordie-mesh';
+      const exe = process.platform === 'win32' ? 'ai-or-die-mesh.exe' : 'ai-or-die-mesh';
       return path.join(base, 'bin', exe);
     }
   }
@@ -113,6 +117,7 @@ class MeshManager {
   async stop() {
     this.stopping = true;
     this._deletePeersFile();
+    this._deleteEgressFile();
     this._clearStabilityTimer();
     clearTimeout(this._restartDelayTimer);
     if (this._restartDelayResolve) { this._restartDelayResolve(); this._restartDelayResolve = null; }
@@ -156,6 +161,7 @@ class MeshManager {
           }
           if (/^MESH-NEEDLOGIN\b/.test(line)) {
             this._deletePeersFile();
+            this._deleteEgressFile();
             this._printNotEnrolled();
             if (!done) { done = true; clearTimeout(timer); resolve(); }
           }
@@ -164,7 +170,7 @@ class MeshManager {
       this.proc.stderr.on('data', (d) => { if (this.dev) process.stderr.write(`  [mesh] ${d}`); });
       this.proc.on('error', (e) => { console.error(`  \x1b[31mmesh sidecar failed: ${e.message}\x1b[0m`); this.proc = null; if (!done) { done = true; clearTimeout(timer); resolve(); } });
       this.proc.on('exit', (code) => {
-        this._clearStabilityTimer(); this.proc = null; this.dnsName = null; this._deletePeersFile();
+        this._clearStabilityTimer(); this.proc = null; this.dnsName = null; this._deletePeersFile(); this._deleteEgressFile();
         if (!this.stopping && code !== 0) this._restart();
       });
     });
@@ -189,7 +195,9 @@ class MeshManager {
 
   _handleStdoutLine(line) {
     try {
-      if (/^MESH-NEEDLOGIN\b/.test(line)) this._deletePeersFile();
+      if (/^MESH-NEEDLOGIN\b/.test(line)) { this._deletePeersFile(); this._deleteEgressFile(); return; }
+      if (/^MESH-EGRESS\b/.test(line)) { this._handleEgressLine(line); return; }
+      if (/^MESH-UNTAGGED\b/.test(line)) { this._handleUntaggedLine(line); return; }
       const match = /^MESH-PEERS\s+(.+)$/.exec(line);
       if (!match) return;
       const raw = match[1];
@@ -206,6 +214,8 @@ class MeshManager {
       const normalized = this._validatePeersPayload(parsed);
       if (!normalized) return;
       this.peers = normalized;
+      // Recovered: tagged peers are visible again, so re-arm the untagged warning.
+      if (normalized.peers.length > 0) this._untaggedWarned = false;
       this._writePeersFile(normalized);
     } catch (_) {}
   }
@@ -249,6 +259,70 @@ class MeshManager {
     try { fs.rmSync(this.peersFilePath(), { force: true }); } catch (_) {}
   }
 
+  egressFilePath() {
+    return path.join(this._appBase, 'mesh', 'egress.json');
+  }
+
+  // Parse `MESH-EGRESS <url> <token>` and persist the loopback CONNECT-proxy
+  // endpoint + local secret for a same-box conductor (github-router) to consume.
+  // Only a loopback http URL is ever accepted; the token is a local credential.
+  _handleEgressLine(line) {
+    const m = /^MESH-EGRESS\s+(\S+)\s+(\S+)\s*$/.exec(line);
+    if (!m) return;
+    const url = m[1];
+    const token = m[2];
+    let u;
+    try { u = new URL(url); } catch (_) { return; }
+    if (u.protocol !== 'http:') return;
+    const host = u.hostname.replace(/^\[/, '').replace(/\]$/, '');
+    // Only a numeric loopback literal — never `localhost`, whose resolution a
+    // consumer's DNS/hosts config could rebind off-host.
+    if (host !== '127.0.0.1' && host !== '::1') return;
+    if (!token || /\s/.test(token)) return;
+    this._writeEgressFile(url, token);
+  }
+
+  _writeEgressFile(url, token) {
+    const file = this.egressFilePath();
+    const dir = path.dirname(file);
+    // Random, exclusive-create tmp so a pre-planted symlink at a predictable path
+    // can't redirect the write (TOCTOU / symlink clobber).
+    const tmp = path.join(dir, `egress.json.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(tmp, JSON.stringify({
+        version: 1,
+        pid: this.proc ? this.proc.pid : process.pid,
+        updatedAt: Date.now(),
+        url,
+        token,
+      }), { mode: 0o600, flag: 'wx' });
+      fs.chmodSync(tmp, 0o600);
+      fs.renameSync(tmp, file);
+    } catch (_) {
+      try { fs.rmSync(tmp, { force: true }); } catch (_) {}
+    }
+  }
+
+  _deleteEgressFile() {
+    try { fs.rmSync(this.egressFilePath(), { force: true }); } catch (_) {}
+  }
+
+  // Actionable one-shot hint: tailnet peers exist but none carry tag:aiordie, so
+  // fleet discovery will surface nothing until they are tagged. The exact failure
+  // this whole path guards against — surfaced, not silent.
+  _handleUntaggedLine(line) {
+    if (this._untaggedWarned) return;
+    const m = /^MESH-UNTAGGED\s+(\S+)\s+(\d+)\s+(\d+)\s*$/.exec(line);
+    if (!m) return;
+    this._untaggedWarned = true;
+    const total = m[2];
+    console.log(`\n  \x1b[33mMesh: ${total} tailnet device(s) visible but \x1b[1m0 tagged tag:aiordie\x1b[0m\x1b[33m.\x1b[0m`);
+    console.log('    Fleet discovery stays EMPTY until instances carry the tag:');
+    console.log('    • enroll with a REUSABLE + TAGGED key (tag:aiordie), or retag each device in the admin console;');
+    console.log('    • ensure the ACL allows your conductor → tag:aiordie on the served ports (docs/mesh-acl.example.hujson).');
+  }
+
   _printMissing(err) {
     const code = err && err.code;
     const map = {

package/src/utils/sidecar-installer.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Sidecar installer — fetches the prebuilt aiordie-mesh tsnet binary for the
+// Sidecar installer — fetches the prebuilt ai-or-die-mesh tsnet binary for the
 // current platform and verifies it against a SHA-256 that ships INSIDE this npm
 // package (mesh-sidecar.lock.json). Trust is therefore anchored by the signed
 // npm artifact, not by a checksums file fetched from the same mutable GitHub
@@ -12,7 +12,7 @@
 // CI only rebuilds when the source — and thus the hash — changes.
 //
 // Asset convention (published by .github/workflows/release-on-main.yml):
-//   aiordie-mesh-<plat>-<arch>[.exe]   plat: windows|linux|darwin  arch: amd64|arm64
+//   ai-or-die-mesh-<plat>-<arch>[.exe]   plat: windows|linux|darwin  arch: amd64|arm64
 
 const fs = require('fs');
 const fsp = require('fs').promises;
@@ -44,7 +44,7 @@ function assetName() {
   const plat = PLAT[process.platform];
   const arch = ARCH[process.arch];
   if (!plat || !arch) return null;
-  return `aiordie-mesh-${plat}-${arch}${process.platform === 'win32' ? '.exe' : ''}`;
+  return `ai-or-die-mesh-${plat}-${arch}${process.platform === 'win32' ? '.exe' : ''}`;
 }
 
 function baseDir() {
@@ -52,11 +52,32 @@ function baseDir() {
   return process.platform === 'win32' ? path.join(localApp, 'ai-or-die') : path.join(os.homedir(), '.ai-or-die');
 }
 
-// Versioned path: a new contentHash installs alongside the old one, so we never
-// rename over a binary that a running sidecar still has open (Windows EPERM).
-function sidecarPath(contentHash) {
+// Stable runnable path (NO content hash): the manager LAUNCHES this path, so a
+// single-file WDAC/AppLocker allow-list rule matches the executed image across
+// every version. This trades ADR-0035's install-alongside for that match; it is
+// safe because the stable file is free at process start (the prior ai-or-die and
+// its sidecar have exited), and the MOTW/quarantine mark is stripped after the
+// SHA-256 verify so a re-download is not re-gated. See ADR-0036.
+function stableSidecarPath() {
   const ext = process.platform === 'win32' ? '.exe' : '';
-  return path.join(baseDir(), 'bin', `aiordie-mesh-${contentHash}${ext}`);
+  return path.join(baseDir(), 'bin', `ai-or-die-mesh${ext}`);
+}
+
+// Best-effort provenance strip AFTER the SHA-256 verify: remove Windows
+// mark-of-the-web (Zone.Identifier ADS) / macOS Gatekeeper quarantine so the
+// freshly-verified binary is not re-gated by SmartScreen/Gatekeeper on each new
+// version. We verified the bytes against the checksum shipped in the signed npm
+// package, so this de-gates only a binary we already trust. Never throws.
+function stripProvenance(file) {
+  try {
+    if (process.platform === 'win32') {
+      fs.rmSync(`${file}:Zone.Identifier`, { force: true });
+    } else if (process.platform === 'darwin') {
+      try {
+        require('child_process').execFileSync('xattr', ['-d', 'com.apple.quarantine', file], { stdio: 'ignore' });
+      } catch (_) { /* xattr absent or attribute not set */ }
+    }
+  } catch (_) { /* best-effort */ }
 }
 
 // The release ref to fetch from. Defaults to mesh-<contentHash>; an explicit
@@ -127,11 +148,11 @@ async function ensureSidecar(dest, opts = {}) {
     throw new SidecarError('lock-unfinalized', `mesh-sidecar.lock.json has no checksum for ${name} (built without the mesh asset pipeline?)`);
   }
 
-  dest = dest || sidecarPath(lock.contentHash);
+  dest = dest || stableSidecarPath();
 
   // Existing file: trust only if it matches; otherwise replace it.
   if (fs.existsSync(dest)) {
-    if ((await _sha256(dest)).toLowerCase() === want) return dest;
+    if ((await _sha256(dest)).toLowerCase() === want) { stripProvenance(dest); return dest; }
     try { await fsp.unlink(dest); }
     catch (e) {
       if (e.code === 'EPERM' || e.code === 'EBUSY' || e.code === 'EACCES') {
@@ -157,7 +178,7 @@ async function ensureSidecar(dest, opts = {}) {
     } catch (e) {
       // Lost a race to a concurrent installer (or the file is locked). If the
       // destination is now present and valid, accept it; otherwise surface it.
-      if (fs.existsSync(dest) && (await _sha256(dest)).toLowerCase() === want) return dest;
+      if (fs.existsSync(dest) && (await _sha256(dest)).toLowerCase() === want) { stripProvenance(dest); return dest; }
       if (e.code === 'EPERM' || e.code === 'EBUSY' || e.code === 'EACCES') {
         throw new SidecarError('locked-binary', `cannot install sidecar at ${dest} (${e.code})`);
       }
@@ -166,7 +187,8 @@ async function ensureSidecar(dest, opts = {}) {
   } finally {
     try { await fsp.unlink(tmp); } catch (_) {}
   }
+  stripProvenance(dest);
   return dest;
 }
 
-module.exports = { ensureSidecar, sidecarPath, assetName, loadLock, SidecarError };
+module.exports = { ensureSidecar, stableSidecarPath, assetName, loadLock, SidecarError };

package/mesh/main_test.go

@@ -1,123 +0,0 @@
-package main
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"testing"
-)
-
-func TestResolveBackend(t *testing.T) {
-	cases := []struct {
-		name      string
-		backend   string
-		port      string
-		wantErr   bool
-		wantHost  string // expected resolved u.Host when no error
-	}{
-		{"default port → loopback", "", "7777", false, "127.0.0.1:7777"},
-		{"explicit loopback v4", "http://127.0.0.1:8080", "0", false, "127.0.0.1:8080"},
-		{"loopback v6", "http://[::1]:8080", "0", false, "[::1]:8080"},
-		{"ipv4-mapped loopback", "http://[::ffff:127.0.0.1]:8080", "0", false, "[::ffff:127.0.0.1]:8080"},
-		{"localhost normalized to 127.0.0.1", "http://localhost:9000", "0", false, "127.0.0.1:9000"},
-		{"https loopback allowed", "https://127.0.0.1:8443", "0", false, "127.0.0.1:8443"},
-		{"off-host private ip rejected", "http://10.0.0.5:80", "0", true, ""},
-		{"0.0.0.0 rejected", "http://0.0.0.0:80", "0", true, ""},
-		{"public ip rejected", "http://93.184.216.34:80", "0", true, ""},
-		{"arbitrary dns rejected", "http://evil.example.com:80", "0", true, ""},
-		{"non-loopback v6 rejected", "http://[2001:db8::1]:80", "0", true, ""},
-		{"bad scheme rejected", "ftp://127.0.0.1:80", "0", true, ""},
-		{"file scheme rejected", "file:///etc/passwd", "0", true, ""},
-		{"garbage rejected", "://nope", "0", true, ""},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			u, err := resolveBackend(c.backend, c.port)
-			if c.wantErr {
-				if err == nil {
-					t.Fatalf("expected error for backend=%q, got host=%q", c.backend, u.Host)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error for backend=%q: %v", c.backend, err)
-			}
-			if u.Host != c.wantHost {
-				t.Fatalf("backend=%q → host=%q, want %q", c.backend, u.Host, c.wantHost)
-			}
-		})
-	}
-}
-
-func TestIsLoopbackHost(t *testing.T) {
-	loop := []string{"localhost", "127.0.0.1", "127.0.0.2", "::1", "::ffff:127.0.0.1"}
-	notLoop := []string{"0.0.0.0", "10.0.0.1", "192.168.1.1", "93.184.216.34", "2001:db8::1", "example.com", ""}
-	for _, h := range loop {
-		if !isLoopbackHost(h) {
-			t.Errorf("isLoopbackHost(%q) = false, want true", h)
-		}
-	}
-	for _, h := range notLoop {
-		if isLoopbackHost(h) {
-			t.Errorf("isLoopbackHost(%q) = true, want false", h)
-		}
-	}
-}
-
-// End-to-end through the actual reverse proxy (no tailnet): a real loopback
-// backend must receive the X-Forwarded-Proto/Host the edge stamps, the app
-// bearer, and the pointer-captured proto must reflect the post-TLS decision.
-func TestEdgeProxyForwardsProtoHostAndAuth(t *testing.T) {
-	var gotProto, gotHost, gotAuth, gotBody string
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotProto = r.Header.Get("X-Forwarded-Proto")
-		gotHost = r.Header.Get("X-Forwarded-Host")
-		gotAuth = r.Header.Get("Authorization")
-		io.WriteString(w, "backend-ok")
-	}))
-	defer backend.Close()
-
-	target, _ := url.Parse(backend.URL) // 127.0.0.1 loopback
-	proto := "http"                      // default before the TLS decision
-	rp := newEdgeProxy(target, "node.tailnet.ts.net", &proto, "app-token")
-	proto = "https" // edge decided real TLS AFTER constructing the proxy
-
-	front := httptest.NewServer(rp)
-	defer front.Close()
-
-	res, err := http.Get(front.URL + "/app")
-	if err != nil {
-		t.Fatalf("proxy request failed: %v", err)
-	}
-	defer res.Body.Close()
-	b, _ := io.ReadAll(res.Body)
-	gotBody = string(b)
-
-	if gotProto != "https" {
-		t.Errorf("backend saw X-Forwarded-Proto=%q, want https (pointer-captured decision)", gotProto)
-	}
-	if gotHost != "node.tailnet.ts.net" {
-		t.Errorf("backend saw X-Forwarded-Host=%q, want node.tailnet.ts.net", gotHost)
-	}
-	if gotAuth != "Bearer app-token" {
-		t.Errorf("backend saw Authorization=%q, want Bearer app-token", gotAuth)
-	}
-	if gotBody != "backend-ok" {
-		t.Errorf("proxy body=%q, want backend-ok", gotBody)
-	}
-}
-
-func TestRedirectToHTTPS(t *testing.T) {
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequest("GET", "http://anything/path?q=1", nil)
-	redirectToHTTPS("node.tailnet.ts.net")(rec, req)
-	if rec.Code != http.StatusPermanentRedirect {
-		t.Fatalf("status=%d, want 308", rec.Code)
-	}
-	loc := rec.Header().Get("Location")
-	if !strings.HasPrefix(loc, "https://node.tailnet.ts.net/path") || !strings.Contains(loc, "q=1") {
-		t.Fatalf("Location=%q, want https://node.tailnet.ts.net/path?q=1", loc)
-	}
-}