bunqueue-dashboard 0.0.15 → 0.0.16

package/scripts/serve.ts

@@ -7,7 +7,11 @@
  *   2. Proxies /api/* to the bunqueue server (BUNQUEUE_URL, default :6790) —
  *      same-origin like the dev proxy, so no CORS and SSE streams through.
  *   3. Runs the control agent (start/stop/restart bunqueue) on 127.0.0.1:6800
- *      with the same Origin-allowlist security as agent/index.ts.
+ *      with the same Origin-allowlist security as agent/index.ts — and ALSO
+ *      exposes it same-origin at /agent/* (the served index.html gets
+ *      `window.__BUNQUEUE_AGENT_URL__ = '/agent'` injected), so the prebuilt
+ *      SPA finds the agent regardless of AGENT_PORT and even from a remote
+ *      browser, where loopback :6800 would be unreachable.
  *
  * Env: PORT (dashboard, default 8080) · BIND_ADDR (default 127.0.0.1) ·
  *      BUNQUEUE_URL · AGENT_PORT · AGENT_ALLOWED_ORIGINS · AGENT_TOKEN ·
@@ -43,13 +47,34 @@ const agentHandle = createFetchHandler(mgr, {
 });
 Bun.serve({ port: AGENT_PORT, hostname: '127.0.0.1', fetch: agentHandle });
 
-// Dashboard + /api proxy.
+// index.html with the runtime agent base injected, prepared once at startup.
+// The SPA's lib/bq.ts reads window.__BUNQUEUE_AGENT_URL__ before its baked-in
+// default, so Server Control works whatever AGENT_PORT is — the /agent/*
+// route below forwards to the in-process agent handler.
+const INDEX_HTML = (await Bun.file(ASSETS['/index.html']).text()).replace(
+  '</head>',
+  "<script>window.__BUNQUEUE_AGENT_URL__='/agent'</script></head>"
+);
+const indexResponse = () =>
+  new Response(INDEX_HTML, { headers: { 'content-type': 'text/html; charset=utf-8' } });
+
+// Dashboard + /api proxy + same-origin /agent proxy.
 Bun.serve({
   port: PORT,
   hostname: HOST,
   async fetch(req) {
     const url = new URL(req.url);
 
+    // Same-origin bridge to the control agent: strip the /agent prefix and
+    // hand the request to the in-process agent handler (no loopback hop).
+    // The agent's own Origin allowlist + optional AGENT_TOKEN still apply —
+    // this changes reachability, not authorization.
+    if (url.pathname === '/agent' || url.pathname.startsWith('/agent/')) {
+      const sub = new URL(url.pathname.slice('/agent'.length) || '/', 'http://agent.internal');
+      sub.search = url.search;
+      return agentHandle(new Request(sub, req));
+    }
+
     // Same-origin proxy to the bunqueue server (mirrors the Vite dev proxy).
     if (url.pathname === '/api' || url.pathname.startsWith('/api/')) {
       const target = API + (url.pathname.slice(4) || '/') + url.search;
@@ -74,11 +99,13 @@ Bun.serve({
     // Embedded static assets with SPA history fallback. A missing fingerprinted
     // /assets/* file must 404 (as docker/Caddyfile does) — falling back to
     // index.html would feed HTML to a stale chunk import() and mask the miss.
+    // index.html (direct or via fallback) is served from the injected copy.
     const key = url.pathname === '/' ? '/index.html' : url.pathname;
-    const asset =
-      ASSETS[key] ?? (url.pathname.startsWith('/assets/') ? undefined : ASSETS['/index.html']);
-    if (!asset) return new Response('Not found', { status: 404 });
-    return new Response(Bun.file(asset));
+    if (key === '/index.html') return indexResponse();
+    const asset = ASSETS[key];
+    if (asset) return new Response(Bun.file(asset));
+    if (url.pathname.startsWith('/assets/')) return new Response('Not found', { status: 404 });
+    return indexResponse();
   },
 });