haltija 1.12.6 → 1.12.7

package/CHANGELOG.md

@@ -1,5 +1,110 @@
 # Changelog
 
+## 1.12.7 (unreleased)
+
+### File preview: 3D models, video, audio and fonts
+
+The terminal's file browser previews a lot more than text and images now.
+
+- **3D models** — `.glb`, `.gltf`, `.obj`, `.stl`, `.fbx`, `.ply`, `.splat`/`.spz`, `.bvh`. Babylon.js
+  is fetched from the CDN **on demand**, not bundled: a terminal that mostly shows text should not
+  carry a 3D engine to start up, and the browser caches it after the first model. Orbit/zoom, and
+  the scene is disposed when you open anything else (a WebGL context is a capped resource).
+- **Video and audio** — anything `<video>`/`<audio>` can decode. Deliberately no codec allowlist:
+  container support depends on the build, so the file is handed to the element and **its own**
+  error is reported if it cannot decode. Claiming support we do not have is the failure worth
+  avoiding; a silent black rectangle looks like a corrupt file.
+- **Fonts** — `.ttf`, `.otf`, `.woff`, `.woff2`, `.ttc`: charset plus a pangram at seven sizes. Each
+  preview registers a uniquely-named family, so a failed load can never leave the *previous*
+  typeface on screen pretending to be this one.
+
+Two things that would otherwise have made this quietly useless:
+
+- `/files/read` reports anything over 1MB as `tooLarge`, which is most real models and every video.
+  Rich previews are decided **before** that guard and the binary guard, or a 3.6MB `.glb` would
+  simply say "File too large".
+- Sibling files (`.mtl`, `.bin`, textures) cannot resolve from a blob URL, so OBJ/FBX/glTF may load
+  geometry without materials. The preview says so — on failure *and* in the caption on success —
+  rather than letting a limitation look like a bad asset.
+
+Large files **warn rather than refuse**: over 64MB you get the size, what it will cost, and a
+"Preview anyway" button. These are local files and the user knows what they opened.
+
+Not supported, and left out on purpose: `.dae` (COLLADA) and `.usdz` — Babylon has no loader for
+either, and listing them would produce a canvas that fails instead of an honest "not supported".
+
+### Desktop app fixes found while testing the above
+
+- **The terminal iframe was always told port 8700.** `window.haltija.port` has never existed —
+  preload exposes `serverUrl` — so `window.haltija?.port || 8700` silently resolved to the shared
+  default for every launch. It happened to be right whenever the app's own server was on 8700, and
+  was an **isolation violation** on a `--private` run: the terminal's WebSocket registered its shell
+  on a *different project's* server while everything else used the private one. Symptoms were the
+  Claude tab reporting "shell not found" and the file browser stuck on haltija's own directory
+  (`/files/tree` falls back to the server's cwd when the shell id resolves to nothing).
+- **The file panel did not follow `cd`.** It only loaded when toggled, so after changing directory
+  the tree and the prompt disagreed about where you were. It now refreshes on `cwd-changed`, when
+  visible. Pre-existing.
+
+### Security: shell execution and filesystem access are no longer served over HTTP (#40)
+
+A default `bunx haltija` answered `POST /terminal/command` → `spawn('sh', ['-c', …])`,
+`POST /terminal/agent-prompt` → `claude --permission-mode dontAsk`, and the whole `/files/*`
+surface, to **any caller on the port**.
+
+Verified, not theorised: a cross-origin POST with a `text/plain` body — a CORS-*simple* request, so
+the browser issues **no preflight** — returned 200 and its shell command wrote a file. The `Origin`
+header was present and ignored. So the exposure was not "someone on your LAN"; it was **any web
+page open in your browser** while haltija ran on the default port. We also send
+`Access-Control-Allow-Private-Network: true`, which opts out of the browser mitigation built to
+stop exactly this.
+
+**Removed rather than gated.** A token gate would leave `spawn('sh','-c')` reachable and depend on
+the gate staying correct forever. A development tool has no business offering remote code execution
+on a network port at all, so `/terminal/*` and `/files/*` are refused with **410 and an explanation**.
+
+Two decisions worth recording:
+
+- **The refusal is on the PREFIX, not a list of routes.** There are 21 routes under those two
+  prefixes; removing the four obvious ones would have left `/files/tree` (directory listing) and
+  `/files/image` (arbitrary file read) serving happily. Default-deny means the route nobody has
+  written yet is refused too.
+- **The allowlist is empty.** One route had a legitimate cross-origin caller — the injected widget
+  reads the running-agent list — and the first version carved it out as an exception. It moved to
+  **`/agents`** instead, so the rule is "nothing under these prefixes is served": a sentence that
+  cannot be subtly wrong, and no hole for a future need to widen.
+
+**Browser control is unaffected** — `/tree`, `/click`, `/eval`, `/screenshot`, the widget, the
+bookmarklet and the tunnel path all behave exactly as before. Nothing here was public API: these
+routes appear in no `API.md`, `DOCS.md`, `llms.txt` or `api-schema.ts` entry.
+
+**Known limitation:** if the app *attaches* to a haltija server that was already running
+(`serverMode: 'auto'`, the default, when something is on 8700), the terminal/agent/file tabs are
+unavailable — the pipe requires being the server's parent. The app says so and names
+`HALTIJA_SERVER_MODE=builtin`. Tracked in `TODO.md` with a clean fix.
+
+**The desktop tabs keep working** (when the app started its own server), over a channel a browser
+cannot address: `terminal.html`
+postMessages the renderer, which reaches Electron main over IPC, which talks to the server child
+over its **stdio**. A pipe has no origin, no port and no URL `fetch()` can name.
+
+The channel opens only when the spawning parent sets `HALTIJA_MACHINE_CHANNEL=1` — which the app
+does for its own public server. So a plain `bunx haltija` now has **no machine-control surface on
+any transport at all**, which is a stronger position than before this release, when it was on by
+default and reachable from any web page.
+
+(A Unix socket was the obvious choice and does not work: Bun 1.4.0 accepts the connection and never
+responds, verified three ways against a working Node↔Node control. Noted so nobody retries it.)
+
+
+- **Our own integration lane was driving other projects' browsers.** `tests/haltija.test.ts`
+  adopted whatever answered on the shared default port 8700 and then called `navigate` and `click`
+  against it. On a machine running a second project, that is a stranger's browser. It now runs only
+  against a server it was explicitly pointed at (`HALTIJA_PORT` / `HALTIJA_URL`), and skips
+  otherwise with instructions. No library or runtime change — test lane only.
+- Filed #42: the same default ships in `haltija/test` for every adopter, which is a
+  published-API decision rather than housekeeping.
+
 ## 1.12.6
 
 Security updates, three silent-failure fixes in the path from "server tells page how to reach me",

package/apps/desktop/main.js

@@ -1270,10 +1270,87 @@ function checkServerRunning() {
  * Stdout/stderr are piped to the desktop app's console with a label, and
  * `__NEED_WINDOW__` from the public server triggers window recreation.
  */
-function spawnHaltijaServer({ port, role, serverPath, useCompiledBinary, componentDir, portFile }) {
+// Registered at MODULE SCOPE, once. It was originally inside spawnHaltijaServer, which runs twice
+// (public and internal servers) — Electron throws "Attempted to register a second handler" and the
+// app dies at startup. Found by launching the app; no unit test would have caught it.
+/**
+ * Machine control over the public server's stdio (#40).
+ *
+ * /terminal/* and /files/* are refused on the network listener, because a text/plain POST is a
+ * CORS-simple request and any web page could reach them. The desktop app's own tabs still need
+ * them, so they travel down a pipe instead: no port, no origin, nothing fetch() can name.
+ *
+ * A Unix socket was the first choice and does not work — Bun 1.4.0 accepts the connection and
+ * never answers (verified three ways against a working Node<->Node control). Don't retry it.
+ */
+const MACHINE_REQ_PREFIX = 'HJ_MACHINE_REQ '
+const MACHINE_RES_PREFIX = 'HJ_MACHINE_RES '
+const machinePending = new Map()
+let machineBuffer = ''
+let machineSeq = 0
+let machineProc = null
+
+function machineRequest(path, init = {}) {
+  return new Promise((resolve) => {
+    if (!machineProc || !machineProc.stdin || machineProc.stdin.destroyed) {
+      // The likeliest cause by far: serverMode 'auto' found a healthy server on 8700 and ATTACHED
+      // to it rather than starting its own (which is deliberate — it must not kill another
+      // project's channel). But the pipe requires being the server's PARENT, so an adopted server
+      // has no machine control. Name the remedy; "unavailable" alone sends people hunting.
+      const adopted = reusedExternalServer
+      resolve({ status: 503, bodyB64: Buffer.from(JSON.stringify({
+        success: false,
+        error: adopted
+          ? 'Terminal, agent and file features need a server this app started itself, and this '
+            + 'instance ATTACHED to a haltija server that was already running (it will not kill '
+            + 'another project\'s channel). Quit that server, or relaunch with '
+            + 'HALTIJA_SERVER_MODE=builtin to force its own. See issue #40.'
+          : 'The machine-control channel is not open. It exists only for the desktop app\'s own '
+            + 'server (issue #40); terminal and file features are unavailable in this instance.',
+      })).toString('base64') })
+      return
+    }
+    const id = `m${++machineSeq}`
+    // ALWAYS resolve. A tab awaiting an id that never returns looks frozen, which is far worse to
+    // diagnose than an error, so every request carries its own deadline.
+    const timer = setTimeout(() => {
+      if (machinePending.delete(id)) {
+        resolve({ status: 504, bodyB64: Buffer.from(JSON.stringify({
+          success: false, error: `Timed out waiting for ${path} on the machine channel.`,
+        })).toString('base64') })
+      }
+    }, 30000)
+    machinePending.set(id, (res) => { clearTimeout(timer); resolve(res) })
+    const frame = { id, method: init.method || 'GET', path, headers: init.headers || {} }
+    if (init.bodyB64 !== undefined) frame.bodyB64 = init.bodyB64
+    try {
+      machineProc.stdin.write(MACHINE_REQ_PREFIX + JSON.stringify(frame) + '\n')
+    } catch (err) {
+      if (machinePending.delete(id)) {
+        clearTimeout(timer)
+        resolve({ status: 500, bodyB64: Buffer.from(JSON.stringify({
+          success: false, error: String(err && err.message || err),
+        })).toString('base64') })
+      }
+    }
+  })
+}
+
+ipcMain.handle('machine-request', async (_evt, path, init) => {
+  // Only this prefix pair is reachable, so a compromised renderer cannot use the channel as a
+  // general proxy to the server (e.g. to bypass a token on some unrelated endpoint).
+  if (typeof path !== 'string' || !(path.startsWith('/terminal/') || path.startsWith('/files/'))) {
+    return { status: 400, bodyB64: Buffer.from(JSON.stringify({
+      success: false, error: 'machine-request only carries /terminal/* and /files/* paths',
+    })).toString('base64') }
+  }
+  return machineRequest(path, init || {})
+})
+
+  function spawnHaltijaServer({ port, role, serverPath, useCompiledBinary, componentDir, portFile }) {
   // Built by src/desktop-server-env.ts, whose contract is unit-tested without launching Electron —
   // getting this wrong is silent (a child that ignores its port, binds the parent's, and dies).
-  const env = buildServerEnv(process.env, {
+const env = buildServerEnv(process.env, {
     port,
     role: role === 'public' ? 'public' : 'internal',
     isPrivate: IS_PRIVATE,
@@ -1282,26 +1359,52 @@ function spawnHaltijaServer({ port, role, serverPath, useCompiledBinary, compone
   let proc
   if (serverPath && useCompiledBinary) {
     proc = spawn(serverPath, [], {
-      stdio: ['ignore', 'pipe', 'pipe'],
+      stdio: [role === 'public' ? 'pipe' : 'ignore', 'pipe', 'pipe'],
       cwd: componentDir || path.dirname(serverPath),
       env,
     })
   } else if (serverPath) {
     proc = spawn('bun', ['run', serverPath], {
-      stdio: ['ignore', 'pipe', 'pipe'],
+      stdio: [role === 'public' ? 'pipe' : 'ignore', 'pipe', 'pipe'],
       env,
     })
   } else {
     proc = spawn('bunx', ['haltija', '--port', port.toString()], {
-      stdio: ['ignore', 'pipe', 'pipe'],
+      stdio: [role === 'public' ? 'pipe' : 'ignore', 'pipe', 'pipe'],
       env,
     })
   }
 
+  if (role === 'public') machineProc = proc
+
   const label = `[${role} server]`
 
   proc.stdout.on('data', (data) => {
     try {
+      // Machine-channel responses first, on the RAW chunk. The logging path below trims and
+      // reformats, and a pipe splits frames wherever it likes — so parsing has to be line-based
+      // and buffered, or a large /files/tree answer arrives as fragments and never resolves.
+      if (role === 'public') {
+        machineBuffer += data.toString()
+        const parts = machineBuffer.split('\n')
+        machineBuffer = parts.pop()
+        for (const line of parts) {
+          if (!line.startsWith(MACHINE_RES_PREFIX)) {
+            if (line.trim()) console.log(`${label} ${line.trim()}`)
+            continue
+          }
+          try {
+            const res = JSON.parse(line.slice(MACHINE_RES_PREFIX.length))
+            const waiting = machinePending.get(res.id)
+            if (waiting) { machinePending.delete(res.id); waiting(res) }
+          } catch {}
+        }
+        if (role === 'public' && machineBuffer.includes('__NEED_WINDOW__') && BrowserWindow.getAllWindows().length === 0) {
+          console.log('[Haltija Desktop] Server requested window, recreating...')
+          createWindow()
+        }
+        return
+      }
       const text = data.toString().trim()
       console.log(`${label} ${text}`)
       if (role === 'public' && text.includes('__NEED_WINDOW__') && BrowserWindow.getAllWindows().length === 0) {

package/apps/desktop/preload.js

@@ -31,6 +31,10 @@ contextBridge.exposeInMainWorld('haltija', {
   goForward: () => ipcRenderer.send('go-forward'),
   refresh: () => ipcRenderer.send('refresh'),
   
+  // Machine control over the server's stdio (#40). /terminal/* and /files/* are refused on the
+  // network listener; this is how the app's own tabs still reach them. Returns {status, bodyB64}.
+  machineRequest: (path, init) => ipcRenderer.invoke('machine-request', path, init),
+
   // Screen capture
   capturePage: () => ipcRenderer.invoke('capture-page'),
   captureElement: (selector) => ipcRenderer.invoke('capture-element', selector),

package/apps/desktop/renderer/agent-status.js

@@ -4,6 +4,7 @@
 
 import { tabs, el, getServerUrl } from './state.js'
 import { escapeHtml, createFloatPanel } from './ui-utils.js'
+import { machineFetch } from './machine-relay.js'
 
 let agentStatusWs = null
 let connectedShells = new Map()
@@ -132,7 +133,7 @@ async function showMemosPanel(target) {
   if (!panel) return
 
   try {
-    const resp = await fetch(`${getServerUrl()}/terminal/command`, {
+    const resp = await machineFetch(`/terminal/command`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ tool: 'tasks', command: 'board' })
@@ -209,7 +210,7 @@ export async function initAgentStatusBar() {
   if (selectorEl) selectorEl.style.display = 'none'
 
   try {
-    const response = await fetch(`${getServerUrl()}/terminal/status`)
+    const response = await machineFetch(`/terminal/status`)
     if (response.ok) {
       const line = await response.text()
       renderAgentStatusBar(line)
@@ -220,7 +221,7 @@ export async function initAgentStatusBar() {
 
   // Seed agent list from existing sessions (may have connected before this WS)
   try {
-    const res = await fetch(`${getServerUrl()}/terminal/agents`)
+    const res = await fetch(`${getServerUrl()}/agents`)
     if (res.ok) {
       const data = await res.json()
       for (const agent of data.agents || []) {

package/apps/desktop/renderer/machine-relay.js

@@ -0,0 +1,107 @@
+/**
+ * Relay for the terminal iframe's machine-control calls (#40).
+ *
+ * `terminal.html` is loaded from disk as an iframe and has NO preload bridge — which is exactly
+ * why it originally reached its own machine over HTTP, and why `/terminal/*` and `/files/*` had to
+ * be network-reachable at all. Those routes are now refused on the network listener, so the iframe
+ * asks its parent instead: the renderer has `window.haltija`, which reaches main, which owns the
+ * pipe to the server.
+ *
+ * The iframe already talks to us this way for `terminal-cwd`, `agent-status` and `shell-renamed`,
+ * so this is an extra message type on a channel that exists, not a new mechanism.
+ */
+
+const RELAY_REQUEST = 'hj-machine-request'
+const RELAY_RESPONSE = 'hj-machine-response'
+
+export function initMachineRelay() {
+  window.addEventListener('message', async (event) => {
+    const msg = event.data
+    if (!msg || msg.type !== RELAY_REQUEST || typeof msg.id !== 'string') return
+
+    // Answer through the SOURCE window, not a broadcast: several terminal tabs can be open, and
+    // posting to all of them would let one tab observe another's file contents and command output.
+    const reply = (payload) => {
+      try {
+        event.source?.postMessage({ type: RELAY_RESPONSE, id: msg.id, ...payload }, '*')
+      } catch {}
+    }
+
+    if (!window.haltija?.machineRequest) {
+      reply({
+        status: 503,
+        bodyB64: btoa(JSON.stringify({
+          success: false,
+          error: 'Machine control is unavailable: this window has no preload bridge.',
+        })),
+      })
+      return
+    }
+
+    try {
+      const res = await window.haltija.machineRequest(msg.path, msg.init || {})
+      // Pass base64 through UNTOUCHED. An earlier version decoded with atob() here, which yields a
+      // binary string and silently corrupts anything that is not Latin-1 — /files/image is binary,
+      // and a source file with any non-ASCII character would have been mangled on the way to the
+      // editor. Decoding belongs where the consumer knows whether it wants text or bytes.
+      reply({ status: res.status, bodyB64: res.bodyB64 || '', headers: res.headers || {} })
+    } catch (err) {
+      // Always reply. A pending id that never returns presents as a frozen tab.
+      reply({
+        status: 500,
+        bodyB64: btoa(JSON.stringify({ success: false, error: String(err?.message || err) })),
+      })
+    }
+  })
+}
+
+/**
+ * fetch()-shaped access to machine control, for renderer modules (#40).
+ *
+ * The renderer HAS the preload bridge, so it calls `machineRequest` directly — no postMessage hop;
+ * that relay exists only for the terminal iframe, which has no bridge.
+ *
+ * This exists because converting call sites by enumeration missed six of them: `terminal.html` was
+ * done thoroughly while `tabs.js` and `agent-status.js` were forgotten entirely, so `/terminal/*`
+ * from the renderer silently started returning 410 — which is how "Pick folder…" stopped working
+ * (it sends a `cd` via /terminal/command). Keeping the call shape identical to fetch() means the
+ * conversion is mechanical and a missed site is visible rather than subtle.
+ */
+export async function machineFetch(path, init = {}) {
+  const respond = (status, bodyB64, headers = {}) => {
+    let text = null
+    const decode = () => {
+      if (text === null) {
+        const bytes = Uint8Array.from(atob(bodyB64 || ''), (c) => c.charCodeAt(0))
+        text = new TextDecoder().decode(bytes)
+      }
+      return text
+    }
+    return {
+      ok: status >= 200 && status < 300,
+      status,
+      headers,
+      b64: bodyB64 || '',
+      json: async () => JSON.parse(decode() || '{}'),
+      text: async () => decode(),
+    }
+  }
+
+  if (!window.haltija?.machineRequest) {
+    return respond(503, btoa(JSON.stringify({
+      success: false,
+      error: 'Machine control is unavailable: no preload bridge in this window.',
+    })))
+  }
+
+  const frame = { method: init.method || 'GET', headers: init.headers || {} }
+  if (init.body !== undefined) {
+    frame.bodyB64 = btoa(typeof init.body === 'string' ? init.body : JSON.stringify(init.body))
+  }
+  try {
+    const res = await window.haltija.machineRequest(path, frame)
+    return respond(res.status, res.bodyB64 || '', res.headers || {})
+  } catch (err) {
+    return respond(500, btoa(JSON.stringify({ success: false, error: String(err?.message || err) })))
+  }
+}

package/apps/desktop/renderer/tabs.js

@@ -6,7 +6,24 @@ import { tabs, activeTabId, setActiveTabId, nextTabId, el, getServerUrl, lastCwd
 import { showNotification } from './ui-utils.js'
 import { setupWebviewEvents } from './webview-events.js'
 import { checkHaltija, updateNavButtons } from './status.js'
+
+/**
+ * The port of THIS instance's public server.
+ *
+ * Derived from `serverUrl`, which main sets after port resolution — so a private instance reports
+ * its ephemeral port rather than the shared default. Falls back to 8700 only when main told us
+ * nothing, which is the "adopted an external server" case where 8700 is genuinely right.
+ */
+function resolvePublicPort() {
+  try {
+    const url = window.haltija?.serverUrl
+    if (url) return new URL(url).port || '8700'
+  } catch {}
+  return '8700'
+}
+
 import { handleAction, getIsRecordingActions, getIsRecordingVideo, getIsSelecting } from './widget-status.js'
+import { machineFetch } from './machine-relay.js'
 
 // ==========================================
 // Tab dropdown menu
@@ -217,7 +234,13 @@ export async function createTerminalTab(mode = 'human') {
   const iframe = document.createElement('iframe')
   iframe.id = tabId
   const cwdParam = initialCwd ? `&cwd=${encodeURIComponent(initialCwd)}` : ''
-  iframe.src = `terminal.html?port=${window.haltija?.port || 8700}&mode=${mode}${cwdParam}`
+  // `window.haltija.port` HAS NEVER EXISTED — preload exposes `serverUrl`, not `port` — so this
+  // silently resolved to 8700 for every instance. On a `--private --app` run that is another
+  // project's shared server: the terminal's WebSocket registered its shell THERE while everything
+  // else talked to our own ephemeral server, which is an isolation violation the private mode
+  // exists to prevent. It only became visible when /terminal/* moved to the stdio pipe (#40) and
+  // the two transports could no longer agree by accident.
+  iframe.src = `terminal.html?port=${resolvePublicPort()}&mode=${mode}${cwdParam}`
   iframe.className = 'terminal-frame'
 
   el.webviewContainer.appendChild(iframe)
@@ -287,7 +310,7 @@ export function activateTab(tabId) {
     }
 
     if (tab.terminalMode === 'agent' && tab.shellId) {
-      fetch(`${getServerUrl()}/terminal/agent-focus`, {
+      machineFetch(`/terminal/agent-focus`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ shellId: tab.shellId }),
@@ -415,7 +438,7 @@ export function navigate(url, tabId = activeTabId) {
 export async function changeTerminalDirectory(tab, path) {
   if (!path) return
   try {
-    const resp = await fetch(`${getServerUrl()}/terminal/command`, {
+    const resp = await machineFetch(`/terminal/command`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ command: `cd ${path}`, shellId: tab.shellId }),
@@ -453,7 +476,7 @@ async function checkHjInstalled() {
   hjCheckDone = true
 
   try {
-    const response = await fetch(`${getServerUrl()}/terminal/hj-status`)
+    const response = await machineFetch(`/terminal/hj-status`)
     if (!response.ok) return
 
     const { installed, installCommand, message } = await response.json()

package/apps/desktop/renderer.js

@@ -12,6 +12,7 @@ import {
 } from './renderer/tabs.js'
 import { setTabFunctions } from './renderer/webview-events.js'
 import { checkHaltija } from './renderer/status.js'
+import { initMachineRelay } from './renderer/machine-relay.js'
 import { initSettingsListeners, hideSettings, hideNewTabDialog } from './renderer/settings.js'
 import { initAgentStatusBar } from './renderer/agent-status.js'
 import { initVideoCapture } from './renderer/video-capture.js'
@@ -29,6 +30,7 @@ window._tabs = { getActiveTab, getActiveWebview, createTab, activateTab, closeTa
 setTabFunctions({ navigate, createTab, activateTab, closeTab })
 
 console.log('[Haltija Desktop] Initializing with tabs...')
+initMachineRelay()
 checkHaltija()
 createTab()
 

package/apps/desktop/resources/component.js

@@ -46,7 +46,7 @@
   });
 
   // src/version.ts
-  var VERSION = "1.12.6";
+  var VERSION = "1.12.7";
 
   // src/ws-url.ts
   function httpBaseFromWsUrl(wsUrl2, fallback = "http://localhost:8700") {
@@ -4698,7 +4698,7 @@
       const serverUrl2 = this.serverUrl.replace("ws://", "http://").replace("wss://", "https://").replace("/ws/browser", "");
       let agents = [];
       try {
-        const response = await fetch(`${serverUrl2}/terminal/agents`, { headers: serverHeaders() });
+        const response = await fetch(`${serverUrl2}/agents`, { headers: serverHeaders() });
         const data = await response.json();
         agents = data.agents || [];
       } catch (err) {

package/apps/desktop/server-env.js

@@ -54,6 +54,10 @@ function buildServerEnv(base, opts) {
   env.DEV_CHANNEL_PORT = port;
   env.HALTIJA_DESKTOP = "1";
   env.HALTIJA_DESKTOP_PUBLIC = opts.role === "public" ? "1" : "0";
+  if (opts.role === "public")
+    env.HALTIJA_MACHINE_CHANNEL = "1";
+  else
+    delete env.HALTIJA_MACHINE_CHANNEL;
   if (opts.isPrivate) {
     env.HALTIJA_PRIVATE = "1";
     env.HALTIJA_NO_RETIRE = "1";