haltija 1.12.8 → 1.13.0-beta.1

package/CHANGELOG.md

@@ -1,6 +1,261 @@
 # Changelog
 
-## 1.12.8 (unreleased)
+## 1.13.0-beta.1 (2026-09-26)
+
+Beta (`npm i haltija@beta`); `latest` stays 1.12.9. Breaking changes are listed first.
+
+### Known issue: any web page can call the REST API (#44)
+
+The REST API answers any origin (`Access-Control-Allow-Origin: *`) and needs no token by default,
+so a page you visit can call `/eval` in your connected tabs, or `/shutdown`, and read the results.
+This predates 1.13. What 1.13 changes: with HTTPS on by default, https pages in **Safari** can now
+reach it once the certificate is trusted, where mixed-content blocking used to stop them. Until an
+origin gate lands (planned before 1.13.0), start the server with `--token <secret>` (or set
+`HALTIJA_TOKEN`) on any machine where that matters, and don't leave a server running you aren't
+using.
+
+### Changed (breaking)
+
+- **A server now opens BOTH transports by default** (#32a). `DEV_CHANNEL_MODE` defaults to `both`
+  instead of `http`, so HTTP 8700 *and* HTTPS 8701 come up whichever project starts the channel.
+
+  #32 reported this as a missing-certificate problem — `foresight/node_modules/haltija/certs`
+  didn't exist, so that instance came up HTTP-only. The causation runs the other way: certs are
+  only generated when HTTPS is *wanted*, and the mode defaulted to `http`. The certs were absent
+  **because** the transport was, so shipping certs in the package would have fixed nothing.
+
+  The default is a cross-project decision, which is what makes it worth changing rather than
+  documenting. The channel is shared, so an HTTP-only default is not a choice a project makes for
+  itself — it decides, for every neighbour on the machine, whether `https://` pages can connect at
+  all. In #32 that cost tosijs-3d its entire channel while every indicator said healthy: `hj where`
+  reported "haltija 1.12.2, 1 tab", the dev server logged "dev-channel ready", and every command
+  routed into an unrelated project's page. An unrecognised `DEV_CHANNEL_MODE` now falls back to
+  `both` rather than `http`, so a typo cannot produce the half-open channel either.
+
+  **`--http` now actually does something.** It was listed in `--help` but never parsed — it
+  "worked" only because the `else` branch made HTTP the default. It is a real flag now, and
+  choosing it (or `--https`) explicitly on a shared server prints what it costs your neighbours
+  (#32d). The default is never warned about; a warning that fires routinely is one nobody reads.
+
+- **The TLS certificate moved to `~/.haltija/certs`** — machine-level, not per-install. This is a
+  consequence of the above: per-install certs were nearly invisible while almost nobody had any,
+  but with HTTPS on by default they mean the browser's "I trust this" memory is invalidated every
+  time a different install wins the race to bind 8701, and again after every `npm install` that
+  wipes `node_modules`. The user would be asked to trust localhost repeatedly with no way to make
+  it stop. An existing per-install certificate is **adopted** (copied forward) rather than
+  regenerated, so trust you have already granted survives the move. The private key is written
+  `0600` into a `0700` directory. Override with `HALTIJA_CERTS_DIR`.
+
+  If neither `mkcert` nor `openssl` is present, HTTPS is skipped with an explanation and HTTP still
+  serves — a missing tool is not a broken haltija.
+
+- **The desktop app's internal chrome-widget port moved from 8701 to 8710** (#32a). `8701` was
+  *also* the default for the public HTTPS listener — one number with two independent literals, in
+  `src/server.ts` and `apps/desktop/main.js`, neither file aware of the other. They cannot both bind.
+
+  This was live, not latent. Verified on a developer machine mid-fix: one process (a project's
+  `haltija --both`) held **8700 and 8701 together**, because both transports share a process. Launch
+  the desktop app in `serverMode: 'builtin'` against that and `killZombieServer()` POSTs `/shutdown`
+  to 8701 to claim it for a private widget — shutting down that project's **HTTP** channel as
+  collateral. It also blocked #32's headline request outright: "both transports by default" cannot
+  ship while the desktop app claims one of them.
+
+  **The internal port moved rather than HTTPS**, because HTTPS 8701 has callers we do not ship —
+  the injected loader and bookmarklet hardcode `https://localhost:8701` (see #38 for the last time
+  that string drifted), adopters' dev servers import from it, and self-signed-cert trust is
+  per-origin, so moving it would silently un-trust the cert and present as a dead channel. The
+  internal port's only client is the app's own renderer, updated in the same binary.
+
+  **Who is affected:** anyone who targeted the chrome widget as `HALTIJA_PORT=8701 hj tree` should
+  now use `8710`. A desktop app older than 1.13.0 still holds 8701, so a new `--both` server may
+  fail to bind HTTPS until that app restarts. Setting `HALTIJA_INTERNAL_PORT=8701` by hand now
+  prints what will break instead of surfacing as a bind failure in a process you forgot was
+  involved.
+
+  Every well-known port and its role now lives in **`src/ports.ts`** (8700 public HTTP / 8701 public
+  HTTPS / 8710 internal HTTP / 8711 reserved), compiled to a CJS twin for Electron main the same way
+  `server-env.js` is. `src/ports.test.ts` asserts the public and internal blocks stay disjoint — and
+  asserts the *roles*, not the literals, since two literals agreeing is precisely what the bug was.
+  Verified against a real `--private --app` launch: chrome widget connected, ports released on
+  teardown, and the unrelated `--both` server on 8700/8701 untouched throughout.
+
+- **Only the server holding 8700 takes the well-known HTTPS port 8701.** A server started with
+  `--port`/`--name`, or one that fell back off a busy 8700 onto an ephemeral port, now opens HTTPS
+  on an ephemeral port shown in its banner and `/status`, unless given `--https-port`. Before
+  this, with `both` as the default, the first 1.13 server started in any project could capture
+  every project's https pages while the real channel and `hj` saw 0 tabs.
+
+- **The startup banner and the `server` export prefer HTTP.** They preferred HTTPS, which with
+  `both` as the default pointed `curl` at a self-signed certificate and made the DEV MODE
+  one-liner fail silently on http pages. `server` is the HTTP listener whenever HTTP is up; use
+  `httpsServer` for the HTTPS one.
+
+- **A server run from a source checkout installs `hj` by copy, never by symlink,** and only a
+  bundle whose stamped version matches the server's. The old symlink fallback pinned
+  `~/.local/bin/hj` to that checkout permanently, because a symlinked `hj` is treated as a
+  deliberate choice and never repaired.
+
+### Added
+
+- **`testInBrowser`** — jest-shaped tests whose assertions run on the host and whose probes run in a
+  real browser (#51). The body stays on the host with its real `expect`; only the probe crosses.
+  Coordinates (`clickAt`, `dragFrom`) are first-class alongside selectors, because SVG-based UI has
+  no selectable element to name. Design credit tosijs-3d; corpus-liveness requirement from
+  tosijs-3d-ensemble; the numbers that made the case from tosijs-ui.
+
+- **The embed snippet falls back to the other transport** (#32c). It tries the transport matching
+  the page, then the other; an https page drops to http only on `localhost`. If neither works it
+  logs `haltija: no channel reachable` in the page console, naming the HTTPS address to accept,
+  instead of failing silently. The snippet now has one source (`src/loader-snippet.ts`) shared by
+  the `/docs` copy and its Playwright suite, and `bun run test:engines` runs that suite in
+  Chromium, Firefox and WebKit.
+
+### Fixed
+
+- **Whether an https page can reach `http://localhost` depends on the browser, and the docs now
+  say so.** Chromium and Firefox allow it; **Safari (WebKit) blocks it as mixed content**. The docs
+  had said it was always blocked. Earlier in this release they were changed to say it was never
+  blocked, based on a Chromium-only measurement. Both were wrong. The effect is that the fallback
+  above helps Chromium and Firefox, but https pages in Safari still need the HTTPS transport. That
+  is the strongest reason for `both` being the default. #33's original "mixed content" diagnosis
+  was correct for Safari.
+
+- **`haltija/server`'s types no longer require `@types/bun`.** Its `.d.ts` exported Bun's own
+  server type, so a TypeScript project importing it failed to compile with "Cannot find name
+  'Bun'". `server`, `httpServer` and `httpsServer` are now typed as a small `ListeningServer`
+  interface (`port`, `hostname`, `url`, `stop()`); the runtime values are unchanged. Found by the
+  new publish workflow's consumer smoke test.
+
+- **The machine-level certificate is renewed before it expires**, and one that can't be read is
+  replaced. It used to be regenerated by every `npm install`; kept in `~/.haltija/certs` it would
+  have lapsed after the openssl fallback's 365 days, while `/status` still reported HTTPS up.
+  Writing, adopting or renewing it now leaves a receipt in `~/.haltija/machine-actions.log` and a
+  line on stderr. A replaced pair is kept as `*.bak`, since `HALTIJA_CERTS_DIR` may point at a
+  directory you own. A key that doesn't match its cert is replaced too, so a pair left
+  mismatched by two servers renewing at once heals on the next start. A failed renewal keeps
+  using the current cert while it is still valid.
+
+- **A bad certificate costs HTTPS only.** A mismatched or corrupt pair in `~/.haltija/certs` used
+  to stop every haltija server on the machine from starting, HTTP included. `/status` (and so
+  `hj where`) now names the real reason HTTPS is down; it used to blame "port N is held by
+  another process" for certificate problems.
+
+- **`testInBrowser`: `clickAt` and `dragFrom` send pointer events** as well as mouse events, with
+  `buttons` set, and moves go to the element under the pointer. Pointer-driven controls (3D camera
+  orbits) ignored them before, and the drag still reported success. `clickAt` also accepts a real
+  point above the fold on a scrolled page, which it rejected as "outside the document", and
+  `click`/`type`/`press` now fail on a `{ success: false }` reply from a bridge instead of passing.
+
+- **The test suites no longer touch the real 8701 or `~/.haltija/certs`.** The Playwright helper
+  opted out of HTTPS with a variable nothing had read since v0.1.7, which stopped mattering only
+  while `http` was the default. CI now fails if a suite writes anything under `~/.haltija`.
+
+- **The README no longer says "localhost only by default".** The server listens on all
+  interfaces, and without `--token` any page or anything on the network can call its REST API.
+
+## 1.12.9
+
+Remediation of a Tier 1 review that returned **BLOCK** on the already-published 1.12.7/1.12.8.
+Full report: `reviews/1.12.9-tier1-v1.12.6-to-v1.12.8.md`.
+
+### Security
+
+- **Babylon.js is pinned and integrity-checked (review B1).** The 3D preview added in 1.12.7 loaded
+  `cdn.babylonjs.com/babylon.js` — rolling latest, no pin, no SRI — into the one frame holding a
+  postMessage relay that reaches `spawn('sh','-c')` and the filesystem. The app strips CSP headers
+  globally and the iframe has no sandbox, so a CDN compromise, a bad publish, or a TLS-intercepting
+  proxy meant arbitrary code execution on the developer's machine. Shipped, ironically, in the
+  release that removed a *network*-reachable RCE. Now pinned to `v9.25.0` with `integrity` +
+  `crossorigin`, so substituted bytes cannot execute at all.
+- **The renderer relay now default-denies its sender.** It validated message *shape* only, so any
+  frame in the renderer could reach shell and filesystem. It now requires `event.source` to be a
+  known terminal iframe. This is what turned "third-party code in a preview pane" into "third-party
+  code with a shell", and it would have handed shell access to any plain `<iframe>` added later.
+- **`/ws/terminal` upgrades are restricted (review B3).** It accepted unauthenticated
+  cross-origin upgrades and volunteers `{shellId, cwd}` on connect, streaming the developer's
+  working directory and absolute file paths to any web page. It now admits: a **loopback hostname**
+  origin, an opaque/`file:` origin that presents a per-launch nonce the desktop app gives only to
+  its own terminal frame, or a request with **no `Origin` header at all** (a non-browser client — a
+  browser always sends one cross-origin).
+
+  **Stated precisely, because an earlier draft of this bullet was false in three directions and a
+  pre-publish review caught it.** What is *not* claimed: `/ws/agent` and `/ws/browser` are
+  deliberately **not** gated — the REST surface already answers any origin
+  (`Access-Control-Allow-Origin: *`), so any page can already `POST /tree` and `/eval`; gating the
+  socket alone would close nothing and would break non-browser agents, which is why an attempt to
+  do so was reverted during this release. And the `/ws/terminal` rule is not "local machine only":
+  a loopback match is **hostname-only, any port**, so a third-party script on your own
+  `localhost:3000` dev server qualifies, and an absent `Origin` is admitted from anywhere on the
+  LAN because the server binds `0.0.0.0`. **`--token` is what addresses those**, not this gate.
+- **The channel grant no longer leaks to child processes.** `HALTIJA_MACHINE_CHANNEL=1` was spread
+  into every command the terminal or an agent spawned, so a nested `bunx haltija` would start
+  treating its own stdin as an authenticated control channel.
+
+### `haltija/test` no longer mutates a browser nobody chose (#42)
+
+`resolveTestServerUrl` falls back to `http://localhost:8700` — the *shared* interactive server — and
+the only gate was a stderr warning. This project proved on itself that a warning is not a boundary:
+on 2026-09-03 our own suite adopted another project's server and called `navigate`/`click` against
+its six live tabs. We fixed our lane and left the published library adopting, and **a hazard fixed
+in your own lane but left in the library you ship is not fixed**.
+
+Mutating calls (`navigate`, `click`, `type`, `press`, `refresh`) now **throw** when no
+`HALTIJA_URL`/`HALTIJA_PORT` was set, with a message naming the remedy. Read-only calls (`status`,
+`query`, `eval`) are unaffected — reading from a shared server harms nobody, and a guard that blocks
+harmless calls gets disabled wholesale. `HALTIJA_TEST_ALLOW_SHARED=1` opts back in deliberately.
+
+**This is a behaviour change in a published API.** Anyone whose suite relied on the 8700 fallback
+for mutating calls will now get a loud error instead of silently driving whichever browser answered
+— which is the point.
+
+### Dependencies
+
+- **`tosijs-schema` was pinned to an exact `1.5.1`, four minors behind.** Surfaced by a new Tier 0
+  check (from tosijs-ui#61's finding #2: *declared ranges whose window excludes what a consumer
+  installs today*). An exact pin in a regular dependency also invites a duplicate install alongside
+  a consumer's own copy. Moved to `^1.9.0` after verifying the upgrade rather than assuming it:
+  977 unit + 125 e2e green, and every schema-derived generated artifact (`API.md`, `DOCS.md`,
+  `llms.txt`, `bin/hints.json`, `apps/mcp/src/endpoints.json`) rebuilt **byte-identical**.
+
+### Coverage and structure (the two gaps the reviews left open)
+
+- **Nothing exercised the terminal's WebSocket**, which is why a regression that broke it was
+  invisible to 977 green tests: `/terminal/command` travels over the stdio pipe and never needed
+  the socket, so commands kept working. Two guards now: a live upgrade test against a real private
+  server (raw HTTP upgrade, so it can set `Origin` — which the browser WebSocket API forbids), and
+  a wiring test asserting `main.js` actually *passes* what `buildServerEnv` can grant. The second
+  is the one that matters: the function was already tested; the defect was a caller that silently
+  dropped an argument. Both verified by mutation.
+- **The base64 Response shim existed twice and had already diverged** (only one copy had
+  `dataUrl()`). Now one source, `src/machine-response.ts`, built twice — ESM for the renderer's
+  modules, a global for `terminal.html`, which is an inline-script page with no import mechanism.
+
+### Fixes
+
+- **Window recreation was dead code (review B2).** The 1.12.7 stdout refactor tested
+  `__NEED_WINDOW__` against the *residual line buffer*; the marker always arrives newline-terminated,
+  so the check was always false and the correct one below it unreachable. Every `hj` command against
+  a windowless-but-alive desktop app hung 8s and failed.
+- **Root cause of the above: the wire protocol was implemented twice.** `main.js` hand-rolled the
+  prefixes, the line split and the parse while `src/machine-channel.ts` owned and tested them. It is
+  now a generated twin (`apps/desktop/machine-channel.js`), like `server-env.js`.
+- **Timeout layering was inverted**, so a ~30s command (`npm ci`, a slow build) reported "Timed out
+  on the machine channel" and discarded the server's real output. Each outer deadline is now
+  strictly longer than the one it wraps (server 30s → main 45s → iframe 50s), so a timeout at a
+  layer means that layer genuinely lost the answer.
+- **The desktop guard test only recognised template-literal fetches**, so
+  `fetch(getServerUrl() + '/files/read')` passed green and 410'd at runtime — the exact silent
+  breakage it exists to prevent. It now matches the call and the path independently (verified by
+  mutation), skips comments, and states its remaining line-scoped limit rather than implying none.
+- Bun's Unix-socket defect is now **filed upstream** (oven-sh/bun#41381) and mirrored in
+  `UPSTREAM.md`, per "we file, we don't fix". The stdio channel stays regardless — it is good on its
+  own merits.
+- Docs corrected: `docs/AGENTIC-IDE.md` no longer advertises two routes that now return 410;
+  `CLAUDE.md` no longer contradicts itself about whether the tabs were restored; published versions
+  are no longer marked `(unreleased)`; and the absolute "no machine-control surface on any
+  transport" claim is stated precisely, since an earlier version of it was false.
+
+## 1.12.8
 
 - **Electron discovery assumed macOS, so Linux re-downloaded Electron every run (#43).** The npx-cache
   search looked for `Electron.app` — a macOS bundle — behind a `platform() !== 'win32'` guard, so
@@ -14,7 +269,7 @@
   right all along — decide the binary name, so there is one authority instead of two to drift.
   Reported by snowfox with the diagnosis and the fix.
 
-## 1.12.7 (unreleased)
+## 1.12.7
 
 ### File preview: 3D models, video, audio and fonts
 

package/README.md

@@ -331,8 +331,13 @@ app also exists but isn't required for either.
 
 - Widget is always visible (no silent snooping)
 - User can pause or kill connection anytime
-- Localhost only by default
-- HTTPS mode with auto-generated certs
+- **Not localhost-only.** The server listens on all interfaces (HTTP 8700 and HTTPS 8701 by
+  default), and without `--token` any page you visit, or anything on your network, can call its
+  REST API — including `/eval` in your connected tabs. Use `--token <secret>` (or
+  `HALTIJA_TOKEN`) on any network you don't trust, and don't leave a server running you aren't
+  using.
+- Machine-level HTTPS certificate in `~/.haltija/certs`, auto-generated (mkcert if installed,
+  otherwise openssl) and renewed before it expires
 
 ---
 
@@ -419,10 +424,10 @@ HALTIJA_NAME=dashboard hj tree         # any shell can address it by name
 
 What this means for you, depending on how you used 1.3.0-beta.7:
 
-- **`bunx haltija` desktop app** — works the same; no migration needed. The outer "chrome" widget that lets the app inspect itself now lives on a separate internal port (8701) so it never appears in agent-facing window listings.
+- **`bunx haltija` desktop app** — works the same; no migration needed. The outer "chrome" widget that lets the app inspect itself now lives on a separate internal port (8701 then, 8710 since 1.13.0) so it never appears in agent-facing window listings.
 - **`HALTIJA_SESSION` / `--session` / `--secure` / the click-to-copy session badge** — gone. If you were setting `HALTIJA_SESSION` in your shell, replace it with `HALTIJA_NAME` (and start the server with `--name <foo>`) or `HALTIJA_PORT`.
 - **`inject(url, { session })`** — the `session` option is removed. If you need auth, use `inject(url, { token })` (matches `haltija --token <secret>`); for embedding without auth, just `inject(url)` or `inject(url, { mode: 'headless' })`.
-- **`hj-chrome` exclusion logic** — gone from the public REST API. To inspect the desktop app's outer UI from `hj`, target the internal port directly: `HALTIJA_PORT=8701 hj tree`.
+- **`hj-chrome` exclusion logic** — gone from the public REST API. To inspect the desktop app's outer UI from `hj`, target the internal port directly: `HALTIJA_PORT=8710 hj tree`. *(That port was 8701 in 1.4.0–1.12.x; it moved in 1.13.0 because 8701 is the public HTTPS listener — see [#32](https://github.com/tonioloewald/haltija/issues/32).)*
 
 Net code change: ~830 lines removed, ~150 added back for the simpler model. Test count went up (we now have integration coverage for the token stub, named instances, and auto-port fallback that the previous betas lacked).
 

package/apps/desktop/isolation.js

@@ -48,8 +48,14 @@ __export(exports_desktop_isolation, {
   resolveServerUrl: () => resolveServerUrl
 });
 module.exports = __toCommonJS(exports_desktop_isolation);
-var SHARED_PUBLIC_URL = "http://localhost:8700";
-var SHARED_INTERNAL_PORT = 8701;
+
+// src/ports.ts
+var DEFAULT_HTTP_PORT = 8700;
+var DEFAULT_INTERNAL_PORT = 8710;
+
+// src/desktop-isolation.ts
+var SHARED_PUBLIC_URL = `http://localhost:${DEFAULT_HTTP_PORT}`;
+var SHARED_INTERNAL_PORT = DEFAULT_INTERNAL_PORT;
 function resolveInternalPort(env) {
   const raw = env.HALTIJA_INTERNAL_PORT;
   if (raw === undefined || raw === "")

package/apps/desktop/machine-channel.js

@@ -0,0 +1,105 @@
+/** ⚠️  AUTO-GENERATED FROM src/machine-channel.ts — DO NOT EDIT. Run: bun run build */
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/machine-channel.ts
+var exports_machine_channel = {};
+__export(exports_machine_channel, {
+  MACHINE_CHANNEL_ENV: () => MACHINE_CHANNEL_ENV,
+  MACHINE_REQ_PREFIX: () => MACHINE_REQ_PREFIX,
+  MACHINE_RES_PREFIX: () => MACHINE_RES_PREFIX,
+  childEnvWithoutChannel: () => childEnvWithoutChannel,
+  formatRequest: () => formatRequest,
+  formatResponse: () => formatResponse,
+  machineChannelEnabled: () => machineChannelEnabled,
+  parseRequestLine: () => parseRequestLine,
+  parseResponseLine: () => parseResponseLine,
+  splitLines: () => splitLines
+});
+module.exports = __toCommonJS(exports_machine_channel);
+var MACHINE_REQ_PREFIX = "HJ_MACHINE_REQ ";
+var MACHINE_RES_PREFIX = "HJ_MACHINE_RES ";
+var MACHINE_CHANNEL_ENV = "HALTIJA_MACHINE_CHANNEL";
+function machineChannelEnabled(env) {
+  return env[MACHINE_CHANNEL_ENV] === "1";
+}
+function formatRequest(req) {
+  return MACHINE_REQ_PREFIX + JSON.stringify(req) + `
+`;
+}
+function formatResponse(res) {
+  return MACHINE_RES_PREFIX + JSON.stringify(res) + `
+`;
+}
+function parseRequestLine(line) {
+  if (!line.startsWith(MACHINE_REQ_PREFIX))
+    return null;
+  try {
+    const parsed = JSON.parse(line.slice(MACHINE_REQ_PREFIX.length));
+    if (typeof parsed?.id !== "string" || typeof parsed?.path !== "string")
+      return null;
+    if (!parsed.path.startsWith("/"))
+      return null;
+    return { method: "GET", ...parsed };
+  } catch {
+    return null;
+  }
+}
+function parseResponseLine(line) {
+  if (!line.startsWith(MACHINE_RES_PREFIX))
+    return null;
+  try {
+    const parsed = JSON.parse(line.slice(MACHINE_RES_PREFIX.length));
+    if (typeof parsed?.id !== "string" || typeof parsed?.status !== "number")
+      return null;
+    return { headers: {}, bodyB64: "", ...parsed };
+  } catch {
+    return null;
+  }
+}
+function splitLines(buffer) {
+  const parts = buffer.split(`
+`);
+  const rest = parts.pop() ?? "";
+  return { lines: parts, rest };
+}
+function childEnvWithoutChannel(env = process.env) {
+  const copy = { ...env };
+  delete copy[MACHINE_CHANNEL_ENV];
+  return copy;
+}

package/apps/desktop/machine-response.global.js

@@ -0,0 +1,74 @@
+/** ⚠️  AUTO-GENERATED FROM src/machine-response.ts — DO NOT EDIT. Run: bun run build */
+(() => {
+  var __defProp = Object.defineProperty;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  function __accessProp(key) {
+    return this[key];
+  }
+  var __toCommonJS = (from) => {
+    var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+    if (entry)
+      return entry;
+    entry = __defProp({}, "__esModule", { value: true });
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (var key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(entry, key))
+          __defProp(entry, key, {
+            get: __accessProp.bind(from, key),
+            enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+          });
+    }
+    __moduleCache.set(from, entry);
+    return entry;
+  };
+  var __moduleCache;
+  var __returnValue = (v) => v;
+  function __exportSetter(name, newValue) {
+    this[name] = __returnValue.bind(null, newValue);
+  }
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, {
+        get: all[name],
+        enumerable: true,
+        configurable: true,
+        set: __exportSetter.bind(all, name)
+      });
+  };
+
+  // src/machine-response.ts
+  var exports_machine_response = {};
+  __export(exports_machine_response, {
+    machineResponseError: () => machineResponseError,
+    makeMachineResponse: () => makeMachineResponse
+  });
+  function makeMachineResponse(status, bodyB64, headers = {}) {
+    let decoded = null;
+    const decode = () => {
+      if (decoded === null) {
+        const bytes = Uint8Array.from(atob(bodyB64 || ""), (c) => c.charCodeAt(0));
+        decoded = new TextDecoder().decode(bytes);
+      }
+      return decoded;
+    };
+    return {
+      ok: status >= 200 && status < 300,
+      status,
+      headers,
+      b64: bodyB64 || "",
+      dataUrl: () => `data:${headers["content-type"] || "application/octet-stream"};base64,${bodyB64 || ""}`,
+      json: async () => JSON.parse(decode() || "{}"),
+      text: async () => decode()
+    };
+  }
+  function machineResponseError(status, message) {
+    return makeMachineResponse(status, btoa(JSON.stringify({ success: false, error: message })), {
+      "content-type": "application/json"
+    });
+  }
+  if (typeof globalThis !== "undefined" && typeof globalThis.document !== "undefined") {
+    globalThis.__hjMachineResponse = { makeMachineResponse, machineResponseError };
+  }
+})();