haltija 1.12.9 → 1.13.0-beta.2

package/CHANGELOG.md

@@ -1,6 +1,217 @@
 # Changelog
 
-## 1.12.9 (unreleased)
+## 1.13.0-beta.2 (2026-09-29)
+
+### Changed
+
+- **Navigating or reloading now blocks until the page's widget is back** (see Fixed). This
+  applies everywhere: `hj navigate` / `hj refresh`, REST `/navigate` / `/refresh`, the MCP
+  bridge, `DevChannelClient` and `haltija/test`, and the test runner's `navigate` step.
+  - Usually it takes tens of milliseconds. On a page that doesn't load the widget itself (a
+    bookmarklet tab), nothing comes back, so each call waits out `--timeout` (default 10 s, max
+    50 s) and then returns with a warning. Pass `--no-wait` (`wait: false`, or `timeout: 0`)
+    there.
+  - Focus follows the navigated tab, so the next untargeted command reaches the page just
+    loaded, unless focus was deliberately changed during the load.
+  - `DevChannelClient.navigate()` / `refresh()` (and the `haltija/test` wrappers) now return
+    `{ reconnected, warning?, candidateWindowId? }` instead of nothing. `refresh()` with no
+    argument is a hard reload, matching the endpoint. It always was one, by accident; see Fixed.
+  - **The widget writes to the page's `window.name`** when it navigates, to carry the tab's
+    identity across. It writes `haltija-handoff:<id>|<the page's own name>` just before an http(s)
+    navigation that loads a new page. The next page's widget restores the page's own value.
+    - If the page stays (a 204, a download, a cancelled navigation), the widget restores it once
+      the caller's wait is over.
+    - If the next page doesn't load the widget, the marker is left there.
+    - The next page's own scripts can see the marker until the widget loads and removes it. That
+      matters for an app that keeps state in `window.name`.
+
+### Fixed
+
+- **`hj navigate` and `hj refresh` wait for the new page** (#54, reported by Snowfox). Both replied
+  as soon as the navigation started, before the old page had unloaded. A command sent straight
+  after was answered by the page being left, failed with "No browser connected" during the
+  handover, or was lost and timed out after 5 s. Snowfox saw it as a page that "stopped loading"
+  and worked around it with a 2.5 s pause.
+  - They now return once the tab is back from the new page (`data.reconnected: true`).
+  - A tab keeps its identity across origins: the widget hands its window id to the next page
+    through `window.name`, since the sessionStorage it normally uses is per-origin. The tab is
+    therefore recognised by its id, never by guessing which new window it might be. A tab that
+    merely appears on the destination origin during a slow load is not mistaken for it.
+  - Where `window.name` does not survive, the call returns within about 2 s with
+    `reconnected: false`, a `warning`, and the new window as `candidateWindowId`, and never claims
+    that window. In the test runner, a `navigate` step fails in this case. How often that happens
+    depends on the browser (measured):
+    - Chromium, which includes `--headless` and the desktop app's engine, keeps `window.name`
+      across origins and sites, including redirects. It is cleared only when the browsing-context
+      group changes, which COOP (sent by some OAuth providers) causes.
+    - Firefox and WebKit clear it on any cross-origin navigation, including a move to another
+      localhost port.
+    - In the desktop app a tab's id is stable anyway.
+  - The URL is resolved and normalised once, and that URL is both what is loaded and what the
+    server waits for. `/docs` used to go to `https:///docs`, and `#x` became a web search in the
+    desktop app. A `#hash`-only navigation, which returns at once, was misjudged when written
+    differently (`http://localhost:3000#x`, an uppercase host). A bare host (`localhost:3000`)
+    still reaches the desktop app raw, so it keeps falling back to http.
+  - Warnings are joined to any already attached, rather than replacing them.
+  - The test runner's `navigate` step uses the same wait and tab choice. It had failed
+    cross-origin navigations and spent a fixed 400 ms per navigation.
+- **`DevChannelClient.refresh(false)` was always a hard reload:** it sent `hard` to an endpoint
+  that reads `soft`.
+
+## 1.13.0-beta.1 (2026-09-26)
+
+Beta (`npm i haltija@beta`); `latest` stays 1.12.9. Breaking changes are listed first.
+
+### Known issue: any web page can call the REST API (#44)
+
+The REST API answers any origin (`Access-Control-Allow-Origin: *`) and needs no token by default,
+so a page you visit can call `/eval` in your connected tabs, or `/shutdown`, and read the results.
+This predates 1.13. What 1.13 changes: with HTTPS on by default, https pages in **Safari** can now
+reach it once the certificate is trusted, where mixed-content blocking used to stop them. Until an
+origin gate lands (planned before 1.13.0), start the server with `--token <secret>` (or set
+`HALTIJA_TOKEN`) on any machine where that matters, and don't leave a server running you aren't
+using.
+
+### Changed (breaking)
+
+- **A server now opens BOTH transports by default** (#32a). `DEV_CHANNEL_MODE` defaults to `both`
+  instead of `http`, so HTTP 8700 *and* HTTPS 8701 come up whichever project starts the channel.
+
+  #32 reported this as a missing-certificate problem — `foresight/node_modules/haltija/certs`
+  didn't exist, so that instance came up HTTP-only. The causation runs the other way: certs are
+  only generated when HTTPS is *wanted*, and the mode defaulted to `http`. The certs were absent
+  **because** the transport was, so shipping certs in the package would have fixed nothing.
+
+  The default is a cross-project decision, which is what makes it worth changing rather than
+  documenting. The channel is shared, so an HTTP-only default is not a choice a project makes for
+  itself — it decides, for every neighbour on the machine, whether `https://` pages can connect at
+  all. In #32 that cost tosijs-3d its entire channel while every indicator said healthy: `hj where`
+  reported "haltija 1.12.2, 1 tab", the dev server logged "dev-channel ready", and every command
+  routed into an unrelated project's page. An unrecognised `DEV_CHANNEL_MODE` now falls back to
+  `both` rather than `http`, so a typo cannot produce the half-open channel either.
+
+  **`--http` now actually does something.** It was listed in `--help` but never parsed — it
+  "worked" only because the `else` branch made HTTP the default. It is a real flag now, and
+  choosing it (or `--https`) explicitly on a shared server prints what it costs your neighbours
+  (#32d). The default is never warned about; a warning that fires routinely is one nobody reads.
+
+- **The TLS certificate moved to `~/.haltija/certs`** — machine-level, not per-install. This is a
+  consequence of the above: per-install certs were nearly invisible while almost nobody had any,
+  but with HTTPS on by default they mean the browser's "I trust this" memory is invalidated every
+  time a different install wins the race to bind 8701, and again after every `npm install` that
+  wipes `node_modules`. The user would be asked to trust localhost repeatedly with no way to make
+  it stop. An existing per-install certificate is **adopted** (copied forward) rather than
+  regenerated, so trust you have already granted survives the move. The private key is written
+  `0600` into a `0700` directory. Override with `HALTIJA_CERTS_DIR`.
+
+  If neither `mkcert` nor `openssl` is present, HTTPS is skipped with an explanation and HTTP still
+  serves — a missing tool is not a broken haltija.
+
+- **The desktop app's internal chrome-widget port moved from 8701 to 8710** (#32a). `8701` was
+  *also* the default for the public HTTPS listener — one number with two independent literals, in
+  `src/server.ts` and `apps/desktop/main.js`, neither file aware of the other. They cannot both bind.
+
+  This was live, not latent. Verified on a developer machine mid-fix: one process (a project's
+  `haltija --both`) held **8700 and 8701 together**, because both transports share a process. Launch
+  the desktop app in `serverMode: 'builtin'` against that and `killZombieServer()` POSTs `/shutdown`
+  to 8701 to claim it for a private widget — shutting down that project's **HTTP** channel as
+  collateral. It also blocked #32's headline request outright: "both transports by default" cannot
+  ship while the desktop app claims one of them.
+
+  **The internal port moved rather than HTTPS**, because HTTPS 8701 has callers we do not ship —
+  the injected loader and bookmarklet hardcode `https://localhost:8701` (see #38 for the last time
+  that string drifted), adopters' dev servers import from it, and self-signed-cert trust is
+  per-origin, so moving it would silently un-trust the cert and present as a dead channel. The
+  internal port's only client is the app's own renderer, updated in the same binary.
+
+  **Who is affected:** anyone who targeted the chrome widget as `HALTIJA_PORT=8701 hj tree` should
+  now use `8710`. A desktop app older than 1.13.0 still holds 8701, so a new `--both` server may
+  fail to bind HTTPS until that app restarts. Setting `HALTIJA_INTERNAL_PORT=8701` by hand now
+  prints what will break instead of surfacing as a bind failure in a process you forgot was
+  involved.
+
+  Every well-known port and its role now lives in **`src/ports.ts`** (8700 public HTTP / 8701 public
+  HTTPS / 8710 internal HTTP / 8711 reserved), compiled to a CJS twin for Electron main the same way
+  `server-env.js` is. `src/ports.test.ts` asserts the public and internal blocks stay disjoint — and
+  asserts the *roles*, not the literals, since two literals agreeing is precisely what the bug was.
+  Verified against a real `--private --app` launch: chrome widget connected, ports released on
+  teardown, and the unrelated `--both` server on 8700/8701 untouched throughout.
+
+- **Only the server holding 8700 takes the well-known HTTPS port 8701.** A server started with
+  `--port`/`--name`, or one that fell back off a busy 8700 onto an ephemeral port, now opens HTTPS
+  on an ephemeral port shown in its banner and `/status`, unless given `--https-port`. Before
+  this, with `both` as the default, the first 1.13 server started in any project could capture
+  every project's https pages while the real channel and `hj` saw 0 tabs.
+
+- **The startup banner and the `server` export prefer HTTP.** They preferred HTTPS, which with
+  `both` as the default pointed `curl` at a self-signed certificate and made the DEV MODE
+  one-liner fail silently on http pages. `server` is the HTTP listener whenever HTTP is up; use
+  `httpsServer` for the HTTPS one.
+
+- **A server run from a source checkout installs `hj` by copy, never by symlink,** and only a
+  bundle whose stamped version matches the server's. The old symlink fallback pinned
+  `~/.local/bin/hj` to that checkout permanently, because a symlinked `hj` is treated as a
+  deliberate choice and never repaired.
+
+### Added
+
+- **`testInBrowser`** — jest-shaped tests whose assertions run on the host and whose probes run in a
+  real browser (#51). The body stays on the host with its real `expect`; only the probe crosses.
+  Coordinates (`clickAt`, `dragFrom`) are first-class alongside selectors, because SVG-based UI has
+  no selectable element to name. Design credit tosijs-3d; corpus-liveness requirement from
+  tosijs-3d-ensemble; the numbers that made the case from tosijs-ui.
+
+- **The embed snippet falls back to the other transport** (#32c). It tries the transport matching
+  the page, then the other; an https page drops to http only on `localhost`. If neither works it
+  logs `haltija: no channel reachable` in the page console, naming the HTTPS address to accept,
+  instead of failing silently. The snippet now has one source (`src/loader-snippet.ts`) shared by
+  the `/docs` copy and its Playwright suite, and `bun run test:engines` runs that suite in
+  Chromium, Firefox and WebKit.
+
+### Fixed
+
+- **Whether an https page can reach `http://localhost` depends on the browser, and the docs now
+  say so.** Chromium and Firefox allow it; **Safari (WebKit) blocks it as mixed content**. The docs
+  had said it was always blocked. Earlier in this release they were changed to say it was never
+  blocked, based on a Chromium-only measurement. Both were wrong. The effect is that the fallback
+  above helps Chromium and Firefox, but https pages in Safari still need the HTTPS transport. That
+  is the strongest reason for `both` being the default. #33's original "mixed content" diagnosis
+  was correct for Safari.
+
+- **`haltija/server`'s types no longer require `@types/bun`.** Its `.d.ts` exported Bun's own
+  server type, so a TypeScript project importing it failed to compile with "Cannot find name
+  'Bun'". `server`, `httpServer` and `httpsServer` are now typed as a small `ListeningServer`
+  interface (`port`, `hostname`, `url`, `stop()`); the runtime values are unchanged. Found by the
+  new publish workflow's consumer smoke test.
+
+- **The machine-level certificate is renewed before it expires**, and one that can't be read is
+  replaced. It used to be regenerated by every `npm install`; kept in `~/.haltija/certs` it would
+  have lapsed after the openssl fallback's 365 days, while `/status` still reported HTTPS up.
+  Writing, adopting or renewing it now leaves a receipt in `~/.haltija/machine-actions.log` and a
+  line on stderr. A replaced pair is kept as `*.bak`, since `HALTIJA_CERTS_DIR` may point at a
+  directory you own. A key that doesn't match its cert is replaced too, so a pair left
+  mismatched by two servers renewing at once heals on the next start. A failed renewal keeps
+  using the current cert while it is still valid.
+
+- **A bad certificate costs HTTPS only.** A mismatched or corrupt pair in `~/.haltija/certs` used
+  to stop every haltija server on the machine from starting, HTTP included. `/status` (and so
+  `hj where`) now names the real reason HTTPS is down; it used to blame "port N is held by
+  another process" for certificate problems.
+
+- **`testInBrowser`: `clickAt` and `dragFrom` send pointer events** as well as mouse events, with
+  `buttons` set, and moves go to the element under the pointer. Pointer-driven controls (3D camera
+  orbits) ignored them before, and the drag still reported success. `clickAt` also accepts a real
+  point above the fold on a scrolled page, which it rejected as "outside the document", and
+  `click`/`type`/`press` now fail on a `{ success: false }` reply from a bridge instead of passing.
+
+- **The test suites no longer touch the real 8701 or `~/.haltija/certs`.** The Playwright helper
+  opted out of HTTPS with a variable nothing had read since v0.1.7, which stopped mattering only
+  while `http` was the default. CI now fails if a suite writes anything under `~/.haltija`.
+
+- **The README no longer says "localhost only by default".** The server listens on all
+  interfaces, and without `--token` any page or anything on the network can call its REST API.
+
+## 1.12.9
 
 Remediation of a Tier 1 review that returned **BLOCK** on the already-published 1.12.7/1.12.8.
 Full report: `reviews/1.12.9-tier1-v1.12.6-to-v1.12.8.md`.

package/README.md

@@ -331,8 +331,13 @@ app also exists but isn't required for either.
 
 - Widget is always visible (no silent snooping)
 - User can pause or kill connection anytime
-- Localhost only by default
-- HTTPS mode with auto-generated certs
+- **Not localhost-only.** The server listens on all interfaces (HTTP 8700 and HTTPS 8701 by
+  default), and without `--token` any page you visit, or anything on your network, can call its
+  REST API — including `/eval` in your connected tabs. Use `--token <secret>` (or
+  `HALTIJA_TOKEN`) on any network you don't trust, and don't leave a server running you aren't
+  using.
+- Machine-level HTTPS certificate in `~/.haltija/certs`, auto-generated (mkcert if installed,
+  otherwise openssl) and renewed before it expires
 
 ---
 
@@ -419,10 +424,10 @@ HALTIJA_NAME=dashboard hj tree         # any shell can address it by name
 
 What this means for you, depending on how you used 1.3.0-beta.7:
 
-- **`bunx haltija` desktop app** — works the same; no migration needed. The outer "chrome" widget that lets the app inspect itself now lives on a separate internal port (8701) so it never appears in agent-facing window listings.
+- **`bunx haltija` desktop app** — works the same; no migration needed. The outer "chrome" widget that lets the app inspect itself now lives on a separate internal port (8701 then, 8710 since 1.13.0) so it never appears in agent-facing window listings.
 - **`HALTIJA_SESSION` / `--session` / `--secure` / the click-to-copy session badge** — gone. If you were setting `HALTIJA_SESSION` in your shell, replace it with `HALTIJA_NAME` (and start the server with `--name <foo>`) or `HALTIJA_PORT`.
 - **`inject(url, { session })`** — the `session` option is removed. If you need auth, use `inject(url, { token })` (matches `haltija --token <secret>`); for embedding without auth, just `inject(url)` or `inject(url, { mode: 'headless' })`.
-- **`hj-chrome` exclusion logic** — gone from the public REST API. To inspect the desktop app's outer UI from `hj`, target the internal port directly: `HALTIJA_PORT=8701 hj tree`.
+- **`hj-chrome` exclusion logic** — gone from the public REST API. To inspect the desktop app's outer UI from `hj`, target the internal port directly: `HALTIJA_PORT=8710 hj tree`. *(That port was 8701 in 1.4.0–1.12.x; it moved in 1.13.0 because 8701 is the public HTTPS listener — see [#32](https://github.com/tonioloewald/haltija/issues/32).)*
 
 Net code change: ~830 lines removed, ~150 added back for the simpler model. Test count went up (we now have integration coverage for the token stub, named instances, and auto-port fallback that the previous betas lacked).
 

package/apps/desktop/isolation.js

@@ -48,8 +48,14 @@ __export(exports_desktop_isolation, {
   resolveServerUrl: () => resolveServerUrl
 });
 module.exports = __toCommonJS(exports_desktop_isolation);
-var SHARED_PUBLIC_URL = "http://localhost:8700";
-var SHARED_INTERNAL_PORT = 8701;
+
+// src/ports.ts
+var DEFAULT_HTTP_PORT = 8700;
+var DEFAULT_INTERNAL_PORT = 8710;
+
+// src/desktop-isolation.ts
+var SHARED_PUBLIC_URL = `http://localhost:${DEFAULT_HTTP_PORT}`;
+var SHARED_INTERNAL_PORT = DEFAULT_INTERNAL_PORT;
 function resolveInternalPort(env) {
   const raw = env.HALTIJA_INTERNAL_PORT;
   if (raw === undefined || raw === "")

package/apps/desktop/main.js

@@ -25,6 +25,7 @@ const { spawn } = require('child_process')
 const http = require('http')
 const { attachNetwork, detachNetwork, getNetworkLog, getNetworkStats, clearNetwork, isMonitoring } = require('./cdp-network.js')
 const { buildServerEnv } = require('./server-env.js')
+const { DEFAULT_HTTP_PORT, DEFAULT_INTERNAL_PORT, internalPortConflict } = require('./ports.js')
 // The wire protocol, generated from src/machine-channel.ts — NOT re-declared here. main.js used to
 // hand-roll the prefixes, the line split and the parse; that copy is where the __NEED_WINDOW__
 // regression came from, and it had no test while the src/ original did.
@@ -88,15 +89,30 @@ if (IS_PRIVATE) {
 }
 
 // Haltija server config
-let HALTIJA_PORT = IS_PRIVATE ? 0 : parseInt(process.env.HALTIJA_PORT || '8700')
+let HALTIJA_PORT = IS_PRIVATE ? 0 : parseInt(process.env.HALTIJA_PORT || String(DEFAULT_HTTP_PORT))
 let HALTIJA_SERVER = `http://localhost:${HALTIJA_PORT}`
 
 // Internal port for the chrome widget (the haltija UI inspecting itself).
 // Lives on a separate server so it never appears in agent-facing window lists
 // — agents see only content tabs unless they explicitly target this port.
-let HALTIJA_INTERNAL_PORT = IS_PRIVATE ? 0 : parseInt(process.env.HALTIJA_INTERNAL_PORT || '8701')
+//
+// The default comes from src/ports.ts, NOT a literal here. It used to be `8701`, which is also
+// src/server.ts's default for the public HTTPS listener — two independent literals for one number,
+// which cannot both bind (#32a). In 'builtin' mode that made `killZombieServer()` shut down a
+// `haltija --both` server on 8701 and take its HTTP transport down with it.
+let HALTIJA_INTERNAL_PORT = IS_PRIVATE
+  ? 0
+  : parseInt(process.env.HALTIJA_INTERNAL_PORT || String(DEFAULT_INTERNAL_PORT))
 let HALTIJA_INTERNAL_SERVER = `http://localhost:${HALTIJA_INTERNAL_PORT}`
 
+// Someone who pins the old number by hand re-creates the collision, so say what will break rather
+// than letting them discover it as a bind failure in a process they forgot was involved (#32b:
+// a half-open channel and a healthy one must not look alike).
+{
+  const conflict = internalPortConflict(HALTIJA_INTERNAL_PORT)
+  if (conflict) console.error(`[Haltija Desktop] ${conflict}`)
+}
+
 // Unique app instance ID - used to create stable window IDs across navigations
 // Combined with webContents.id to create globally unique tab identifiers
 const APP_INSTANCE_ID = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`
@@ -310,10 +326,12 @@ async function checkAndPromptMcpSetup() {
     try {
       // The require MUST be inside the try. It was outside, so a missing electron-store threw
       // before the catch could run and the fallback below was unreachable — while its comment
-      // claimed otherwise. electron-store is declared in NO manifest (not the root's, not
-      // apps/desktop's), so for anyone installing from npm it is always missing and this path
-      // always threw. Found by a release-doctor check for shipped imports the manifest never
-      // declares. `hasSkippedMcpSetup()` below already had it right; the two disagreed.
+      // claimed otherwise. It was then declared in no manifest, so for anyone installing from npm
+      // it was always missing and this path always threw. It is now an optional peer of the root
+      // package and an optionalDependency here, and npm still does not install it for npm users,
+      // so the fallback below remains the path that normally runs. Found by a release-doctor
+      // check for shipped imports the manifest never declares. `hasSkippedMcpSetup()` below
+      // already had it right; the two disagreed.
       const store = require('electron-store')
       const Store = store.default || store
       const appStore = new Store()
@@ -1548,10 +1566,10 @@ async function startEmbeddedServer() {
       HALTIJA_INTERNAL_SERVER = `http://localhost:${intPort}`
     } else {
       // The internal server never reported. Leaving the port at 0 makes the preload's
-      // `parseInt(...) || 8701` fall back to the SHARED internal port — a private app's chrome
+      // `parseInt(...) || DEFAULT_INTERNAL_PORT` fall back to the SHARED internal port — a private app's chrome
       // widget would attach to another project's server. Better to have no chrome widget than to
       // silently join the channel this mode exists to stay out of.
-      console.error('[Haltija Desktop] Private internal server did not report a port — chrome widget disabled (refusing to fall back to the shared 8701)')
+      console.error('[Haltija Desktop] Private internal server did not report a port — chrome widget disabled (refusing to fall back to the shared internal port)')
       HALTIJA_INTERNAL_PORT = 0
       HALTIJA_INTERNAL_SERVER = ''
     }
@@ -1732,7 +1750,8 @@ async function ensureServer() {
  *
  * The renderer learns them from `process.env` via the preload, but private mode only reassigns the
  * module-level `let`s — which does not touch `process.env`. Without this, a private app's chrome
- * widget attached to the SHARED 8701 and its first tab loaded the shared 8700. Must run on EVERY
+ * widget attached to the SHARED internal server (8701 at the time; 8710 since #32a) and its first
+ * tab loaded the shared 8700. Must run on EVERY
  * path that reaches `createWindow()`, including the startup-failure one, or the leak returns
  * through the error path. 0 / '' mean "no server", and the renderer treats them as such.
  */
@@ -1819,7 +1838,7 @@ if (!gotTheLock) {
     } catch (err) {
       console.error('[Haltija Desktop] Fatal error during startup:', err)
       // Publish here too. This path still creates a window, so without it the preload would see
-      // NEITHER variable and fall back to the shared 8701/8700 — the isolation leak, via the
+      // NEITHER variable and fall back to the shared internal port/8700 — the isolation leak, via the
       // error path. On a failed startup the values are 0/'' , which is the safe state.
       publishResolvedAddresses()
       // Still try to create a window so user sees something

package/apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "haltija-desktop",
-  "version": "1.12.6",
+  "version": "1.13.0-beta.2",
   "private": true,
   "description": "Haltija Desktop - God Mode Browser for AI Agents",
   "homepage": "https://github.com/tonioloewald/haltija",
@@ -112,5 +112,8 @@
     "asarUnpack": [
       "resources/*"
     ]
+  },
+  "optionalDependencies": {
+    "electron-store": "^10.0.0"
   }
 }

package/apps/desktop/ports.js

@@ -0,0 +1,78 @@
+/** ⚠️  AUTO-GENERATED FROM src/ports.ts — DO NOT EDIT. Run: bun run build */
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/ports.ts
+var exports_ports = {};
+__export(exports_ports, {
+  DEFAULT_HTTPS_PORT: () => DEFAULT_HTTPS_PORT,
+  DEFAULT_HTTP_PORT: () => DEFAULT_HTTP_PORT,
+  DEFAULT_INTERNAL_PORT: () => DEFAULT_INTERNAL_PORT,
+  INTERNAL_PORTS: () => INTERNAL_PORTS,
+  LEGACY_INTERNAL_PORT: () => LEGACY_INTERNAL_PORT,
+  PUBLIC_PORTS: () => PUBLIC_PORTS,
+  RESERVED_INTERNAL_HTTPS_PORT: () => RESERVED_INTERNAL_HTTPS_PORT,
+  assertNoPortRoleConflict: () => assertNoPortRoleConflict,
+  internalPortConflict: () => internalPortConflict
+});
+module.exports = __toCommonJS(exports_ports);
+var DEFAULT_HTTP_PORT = 8700;
+var DEFAULT_HTTPS_PORT = 8701;
+var DEFAULT_INTERNAL_PORT = 8710;
+var RESERVED_INTERNAL_HTTPS_PORT = 8711;
+var LEGACY_INTERNAL_PORT = 8701;
+var PUBLIC_PORTS = [DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT];
+var INTERNAL_PORTS = [
+  DEFAULT_INTERNAL_PORT,
+  RESERVED_INTERNAL_HTTPS_PORT
+];
+function internalPortConflict(port) {
+  if (port === DEFAULT_HTTPS_PORT) {
+    return `HALTIJA_INTERNAL_PORT=${port} is the public HTTPS port. The desktop app's internal ` + `chrome-widget server would contend with the channel that serves https:// pages — and in ` + `'builtin' server mode it shuts down whatever it finds there, taking a --both server's HTTP ` + `listener with it. Default is ${DEFAULT_INTERNAL_PORT}. See ` + `https://github.com/tonioloewald/haltija/issues/32`;
+  }
+  if (port === DEFAULT_HTTP_PORT) {
+    return `HALTIJA_INTERNAL_PORT=${port} is the public HTTP port — the internal server would contend ` + `with the channel agents drive. Default is ${DEFAULT_INTERNAL_PORT}.`;
+  }
+  return null;
+}
+function assertNoPortRoleConflict() {
+  const overlap = INTERNAL_PORTS.filter((p) => PUBLIC_PORTS.includes(p));
+  if (overlap.length > 0) {
+    throw new Error(`Port role conflict: ${overlap.join(", ")} assigned to both the public channel and the ` + `desktop app's internals. That is issue #32a — one number, two defaults, neither aware of ` + `the other. Pick a free number in the internal block rather than reusing a public one.`);
+  }
+}

package/apps/desktop/preload.js

@@ -17,7 +17,7 @@ contextBridge.exposeInMainWorld('haltija', {
   webviewPreloadPath: webviewPreloadPath,
   // Internal-server port (chrome widget connects here, hidden from public agent traffic).
   // Set by main AFTER port resolution, so a --private instance reports its EPHEMERAL port rather
-  // than the shared 8701. 0 means "none" and must stay 0. See src/desktop-isolation.ts.
+  // than the shared internal port. 0 means "none" and must stay 0. See src/desktop-isolation.ts.
   internalPort: resolveInternalPort(process.env),
   // This instance's public server, or NULL if main didn't set one. Not a default: `|| 8700` here
   // made state.js's "did main tell me?" check always true, so it overwrote the user's saved

package/apps/desktop/renderer/isolation.js

@@ -1,7 +1,11 @@
 /** ⚠️  AUTO-GENERATED FROM src/desktop-isolation.ts — DO NOT EDIT. Run: bun run build */
+// src/ports.ts
+var DEFAULT_HTTP_PORT = 8700;
+var DEFAULT_INTERNAL_PORT = 8710;
+
 // src/desktop-isolation.ts
-var SHARED_PUBLIC_URL = "http://localhost:8700";
-var SHARED_INTERNAL_PORT = 8701;
+var SHARED_PUBLIC_URL = `http://localhost:${DEFAULT_HTTP_PORT}`;
+var SHARED_INTERNAL_PORT = DEFAULT_INTERNAL_PORT;
 function resolveInternalPort(env) {
   const raw = env.HALTIJA_INTERNAL_PORT;
   if (raw === undefined || raw === "")

package/apps/desktop/renderer/tabs.js

@@ -403,7 +403,10 @@ export function navigate(url, tabId = activeTabId) {
   let addedHttps = false
 
   if (url && !url.match(/^(https?|blob|data|file|about|javascript):\/?\/?/i)) {
-    if (url.includes('.') || url === 'localhost' || url.startsWith('localhost:')) {
+    // A host, not a search: dotted names, localhost with a port or path, and any `name:port`. The
+    // widget hands bare hosts over raw so this fallback to http applies; `localhost/docs` and
+    // `devbox:3000` used to become a web search (#54 review).
+    if (url.includes('.') || /^localhost([:/]|$)/i.test(url) || /^[a-z][\w-]*:\d+([/?#]|$)/i.test(url)) {
       addedHttps = true
       url = 'https://' + url
     } else {

package/apps/desktop/renderer.js

@@ -38,17 +38,17 @@ createTab()
 setInterval(checkHaltija, 5000)
 
 // Inject outer widget (headless) into the renderer for persistence + self-inspection.
-// Connects to the *internal* server (default port 8701) so it doesn't appear in
-// agent-facing window lists on the public server. To inspect the outer Haltija
-// UI from `hj`, target the internal port: HALTIJA_PORT=8701 hj tree
+// Connects to the *internal* server (default port 8710 — see src/ports.ts) so it
+// doesn't appear in agent-facing window lists on the public server. To inspect the
+// outer Haltija UI from `hj`, target the internal port: HALTIJA_PORT=8710 hj tree
 ;(async function injectOuterWidget() {
   // 0 / NaN means "this instance has NO internal server" — main.js sets it that way on purpose for
-  // a private run whose internal server never reported. `|| 8701` undid that one layer above the
+  // a private run whose internal server never reported. `|| <shared internal port>` undid that one layer above the
   // guard and attached the chrome widget to ANOTHER project's shared internal server, with the same
   // windowId ('hj-chrome'), so the two collided on that channel. Third instance of this leak.
   const internalPort = Number(window.haltija?.internalPort)
   if (!Number.isFinite(internalPort) || internalPort <= 0) {
-    console.warn('[Haltija Desktop] No internal server for this instance — chrome widget disabled (refusing to attach to the shared 8701)')
+    console.warn('[Haltija Desktop] No internal server for this instance — chrome widget disabled (refusing to attach to the shared internal port)')
     return
   }
   const internalUrl = getServerUrl().replace(/:\d+/, `:${internalPort}`)