infinicode 2.7.0 → 2.8.0

package/dist/cli.js

@@ -311,10 +311,7 @@ program
     .option('--lan-port <port>', 'UDP discovery port for --lan (default 47915)')
     .option('--tag <tag>', 'only discover peers carrying this tag (Tailscale ACL tag or LAN beacon tag)')
     .option('--console', 'interactive slash-command console on the node (/nodes, /build, /activity …); on by default in a TTY')
-    .option('--dashboard', 'serve the RoboPark control web UI at http://<host>:<port>/ (fleet map, live activity, actions)')
-    .option('--scheduler-url <url>', 'link a RoboPark scheduler so the dashboard shows sessions + telemetry (e.g. http://localhost:8080)')
-    .option('--scheduler-token <token>', 'bearer token to present to the scheduler on proxied requests')
-    .option('--tls-cert <path>', 'PEM cert file — serve the dashboard/mesh over HTTPS')
+    .option('--tls-cert <path>', 'PEM cert file — serve the mesh over HTTPS')
     .option('--tls-key <path>', 'PEM private key file for --tls-cert')
     .option('--gateway <url>', 'link to an InfiniBot gateway (ws://host:18789) — appear on its neural-mesh map')
     .option('--gateway-token <token>', 'auth token for the InfiniBot gateway')

package/dist/commands/robopark.d.ts

@@ -3,4 +3,6 @@ import type Conf from 'conf';
 import type { InfinicodeConfig } from '../kernel/config-schema.js';
 /** Attach the robopark verbs to a Commander command (the `robopark` program in
  *  the standalone bin, or the `infinicode robopark` group). */
-export declare function attachRoboparkSubcommands(cmd: Command, config: Conf<InfinicodeConfig>): void;
+export declare function attachRoboparkSubcommands(cmd: Command, config: Conf<InfinicodeConfig>, opts?: {
+    skipSetup?: boolean;
+}): void;

package/dist/commands/robopark.js

@@ -111,10 +111,10 @@ function renderFleet(snap) {
     return lines.join('\n');
 }
 const ROLE_PRESETS = {
-    scheduler: { mesh: 'hub', blurb: 'on-site hub (LiveKit Server 1) — bridges tailnet ↔ LAN, serves the dashboard', dashboard: true, lan: true, tailscale: true },
-    robot: { mesh: 'satellite', blurb: 'a robot Pi — accept-only, LAN-discovered, never dials out', dashboard: false, lan: true, tailscale: false },
-    laptop: { mesh: 'peer', blurb: 'your control station — drives the fleet over the mesh', dashboard: false, lan: false, tailscale: true },
-    relay: { mesh: 'relay', blurb: 'a relay hop between two networks', dashboard: false, lan: true, tailscale: true },
+    scheduler: { mesh: 'hub', blurb: 'on-site hub (LiveKit Server 1) — bridges tailnet ↔ LAN, runs robopark serve', lan: true, tailscale: true },
+    robot: { mesh: 'satellite', blurb: 'a robot Pi — accept-only, LAN-discovered, never dials out', lan: true, tailscale: false },
+    laptop: { mesh: 'peer', blurb: 'your control station — drives the fleet over the mesh', lan: false, tailscale: true },
+    relay: { mesh: 'relay', blurb: 'a relay hop between two networks', lan: true, tailscale: true },
 };
 // Power users can pass raw mesh roles too; fold them onto the matching preset.
 const MESH_ALIASES = { hub: 'scheduler', satellite: 'robot', peer: 'laptop' };
@@ -192,11 +192,6 @@ async function roboparkSetup(config, opts) {
     const { label, preset } = resolved;
     const meshRole = preset.mesh;
     // Preset defaults, overridable by explicit flags.
-    const dashboard = opts.dashboard ?? preset.dashboard;
-    // The RoboPark scheduler API runs on the same box as the on-site hub, so the
-    // scheduler role links it by default → the dashboard's Sessions & Telemetry
-    // tab is live out of the box. Other roles don't proxy a scheduler.
-    const schedulerUrl = opts.schedulerUrl ?? (label === 'scheduler' ? 'http://127.0.0.1:8080' : undefined);
     const lan = opts.lan ?? preset.lan;
     const tailscale = opts.tailscale ?? (preset.tailscale && !opts.hub); // seed URL replaces discovery
     const port = opts.port ? parseInt(opts.port, 10) : DEFAULT_PORT;
@@ -232,8 +227,6 @@ async function roboparkSetup(config, opts) {
         console.log(`  lan:    ${chalk.green('auto-discovery on')}`);
     if (tailscale)
         console.log(`  tailnet:${chalk.green(' discovery on')}${opts.tag ? chalk.dim(' · tag ' + opts.tag) : ''}`);
-    if (dashboard)
-        console.log(`  ui:     ${chalk.green('dashboard on')}`);
     console.log();
     const serveOpts = {
         role: meshRole,
@@ -244,33 +237,29 @@ async function roboparkSetup(config, opts) {
         tailscale,
         lan,
         tag: opts.tag,
-        dashboard,
-        schedulerUrl,
-        schedulerToken: opts.schedulerToken,
         gateway: opts.gateway,
         gatewayToken: opts.gatewayToken,
     };
-    if (opts.start) {
-        console.log(chalk.dim('  starting node…\n'));
-        await serve(config, serveOpts);
-        return;
-    }
-    const startCmd = [
+    const infinicodeCmd = [
         'infinicode serve',
         `--role ${meshRole}`,
-        dashboard ? '--dashboard' : '',
-        schedulerUrl ? `--scheduler-url ${schedulerUrl}` : '',
         lan ? '--lan' : '',
         tailscale ? '--tailscale' : '',
         opts.tag ? `--tag ${opts.tag}` : '',
         opts.hub ? `--seed ${opts.hub}` : '',
         fed.token ? `--token ${fed.token}` : '',
         opts.gateway ? `--gateway ${opts.gateway}` : '',
-    ]
-        .filter(Boolean)
-        .join(' ');
+    ].filter(Boolean).join(' ');
+    if (opts.start) {
+        console.log(chalk.dim('  starting node…\n'));
+        await serve(config, serveOpts);
+        return;
+    }
     console.log(chalk.dim('  saved. start it now with:  ') + chalk.cyan('robopark setup --' + label + ' --start'));
-    console.log(chalk.dim('  or run the node directly:   ') + chalk.cyan(startCmd));
+    console.log(chalk.dim('  or run the node directly:   ') + chalk.cyan(infinicodeCmd));
+    if (label === 'scheduler') {
+        console.log(chalk.dim('  and for the RoboPark UI:    ') + chalk.cyan('robopark serve --port 8080'));
+    }
     console.log();
 }
 async function roboparkFleet(config, opts) {
@@ -367,17 +356,13 @@ function openBrowser(url) {
     }
 }
 async function roboparkDashboard(config, opts) {
-    const base = nodeUrl(config, opts.url);
+    // The RoboPark dashboard is now served by `robopark serve`, not the mesh node.
+    // Default to the scheduler URL if none is given, falling back to the local node.
+    const base = (opts.url ?? 'http://127.0.0.1:8080').replace(/\/+$/, '');
     const token = authToken(config, opts.token);
     const link = `${base}/${token ? `?token=${encodeURIComponent(token)}` : ''}`;
-    // Confirm the node is actually serving the dashboard before pointing there.
     try {
-        const res = await fetch(link, { headers: headers(token), signal: AbortSignal.timeout(5000) });
-        if (res.status === 404) {
-            console.log(chalk.yellow(`  ⚠ node at ${base} is up but the dashboard is off.`));
-            console.log(chalk.dim('    restart it with  infinicode serve --dashboard'));
-            return;
-        }
+        const res = await fetch(`${base}/api/settings`, { headers: headers(token), signal: AbortSignal.timeout(5000) });
         if (!res.ok)
             throw new Error(`HTTP ${res.status}`);
     }
@@ -393,33 +378,32 @@ async function roboparkDashboard(config, opts) {
 // ── wiring ─────────────────────────────────────────────────────────────────────
 /** Attach the robopark verbs to a Commander command (the `robopark` program in
  *  the standalone bin, or the `infinicode robopark` group). */
-export function attachRoboparkSubcommands(cmd, config) {
-    cmd
-        .command('setup')
-        .description('Set up this device in one pass. Run bare for a guided wizard, or pass a role to skip it.')
-        .option('--scheduler', 'this device is the on-site hub (LiveKit Server 1)')
-        .option('--robot', 'this device is a talking-robot Raspberry Pi')
-        .option('--laptop', 'this device is your control station')
-        .option('--role <role>', 'explicit role: scheduler | robot | laptop | relay (or raw mesh role hub/peer/satellite)')
-        .option('--site <site>', 'physical location for fleet grouping, e.g. "Tel Aviv"')
-        .option('--name <name>', 'friendly device name (defaults to hostname)')
-        .option('--hub <url>', 'hub base URL to join, e.g. http://100.x.y.z:47913 (robots/laptops)')
-        .option('--gateway <url>', 'InfiniBot gateway ws:// URL to surface the fleet in InfiniBot (scheduler)')
-        .option('--gateway-token <token>', 'auth token for the InfiniBot gateway')
-        .option('--token <token>', 'shared bearer token every device must present')
-        .option('--port <port>', 'mesh listen port (default 47913)')
-        .option('--tag <tag>', 'only discover peers carrying this tag (e.g. tag:robopark)')
-        .option('--architecture <text>', "one-line brief of this device's job in the wider system")
-        .option('--lan', 'force zero-config LAN auto-discovery (on by default for scheduler/robot)')
-        .option('--tailscale', 'force Tailscale peer discovery (on by default for scheduler/laptop)')
-        .option('--dashboard', 'force the web control UI (on by default for scheduler)')
-        .option('--scheduler-url <url>', 'RoboPark scheduler API to link for the dashboard Sessions tab (default http://127.0.0.1:8080 for the scheduler role)')
-        .option('--scheduler-token <token>', 'bearer token presented to the scheduler on proxied requests')
-        .option('--start', 'launch the node now instead of just writing config')
-        .option('--yes', 'skip the guided wizard even with no role (non-interactive)')
-        .action(async (opts) => {
-        await roboparkSetup(config, opts);
-    });
+export function attachRoboparkSubcommands(cmd, config, opts) {
+    if (!opts?.skipSetup) {
+        cmd
+            .command('setup')
+            .description('Set up this device in one pass. Run bare for a guided wizard, or pass a role to skip it.')
+            .option('--scheduler', 'this device is the on-site hub (LiveKit Server 1)')
+            .option('--robot', 'this device is a talking-robot Raspberry Pi')
+            .option('--laptop', 'this device is your control station')
+            .option('--role <role>', 'explicit role: scheduler | robot | laptop | relay (or raw mesh role hub/peer/satellite)')
+            .option('--site <site>', 'physical location for fleet grouping, e.g. "Tel Aviv"')
+            .option('--name <name>', 'friendly device name (defaults to hostname)')
+            .option('--hub <url>', 'hub base URL to join, e.g. http://100.x.y.z:47913 (robots/laptops)')
+            .option('--gateway <url>', 'InfiniBot gateway ws:// URL to surface the fleet in InfiniBot (scheduler)')
+            .option('--gateway-token <token>', 'auth token for the InfiniBot gateway')
+            .option('--token <token>', 'shared bearer token every device must present')
+            .option('--port <port>', 'mesh listen port (default 47913)')
+            .option('--tag <tag>', 'only discover peers carrying this tag (e.g. tag:robopark)')
+            .option('--architecture <text>', "one-line brief of this device's job in the wider system")
+            .option('--lan', 'force zero-config LAN auto-discovery (on by default for scheduler/robot)')
+            .option('--tailscale', 'force Tailscale peer discovery (on by default for scheduler/laptop)')
+            .option('--start', 'launch the node now instead of just writing config')
+            .option('--yes', 'skip the guided wizard even with no role (non-interactive)')
+            .action(async (opts) => {
+            await roboparkSetup(config, opts);
+        });
+    }
     cmd
         .command('fleet')
         .alias('status')

package/dist/commands/serve.d.ts

@@ -17,9 +17,6 @@ export interface ServeOptions {
     gateway?: string;
     gatewayToken?: string;
     gatewayPassword?: string;
-    dashboard?: boolean;
-    schedulerUrl?: string;
-    schedulerToken?: string;
     tlsCert?: string;
     tlsKey?: string;
     supervised?: boolean;

package/dist/commands/serve.js

@@ -11,7 +11,7 @@
  */
 import chalk from 'chalk';
 import { readFileSync } from 'node:fs';
-import { randomBytes } from 'node:crypto';
+import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { buildKernelFromConfig, registerCloudProviders } from '../kernel/setup.js';
@@ -60,18 +60,20 @@ export async function serve(config, opts) {
     // performSelfUpdate via the environment.
     if (opts.supervised ?? fed.supervised)
         process.env.INFINICODE_SUPERVISED = '1';
-    // Secure-by-default: a control dashboard exposed on a routable interface with
-    // no token is a wide-open remote. If the operator asked for the dashboard but
-    // set no token, mint a session token so the surface isn't unauthenticated.
-    if (opts.dashboard && !token && !isLoopback(bindHost)) {
-        token = randomBytes(9).toString('base64url');
-        console.log(chalk.yellow(`  ⚠ dashboard exposed on ${bindHost} without --token — generated a session token.`));
+    // Mesh nodes should always present a token on a routable interface. If none
+    // is provided, generate one so remote peers can authenticate.
+    if (!token && !isLoopback(bindHost)) {
+        token = crypto.randomBytes(9).toString('base64url');
+        console.log(chalk.yellow(`  ⚠ mesh exposed on ${bindHost} without --token — generated a session token.`));
         console.log(chalk.yellow(`    peers must now connect with  --token ${token}`));
     }
     // Keep a network-exposed, tokenless node read-only: it will answer status/map
     // queries but refuse control commands until a token is set. Loopback-only or
     // token-protected nodes are trusted and run everything.
     const trusted = Boolean(token) || isLoopback(bindHost);
+    // commandGate is the mesh-side gate only. The RoboPark product UI is now
+    // served exclusively by `robopark serve`, so control writes there are no
+    // longer in scope for `infinicode serve`.
     const commandGate = (input) => {
         if (trusted)
             return { ok: true };
@@ -158,13 +160,9 @@ export async function serve(config, opts) {
             autoUpdate: opts.autoUpdate ?? fed.autoUpdate,
             applyConfig,
             autoPullConfig: role === 'satellite',
-            dashboard: opts.dashboard,
             onApply,
             commandGate,
             tls,
-            schedulerUrl: opts.schedulerUrl ?? fed.schedulerUrl,
-            schedulerToken: opts.schedulerToken,
-            schedulerReadOnly: !trusted,
         },
     });
     // Let the kernel's slash-command surface reach the mesh (/nodes, /node, …).
@@ -184,18 +182,10 @@ export async function serve(config, opts) {
         console.log(`  auth:   ${chalk.green('token required')}`);
     console.log();
     await federation.start();
-    // Control dashboard link — prefer a reachable host over the 0.0.0.0 wildcard.
-    if (opts.dashboard) {
-        const uiHost = isLoopback(bindHost) || bindHost === '0.0.0.0' ? 'localhost' : bindHost;
-        const scheme = tls ? 'https' : 'http';
-        const url = `${scheme}://${uiHost}:${port}/${token ? `?token=${token}` : ''}`;
-        console.log(chalk.bold(`  dashboard: ${chalk.cyan(url)}`));
-        if (opts.schedulerUrl)
-            console.log(chalk.dim(`    scheduler linked: ${opts.schedulerUrl} (sessions + telemetry tabs live)`));
-        if (!token)
-            console.log(chalk.dim('    (no token — anyone who can reach this port can control the fleet; add --token to lock it)'));
-        console.log();
-    }
+    // Mesh-only node. The RoboPark dashboard + scheduler UI are served by
+    // `robopark serve` on the hub box, not by `infinicode serve`.
+    console.log(chalk.dim('  (use `robopark serve` on the hub for the fleet dashboard + scheduler UI)'));
+    console.log();
     // Connect to seeds. Satellites auto-source shared config from any hub/relay
     // they connect to (handled inside federation.connect()).
     for (const url of seeds) {