infinicode 2.8.37 → 2.8.39

package/dist/kernel/federation/transport-http.d.ts

@@ -53,6 +53,8 @@ export declare class MeshServer {
     start(): Promise<void>;
     /** Proxy a dashboard request to the RoboPark scheduler (product data). */
     private proxyToScheduler;
+    /** Proxy the scheduler's full Control Center and its same-origin assets. */
+    private proxySchedulerPath;
     /** Protected local runtime controls for the RoboPark operator dashboard. */
     private runtimeDocker;
     /** Push a frame to every connected stream subscriber. */

package/dist/kernel/federation/transport-http.js

@@ -123,6 +123,39 @@ export class MeshServer {
             res.end(JSON.stringify({ ok: false, error: `scheduler unreachable: ${err instanceof Error ? err.message : String(err)}` }));
         });
     }
+    /** Proxy the scheduler's full Control Center and its same-origin assets. */
+    proxySchedulerPath(req, res, path) {
+        const base = this.opts.schedulerUrl.replace(/\/+$/, '');
+        const target = `${base}${path}${req.url?.includes('?') ? req.url.slice(req.url.indexOf('?')) : ''}`;
+        this.readBody(req)
+            .then(async (body) => {
+            const headers = {};
+            if (req.headers['content-type'])
+                headers['content-type'] = req.headers['content-type'];
+            if (this.opts.schedulerToken)
+                headers.authorization = `Bearer ${this.opts.schedulerToken}`;
+            const upstream = await fetch(target, {
+                method: req.method,
+                headers,
+                body: req.method === 'GET' || req.method === 'HEAD' ? undefined : body,
+                signal: AbortSignal.timeout(15_000),
+            });
+            const responseHeaders = {
+                'content-type': upstream.headers.get('content-type') ?? 'application/octet-stream',
+                'cache-control': upstream.headers.get('cache-control') ?? 'no-store',
+            };
+            const presented = this.presentedToken(req);
+            if (this.opts.token && presented) {
+                responseHeaders['set-cookie'] = `robopark_auth=${encodeURIComponent(presented)}; Path=/; SameSite=Lax`;
+            }
+            res.writeHead(upstream.status, responseHeaders);
+            res.end(await upstream.arrayBuffer());
+        })
+            .catch(err => {
+            res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end(`scheduler unreachable: ${err instanceof Error ? err.message : String(err)}`);
+        });
+    }
     /** Protected local runtime controls for the RoboPark operator dashboard. */
     async runtimeDocker(req, res, path) {
         const send = (status, body) => {
@@ -195,6 +228,10 @@ export class MeshServer {
             if (t)
                 return t;
         }
+        const cookie = req.headers.cookie ?? '';
+        const match = cookie.match(/(?:^|;\s*)robopark_auth=([^;]+)/);
+        if (match)
+            return decodeURIComponent(match[1]);
         return undefined;
     }
     authOk(req) {
@@ -215,17 +252,41 @@ export class MeshServer {
             return;
         }
         const remote = req.socket.remoteAddress ?? 'unknown';
-        // Control dashboard (single self-contained page). Same-origin fetches carry
-        // the ?token= through, so no CORS is opened.
+        // The scheduler owns the complete RoboPark Control Center. The mesh page is
+        // retained at /mesh as a diagnostics view, not as the primary operator UI.
         if (req.method === 'GET' && (path === '/' || path === '/ui' || path === '/dashboard')) {
+            if (this.opts.schedulerUrl) {
+                this.proxySchedulerPath(req, res, '/');
+                return;
+            }
             if (!this.opts.dashboardHtml) {
                 res.writeHead(404).end('dashboard not enabled (start with --dashboard)');
                 return;
             }
+            res.writeHead(200, {
+                'content-type': 'text/html; charset=utf-8',
+                'cache-control': 'no-store',
+                ...(this.opts.token && this.presentedToken(req)
+                    ? { 'set-cookie': `robopark_auth=${encodeURIComponent(this.presentedToken(req))}; Path=/; SameSite=Lax` }
+                    : {}),
+            });
+            res.end(this.opts.dashboardHtml);
+            return;
+        }
+        if (req.method === 'GET' && path === '/mesh') {
+            if (!this.opts.dashboardHtml) {
+                res.writeHead(404).end('mesh dashboard not enabled (start with --dashboard)');
+                return;
+            }
             res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
             res.end(this.opts.dashboardHtml);
             return;
         }
+        // Full scheduler dashboard requests are same-origin after the root proxy.
+        if (this.opts.schedulerUrl && (path.startsWith('/api/') || path.startsWith('/static/') || path.startsWith('/vendor/'))) {
+            this.proxySchedulerPath(req, res, path);
+            return;
+        }
         // Static assets bundled with the dashboard (robot concept avatars, etc.).
         if (req.method === 'GET' && path.startsWith('/static/')) {
             const asset = loadStaticAsset(path.slice(8));

package/dist/robopark/add-robot.d.ts

@@ -7,5 +7,7 @@ export interface AddRobotOptions extends ExplicitContextOpts {
     /** Force a specific park-map pad/character preset id instead of the
      * fuzzy name-based match below — e.g. `--character jaguar`. */
     character?: string;
+    lan?: boolean;
+    tailscale?: boolean;
 }
 export declare function roboparkAddRobot(config: Conf<InfinicodeConfig>, opts: AddRobotOptions): Promise<void>;

package/dist/robopark/add-robot.js

@@ -73,6 +73,11 @@ export async function roboparkAddRobot(config, opts) {
         console.log(chalk.red('  ✗ --name is required, e.g. --name robobmw'));
         process.exit(1);
     }
+    if (opts.lan && opts.tailscale) {
+        console.log(chalk.red('  ✗ choose exactly one network mode: --lan or --tailscale'));
+        process.exit(1);
+    }
+    const network = opts.tailscale ? 'tailscale' : 'lan';
     const ctx = await resolveContext(opts);
     if (!ctx.schedulerUrl) {
         console.log(chalk.red('  ✗ no scheduler URL resolved. Pass --scheduler-url/--hub-url, run `robopark hub-use` first, or run this on/near the hub.'));
@@ -80,6 +85,7 @@ export async function roboparkAddRobot(config, opts) {
     }
     console.log(`  scheduler: ${chalk.cyan(ctx.schedulerUrl)}`);
     console.log(`  name:      ${chalk.cyan(opts.name)}${ctx.site ? chalk.dim('  @ ' + ctx.site) : ''}`);
+    console.log(`  network:   ${chalk.cyan(network)}`);
     console.log();
     const characterId = opts.character?.trim() || await pickCharacterPreset(ctx.schedulerUrl, opts.name);
     if (characterId) {
@@ -114,6 +120,8 @@ export async function roboparkAddRobot(config, opts) {
             schedulerPort: ctx.schedulerUrl ? String(new URL(ctx.schedulerUrl).port || '8080') : undefined,
             enrollmentToken: minted.enrollment_token,
             start: true,
+            lan: opts.lan,
+            tailscale: opts.tailscale,
         });
         return;
     }
@@ -131,6 +139,7 @@ export async function roboparkAddRobot(config, opts) {
         const schedulerPort = new URL(ctx.schedulerUrl).port || '8080';
         argv.push('--scheduler-port', schedulerPort);
     }
+    argv.push(network === 'tailscale' ? '--tailscale' : '--lan');
     argv.push('--enrollment-token', minted.enrollment_token, '--start', '--auto-start');
     console.log(chalk.dim(`  run this ON THE ROBOT${characterId ? ` (binds to pad: ${characterId})` : ''}:`));
     console.log('  ' + chalk.cyan(commandString(argv)));

package/dist/robopark/secrets.d.ts

@@ -0,0 +1,8 @@
+type Options = {
+    schedulerUrl: string;
+    workerEnv: string;
+    rotate?: boolean;
+};
+/** Provision the scheduler's shared worker secret into a ROBOVOICE .env file. */
+export declare function roboparkSecrets(opts: Options): Promise<void>;
+export {};

package/dist/robopark/secrets.js

@@ -0,0 +1,41 @@
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import chalk from 'chalk';
+function updateEnv(contents, token) {
+    const line = `ROBOPARK_AGENT_TOKEN=${token}`;
+    const re = /^ROBOPARK_AGENT_TOKEN=.*$/m;
+    return re.test(contents)
+        ? contents.replace(re, line)
+        : `${contents.trimEnd()}\n${line}\n`;
+}
+/** Provision the scheduler's shared worker secret into a ROBOVOICE .env file. */
+export async function roboparkSecrets(opts) {
+    const base = opts.schedulerUrl.replace(/\/$/, '');
+    const response = await fetch(`${base}/api/settings/agent-token/provision`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ rotate: Boolean(opts.rotate) }),
+    });
+    if (!response.ok) {
+        throw new Error(`scheduler rejected secret provisioning (${response.status})`);
+    }
+    const body = await response.json();
+    if (!body.agent_token)
+        throw new Error('scheduler returned no agent token');
+    let current = '';
+    try {
+        current = await readFile(opts.workerEnv, 'utf8');
+    }
+    catch (err) {
+        if (err?.code !== 'ENOENT')
+            throw err;
+    }
+    const next = updateEnv(current, body.agent_token);
+    await mkdir(dirname(opts.workerEnv), { recursive: true });
+    const temp = `${opts.workerEnv}.tmp-${process.pid}`;
+    await writeFile(temp, next, { encoding: 'utf8', mode: 0o600 });
+    await rename(temp, opts.workerEnv);
+    console.log(chalk.green(`  ✓ ROBOVOICE secret synchronized to ${opts.workerEnv}`));
+    if (opts.rotate)
+        console.log(chalk.yellow('  Restart the ROBOVOICE worker to use the rotated secret.'));
+}

package/dist/robopark/serve.d.ts

@@ -5,6 +5,7 @@ export interface ServeOptions {
     gateway?: string;
     gatewayToken?: string;
     gatewayPassword?: string;
+    /** Open the Control Center after the scheduler is reachable. */
     open?: boolean;
     foreground?: boolean;
 }

package/dist/robopark/serve.js

@@ -181,14 +181,19 @@ export async function roboparkServe(opts) {
             catch { /* ignore */ }
         });
         proc.on('exit', () => process.exit(0));
+        if (opts.open !== false) {
+            await openDashboard(host, port);
+        }
     }
     else {
         // Detached mode: let the user walk away. The process keeps running.
         proc.unref();
+        if (opts.open !== false) {
+            await openDashboard(host, port);
+        }
         printUrl(port);
         console.log(chalk.dim('  running in background. Use Task Manager / systemctl / launchctl to stop.'));
-        // give the scheduler a moment to bind before printing URL
-        setTimeout(() => process.exit(0), 1200);
+        setTimeout(() => process.exit(0), 100);
     }
 }
 function printUrl(port) {
@@ -205,3 +210,43 @@ export async function schedulerHealthy(url, timeoutMs = 3000) {
         return false;
     }
 }
+function dashboardUrl(host, port) {
+    // 0.0.0.0/:: are bind addresses, not useful browser destinations.
+    const browserHost = host === '0.0.0.0' || host === '::' ? 'localhost' : host;
+    const formattedHost = browserHost.includes(':') && !browserHost.startsWith('[')
+        ? `[${browserHost}]`
+        : browserHost;
+    return `http://${formattedHost}:${port}/`;
+}
+function openBrowser(url) {
+    // Use detached platform-native launchers so robopark serve remains usable
+    // from terminals and does not inherit browser stdio or lifecycle.
+    const command = process.platform === 'win32'
+        ? 'cmd.exe'
+        : process.platform === 'darwin'
+            ? 'open'
+            : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(command, args, { detached: true, stdio: 'ignore', windowsHide: true }).unref();
+    }
+    catch (err) {
+        console.log(chalk.yellow(`  ⚠ could not open browser: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+async function openDashboard(host, port) {
+    const url = dashboardUrl(host, port);
+    const deadline = Date.now() + 10_000;
+    let healthy = false;
+    while (Date.now() < deadline) {
+        if (await schedulerHealthy(url, 500)) {
+            healthy = true;
+            break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 250));
+    }
+    if (!healthy) {
+        console.log(chalk.yellow('  ⚠ scheduler did not answer within 10s; opening the dashboard anyway.'));
+    }
+    openBrowser(url);
+}

package/dist/robopark/setup.d.ts

@@ -21,5 +21,8 @@ export interface SetupOptions {
     autoStart?: boolean;
     yes?: boolean;
     foreground?: boolean;
+    /** Robot transport. Defaults to LAN for backwards compatibility. */
+    lan?: boolean;
+    tailscale?: boolean;
 }
 export declare function roboparkSetup(config: Conf<InfinicodeConfig>, opts: SetupOptions): Promise<void>;

package/dist/robopark/setup.js

@@ -171,6 +171,12 @@ async function setupHub(config, opts, internal) {
     }
 }
 async function setupRobot(config, opts, ctx, internal) {
+    if (opts.lan && opts.tailscale) {
+        console.log(chalk.red('  ✗ choose exactly one robot network: --lan or --tailscale'));
+        return;
+    }
+    const network = opts.tailscale ? 'tailscale' : 'lan';
+    const networkFlag = network === 'tailscale' ? '--tailscale' : '--lan';
     const hubUrl = opts.hub ?? (ctx.hub ? `http://${ctx.hub.ip}:${internal.port}` : undefined);
     if (!hubUrl) {
         console.log(chalk.red('  ✗ no hub discovered. Pass --hub http://HUB_IP:47913'));
@@ -184,7 +190,7 @@ async function setupRobot(config, opts, ctx, internal) {
         displayName: internal.name,
         token: internal.token,
         seeds: [hubUrl],
-        lan: true,
+        lan: network === 'lan',
     };
     config.set('federation', fed);
     const args = [
@@ -193,7 +199,7 @@ async function setupRobot(config, opts, ctx, internal) {
         '--port', String(internal.port),
         '--token', internal.token,
         '--seed', hubUrl,
-        '--lan',
+        networkFlag,
         '--auto-update',
         '--supervised',
     ];
@@ -225,6 +231,7 @@ async function setupRobot(config, opts, ctx, internal) {
     console.log('  ' + chalk.cyan(`robopark ${previewAgentArgs.join(' ')}`));
     if (visionEnabled)
         console.log('  ' + chalk.cyan(`robopark ${visionAgentArgs.join(' ')}`));
+    console.log(chalk.dim(`  network: ${network} (scheduler: ${schedulerUrl})`));
     console.log();
     if (opts.start) {
         const robotArgv = await infinicodeArgv(args);

package/dist/robopark-cli.js

@@ -20,6 +20,7 @@ import { roboparkDoctor } from './robopark/doctor.js';
 import { roboparkAddRobot } from './robopark/add-robot.js';
 import { saveHubProfile, clearHubProfile } from './robopark/profile.js';
 import { roboparkAgentUp, roboparkAgentDown, roboparkAgentLogs } from './robopark/agent-ctl.js';
+import { roboparkSecrets } from './robopark/secrets.js';
 // Read the real version from package.json so `--version` never drifts from
 // what is actually installed (this was a hardcoded constant that went stale
 // across several releases — see the identical fix + comment in cli.ts).
@@ -93,10 +94,26 @@ program
     .option('--gateway <url>', 'InfiniBot gateway ws:// URL')
     .option('--gateway-token <token>', 'InfiniBot gateway token')
     .option('--gateway-password <pw>', 'InfiniBot gateway password')
+    .option('--no-open', 'do not open the RoboPark Control Center in a browser')
     .option('--foreground', 'stay in foreground; do not detach')
     .action(async (opts) => {
     await roboparkServe(opts);
 });
+program
+    .command('secrets')
+    .description('Provision the scheduler-managed ROBOVOICE authentication secret')
+    .option('--scheduler-url <url>', 'scheduler base URL', 'http://localhost:8080')
+    .option('--worker-env <path>', 'ROBOVOICE worker .env file', '.env')
+    .option('--rotate', 'rotate the shared secret before synchronizing it')
+    .action(async (opts) => {
+    try {
+        await roboparkSecrets(opts);
+    }
+    catch (err) {
+        console.error(chalk.red(`  ✗ secret provisioning failed: ${err?.message ?? err}`));
+        process.exitCode = 1;
+    }
+});
 program
     .command('enroll')
     .description('Enroll this robot/satellite with the RoboPark scheduler')
@@ -227,6 +244,8 @@ program
     .option('--token <token>', 'shared mesh token (defaults to saved hub profile / auto-discovery)')
     .option('--scheduler-url <url>', 'scheduler base URL (defaults to saved hub profile / auto-discovery)')
     .option('--character <id>', 'force a specific park-map pad/character preset id (default: fuzzy-matched from the robot name)')
+    .option('--lan', 'generate a robot command for the same local network (default)')
+    .option('--tailscale', 'generate a robot command for a Tailscale-reachable hub')
     .option('--start', 'start the robot node on this machine now, instead of printing the one-liner')
     .action(async (name, opts) => {
     await roboparkAddRobot(config, { name, ...opts });
@@ -272,6 +291,8 @@ program
     .option('--tailscale-auth <token>', 'Tailscale auth key for the hub')
     .option('--tag <tag>', 'Tailscale tag filter')
     .option('--enrollment-token <token>', 'one-time scheduler enrollment token for robots')
+    .option('--lan', 'use LAN discovery and LAN hub/scheduler addresses (default for robots)')
+    .option('--tailscale', 'use Tailscale discovery and Tailscale hub/scheduler addresses')
     .option('--video-device <dev>', 'default camera for robot preview agent', 'auto')
     .option('--audio-device <dev>', 'default microphone for robot preview agent', 'default')
     .option('--no-vision', 'do not start the vision (camera/motion trigger) agent for a robot — armed by default')
@@ -303,6 +324,8 @@ program
         start: opts.start,
         autoStart: opts.autoStart,
         yes: opts.yes,
+        lan: opts.lan,
+        tailscale: opts.tailscale,
     });
 });
 // Keep legacy fleet/run/apply/dashboard commands available while migrating.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinicode",
-  "version": "2.8.37",
+  "version": "2.8.39",
   "description": "OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.",
   "type": "module",
   "main": "./dist/kernel/index.js",