secure-agents 0.0.0-stage → 0.7.2

package/dist/cli.js

@@ -0,0 +1,310 @@
+#!/usr/bin/env node
+// secure: set up this computer, run the daemon, serve the agent's MCP tools, and approve from the terminal.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { DEFAULT_PORT, ensureHome, moveOldHome, file, HOME, readJson, readSettings, requireSettings, writeJson } from './config.js';
+import { loadOrCreateAgentKey, startControl } from './control.js';
+import { loadOrCreateIdentity, newIdentity } from './identity.js';
+import { Link } from './link.js';
+import HyperDHT from 'hyperdht';
+import { runMcp } from './mcp.js';
+import { runRelay } from './relay.js';
+import { connectAgents, openPage } from './setup.js';
+import { APP_DIR, appCli, currentVersion, installedVersion, installVersion, newer, runningAs } from './update.js';
+import { spawn } from 'node:child_process';
+import { readPassphrase } from './prompt.js';
+import { audit, Store, verifyAudit } from './store.js';
+import { createVault, exportKey, MIN_PASSPHRASE, unlock, useKey, vaultExists } from './vault.js';
+const [cmd, ...args] = process.argv.slice(2);
+const CLI = fileURLToPath(import.meta.url);
+const START = runningAs() === 'source' ? `node "${CLI}" start` : 'npx secure-agents start';
+const flag = (name) => { const i = args.indexOf(`--${name}`); return i >= 0 ? args[i + 1] : undefined; };
+const HELP = `secure: let AI agents on different computers talk, with both people's consent.
+
+  secure guide                                    setup steps for an AI agent (it follows them for you)
+  secure start --name <computer-name>             first time: set up, connect your agents, run, open the page
+  secure start                                    every time after: run Secure (keep the window open)
+  secure init --name <name> | daemon              the same in two separate steps
+  secure ui                                       print the approval page address
+  secure pending                                  list what waits for your approval
+  secure deny <id>                                deny one item (asks for your passphrase)
+  Approving, sharing folders, rules and wake-up are on the approval page: each needs a passkey touch
+  (Touch ID, Windows Hello or your phone), so an agent can't do them even if it knows your passphrase.
+  secure audit                                    check that the audit log was not edited
+  secure rotate-identity                          new key pair for this computer (stop the daemon first; re-pair after)
+  secure id                                       this computer's public key (to allow it on a relay)
+  secure use-relay <relay-key> | off              connect only through a relay: paired peers never see your IP
+  secure relay                                    run a relay (on a server you trust), prints its key
+  secure relay allow <public-key>                 let a computer use this relay
+  secure brain [search words]                     list or search your saved decisions
+  secure mcp                                      MCP server for your agent (stdio)
+
+Your passphrase is never saved. Your agent must never know it: type it yourself, don't put it in a file or a prompt.
+
+"secure start" connects Claude Code and Codex for you. For another agent, add a local (stdio) MCP server: secure mcp
+Data folder: ${HOME}`;
+const readSettingsFile = () => readJson('settings.json', {});
+/** Signs in with the passphrase for one command, then signs out. */
+async function human(method, p, body) {
+    const { port } = requireSettings();
+    const base = `http://127.0.0.1:${port}`;
+    const headers = { 'x-secure-human': '1', 'content-type': 'application/json' };
+    const go = async (m, q, b, extra = {}) => {
+        const res = await fetch(`${base}${q}`, { method: m, headers: { ...headers, ...extra }, body: b ? JSON.stringify(b) : undefined })
+            .catch(() => { throw new Error('The daemon is not running. Start it with: secure daemon'); });
+        const json = await res.json();
+        if (!res.ok)
+            throw new Error(json.error ?? String(res.status));
+        return json;
+    };
+    const { token } = await go('POST', '/human/login', { passphrase: await readPassphrase('Secure passphrase: ') });
+    try {
+        return await go(method, p, body, { 'x-secure-session': token });
+    }
+    finally {
+        await go('POST', '/human/logout', null, { 'x-secure-session': token }).catch(() => { });
+    }
+}
+/** "npx secure-agents start": the first time, keep this version in ~/.secure/app; after that always run that pinned copy. Updates are approved on the page. */
+async function runPinned() {
+    ensureHome();
+    const have = installedVersion(), got = currentVersion();
+    if (!have) {
+        console.log(`Installing Secure ${got} in ${APP_DIR}…`);
+        installVersion(got);
+    }
+    else if (newer(got, have)) {
+        console.log(`Secure ${got} is available (this computer runs ${have}). Install it on the approval page: it needs your passkey.`);
+    }
+    const child = spawn(process.execPath, [appCli(), 'start', ...args], { stdio: 'inherit' });
+    for (const sig of ['SIGINT', 'SIGTERM'])
+        process.on(sig, () => child.kill(sig));
+    await new Promise((resolve) => child.on('exit', (code) => { process.exitCode = code ?? 0; resolve(); }));
+}
+/** First run: name, passphrase (typed twice), key pair and the agent's key. */
+async function setUp(name) {
+    if (!/^[a-z0-9][a-z0-9-]{1,40}$/i.test(name))
+        throw new Error('Use letters, numbers and dashes for the name, e.g. my-laptop.');
+    ensureHome();
+    const port = Number(flag('port') ?? readSettings()?.port ?? DEFAULT_PORT);
+    writeJson('settings.json', { ...readSettingsFile(), name, port });
+    if (!vaultExists()) {
+        console.error(`Choose a passphrase (at least ${MIN_PASSPHRASE} characters). You type it to start Secure and to sign in to its page.\nType it yourself: your agent must never know it. It can't be recovered, so keep it somewhere safe.`);
+        const pass = await readPassphrase('Passphrase: ');
+        if (process.stdin.isTTY && pass !== await readPassphrase('Again: '))
+            throw new Error('The two passphrases are different.');
+        createVault(pass);
+    }
+    const kp = loadOrCreateIdentity();
+    loadOrCreateAgentKey();
+    console.log(`Set up "${name}" in ${HOME} (key ${kp.publicKey.toString('hex').slice(0, 16)}…)`);
+}
+async function runDaemon(settings, carriedSessions = []) {
+    const key = loadOrCreateAgentKey();
+    const link = new Link(settings);
+    let control = null;
+    const stop = async () => { await link.stop(); process.exit(0); };
+    link.on('restart', () => { if (control)
+        void restartInPlace(link, control, stop); });
+    control = await startControl(link, settings.port, key, carriedSessions).catch((e) => {
+        throw new Error(e.code === 'EADDRINUSE' ? `Secure is already running on this computer (port ${settings.port}). Use that window, or close it first.` : e.message);
+    });
+    await link.start();
+    audit('daemon_started', { name: settings.name });
+    console.log(`Secure "${settings.name}" is running${settings.relay ? ' through the relay (peers cannot see your IP)' : ''}.\nApprovals: http://localhost:${settings.port}/ui (passphrase, then a passkey touch for each approval)`);
+    link.on('item', (it) => {
+        if (it.status !== 'awaiting_human')
+            return;
+        const warn = it.data?.warnings?.length ? `\n  WARNING: this ${it.data.warnings.join('; ')}` : '';
+        console.log(`\n[needs you] ${it.kind} ${it.direction === 'in' ? 'from' : 'to'} ${it.peerName}: ${it.text.slice(0, 120)}${warn}\n  approve on http://localhost:${settings.port}/ui`);
+    });
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+}
+/** After a passkey-approved update: stop, start the new version in this same window, and hand it the unlocked key and page sign-ins over a private channel. */
+async function restartInPlace(link, control, stop) {
+    console.log('\nUpdate installed. Restarting Secure with the new version…');
+    const handoff = { key: exportKey(), sessions: control.sessions() };
+    process.off('SIGINT', stop);
+    process.off('SIGTERM', stop);
+    await link.stop();
+    control.server.closeAllConnections();
+    await new Promise((resolve) => control.server.close(() => resolve()));
+    const child = spawn(process.execPath, [appCli(), 'daemon', '--handoff'], { stdio: ['inherit', 'inherit', 'inherit', 'ipc'] });
+    child.send(handoff, () => child.disconnect());
+    for (const sig of ['SIGINT', 'SIGTERM'])
+        process.on(sig, () => child.kill(sig));
+    child.on('exit', (code) => process.exit(code ?? 0));
+}
+function takeHandoff() {
+    return new Promise((resolve, reject) => {
+        if (!process.send)
+            return reject(new Error('--handoff is only used by Secure itself after an update.'));
+        process.once('message', (m) => resolve(m));
+    });
+}
+async function main() {
+    if (['start', 'init', 'daemon'].includes(cmd)) {
+        const moved = await moveOldHome();
+        if (moved)
+            console.log(moved);
+    }
+    switch (cmd) {
+        case 'start': {
+            if (runningAs() === 'download')
+                return runPinned();
+            const name = flag('name');
+            let settings = readSettings();
+            if (!vaultExists()) {
+                if (!name)
+                    throw new Error(`First time on this computer: give it a name.\n  ${START} --name my-laptop`);
+                await setUp(name);
+                settings = requireSettings();
+            }
+            else {
+                if (!settings)
+                    throw new Error('Secure data is incomplete on this computer.');
+                if (name && name !== settings.name)
+                    console.log(`(This computer is already set up as "${settings.name}"; keeping that name.)`);
+                unlock(await readPassphrase('Secure passphrase: '));
+            }
+            if (!args.includes('--no-agents'))
+                for (const line of connectAgents(CLI))
+                    console.log(line);
+            await runDaemon(settings);
+            if (!args.includes('--no-open'))
+                openPage(`http://localhost:${settings.port}/ui`);
+            console.log(`\nKeep this window open: Secure works only while it runs.\nNext time, start it with:  ${START}\nRestart your agent (Claude Code, Codex…) once so it loads the Secure tools.`);
+            return;
+        }
+        case 'init': {
+            const name = flag('name');
+            if (!name)
+                throw new Error(`Give this computer a name: ${START} --name my-laptop`);
+            if (vaultExists())
+                unlock(await readPassphrase('Secure passphrase: '));
+            await setUp(name);
+            return;
+        }
+        case 'daemon': {
+            const settings = requireSettings();
+            if (args.includes('--handoff')) {
+                const h = await takeHandoff();
+                useKey(h.key);
+                await runDaemon(settings, h.sessions);
+                return;
+            }
+            unlock(await readPassphrase('Secure passphrase: '));
+            await runDaemon(settings);
+            return;
+        }
+        case 'ui': {
+            console.log(`http://localhost:${requireSettings().port}/ui`);
+            return;
+        }
+        case 'pending': {
+            const s = await human('GET', '/human/state');
+            if (!s.pending.length)
+                console.log('Nothing waiting.');
+            for (const i of s.pending)
+                console.log(`${i.id}  ${i.kind} ${i.direction === 'in' ? 'from' : 'to'} ${i.peerName}${i.data?.warnings?.length ? `\n  WARNING: this ${i.data.warnings.join('; ')}` : ''}\n  ${i.text.slice(0, 300)}`);
+            return;
+        }
+        case 'deny': {
+            if (!args[0])
+                throw new Error('Usage: secure deny <id>');
+            const r = await human('POST', '/human/deny', { id: args[0] });
+            console.log(`Denied: ${r.status}`);
+            return;
+        }
+        case 'approve':
+        case 'share':
+        case 'unshare':
+        case 'rule':
+        case 'wake': {
+            console.log(`This needs your passkey (Touch ID, Windows Hello or your phone), so do it on the approval page:\n  http://localhost:${requireSettings().port}/ui\nThe terminal can only list (secure pending) and deny (secure deny <id>).`);
+            return;
+        }
+        case 'audit': {
+            requireSettings();
+            unlock(await readPassphrase('Secure passphrase: '));
+            const r = verifyAudit();
+            console.log(r.brokenAt === null ? `Audit log intact: ${r.lines} lines.` : `Audit log was edited: line ${r.brokenAt} of ${r.lines} (${r.reason}).`);
+            if (r.brokenAt !== null)
+                process.exitCode = 2;
+            return;
+        }
+        case 'rotate-identity': {
+            const settings = requireSettings();
+            if (await fetch(`http://127.0.0.1:${settings.port}/ui`).then(() => true, () => false))
+                throw new Error('Stop the daemon first.');
+            unlock(await readPassphrase('Secure passphrase: '));
+            const store = new Store(settings.limits.maxItems);
+            const before = store.peers.length;
+            const kp = newIdentity();
+            store.peers = [];
+            store.joins = [];
+            store.invites = [];
+            store.save();
+            fs.rmSync(file('brain-copies.sealed'), { force: true });
+            audit('identity_rotated', { publicKey: kp.publicKey.toString('hex'), peersRemoved: before });
+            console.log(`New identity ${kp.publicKey.toString('hex').slice(0, 16)}…. ${before} paired agent(s) removed: pair with them again.`);
+            return;
+        }
+        case 'id': {
+            requireSettings();
+            unlock(await readPassphrase('Secure passphrase: '));
+            console.log(loadOrCreateIdentity().publicKey.toString('hex'));
+            return;
+        }
+        case 'use-relay': {
+            if (!args[0])
+                throw new Error('Usage: secure use-relay <relay-key>   or   secure use-relay off');
+            if (args[0] !== 'off' && !/^[0-9a-f]{64}$/.test(args[0]))
+                throw new Error('A relay key is 64 hex characters, printed by "secure relay".');
+            writeJson('settings.json', { ...readSettingsFile(), relay: args[0] === 'off' ? null : args[0] });
+            console.log(args[0] === 'off' ? 'Direct connections again: paired peers can see your IP. Restart the daemon.' : 'This computer now connects only through that relay. Restart the daemon, and set the same relay on the other computer.');
+            return;
+        }
+        case 'relay': {
+            ensureHome();
+            const allowed = () => new Set(readJson('relay-allow.json', []));
+            if (args[0] === 'allow') {
+                if (!/^[0-9a-f]{64}$/.test(args[1] ?? ''))
+                    throw new Error('Usage: secure relay allow <public-key>   (the key "secure id" prints on that computer)');
+                writeJson('relay-allow.json', [...new Set([...allowed(), args[1]])]);
+                console.log(`Allowed ${args[1].slice(0, 16)}…. ${allowed().size} computer(s) may use this relay.`);
+                return;
+            }
+            const saved = readJson('relay-key.json', null);
+            const kp = saved ? { publicKey: Buffer.from(saved.publicKey, 'hex'), secretKey: Buffer.from(saved.secretKey, 'hex') } : HyperDHT.keyPair();
+            if (!saved)
+                writeJson('relay-key.json', { publicKey: kp.publicKey.toString('hex'), secretKey: kp.secretKey.toString('hex') });
+            const stop = await runRelay(kp, allowed, (m) => console.log(`${new Date().toISOString()} ${m}`));
+            console.log(`Secure relay running.\nRelay key: ${kp.publicKey.toString('hex')}\nOn each computer: secure use-relay ${kp.publicKey.toString('hex')}\nAllowed computers: ${allowed().size} (add with: secure relay allow <key>)`);
+            const end = async () => { await stop(); process.exit(0); };
+            process.on('SIGINT', end);
+            process.on('SIGTERM', end);
+            return;
+        }
+        case 'brain': {
+            const { port } = requireSettings();
+            const key = fs.readFileSync(file('agent.key'), 'utf8').trim();
+            const r = await fetch(`http://127.0.0.1:${port}/agent/brain?q=${encodeURIComponent(args.join(' '))}`, { headers: { 'x-secure-key': key } }).then((x) => x.json());
+            if (!r.length)
+                console.log('No decisions found.');
+            for (const d of r)
+                console.log(`${d.shared ? '[shared] ' : '[private]'} ${d.title}\n  ${d.decision}\n  sources: ${d.sources.join(', ') || 'none'}`);
+            return;
+        }
+        case 'mcp':
+            await runMcp();
+            return;
+        case 'guide':
+            console.log(fs.readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'AGENTS.md'), 'utf8'));
+            return;
+        default: console.log(HELP);
+    }
+}
+main().catch((e) => { console.error(e instanceof Error ? e.message : e); process.exit(1); });

package/dist/config.js

@@ -0,0 +1,62 @@
+// Where this computer's Secure data lives, and the few settings it has.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+export const HOME = process.env.SECURE_HOME ?? path.join(os.homedir(), '.secure');
+export const file = (name) => path.join(HOME, name);
+/** Before the rename to Secure, data lived in ~/.securee; it moves here once, keeping the keys, pairings and passphrase. */
+export async function moveOldHome() {
+    const old = path.join(os.homedir(), '.securee');
+    if (process.env.SECURE_HOME || fs.existsSync(HOME) || !fs.existsSync(old))
+        return null;
+    const port = (() => { try {
+        return JSON.parse(fs.readFileSync(path.join(old, 'settings.json'), 'utf8')).port ?? DEFAULT_PORT;
+    }
+    catch {
+        return DEFAULT_PORT;
+    } })();
+    const running = await fetch(`http://127.0.0.1:${port}/ui`, { signal: AbortSignal.timeout(1500) }).then(() => true, () => false);
+    if (running)
+        throw new Error('The old Securee is still running. Close its window (or stop it), then run this again: your data moves to ~/.secure.');
+    try {
+        fs.renameSync(old, HOME);
+    }
+    catch (e) {
+        const code = e.code;
+        if (code !== 'EPERM' && code !== 'EBUSY' && code !== 'EACCES')
+            throw e;
+        throw new Error(`Could not move ${old}: something still uses it, usually Claude Code or Codex running the old Securee tools. Close Claude Code and Codex completely (or restart the computer), then run this again.`);
+    }
+    return `Moved your data from ${old} to ${HOME}: same keys, pairings and passphrase.`;
+}
+export const DEFAULT_LIMITS = { messagesPerMinute: 60, maxPendingPerPeer: 20, maxItems: 2000, maxLoginFailures: 5, lockoutSeconds: 60, sessionHours: 12, pendingHours: 24, updateCheckHours: 6, updateCheckOnOpenMinutes: 60, minFreeDiskMB: 1024, precheckSeconds: 120, historyLogBytes: 16384, notifyGroupSeconds: 3, fileLimitMaxMB: 51200, wakeMinutes: 240 };
+export const DEFAULT_PORT = 47800;
+export const DEFAULT_MAX_FILE_BYTES = 200 * 1024 * 1024;
+export function ensureHome() {
+    fs.mkdirSync(HOME, { recursive: true, mode: 0o700 });
+}
+export function readJson(name, fallback) {
+    try {
+        return JSON.parse(fs.readFileSync(file(name), 'utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Atomic write, readable only by this OS user. */
+export function writeJson(name, value) {
+    ensureHome();
+    const tmp = file(`${name}.tmp`);
+    fs.writeFileSync(tmp, JSON.stringify(value, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, file(name));
+}
+export function readSettings() {
+    const s = readJson('settings.json', null);
+    return s?.name ? { name: s.name, port: s.port ?? DEFAULT_PORT, maxFileBytes: s.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES, limits: { ...DEFAULT_LIMITS, ...s.limits }, relay: s.relay ?? null, notify: s.notify ?? true } : null;
+}
+export function requireSettings() {
+    const s = readSettings();
+    if (!s)
+        throw new Error(`Secure is not set up here. Run: secure init --name <agent-name>`);
+    return s;
+}

package/dist/control.js

@@ -0,0 +1,251 @@
+// Local-only HTTP API on 127.0.0.1. The agent's key can ask, read and reply. Approving anything needs the passphrase, which is never stored on disk.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import { file } from './config.js';
+import { RULE_KEYS, verifyAudit } from './store.js';
+import { Passkeys } from './passkey.js';
+import { approvalPage } from './ui.js';
+import { passphraseMatches } from './vault.js';
+import { presetWake } from './waker.js';
+const MAX_BODY = 1_000_000;
+const COOKIE = 'secure_session';
+/** The agent's key, saved for the MCP bridge. It opens only /agent/* routes. */
+export function loadOrCreateAgentKey() {
+    try {
+        fs.rmSync(file('human.key'), { force: true });
+    }
+    catch { /* older versions kept one */ }
+    try {
+        const k = fs.readFileSync(file('agent.key'), 'utf8').trim();
+        if (k)
+            return k;
+    }
+    catch { /* first run */ }
+    const k = crypto.randomBytes(24).toString('hex');
+    fs.writeFileSync(file('agent.key'), k, { mode: 0o600 });
+    return k;
+}
+/** Human sign-ins live only in this process's memory; a restart signs everyone out. */
+class Sessions {
+    limits;
+    tokens;
+    failures = 0;
+    lockedUntil = 0;
+    constructor(limits, carried = []) {
+        this.limits = limits;
+        this.tokens = new Map(carried);
+    }
+    carry() { return [...this.tokens].filter(([, exp]) => exp > Date.now()); }
+    login(passphrase) {
+        if (Date.now() < this.lockedUntil)
+            throw new Error(`Too many wrong passphrases. Try again in ${Math.ceil((this.lockedUntil - Date.now()) / 1000)} s.`);
+        if (!passphraseMatches(passphrase)) {
+            if (++this.failures >= this.limits.maxLoginFailures) {
+                this.failures = 0;
+                this.lockedUntil = Date.now() + this.limits.lockoutSeconds * 1000;
+            }
+            throw new Error('Wrong passphrase.');
+        }
+        this.failures = 0;
+        const t = crypto.randomBytes(32).toString('hex');
+        this.tokens.set(t, Date.now() + this.limits.sessionHours * 3600_000);
+        return t;
+    }
+    valid(t) {
+        const exp = this.tokens.get(t);
+        if (exp && exp > Date.now())
+            return true;
+        this.tokens.delete(t);
+        return false;
+    }
+    logout(t) { this.tokens.delete(t); }
+}
+export function startControl(link, port, agentKey, carriedSessions = []) {
+    const sessions = new Sessions(link.settings.limits, carriedSessions);
+    const passkeys = new Passkeys(port);
+    // Anything that lets something reach the agent or leave the computer, or loosens a rule, needs a passkey touch for that exact action.
+    const protectedActions = {
+        approve: (b) => link.approve(str(b.id, 'id')),
+        unpair: (b) => { link.unpair(str(b.peer, 'peer')); return { ok: true }; },
+        rule: (b) => { link.setRule(str(b.peer, 'peer'), rk(b.key), rule(b.rule)); return { ok: true }; },
+        access: (b) => link.setAccess(str(b.peer, 'peer'), b.reach === 'computer' ? 'computer' : 'folders', b.tools === 'all' ? 'all' : 'files'),
+        share: (b) => link.shareFolder(str(b.peer, 'peer'), str(b.folder, 'folder'), b.remove === true),
+        'decision-shared': (b) => link.setDecisionShared(str(b.id, 'id'), b.shared === true),
+        wake: (b) => ({ wake: link.setWake(wakeFrom(b)) }),
+        'file-limit': (b) => link.setFileLimit(Number(b.mb)),
+        'add-passkey': (_b, session) => passkeys.registerOptions(session, true),
+        update: (b) => link.installUpdate(str(b.version, 'version')),
+    };
+    const agent = {
+        'GET /agent/status': () => link.status(),
+        'POST /agent/invite': () => link.createInvite(),
+        'POST /agent/join': (b) => link.join(str(b.code, 'code')),
+        'POST /agent/ask': (b) => link.ask(str(b.peer, 'peer'), str(b.text, 'text'), typeof b.thread === 'string' && b.thread ? b.thread : undefined),
+        'POST /agent/task-reply': (b) => link.replyToTask(str(b.id, 'id'), str(b.text, 'text')),
+        'GET /agent/inbox': () => link.inbox(),
+        'POST /agent/reply': (b) => link.reply(str(b.id, 'id'), str(b.text, 'text'), strs(b.sources)),
+        'GET /agent/wait': (_b, u) => link.waitFor(u.searchParams.get('id') ?? '', Math.min(Number(u.searchParams.get('timeout') ?? 0) * 1000, 300_000)),
+        'POST /agent/request-file': (b) => link.requestFile(str(b.peer, 'peer'), str(b.path, 'path'), typeof b.reason === 'string' ? b.reason : ''),
+        'POST /agent/offer-file': (b) => link.offerFile(str(b.peer, 'peer'), str(b.path, 'path'), typeof b.note === 'string' ? b.note : ''),
+        'GET /agent/received': () => link.received(),
+        'POST /agent/task': (b) => link.requestTask(str(b.peer, 'peer'), str(b.text, 'text')),
+        'POST /agent/task-update': (b) => link.updateTask(str(b.id, 'id'), str(b.note, 'note')),
+        'POST /agent/task-complete': (b) => link.completeTask(str(b.id, 'id'), str(b.note, 'note'), strs(b.artifacts), b.failed === true, b.needsInput === true),
+        'POST /agent/decision': (b) => link.recordDecision({ title: str(b.title, 'title'), decision: str(b.decision, 'decision'), why: str(b.why, 'why'),
+            alternatives: typeof b.alternatives === 'string' ? b.alternatives : undefined, sources: strs(b.sources), tags: strs(b.tags), shared: b.shared !== false }),
+        'GET /agent/brain': (_b, u) => link.searchMine(u.searchParams.get('q') ?? ''),
+        'POST /agent/ask-brain': (b) => link.askBrain(str(b.peer, 'peer'), str(b.query, 'query')),
+        'GET /agent/brain-copy': (_b, u) => link.searchCopy(link.store.peerByName(u.searchParams.get('peer') ?? '')?.publicKey ?? '', u.searchParams.get('q') ?? ''),
+    };
+    const human = {
+        'POST /human/check-update': async () => ({ update_available: await link.lookForUpdate() }),
+        'GET /human/state': () => (link.lookForUpdateSoon(), { ...link.status(), wakeLast: link.waker.last, wakePreset: link.waker.preset, passkeys: passkeys.count, pending: link.pending(), notices: link.notices(), maxFileBytes: link.settings.maxFileBytes, fileLimitMaxMB: link.settings.limits.fileLimitMaxMB, wakeMinutes: link.waker.minutes(), wakeInternet: link.wakeInternet(), wakeCommands: link.wakeCommands(), decisionsList: link.brain.mine }),
+        'GET /human/history': (_b, u) => link.history(u.searchParams.get('peer') ?? ''),
+        'GET /human/agent-log': (_b, u) => ({ log: link.agentLog(u.searchParams.get('id') ?? '') }),
+        'POST /human/deny': (b) => link.deny(str(b.id, 'id')),
+        'POST /human/dismiss': (b) => link.dismiss(str(b.id, 'id')),
+        'GET /human/decisions': () => link.brain.mine,
+        'GET /human/audit': () => verifyAudit(),
+        'POST /human/passkey/options': (_b, _u, session) => passkeys.registerOptions(session),
+        'POST /human/passkey/register': async (b, _u, session) => ({ passkeys: await passkeys.register(session, str(b.id, 'id'), b.response) }),
+        'POST /human/challenge': (b, _u, session) => {
+            const action = str(b.action, 'action');
+            if (!protectedActions[action])
+                throw new Error(`Unknown action "${action}".`);
+            return passkeys.challenge(session, action, (b.body ?? {}));
+        },
+        'POST /human/confirm': async (b, _u, session) => {
+            const { action, body } = await passkeys.confirm(session, str(b.id, 'id'), b.response);
+            return protectedActions[action](body, session);
+        },
+    };
+    const server = http.createServer(async (req, res) => {
+        const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+        const send = (code, body, type = 'application/json') => {
+            res.writeHead(code, { 'content-type': type, 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' });
+            res.end(type === 'application/json' ? JSON.stringify(body) : String(body));
+        };
+        // Browsers on other sites must not reach this API: no CORS, and the host must be local.
+        if (!/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(req.headers.host ?? ''))
+            return send(403, { error: 'local only' });
+        // Passkeys only work on a named host, so the page always lives on localhost.
+        if (url.pathname === '/ui' && req.method === 'GET' && !(req.headers.host ?? '').startsWith('localhost')) {
+            res.writeHead(302, { location: `http://localhost:${port}/ui` });
+            return res.end();
+        }
+        if (url.pathname === '/ui' && req.method === 'GET') {
+            res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', 'x-frame-options': 'DENY',
+                'content-security-policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'" });
+            return res.end(approvalPage());
+        }
+        const route = `${req.method} ${url.pathname}`;
+        let session = '';
+        const isHuman = url.pathname.startsWith('/human/');
+        if (isHuman) {
+            // A custom header can't be sent cross-site without a preflight, which this server never allows.
+            if (req.headers['x-secure-human'] !== '1')
+                return send(403, { error: 'missing header' });
+            const token = String(req.headers['x-secure-session'] ?? cookie(req.headers.cookie, COOKIE));
+            if (route === 'POST /human/login') {
+                try {
+                    const t = sessions.login(String((await readBody(req)).passphrase ?? ''));
+                    res.setHeader('set-cookie', `${COOKIE}=${t}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${link.settings.limits.sessionHours * 3600}`);
+                    return send(200, { token: t });
+                }
+                catch (e) {
+                    return send(401, { error: e instanceof Error ? e.message : String(e) });
+                }
+            }
+            if (route === 'POST /human/logout') {
+                sessions.logout(token);
+                res.setHeader('set-cookie', `${COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`);
+                return send(200, { ok: true });
+            }
+            if (!sessions.valid(token))
+                return send(401, { error: 'signin' });
+            session = token;
+        }
+        const h = (isHuman ? human : agent)[route];
+        if (!h)
+            return send(404, { error: 'not found' });
+        if (!isHuman && !same(String(req.headers['x-secure-key'] ?? ''), agentKey))
+            return send(401, { error: 'wrong key' });
+        try {
+            const body = req.method === 'POST' ? await readBody(req) : {};
+            send(200, (await h(body, url, session)) ?? null);
+        }
+        catch (e) {
+            send(400, { error: e instanceof Error ? e.message : String(e) });
+        }
+    });
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(port, '127.0.0.1', () => resolve({ server, sessions: () => sessions.carry() }));
+    });
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on('data', (c) => { size += c.length; if (size > MAX_BODY) {
+            reject(new Error('Message too large.'));
+            req.destroy();
+        }
+        else
+            chunks.push(c); });
+        req.on('end', () => { try {
+            resolve(chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : {});
+        }
+        catch {
+            reject(new Error('Body must be JSON.'));
+        } });
+        req.on('error', reject);
+    });
+}
+function cookie(header, name) {
+    for (const part of (header ?? '').split(';')) {
+        const [k, ...v] = part.trim().split('=');
+        if (k === name)
+            return v.join('=');
+    }
+    return '';
+}
+function same(a, b) {
+    const x = Buffer.from(a), y = Buffer.from(b);
+    return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function wakeFrom(b) {
+    if (b.preset === 'off')
+        return null;
+    const cwd = str(b.cwd, 'cwd');
+    if (!fs.statSync(cwd).isDirectory())
+        throw new Error('cwd must be a folder.');
+    const minutes = b.timeoutMinutes === undefined || b.timeoutMinutes === '' ? undefined : Number(b.timeoutMinutes);
+    if (minutes !== undefined && !(Number.isInteger(minutes) && minutes >= 1 && minutes <= 10080))
+        throw new Error('The time limit must be a whole number of minutes, from 1 to 10080 (a week).');
+    if (b.preset === 'claude' || b.preset === 'codex')
+        return presetWake(b.preset, cwd, b.allowCommands === true, minutes, b.internet === true);
+    if (b.preset !== 'custom')
+        throw new Error('preset must be claude, codex, custom or off.');
+    const line = str(b.line, 'command');
+    const [command, ...args] = splitLine(line);
+    return { preset: 'custom', line, question: { command, args }, task: { command, args }, cwd, timeoutMinutes: minutes ?? 0, timeoutSet: minutes !== undefined };
+}
+/** Splits a typed command line into words; "double quotes" keep spaces together. */
+function splitLine(line) {
+    const words = [...line.matchAll(/"([^"]*)"|(\S+)/g)].map((m) => m[1] ?? m[2]);
+    if (!words.length)
+        throw new Error('Type the command that starts your agent.');
+    return words;
+}
+function str(v, name) {
+    if (typeof v !== 'string' || !v.trim())
+        throw new Error(`"${name}" is required.`);
+    return v;
+}
+function strs(v) { return Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []; }
+function rk(v) { if (RULE_KEYS.includes(v))
+    return v; throw new Error(`"key" must be one of ${RULE_KEYS.join(', ')}.`); }
+function rule(v) { if (v === 'auto' || v === 'ask' || v === 'never')
+    return v; throw new Error('"rule" must be auto, ask or never.'); }