sliccy 6.87.2 → 6.88.0

package/README.md

@@ -78,7 +78,7 @@ SLICC is for you if:
 - **Boot full x86 virtual machines in the browser.** `v86 start` runs real operating systems (Alpine, FreeDOS, KolibriOS, ...) on the wasm-based [v86](https://github.com/copy/v86) emulator, entirely client-side. The agent drives the guest from the shell — type, click, screenshot, stream the screen live, save/restore state — and `-net <model>,relay=fetch` gives the guest HTTP access through SLICC's fetch proxy. Install with `ipk add v86`.
 - **Delegate parallel work to scoops.** Split tasks into isolated sub-agents with their own sandboxes and context, then let the main agent coordinate the results.
 - **Turn one-off wins into reusable workflows.** Package behavior as skills, build interactive sprinkles, and react to external events with webhooks and cron-driven licks.
-- **Mount your local file system.** By default, SLICC is confined to your browser. But you can ask it to mount folders from your local file system, so it can read and write from there. Mount into an empty path such as `/mnt/myproject` so you do not hide existing skills or scripts.
+- **Mount your local file system.** By default, SLICC is confined to your browser. But you can ask it to mount folders from your local file system, so it can read and write from there. Mount into an empty path such as `/mnt/myproject` so you do not hide existing skills or scripts. Picker mounts ask again after a page reload; for folders you always want available, map them in the launcher's mount table (`npx slicc --mount=~/Projects/foo:/mnt/foo`, or Settings → Mounts in Sliccstart.app) and they are mounted automatically on every launch, with no picker or permission prompt — see [Auto-mounted host folders](docs/mounts.md#auto-mounted-host-folders-the-mount-table).
 - **Mount remote storage as if it were local.** Beyond local folders, `mount --source` bridges S3 buckets, S3-compatible services like Cloudflare R2 and MinIO, and Adobe authoring content — both da.live repositories and Helix 6 sites on the AEM Source Bus — into the same VFS surface. Reads use TTL+ETag caching with conditional revalidation; writes use ETag-conditional PUTs that surface concurrent-edit conflicts as `EBUSY`. Credentials live server-side (`~/.slicc/secrets.env` in CLI, `chrome.storage.local` in the extension via the **Extension options** page) and never reach the agent. After setup: `mount --source s3://my-bucket --profile r2 /mnt/r2`, `mount --source da://my-org/my-repo /mnt/da`, or `mount --source aem://my-org/my-site /mnt/aem`. A `da://` source checks the site config first and re-routes to the Source Bus when the site has been upgraded to Helix 6, rather than quietly mounting a store that no longer holds its content. See [docs/mounts.md](docs/mounts.md) for the full guide.
 
 ## Getting started

package/dist/node-server/_shared/index.d.ts

@@ -5,6 +5,7 @@ export * from './cdp-frame-unmask.js';
 export * from './content-type.js';
 export * from './electron-overlay-route.js';
 export * from './fetch-proxy-protocol.js';
+export * from './loopback.js';
 export * from './oauth-extra-domains-storage.js';
 export * from './preview-url.js';
 export * from './runtime-env.js';

package/dist/node-server/_shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,kCAAkC,CAAC;AACjD,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC"}

package/dist/node-server/_shared/index.js

@@ -6,6 +6,7 @@ export * from './cdp-frame-unmask.js';
 export * from './content-type.js';
 export * from './electron-overlay-route.js';
 export * from './fetch-proxy-protocol.js';
+export * from './loopback.js';
 export * from './oauth-extra-domains-storage.js';
 export * from './preview-url.js';
 export * from './runtime-env.js';

package/dist/node-server/_shared/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,kCAAkC,CAAC;AACjD,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC"}

package/dist/node-server/_shared/loopback.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Canonical loopback-host detection shared across security gates
+ * (bridge-token exemption, localhost-only endpoints, http: allowlists,
+ * OAuth redirect branching). One accepted set — do not reimplement.
+ *
+ * Accepts:
+ * - `localhost`
+ * - the entire `127.0.0.0/8` block (e.g. `127.0.0.1`, `127.0.0.2`)
+ * - IPv6 loopback, bracketed or bare (`[::1]`, `::1`)
+ */
+/** True when `hostname` is a loopback name (no URL parse — host only). */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * True when `origin` parses as a URL whose hostname is loopback.
+ * Returns false for missing / empty / unparseable values.
+ */
+export declare function isLoopbackOrigin(origin: string | undefined | null): boolean;
+//# sourceMappingURL=loopback.d.ts.map

package/dist/node-server/_shared/loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../src/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAW5D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAO3E"}

package/dist/node-server/_shared/loopback.js

@@ -0,0 +1,41 @@
+/**
+ * Canonical loopback-host detection shared across security gates
+ * (bridge-token exemption, localhost-only endpoints, http: allowlists,
+ * OAuth redirect branching). One accepted set — do not reimplement.
+ *
+ * Accepts:
+ * - `localhost`
+ * - the entire `127.0.0.0/8` block (e.g. `127.0.0.1`, `127.0.0.2`)
+ * - IPv6 loopback, bracketed or bare (`[::1]`, `::1`)
+ */
+/** True when `hostname` is a loopback name (no URL parse — host only). */
+export function isLoopbackHostname(hostname) {
+    if (!hostname)
+        return false;
+    // WHATWG URL keeps brackets on IPv6 hostnames (`http://[::1]` → `[::1]`);
+    // socket addresses and some callers pass bare `::1`. Accept both.
+    const host = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+    if (host === 'localhost')
+        return true;
+    if (host === '::1')
+        return true;
+    // 127.0.0.0/8 — octet shape only (same as the former webapp plugin gate).
+    if (/^127(\.\d{1,3}){3}$/.test(host))
+        return true;
+    return false;
+}
+/**
+ * True when `origin` parses as a URL whose hostname is loopback.
+ * Returns false for missing / empty / unparseable values.
+ */
+export function isLoopbackOrigin(origin) {
+    if (!origin)
+        return false;
+    try {
+        return isLoopbackHostname(new URL(origin).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=loopback.js.map

package/dist/node-server/_shared/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../src/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,IAAI,GACR,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxF,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,0EAA0E;IAC1E,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/node-server/bridge-security.d.ts

@@ -42,12 +42,15 @@ export declare const BRIDGE_ALLOWED_ORIGINS: readonly string[];
  */
 export declare function isAllowedBridgeOrigin(origin: string | undefined | null): boolean;
 /**
- * True iff `origin` is a loopback host (localhost / 127.0.0.1 / ::1).
+ * True iff `origin` is a loopback host.
  * Loopback allowlisted origins (e.g. the locally-served OAuth callback
  * page at `http://localhost:5710/auth/callback` posting to
  * `/api/oauth-result`) are exempt from the bridge-token requirement —
  * the token's threat model is "remote allowlisted origin (sliccy.ai)
  * with a hostile script", not "local server talking to itself".
+ *
+ * Canonical set: `@slicc/shared-ts` `isLoopbackOrigin` (localhost,
+ * 127.0.0.0/8, bracketed/bare ::1).
  */
 export declare function isLoopbackBridgeOrigin(origin: string | undefined | null): boolean;
 /**

package/dist/node-server/bridge-security.js

@@ -19,7 +19,7 @@
  * testable from `tests/bridge-security.test.ts`.
  */
 import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { BRIDGE_SUBPROTOCOL_PREFIX, BRIDGE_TOKEN_HEADER, BRIDGE_TOKEN_QUERY_PARAM, BRIDGE_WS_QUERY_PARAM, SLICC_HOSTED_ORIGIN, SLICC_STAGING_HUB_ORIGIN, } from './_shared/index.js';
+import { BRIDGE_SUBPROTOCOL_PREFIX, BRIDGE_TOKEN_HEADER, BRIDGE_TOKEN_QUERY_PARAM, BRIDGE_WS_QUERY_PARAM, isLoopbackOrigin, SLICC_HOSTED_ORIGIN, SLICC_STAGING_HUB_ORIGIN, } from './_shared/index.js';
 // Re-exported so the many existing bridge-security importers (index.ts,
 // launch-url.ts, electron-controller.ts, tests) keep their import surface.
 // Canonical definitions: packages/shared-ts/src/bridge-protocol.ts.
@@ -144,28 +144,18 @@ export function isAllowedBridgeOrigin(origin) {
     return BRIDGE_DEV_ALLOWED_ORIGINS.has(normalized);
 }
 /**
- * True iff `origin` is a loopback host (localhost / 127.0.0.1 / ::1).
+ * True iff `origin` is a loopback host.
  * Loopback allowlisted origins (e.g. the locally-served OAuth callback
  * page at `http://localhost:5710/auth/callback` posting to
  * `/api/oauth-result`) are exempt from the bridge-token requirement —
  * the token's threat model is "remote allowlisted origin (sliccy.ai)
  * with a hostile script", not "local server talking to itself".
+ *
+ * Canonical set: `@slicc/shared-ts` `isLoopbackOrigin` (localhost,
+ * 127.0.0.0/8, bracketed/bare ::1).
  */
 export function isLoopbackBridgeOrigin(origin) {
-    if (!origin)
-        return false;
-    try {
-        const url = new URL(origin);
-        // Node's WHATWG URL parser keeps the brackets on IPv6 hostnames
-        // (`http://[::1]:5710` → `[::1]`); accept both bracketed and bare.
-        return (url.hostname === 'localhost' ||
-            url.hostname === '127.0.0.1' ||
-            url.hostname === '::1' ||
-            url.hostname === '[::1]');
-    }
-    catch {
-        return false;
-    }
+    return isLoopbackOrigin(origin);
 }
 /**
  * Constant-time compare for the bridge token. `presented` may be missing

package/dist/node-server/cloud-status.d.ts

@@ -15,6 +15,9 @@ export interface CloudStatusPayload {
  * Reject non-loopback requests. The sandbox is a private execution boundary,
  * but defense in depth: someone might wire a port-forward and we want this
  * endpoint to be unreachable from the outside.
+ *
+ * Socket addresses may be IPv4-mapped IPv6 (`::ffff:127.0.0.1`); strip that
+ * prefix then use the shared loopback hostname check.
  */
 export declare function requireLoopback(req: Request, res: Response, next: NextFunction): void;
 export declare function registerCloudStatusEndpoint(app: Express, options: CloudStatusEndpointOptions): void;

package/dist/node-server/cloud-status.js

@@ -1,4 +1,5 @@
 import { promises as fs } from 'node:fs';
+import { isLoopbackHostname } from './_shared/index.js';
 import express from 'express';
 /** The optional string fields validated when present but never required. */
 const OPTIONAL_STRING_FIELDS = [
@@ -25,11 +26,14 @@ function isCloudStatusPayload(x) {
  * Reject non-loopback requests. The sandbox is a private execution boundary,
  * but defense in depth: someone might wire a port-forward and we want this
  * endpoint to be unreachable from the outside.
+ *
+ * Socket addresses may be IPv4-mapped IPv6 (`::ffff:127.0.0.1`); strip that
+ * prefix then use the shared loopback hostname check.
  */
 export function requireLoopback(req, res, next) {
     const addr = req.socket.remoteAddress ?? '';
-    const isLoopback = addr === '127.0.0.1' || addr === '::1' || addr === '::ffff:127.0.0.1' || addr === 'localhost';
-    if (!isLoopback) {
+    const normalized = addr.toLowerCase().startsWith('::ffff:') ? addr.slice('::ffff:'.length) : addr;
+    if (!isLoopbackHostname(normalized)) {
         res.status(403).json({ error: 'localhost only' });
         return;
     }

package/dist/node-server/hostfs.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Host filesystem bridge — serves the folders named in the mount table
+ * (`--mount=<os-path>:<slicc-path>`) to the webapp over the local /api
+ * surface, so configured mounts appear in the VFS fully automatically,
+ * with no File System Access picker and no Chrome permission prompt.
+ *
+ * Only paths under a configured mount root are reachable. Every request
+ * names a mount by its SLICC target (`?mount=/mnt/project`) plus a
+ * mount-relative path (`?path=sub/file.txt`); the mapping to the OS root
+ * happens here and `resolveWithinRoot` rejects traversal (`..`) and
+ * symlink escapes, so the browser never addresses the host filesystem
+ * directly.
+ *
+ * Protected like every other /api route: same-origin / loopback callers
+ * pass, cross-origin callers need the bridge token (see
+ * `createThinBridgeCorsMiddleware` in index.ts).
+ */
+import type { Express } from 'express';
+import type { HostMountMapping } from './runtime-flags.js';
+/** Matches the webapp's hostfs body cap (backend-hostfs.ts). */
+export declare const HOSTFS_MAX_BODY_BYTES: number;
+/**
+ * Resolve `relPath` against `root`, rejecting anything that leaves the root
+ * either lexically (`..`) or via symlinks. Symlinks *inside* the root that
+ * also point inside the root are followed; a link pointing outside is
+ * rejected. The check walks to the nearest existing ancestor so that writes
+ * to not-yet-existing paths are still validated.
+ */
+export declare function resolveWithinRoot(root: string, relPath: string): Promise<string>;
+interface HostMountRoot {
+    /** SLICC target path, e.g. /mnt/project. */
+    path: string;
+    /** realpath()'d OS root. */
+    root: string;
+}
+/**
+ * Resolve the configured mappings to realpath'd roots. Mappings whose OS
+ * path does not exist (or is not a directory) are dropped with a warning —
+ * a missing folder must not take the whole /api surface down, and the
+ * webapp will surface the absent mount as "not mounted".
+ */
+export declare function resolveHostMountRoots(mounts: readonly HostMountMapping[], warn?: (msg: string) => void): Promise<HostMountRoot[]>;
+/**
+ * Register the /api/hostfs routes for the resolved mount roots. The route
+ * surface mirrors `MountBackend` 1:1 (webapp `backend-hostfs.ts`):
+ *
+ *   GET    /api/hostfs/list?mount=&path=          → { entries: [...] }
+ *   GET    /api/hostfs/stat?mount=&path=          → { kind, size, mtime }
+ *   GET    /api/hostfs/read?mount=&path=          → octet-stream body
+ *   PUT    /api/hostfs/write?mount=&path=         ← octet-stream body
+ *   POST   /api/hostfs/mkdir?mount=&path=
+ *   DELETE /api/hostfs/remove?mount=&path=[&recursive=1]
+ *
+ * Errors are `{ code, message }` JSON with an errno-derived status so the
+ * webapp backend can rethrow faithful `FsError`s.
+ */
+export declare function registerHostFsRoutes(app: Express, roots: readonly HostMountRoot[]): void;
+export {};

package/dist/node-server/hostfs.js

@@ -0,0 +1,257 @@
+/**
+ * Host filesystem bridge — serves the folders named in the mount table
+ * (`--mount=<os-path>:<slicc-path>`) to the webapp over the local /api
+ * surface, so configured mounts appear in the VFS fully automatically,
+ * with no File System Access picker and no Chrome permission prompt.
+ *
+ * Only paths under a configured mount root are reachable. Every request
+ * names a mount by its SLICC target (`?mount=/mnt/project`) plus a
+ * mount-relative path (`?path=sub/file.txt`); the mapping to the OS root
+ * happens here and `resolveWithinRoot` rejects traversal (`..`) and
+ * symlink escapes, so the browser never addresses the host filesystem
+ * directly.
+ *
+ * Protected like every other /api route: same-origin / loopback callers
+ * pass, cross-origin callers need the bridge token (see
+ * `createThinBridgeCorsMiddleware` in index.ts).
+ */
+import express from 'express';
+import { lstat, mkdir, readdir, readFile, realpath, rename, rm, stat, writeFile, } from 'fs/promises';
+import { dirname, resolve, sep } from 'path';
+/** Matches the webapp's hostfs body cap (backend-hostfs.ts). */
+export const HOSTFS_MAX_BODY_BYTES = 100 * 1024 * 1024;
+function errnoCode(err) {
+    const code = err?.code;
+    return typeof code === 'string' ? code : null;
+}
+/** Map an fs errno (or traversal rejection) to an HTTP status + FsError code. */
+function toFsCodeError(err) {
+    const code = errnoCode(err) ?? 'EIO';
+    const message = err instanceof Error ? err.message : String(err);
+    switch (code) {
+        case 'ENOENT':
+            return { status: 404, code, message };
+        case 'EACCES':
+        case 'EPERM':
+            return { status: 403, code: 'EACCES', message };
+        case 'EISDIR':
+        case 'ENOTDIR':
+        case 'ENOTEMPTY':
+        case 'EEXIST':
+            return { status: 409, code, message };
+        default:
+            return { status: 500, code, message };
+    }
+}
+function sendFsError(res, err) {
+    const mapped = toFsCodeError(err);
+    res.status(mapped.status).json({ code: mapped.code, message: mapped.message });
+}
+/** Traversal/symlink escape → EACCES, so it renders as a permission error. */
+function escapeError(target) {
+    const err = new Error(`path escapes the mount root: ${target}`);
+    err.code = 'EACCES';
+    return err;
+}
+function isWithin(root, target) {
+    return target === root || target.startsWith(root + sep);
+}
+/**
+ * Resolve `relPath` against `root`, rejecting anything that leaves the root
+ * either lexically (`..`) or via symlinks. Symlinks *inside* the root that
+ * also point inside the root are followed; a link pointing outside is
+ * rejected. The check walks to the nearest existing ancestor so that writes
+ * to not-yet-existing paths are still validated.
+ */
+export async function resolveWithinRoot(root, relPath) {
+    const cleaned = relPath.replace(/^\/+/, '');
+    const target = resolve(root, cleaned);
+    if (!isWithin(root, target))
+        throw escapeError(target);
+    // Walk up to the nearest existing ancestor and realpath it; a symlinked
+    // ancestor must still land inside the (already realpath'd) root.
+    let probe = target;
+    for (;;) {
+        try {
+            const real = await realpath(probe);
+            if (!isWithin(root, real) && probe !== root)
+                throw escapeError(target);
+            break;
+        }
+        catch (err) {
+            if (errnoCode(err) !== 'ENOENT')
+                throw err;
+            const parent = dirname(probe);
+            if (parent === probe)
+                break;
+            probe = parent;
+        }
+    }
+    return target;
+}
+function statPayload(s) {
+    return {
+        kind: s.isDirectory() ? 'directory' : 'file',
+        size: s.isDirectory() ? 0 : s.size,
+        mtime: Math.round(s.mtimeMs),
+    };
+}
+/**
+ * Resolve the configured mappings to realpath'd roots. Mappings whose OS
+ * path does not exist (or is not a directory) are dropped with a warning —
+ * a missing folder must not take the whole /api surface down, and the
+ * webapp will surface the absent mount as "not mounted".
+ */
+export async function resolveHostMountRoots(mounts, warn = (msg) => console.warn(msg)) {
+    const roots = [];
+    for (const mapping of mounts) {
+        try {
+            const root = await realpath(mapping.hostPath);
+            const s = await stat(root);
+            if (!s.isDirectory()) {
+                warn(`--mount ${mapping.hostPath}: not a directory, skipping`);
+                continue;
+            }
+            roots.push({ path: mapping.path, root });
+        }
+        catch {
+            warn(`--mount ${mapping.hostPath}: does not exist, skipping`);
+        }
+    }
+    return roots;
+}
+function queryString(req, name) {
+    const value = req.query[name];
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+/**
+ * Register the /api/hostfs routes for the resolved mount roots. The route
+ * surface mirrors `MountBackend` 1:1 (webapp `backend-hostfs.ts`):
+ *
+ *   GET    /api/hostfs/list?mount=&path=          → { entries: [...] }
+ *   GET    /api/hostfs/stat?mount=&path=          → { kind, size, mtime }
+ *   GET    /api/hostfs/read?mount=&path=          → octet-stream body
+ *   PUT    /api/hostfs/write?mount=&path=         ← octet-stream body
+ *   POST   /api/hostfs/mkdir?mount=&path=
+ *   DELETE /api/hostfs/remove?mount=&path=[&recursive=1]
+ *
+ * Errors are `{ code, message }` JSON with an errno-derived status so the
+ * webapp backend can rethrow faithful `FsError`s.
+ */
+export function registerHostFsRoutes(app, roots) {
+    const byPath = new Map(roots.map((r) => [r.path, r]));
+    const withTarget = (handler) => {
+        return (req, res) => {
+            void (async () => {
+                const mount = queryString(req, 'mount');
+                const rel = queryString(req, 'path') ?? '';
+                const entry = mount ? byPath.get(mount) : undefined;
+                if (!entry) {
+                    res.status(404).json({ code: 'ENOENT', message: `no such mount: ${mount ?? ''}` });
+                    return;
+                }
+                try {
+                    const target = await resolveWithinRoot(entry.root, rel);
+                    await handler(target, req, res);
+                }
+                catch (err) {
+                    sendFsError(res, err);
+                }
+            })();
+        };
+    };
+    app.get('/api/hostfs/list', withTarget(async (target, _req, res) => {
+        const dirents = await readdir(target, { withFileTypes: true });
+        const entries = await Promise.all(dirents.map(async (d) => {
+            if (d.isDirectory())
+                return { name: d.name, kind: 'directory' };
+            try {
+                // stat() follows symlinks, so a link to a directory classifies as
+                // a directory — matching what every subsequent access sees (and
+                // the swift server, whose fileExists follows links). Escaping
+                // links are still refused at access time by resolveWithinRoot.
+                const s = await stat(resolve(target, d.name));
+                if (s.isDirectory())
+                    return { name: d.name, kind: 'directory' };
+                return {
+                    name: d.name,
+                    kind: 'file',
+                    size: s.size,
+                    lastModified: Math.round(s.mtimeMs),
+                };
+            }
+            catch {
+                // Raced deletion / dangling link / unreadable: name only.
+                return { name: d.name, kind: 'file' };
+            }
+        }));
+        res.json({ entries });
+    }));
+    app.get('/api/hostfs/stat', withTarget(async (target, _req, res) => {
+        res.json(statPayload(await stat(target)));
+    }));
+    app.get('/api/hostfs/read', withTarget(async (target, _req, res) => {
+        // lstat first so a dangling symlink is ENOENT, a directory is EISDIR.
+        const s = await stat(target);
+        if (s.isDirectory()) {
+            sendFsError(res, Object.assign(new Error(`is a directory: ${target}`), { code: 'EISDIR' }));
+            return;
+        }
+        if (s.size > HOSTFS_MAX_BODY_BYTES) {
+            res.status(413).json({
+                code: 'EFBIG',
+                message: `file exceeds the ${HOSTFS_MAX_BODY_BYTES} byte hostfs cap`,
+            });
+            return;
+        }
+        const body = await readFile(target);
+        res.setHeader('Content-Type', 'application/octet-stream');
+        res.send(body);
+    }));
+    app.put('/api/hostfs/write', express.raw({ type: () => true, limit: HOSTFS_MAX_BODY_BYTES }), withTarget(async (target, req, res) => {
+        // Refuse to clobber a directory with a file (fs would throw EISDIR on
+        // open, but check explicitly so the error is deterministic).
+        try {
+            const existing = await lstat(target);
+            if (existing.isDirectory()) {
+                sendFsError(res, Object.assign(new Error(`is a directory: ${target}`), { code: 'EISDIR' }));
+                return;
+            }
+        }
+        catch {
+            /* ENOENT — fresh file */
+        }
+        await mkdir(dirname(target), { recursive: true });
+        const body = Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0);
+        // Write-then-rename would break hardlinks and xattrs on user files;
+        // plain writeFile matches what local tools do.
+        await writeFile(target, body);
+        res.json({ ok: true });
+    }));
+    app.post('/api/hostfs/mkdir', withTarget(async (target, _req, res) => {
+        await mkdir(target, { recursive: true });
+        res.json({ ok: true });
+    }));
+    app.post('/api/hostfs/rename', withTarget(async (target, req, res) => {
+        const mount = queryString(req, 'mount');
+        const toRel = queryString(req, 'to');
+        const entry = mount ? byPath.get(mount) : undefined;
+        if (!entry || !toRel) {
+            res.status(400).json({ code: 'EINVAL', message: 'rename requires mount and to' });
+            return;
+        }
+        const to = await resolveWithinRoot(entry.root, toRel);
+        await rename(target, to);
+        res.json({ ok: true });
+    }));
+    app.delete('/api/hostfs/remove', withTarget(async (target, req, res) => {
+        const isRoot = roots.some((r) => r.root === target);
+        if (isRoot) {
+            res.status(403).json({ code: 'EACCES', message: 'refusing to remove a mount root' });
+            return;
+        }
+        const recursive = queryString(req, 'recursive') === '1';
+        await rm(target, { recursive, force: false });
+        res.json({ ok: true });
+    }));
+}

package/dist/node-server/index.js

@@ -30,6 +30,7 @@ import { getElectronAppPorts } from './electron-runtime.js';
 import { ElectronTrayFollower } from './electron-tray-follower.js';
 import { FileLogger } from './file-logger.js';
 import { registerHostedBootstrapEndpoint } from './hosted-bootstrap.js';
+import { registerHostFsRoutes, resolveHostMountRoots } from './hostfs.js';
 import { runInstallCli } from './install-cli.js';
 import { resolveCliBrowserLaunchUrl } from './launch-url.js';
 import { createHttpCdp, registerLeaderRestartEndpoint } from './leader-restart.js';
@@ -197,6 +198,7 @@ function createServerState() {
         electronFollower: null,
         shuttingDown: false,
         discoveredTrayJoinUrl: RUNTIME_FLAGS.joinUrl ?? null,
+        hostMountRoots: [],
         bridgeToken: resolveServerBridgeToken(process.env, { thinBridgeMode: THIN_BRIDGE_MODE }),
         cdpUrl: null,
         chromeWs: null,
@@ -1106,6 +1108,10 @@ async function main() {
             // after `server.listen()`, so this endpoint must NOT close over a
             // pre-launch snapshot or it would always return null.
             trayJoinUrl: state.discoveredTrayJoinUrl ?? null,
+            // Mount table (--mount=<os-path>:<slicc-path>): served over
+            // /api/hostfs and auto-mounted by the webapp at boot. Only mappings
+            // whose OS folder existed at startup are advertised.
+            autoMounts: state.hostMountRoots.map(({ path, root }) => ({ path, hostPath: root })),
         });
     });
     // Localhost API descriptor — the discoverable surface advertised by the
@@ -1144,6 +1150,10 @@ async function main() {
         registerHostedBootstrapEndpoint(app, { secretStore });
         registerSecretsReloadEndpoint(app, { secretProxy, secretStore, oauthStore });
     }
+    // Host-FS bridge for the mount table (--mount=<os>:<vfs>), every mode.
+    // Roots are resolved once at startup; a folder created later needs a restart.
+    state.hostMountRoots = await resolveHostMountRoots(RUNTIME_FLAGS.mounts);
+    registerHostFsRoutes(app, state.hostMountRoots);
     // Sudo approval endpoint — raises a native OS dialog / TTY prompt from this
     // trusted process so the in-browser agent can request, but never fabricate,
     // an approval. Loopback-only; selects a backend by environment at call time.

package/dist/node-server/routes/fetch-proxy.js

@@ -1,6 +1,6 @@
 import { Readable, Transform } from 'node:stream';
 import { StringDecoder } from 'node:string_decoder';
-import { HMAC_SIGN_HEADER, isTextContentType } from '../_shared/index.js';
+import { HMAC_SIGN_HEADER, isLoopbackOrigin, isTextContentType } from '../_shared/index.js';
 import { FETCH_PROXY_CONTENT_LENGTH_HEADER, FETCH_PROXY_SKIP_HEADERS, FETCH_PROXY_SKIP_RESPONSE_HEADERS, FETCH_PROXY_SKIP_RESPONSE_PREFIXES, } from '../fetch-proxy-headers.js';
 import { AgentActivityTracker, registerAgentActivityRoute } from './agent-activity.js';
 /** Pick the first value of a possibly-multi-valued request header. */
@@ -9,21 +9,6 @@ function firstHeaderValue(value) {
         return undefined;
     return Array.isArray(value) ? value[0] : value;
 }
-/** True when an origin/referer value points at localhost (any family). */
-function isLocalhostOrigin(origin) {
-    if (!origin)
-        return false;
-    try {
-        const url = new URL(origin);
-        return (url.hostname === 'localhost' ||
-            url.hostname === '127.0.0.1' ||
-            url.hostname === '::1' ||
-            url.hostname === '[::1]');
-    }
-    catch {
-        return false;
-    }
-}
 /** Get the body — either from express.json()'s parsed body or raw chunks. */
 async function collectRawBody(req) {
     if (req.body && typeof req.body === 'object' && Object.keys(req.body).length > 0) {
@@ -58,7 +43,7 @@ function buildForwardHeaders(req, targetUrl) {
     if (proxyOrigin) {
         headers.origin = proxyOrigin;
     }
-    else if (isLocalhostOrigin(headers.origin)) {
+    else if (isLoopbackOrigin(headers.origin)) {
         // Only strip the browser's auto-added localhost origin; preserve legitimate origins.
         delete headers.origin;
     }
@@ -77,7 +62,7 @@ function buildForwardHeaders(req, targetUrl) {
     if (proxyReferer) {
         headers.referer = proxyReferer;
     }
-    else if (isLocalhostOrigin(headers.referer)) {
+    else if (isLoopbackOrigin(headers.referer)) {
         delete headers.referer;
     }
     // Restore any X-Proxy-Proxy-* transport headers as Proxy-* headers

package/dist/node-server/runtime-flags.d.ts

@@ -24,7 +24,29 @@ export interface CliRuntimeFlags {
     installCli: boolean;
     /** Target directory for --install-cli (default: OS-idiomatic, see install-cli.ts) */
     installDir: string | null;
+    /**
+     * Mount table: OS-folder → SLICC-target mappings served over the local
+     * host-FS bridge (`/api/hostfs`) and auto-mounted by the webapp at boot,
+     * with no picker and no Chrome permission prompt. Filled by repeatable
+     * `--mount=<os-path>:<slicc-path>` / `--mount <os-path>:<slicc-path>`
+     * flags. Picker-initiated (`mount <path>`) FS-Access mounts are
+     * unaffected and keep asking for permission.
+     */
+    mounts: HostMountMapping[];
+}
+/** One `--mount` entry: an absolute OS folder mapped to a VFS target. */
+export interface HostMountMapping {
+    hostPath: string;
+    path: string;
 }
 export declare const DEFAULT_CLI_CDP_PORT = 9222;
 export declare const DEFAULT_ELECTRON_ATTACH_CDP_PORT = 9223;
+/**
+ * Parse a `--mount` value of the form `<os-path>:<slicc-path>`. The split is
+ * on the LAST `:` whose remainder is an absolute path, so OS paths containing
+ * `:` still parse. A leading `~/` on the OS side expands against `homeDir`.
+ * Returns null (never a partial mapping) for anything else, so a stray
+ * `--mount=` or a one-sided value never lands in the table.
+ */
+export declare function parseMountTableMapping(value: string, homeDir?: string): HostMountMapping | null;
 export declare function parseCliRuntimeFlags(argv: string[]): CliRuntimeFlags;