Public, free to read, reuse, and adapt — Kirk Patrick Miller's notice for this edition. Not a patent grant.
Public work excerpts — privacy boundaries marked · c12
77aa591c4a · words 1413 · characters 120532–132424
Previous section · Next section
Exact section text · Full source · Source index
- Continuity — explicit wording in the guide row
const opt = (rel) => { try { return fs.readFileSync(path.join(repo, rel), 'utf8'); } catch (e) { return null; } };
const client = opt('docs/modules/agent-bridge-client.js');
const propose = opt('docs/modules/propose.js');
const workshop = opt('docs/modules/workshop.js');
const app = opt('docs/app.html');
const rootIndex = opt('index.html');
if (client) {
assert.ok(/X-FL-Bridge-Token/.test(client), 'client sends token header');
assert.ok(!/innerHTML/.test(client), 'client renders with textContent only');
assert.ok(!/\bconfirm\s*\(/.test(client), 'client never asks confirm()');
assert.ok(/renderPairedList/.test(client) && /\/pair\/revoke/.test(client), 'client has Paired minds with Revoke');
execFileSync(process.execPath, ['--check', path.join(repo, 'docs/modules/agent-bridge-client.js')]);
}
if (propose) {
assert.strictEqual((propose.match(/commitViaBridge\s*\(/g) || []).length, 3, 'CRITICAL LOCK 1A count unchanged');
assert.strictEqual((propose.match(/\/code\/git\/commit/g) || []).length, 1, 'CRITICAL LOCK 1B count unchanged');
assert.ok(/FLAgentBridge/.test(propose), 'propose routes bridge calls through FLAgentBridge when present');
}
if (workshop) {
assert.ok(/http:\/\/localhost:3141/.test(workshop) && /runCodeTask/.test(workshop), 'v5.71.8 workshop lock still true');
assert.ok(/FLAgentBridge/.test(workshop), 'workshop routes bridge calls through FLAgentBridge when present');
assert.ok(/renderPairedList/.test(workshop), 'workshop shows Paired minds');
}
if (app) {
assert.ok(/<script src="modules\/agent-bridge-client\.js" defer><\/script>/.test(app), 'app loads client');
assert.ok(app.indexOf('modules/agent-bridge-client.js') < app.indexOf('modules/propose.js'), 'client loads before propose');
if (rootIndex !== null) assert.strictEqual(rootIndex, app, 'root index.html byte-identical to docs/app.html');
}
## Exact source excerpt, characters 113089–113344
// ── Runtime helpers ──
function freePort() {
return new Promise((resolve, reject) => {
const s = net.createServer();
s.listen(0, '127.0.0.1', () => { const p = s.address().port; s.close(() => resolve(p)); });
s.on('error', reject);
});
}
## Exact source excerpt, characters 113346–114017
function req(port, opts, body) {
return new Promise((resolve) => {
const r = http.request({ host: '127.0.0.1', port, method: opts.method || 'GET', path: opts.path || '/',
headers: opts.headers || {} }, (res) => {
let buf = '';
res.setEncoding('utf8');
res.on('data', (c) => { buf += c; });
res.on('end', () => { let json = null; try { json = JSON.parse(buf); } catch (e) {} resolve({ status: res.statusCode, headers: res.headers, json, text: buf }); });
});
r.on('error', (e) => resolve({ status: 0, error: e }));
if (body !== undefined) r.write(typeof body === 'string' ? body : JSON.stringify(body));
r.end();
});
}
## Exact source excerpt, characters 114019–114319
function connectRefused(host, port) {
return new Promise((resolve) => {
const s = net.connect({ host, port, timeout: 1500 });
s.on('connect', () => { s.destroy(); resolve(false); });
s.on('timeout', () => { s.destroy(); resolve(true); });
s.on('error', () => resolve(true));
});
}
## Exact source excerpt, characters 114877–115878
const children = new Set();
async function startBridge(env, cwd) {
const child = spawn(process.execPath, [BRIDGE], { env, cwd, stdio: ['ignore', 'pipe', 'pipe'] });
children.add(child);
const h = { child, out: '' };
child.stdout.on('data', (c) => { h.out += c.toString(); });
child.stderr.on('data', (c) => { h.out += c.toString(); });
for (let i = 0; i < 200 && !/Pairing code:/.test(h.out); i++) await new Promise((r) => setTimeout(r, 25));
h.code = () => { const all = [...h.out.matchAll(/Pairing code: ([A-Z0-9]{3})-([A-Z0-9]{3})/g)]; const m = all.pop(); return m ? m[1] + '-' + m[2] : ''; };
h.stop = () => new Promise((resolve) => { if (child.exitCode !== null) return resolve(); child.once('exit', () => resolve()); child.kill(); });
return h;
}
function cli(env, cwd, args) {
const r = spawnSync(process.execPath, [BRIDGE].concat(args), { env, cwd, encoding: 'utf8', timeout: 20000 });
return { status: r.status, out: String(r.stdout || '') + String(r.stderr || '') };
}
## Exact source excerpt, characters 115880–116053
(async function main() {
try { execFileSync('git', ['--version'], { stdio: 'ignore' }); }
catch (e) { console.error('git is required for this smoke'); process.exit(1); }
## Exact source excerpt, characters 116055–116439
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'fl-bridge-lock-'));
const home = path.join(tmp, 'home');
const home2 = path.join(tmp, 'home2');
const proj = path.join(tmp, 'proj');
const proj2 = path.join(tmp, 'proj2');
const sibling = path.join(tmp, 'proj-evil');
fs.mkdirSync(home); fs.mkdirSync(home2); fs.mkdirSync(sibling);
gitProject(proj); gitProject(proj2);
## Exact source excerpt, characters 116441–117049
const port = await freePort();
const env = Object.assign({}, process.env, { HOME: home, USERPROFILE: home, FL_PORT: String(port), FL_PROJECT: proj });
delete env.FL_BRIDGE_EPHEMERAL;
let b = null;
const done = async (code) => {
for (const c of children) { try { c.kill(); } catch (e) {} }
try { fs.rmSync(tmp, { recursive: true, force: true }); } catch (e) {}
process.exit(code);
};
const fail = (e) => { console.error('FAIL', e && e.message); console.error(b ? b.out.slice(-2500) : ''); done(1); };
process.on('uncaughtException', fail);
process.on('unhandledRejection', fail);
## Exact source excerpt, characters 117051–117318
b = await startBridge(env, proj);
assert.ok(new RegExp('Listening on http://127\\.0\\.0\\.1:' + port).test(b.out), 'bridge says it listens on 127.0.0.1');
assert.ok(/Trusted minds: \d+ \(kept until you revoke/.test(b.out), 'bridge says trusted minds are kept');
## Exact source excerpt, characters 117320–118149
// Local tools are trusted by default through the private token file.
const dataDir = path.join(home, '.freelattice');
const tokenFile = path.join(dataDir, 'agent-bridge-token');
const trustFile = path.join(dataDir, 'agent-bridge-trusted.json');
const token = fs.readFileSync(tokenFile, 'utf8').trim();
assert.ok(/^[a-f0-9]{64}$/.test(token), 'local tools token is 32 random bytes hex');
if (process.platform !== 'win32') {
assert.strictEqual(fs.statSync(tokenFile).mode & 0o077, 0, 'token file is private (0600)');
assert.strictEqual(fs.statSync(trustFile).mode & 0o077, 0, 'trusted minds file is private (0600)');
}
let trustText = fs.readFileSync(trustFile, 'utf8');
assert.ok(trustText.includes(sha(token)) && !trustText.includes(token), 'trust file holds only the hash of the local tools token');
## Exact source excerpt, characters 118151–118404
const GOOD = 'https://freelattice.com';
const EVIL = 'https://evil.example';
const J = { 'Content-Type': 'application/json' };
const as = (t, h) => Object.assign({}, J, h || {}, { 'X-FL-Bridge-Token': t });
const withTok = (h) => as(token, h);
## Exact source excerpt, characters 118406–118799
// Binding: not reachable on any non-loopback IPv4.
const ifaces = Object.values(os.networkInterfaces()).flat().filter((i) => i && i.family === 'IPv4' && !i.internal);
for (const i of ifaces) assert.ok(await connectRefused(i.address, port), 'not reachable on ' + i.address);
if (!ifaces.length) console.log(' (no external IPv4 interface to probe; static + log checks cover binding)');
## Exact source excerpt, characters 118801–119125
// T1 preflight from evil origin → 403, no ACAO.
let r = await req(port, { method: 'OPTIONS', path: '/code/write', headers: { Origin: EVIL, 'Access-Control-Request-Method': 'POST' } });
assert.strictEqual(r.status, 403, 'evil preflight 403');
assert.ok(!r.headers['access-control-allow-origin'], 'no ACAO for evil');
## Exact source excerpt, characters 119127–119660
// T2 evil origin even with a valid token → 403.
r = await req(port, { method: 'POST', path: '/code/write', headers: withTok({ Origin: EVIL }) }, { path: 'x.txt', content: 'x' });
assert.strictEqual(r.status, 403, 'evil POST 403 even with token');
assert.ok(!fs.existsSync(path.join(proj, 'x.txt')), 'evil write did not land');
r = await req(port, { method: 'POST', path: '/code/git/commit', headers: withTok({ Origin: EVIL }) }, { message: 'evil' });
assert.strictEqual(r.status, 403, 'evil commit 403 even with token');
## Exact source excerpt, characters 119662–120814
// T3 good preflight → 204, echoes origin, allows token header. Tauri shell too.
r = await req(port, { method: 'OPTIONS', path: '/code/write', headers: { Origin: GOOD, 'Access-Control-Request-Method': 'POST', 'Access-Control-Request-Headers': 'content-type,x-fl-bridge-token' } });
assert.strictEqual(r.status, 204, 'good preflight 204');
assert.strictEqual(r.headers['access-control-allow-origin'], GOOD, 'ACAO echoes the named origin');
assert.ok(/x-fl-bridge-token/i.test(r.headers['access-control-allow-headers'] || ''), 'token header allowed');
assert.ok(/origin/i.test(r.headers['vary'] || ''), 'Vary: Origin');
for (const t of ['tauri://localhost', 'http://tauri.localhost', 'https://tauri.localhost']) {
r = await req(port, { method: 'OPTIONS', path: '/code/write', headers: { Origin: t, 'Access-Control-Request-Method': 'POST' } });
assert.strictEqual(r.status, 204, 'Tauri origin allowed: ' + t);
}
r = await req(port, { method: 'OPTIONS', path: '/', headers: { Origin: 'https://kirk.dev', 'Access-Control-Request-Method': 'GET' } });
assert.strictEqual(r.status, 403, 'unlisted origin 403 before Kirk trusts it');
## Exact source excerpt, characters 120816–121248
// T4 heartbeat stays open and says it is locked.
r = await req(port, { path: '/', headers: { Origin: GOOD } });
assert.strictEqual(r.status, 200, 'heartbeat 200');
assert.strictEqual(r.json.bridgeLock, 'v0.1', 'heartbeat bridgeLock v0.1');
assert.strictEqual(r.json.trustedMinds, 'persistent', 'heartbeat says trusted minds persist');
assert.ok(!JSON.stringify(r.json).includes(token), 'heartbeat never leaks a token');
## Exact source excerpt, characters 121250–122578
// T5 no token → 401 on writes, commits, code reads, test runs and LP pay.
r = await req(port, { method: 'POST', path: '/code/write', headers: Object.assign({ Origin: GOOD }, J) }, { path: 'x.txt', content: 'x' });
assert.strictEqual(r.status, 401, 'no token write 401');
r = await req(port, { method: 'POST', path: '/code/git/commit', headers: Object.assign({ Origin: GOOD }, J) }, { message: 'nope' });
assert.strictEqual(r.status, 401, 'no token commit 401');
r = await req(port, { method: 'POST', path: '/code/write', headers: as('f'.repeat(64), { Origin: GOOD }) }, { path: 'x.txt', content: 'x' });
assert.strictEqual(r.status, 401, 'wrong token 401');
r = await req(port, { path: '/code/read?path=README.md' });
assert.strictEqual(r.status, 401, 'no-origin code read without token 401');
r = await req(port, { path: '/test/run' });
assert.strictEqual(r.status, 401, 'test run without token 401 (an <img> tag cannot run smoke)');
r = await req(port, { method: 'POST', path: '/wallet/pay', headers: Object.assign({ Origin: GOOD }, J) }, { address: 'a', amount: 1 });
assert.strictEqual(r.status, 401, 'LP wallet pay without token 401 (AI never auto-pays)');
r = await req(port, { path: '/pair/list', headers: { Origin: GOOD } });
assert.strictEqual(r.status, 401, 'paired list needs a token');
## Exact source excerpt, characters 122580–122751
// T6 DNS-rebinding Host → 403.
r = await req(port, { path: '/', headers: { Host: 'evil.example:' + port } });
assert.strictEqual(r.status, 403, 'foreign Host 403');
## Exact source excerpt, characters 122753–125006