Codeman

1,957 Commits 58 Branches 191 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
Codeman maintainer	15ae5f5d81	fix(deepseek): make the web-UI shortcut pick a free port, verify it, and trust its frame The `Run > DeepSeek web UI...` shortcut failed three ways at once against a real install, and the three are independent. 1. It hardcoded `--port 3080`. That is dsh web's OWN default, which makes it precisely the port a DeepSeek user is most likely to be serving on already, so the launch died with EADDRINUSE against the user's own server. The port now comes from `GET /api/deepseek/web-port`, which walks 3080..3119 for a free loopback port by BINDING it (a connect probe cannot tell "free" from "listening but not answering yet"). 2. It opened the tab unconditionally. The crashed server left a saved dashboard pointing at nothing, with the failure only visible in a shell tab nobody had a reason to look at. The launch now polls the existing webview probe until the URL answers, and on timeout reports the error naming the shell tab instead of persisting a dead dashboard. 3. The saved tab was untrusted, so the frame was sandboxed without `allow-same-origin` and the dashboard was broken twice over: the dsh client-runtime reads `localStorage` while loading its plugins and died there ("the document is sandboxed and lacks the 'allow-same-origin' flag"), and an opaque-origin frame sends `Origin: null`, so dsh's own trust fence 403'd every `/api` call no matter which authority `--trusted-host` named. Passing `location.host` only means anything once the frame actually carries that origin, so `--trusted-host` had never once done its job. The managed tab is now created `trusted: true`. That trade is real and deliberate: a trusted proxied frame is same-origin with Codeman and can reach Codeman's API. It is defensible only because this dashboard is an agent harness Codeman just started itself, on loopback, which can already run code as the user. It is not a precedent for trusting third-party dashboards, which is why it is set at this one call site rather than defaulted. Separately, the shortcut listed its own dashboard twice: once as the menu entry that starts it and once as the row that entry had written on the previous click. Webviews now carry an optional `managed` marker, managed rows are filtered out of the saved-dashboard list, and a relaunch repoints the existing row rather than stacking one dead dashboard per restart (which the per-launch port would otherwise guarantee). `managed` is declared in the schema because a plain `z.object` strips undeclared keys, so an undeclared marker would never survive the round trip. `DEEPSEEK_WEB_PORT` is gone from constants.js; its doc comment asserted that a hand-started `dsh web` and the shortcut "land on the same place and share one saved tab", which is the bug stated as a feature. Verified on a real install with the user's own `dsh web` holding 3080: the shortcut takes 3081, the server answers, exactly one DeepSeek entry shows in the run menu, and the proxied dashboard renders its workspaces and completes its own API calls (the previously-403'd `api/settings.describe` now succeeds). Full gate green (6142 passed), typecheck/lint/format/public-assets clean.	2026-08-25 02:39:57 +02:00
Codeman maintainer	b34fcaf928	feat(web-tabs): open dashboard URLs as tabs beside agent sessions Adds a "Web / URL" section to the Run dropdown. A saved URL renders as a tab in the same strip as Claude/Codex/Gemini sessions, with the same Alt+1..9 numbering, so Codeman is one mission control instead of Codeman plus a pile of browser tabs. A webview is NOT a sixth SessionMode: no PTY, no tmux, no respawn, no idle detection. It is a separate resource sharing only the tab strip and the main content area, the same call that keeps Docker and remote-SSH as case overlays. Dashboards are proxied through Codeman's own origin, because a direct iframe fails three ways at once in the shipped deployment: prod serves HTTPS behind tailscale serve, so http:// targets are hard-blocked as mixed content (with no override at all on iOS Safari); Grafana/Portainer-class dashboards send X-Frame-Options: DENY; and our own default-src 'self' CSP blocks cross-origin frames. Proxying dissolves all three and leaves the production CSP byte-for-byte unchanged, since /webview/... is already covered by 'self'. A useful side effect: the fetch happens server-side, so a tailnet-only dashboard is reachable from a phone that is not on the tailnet. The proxy is not an API surface. It authenticates on a 192-bit capability in the path (memory-only, rolling TTL, bound to the minting user, revoked on edit or delete) and is correspondingly exempt from the cookie and Origin checks, because a sandboxed iframe is opaque-origin: it sends no SameSite=lax cookie and its writes arrive with Origin: null. The Host allowlist is never bypassed. A second Referer-keyed form of the exemption exists for root-absolute assets and is fenced to safe methods on non-/api, non-/ws, non-/q paths. Iframes omit allow-same-origin unless a URL is explicitly marked trusted, since a proxied page is served from Codeman's own origin and could otherwise read this document and drive the agent-spawning API. Authorization and codeman_session are stripped upstream in BOTH modes, so CODEMAN_PASSWORD cannot leak into a dashboard. Two things only a real browser reveals, both presenting as the dashboard's own "Failed to fetch" while the page itself renders fine: - Runtime-built root-absolute URLs (fetch('/api/data')) escape <base href> and land on Codeman's root. Widening the Referer fallback into /api would trade security for it, so an injected shim patches fetch/XHR/WebSocket/EventSource inside the frame instead, removing the class rather than the guard. - An opaque-origin document CORS-checks every request, including to the host it was served from. Script/css/img loads are not CORS-checked, which is why the page renders while its API calls die. The proxy now emits CORS headers and answers preflights itself. registerSecurityHeaders answered every OPTIONS with a bare 204 before routing, carrying no ACAO for Origin: null, so that short-circuit now exempts a valid capability. Neither is reproducible with curl, which does not enforce CORS. Also fixes a pre-existing bug found on the way: .toolbar has backdrop-filter, making it a stacking context that trapped .run-mode-menu's z-index:1000, so .welcome-overlay painted over the whole Run menu. With no session open, every item in it (Claude Code included) was unclickable. Verified end to end against a real tailnet dashboard: live data, WebSocket push, no failed requests, and switching tabs does not reload the frame. 98 new tests cover the pure rewrite helpers, the CORS helper, the shim's rewrite logic, route CRUD, and every edge of the auth exemption. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 17:06:36 +02:00

Author

SHA1

Message

Date

Codeman maintainer

15ae5f5d81

fix(deepseek): make the web-UI shortcut pick a free port, verify it, and trust its frame

The `Run > DeepSeek web UI...` shortcut failed three ways at once against a real
install, and the three are independent.

1. It hardcoded `--port 3080`. That is dsh web's OWN default, which makes it
   precisely the port a DeepSeek user is most likely to be serving on already,
   so the launch died with EADDRINUSE against the user's own server. The port
   now comes from `GET /api/deepseek/web-port`, which walks 3080..3119 for a
   free loopback port by BINDING it (a connect probe cannot tell "free" from
   "listening but not answering yet").

2. It opened the tab unconditionally. The crashed server left a saved dashboard
   pointing at nothing, with the failure only visible in a shell tab nobody had
   a reason to look at. The launch now polls the existing webview probe until
   the URL answers, and on timeout reports the error naming the shell tab
   instead of persisting a dead dashboard.

3. The saved tab was untrusted, so the frame was sandboxed without
   `allow-same-origin` and the dashboard was broken twice over: the dsh
   client-runtime reads `localStorage` while loading its plugins and died there
   ("the document is sandboxed and lacks the 'allow-same-origin' flag"), and an
   opaque-origin frame sends `Origin: null`, so dsh's own trust fence 403'd
   every `/api` call no matter which authority `--trusted-host` named. Passing
   `location.host` only means anything once the frame actually carries that
   origin, so `--trusted-host` had never once done its job. The managed tab is
   now created `trusted: true`.

   That trade is real and deliberate: a trusted proxied frame is same-origin
   with Codeman and can reach Codeman's API. It is defensible only because this
   dashboard is an agent harness Codeman just started itself, on loopback, which
   can already run code as the user. It is not a precedent for trusting
   third-party dashboards, which is why it is set at this one call site rather
   than defaulted.

Separately, the shortcut listed its own dashboard twice: once as the menu entry
that starts it and once as the row that entry had written on the previous click.
Webviews now carry an optional `managed` marker, managed rows are filtered out
of the saved-dashboard list, and a relaunch repoints the existing row rather
than stacking one dead dashboard per restart (which the per-launch port would
otherwise guarantee). `managed` is declared in the schema because a plain
`z.object` strips undeclared keys, so an undeclared marker would never survive
the round trip.

`DEEPSEEK_WEB_PORT` is gone from constants.js; its doc comment asserted that a
hand-started `dsh web` and the shortcut "land on the same place and share one
saved tab", which is the bug stated as a feature.

Verified on a real install with the user's own `dsh web` holding 3080: the
shortcut takes 3081, the server answers, exactly one DeepSeek entry shows in the
run menu, and the proxied dashboard renders its workspaces and completes its own
API calls (the previously-403'd `api/settings.describe` now succeeds). Full gate
green (6142 passed), typecheck/lint/format/public-assets clean.

2026-08-25 02:39:57 +02:00

Codeman maintainer

b34fcaf928

feat(web-tabs): open dashboard URLs as tabs beside agent sessions

Adds a "Web / URL" section to the Run dropdown. A saved URL renders as a tab in
the same strip as Claude/Codex/Gemini sessions, with the same Alt+1..9 numbering,
so Codeman is one mission control instead of Codeman plus a pile of browser tabs.

A webview is NOT a sixth SessionMode: no PTY, no tmux, no respawn, no idle
detection. It is a separate resource sharing only the tab strip and the main
content area, the same call that keeps Docker and remote-SSH as case overlays.

Dashboards are proxied through Codeman's own origin, because a direct iframe
fails three ways at once in the shipped deployment: prod serves HTTPS behind
tailscale serve, so http:// targets are hard-blocked as mixed content (with no
override at all on iOS Safari); Grafana/Portainer-class dashboards send
X-Frame-Options: DENY; and our own default-src 'self' CSP blocks cross-origin
frames. Proxying dissolves all three and leaves the production CSP byte-for-byte
unchanged, since /webview/... is already covered by 'self'. A useful side effect:
the fetch happens server-side, so a tailnet-only dashboard is reachable from a
phone that is not on the tailnet.

The proxy is not an API surface. It authenticates on a 192-bit capability in the
path (memory-only, rolling TTL, bound to the minting user, revoked on edit or
delete) and is correspondingly exempt from the cookie and Origin checks, because
a sandboxed iframe is opaque-origin: it sends no SameSite=lax cookie and its
writes arrive with Origin: null. The Host allowlist is never bypassed. A second
Referer-keyed form of the exemption exists for root-absolute assets and is fenced
to safe methods on non-/api, non-/ws, non-/q paths.

Iframes omit allow-same-origin unless a URL is explicitly marked trusted, since a
proxied page is served from Codeman's own origin and could otherwise read this
document and drive the agent-spawning API. Authorization and codeman_session are
stripped upstream in BOTH modes, so CODEMAN_PASSWORD cannot leak into a dashboard.

Two things only a real browser reveals, both presenting as the dashboard's own
"Failed to fetch" while the page itself renders fine:

- Runtime-built root-absolute URLs (fetch('/api/data')) escape <base href> and
  land on Codeman's root. Widening the Referer fallback into /api would trade
  security for it, so an injected shim patches fetch/XHR/WebSocket/EventSource
  inside the frame instead, removing the class rather than the guard.
- An opaque-origin document CORS-checks every request, including to the host it
  was served from. Script/css/img loads are not CORS-checked, which is why the
  page renders while its API calls die. The proxy now emits CORS headers and
  answers preflights itself. registerSecurityHeaders answered every OPTIONS with
  a bare 204 before routing, carrying no ACAO for Origin: null, so that
  short-circuit now exempts a valid capability.

Neither is reproducible with curl, which does not enforce CORS.

Also fixes a pre-existing bug found on the way: .toolbar has backdrop-filter,
making it a stacking context that trapped .run-mode-menu's z-index:1000, so
.welcome-overlay painted over the whole Run menu. With no session open, every
item in it (Claude Code included) was unclickable.

Verified end to end against a real tailnet dashboard: live data, WebSocket push,
no failed requests, and switching tabs does not reload the frame. 98 new tests
cover the pure rewrite helpers, the CORS helper, the shim's rewrite logic, route
CRUD, and every edge of the auth exemption.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-07-27 17:06:36 +02:00