jasonku09/grill-with-ui

# no-mistakes per-repo config — gates a branch through # review → test → document → lint → push → PR → CI in a disposable worktree, # then opens a clean PR.  Docs: https://kunchenguid.github.io/no-mistakes/

# review → test → document → lint → push → PR → CI in a disposable worktree, # then opens a clean PR.  Docs: https://kunchenguid.github.io/no-mistakes/ #

# then opens a clean PR.  Docs: https://kunchenguid.github.io/no-mistakes/

The skill is a plain [Agent Skills](https://agentskills.io) folder (`SKILL.md` plus one

git clone https://github.com/jasonku09/grill-with-ui ~/Projects/grill-with-ui

a loopback request never gets that pass. The port is required: avoid `--port 80`, since browsers omit that default port from Host and are refused. Local clients such as curl remain trusted: POSTs without an Origin header are allowed after t

<meta name="viewport" content="width=device-width, initial-scale=1" /> <title>grill · grill-with-ui skill · Inbox (clean)</title> <link rel="preconnect" href="https://fonts.googleapis.com" />

<title>grill · grill-with-ui skill · Inbox (clean)</title> <link rel="preconnect" href="https://fonts.googleapis.com" /> <link href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400;9..144,500&family=IBM+Plex+Sans:wght

<link rel="preconnect" href="https://fonts.googleapis.com" />

<link href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400;9..144,500&family=IBM+Plex+Sans:wght@400;500;600&display=swap" rel="stylesheet" />

<meta name="viewport" content="width=device-width, initial-scale=1" /> <title>grill · grill-with-ui skill · Inbox (clean)</title> <link rel="preconnect" href="https://fonts.googleapis.com" />

<title>grill · grill-with-ui skill · Inbox (clean)</title> <link rel="preconnect" href="https://fonts.googleapis.com" /> <link href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400;9..144,500&family=IBM+Plex+Sans:wght

<link rel="preconnect" href="https://fonts.googleapis.com" />

<link href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400;9..144,500&family=IBM+Plex+Sans:wght@400;500;600&display=swap" rel="stylesheet" />

<meta name="viewport" content="width=device-width, initial-scale=1" /> <title>grill · grill-with-ui skill · Inbox</title> <link rel="preconnect" href="https://fonts.googleapis.com" />

<title>grill · grill-with-ui skill · Inbox</title> <link rel="preconnect" href="https://fonts.googleapis.com" /> <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300..700;1,9..144,300..700&family=IBM+Ple

<link rel="preconnect" href="https://fonts.googleapis.com" />

<link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300..700;1,9..144,300..700&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet" />

body {     font-family: var(--sans); color: var(--ink); background: var(--paper);     background-image: radial-gradient(1200px 600px at 10% -10%, #fbf7ee 0%, transparent 60%), url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg

font-family: var(--sans); color: var(--ink); background: var(--paper);     background-image: radial-gradient(1200px 600px at 10% -10%, #fbf7ee 0%, transparent 60%), url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16

background-image: radial-gradient(1200px 600px at 10% -10%, #fbf7ee 0%, transparent 60%), url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='160' height='160'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' ba

<meta name="viewport" content="width=device-width, initial-scale=1" /> <title>grill · grill-with-ui skill · Inbox</title> <link rel="preconnect" href="https://fonts.googleapis.com" />

<title>grill · grill-with-ui skill · Inbox</title> <link rel="preconnect" href="https://fonts.googleapis.com" /> <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300..700;1,9..144,300..700&family=IBM+Ple

<link rel="preconnect" href="https://fonts.googleapis.com" />

<link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300..700;1,9..144,300..700&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet" />

body {     font-family: var(--sans); color: var(--ink); background: var(--paper);     background-image: radial-gradient(1200px 600px at 10% -10%, #fbf7ee 0%, transparent 60%), url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg

font-family: var(--sans); color: var(--ink); background: var(--paper);     background-image: radial-gradient(1200px 600px at 10% -10%, #fbf7ee 0%, transparent 60%), url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16

background-image: radial-gradient(1200px 600px at 10% -10%, #fbf7ee 0%, transparent 60%), url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='160' height='160'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' ba

<meta name="viewport" content="width=device-width, initial-scale=1" /> <title>grill · grill-with-ui skill · Scroll</title> <link rel="preconnect" href="https://fonts.googleapis.com" />

<title>grill · grill-with-ui skill · Scroll</title> <link rel="preconnect" href="https://fonts.googleapis.com" /> <link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600&family=JetBrains+Mono:wght@400;500;700&display=swap

<link rel="preconnect" href="https://fonts.googleapis.com" />

<link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet" />

<meta name="viewport" content="width=device-width, initial-scale=1" /> <title>grill · grill-with-ui skill · Scroll</title> <link rel="preconnect" href="https://fonts.googleapis.com" />

<title>grill · grill-with-ui skill · Scroll</title> <link rel="preconnect" href="https://fonts.googleapis.com" /> <link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600&family=JetBrains+Mono:wght@400;500;700&display=swap

<link rel="preconnect" href="https://fonts.googleapis.com" />

<link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet" />

<meta name="viewport" content="width=device-width, initial-scale=1" /> <title>grill · grill-with-ui skill · Tree + Focus</title> <link rel="preconnect" href="https://fonts.googleapis.com" />

<title>grill · grill-with-ui skill · Tree + Focus</title> <link rel="preconnect" href="https://fonts.googleapis.com" /> <link href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,300..800&family=Atkinson+Hyper

<link rel="preconnect" href="https://fonts.googleapis.com" />

<link href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,300..800&family=Atkinson+Hyperlegible:wght@400;700&family=Fira+Code:wght@400;600&display=swap" rel="stylesheet" />

<meta name="viewport" content="width=device-width, initial-scale=1" /> <title>grill · grill-with-ui skill · Tree + Focus</title> <link rel="preconnect" href="https://fonts.googleapis.com" />

<title>grill · grill-with-ui skill · Tree + Focus</title> <link rel="preconnect" href="https://fonts.googleapis.com" /> <link href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,300..800&family=Atkinson+Hyper

<link rel="preconnect" href="https://fonts.googleapis.com" />

<link href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,300..800&family=Atkinson+Hyperlegible:wght@400;700&family=Fira+Code:wght@400;600&display=swap" rel="stylesheet" />

Executable file

Executable file

need a valid `t` token, or get a 403), then #8's `__GRILL_THEME__` placeholder replacement   on `GET /`. - **Extra fix:** #8's `fetch("/theme", …)` in `page.html` is wrapped with #25's

on `GET /`. - **Extra fix:** #8's `fetch("/theme", …)` in `page.html` is wrapped with #25's   `withToken(…)`.

- **Extra fix:** #8's `fetch("/theme", …)` in `page.html` is wrapped with #25's

Executable file

// Build links next, formatting the label but keeping the URL literal.   // The finished <a> tags are stashed like code spans so bold/italic   // never rewrites the href (e.g. https://example.com/_docs_/x).

// never rewrites the href (e.g. https://example.com/_docs_/x).

async function poll() {   try {     const r = await fetch(withToken("/state"), { cache: "no-store" });

try {     const r = await fetch(withToken("/state"), { cache: "no-store" });     if (!r.ok) throw new Error(String(r.status));

const r = await fetch(withToken("/state"), { cache: "no-store" });

if (gone) { gone = false; render(); }     const was = unheard();     listener = await fetch(withToken("/listener"), { cache: "no-store" }).then((x) => (x.ok ? x.json() : null)).catch(() => null);

const was = unheard();     listener = await fetch(withToken("/listener"), { cache: "no-store" }).then((x) => (x.ok ? x.json() : null)).catch(() => null);     if (text !== raw) { raw = text; S = JSON.parse(text); onState(); } else if (unhear

listener = await fetch(withToken("/listener"), { cache: "no-store" }).then((x) => (x.ok ? x.json() : null)).catch(() => null);

async function post(actions) {   let r, j = {};   try { r = await fetch(withToken("/send"), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ actions }) }); j = await r.json().catch(() => ({})); } cat

let r, j = {};   try { r = await fetch(withToken("/send"), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ actions }) }); j = await r.json().catch(() => ({})); } catch { r = null; }   if (!j.ok) $("

try { r = await fetch(withToken("/send"), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ actions }) }); j = await r.json().catch(() => ({})); } catch { r = null; }

theme = THEMES[(THEMES.indexOf(theme) + 1) % THEMES.length];   applyTheme();   fetch(withToken("/theme"), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ theme }) }).catch(() => {});

applyTheme();   fetch(withToken("/theme"), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ theme }) }).catch(() => {}); };

fetch(withToken("/theme"), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ theme }) }).catch(() => {});

#!/usr/bin/env node

// Browsers set Origin on every POST, same-origin or not; reject a mismatch so another tab (or   // the sandboxed visual iframe, whose Origin is "null") can't forge a request. No Origin at all —   // curl, wait mode, this project's own test

// the sandboxed visual iframe, whose Origin is "null") can't forge a request. No Origin at all —   // curl, wait mode, this project's own tests — is still allowed. http://localhost:<port> is this   // same server, so that spelling passes t

// curl, wait mode, this project's own tests — is still allowed. http://localhost:<port> is this

const srv = http.createServer(async (req, res) => {     const u = new URL(req.url, "http://x");

const u = new URL(req.url, "http://x");

// Without the token a LAN neighbor could curl a send into the agent's

const { port } = srv.address();     const display = anyInterface ? "127.0.0.1" : host;     let url = `http://${display}:${port}/`;

const display = anyInterface ? "127.0.0.1" : host;     let url = `http://${display}:${port}/`;     let lanUrl = null;

let url = `http://${display}:${port}/`;

if (lanToken && (needLanUrl || anyInterface)) {       const lan = lanIPv4();       if (lan) lanUrl = `http://${lan}:${port}/?t=${lanToken}`;

const lan = lanIPv4();       if (lan) lanUrl = `http://${lan}:${port}/?t=${lanToken}`;     } else if (lanToken) {

if (lan) lanUrl = `http://${lan}:${port}/?t=${lanToken}`;

url = `http://${display}:${port}/?t=${lanToken}`;

selfHosts.push(`${h.includes(":") && !h.startsWith("[") ? `[${h}]` : h}:${port}`);     }     selfOrigins = selfHosts.map((h) => `http://${h}`);

}     selfOrigins = selfHosts.map((h) => `http://${h}`);     writeJson(serverFile, { url, port, pid: process.pid, started: new Date().toISOString(), host, ...(lanUrl ? { lanUrl } : {}) });

selfOrigins = selfHosts.map((h) => `http://${h}`);

try { // the pid may have been reused: trust it only if the server at that url answers for this session     const probe = new URL(info.url); probe.pathname = "/listener"; // keeps a --host URL's ?t= token     const r = await fetch(probe, { 

const probe = new URL(info.url); probe.pathname = "/listener"; // keeps a --host URL's ?t= token     const r = await fetch(probe, { signal: AbortSignal.timeout(2000) });     return r.ok && (await r.json()).session === session ? info : null;

const r = await fetch(probe, { signal: AbortSignal.timeout(2000) });

Executable file

Executable file

const put = (id, v) => { document.getElementById(id).textContent = v; }; put("ran", "scripts run"); fetch("/state").then((r) => r.text()).then((t) => (t.includes("Manual visuals") ? "read" : "empty"), () => "blocked").then((v) => put("read"

put("ran", "scripts run"); fetch("/state").then((r) => r.text()).then((t) => (t.includes("Manual visuals") ? "read" : "empty"), () => "blocked").then((v) => put("read", v)); fetch("/send", { method: "POST", body: JSON.stringify({ actions: [

fetch("/state").then((r) => r.text()).then((t) => (t.includes("Manual visuals") ? "read" : "empty"), () => "blocked").then((v) => put("read", v));

fetch("/send", { method: "POST", body: JSON.stringify({ actions: [{ type: "visualize" }] }) }).then((r) => "status " + r.status, () => "blocked").then((v) => put("sent", v));

Executable file

test("links render as anchors, unsafe URLs stay literal", () => {   assert.equal(     md("[docs](https://example.com)"),

assert.equal(     md("[docs](https://example.com)"),     '<a href="https://example.com" target="_blank" rel="noopener noreferrer">docs</a>'

md("[docs](https://example.com)"),

'<a href="https://example.com" target="_blank" rel="noopener noreferrer">docs</a>'

);   assert.equal(     md("`[x](https://example.com)`"),

assert.equal(     md("`[x](https://example.com)`"),     '<code>[x](https://example.com)</code>'

md("`[x](https://example.com)`"),

'<code>[x](https://example.com)</code>'

test("only absolute http and https links render; everything else stays plain text", () => {   assert.equal(     md("[docs](https://example.com/a?b=1)"),

assert.equal(     md("[docs](https://example.com/a?b=1)"),     '<a href="https://example.com/a?b=1" target="_blank" rel="noopener noreferrer">docs</a>'

md("[docs](https://example.com/a?b=1)"),

'<a href="https://example.com/a?b=1" target="_blank" rel="noopener noreferrer">docs</a>'

);   assert.equal(     md("[docs](http://example.com)"),

assert.equal(     md("[docs](http://example.com)"),     '<a href="http://example.com" target="_blank" rel="noopener noreferrer">docs</a>'

md("[docs](http://example.com)"),

'<a href="http://example.com" target="_blank" rel="noopener noreferrer">docs</a>'

test("formatting never rewrites link URLs", () => {   assert.equal(     md("[guide](https://example.com/_docs_/x)"),

assert.equal(     md("[guide](https://example.com/_docs_/x)"),     '<a href="https://example.com/_docs_/x" target="_blank" rel="noopener noreferrer">guide</a>'

md("[guide](https://example.com/_docs_/x)"),

'<a href="https://example.com/_docs_/x" target="_blank" rel="noopener noreferrer">guide</a>'

);   assert.equal(     md("[**bold** guide](https://example.com)"),

assert.equal(     md("[**bold** guide](https://example.com)"),     '<a href="https://example.com" target="_blank" rel="noopener noreferrer"><strong>bold</strong> guide</a>'

md("[**bold** guide](https://example.com)"),

'<a href="https://example.com" target="_blank" rel="noopener noreferrer"><strong>bold</strong> guide</a>'

test("links open in a new tab", () => {   assert.match(     md("[docs](https://example.com)"),

assert.match(     md("[docs](https://example.com)"),     /target="_blank" rel="noopener noreferrer"/

md("[docs](https://example.com)"),

Executable file

"a _real_ emphasis",   "2 * 3 * 4 equals 24",   "[docs](https://example.com)",

"2 * 3 * 4 equals 24",   "[docs](https://example.com)",   "[x](javascript:alert(1))",

"[docs](https://example.com)",

"[x](#q3)",   "[x](mailto:a@example.com)",   "[docs](http://example.com)",

"[x](mailto:a@example.com)",   "[docs](http://example.com)",   "[docs](https://example.com/a?b=1)",

"[docs](http://example.com)",

"[docs](https://example.com/a?b=1)",

"\0LINK7\0 and \0CODE3\0",   "`[x](https://example.com)`",   "[guide](https://example.com/_docs_/x)",

"`[x](https://example.com)`",

"[guide](https://example.com/_docs_/x)",

"[**bold** guide](https://example.com)",

}   assert.equal(     pageMd("[docs](https://example.com)"),

assert.equal(     pageMd("[docs](https://example.com)"),     '<a href="https://example.com" target="_blank" rel="noopener noreferrer">docs</a>'

pageMd("[docs](https://example.com)"),

'<a href="https://example.com" target="_blank" rel="noopener noreferrer">docs</a>'

test("page.html links open in a new tab", () => {   assert.match(     pageMd("[docs](https://example.com)"),

assert.match(     pageMd("[docs](https://example.com)"),     /target="_blank" rel="noopener noreferrer"/

pageMd("[docs](https://example.com)"),

Executable file

terms: [{ term: "Send", def: "One press of Send to Agent.", avoid: ["submit", "reply"] }],   questions: [     { id: "q1", round: 1, deps: [], title: "Root question", body: "Answered earlier. Retries go through `retry_queue`; see [the guide]

questions: [     { id: "q1", round: 1, deps: [], title: "Root question", body: "Answered earlier. Retries go through `retry_queue`; see [the guide](https://example.com/guide), not [the visual](/visual) or [elsewhere](//evil.example).", opti

{ id: "q1", round: 1, deps: [], title: "Root question", body: "Answered earlier. Retries go through `retry_queue`; see [the guide](https://example.com/guide), not [the visual](/visual) or [elsewhere](//evil.example).", options: [{ k: "A", t

await page.reload();   await page.locator(".item").first().waitFor();   check("theme: the choice survives a reload, set before the script runs", (await mode()) === "dark" && await isDark() && (await (await fetch(url)).text()).includes('<htm

await page.locator(".item").first().waitFor();   check("theme: the choice survives a reload, set before the script runs", (await mode()) === "dark" && await isDark() && (await (await fetch(url)).text()).includes('<html lang="en" data-theme=

check("theme: the choice survives a reload, set before the script runs", (await mode()) === "dark" && await isDark() && (await (await fetch(url)).text()).includes('<html lang="en" data-theme="dark">'));

check("markdown: code spans are readable in both themes", await page.locator(".card .body code").count() === 1 && cr.ok, cr.extra);   const mdLinks = await page.locator(".card .body a").evaluateAll((as) => as.map((a) => [a.getAttribute("hre

const mdLinks = await page.locator(".card .body a").evaluateAll((as) => as.map((a) => [a.getAttribute("href"), a.target, a.rel]));   check("markdown: only the absolute https link renders, opening a new tab", JSON.stringify(mdLinks) === JSON

check("markdown: only the absolute https link renders, opening a new tab", JSON.stringify(mdLinks) === JSON.stringify([["https://example.com/guide", "_blank", "noopener noreferrer"]]), JSON.stringify(mdLinks));

[Credential-related source omitted]

[Credential-related source omitted]

const dotLocal = `http://grill-e2e.local:${lan.port}/?t=${token}`;

const lp = await lanBrowser.newPage({ viewport: { width: 1440, height: 900 } });     const seen = []; const refused = [];     lp.on("request", (r) => { if (r.url().startsWith(`http://grill-e2e.local:${lan.port}/`)) seen.push(r.url()); });

const seen = []; const refused = [];     lp.on("request", (r) => { if (r.url().startsWith(`http://grill-e2e.local:${lan.port}/`)) seen.push(r.url()); });     lp.on("response", (r) => { if (r.status() === 403) refused.push(`${r.request().met

lp.on("request", (r) => { if (r.url().startsWith(`http://grill-e2e.local:${lan.port}/`)) seen.push(r.url()); });

Executable file

const run = (args, opts = {}) => execFileSync(process.execPath, [SERVER, ...args], { encoding: "utf8", env, ...opts }).trim(); const sleep = (ms) => new Promise((r) => setTimeout(r, ms)); const post = (url, body) => fetch(url + "send", { me

const post = (url, body) => fetch(url + "send", { method: "POST", headers: { "content-type": "application/json" }, body: typeof body === "string" ? body : JSON.stringify(body) });

const html = await (await fetch(s.ready.url)).text();

assert.match(html, /<textarea/);   const state = await (await fetch(s.ready.url + "state")).json();   assert.equal(state.topic, "Fonts");

const state = await (await fetch(s.ready.url + "state")).json();

const actions = [{ q: "q1", type: "defer" }];   const withOrigin = (origin, contentType = "application/json") =>     fetch(s.ready.url + "send", { method: "POST", headers: { "content-type": contentType, origin }, body: JSON.stringify({ acti

fetch(s.ready.url + "send", { method: "POST", headers: { "content-type": contentType, origin }, body: JSON.stringify({ actions }) });

assert.equal((await withOrigin(s.ready.url.slice(0, -1))).status, 200, "the page's own origin is allowed");   const port = Number(new URL(s.ready.url).port);   assert.equal((await withOrigin(`http://localhost:${port}`)).status, 200, "the sa

const port = Number(new URL(s.ready.url).port);   assert.equal((await withOrigin(`http://localhost:${port}`)).status, 200, "the same server opened as localhost is allowed");   assert.equal((await withOrigin(`http://localhost:${port + 1}`)).

assert.equal((await withOrigin(`http://localhost:${port}`)).status, 200, "the same server opened as localhost is allowed");

assert.equal((await withOrigin(`http://localhost:${port + 1}`)).status, 403, "localhost on another port is still rejected");

assert.equal((await withOrigin("https://evil.example", "text/plain")).status, 403, "a foreign origin is rejected even as a no-preflight content-type");

const themeOf = async (url) => (await (await fetch(url)).text()).match(/<html[^>]*data-theme="([^"]+)"/)[1];

assert.equal(await themeOf(a.ready.url), "system", "defaults to system");   const setTheme = (url, theme, origin) =>     fetch(url + "theme", { method: "POST", headers: { "content-type": "application/json", ...(origin ? { origin } : {}) }, 

fetch(url + "theme", { method: "POST", headers: { "content-type": "application/json", ...(origin ? { origin } : {}) }, body: JSON.stringify({ theme }) });

assert.equal((await setTheme(a.ready.url, "chartreuse")).status, 400, "an unknown theme is rejected");   assert.equal((await setTheme(a.ready.url, "light", "https://evil.example")).status, 403, "a foreign origin is rejected");

assert.equal((await setTheme(a.ready.url, "light", "https://evil.example")).status, 403, "a foreign origin is rejected");

const { session } = newSession(tmp("grill-v-"));   const s = await startServe(session); t.after(s.stop);   const miss = await fetch(s.ready.url + "visual");

const s = await startServe(session); t.after(s.stop);   const miss = await fetch(s.ready.url + "visual");   assert.equal(miss.status, 404);

const miss = await fetch(s.ready.url + "visual");

const html = "<!doctype html><title>v</title><h1>Prototype</h1>";   writeFileSync(join(session, "visual.html"), html);   const hit = await fetch(s.ready.url + "visual?v=1");

writeFileSync(join(session, "visual.html"), html);   const hit = await fetch(s.ready.url + "visual?v=1");   assert.equal(hit.status, 200);

const hit = await fetch(s.ready.url + "visual?v=1");

writeFileSync(join(session, "visual.html"), "<!doctype html><p>v</p>");   const s = await startServe(session); t.after(s.stop);   const hit = await fetch(s.ready.url + "visual?v=1");

const s = await startServe(session); t.after(s.stop);   const hit = await fetch(s.ready.url + "visual?v=1");   assert.equal(hit.status, 200);

const hit = await fetch(s.ready.url + "visual?v=1");

assert.equal(hit.status, 200);   assert.equal(hit.headers.get("content-security-policy"), "sandbox allow-scripts");   const page = await fetch(s.ready.url);

assert.equal(hit.headers.get("content-security-policy"), "sandbox allow-scripts");   const page = await fetch(s.ready.url);   assert.equal(page.headers.get("content-security-policy"), null, "the page itself is not sandboxed");

const page = await fetch(s.ready.url);

assert.equal(JSON.parse(readFileSync(join(session, "server.json"), "utf8")).pid, ready.pid);   assert.equal(run(["url", "--session", session]), ready.url);   assert.equal((await fetch(ready.url + "state")).status, 200);

assert.equal((await fetch(ready.url + "state")).status, 200);

assert.equal(ready.lanUrl, JSON.parse(readFileSync(join(session, "server.json"), "utf8")).lanUrl);   const lan = new URL(ready.lanUrl);   assert.equal((await fetch(`${lan.origin}/state${lan.search}`)).status, 200, "the LAN URL is served");

const lan = new URL(ready.lanUrl);   assert.equal((await fetch(`${lan.origin}/state${lan.search}`)).status, 200, "the LAN URL is served");   assert.equal((await fetch(`${lan.origin}/listener`)).status, 403, "LAN /listener without the token 

assert.equal((await fetch(`${lan.origin}/state${lan.search}`)).status, 200, "the LAN URL is served");

assert.equal((await fetch(`${lan.origin}/listener`)).status, 403, "LAN /listener without the token is refused");

const hr = JSON.parse(h.stdout.trim());   t.after(() => killPid(hr.pid)); // a second server, if one was wrongly started, is the one server.json names   assert.match(hr.url, new RegExp(`^http://${ip.address.replace(/\./g, "\\.")}:\\d+/\\?t=

t.after(() => killPid(hr.pid)); // a second server, if one was wrongly started, is the one server.json names   assert.match(hr.url, new RegExp(`^http://${ip.address.replace(/\./g, "\\.")}:\\d+/\\?t=[0-9a-f]{32}$`));   const again = JSON.par

assert.match(hr.url, new RegExp(`^http://${ip.address.replace(/\./g, "\\.")}:\\d+/\\?t=[0-9a-f]{32}$`));

const listener = async (url) => (await fetch(url + "listener")).json();

const s3 = await startServe(session); t.after(s3.stop);   assert.notEqual(new URL(s3.ready.url).port, String(port), "falls back when the port is taken");   assert.equal((await fetch(s3.ready.url + "state")).status, 200);

assert.notEqual(new URL(s3.ready.url).port, String(port), "falls back when the port is taken");   assert.equal((await fetch(s3.ready.url + "state")).status, 200);   await s3.stop(); await new Promise((r) => blocker.close(r));

assert.equal((await fetch(s3.ready.url + "state")).status, 200);

const s = await startServe(session); t.after(s.stop);   let st = await (await fetch(s.ready.url + "state")).json();

let st = await (await fetch(s.ready.url + "state")).json();

applied(session, { agent: { status: "working" } });   const working = (await (await fetch(s.ready.url + "state")).json()).agent;

const working = (await (await fetch(s.ready.url + "state")).json()).agent;

st = await (await fetch(s.ready.url + "state")).json();

const s = await startServe(session, ["--lan"]); t.after(s.stop);   assert.match(s.ready.url, /^http:\/\/127\.0\.0\.1:\d+\/$/, "the primary URL stays localhost");   assert.match(s.ready.lanUrl, new RegExp(`^http://${expected.replace(/\./g, "

assert.match(s.ready.url, /^http:\/\/127\.0\.0\.1:\d+\/$/, "the primary URL stays localhost");   assert.match(s.ready.lanUrl, new RegExp(`^http://${expected.replace(/\./g, "\\.")}:\\d+/\\?t=[0-9a-f]{32}$`), "the LAN URL carries a 128-bit to

assert.match(s.ready.lanUrl, new RegExp(`^http://${expected.replace(/\./g, "\\.")}:\\d+/\\?t=[0-9a-f]{32}$`), "the LAN URL carries a 128-bit token and prefers RFC 1918");

assert.equal((await fetch(s.ready.url + "state")).status, 200, "localhost still serves without a token");

assert.equal((await fetch(lan("state"))).status, 200, "the LAN URL serves with the token");

assert.equal((await fetch(lanBase + "state")).status, 403, "the LAN address without a token is rejected");

assert.equal((await fetch(lan("state", "wrong"))).status, 403, "a wrong token is rejected");

const actions = [{ q: "q1", type: "defer" }];   const sendAs = (url, origin) => fetch(url, { method: "POST", headers: { "content-type": "application/json", origin }, body: JSON.stringify({ actions }) });   assert.equal((await sendAs(lan("se

const sendAs = (url, origin) => fetch(url, { method: "POST", headers: { "content-type": "application/json", origin }, body: JSON.stringify({ actions }) });

assert.equal((await sendAs(lanBase + "send", lanOrigin)).status, 403, "a tokenless LAN send is rejected, curl included");

const port = new URL(s.ready.url).port;   const dotLocal = `http://my-mac.local:${port}`;

const dotLocal = `http://my-mac.local:${port}`;

assert.equal((await sendAs(lan("send"), "null")).status, 403, "the sandboxed visual iframe has the token in its src, so an opaque origin stays rejected");   assert.equal((await sendAs(s.ready.url + "send", dotLocal)).status, 403, "a token-l

assert.equal((await sendAs(s.ready.url + "send", dotLocal)).status, 403, "a token-less request keeps the Origin allowlist");   assert.equal((await sendAs(s.ready.url + "send", "https://evil.example")).status, 403, "a foreign origin is still

assert.equal((await sendAs(s.ready.url + "send", "https://evil.example")).status, 403, "a foreign origin is still rejected on loopback");   const themeAs = (url, origin) => fetch(url, { method: "POST", headers: { "content-type": "applicatio

const themeAs = (url, origin) => fetch(url, { method: "POST", headers: { "content-type": "application/json", origin }, body: JSON.stringify({ theme: "system" }) });

assert.equal((await themeAs(lan("theme"), "null")).status, 403, "and rejects the iframe's opaque origin");   assert.equal((await themeAs(lanBase + "theme", lanOrigin)).status, 403, "a tokenless LAN theme write is rejected");   assert.equal(

assert.equal((await themeAs(lanBase + "theme", lanOrigin)).status, 403, "a tokenless LAN theme write is rejected");   assert.equal((await fetch(lanBase)).status, 403, "the LAN page without a token is rejected");   assert.equal((await fetch(

assert.equal((await fetch(lanBase)).status, 403, "the LAN page without a token is rejected");

assert.equal((await fetch(lan("", token))).status, 200, "the LAN page serves with the token");

assert.equal((await fetch(lanBase + "events")).status, 403, "LAN /events without a token is rejected");

assert.equal((await fetch(lan("events"))).status, 200, "LAN /events serves with the token");

assert.equal((await fetch(lanBase + "visual")).status, 403, "LAN /visual without a token is rejected");

assert.equal((await fetch(lan("visual"))).status, 404, "LAN /visual with the token passes the gate (404, no visual yet)");

[Credential-related source omitted]

const port = lan.port;   const lanBase = `http://${lan.host}/`;   const dotLocal = `my-mac.local:${port}`;

const lanBase = `http://${lan.host}/`;

assert.equal((await raw(lanBase, { path: `${p}?t=${token}`, host: dotLocal })).status, 200, `LAN ${p} under a .local Host with the token is served`);   }   assert.equal((await raw(lanBase, { method: "POST", path: `/send?t=${token}`, host: d

}   assert.equal((await raw(lanBase, { method: "POST", path: `/send?t=${token}`, host: dotLocal, body: send, headers: { "content-type": "application/json", origin: `http://${dotLocal}` } })).status, 200, "a .local Send with the token lands"

assert.equal((await raw(lanBase, { method: "POST", path: `/send?t=${token}`, host: dotLocal, body: send, headers: { "content-type": "application/json", origin: `http://${dotLocal}` } })).status, 200, "a .local Send with the token lands");

assert.match(s.stderr(), new RegExp(`^grill: could not open ${s.ready.url.replace(/[.?/]/g, "\\$&")} automatically; open it by hand\n$`), `${why}: exactly one grill: line, naming the URL`);     assert.equal(s.child.exitCode, null, `${why}: 

assert.equal(s.child.exitCode, null, `${why}: the server keeps running`);     assert.equal((await fetch(s.ready.url + "state")).status, 200, `${why}: and keeps serving`);     await post(s.ready.url, { actions: [{ q: "q1", type: "defer" }] }

assert.equal((await fetch(s.ready.url + "state")).status, 200, `${why}: and keeps serving`);

Executable file