Function handlePairAgent

browse/src/cli.ts:838–977

(state: ServerState, args: string[])

}

async function handlePairAgent(state: ServerState, args: string[]): Promise<void> {
  const clientName = parseFlag(args, '--client') || `remote-${Date.now()}`;
  const domains = parseFlag(args, '--domain')?.split(',').map(d => d.trim());
  const control = hasFlag(args, '--control') || hasFlag(args, '--admin');
  const restrict = parseFlag(args, '--restrict');
  const localHost = parseFlag(args, '--local');

  // Call POST /pair to create a setup key
  // Default: full access (read+write+admin+meta). --control adds browser-wide ops.
  // --restrict limits: --restrict read (read-only), --restrict "read,write" (no admin)
  const pairResp = await fetch(`http://127.0.0.1:${state.port}/pair`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${state.token}`,
    },
    body: JSON.stringify({
      domains,
      clientId: clientName,
      control,
      ...(restrict ? { scopes: restrict.split(',').map(s => s.trim()) } : {}),
    }),
    signal: AbortSignal.timeout(5000),
  });

  if (!pairResp.ok) {
    const err = await pairResp.text();
    console.error(`[browse] Failed to create setup key: ${err}`);
    process.exit(1);
  }

  const pairData = await pairResp.json() as {
    setup_key: string;
    expires_at: string;
    scopes: string[];
    tunnel_url: string | null;
    server_url: string;
  };

  // Determine the URL to use
  let serverUrl: string;
  if (pairData.tunnel_url) {
    // Server already verified the tunnel is alive, but double-check from CLI side
    // in case of race condition between server probe and our request
    try {
      const cliProbe = await fetch(`${pairData.tunnel_url}/health`, {
        headers: { 'ngrok-skip-browser-warning': 'true' },
        signal: AbortSignal.timeout(5000),
      });
      if (cliProbe.ok) {
        serverUrl = pairData.tunnel_url;
      } else {
        console.warn(`[browse] Tunnel returned HTTP ${cliProbe.status}, attempting restart...`);
        pairData.tunnel_url = null; // fall through to restart logic
      }
    } catch {
      console.warn('[browse] Tunnel unreachable from CLI, attempting restart...');
      pairData.tunnel_url = null; // fall through to restart logic