4 Commits

Include renames

Author	SHA1	Message	Date
rmancinasandClaude Opus 5	6895167964	fix(setup): print the hub's public URL, not the host the reader typed ... The setup pages build commands that get pasted into a terminal on a *different* machine, but they built them from location.origin. Open the console by LAN IP or over a tunnel and the enrolment one-liner told the target machine to curl an address it may not resolve at all. /docs and /enroll/:token are now served through a template that stamps in config.baseUrl — PUBLIC_URL where set, the proxied request host otherwise — with location.origin left as a fallback for the unsubstituted file. The remaining 127.0.0.1 references are the loopback VNC port on the machine being registered, which is meant to be literal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-12 11:41:31 -07:00
rmancinasandClaude Opus 5	cfda6b19b7	feat(install): one-command device registration for macOS, Windows and Linux ... Registering a machine meant reading a multi-step page, installing Node, and running three commands in the right order. Now it is one line per platform. The hub serves scripts/install.sh and scripts/install.ps1 with its own address and the enrolment token substituted in, so the published command carries everything and there is nothing to fill in: curl -fsSL https://support.freakma.com/install.sh?token=TOKEN | sh irm https://support.freakma.com/install.ps1?token=TOKEN | iex That output is piped straight into a shell, so the token — the only untrusted value in either file — is refused unless it matches the base64url shape that randomToken produces. Each script checks for a usable runtime and stops with instructions rather than guessing, warns when nothing is serving RFB on the loopback, installs per-user with no root or administrator, and registers a login-scoped service: launchd on macOS, a lingering systemd user service on Linux, a logon task on Windows. The Windows script uses Node 22 when it is present and falls back to the bundled executable otherwise, which is what lets one command cover both Windows 11 and Server 2008 R2. It registers a logon task rather than a service on purpose: services run in session 0 and cannot draw on the interactive desktop, so the "ask first" consent prompt would never appear. Also adds /docs — a per-OS setup guide with service management and a troubleshooting table — and reworks the enrolment page into OS tabs that open on whichever platform the reader is sitting at. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-12 11:37:12 -07:00
rmancinasandClaude Opus 5	cecaf74a0a	feat(agent): ship a Node 12 executable for Windows Server 2008 R2 ... Machines that cannot install Node 22 had no way to run the agent at all, which left them stuck on direct mode — and direct mode only works when the hub can route to the VNC port, which it often cannot. agent.js now resolves the two Node 22 globals it uses through fallbacks: `ws` for the control and tunnel sockets, and http/https for the single enrolment POST. Node 22 loads neither, since `globalThis.WebSocket || require('ws')` short-circuits. The require and the http/https references are static so the bundler can follow them. A new Docker stage bundles that file with a Node 12 runtime — the last line supporting Windows 7 and Server 2008 R2 — into one self-contained .exe, served from /download/agent.exe and linked from the enrolment page. The route answers 503 rather than 404 in a dev checkout, where the build has not run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-12 00:55:57 -07:00
rmancinasandClaude Opus 5	999717f77b	feat: self-hosted remote support over VNC ... Browser-based remote control (noVNC) with invite links, per-user access control, garagedoor SSO and a persisted client list. The hub proxies RFB rather than pointing the browser at a VNC server. That is what lets it authenticate upstream with a stored password the browser never sees, and enforce view-only by dropping input messages on the client->server stream instead of hiding buttons. Machines are reachable two ways: direct TCP for LAN hosts, or an outbound agent tunnel for anything behind NAT. Node 22's global WebSocket keeps the agent dependency-free, and node:sqlite keeps the image free of native builds. Ships with an end-to-end suite that boots the real server against a fake VNC server and a fake auth service (72 assertions), plus Gitea Actions CI/CD to Portainer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-11 23:37:35 -07:00