web-runtime

Web runtime-router for iapeer peers (runtime id web): the owner's browser console for the fleet — chat with any peer + a live fleet panel — served from a single loopback HTTP process.

Like telegram-runtime makes a person a peer through Telegram, web-runtime makes a browser one more runtime of the owner's single identity:

• Chat. A message typed in the console is delivered to the target peer through the daemon FROM the owner's identity (from-runtime=web). A peer's reply sent with send_to_peer(<owner>, runtime="web") lands on this process's stdin as an IAP envelope and is pushed live into the open browser page (SSE). Both directions carry attachments: uploads (button / drag&drop / paste) travel as iapeer send --attachment; a peer's attachments render inline (images, audio, video) and download via an allowlist endpoint. History is durable (JSONL, survives restarts).
• Slash commands. /new /compact /stop (+ /wake, /refresh) go to the daemon's Fleet control endpoint — never as chat text; /activity on|off|status is a console-level per-peer toggle; the peer's own /alias_* expansions work exactly as in Telegram. The composer autocompletes all of them.
• Fleet panel. Peer list with live statuses, fed by a loopback pass-through proxy of the daemon's Fleet API (/fleet/v1/snapshot + /fleet/v1/events). The browser never talks to the daemon; the daemon stays loopback-only.

Security model

• The server binds 127.0.0.1 only — a hard invariant, not a knob.
• External access is the operator's business: a tunnel (e.g. Cloudflare Tunnel) with its own auth gate (e.g. Cloudflare Access) terminating on this host and forwarding to the loopback port. Nothing in this package is ever exposed directly.
• Every local request is treated as the owner (same trust class as the daemon's own tokenless loopback surface). The perimeter auth lives at the tunnel edge.
• No secrets are stored: the optional daemon bearer (IAPEER_BEARER_TOKEN) is read from the environment; there are no tokens of our own.

Install

npx @agfpd/web-runtime          # self-install: bin on PATH + runtime manifest
iapeer create <owner> --runtime web   # give the owner the web face (operator-add)

The foundation hosts web-runtime run as the always-on session web-<owner>.

Configuration

| Knob | Where | Default | |---|---|---| | Console port | --port flag > WEB_RUNTIME_PORT env > interfaces.web.port | 8787 | | Daemon discovery | <IAPEER_ROOT>/state/iapeer/router.json (fleet marker) | — | | iapeer binary | WEB_RUNTIME_IAP_BIN > IAP_BIN | iapeer on PATH | | Modality frame | WEB_RUNTIME_FRAME=0 disables | enabled | | Upload cap (per file) | WEB_RUNTIME_MAX_UPLOAD_MB | 50 MB (≤ 20 files/message) |

Set the port persistently with web-runtime interface --port <n> (writes interfaces.web.port in the peer profile), or pass WEB_RUNTIME_PORT at iapeer create time.

Commands

web-runtime                  # self-install (npx contract)
web-runtime self-config      # per-peer hook (foundation-invoked)
web-runtime interface --port <n>
web-runtime run [--port <n>]
web-runtime doctor [--json]

• Activity stream. While a peer works, the console tails its own transcript and shows the turn live: every tool call with expandable FULL arguments and results, thinking presence, context tokens, turn boundaries — richer than the Telegram bridge. The panel shows what every busy peer is doing right now.
• Voice. Record in the browser (MediaRecorder) → voice-connect STT → the peer gets 🎤 [voice] <text>; any reply can be spoken via voice-connect TTS (Ogg/Opus), and agent-sent .ogg attachments play inline.

Current bounds

• Approvals surface, PWA — future phases.

Docs

See docs/.