@fiodos/bridge

Lets your Fiodos company agent reach a dashboard or API that lives on your own network (localhost:3947, an intranet host) without opening a port, without a third-party tunnel and without giving Fiodos your local key.

How it works: the bridge is a small process on a machine that can see that dashboard. It opens one outbound connection to Fiodos and holds it. When the agent needs to call the dashboard, Fiodos sends the request down that connection, the bridge judges it against the allow-list you set, executes it locally with your local credentials, and returns the answer.

npx -y --loglevel=error @fiodos/bridge pair ABCD-EFGH --target http://localhost:3947

That is the whole install. The code comes from the Fiodos dashboard (internal orb → connections → "dashboard on my network") and is valid for 15 minutes, once.

What stays here, what travels

| Kept on this machine (~/.fiodos/bridge/config.json, mode 0600) | Never leaves it | | --- | --- | | The pairing token (talks to Fiodos) | Your dashboard's key (--header) | | The target origin and allowed path prefixes | Any code, any copy of a response | | Header names you added (values are only in the file) | — |

Fiodos keeps the API document of the dashboard (read once through the bridge, or uploaded as a file) so the agent knows what it can call — never the code.

Commands

pair <code> --target <url> [--header "Name: value"]... [--header-file path]
                           [--allow </prefix>]... [--name <label>] [--api-url <url>] [--no-run]
run                        serve every paired bridge (what the service runs)
status                     what is paired, where it points; never prints a key
unpair [--bridge <id>]
service install|uninstall|show    launchd (macOS) / systemd --user (Linux); Windows prints instructions

• --header "Authorization: Bearer …" — how the bridge authenticates to your dashboard. Use --header-file if the value must not appear in shell history.
• --allow /v1/owner (repeatable) — restrict the bridge to those path prefixes. Default is everything on the target origin, nothing off it.
• The token is sent to Fiodos as the first WebSocket frame, never in the URL.

Run it always

fiodos-bridge service install        # starts with the machine, restarts if it dies

Or as a container (see Dockerfile): pair once with the volume, then run.

Requirements

Node.js 22.5 or newer (uses the built-in WebSocket and fetch; no dependencies).

Revoking

From the Fiodos dashboard, "revoke bridge" ends the pairing: the running bridge receives the notice, deletes its token and exits. A new code re-pairs.