@oharness/server

The browser frontend: an HTTP server that serves a single page and streams an agent to it over SSE.

npx @oharness/server

It prints a URL carrying a token, and binds 127.0.0.1 by default. That default is not caution for its own sake — reaching this port is close enough to running commands on the machine, because the agent behind it writes files and runs shells. The token is regenerated per run, never written to disk, printed once, and compared with timingSafeEqual; a plain !== leaks it one character at a time. Passing --host to bind a public interface publishes that capability to the network, and the server says so at startup.

Permission prompts travel to the browser over SSE and are answered by POST. Dismissing the dialog — Escape, clicking away — counts as a denial, and every request still waiting when the server stops is resolved as denied rather than left to hang the agent's turn forever.

Documentation: https://github.com/Jet1217/OHarness