daemon

const (
	RelayInfoPath   = "/api/relay/info"
	RelayDeployPath = "/api/relay/deploy"
	RelayUpdatePath = "/api/relay/update"
	// RelayJoinPath answers the join line for adding another machine — the
	// same string the deploy result shows, rebuilt from relay.json on demand.
	// It carries the fleet secret, which is why it is its own endpoint behind
	// a click rather than a field on Info that every page load would fetch:
	// the secret should cross into a page exactly when a human asked to see
	// it. Loopback + auth is the boundary that makes even that acceptable —
	// the cookie behind withAuth already spawns shells, so a page that can
	// call this could do worse.
	RelayJoinPath = "/api/relay/join"
	// RelayAddressPath takes {"address": "wss://..."} and repoints relay.json
	// at a custom domain the user routed to the Worker themselves. No
	// Cloudflare call, no token; a POST because it mutates.
	RelayAddressPath = "/api/relay/address"
)

The Remote screen's relay endpoints. The daemon owns the HTTP surface — auth, method policy, body bounds — and an injected RelayUI (wired up by cmd/flue, which owns the embedded bundles and the config files) does the deploying. The split keeps this package free of any Cloudflare knowledge.

These endpoints exist on the loopback origin only, by construction rather than by check: the daemon binds 127.0.0.1, and a relay forwards exactly one piece of HTTP (pairing) — every other remote interaction rides the Noise channel's wire protocol, which has no operation that reaches these paths. That is the property that makes a Cloudflare API token acceptable in a request body here at all. It must never be given a wire-protocol equivalent: a token typed into a remote tab would ride the relay, and a hostile relay origin serving that tab its JavaScript could read it.

const (

	// LocalCSP is what this daemon serves its own UI under.
	LocalCSP = cspHead + cspLoopbackSockets + cspTail

	// RelayCSP is what a relay origin serves the same bundle under. It is
	// carried to the deploy as the `_headers` file the Worker's static assets
	// are served with — see cmd/flue/relay.go. It grants nothing beyond
	// 'self': the bundle on a relay origin talks to that origin alone.
	RelayCSP = cspHead + cspTail
)

The Content-Security-Policy the UI is served under, in the two shapes the two origins that can serve it need.

It is not decoration on either. The browser's static Noise key lives in IndexedDB as raw bytes (web/src/crypto/keys.ts — a non-extractable CryptoKey cannot feed a userland Noise implementation), so a stored key is a standing grant to a shell and an injected script would be key theft. `script-src 'self'` is the compensating control that file names, and it has to hold on every origin that serves the bundle, not only on the one that is already unreachable from the internet.

The two differ in `connect-src`, and that difference is why there are two.

The daemon serves the UI over http on loopback and the socket the UI opens is `ws://127.0.0.1:7717`, which `'self'` does not cover; a relay serves it over https and the socket is a same-origin `wss://`, which `'self'` does. Those loopback entries carry wildcard ports — an injected script could reach every other service on the machine through them (docs/FOLLOW-UPS.md §6) — so an internet-facing origin must not inherit them just because the daemon needs them.

Composed rather than written twice, so the shared half cannot drift.

const (
	// RelayOff is a daemon with no relay: none configured, or one that has
	// stopped being dialled. It is never sent on the wire — the welcome omits
	// the relay field entirely — so no client has to branch on it.
	RelayOff = "off"
	// RelayConnecting is a relay this daemon is trying to reach: dialling,
	// backing off between dials, or waiting out a refusal. Nothing is reachable
	// through it, so it names no origin.
	RelayConnecting = "connecting"
	// RelayConnected is a live socket to the relay, and the one state that
	// carries an origin.
	RelayConnected = "connected"
)

The three states the relay leg can be in, and the only three strings that ever reach a client in wire.RelayInfo.Status.

They are exported because the transport that reports them lives in another package (internal/transport/relay) and the compiler is the only thing that can keep the two spellings identical.

const MintPath = "/api/handoff"

MintPath is the one route that may be reached by a method other than GET or HEAD. It hands the flue CLI a one-time handoff token so that the session token never has to appear in a URL — and therefore never in the browser opener's argv, which any local user can read.

const PairPagePath = "/pair"

PairPagePath is the client-side route that makes that POST: the app shell, served to a device that has nothing to authenticate with, carrying the token in ?t=. It is the path the QR code names — see conn.go, which builds that URL from this constant so the page the daemon serves without a session token and the page it sends the second device to cannot drift apart.

Serving it needs no token for the same reason the POST does not: the device holds none. It is still refused unless the request's provenance is this daemon's own, and it answers with the app shell and nothing else. See Server.withProvenance.

const PairPath = "/api/pair"

PairPath is the second of the two routes that may be reached by a method other than GET or HEAD, and the only endpoint on this daemon that is not authenticated by the session token.

That is the ceremony, not an oversight. The device being paired is by definition a device that holds no credential of this daemon's yet — if it had one it would not need pairing — so the thing it presents instead is the pairing token, which the user carried across from an already-trusted UI by scanning a code or following a link. Four rules keep that narrow:

• There has to be an open window. Outside one, this endpoint is inert.
• The window closes on the presentation that succeeds (see pairingState.redeem), so a token pairs exactly one device.
• The window closes on its own after PairingTTL. Nothing else closes it: a wrong guess costs the guesser a request and the user nothing, because this endpoint is reachable from the internet over a relay and the token it protects is 256 bits.
• The request must be same-origin, checked before the token is compared, so a page that is not the /pair page this daemon served cannot even reach the comparison.

const PairingTTL = 2 * time.Minute

PairingTTL is how long a pairing window stays open.

Two minutes is the span of the ceremony itself: pick up the second device, scan or open the link, confirm. It is not a span anyone is meant to walk away during, and a token found afterwards — in a screenshot, in a photo of a QR code, in a chat message — is inert.

const ReleasePath = "/api/flue/release"

ReleasePath answers one question: is there a flue newer than this one?

Loopback only, like the relay endpoints beside it, and for a reason that is about the answer rather than about secrecy. Upgrading flue means replacing a binary on the machine the daemon runs on — a browser cannot do it from anywhere, and a phone reading a laptop's fleet over the relay least of all. An endpoint that only the machine's own tab can reach is the honest shape for a fact only the machine's own operator can act on.

It is also the only place in the app that talks to a third party. The check runs here rather than in the tab deliberately: one machine asks GitHub on an interval, instead of every open tab asking on every load — including remote tabs, which would be telling GitHub about a flue instance from whatever network the reader happens to be on.