[edgehero]

Closes #708 together with #728 (the console as a service, merged).

What it does

/dispatch console [page] [--link [name]] [--no-open], operator-typed only:

• Output. Everything goes to the operator's notice. Nothing reaches model context, and no tool exposes it.
• Address. It prints the console's address, deep-linked to runs, fleet, insights, config, parked, audit or a run id.
• Running or not. It asks /healthz through the worker's console probe. That is the same rule doctor uses, and it contacts only loopback or the socket.
• --link. This mints a 60 s, single-use login code for an operator token, and asks which token when there are several.
  • It appends a panel audit row before the code exists, plus a failed row under the same ticket if the mint is refused.
  • It mints only while the console answers as running, only in pi's TUI mode, and only where the codes directory is guarded.
  • The link can carry a return page. Both the server and the page script check it against the console's own pages, so it cannot redirect elsewhere.
• Opening the browser.
  • On a local session (no SSH, a display, a TCP listener), the link goes to the browser through a 0600 page in a 0700 temporary directory, so the code never appears in a process's arguments.
  • The URL is always printed, and --no-open only prints.
  • On Windows the opener now uses url.dll, so a URL holding & survives.
• The login-codes directory joins the guarded files, as the tokens file is. It is judged by file identity, even before it exists. The console also refuses a code file that another account can read or owns, and one whose expiry is beyond the code's lifetime.

Specs

• Amended:
  • REQ-ADMIN-VIA-PI-EXTENSION and DES-ADMIN-VIA-PI-EXTENSION: the subcommand, and a browser only for it on a local session.
  • OQ-024: reopened and closed again.
  • DES-OPERATOR-CONSOLE: the panel as a second minter, the return-path rule, and threat 4.
  • INT-CONSOLE-AUDIT-LOG.
• UNCHANGED, checked: "binds no network port", the model-callable tool list, and REQ-CONSOLE-SECURITY.

Residuals (named in DES-OPERATOR-CONSOLE)

• The code itself. It still appears in the notice, and stays in browser history until it is spent.
• Snap or Flatpak browsers cannot read the page in /tmp, so the operator opens the printed link instead.
• tmux attached over SSH opens on the unattended desktop.
• Windows hosts cannot use one-time links, so the token is pasted instead.
• Verified by reading only: rundll32.
• bash remains the named residual for the guard, as for the tokens file.

Verification

• Review: two adversarial rounds, all findings fixed.
• Full suite with Valkey: only known flakes.
• Build: node admin/build.mjs builds.
• Checks: revision-row, test-count, temp-dir and dated-fixture all pass.
• Manual run against a real serve: the probe said running and not running, a --link code signed in and landed on /runs, a reused code got 401, and the audit chain verified.