Run the core somewhere else: Docker, SSH, or both, via tinybox

.gitmodules

@@ -31,6 +31,10 @@
 	path = vendor/tinyhosts
 	url = https://github.com/tinyhumansai/tinyhosts.git
 	branch = main
+[submodule "vendor/tinybox"]
+	path = vendor/tinybox
+	url = https://github.com/tinyhumansai/tinybox
+	branch = main
 [submodule "vendor/tinyruntime"]
 	path = vendor/tinyruntime
 	url = https://github.com/tinyhumansai/tinyruntime.git

app/src-tauri/Cargo.toml

@@ -81,6 +81,14 @@ futures-util = { version = "0.3", default-features = false, features = ["sink",
 
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 rand = "0.9"
+# tinybox: reach (local/ssh) and confinement (passthrough/docker) as
+# independent axes, which is what lets one `GatewaySpec::Box` variant cover a
+# container here, a machine over there, and a container over there. Vendored as
+# a submodule and taken by path, the same shape as the other tiny* crates.
+tinybox-core = { path = "../../vendor/tinybox/crates/tinybox-core", optional = true }
+tinybox-host = { path = "../../vendor/tinybox/crates/tinybox-host", optional = true }
+tinybox-ssh = { path = "../../vendor/tinybox/crates/tinybox-ssh", optional = true }
+tinybox-docker = { path = "../../vendor/tinybox/crates/tinybox-docker", optional = true }
 hex = "0.4"
 # Tauri's vendored dev-server proxy (see `vendor/tauri-cef/.../protocol/tauri.rs`)
 # builds a reqwest 0.13 client that requires a process-wide rustls
@@ -244,7 +252,21 @@ windows-sys = { version = "0.59", features = [
 ] }
 
 [features]
-default = []
+default = ["gateways"]
+# Routing the frontend to a core somewhere other than this process: a
+# container, a machine over SSH, or a container on a machine over SSH. Pulls in
+# the tinybox crates that provision and reach those boxes.
+#
+# This is a **shell-local** gate, unrelated to the feature-forwarding rules in
+# AGENTS.md: those govern which `openhuman_core` gates the shell forwards, and
+# `scripts/ci/check-feature-forwarding.mjs` reads the core dependency's feature
+# list, not this table. Nothing here belongs in `scripts/ci/product-features.txt`.
+gateways = [
+    "dep:tinybox-core",
+    "dep:tinybox-docker",
+    "dep:tinybox-host",
+    "dep:tinybox-ssh",
+]
 # `custom-protocol` switches Tauri from `devUrl` (vite dev server) to the
 # bundled `frontendDist` served via `tauri://localhost`. `cargo tauri build`
 # turns this on automatically for release; do not put it in `default` or

app/src-tauri/src/core_rpc.rs

@@ -41,15 +41,16 @@ fn relay_bearer_header(token: Option<&str>) -> Option<String> {
 }
 
 /// Redact a relay URL before it lands in a log line or error string: drop the
-/// query, fragment, and any userinfo (which can carry tokens/credentials),
-/// keeping just `scheme://host[:port]/path` so transport diagnostics stay
-/// useful without persisting secrets. Falls back to a coarse sentinel when the
-/// URL can't be parsed.
-fn redact_url_for_log(url: &str) -> String {
+/// query, fragment, path, and any userinfo (which can carry tokens/credentials
+/// or PII in the path itself), keeping just `scheme://host[:port]` so transport
+/// diagnostics stay useful without persisting secrets. Falls back to a coarse
+/// sentinel when the URL can't be parsed.
+pub(crate) fn redact_url_for_log(url: &str) -> String {
     url.parse::<url::Url>()
         .map(|mut parsed| {
             parsed.set_query(None);
             parsed.set_fragment(None);
+            parsed.set_path("");
             let _ = parsed.set_username("");
             let _ = parsed.set_password(None);
             parsed.to_string()
@@ -94,8 +95,30 @@ pub(crate) async fn post_json_rpc(
     token: Option<&str>,
     body: String,
 ) -> Result<RelayHttpResponse, String> {
-    let client = reqwest::Client::builder()
-        .timeout(Duration::from_secs(30))
+    // Defense in depth behind `store::save`'s validation: never attach a
+    // bearer over plain HTTP to a non-loopback host, whatever the caller is.
+    // The local core (loopback) and any `https` endpoint keep working; a
+    // Remote gateway that slipped past persistence is still rejected here.
+    let relay_token = relay_bearer_header(token);
+    #[cfg(feature = "gateways")]
+    if relay_token.is_some()
+        && crate::gateway::types::validate_remote_transport(url, token).is_err()
+    {
+        return Err(format!(
+            "refusing to send a bearer to {} over an insecure transport",
+            redact_url_for_log(url)
+        ));
+    }
+
+    let mut client_builder = reqwest::Client::builder().timeout(Duration::from_secs(30));
+    if relay_token.is_some() {
+        // A bearer must never follow a redirect off the endpoint the user
+        // configured. reqwest strips Authorization on cross-origin redirects
+        // by default, but disabling redirects entirely for authenticated
+        // requests is the deterministic, fail-closed choice.
+        client_builder = client_builder.redirect(reqwest::redirect::Policy::none());
+    }
+    let client = client_builder
         .build()
         .map_err(|e| format!("failed to build HTTP client: {e}"))?;
 
@@ -104,15 +127,14 @@ pub(crate) async fn post_json_rpc(
         .header("Content-Type", "application/json")
         .body(body);
 
-    let bearer = relay_bearer_header(token);
-    if let Some(value) = bearer.as_deref() {
+    if let Some(value) = relay_token.as_deref() {
         builder = builder.header("Authorization", value);
     }
 
     let safe_url = redact_url_for_log(url);
     log::debug!(
         "[core_rpc][relay] POST {safe_url} (auth={})",
-        bearer.is_some()
+        relay_token.is_some()
     );
 
     let resp = builder
@@ -133,6 +155,7 @@ pub(crate) async fn post_json_rpc(
 
 #[cfg(test)]
 mod tests {
+    use super::redact_url_for_log;
     use super::relay_bearer_header;
 
     #[test]
@@ -154,4 +177,54 @@ mod tests {
         assert_eq!(relay_bearer_header(Some("")), None);
         assert_eq!(relay_bearer_header(Some("   ")), None);
     }
+
+    #[test]
+    fn redact_strips_credentials_query_and_path() {
+        // Userinfo, query, fragment, and path must not survive into logs; only
+        // the scheme://host[:port] surface is kept for transport diagnostics.
+        assert_eq!(
+            redact_url_for_log("http://user:pass@192.168.1.74:7788/rpc/secret?token=t0k#frag"),
+            "http://192.168.1.74:7788/"
+        );
+        assert_eq!(
+            redact_url_for_log("https://core.example.com/rpc"),
+            "https://core.example.com/"
+        );
+        // An unparseable URL degrades to the coarse sentinel.
+        assert_eq!(redact_url_for_log("not a url"), "<invalid relay url>");
+    }
+
+    /// A non-loopback `http` URL carrying a bearer must be refused, and the
+    /// surfaced error must carry the redacted `scheme://host[:port]` form —
+    /// never the raw secret-bearing userinfo, path, or query (CWE-532).
+    #[cfg(feature = "gateways")]
+    #[tokio::test]
+    async fn insecure_transport_refusal_redacts_url() {
+        let err = match super::post_json_rpc(
+            "http://user:pass@192.168.1.74:7788/rpc/secret?token=t0k",
+            Some("bearer-tok"),
+            "body".to_string(),
+        )
+        .await
+        {
+            Err(e) => e,
+            Ok(_) => panic!("insecure non-loopback + bearer must be refused"),
+        };
+        assert!(
+            !err.contains("pass"),
+            "raw userinfo leaked into refusal error: {err}"
+        );
+        assert!(
+            !err.contains("t0k"),
+            "raw query token leaked into refusal error: {err}"
+        );
+        assert!(
+            !err.contains("/secret"),
+            "raw path leaked into refusal error: {err}"
+        );
+        assert!(
+            err.contains("http://192.168.1.74:7788/"),
+            "redacted host should remain for diagnostics: {err}"
+        );
+    }
 }

app/src-tauri/src/gateway/commands.rs

@@ -0,0 +1,76 @@
+//! The Tauri surface for gateways.
+//!
+//! Thin by design: every command resolves arguments, delegates to [`store`] or
+//! [`registry`], and maps the result. The rules live there.
+
+use super::registry;
+use super::store;
+use super::types::{Gateway, GatewayStatus, GatewaySummary};
+
+/// Every configured gateway, the built-in desktop one first.
+///
+/// Returns a credential-free [`GatewaySummary`], not the full [`Gateway`]: a
+/// `Remote` bearer and a `Box`/SSH destination or identity path belong to the
+/// shell store, and the renderer only needs the id, label and kind badge.
+#[tauri::command]
+pub(crate) fn gateway_list() -> Vec<GatewaySummary> {
+    let gateways = store::list();
+    log::debug!("[gateway][cmd] list -> {} gateway(s)", gateways.len());
+    gateways.iter().map(GatewaySummary::from).collect()
+}
+
+/// Add or replace a gateway.
+///
+/// Saving does not activate: a user editing an SSH destination should not have
+/// their session torn down and re-provisioned on every keystroke that lands in
+/// a save.
+#[tauri::command]
+pub(crate) fn gateway_save(gateway: Gateway) -> Result<(), String> {
+    log::info!(
+        "[gateway][cmd] save id={} kind={}",
+        gateway.id,
+        gateway.spec.kind()
+    );
+    store::save(gateway)
+}
+
+/// Forget a gateway.
+///
+/// Removing the active one does not switch away from it — the running session
+/// keeps working, and the next launch falls back to the desktop core. Tearing a
+/// working connection down as a side effect of tidying a list would be a
+/// surprise.
+#[tauri::command]
+pub(crate) fn gateway_delete(id: String) -> Result<(), String> {
+    log::info!("[gateway][cmd] delete id={id}");
+    store::delete(&id)
+}
+
+/// Make a gateway the one RPC goes to.
+///
+/// Returns an empty acknowledgment, not the [`ActiveGateway`]: the endpoint and
+/// bearer stay in the shell registry, where `core_rpc_url` / `core_rpc_token`
+/// answer from. Handing the bearer to the renderer would let an XSS exfiltrate
+/// a credential the renderer never needs — it only needs to know the switch
+/// happened.
+#[tauri::command]
+pub(crate) async fn gateway_activate(
+    id: String,
+    desktop: tauri::State<'_, crate::core_process::CoreProcessHandle>,
+) -> Result<(), String> {
+    let gateway = store::get(&id).ok_or_else(|| format!("no gateway named {id}"))?;
+    registry::activate(&gateway, desktop.inner()).await?;
+    Ok(())
+}
+
+/// Which gateway is active.
+#[tauri::command]
+pub(crate) async fn gateway_active() -> String {
+    registry::active_id().await
+}
+
+/// What a gateway is doing right now.
+#[tauri::command]
+pub(crate) async fn gateway_status(id: String) -> GatewayStatus {
+    registry::status_of(&id).await
+}

app/src-tauri/src/gateway/mod.rs

@@ -0,0 +1,51 @@
+//! Routing the frontend to a core, wherever that core runs.
+//!
+//! The app has always been able to reach two cores: the one in this process,
+//! and one at a URL somebody else is running. This module adds the ones this
+//! app provisions itself — a container here, a machine over SSH, or a container
+//! on a machine over SSH — by driving [tinybox], whose model is exactly the
+//! distinction that matters: *reach* (which machine) and *confinement* (what
+//! contains it) are independent axes, so the third case needs no code of its
+//! own.
+//!
+//! # The seam
+//!
+//! **A gateway resolves to a URL and a bearer, and nothing else changes.**
+//! `core_rpc_url` and `core_rpc_token` answer from the active gateway, so every
+//! call site in the renderer — `coreRpcClient`, `relay_http_rpc`, every screen —
+//! reaches a remote core through the code that already reached the local one.
+//! That is the whole reason this is tractable: the alternative, a transport
+//! abstraction threaded through the frontend, would touch every caller.
+//!
+//! # Layout
+//!
+//! - [`types`] — what a gateway is
+//! - [`store`] — where records live (shell-side, not renderer storage)
+//! - [`ops`] — which of those a gateway needs, and what holds it open
+//! - [`provision`] — create a box, start a core in it, open a tunnel to it
+//! - [`registry`] — which gateway is active, and what is being held open for it
+//! - [`commands`] — the Tauri surface
+//!
+//! [tinybox]: https://github.com/tinyhumansai/tinybox
+
+pub mod commands;
+pub mod ops;
+pub mod provision;
+pub mod registry;
+pub mod store;
+pub mod types;
+
+// No re-exports: every consumer of this module is either `lib.rs` reaching
+// `registry`/`commands`, or one of the submodules reaching a sibling. A
+// convenience `pub use` here would be surface nothing asks for.
+
+// Test modules are declared here rather than beside each file so they resolve
+// as siblings in this directory. Each is named for the module it covers.
+#[cfg(test)]
+mod ops_tests;
+#[cfg(test)]
+mod registry_tests;
+#[cfg(test)]
+mod store_tests;
+#[cfg(test)]
+mod types_tests;