Adom Bridge

@@ -299,74 +299,7 @@ Adom Bridge serves a couple of small pages on its loopback HTTP API (the stable  ### Try it live -If Adom Bridge is running on this machine, the panel below reaches it. Pick a security mode, then run a verb. Nothing touches your machine without a prompt you click (or, in handshake mode, without the wiki proving it is you).--<div id="abwc" style="font-family:system-ui,Segoe UI,sans-serif;border:1px solid #30363d;border-radius:10px;background:#0d1117;color:#e6edf3;padding:18px;max-width:820px">-  <div style="display:flex;align-items:center;gap:10px;margin-bottom:6px">-    <span id="abwc-dot" style="width:12px;height:12px;border-radius:50%;background:#484f58;display:inline-block"></span>-    <strong>Try Web Control (live)</strong>-  </div>-  <div style="font-size:12px;color:#8b949e;margin-bottom:12px">This runs against <code>http://127.0.0.1:24680</code> on <em>your</em> machine. If Adom Bridge is running, the buttons below reach it. Nothing changes your machine without a permission prompt you click.</div>-  <div style="display:flex;flex-wrap:wrap;gap:8px;margin-bottom:12px">-    <button id="abwc-detect" style="padding:8px 14px;border-radius:6px;border:1px solid #30363d;background:#21262d;color:#e6edf3;cursor:pointer">Detect Adom Bridge</button>-    <button id="abwc-status" style="padding:8px 14px;border-radius:6px;border:1px solid #30363d;background:#21262d;color:#e6edf3;cursor:pointer">Read status</button>-    <button id="abwc-run" style="padding:8px 14px;border-radius:6px;border:1px solid #1f6feb;background:#1f6feb;color:#fff;cursor:pointer">Run a verb (asks your permission)</button>-  </div>-  <div style="border:1px solid #21262d;border-radius:6px;padding:10px 12px;margin-bottom:12px;font-size:13px">-    <div style="font-weight:600;margin-bottom:6px">Security mode</div>-    <label style="display:block;margin-bottom:4px;cursor:pointer"><input type="radio" name="abwc-mode" value="consent" checked> Consent only (the default): every request pops an Allow / Deny prompt in Adom Bridge.</label>-    <label style="display:block;cursor:pointer"><input type="radio" name="abwc-mode" value="handshake"> Handshake + consent: the page must also prove it is really the Adom wiki, acting as you, before the prompt appears.</label>-    <div id="abwc-mode-note" style="color:#8b949e;margin-top:8px;font-size:12px"></div>-  </div>-  <pre id="abwc-log" style="background:#010409;border:1px solid #21262d;border-radius:6px;padding:12px;font-size:12px;max-height:320px;overflow:auto;white-space:pre-wrap;margin:0">Ready. Click "Detect Adom Bridge" to begin.</pre>-  <script>-  (function () {-    var AB = "http://127.0.0.1:24680";-    var log = document.getElementById("abwc-log"), dot = document.getElementById("abwc-dot"), note = document.getElementById("abwc-mode-note");-    function line(m){ log.textContent += "\n" + m; log.scrollTop = log.scrollHeight; }-    function mode(){ var r = document.querySelector('input[name="abwc-mode"]:checked'); return r ? r.value : "consent"; }-    function refreshNote(){-      note.textContent = mode() === "handshake"-        ? "In this mode a page must send a per-launch secret that Adom Bridge publishes only to YOUR Adom account key-value. Only wiki.adom.inc, signed in as you, can read it. This page (a plain frame) cannot, so if you have turned ON Settings > Web Control > \"Require wiki handshake\", the run below is refused BEFORE the prompt. That refusal is the point: a random site could not get past it either. It is off by default; turn it on for the stronger gate, and it could become the default later."-        : "The default. Every request from a web page pops an Allow once / Allow 1 hr / Deny prompt in Adom Bridge. Nothing runs until you click.";-    }-    Array.prototype.forEach.call(document.querySelectorAll('input[name="abwc-mode"]'), function(el){ el.onchange = refreshNote; });-    refreshNote();-    document.getElementById("abwc-detect").onclick = function () {-      log.textContent = "GET " + AB + "/health ...";-      fetch(AB + "/health").then(function(r){return r.ok?r.json():Promise.reject("HTTP "+r.status);})-        .then(function(j){ dot.style.background = j.service==="adom-bridge" ? "#00b8b0" : "#e6c86c"; line("RUNNING: " + JSON.stringify(j)); })-        .catch(function(e){ dot.style.background = "#484f58"; line("Not reachable (" + e + "). Is Adom Bridge running on this machine?"); });-    };-    document.getElementById("abwc-status").onclick = function () {-      log.textContent = "GET " + AB + "/status ...";-      fetch(AB + "/status").then(function(r){return r.json();}).then(function(j){-        var wc = (j && j.webControl) || {};-        line("Web Control enabled: " + wc.enabled + "  |  requireHandshake: " + wc.requireHandshake + "  |  gate: " + wc.commandGate);-      }).catch(function(e){ line("failed: " + e); });-    };-    document.getElementById("abwc-run").onclick = function () {-      var m = mode();-      log.textContent = "POST " + AB + "/command {bridge_list}" + (m === "handshake" ? "  (handshake mode: no secret sent)" : "") + " ...";-      var headers = { "Content-Type": "application/json" };-      // A real wiki backend would read bridge.webcontrol for the signed-in user and add-      // X-Adom-WebControl-Secret here. This demo frame cannot, on purpose.-      fetch(AB + "/command", { method:"POST", headers: headers, body: JSON.stringify({ command:"bridge_list" }) })-        .then(function(r){ return r.json().then(function(j){ return { status:r.status, body:j }; }); })-        .then(function(res){-          if (res.status === 200) { line("APPROVED and ran: " + JSON.stringify(res.body).slice(0, 400)); return; }-          if (res.body && res.body.errorCode === "handshake_required") {-            line("REFUSED (handshake_required): this page has no secret, so Adom Bridge refused BEFORE the prompt. In production, wiki.adom.inc's backend supplies the secret and only then does the Allow prompt appear. evil.com is stuck exactly here.");-            return;-          }-          if (res.body && res.body.errorCode === "web_control_disabled") { line("Web Control is turned OFF in Adom Bridge > Settings."); return; }-          line("Not approved (HTTP " + res.status + "): " + JSON.stringify(res.body));-        })-        .catch(function(e){ line("blocked before Adom Bridge answered: " + e); });-    };-  })();-  </script>-</div>+If you are reading this on the Adom wiki with Adom Bridge running, the **Overview** tab shows a live panel: pick a security mode (consent-only or the optional wiki handshake) and run a verb against your own machine, with a permission prompt you click. (The interactive panel needs the HTML view of this page; this plain-text version just describes it.)  ## Versioning