← Commit history

Link the web-control live demo from the web-integration section

John Lauer ·9b52e080fa ·2mo ago ·parent 0758ece
1 file changed +1−1
README.md+1−1
@@ -290,7 +290,7 @@ Adom Bridge serves a couple of small pages on its loopback HTTP API (the stable  - **`http://127.0.0.1:24680/verbs`** is a browsable API Explorer: every verb, grouped into tabs by category and with one tab per installed bridge, each with a plain-English description and a copy-to-clipboard curl command. The footer tooltip in the laptop GUI links straight to it. `GET /health`, `/status`, and `/commands` return the same information as JSON. -- **Web integration (detection).** A page served from `https://wiki.adom.inc` (and only that origin) can `fetch('http://127.0.0.1:24680/health')` to detect whether Adom Bridge is running, so the wiki can light up actions like "open this component in KiCad." The security is deliberately tight: Adom Bridge returns CORS headers only for the exact origin `https://wiki.adom.inc` (never a wildcard, never a user-provisionable `*.adom.cloud` host) with a loopback-Host check to defeat DNS rebinding, and it handles the Private-Network-Access preflight. A web origin may reach only the read-only detection endpoints; `POST /command` is refused for every web origin, so no verb can change the machine from a web page. The planned launch and send actions will each require a native Adom Bridge consent dialog. Full model: the `adom-bridge-web-integration` skill.+- **Web integration (detection).** A page served from `https://wiki.adom.inc` (and only that origin) can `fetch('http://127.0.0.1:24680/health')` to detect whether Adom Bridge is running, so the wiki can light up actions like "open this component in KiCad." The security is deliberately tight: Adom Bridge returns CORS headers only for the exact origin `https://wiki.adom.inc` (never a wildcard, never a user-provisionable `*.adom.cloud` host) with a loopback-Host check to defeat DNS rebinding, and it handles the Private-Network-Access preflight. A web origin may reach only the read-only detection endpoints; `POST /command` is refused for every web origin, so no verb can change the machine from a web page. The planned launch and send actions will each require a native Adom Bridge consent dialog. **Try it live:** [talking to Adom Bridge from a web page](docs/web-control.md) is a working harness that detects your running Adom Bridge, reads its status, and shows the "open KiCad" wall refusing a machine-changing call. Full model: the `adom-bridge-web-integration` skill.  ## Versioning