18790a7e4e
Three bugs, all found standing up a second rig on m3ultra:
1. SECURITY: HTTPServer(("", 8017)) bound 0.0.0.0 with no auth, and POST /save
base64-writes bytes to an absolute `dest` taken straight from the request body.
Anyone on the same wifi could write arbitrary files as this user — drop a
~/Library/LaunchAgents plist and you have code execution. It was live on ultra
(verified: `TCP *:8017 (LISTEN)`, 204 from 192.168.1.249). Now binds 127.0.0.1;
FLOW_BIND overrides for a tailnet IP (utun-routed, LAN still can't reach it).
2. The launchd "self-heal" never healed anything. launch.sh backgrounds the queue
server and exits; without AbandonProcessGroup launchd SIGKILLs the process group
on exit, so every 10-min tick started a server that died a second later. The
server that was actually up had been started by a manual ./launch.sh.
Verified after the fix: kill -> 000 -> kickstart -> 204 on a fresh pid.
3. launch.sh hard-coded "Brave Browser" in the osascript. The extension is loaded
into Chrome on m3ultra. FLOW_BROWSER now names it (default Brave, unchanged
for ultra); m3ultra's plist sets "Google Chrome".
Also chmod +x install.sh launch.sh (both had lost the bit).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
61 lines
2.2 KiB
Bash
Executable File
61 lines
2.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# One-command Flow rinse launcher (macOS). Not headless — Brave must be logged in —
|
|
# but fully unattended once the tab is open and Auto-start is ticked in the popup.
|
|
#
|
|
# ./launch.sh https://labs.google/fx/tools/flow/project/XXXXXXXX
|
|
# FLOW_URL=... ./launch.sh
|
|
#
|
|
# Does three things: start the queue server if it's down, keep the Mac awake, and
|
|
# open OR focus a single Flow tab in Brave (never spawns duplicates).
|
|
#
|
|
# Scheduled every 10 min via launchd for self-healing (see install.sh).
|
|
# NOTE: launchd can't execute scripts inside ~/Documents (macOS TCC blocks it),
|
|
# so the agent runs a COPY at "~/Library/Application Support/flowrinse/" —
|
|
# after editing this file or local_server_example.py, re-run ./install.sh to resync.
|
|
|
|
set -e
|
|
DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
URL="${1:-$FLOW_URL}"
|
|
if [ -z "$URL" ]; then
|
|
echo "Usage: ./launch.sh <flow_project_url> (or set FLOW_URL)"
|
|
exit 1
|
|
fi
|
|
|
|
# 1. queue server on 8017 (nc check avoids consuming a task via /next-task)
|
|
if ! nc -z localhost 8017 2>/dev/null; then
|
|
( cd "$DIR" && caffeinate -s python3 -B local_server_example.py >/tmp/flowrinse.log 2>&1 & )
|
|
echo "started queue server + caffeinate (log: /tmp/flowrinse.log)"
|
|
sleep 1
|
|
else
|
|
echo "queue server already up on 8017"
|
|
fi
|
|
|
|
# 2. open or focus ONE Flow tab (reuses an existing one so it can't double-run).
|
|
# Only `activate` (steal system focus) when opening fresh — on the 10-min launchd
|
|
# tick an existing tab is re-selected inside the browser without yanking you out of
|
|
# whatever you're doing. Selecting the tab also keeps Memory Saver from discarding it.
|
|
#
|
|
# Must name the browser the EXTENSION is loaded into. ultra = Brave, m3ultra = Chrome.
|
|
BROWSER="${FLOW_BROWSER:-Brave Browser}"
|
|
osascript <<OSA
|
|
tell application "$BROWSER"
|
|
set found to false
|
|
repeat with w in windows
|
|
set i to 0
|
|
repeat with t in tabs of w
|
|
set i to i + 1
|
|
if (URL of t) contains "tools/flow/project" then
|
|
set active tab index of w to i
|
|
set index of w to 1
|
|
set found to true
|
|
end if
|
|
end repeat
|
|
end repeat
|
|
if not found then
|
|
activate
|
|
open location "$URL"
|
|
end if
|
|
end tell
|
|
OSA
|
|
echo "$BROWSER focused on Flow. With Auto-start ticked, the rinse begins on load."
|