scema_daemon/lib.rs
1//! # scema-daemon — the loop, reachable
2//!
3//! `scema-omnid` puts the omni cognitive loop behind a loopback HTTP surface so the browser
4//! extension, the web console and anything else on the machine can drive it without each of
5//! them re-implementing perception, simulation and verification.
6//!
7//! ```text
8//! extension service worker ─┐
9//! /omni console ────────────┼─▶ 127.0.0.1:7842 ─▶ scema-agent ─▶ .scema/
10//! curl / scripts ───────────┘ (token)
11//! ```
12//!
13//! ## The security model, in four sentences
14//!
15//! The daemon reads the operator's filesystem and answers questions about it, so it binds
16//! to **loopback only and the interface is not configurable** — the one thing that reliably
17//! happens to a `--bind` flag is somebody setting it to `0.0.0.0`. Loopback is not privacy:
18//! every local process, and every web page in the operator's own browser, can reach
19//! `127.0.0.1`, so a **256-bit bearer token** is what actually authorises, compared in
20//! constant time. A `Host` header check rejects **DNS rebinding**, the one manoeuvre that
21//! makes a page same-origin with a localhost service and therefore able to read its
22//! replies. Every path a client names is resolved through a [`scema_tools::Workspace`]
23//! before anything opens it.
24//!
25//! No `Access-Control-Allow-Origin` is ever emitted and no `OPTIONS` is handled, so an
26//! ordinary web page cannot read a response even if it guesses a route. The extension is
27//! unaffected: it fetches from its service worker under `host_permissions`, which is not
28//! subject to CORS.
29//!
30//! ## What it will not do
31//!
32//! `POST /decide` seals a record and appends memory — a local write, but a write — and it
33//! is **off until `--allow-decide`**. `POST /simulate` never persists, and it constructs its
34//! own non-persisting agent rather than flipping a flag on the shared one, because two
35//! concurrent requests against a shared mutable flag is a race whose failure mode is a
36//! simulation quietly sealing a record.
37//!
38//! There is still no write path to the observed environment. See `scema-agent`.
39
40pub mod auth;
41pub mod http;
42pub mod routes;
43
44pub use routes::State;
45
46/// Default port. Arbitrary, in the IANA dynamic range, and unlikely to collide with a dev
47/// server.
48pub const DEFAULT_PORT: u16 = 7842;