fix: screenshot Bearer auth + Node 24 preflight

[matthewhand]

REQ-004: land the real screenshot Bearer + Node 24 preflight fix on matthewhand/OpenMausBot main without swallowing upstream. Success: a focused PR against current main, CI green, squash-mergeable. Diff should be the Bearer/Node24 fix only (small file count), not 687 files.

What changed

Cherry-picked the unique Bearer / screenshot / Node 24 work from cursor/screenshot-bearer-node24-19c5 (PR #19) onto current origin/main. Does not include #19's later upstream merge.

1. Screenshot / API Bearer — ComputerPanel’s local api() (live POST /api/local-computer/screenshot and POST /api/bots/:id/computer/screenshot polls), store api(), and LocalComputerSection leftover fetches now share lanAuthRequestInit(). When ombAuthToken is set they send Authorization: Bearer …; when it is not, they send no Authorization (loopback / auth-off unchanged). Does not implement server-side LAN bind, CORS, or the Add opt-in LAN auth with Bearer and EventSource token #16 threat model.

2. Node 24 preflight — server/index.ts calls assertSupportedNode() before listening. Node <24 exits 1 with a readable requires Node >= 24 message instead of the ~85 misleading vitest failures.

Diff vs main: 8 files, +289 / −11. Squash-merge ready.

Why

#18 predicted that #11’s raw screenshot fetch() plus #16’s LAN Bearer would 401 “Watch screen” over LAN. On today’s main the same hole is ComputerPanel’s unauthenticated screenshot client. engines.node: >=24 was install-warning only.

PR #19 claimed to be this targeted fix but its branch later merged a large upstream sync (cursor/sync-upstream-9dfe / 687 files / ~123k additions). Do not squash-merge #19. This PR is the extracted unique work only.

How it was verified

On Node 24.20.0:

• pnpm typecheck
• pnpm vitest run src/lib/lan-auth.test.ts server/node-preflight.test.ts — 19 passed (Bearer presence/absence + screenshot POST contract; Node 22 rejected; Node 24+ accepted; engines stays in sync)
• Live boot: /exec-daemon/node (v22.14.0) exits 1 with requires Node >= 24; Node 24.20 serves /api/health ({"app":"openmausbot",...})
• Full pnpm test: 102 files / 995 passed + broker, updater, packaged-server smoke
• pnpm check:electron

GitHub CI on this PR: all 6 checks green (typecheck+test on macOS/Ubuntu/Windows, Linux package smoke, iOS/Swift, Amazon Q).

Investigation notes:

• Unique first-parent commits on fix: screenshot Bearer auth + Node 24 preflight (targeted, not a rebase) #19’s branch vs current main: 3c13caf (Bearer + Node 24), fb45485 (typecheck/anti-slop), plus a later test-path tweak after the upstream merge.
• The post-merge path change (/api/bots/:id/local-computer/screenshot) is not on current main. This PR keeps the contract against the URLs that actually exist here: /api/local-computer/screenshot and /api/bots/:id/computer/screenshot.
• Unique work was not already on main (lanAuthRequestInit / assertSupportedNode absent). fix: screenshot Bearer auth + Node 24 preflight (targeted, not a rebase) #19 was left open with a do-not-merge comment rather than closed, because the extracted work is not on main until this PR lands.

Screenshots (UI changes)

No visual UI change. Header attachment is covered by tests, not pixels.

Checklist

• pnpm typecheck and pnpm test pass locally
• Server behavior changes come with tests (see CONTRIBUTING.md → Tests)
• No dist-server/ edits (it's build output)
• macOS-only code is platform-gated; no shell: true / cmd.exe string-building
• No secrets in logs, responses, events, or argv

Out of scope

• Do not merge PR Review only: skeptical review of fork UI and architecture (do not merge) #18 (review only).
• Do not merge draft PRs Do not open loopback computer URLs from a LAN tab #11–17, Sync fork with upstream milind-soni/OpenMausBot main #20–22.
• Do not merge PR fix: screenshot Bearer auth + Node 24 preflight (targeted, not a rebase) #19 (687 files / ~123k additions / upstream swallow).
• LAN auth threat model, NSSM policy, custom-MCP allowlist: unchanged.

Matthew: please squash-merge this PR. This agent cannot perform the squash-merge. After merge, Windows2 can pull on 10.0.0.32.

  

[amazon-q-developer]

The PR successfully adds Node.js version gating and centralized LAN authentication support. All implementations are correct and follow the existing patterns in the codebase.

Key additions:

• Node version preflight check: Validates Node >= 24 before server startup to prevent confusing runtime errors
• LAN authentication module: Provides a shared authentication layer for bearer token management across the React app
• Consistent auth integration: Updates all fetch calls in ComputerPanel, LocalComputerSection, and store.tsx to use the new lanAuthRequestInit helper

The code is production-ready with no blocking issues identified.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.