Spaces:
Running
Enable browser curl requests to any HTTPS host
The browser shell currently rejects network commands. This enables curl from Shell and Pi's bash tool for any HTTPS host, using browser fetch without a backend or proxy. For example, Pi can fetch a raw GitHub Gist or download JSON and inspect it with jq.
GET, HEAD, and POST are supported, with an 8-second deadline, a 1 MiB response cap, and cancellation through Stop. Browser CORS still applies; cookies are omitted and redirects require the final URL. Model/tool instructions, the shell footer, setup copy, and HTTP help explain this behavior.
This follows the repository's prebuilt-static-app layout: it replaces the main and agent-worker bundles, removes their superseded versions, adds the help page, and updates the README. The JavaScript bundles are byte-identical to the tested duplicate. The HTML/help retain this Space's identity, and stale townbox metadata/direct-app links now point to victor.
Validation:
- 22 unit tests and the production build passed.
- 17 real-browser shell checks passed on the test Space, including previously unlisted hosts, raw Gists, GET/HEAD/POST, CORS/redirect errors, timeout, cancellation, and persistence.
- Actual MiniCPM5-2B fetched a public Gist and correctly described it in 7.4 seconds.
- A final smoke test applied these exact PR files over the current victor snapshot: raw Gist fetch, non-HTTPS rejection, help page, and canonical metadata passed with no page errors.
Reviewable source and tests: the transport is src/browser-http.mjs, wired through src/workspace.mjs and src/agent.worker.mjs. The validation report records both current results and earlier model limitations (duplicate POSTs and excessive retries). These checks establish the integration, not general agent reliability.