Serve OpenFrame gateway URL + JWT from meshcore getServerTargetUrl

[mikhailm-coder]

Why

OpenFrame agents run a core whose only functional difference from upstream is one function — getServerTargetUrl dialing tunnels through the gateway proxy path with the agent JWT. That patched core has been distributed as a frozen disk file (hand-exported CoreModule.js, baked into an oss-lib JAR), so core changes never reached machines and the server's stock core-push mechanism was bypassed. This PR ports the patch into the true core source so the standard MeshCentral push mechanism delivers it — step 1 of retiring the disk-file distribution (agent-side counterpart: flamingo-stack/meshagent#81).

What

agents/meshcore.js — getServerTargetUrl(path): when mesh.authToken() yields a token (native method on flamingo agent binaries; returns null outside --openframe-mode; absent on vanilla agents — hence the typeof guard and try/catch), emit the gateway form used in production today: protocol//host/ws/tools/agent/meshcentral-server/<path>?authorization=<bare-token>, no :port. Otherwise the stock upstream URL. Behavior verified byte-equivalent to the production core for the token case; stock for everyone else.

Rollout notes

• The assembled core hash changes at boot, so agents receive the new core on next connect. Old OpenFrame binaries store-but-ignore pushed cores (disk override) — unaffected. New binaries (meshagent PR) execute it.
• Order matters per env: this image must deploy before the new meshagent binary rolls out — a new binary against an old server core would run stock upstream URLs and lose tunnel connectivity.
• dev/OSS track image tag latest with keel force-poll → auto-roll on merge.

Known parity gaps (not regressions, follow-ups)

• serverFetchFile overwrites the path after URL construction, discarding prefix+token — identical in today's production core.
• Recovery cores (agents/recoverycore.js, agents/agentrecoverycore.js) keep stock getServerTargetUrl — recovery is unused and non-functional in the OpenFrame fleet today; explicitly out of scope.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added authenticated gateway routing when an agent authentication token is available.
  • Preserved direct server connections when no authentication token is present.

[coderabbitai]

📝 Walkthrough

Walkthrough

getServerTargetUrl now routes through the OpenFrame gateway when mesh.authToken() returns a JWT. It appends the token as an authorization query parameter and preserves existing direct server URL behavior when no token exists.

Changes

JWT server routing

Layer / File(s)	Summary
Token-aware URL generation agents/meshcore.js	getServerTargetUrl checks for an agent JWT. When present, it builds the OpenFrame gateway URL and preserves existing query parameters. Without a token, it returns the direct server URL.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: serving the OpenFrame gateway URL and JWT from getServerTargetUrl.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch hotfix/openframe-core-server-push

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agents/meshcore.js`:
- Around line 1157-1159: Update the token-authenticated URL construction in the
gateway request branch to preserve an explicitly configured non-default port
from x.port when building the authority from x.protocol and x.host. Keep
default-port URLs unchanged, and retain the existing path and authorization
query handling.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f518a546-3e6a-4347-8765-96eb473bf4a8

📥 Commits

Reviewing files that changed from the base of the PR and between 4ecedce and db5415f.

📒 Files selected for processing (1)

• agents/meshcore.js