Module viewer 

The viewer: a read-only window onto this channel’s agents for a paired device (agentmux-mobile’s SPEC_AGENT_STATUS_AND_LIVE_PANE_FEED_2026_10_07 §4, §5, §13.2, §13.3).

What it adds next to the LAN routes, and why each part exists:

• a credential that is not public: a per-device viewer token, handed out once against a pairing code shown on this screen, stored hashed, and revocable (pairing, storage::viewer_devices). Never the lan_key (anyone on the network has it) and never the instance auth_key.
• encryption on the wire: the viewer routes are served only on a TLS listener whose self-signed certificate the device pins by the fingerprint in the QR (cert). The listener follows LAN discovery like the other LAN listeners (lan_listeners), on its own port of the LAN port range.
• the feed itself: an agent’s transcript, a bounded snapshot then live appends (feed, the route in server::http_viewer).

Modules

cert

The viewer listener’s certificate: self-signed ECDSA P-256, made once and kept in this instance’s data directory, so its fingerprint (the one a paired device pinned from the QR) survives restarts. No CA is involved and nothing about the certificate itself is trusted; only the fingerprint is.

client

The paired-device side of the viewer: an HTTPS client that accepts exactly one certificate, by the fingerprint the pairing link carried (cert::fingerprint), the way a paired phone does. Used by Tower to read another AgentMux machine’s processes (backend::tower_peers).

feed

The server-side half of the live feed: a FeedHub that watches every published blockfile event in-process (a broker observer, so no WebSocket route is involved) and hands each open feed the changes of the one file it follows: an agent’s transcript (output), or a terminal’s output (term, for the terminal feed in super::terminal); plus the pure pieces of the feed’s wire (cursor, frame truncation, SSE framing) the route assembles.

pairing

Pairing codes and viewer tokens (agentmux-mobile’s SPEC_AGENT_STATUS_AND_LIVE_PANE_FEED_2026_10_07 §13.2).

panes

The panes a paired device lists (GET /agentmux/viewer/panes): every pane of every window and tab, in the order the desktop shows them, plus each agent’s shell drawer (a headless terminal named by the agent block’s term:shellsubblockid, not in any tab). Names, types and whether they run; never a command line, a working directory or any content.

terminal

The pure pieces of a paired device’s terminal feed (GET /agentmux/viewer/terminals/:block_id/feed, the route in server::http_viewer_terminal): where a snapshot of a terminal’s output starts, and how each published append moves the feed’s byte cursor.

Structs

FeedLease

One open feed’s place under the caps. Dropping it frees the place; token is cancelled when the device is revoked.

FeedRegistry 🔒

ViewerService

Enums

FeedRefused

Why a feed was refused.

Constants

LAST_SEEN_EVERY_MS

A device’s last_seen_ms is written at most this often.

MAX_FEEDS

Open feeds this srv serves in all; the next gets 503.

MAX_FEEDS_PER_DEVICE

Open feeds one device may hold; the next gets 503.

Statics

ADVERTISED_PORT 🔒

The port the viewer listener is advertised on, process-wide, for the UDP identity replies (which have no AppState in hand). Installed once by bootstrap; absent in tests.

Functions

advertised_viewer_port

The viewer listener’s port while at least one viewer listener is bound.