hub: Start/Stop buttons local-only (public site is launch-only, no RCE surface)

366d33f874847b713c207dedeea509fd005fb4d6 · 2026-07-28 16:32:58 -0700 · Steve

Files touched

M public/index.html

Diff

commit 366d33f874847b713c207dedeea509fd005fb4d6
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jul 28 16:32:58 2026 -0700

    hub: Start/Stop buttons local-only (public site is launch-only, no RCE surface)
---
 public/index.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/public/index.html b/public/index.html
index 4530421..13fd966 100644
--- a/public/index.html
+++ b/public/index.html
@@ -176,7 +176,8 @@ function render(){
     const url=t.port?`http://${host}:${t.port}/`:null;
     const launchable=st==='up'&&url;
     const go=url?`<a class="act go ${st==='up'?'':'off'}" href="${url}" target="_blank" rel="noopener noreferrer">Launch ↗</a>`:'';
-    const sb=(!t.cli&&!t.missingSource&&t.port)?(st==='up'
+    // Start/Stop only on the LOCAL Mac hub (TOOLHOST==='') — public site stays launch-only (no RCE surface)
+    const sb=(!TOOLHOST&&!t.cli&&!t.missingSource&&t.port)?(st==='up'
       ?`<button class="act stop" data-verb="stop" data-slug="${t.slug}">Stop ■</button>`
       :`<button class="act start" data-verb="start" data-slug="${t.slug}">Start ▶</button>`):'';
     const badges=[t.onDemand?'💤 on-demand':'',t.cli?'⌨️ CLI':'',t.static?'📄 static':'',t.missingSource?'⚠️ missing source':'']

← 2c90036 hub UI → internal-line-viewer pattern: left aside with colla · back to Tools Dw Hub · chore: v1.1.0 (session close) — start/stop from hub + intern 117e94f →