Skip to main content

Local research service

pnpm research:serve starts a dependency-free service on http://127.0.0.1:9013. It is a local process bridge, not a hosted API.

EndpointPurpose
GET /healthservice availability and active-run identifier
GET /sessionissue the per-process browser session token to an allowed local origin
GET /runsconfined local run inventory
GET /runs/:idsanitized run detail
POST /runsstart one predefined PPO job
POST /runs/:id/stopstop the active job
GET /runs/:id/eventsserver-sent progress events
GET /runs/:id/artifacts/:nameread an allowed run artifact

Security controls​

  • Binding is explicitly loopback-only; startup fails rather than falling back to a public interface.
  • Every route after /health requires an allowed local origin. Run, event, and artifact routes additionally require the per-process session token returned by /session.
  • Request bodies use explicit seed, timestep, and episode-limit schemas.
  • The process command is fixed by the service; user input never becomes a shell command, executable path, or environment variable.
  • Run IDs, paths, file extensions, and resolved targets are validated beneath .exepert/runs to reject traversal and symlink escape.
  • Only one training process may be active, and stop/server-shutdown paths clean up the child process.
  • Error and progress output is bounded and sanitized. Secrets are neither read nor returned.

The session response is intentionally available only to an allowed local origin and returns a short-lived in-memory token. This design protects against unrelated web pages; it is not a multi-user authentication system or permission to expose port 9013 to a network.

Hosted application boundary​

Vercel serves the static EXEPERT application and documentation; it does not run this service, the Node worker, Python, PPO, or local model processes. The hosted Runs view therefore reports the local service as unavailable. Research training uses pnpm research:dev and the local application origin. No Supabase migration, Vercel Function, or hosted secret is required by this alpha.