BRIDGE browser integration is enabled in this build.
TOOLS / NATIVE COMPANION / BRIDGE / CONTRACT 1.0.0Browser first.
Browser first.
Native when needed.
BRIDGE is the native companion for capabilities that need an explicit native boundary. Pair the browser, verify the listener cryptographically and see exactly which boundary needs attention: Local Network Access, loopback availability, BRIDGE identity, protocol negotiation or native capability permission.
WEBhttps://2xbr.comUSER ACTION →LOOPBACK127.0.0.1:57821HMAC / HKDF →BRIDGEPAIR-SCOPED CONTROL
LOCAL CONTROL / EXPLICIT CHECKS ONLY
Pair the browser. Then prove the bridge.
BRIDGE CONTROL separates browser Local Network Access, loopback availability, cryptographic listener identity, protocol negotiation and native TUNNEL permission. A failure in one layer is never mislabeled as another.
CHECKS 2/9PAIRING NONESESSION CLOSEDTUNNELS —
STEP 01 / PAIR · LEGACY / AVAILABLENo browser pairing is stored.
Connect first probes BRIDGE only after your click. If Pairing v2 is advertised, the same browser/profile creates a non-extractable P-256 private key, launches the exact four-parameter native activation and pulls the encrypted result back over loopback. Legacy BRIDGE remains on the v1 callback path.
Running on the approved https://2xbr.com origin.
Pair this browser with the installed 2XBR BRIDGE using an explicit user action.
Permission state has not been checked yet.
Not checked. Run secure diagnosis to access the loopback endpoint explicitly.
Not authenticated yet; capability parameters are withheld until proof succeeds.
Protocol negotiation has not run yet.
Capability negotiation has not run yet.
Native permission is checked only after authenticated session establishment.
SAFE SUPPORT REPORT / 2xbr.bridge-diagnostic/v1
Useful diagnostics without credentials.
The report contains gate/origin/LNA states, negotiated BRIDGE version/capabilities, native permission, pair-owned active count and stable error code. It never accepts pairId, pairing secret, session key, MAC headers, public tunnel URL or protected password as input.
{
"schema": "2xbr.bridge-diagnostic/v1",
"checkedAt": "",
"webOrigin": "production",
"featureGate": "enabled",
"pairing": "absent",
"pairingAge": "unknown",
"localNetworkAccess": "unchecked",
"listenerCheck": "not-run",
"authenticated": false,
"loopbackHostCapability": "legacy",
"steps": [
{
"id": "feature",
"state": "PASS"
},
{
"id": "origin",
"state": "PASS"
},
{
"id": "pairing",
"state": "ACTION"
},
{
"id": "lna",
"state": "UNKNOWN"
},
{
"id": "listener",
"state": "UNKNOWN"
},
{
"id": "identity",
"state": "UNKNOWN"
},
{
"id": "protocol",
"state": "UNKNOWN"
},
{
"id": "capabilities",
"state": "UNKNOWN"
},
{
"id": "permission",
"state": "UNKNOWN"
}
]
}Use browser-first TOOLS when the browser can safely do the job. This advanced BRIDGE surface never grants blanket workstation authority, and loopback access begins only from an explicit diagnostic action.
A process answering on 57821 is not treated as BRIDGE until the paired HMAC identity proof validates and an ephemeral session key is derived.
Browser Local Network Access, cryptographic pairing and cap.tunnel.create permission stay distinct in both state and recovery guidance.
The copyable report is deliberately shaped so credentials, tunnel URLs and protected passwords cannot enter it.