adds rver side of localhost backdoor

lens app stub

app/lens.hoon

@@ -0,0 +1,79 @@
+/+  *server
+=,  format
+|%
+:: +move: output effect
+::
++$  move  [bone card]
+:: +card: output effect payload
+::
++$  card
+  $%  [%connect wire binding:http-server term]
+      [%serve wire binding:http-server generator:http-server]
+      [%disconnect wire binding:http-server]
+      [%http-response =http-event:http]
+      [%poke wire dock poke]
+      [%diff %json json]
+  ==
+::
++$  poke
+  $%  [%modulo-bind app=term]
+      [%modulo-unbind app=term]
+  ==
+::
++$  state
+  $%  $:  %0   
+          session=(map term @t)
+          order=(list term)
+          cur=(unit [term @])
+      ==
+  ==
+::
+--
+::
+|_  [bow=bowl:gall sta=state]
+::
+++  this  .
+::
+++  prep
+  |=  old=(unit *)
+  ^-  (quip move _this)
+  [~ this]
+::
+::  alerts us that we were bound. we need this because the vane calls back.
+::
+++  bound
+  |=  [wir=wire success=? binding=binding:http-server]
+  ^-  (quip move _this)
+  [~ this]
+::
+++  poke-handle-http-request
+  %-  (require-authorization:app ost.bow move this)
+  |=  =inbound-request:http-server
+  ^-  (quip move _this)
+  ::
+  =/  request-line  (parse-request-line url.request.inbound-request)
+  =/  site  (flop site.request-line)
+  ::
+  =/  htm
+    %-  manx-to-octs
+    ;div: successfully contacted lens
+  ~&  lens+inbound-request
+  :_  this
+  [ost.bow %http-response (html-response:app htm)]~
+::
+::  +poke-handle-http-cancel: received when a connection was killed
+::
+++  poke-handle-http-cancel
+  |=  =inbound-request:http-server
+  ^-  (quip move _this)
+  ::  the only long lived connections we keep state about are the stream ones.
+  ::
+  [~ this]
+::
+++  poke-noun
+  |=  a=*
+  ^-  (quip move _this)
+  ~&  poke+a
+  [~ this]
+::
+--

sys/vane/rver.hoon

@@ -675,6 +675,31 @@
   ::
   |=  [[our=@p eny=@ =duct now=@da scry=sley] state=server-state]
   |%
+  ::  +request-local: bypass authentication for local lens connections
+  ::
+  ++  request-local
+    |=  [secure=? =address =request:http]
+    ^-  [(list move) server-state]
+    ::
+    =/  act  [%app app=%lens]
+    =/  connection=outstanding-connection
+      [act [& secure address request] ~ 0]
+    ::
+    =.  connections.state
+      (~(put by connections.state) duct connection)
+    ::
+    :_  state
+    :_  ~
+    :^  duct  %pass  /run-app/[app.act]
+    ^-  note
+    :^  %g  %deal  [our our]
+    ::
+    ^-  cush:gall
+    :*  app.act
+        %poke
+        %handle-http-request
+        !>(inbound-request.connection)
+    ==
   ::  +request: starts handling an inbound http request
   ::
   ++  request
@@ -1784,8 +1809,14 @@
     ==
   ::
       %request
+    ~&  task
     =^  moves  server-state.ax  (request:server +.task)
     [moves http-server-gate]
+  ::
+      %request-local
+    ~&  task
+    =^  moves  server-state.ax  (request-local:server +.task)
+    [moves http-server-gate]
   ::
       %cancel-request
     =^  moves  server-state.ax  cancel-request:server

sys/zuse.hoon

@@ -2251,6 +2251,9 @@
           ::  starts handling an inbound http request
           ::
           [%request secure=? =address =request:http]
+          ::  starts handling an backdoor http request
+          ::
+          [%request-local secure=? =address =request:http]
           ::  cancels a previous request
           ::
           [%cancel-request ~]