{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=lgoyal6/listening-surface@0.1.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Answers one question about the machine it runs on: what is listening right now, who owns it, and how far can it be reached. A dev machine accumulates listeners - a forgotten npm run dev, a database a compose file published on every interface months ago, a tunnel, an agent harness on a debug port - and no source scan can answer it, because the answer is live kernel state rather than a file. Bound sockets come from lsof with their owning process, and from netstat as well, because an unprivileged lsof cannot see other users' processes and the difference between the two lists is the set of listeners that could not be attributed, which are named rather than dropped. The grade follows the bind address, which is the whole security question: 127.0.0.1 and ::1 are reachable from this host alone, 0.0.0.0 and :: are every interface including the local network, and a specific LAN address is in between. Each process is then traced to a supervisor - a launchd label, a Homebrew service, a Docker container or compose project","distribution":{"digest":"sha256:8dfcf60feb4c4a2c0404c4450bcb526190fff688de81f877afff182c443ac078","mediaType":"application/vnd.modiqo.rote-flow","size":31582,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0.json"},"name":"listening-surface","owner":{"kind":"user","slug":"lgoyal6"},"parameters":[{"description":"Absolute directory to index for on-disk port declarations (docker-compose files). A process.exec step runs in rote's workspace, not your shell, so a relative path would index the wrong tree and turn every declared listener into an undeclared one; a relative value is refused.","example":"/Users/you/src","input":{"allowCustom":true,"choices":[],"label":"Root"},"name":"root","required":true,"type":"string"},{"default":"4","description":"How many directory levels below root to search for compose files","example":"3","input":{"allowCustom":true,"choices":[],"label":"Depth"},"name":"depth","required":false,"type":"string"},{"default":"false","description":"Also read bound UDP sockets. UDP has no LISTEN state so every bound socket is reported, which is noisier; on by default would bury the TCP answer.","example":"true","input":{"allowCustom":true,"choices":[],"label":"Include udp"},"name":"include_udp","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/listening-surface@0.1.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.79.0"},"publishedAt":"2026-09-04T06:53:16.810417+00:00","reference":"lgoyal6/listening-surface@0.1.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["bash","python3","lsof","netstat","launchctl","ps","awk","find","grep","mktemp","rm","sort","tr","wc","docker"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":2,"installs":0},"steps":{"count":3,"names":["analyze","discover","verify"]},"title":"listening-surface","type":"play","version":"0.1.0","visibility":"public"}