aikido-zen 1.6.0.beta.2-arm64-linux → 1.7.0-arm64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 605bf12f73582ee321281c9992109368292fe8fd8b892845a67a3f61a9b18fe9
-  data.tar.gz: de9ac54f227bf9b62cdd6bdf96b00d4cfae79880d0bbb7bd4054a48312f9296f
+  metadata.gz: 0ffb379e7423fa38477a59c69810a488e9558d2b4e9eabf55d8dbaee38972aa2
+  data.tar.gz: 0d87bf012fe98b6fda0e4e5a8914c4963e79bd408e450766206cd0e30ead389f
 SHA512:
-  metadata.gz: e71903eda24b6507bb187bb20bbf45644514d51d2419626b7dd9010086000d5246eb379c2bc41cc78bc462ae0e0a66f025417bc22029396ebcda716cfd51ec29
-  data.tar.gz: 00d0a9d8df86a856fe7c219732012944c8269f357abfaf1d82b905352ec1bde853b8efb97e2d724db08b530d65d0e5e86fc16f6cb94a3af5b9095d9c800dd152
+  metadata.gz: 5174789571ad048204dfe47ab72f398991bca3a6000362e0165deb896adadf8449557d0295a1270a36f5d02eba600096a14f2e75d4a2a18de0546d0d0d3d6167
+  data.tar.gz: 849de375d72d7ccd824e3d751257a9ac1854f91793db0dc0c36a8155e0c473efa02aa39120ea5f69bfefdad30cbd9a0d29383eb427abaf82e239ccaf0c0022d6

data/lib/aikido/zen/agent.rb

@@ -18,12 +18,14 @@ module Aikido::Zen
 
     def initialize(
       config: Aikido::Zen.config,
+      settings: Aikido::Zen.runtime_settings,
       collector: Aikido::Zen.collector,
       worker: Aikido::Zen::Worker.new(config: config),
       api_client: Aikido::Zen::APIClient.new(config: config),
       api_stream: Aikido::Zen::APIStream.new(config: config)
     )
       @config = config
+      @settings = settings
       @collector = collector
       @worker = worker
       @api_client = api_client
@@ -59,29 +61,39 @@ module Aikido::Zen
         return
       end
 
+      # Code coverage is disabled here because the block is only called when
+      # the process exits.
+      # :nocov:
       at_exit { stop! if started? }
+      # :nocov:
 
       report(Events::Started.new(time: @started_at)) do |response|
-        if update_settings_from_runtime_config!(response)
+        if update_settings_from_runtime_config!(response, reason: "after start")
           updated_settings!
-          @config.logger.info("Updated runtime settings")
+
+          if @config.realtime_settings_updates_enabled? || @settings.realtime_settings_updates_enabled?
+            @api_stream.handle("config-updated") do |event|
+              @config.logger.debug("Received server-sent event: config-updated")
+              settings_updated(event)
+            end
+
+            @api_stream.start!
+          end
+        # :nocov:
+        else
+          # empty
         end
+        # :nocov:
       rescue => err
         @config.logger.error(err.message)
       end
 
       begin
-        update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
-        @config.logger.info("Updated runtime firewall list")
+        update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after start")
       rescue => err
         @config.logger.error(err.message)
       end
 
-      if @config.realtime_settings_updates_enabled?
-        @api_stream.handle("config-updated") { |event| settings_updated(event) }
-        @api_stream.start!
-      end
-
       poll_for_setting_updates
 
       @config.initial_heartbeat_delays.each do |heartbeat_delay|
@@ -167,13 +179,15 @@ module Aikido::Zen
 
       heartbeat = @collector.flush
       report(heartbeat) do |response|
-        if update_settings_from_runtime_config!(response)
+        if update_settings_from_runtime_config!(response, reason: "after heartbeat")
           updated_settings!
-          @config.logger.info("Updated runtime settings after heartbeat")
 
-          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
-          @config.logger.info("Updated runtime firewall list after heartbeat")
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after heartbeat")
+        # :nocov:
+        else
+          # empty
         end
+        # :nocov:
       end
     end
 
@@ -185,15 +199,17 @@ module Aikido::Zen
     # @return [void]
     # @see Aikido::Zen::RuntimeSettings
     def poll_for_setting_updates
-      @worker.every(@config.polling_interval) do
+      @worker.every(@config.polling_interval, run_now: true) do
         if @api_client.should_fetch_settings?
-          if update_settings_from_runtime_config!(@api_client.fetch_runtime_config)
+          if update_settings_from_runtime_config!(@api_client.fetch_runtime_config, reason: "after polling")
             updated_settings!
-            @config.logger.info("Updated runtime settings after polling")
+          # :nocov:
+          else
+            # empty
           end
+          # :nocov:
 
-          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
-          @config.logger.info("Updated runtime firewall list after polling")
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after polling")
         end
       end
     end
@@ -204,13 +220,15 @@ module Aikido::Zen
       updated_at = Time.at(event[:data]["configUpdatedAt"].to_i)
 
       if should_fetch_settings?(updated_at)
-        if update_settings_from_runtime_config!(@api_client.fetch_runtime_config)
+        if update_settings_from_runtime_config!(@api_client.fetch_runtime_config, reason: "after server-sent event")
           updated_settings!
-          @config.logger.info("Updated runtime settings after server-side event")
 
-          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
-          @config.logger.info("Updated runtime firewall list after server-side event")
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists, reason: "after server-sent event")
+        # :nocov:
+        else
+          # empty
         end
+        # :nocov:
       end
     end
 
@@ -229,24 +247,44 @@ module Aikido::Zen
     end
 
     # @param data [Hash]
-    # @return [Boolean]
-    def update_settings_from_runtime_config!(data)
+    # @param reason [String] context appended to the log message when logged
+    # @return [Boolean] whether the settings were updated; or nil if another
+    #   thread is already applying an update.
+    def update_settings_from_runtime_config!(data, reason:)
+      # :nocov:
       return unless @runtime_config_update_mutex.try_lock
+      # :nocov:
       begin
-        Aikido::Zen.api_cache.runtime_config = data
-        Aikido::Zen.runtime_settings.update_from_runtime_config_json(data)
+        return false unless Aikido::Zen.api_cache.update_runtime_config(data)
+
+        if Aikido::Zen.runtime_settings.update_from_runtime_config_json(data)
+          @config.logger.info("Updated runtime settings #{reason}")
+          true
+        else
+          false
+        end
       ensure
         @runtime_config_update_mutex.unlock
       end
     end
 
     # @param data [Hash]
-    # @return [Boolean]
-    def update_settings_from_runtime_firewall_lists!(data)
+    # @param reason [String] context appended to the log message when logged
+    # @return [Boolean] whether the settings were updated; or nil if another
+    #   thread is already applying an update.
+    def update_settings_from_runtime_firewall_lists!(data, reason:)
+      # :nocov:
       return unless @runtime_firewall_lists_update_mutex.try_lock
+      # :nocov:
       begin
-        Aikido::Zen.api_cache.runtime_firewall_lists = data
-        Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(data)
+        return false unless Aikido::Zen.api_cache.update_runtime_firewall_lists(data)
+
+        if Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(data)
+          @config.logger.info("Updated runtime firewall list #{reason}")
+          true
+        else
+          false
+        end
       ensure
         @runtime_firewall_lists_update_mutex.unlock
       end

data/lib/aikido/zen/api_cache.rb

@@ -2,7 +2,60 @@
 
 module Aikido::Zen
   class APICache
-    attr_accessor :runtime_config
-    attr_accessor :runtime_firewall_lists
+    attr_reader :runtime_config
+    attr_reader :runtime_firewall_lists
+    attr_reader :runtime_config_generation
+    attr_reader :runtime_firewall_lists_generation
+
+    def initialize
+      @runtime_config_generation = 0
+      @runtime_firewall_lists_generation = 0
+    end
+
+    def runtime_config=(value)
+      update_runtime_config(value)
+    end
+
+    def runtime_firewall_lists=(value)
+      update_runtime_firewall_lists(value)
+    end
+
+    # @param value [Hash, nil]
+    # @return [Boolean] whether the value actually changed
+    def update_runtime_config(value)
+      return false if value == @runtime_config
+
+      @runtime_config_generation += 1
+      @runtime_config = value
+
+      true
+    end
+
+    # @param value [Hash, nil]
+    # @return [Boolean] whether the value actually changed
+    def update_runtime_firewall_lists(value)
+      return false if value == @runtime_firewall_lists
+
+      @runtime_firewall_lists_generation += 1
+      @runtime_firewall_lists = value
+
+      true
+    end
+
+    # @param known_generation [Integer, nil]
+    # @return [Array(Object, Integer), nil] the current value and generation,
+    #   or nil if the known generation is already current.
+    def config_if_changed(known_generation)
+      return nil if known_generation == runtime_config_generation
+      [runtime_config, runtime_config_generation]
+    end
+
+    # @param known_generation [Integer, nil]
+    # @return [Array(Object, Integer), nil] the current value and generation,
+    #   or nil if the known generation is already current.
+    def firewall_lists_if_changed(known_generation)
+      return nil if known_generation == runtime_firewall_lists_generation
+      [runtime_firewall_lists, runtime_firewall_lists_generation]
+    end
   end
 end

data/lib/aikido/zen/api_stream.rb

@@ -116,12 +116,18 @@ module Aikido::Zen
       http.open_timeout = @open_timeout
       http.write_timeout = @write_timeout
       http.read_timeout = @read_timeout
+      # Working around Net::HTTP cleverness; retries GET requests once by default.
       http.max_retries = 0
 
       request = Net::HTTP::Get.new("/api/runtime/stream")
       request["Authorization"] = @token
       request["Accept"] = "text/event-stream"
       request["Cache-Control"] = "no-cache"
+      request["X-Agent-Platform"] = "ruby"
+      request["X-Agent-Version"] = Aikido::Zen::VERSION
+      # Working around Net::HTTP cleverness; auto-negotiates gzip and buffers
+      # decompressed output internally.
+      request["Accept-Encoding"] = "identity"
 
       @config.logger.debug("API stream connecting")
       http.start

data/lib/aikido/zen/config.rb

@@ -60,6 +60,10 @@ module Aikido::Zen
     #   poll the parent process for updated runtime settings. Defaults to 10 seconds.
     attr_accessor :worker_process_polling_interval
 
+    # @return [Integer] the maximum random delay in seconds before a forked
+    #   worker process starts polling. Defaults to 10 seconds.
+    attr_accessor :worker_process_polling_jitter
+
     # @return [Integer] the interval in seconds at which forked worker processes
     #   flush their collected stats to the parent process. Defaults to 10 seconds.
     attr_accessor :worker_process_heartbeat_interval
@@ -237,6 +241,7 @@ module Aikido::Zen
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
       self.worker_process_polling_interval = 10
+      self.worker_process_polling_jitter = 10
       self.worker_process_heartbeat_interval = 10
       self.json_encoder = DEFAULT_JSON_ENCODER
       self.json_decoder = DEFAULT_JSON_DECODER

data/lib/aikido/zen/runtime_settings/ip_list.rb

@@ -29,10 +29,13 @@ module Aikido::Zen
       @ipv6_ranges = []
 
       ips.each do |ip|
+        range = ip.to_range
+        ip_int_range = (range.begin.to_i..range.end.to_i)
+
         if ip.ipv4?
-          @ipv4_ranges << ip.to_range
+          @ipv4_ranges << ip_int_range
         elsif ip.ipv6?
-          @ipv6_ranges << ip.to_range
+          @ipv6_ranges << ip_int_range
         else
           raise ArgumentError, "Unsupported IP address family: #{ip.inspect}"
         end
@@ -50,10 +53,12 @@ module Aikido::Zen
       native_ip = nativize_ip(ip)
       return false if native_ip.nil?
 
+      ip_int = native_ip.to_i
+
       if native_ip.ipv4?
-        ranges_cover?(@ipv4_ranges, native_ip)
+        ranges_cover?(@ipv4_ranges, ip_int)
       elsif native_ip.ipv6?
-        ranges_cover?(@ipv6_ranges, native_ip)
+        ranges_cover?(@ipv6_ranges, ip_int)
       else
         raise ArgumentError, "Unsupported IP address family: #{ip.inspect}"
       end
@@ -78,12 +83,12 @@ module Aikido::Zen
       end
     end
 
-    def ranges_cover?(ranges, ip)
-      index = ranges.bsearch_index { |range| range.begin > ip }
+    def ranges_cover?(ranges, ip_int)
+      index = ranges.bsearch_index { |range| range.begin > ip_int }
       index = index ? index - 1 : ranges.size - 1
       return false if index < 0
 
-      ranges[index].cover?(ip)
+      ranges[index].cover?(ip_int)
     end
   end
 end

data/lib/aikido/zen/runtime_settings.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "set"
+
 module Aikido::Zen
   # Stores the firewall configuration sourced from the Aikido dashboard. This
   # object is updated by the Agent regularly.
@@ -11,7 +13,25 @@ module Aikido::Zen
   #
   # You can subscribe to changes with +#add_observer(object, func_name)+, which
   # will call the function passing the settings as an argument
-  RuntimeSettings = Struct.new(:updated_at, :heartbeat_interval, :endpoints, :blocked_user_ids, :bypassed_ips, :received_any_stats, :blocking_mode, :blocked_user_agent_regexp, :monitored_user_agent_regexp, :user_agent_details, :blocked_ip_lists, :allowed_ip_lists, :monitored_ip_lists, :block_new_outbound, :domains, :excluded_user_ids_from_rate_limiting) do
+  RuntimeSettings = Struct.new(
+    :updated_at,
+    :heartbeat_interval,
+    :endpoints,
+    :blocked_user_ids,
+    :bypassed_ips,
+    :received_any_stats,
+    :blocking_mode,
+    :blocked_user_agent_regexp,
+    :monitored_user_agent_regexp,
+    :user_agent_details,
+    :blocked_ip_lists,
+    :allowed_ip_lists,
+    :monitored_ip_lists,
+    :block_new_outbound,
+    :domains,
+    :excluded_user_ids_from_rate_limiting,
+    :enabled_features
+  ) do
     def initialize(*)
       super
       self.endpoints ||= RuntimeSettings::Endpoints.new
@@ -20,6 +40,7 @@ module Aikido::Zen
       self.allowed_ip_lists ||= []
       self.monitored_ip_lists ||= []
       self.domains ||= RuntimeSettings::Domains.new
+      self.enabled_features ||= Set.new
     end
 
     # @!attribute [rw] updated_at
@@ -73,6 +94,9 @@ module Aikido::Zen
     #   @return [Array<String>, nil] the user IDs that should be skipped from
     #     rate limiting entirely.
 
+    # @!attribute [rw] enabled_features
+    #   @return [Set<String>]
+
     # Parse and interpret the JSON response from the core API with updated
     # runtime settings, and apply the changes.
     #
@@ -97,6 +121,8 @@ module Aikido::Zen
 
       self.excluded_user_ids_from_rate_limiting = data["excludedUserIdsFromRateLimiting"]
 
+      self.enabled_features = Set.new(data["enabledFeatures"])
+
       updated_at != last_updated_at
     end
 
@@ -223,6 +249,14 @@ module Aikido::Zen
 
       (!domain.nil? && domain.block?) || (domain.nil? && block_new_outbound)
     end
+
+    private def enabled_feature?(feature)
+      enabled_features.include?(feature)
+    end
+
+    def realtime_settings_updates_enabled?
+      enabled_feature?("realtime_updates")
+    end
   end
 end
 

data/lib/aikido/zen/sinks/httpx.rb

@@ -70,6 +70,10 @@ module Aikido::Zen
               Helpers.scan(wrapped_request, connection, "request")
 
               request.on(:response) do |response|
+                # HTTPX emits an ErrorResponse (no status/headers) through this
+                # same callback when the request fails at the transport level.
+                next if response.is_a?(::HTTPX::ErrorResponse)
+
                 Scanners::SSRFScanner.track_redirects(
                   request: wrapped_request,
                   response: Helpers.wrap_response(response)

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.6.0.beta.2"
+    VERSION = "1.7.0"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

data/lib/aikido/zen/worker_process/agent/client.rb

@@ -16,6 +16,7 @@ module Aikido::Zen::WorkerProcess
         worker: Aikido::Zen::Worker.new(config: config),
         keepalive_worker: Aikido::Zen::Worker.new(config: config),
         polling_interval: config.worker_process_polling_interval,
+        polling_jitter: config.worker_process_polling_jitter,
         heartbeat_interval: config.worker_process_heartbeat_interval,
         collector: Aikido::Zen.collector
       )
@@ -23,10 +24,14 @@ module Aikido::Zen::WorkerProcess
         @worker = worker
         @keepalive_worker = keepalive_worker
         @polling_interval = polling_interval
+        @polling_jitter = polling_jitter
         @heartbeat_interval = heartbeat_interval
         @collector = collector
 
         @rpc_client = Aikido::Zen::RPC::Client.new(secret, host, port, reconnect: true)
+
+        @known_config_generation = nil
+        @known_firewall_lists_generation = nil
       end
 
       def close
@@ -34,14 +39,7 @@ module Aikido::Zen::WorkerProcess
       end
 
       def start
-        @rpc_client.start do
-          @worker.perform do
-            update_settings(updated_settings)
-          rescue => err
-            @config.logger.error("Forked worker process #{Process.pid}: failed to get settings after connecting to parent: #{err.message}")
-          end
-        end
-
+        @rpc_client.start
         schedule_tasks
       end
 
@@ -73,35 +71,66 @@ module Aikido::Zen::WorkerProcess
       private
 
       def updated_settings
-        @rpc_client.invoke("updated_settings", KEEPALIVE_INTERVAL)
+        @rpc_client.invoke(
+          "updated_settings",
+          KEEPALIVE_INTERVAL,
+          @known_config_generation,
+          @known_firewall_lists_generation
+        )
       end
 
-      def update_settings(settings)
-        return unless settings
+      def update_settings
+        settings = updated_settings
+        return false unless settings
+        return false unless settings["config"] || settings["firewall_lists"]
+
+        @config.logger.debug("Forked worker process #{Process.pid}: starting runtime settings update")
 
         if settings["config"]
+          @config.logger.debug("Forked worker process #{Process.pid}: starting config update")
           Aikido::Zen.runtime_settings.update_from_runtime_config_json(settings["config"])
+          @known_config_generation = settings["config_generation"]
+          @config.logger.debug("Forked worker process #{Process.pid}: finished config update")
         end
 
         if settings["firewall_lists"]
+          @config.logger.debug("Forked worker process #{Process.pid}: starting firewall_lists update")
           Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(settings["firewall_lists"])
+          @known_firewall_lists_generation = settings["firewall_lists_generation"]
+          @config.logger.debug("Forked worker process #{Process.pid}: finished firewall_lists update")
         end
+
+        @config.logger.debug("Forked worker process #{Process.pid}: finished runtime settings update")
+
+        true
+      rescue => err
+        @config.logger.error("Forked worker process #{Process.pid}: failed to get settings from parent: #{err.message}")
+        false
       end
 
       def schedule_tasks
         @keepalive_worker.every(KEEPALIVE_INTERVAL, run_now: false) { keepalive }
 
-        @worker.every(@polling_interval, run_now: false) do
-          update_settings(updated_settings)
-
-          @config.logger.debug("Forked worker process #{Process.pid}: updated runtime settings from parent")
-        rescue => err
-          @config.logger.error("Forked worker process #{Process.pid}: failed to get settings from parent: #{err.message}")
-        end
+        # Delay start polling to reduce the chance of workers polling in lockstep.
+        delay = polling_start_delay
+        @config.logger.debug("Forked worker process #{Process.pid}: will start polling in #{delay}s")
+        @worker.delay(delay) { start_polling }
 
         @worker.every(@heartbeat_interval, run_now: false) { send_collector_events }
       end
 
+      def start_polling
+        @config.logger.debug("Forked worker process #{Process.pid}: started polling")
+        @worker.every(@polling_interval, run_now: true) { update_settings }
+      end
+
+      def polling_start_delay
+        return 0 if @polling_jitter < 1
+
+        # Seed by pid because forked processes inherit identical PRNG state.
+        Random.new(Process.pid).rand(1..@polling_jitter)
+      end
+
       def keepalive
         @rpc_client.invoke("ping", KEEPALIVE_INTERVAL)
       rescue => err

data/lib/aikido/zen/worker_process/agent/server.rb

@@ -12,8 +12,8 @@ module Aikido::Zen::WorkerProcess
           respond.call(nil)
         end
 
-        @rpc_server.handle("updated_settings") do |respond|
-          respond.call(updated_settings)
+        @rpc_server.handle("updated_settings") do |respond, known_config_generation = nil, known_firewall_lists_generation = nil|
+          respond.call(updated_settings(known_config_generation, known_firewall_lists_generation))
         end
 
         @rpc_server.handle("send_collector_events") do |respond, events_data|
@@ -64,11 +64,20 @@ module Aikido::Zen::WorkerProcess
       # Visible for testing.
       RequestKind = Struct.new(:route, :schema, :client_ip, :actor)
 
-      def updated_settings
-        {
-          "config" => Aikido::Zen.api_cache.runtime_config,
-          "firewall_lists" => Aikido::Zen.api_cache.runtime_firewall_lists
-        }
+      def updated_settings(known_config_generation = nil, known_firewall_lists_generation = nil)
+        result = {}
+
+        config_change = Aikido::Zen.api_cache.config_if_changed(known_config_generation)
+        if config_change
+          result["config"], result["config_generation"] = config_change
+        end
+
+        firewall_lists_change = Aikido::Zen.api_cache.firewall_lists_if_changed(known_firewall_lists_generation)
+        if firewall_lists_change
+          result["firewall_lists"], result["firewall_lists_generation"] = firewall_lists_change
+        end
+
+        result
       end
 
       def send_collector_events(events_data)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.6.0.beta.2
+  version: 1.7.0
 platform: arm64-linux
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-16 00:00:00.000000000 Z
+date: 2026-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby