aikido-zen 1.9.0.beta.4-arm64-linux → 1.9.1-arm64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ada5e55768a0adb9c9311bf01868950a02636af957a14da9766e62a0e0fcb6a6
-  data.tar.gz: 8ace3f901aec31ba41afb86cac79dec53be98a60ec55226b65351aa417b73313
+  metadata.gz: df231e175ddfcbc1a8c21d8c0e23575d13de65a47214a0c191b9b94bdc7d7b51
+  data.tar.gz: 257407c5c9630af6ea66536e4ffc2ae9e8042b5eba98eb53f5baa61bf04d1ba8
 SHA512:
-  metadata.gz: da321436b2e4cdb30c8fa6d3456c771bb9bb56f44afd9b5269a5f5cef1f6af8bdb59ab4dca7a05ce2336d46ac98b57aa407307514270cb7ec7f55707d2fd857c
-  data.tar.gz: 9ae53b66ccd877aae99d0fd59735c23e5e6bc9ffcc71231835eb52e0f4cfce4f51ebb594458df56dcbb9ec855646c46178e59f26040bd7a4a1d870056fc957cb
+  metadata.gz: d758d8a41ab1387576a0202135df2526f62aaa0d594104cce44812051e3941b24edcc7d06d86a9837d8542eab521c08f5d72513b687619c2609183f403a70b3f
+  data.tar.gz: 23997d7f758c63551deff8cefb2d067fa6c0816744f247f6ab15a89d7554aa6f9bfef0e8420a81ec4c66ad1043b7b6702990a6402cb64aed01063f0061478aae

data/lib/aikido/zen/agent.rb

@@ -136,9 +136,7 @@ module Aikido::Zen
 
       # Recording the attack must never prevent us from blocking it.
       begin
-        @config.logger.error(
-          format("Zen has %s a %s: %s", attack.blocked? ? "blocked" : "detected", attack.humanized_name, attack.as_json.to_json)
-        )
+        @config.logger.error(attack_log_message(attack))
 
         report(Events::Attack.new(attack: attack)) if @api_client.can_make_requests?
 
@@ -227,6 +225,21 @@ module Aikido::Zen
 
     private
 
+    def attack_log_message(attack)
+      input = attack.as_json
+
+      format(
+        "Zen has %s a %s: %s(...) originating from %s%s",
+        attack.blocked? ? "blocked" : "detected",
+        attack.humanized_name,
+        attack.operation,
+        input["source"],
+        # The path is built from names in the request, so it can't be trusted
+        # not to split the log line.
+        input["path"].to_s.gsub(/[\r\n]/, " ")
+      )
+    end
+
     def settings_updated(event)
       updated_at = Time.at(event[:data]["configUpdatedAt"].to_i)
 

data/lib/aikido/zen/api_client.rb

@@ -16,12 +16,6 @@ module Aikido::Zen
       @config = config
       @system_info = system_info
       @rate_limiter = rate_limiter
-
-      @should_fetch_settings_endpoint = @config.realtime_endpoint
-    end
-
-    def should_fetch_settings_endpoint=(uri)
-      @should_fetch_settings_endpoint = URI(uri)
     end
 
     # @return [Boolean] whether we have a configured token.
@@ -44,16 +38,16 @@ module Aikido::Zen
 
       response = request(
         Net::HTTP::Get.new("/config", default_headers),
-        base_url: @should_fetch_settings_endpoint
+        base_url: @config.realtime_endpoint,
+        timeout: @config.api_config_timeout
       )
 
       new_updated_at = Time.at(response["configUpdatedAt"].to_i)
       new_updated_at > last_updated_at
     end
 
-    # Fetches the runtime config from the server. In case of a timeout or
-    # other low-lever error, the request will be automatically retried up to two
-    # times, after which it will raise an error.
+    # Fetches the runtime config from the server. Requests are never retried;
+    # on a timeout or other low-level error this raises an error.
     #
     # @return [Hash] decoded JSON response from the server with the runtime
     #   settings.
@@ -61,7 +55,11 @@ module Aikido::Zen
     def fetch_runtime_config
       @config.logger.debug("Fetching new runtime config")
 
-      request(Net::HTTP::Get.new("/api/runtime/config", default_headers))
+      request(
+        Net::HTTP::Get.new("/api/runtime/config", default_headers),
+        base_url: @config.api_endpoint,
+        timeout: @config.api_config_timeout
+      )
     end
 
     def fetch_runtime_firewall_lists
@@ -71,7 +69,11 @@ module Aikido::Zen
         "Accept-Encoding" => "gzip"
       })
 
-      request(Net::HTTP::Get.new("/api/runtime/firewall/lists", headers))
+      request(
+        Net::HTTP::Get.new("/api/runtime/firewall/lists", headers),
+        base_url: @config.api_endpoint,
+        timeout: @config.api_config_timeout
+      )
     end
 
     # @overload report(event)
@@ -111,7 +113,7 @@ module Aikido::Zen
         @config.json_encoder.call(event)
       end
 
-      request(req)
+      request(req, base_url: @config.api_endpoint, timeout: @config.api_events_timeout)
     rescue Aikido::Zen::RateLimitedError
       @rate_limiter.open!
       raise
@@ -121,15 +123,16 @@ module Aikido::Zen
     # response.
     #
     # @param request [Net::HTTPRequest]
-    # @param base_url [URI] which API to use. Defaults to +Config#api_endpoint+.
+    # @param base_url [URI] which API to use.
+    # @param timeout [Numeric] seconds to wait on each connect, read and write.
     #
     # @return [Object] the result of decoding the JSON response from the server.
     #
     # @raise [Aikido::Zen::APIError] in case of a 4XX or 5XX response.
     # @raise [Aikido::Zen::NetworkError] if an error occurs trying to make the
     #   request.
-    private def request(request, base_url: @config.api_endpoint)
-      Net::HTTP.start(base_url.host, base_url.port, http_settings(base_url)) do |http|
+    private def request(request, base_url:, timeout:)
+      Net::HTTP.start(base_url.host, base_url.port, http_settings(base_url, timeout)) do |http|
         response = http.request(request)
 
         case response
@@ -168,11 +171,14 @@ module Aikido::Zen
       end
     end
 
-    private def http_settings(base_url)
-      @http_settings ||= {
+    private def http_settings(base_url, timeout)
+      {
         use_ssl: base_url.scheme == "https",
-        max_retries: 2
-      }.merge(@config.api_timeouts)
+        max_retries: 0,
+        open_timeout: timeout,
+        read_timeout: timeout,
+        write_timeout: timeout
+      }
     end
 
     private def default_headers
@@ -180,7 +186,7 @@ module Aikido::Zen
         "Authorization" => @config.api_token,
         "Accept" => "application/json",
         "User-Agent" => "#{@system_info.library_name} v#{@system_info.library_version}"
-      }
+      }.merge(@system_info.agent_headers)
     end
   end
 end

data/lib/aikido/zen/api_stream.rb

@@ -7,7 +7,9 @@ require "json"
 module Aikido::Zen
   class APIStream
     def initialize(
-      config: Aikido::Zen.config,
+      zen: Aikido::Zen,
+      config: zen.config,
+      system_info: zen.system_info,
       min_backoff: 5,
       max_backoff: 60,
       backoff_reset: 30,
@@ -16,6 +18,7 @@ module Aikido::Zen
       read_timeout: 70
     )
       @config = config
+      @system_info = system_info
       @min_backoff = min_backoff
       @max_backoff = max_backoff
       @backoff_reset = backoff_reset
@@ -123,8 +126,7 @@ module Aikido::Zen
       request["Authorization"] = @token
       request["Accept"] = "text/event-stream"
       request["Cache-Control"] = "no-cache"
-      request["X-Agent-Platform"] = "ruby"
-      request["X-Agent-Version"] = Aikido::Zen::VERSION
+      @system_info.agent_headers.each { |name, value| request[name] = value }
       # Working around Net::HTTP cleverness; auto-negotiates gzip and buffers
       # decompressed output internally.
       request["Accept-Encoding"] = "identity"

data/lib/aikido/zen/attack.rb

@@ -43,13 +43,19 @@ module Aikido::Zen
     end
 
     def as_json
-      {
+      attack_json = {
         "kind" => kind,
         "blocked" => blocked?,
         "metadata" => metadata,
         "operation" => @operation,
         "stack" => @stack
       }.compact.merge(input.as_json)
+
+      if (actor = @context&.request&.actor)
+        attack_json["user"] = {"id" => actor.id, "name" => actor.name}.compact
+      end
+
+      attack_json
     end
 
     def exception(*)

data/lib/aikido/zen/config.rb

@@ -45,8 +45,15 @@ module Aikido::Zen
     #   +https://guard.aikido.dev+.
     attr_reader :realtime_endpoint
 
-    # @return [Hash] HTTP timeouts for communicating with the API.
-    attr_reader :api_timeouts
+    # @return [Numeric] the timeout in seconds for reporting events to the
+    #   API (+POST /api/runtime/events+). Applied to each connect, read and
+    #   write wait. Defaults to 60 seconds.
+    attr_accessor :api_events_timeout
+
+    # @return [Numeric] the timeout in seconds for fetching config, runtime
+    #   config and firewall lists from the API. Applied to each connect, read
+    #   and write wait. Defaults to 30 seconds.
+    attr_accessor :api_config_timeout
 
     # @return [Integer] the interval in seconds to poll the runtime API for
     #   settings changes. Defaults to evey 60 seconds.
@@ -254,7 +261,8 @@ module Aikido::Zen
       self.api_token = ENV.fetch("AIKIDO_TOKEN", nil)
       self.api_endpoint = ENV.fetch("AIKIDO_ENDPOINT") { regional_api_endpoint(api_token) }
       self.realtime_endpoint = api_endpoint
-      self.api_timeouts = 10
+      self.api_events_timeout = 60 # sec
+      self.api_config_timeout = 30 # sec
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
       self.extract_payloads_max_depth = 64
@@ -332,25 +340,6 @@ module Aikido::Zen
       @logger.level = Logger::DEBUG if debugging
     end
 
-    # @overload def api_timeouts=(timeouts)
-    #   Configure granular connection timeouts for the Aikido Zen API. You
-    #   can set any of these per call.
-    #   @param timeouts [Hash]
-    #   @option timeouts [Integer] :open_timeout Duration in seconds.
-    #   @option timeouts [Integer] :read_timeout Duration in seconds.
-    #   @option timeouts [Integer] :write_timeout Duration in seconds.
-    #
-    # @overload def api_timeouts=(duration)
-    #   Configure the connection timeouts for the Aikido Zen API.
-    #   @param duration [Integer] Duration in seconds to set for all three
-    #     timeouts (open, read, and write).
-    def api_timeouts=(value)
-      value = {open_timeout: value, read_timeout: value, write_timeout: value} if value.respond_to?(:to_int)
-
-      @api_timeouts ||= {}
-      @api_timeouts.update(value)
-    end
-
     def api_token_hash
       return unless api_token
 

data/lib/aikido/zen/sink.rb

@@ -85,36 +85,40 @@ module Aikido::Zen
     # @raise [Aikido::UnderAttackError] if an attack is detected and
     #   blocking_mode is enabled.
     def scan(context: Aikido::Zen.current_context, **scan_params)
+      # Nested scans must return early without clearing the scanning state.
       return if context&.scanning
+
       context&.scanning = true
 
-      return if context&.protection_disabled?
+      begin
+        return if context&.protection_disabled?
 
-      scan = Scan.new(sink: self, context: context)
+        scan = Scan.new(sink: self, context: context)
 
-      scans_performed = 0
-      scan.perform do
-        result = nil
+        scans_performed = 0
+        scan.perform do
+          result = nil
 
-        scanners.each do |scanner|
-          next if scanner.skips_on_nil_context? && context.nil?
+          scanners.each do |scanner|
+            next if scanner.skips_on_nil_context? && context.nil?
 
-          result = scanner.call(scan: scan, sink: self, context: context, **scan_params)
-          scans_performed += 1
+            result = scanner.call(scan: scan, sink: self, context: context, **scan_params)
+            scans_performed += 1
 
-          break result if result
-        rescue => error
-          scan.track_error(error, scanner)
-        end
+            break result if result
+          rescue => error
+            scan.track_error(error, scanner)
+          end
 
-        result
-      end
+          result
+        end
 
-      @reporter.call(scan) if scans_performed > 0
+        @reporter.call(scan) if scans_performed > 0
 
-      scan
-    ensure
-      context&.scanning = false
+        scan
+      ensure
+        context&.scanning = false
+      end
     end
   end
 end

data/lib/aikido/zen/system_info.rb

@@ -1,13 +1,21 @@
 # frozen_string_literal: true
 
 require "socket"
+require "securerandom"
 require "rubygems"
 
 require_relative "package"
 
 module Aikido::Zen
-  # Provides information about the currently running Agent.
+  # Provides information about the currently running agent.
   class SystemInfo
+    # @return [String] a unique identifier for the currently running agent.
+    attr_reader :session_id
+
+    def initialize
+      @session_id = generate_session_id
+    end
+
     def attacks_block_requests?
       !!Aikido::Zen.blocking_mode?
     end
@@ -28,8 +36,29 @@ module Aikido::Zen
       RUBY_VERSION
     end
 
+    # @return [String, nil] the hostname, or nil if it cannot be determined.
     def hostname
-      @hostname ||= Socket.gethostname
+      @hostname ||= begin
+        name = Socket.gethostname.to_s
+        name unless name.empty?
+      rescue SystemCallError
+        nil
+      end
+    end
+
+    # Headers sent with every request to the Aikido server to describe and
+    # identify the currently running agent.
+    #
+    # @return [Hash{String => String}] the agent headers, keyed by header name.
+    def agent_headers
+      {
+        "X-Agent-Platform" => "ruby",
+        "X-Agent-Library" => library_name,
+        "X-Agent-Version" => library_version,
+        "X-Agent-Hostname" => hostname || "unknown",
+        "X-Agent-IP-Address" => ip_address || "unknown",
+        "X-Agent-Session-Id" => session_id
+      }
     end
 
     # @return [Array<Aikido::Zen::Package>] a list of loaded rubygems that are
@@ -41,14 +70,18 @@ module Aikido::Zen
         .select(&:supported?)
     end
 
-    # @return [String] the first non-loopback IPv4 address that we can use
-    #   to identify this host. If the machine is solely identified by IPv6
-    #   addresses, then this will instead return an IPv6 address.
+    # Find the first non-loopback IP address, preferring IPv4.
+    #
+    # @return [String, nil] the IP address, or nil if it cannot be determined.
     def ip_address
-      @ip_address ||= Socket.ip_address_list
-        .reject { |ip| ip.ipv4_loopback? || ip.ipv6_loopback? || ip.unix? }
-        .min_by { |ip| ip.ipv4? ? 0 : 1 }
-        .ip_address
+      @ip_address ||= begin
+        address = Socket.ip_address_list
+          .reject { |ip| ip.ipv4_loopback? || ip.ipv6_loopback? || ip.unix? }
+          .min_by { |ip| ip.ipv4? ? 0 : 1 }
+        address&.ip_address
+      rescue SystemCallError
+        nil
+      end
     end
 
     def os_name
@@ -76,5 +109,17 @@ module Aikido::Zen
         "preventedPrototypePollution" => false
       }
     end
+
+    private def generate_session_id
+      # Code coverage is disabled here because `SecureRandom.uuid_v7` is only
+      # defined in Ruby 3.3+.
+      # :nocov:
+      if SecureRandom.respond_to?(:uuid_v7)
+        SecureRandom.uuid_v7
+      else
+        SecureRandom.uuid
+      end
+      # :nocov:
+    end
   end
 end

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.9.0.beta.4"
+    VERSION = "1.9.1"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.74"

data/lib/aikido/zen.rb

@@ -560,6 +560,7 @@ module Aikido
         @agent = nil
         agent&.stop!
 
+        @system_info = nil
         @agent = Agent.start
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.9.0.beta.4
+  version: 1.9.1
 platform: arm64-linux
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-09 00:00:00.000000000 Z
+date: 2026-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby