@claw-link/gateway-host 0.3.3 → 0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/scripts/p2p-test.js

@@ -6,6 +6,9 @@ const crypto = require('crypto');
 const core = require('../src/transport/core');
 
 async function run() {
+  // The self-test transfers over loopback, which the SSRF address-filter blocks by default — allow
+  // LAN/loopback just for this in-process test (does not affect the running service).
+  process.env.CLAWHOST_ALLOW_LAN = process.env.CLAWHOST_ALLOW_LAN || '1';
   if (!core.available || !core.Transport) {
     console.log('Native H2H core is NOT installed for this platform.');
     console.log('The host works fine — Capsule bytes route through the central relay (no P2P speedup).');

package/src/bridge.js

@@ -46,7 +46,7 @@ class Bridge {
   capsuleGet(path) { return this._post('capsule_get', { path }); }
   // H2H peer discovery for the QUIC P2P transport (central relay is the fallback).
   transportAnnounce(cid, addr) { return this._post('transport_announce', { cid, addr }); }
-  transportResolve(cid) { return this._post('transport_resolve', { cid }); }
+  transportResolve(cid, jobId) { return this._post('transport_resolve', { cid, job_id: jobId }); }
   transportSession(cid, mode, bytes) { return this._post('transport_session', { cid, mode, bytes }); }
   // DB floor for a transport ref: fetch the inline plaintext for a transport_cid this job may see.
   capsuleContent(cid, jobId) { return this._post('capsule_content', { cid, job_id: jobId }); }

package/src/transport/p2p.js

@@ -30,7 +30,13 @@ class P2P {
   }
 
   _loadKey() {
-    try { const k = fs.readFileSync(KEY_PATH, 'utf8').trim(); if (/^[0-9a-f]{64}$/i.test(k)) return k; } catch { /* none */ }
+    try {
+      const st = fs.statSync(KEY_PATH);
+      // The node secret is impersonation-grade — tighten perms if a backup/umask left it loose.
+      if (st.mode & 0o077) { try { fs.chmodSync(KEY_PATH, 0o600); this.logger.warn('tightened transport.key permissions to 600'); } catch { /* best effort */ } }
+      const k = fs.readFileSync(KEY_PATH, 'utf8').trim();
+      if (/^[0-9a-f]{64}$/i.test(k)) return k;
+    } catch { /* none */ }
     return null;
   }
   _saveKey(hex) {
@@ -59,25 +65,30 @@ class P2P {
     return this.addr;
   }
 
-  /** Offer a blob for P2P fetch: AEAD-encrypt + store locally, announce cid→our NodeAddr. Returns cid|null. */
-  async offer(bridge, plaintext, key) {
+  /** AEAD-encrypt + store a blob locally for P2P serving; returns its cid. Does NOT announce yet —
+   *  the capsule must be persisted first so the server can authorize the announce. null if unavailable. */
+  async addBlob(plaintext, key) {
     const addr = await this.start();
     if (!addr || !this.node) return null;
-    let cid;
-    try { cid = this.node.add(plaintext, key); } catch (e) { this.logger.warn('p2p add failed:', e.message); return null; }
-    try { await bridge.transportAnnounce(cid, addr); } catch (e) { this.logger.warn('p2p announce failed:', e.message); }
-    return cid;
+    try { return this.node.add(plaintext, key); } catch (e) { this.logger.warn('p2p add failed:', e.message); return null; }
+  }
+
+  /** Announce a previously-added cid to the directory (call AFTER the capsule is persisted, so the
+   *  server can verify this host is the producer). */
+  async announce(bridge, cid) {
+    if (!this.addr || !cid) return;
+    try { await bridge.transportAnnounce(cid, this.addr); } catch (e) { this.logger.warn('p2p announce failed:', e.message); }
   }
 
-  /** Fetch a blob by cid: resolve a peer NodeAddr + fetch over iroh. Returns plaintext Buffer, or null
-   *  to signal the caller should fall back to the central relay. */
-  async fetch(bridge, cid, key) {
+  /** Fetch a blob by cid for a given job: resolve a peer NodeAddr (authorized via job.sees) + fetch
+   *  over iroh. Returns plaintext Buffer, or null to fall back to the central relay. */
+  async fetch(bridge, cid, key, jobId) {
     if (!this.available()) return null;
     await this.start();
     if (!this.node) return null;
     let peer = null;
-    try { const r = await bridge.transportResolve(cid); peer = r && r.peer; } catch { peer = null; }
-    if (!peer || !peer.addr) return null; // no P2P source → relay
+    try { const r = await bridge.transportResolve(cid, jobId); peer = r && r.peer; } catch { peer = null; }
+    if (!peer || !peer.addr) return null; // no authorized P2P source → relay
     try {
       const t0 = Date.now();
       const buf = await this.node.fetch(cid, peer.addr, key);

package/src/worker.js

@@ -37,7 +37,7 @@ async function resolveTransport(bridge, p2p, job) {
     let text = null;
     if (p2p && p2p.available()) {
       try {
-        const buf = await p2p.fetch(bridge, ref.cid, Buffer.from(ref.key, 'hex'));
+        const buf = await p2p.fetch(bridge, ref.cid, Buffer.from(ref.key, 'hex'), job.id);
         if (buf) text = buf.toString('utf8');
       } catch (e) { logger.warn(`p2p resolve ${ref.cid.slice(0, 14)}… failed: ${e.message}`); }
     }
@@ -69,20 +69,23 @@ async function processJob(bridge, agentCfg, job, p2p) {
       try { await bridge.stream(job.id, seq++, evt.type, String(evt.content ?? '')); }
       catch (e) { logger.warn(`stream seq ${seq} failed: ${e.message}`); }
     }
-    // H2H: offer a large result for P2P fetch by the next node's host (inline copy stays the floor).
-    let transport;
+    // H2H: store a large result for P2P fetch by the next node's host (inline copy stays the floor).
+    // We add+ref it before complete(), but ANNOUNCE only AFTER complete() persists the capsule — so
+    // the directory can verify this host is the producer before listing it.
+    let transport, offerCid;
     try {
       const buf = Buffer.from(finalText, 'utf8');
       if (p2p && p2p.available() && job.harness && buf.length > TRANSPORT_MIN_BYTES) {
         const key = crypto.randomBytes(32);
-        const cid = await p2p.offer(bridge, buf, key);
-        if (cid) transport = { cid, key: key.toString('hex'), size: buf.length };
+        offerCid = await p2p.addBlob(buf, key);
+        if (offerCid) transport = { cid: offerCid, key: key.toString('hex'), size: buf.length };
       }
     } catch (e) { logger.warn(`p2p offer failed: ${e.message}`); }
     const meta = {};
     if (toolCalls.length) meta.tool_calls = toolCalls;
     if (transport) meta.transport = transport;
     await withRetry(() => bridge.complete(job.id, finalText, meta));
+    if (offerCid) await p2p.announce(bridge, offerCid);
     logger.info(`job ${job.id} done (${finalText.length} chars${transport ? `, P2P-offered ${transport.cid.slice(0, 14)}…` : ''})`);
   } catch (e) {
     logger.error(`job ${job.id} failed: ${e.message}`);