@decentnetwork/lan 0.1.273 → 0.1.274

package/dist/cli/commands.d.ts

@@ -486,6 +486,24 @@ export declare function windowsServiceLauncherScript(args: {
     configDir: string;
     logPath: string;
 }): string;
+/**
+ * Key-only SSH for connections arriving over the AgentNet subnet.
+ *
+ * Runs automatically whenever the user turns on the TUN / virtual LAN
+ * (`agentnet up --real-tun`, `agentnet service install`) — a daemon friend
+ * gets an L3 route to this machine, and password-guessable SSH over that
+ * route is the #1 exposure (docs/SECURITY-L3-HARDENING.md).
+ *
+ * STRICTLY SCOPED (product rule 2026-08-06): appends a
+ * `Match Address 10.86.0.0/16` block to the END of sshd_config — the
+ * user's existing physical-LAN/WAN login policy is untouched, and we
+ * never rewrite anything they configured. Idempotent via a marker line;
+ * original config backed up once at sshd_config.bak.agentnet; validated
+ * with `sshd -t` and rolled back if the daemon rejects it.
+ */
+export declare function cmdHardenSsh(args?: {
+    quiet?: boolean;
+}): Promise<void>;
 export declare function cmdServiceInstall(args: {
     uninstall?: boolean;
     configDir?: string;

package/dist/cli/commands.js

@@ -449,6 +449,17 @@ export async function cmdUp(args) {
     // full disk stops the daemon outright. Covers the SDK's [peer-debug] output
     // too, since this wraps the process console rather than our Logger.
     installLogThrottle();
+    // Turning on the real TUN = giving friends an L3 route here. Close the
+    // password-SSH door on that route first (scoped, idempotent, no-op when
+    // already done or when there is no sshd).
+    if (args.realTun) {
+        try {
+            await cmdHardenSsh({ quiet: true });
+        }
+        catch (err) {
+            console.warn(String(err.message ?? err));
+        }
+    }
     const daemon = new DaemonServer({
         config,
         configDir: dir,
@@ -867,7 +878,7 @@ export async function cmdFriendsAutoAccept(args) {
     const configPath = resolve(dir, "config.yaml");
     const config = await ConfigLoader.load(configPath);
     if (!args.mode) {
-        const cur = config.friends?.autoAccept ?? true;
+        const cur = config.friends?.autoAccept ?? false;
         console.log(`friends.autoAccept: ${cur ? "on" : "off"}`);
         console.log(cur
             ? "  Incoming friend-requests are accepted automatically."
@@ -2195,6 +2206,76 @@ while ($true) {
 }
 `;
 }
+/**
+ * Key-only SSH for connections arriving over the AgentNet subnet.
+ *
+ * Runs automatically whenever the user turns on the TUN / virtual LAN
+ * (`agentnet up --real-tun`, `agentnet service install`) — a daemon friend
+ * gets an L3 route to this machine, and password-guessable SSH over that
+ * route is the #1 exposure (docs/SECURITY-L3-HARDENING.md).
+ *
+ * STRICTLY SCOPED (product rule 2026-08-06): appends a
+ * `Match Address 10.86.0.0/16` block to the END of sshd_config — the
+ * user's existing physical-LAN/WAN login policy is untouched, and we
+ * never rewrite anything they configured. Idempotent via a marker line;
+ * original config backed up once at sshd_config.bak.agentnet; validated
+ * with `sshd -t` and rolled back if the daemon rejects it.
+ */
+export async function cmdHardenSsh(args = {}) {
+    const MARK = "agentnet L3 hardening";
+    const say = (m) => { if (!args.quiet)
+        console.log(m); };
+    if (process.platform === "win32") {
+        say("[harden-ssh] Windows: append to C:\\ProgramData\\ssh\\sshd_config:\n" +
+            "  Match Address 10.86.0.0/16\n      PasswordAuthentication no\n" +
+            "then Restart-Service sshd (as Administrator).");
+        return;
+    }
+    const cfg = "/etc/ssh/sshd_config";
+    if (!existsSync(cfg)) {
+        say("[harden-ssh] no /etc/ssh/sshd_config (no OpenSSH server) — nothing to do");
+        return;
+    }
+    if (readFileSync(cfg, "utf-8").includes(MARK)) {
+        say("[harden-ssh] already hardened — nothing to do");
+        return;
+    }
+    if (typeof process.getuid === "function" && process.getuid() !== 0) {
+        // Not fatal: the caller may be a non-root `up` on a mock TUN box.
+        console.log("[harden-ssh] needs root — run: sudo agentnet harden-ssh");
+        return;
+    }
+    const { execSync } = await import("child_process");
+    const { copyFileSync, appendFileSync } = await import("fs");
+    const bak = `${cfg}.bak.agentnet`;
+    if (!existsSync(bak))
+        copyFileSync(cfg, bak);
+    appendFileSync(cfg, `\n# ${MARK}: key-only SSH from the virtual net (10.86/16 only)\n` +
+        `Match Address 10.86.0.0/16\n    PasswordAuthentication no\n    KbdInteractiveAuthentication no\n`);
+    try {
+        execSync("/usr/sbin/sshd -t", { stdio: "pipe" });
+    }
+    catch (err) {
+        copyFileSync(bak, cfg);
+        throw new Error(`[harden-ssh] sshd rejected the change — restored original config: ${err.message}`);
+    }
+    if (process.platform === "darwin") {
+        try {
+            execSync("launchctl kickstart -k system/com.openssh.sshd", { stdio: "pipe" });
+        }
+        catch { /* socket-activated: new connections read the config anyway */ }
+    }
+    else {
+        for (const c of ["systemctl reload ssh", "systemctl reload sshd", "service ssh reload"]) {
+            try {
+                execSync(c, { stdio: "pipe" });
+                break;
+            }
+            catch { /* try the next spelling */ }
+        }
+    }
+    console.log(`[harden-ssh] SSH from 10.86.0.0/16 is now key-only. Physical-network logins unchanged; backup: ${bak}`);
+}
 export async function cmdServiceInstall(args) {
     // Detect sudo's $HOME=/root trap. When `service install` is run via
     // sudo and no --config-dir is provided, derive the home dir from
@@ -2337,6 +2418,12 @@ WantedBy=multi-user.target
         }
         execSync("systemctl daemon-reload");
         execSync("systemctl enable --now agentnet");
+        try {
+            await cmdHardenSsh({ quiet: true });
+        }
+        catch (err) {
+            console.warn(String(err.message ?? err));
+        }
         console.log(`Installed ${unitPath} and started agentnet.service.`);
         console.log(`Logs: journalctl -u agentnet -f`);
         console.log(`Optional — watch China video (CCTV etc.): agentnet proxy trust-ca && agentnet proxy router --hls-accel  (docs/CCTV-VIEWING.md)`);
@@ -2414,6 +2501,12 @@ WantedBy=multi-user.target
             console.log(`Note: could not install the newsyslog rotation rule (${err instanceof Error ? err.message : err}). The log is still throttled in-process.`);
         }
         execSync(`launchctl load ${plistPath}`);
+        try {
+            await cmdHardenSsh({ quiet: true });
+        }
+        catch (err) {
+            console.warn(String(err.message ?? err));
+        }
         console.log(`Installed ${plistPath} and started com.decentlan.agentnet.`);
         console.log(`Optional — watch China video (CCTV etc.): agentnet proxy trust-ca && agentnet proxy router --hls-accel  (docs/CCTV-VIEWING.md)`);
         console.log(`Logs: tail -f /var/log/agentnet.log`);

package/dist/cli/index.js

@@ -10,7 +10,7 @@ import { hideBin } from "yargs/helpers";
 // Belt-and-braces — also raise it here in case the CLI is run directly
 // (e.g. `node dist/cli/index.js` rather than via dist/index.js).
 EventEmitter.defaultMaxListeners = 100;
-import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyFileWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdBootstrapShow, cmdBootstrapUpdate, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
+import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyFileWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdBootstrapShow, cmdBootstrapUpdate, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdHardenSsh, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
 async function main() {
     await yargs(hideBin(process.argv))
         .scriptName("agentnet")
@@ -149,6 +149,9 @@ async function main() {
     })
         .demandCommand(1, "Specify a dns subcommand (run 'agentnet dns --help')"), () => {
         // parent handler — never invoked because demandCommand
+    })
+        .command("harden-ssh", "Make SSH key-only for connections from the AgentNet subnet (10.86/16 only; physical-network logins unchanged)", (y) => y, async () => {
+        await cmdHardenSsh();
     })
         // Persistent system service — wraps systemctl (Linux), launchctl
         // (macOS), or a highest-privilege startup task (Windows) so a new operator runs ONE command to install

package/dist/config/loader.js

@@ -301,12 +301,14 @@ export class ConfigLoader {
                 enabled: false,
                 port: 8888,
             },
-            // Auto-accept incoming friend requests by default. The Carrier
-            // network is already a friend network — if you don't want a peer,
-            // don't share your address with them. Disable with
-            // `friends.autoAccept: false` for stricter control.
+            // Manual friend approval by default (2026-08-06 security decision).
+            // A daemon friend gets an L3 route to this machine, and addresses
+            // are now publicly listed (Beagle discover/names directories) — so
+            // auto-accept + TUN would let strangers onto your virtual LAN.
+            // Infra nodes (doras/exits) that must accept strangers set
+            // `friends.autoAccept: true` explicitly.
             friends: {
-                autoAccept: true,
+                autoAccept: false,
             },
             // Dora integration is ON by default and points at the public
             // canonical dora — `agentnet init` follows up with a one-time

package/dist/console/console.js

@@ -883,12 +883,14 @@ var ConfigLoader = class {
         enabled: false,
         port: 8888
       },
-      // Auto-accept incoming friend requests by default. The Carrier
-      // network is already a friend network — if you don't want a peer,
-      // don't share your address with them. Disable with
-      // `friends.autoAccept: false` for stricter control.
+      // Manual friend approval by default (2026-08-06 security decision).
+      // A daemon friend gets an L3 route to this machine, and addresses
+      // are now publicly listed (Beagle discover/names directories) — so
+      // auto-accept + TUN would let strangers onto your virtual LAN.
+      // Infra nodes (doras/exits) that must accept strangers set
+      // `friends.autoAccept: true` explicitly.
       friends: {
-        autoAccept: true
+        autoAccept: false
       },
       // Dora integration is ON by default and points at the public
       // canonical dora — `agentnet init` follows up with a one-time

package/dist/daemon/server.js

@@ -919,7 +919,7 @@ export class DaemonServer {
                             statusMessage: this.config.node.statusMessage ?? "",
                             // Beagle's Profile tab renders the auto-accept toggle only when
                             // the backend reports the current state.
-                            autoAccept: this.config.friends?.autoAccept ?? true,
+                            autoAccept: this.config.friends?.autoAccept ?? false,
                         },
                         tun: this.tunDevice?.getConfig(),
                         // When Dora is unavailable, config.network.ip can still be the
@@ -1255,7 +1255,10 @@ export class DaemonServer {
                     this.ipcEvents.emit("event", { type: "request", userid });
                     // Read the flag LIVE (not captured at start) so `agentnet friends
                     // autoaccept off` takes effect immediately, no daemon restart.
-                    if (this.config.friends?.autoAccept ?? true) {
+                    // Default flipped to false 2026-08-06: friend = L3 route, and
+                    // addresses are public in the Beagle directories now. Infra
+                    // (doras/exits) opts back in explicitly in its config.
+                    if (this.config.friends?.autoAccept ?? false) {
                         this.logger.info(`Friend request from ${who}${hello} — auto-accepting`);
                         this.peerManager?.acceptFriendRequest(req.pubkey).catch((err) => {
                             this.logger.warn(`Auto-accept failed for ${who}: ${err}`);

package/dist/ui/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.273";
+window.__DK_UI_VERSION="0.1.274";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.273",
+  "version": "0.1.274",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",