@kendoo.agentdesk/agentdesk 0.24.0 → 0.25.0

package/cli/daemon.mjs

@@ -318,6 +318,27 @@ export async function runDaemon() {
     }
   }
 
+// AD-34 confirmation helper. Prints session details and asks y/N at the local
+// terminal. Returns true if the user accepts. If stdin isn't a TTY (running
+// headless / no terminal), refuse — the safer default. Set
+// AGENTDESK_DAEMON_AUTO_ACCEPT=1 to skip this prompt for trusted automation.
+async function confirmIncomingSession({ project, taskId, prompt }) {
+  if (!process.stdin.isTTY) {
+    console.log("  Refusing server-pushed session: no terminal to confirm at. Set AGENTDESK_DAEMON_AUTO_ACCEPT=1 to allow.");
+    return false;
+  }
+  const promptPreview = String(prompt || "(no prompt)").trim().slice(0, 240).replace(/\s+/g, " ");
+  console.log("");
+  console.log(`  Incoming session for project: ${project.name}`);
+  if (taskId) console.log(`  Task: ${taskId}`);
+  console.log(`  Prompt: ${promptPreview}${String(prompt || "").length > 240 ? "..." : ""}`);
+  console.log("");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise(resolve => rl.question("  Approve this session? [y/N] ", resolve));
+  rl.close();
+  return /^y(es)?$/i.test(String(answer).trim());
+}
+
   // 4. Session handling
 
   async function handleStartSession({ sessionId, projectId, taskId: remoteTaskId, prompt, phased, screenshots: screenshotsOverride }) {
@@ -329,6 +350,21 @@ export async function runDaemon() {
       return;
     }
 
+    // AD-34: server-pushed sessions get a human confirmation prompt at the
+    // local terminal before any code runs. If an attacker steals the user's
+    // api_key, they can POST to /api/daemon/sessions, but cannot push a
+    // command through to the victim machine without someone at the keyboard
+    // saying yes. Opt out via AGENTDESK_DAEMON_AUTO_ACCEPT=1 for trusted
+    // automation environments.
+    if (process.env.AGENTDESK_DAEMON_AUTO_ACCEPT !== "1") {
+      const accepted = await confirmIncomingSession({ project, taskId: remoteTaskId, prompt });
+      if (!accepted) {
+        console.log(`  ${yellow}Rejected by user:${reset} ${dim}${sessionId}${reset}`);
+        send({ type: "daemon:error", sessionId, error: "Session declined by daemon owner" });
+        return;
+      }
+    }
+
     // Enforce max 1 concurrent session — set flag BEFORE any async work to prevent race
     if (activeSession) {
       console.log(`  ${red}Rejected:${reset} session already running ${dim}(${activeSession.sessionId})${reset}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {