@monster-orange/den 0.4.2 → 0.4.4

package/src/ui/server/request-guard.ts

@@ -19,12 +19,17 @@
  *    session's /api/sessions/<id>/*: agent start and resume mint tokens.
  *    403 `agent_forbidden`. WS-3a (0.4.2) adds the workspace check at
  *    agentRefusal's seam.
- *  - Sign-in (§4, route-classes.ts): beyond loopback (the edge hostname, a
- *    LAN name, or a peer that isn't loopback) every route needs a session
- *    or a bearer. Otherwise 401 `signin_required`. On loopback no route
- *    does, shell-grade ones included (Ward, 2026-11-06: the lock, R8, is
- *    the only prompt there; Host, Origin and CSRF cover CSRF and DNS
- *    rebinding). SIGNIN_FREE routes never need one.
+ *  - Sign-in (§4, route-classes.ts): beyond loopback (a LAN name, a peer
+ *    that isn't loopback, or the edge hostname for a client on another
+ *    machine) every route needs a session or a bearer. Otherwise 401
+ *    `signin_required`. On loopback no route does, shell-grade ones
+ *    included (Ward, 2026-11-06: the lock, R8, is the only prompt there;
+ *    Host, Origin and CSRF cover CSRF and DNS rebinding). SIGNIN_FREE
+ *    routes never need one.
+ *  - The edge counts as local (0.4.3, edgeClientIsLocal): the edge hostname
+ *    from an edge peer gets loopback's treatment unless the edge's
+ *    X-Forwarded-For names another machine, or this server is deliberately
+ *    exposed (`exposed`: a non-loopback DEN_BIND_HOST bind).
  *  - Origin, on POST/PUT/PATCH/DELETE and every WebSocket upgrade: an
  *    allowed host (http or https). No Origin needs a valid bearer.
  *    Otherwise 403 `origin_rejected`.
@@ -45,6 +50,7 @@
 import { randomBytes, timingSafeEqual, createHash } from "crypto";
 import type * as http from "http";
 import * as net from "net";
+import * as os from "os";
 import {
   actorFromHeaders,
   type Actor,
@@ -125,6 +131,18 @@ export interface GuardContext {
    * server's port gets 421. Unset: taken as yes (a unit test).
    */
   peerIsEdge?: (req: http.IncomingMessage) => boolean;
+  /**
+   * This machine's own addresses and container/VM bridges (localNet), for
+   * telling whether an edge request's client is this machine. Unset: none
+   * (a unit test): only loopback and the Docker ranges count as local.
+   */
+  localNet?: () => LocalNet;
+  /**
+   * A deliberate network exposure (a non-loopback DEN_BIND_HOST bind other
+   * than the Docker bridge the edge uses on Linux): the edge hostname
+   * needs a sign-in too, as before 0.4.3.
+   */
+  exposed?: boolean;
 }
 
 export type GuardResult =
@@ -263,6 +281,97 @@ export function isEdgePeer(addr: string | undefined): boolean {
   );
 }
 
+/** An address without its zone, IPv4-mapped prefix or brackets, lowercase. */
+function normAddress(a: string): string {
+  return a
+    .trim()
+    .toLowerCase()
+    .replace(/^\[|\]$/g, "")
+    .replace(/%.*$/, "")
+    .replace(/^::ffff:(?=\d+\.)/, "");
+}
+
+/** This machine's own addresses, and the container/VM bridges it hosts. */
+export interface LocalNet {
+  /** Every interface address (loopback, LAN, a VPN's such as Tailscale's 100.x). */
+  own: readonly string[];
+  /** IPv4 subnets of its container/VM bridges (Docker, OrbStack, VMs). */
+  bridges: readonly { address: string; netmask: string }[];
+}
+
+/** Interface names of container/VM bridges: their peers are this machine's. */
+const BRIDGE_IFACE =
+  /^(docker\d*|br-|bridge\d+|vmnet|virbr|veth|cni|podman|vboxnet)/;
+
+/** localNet from os.networkInterfaces() (or a given table, in a test). */
+export function localNet(
+  ifaces: ReturnType<typeof os.networkInterfaces> = os.networkInterfaces(),
+): LocalNet {
+  const own: string[] = [];
+  const bridges: { address: string; netmask: string }[] = [];
+  for (const [name, list] of Object.entries(ifaces))
+    for (const a of list ?? []) {
+      own.push(normAddress(a.address));
+      if (a.family === "IPv4" && BRIDGE_IFACE.test(name))
+        bridges.push({ address: a.address, netmask: a.netmask });
+    }
+  return { own: [...new Set(own)], bridges };
+}
+
+function ipv4(a: string): number {
+  return a.split(".").reduce((n, o) => n * 256 + Number(o), 0);
+}
+function inSubnet(a: string, net4: { address: string; netmask: string }) {
+  if (!net.isIPv4(a) || !net.isIPv4(net4.address)) return false;
+  const m = ipv4(net4.netmask);
+  // Unsigned compare of the masked halves (no 32-bit sign games).
+  const lo = (x: number) => x - (x % (2 ** 32 - m));
+  return m > 0 && lo(ipv4(a)) === lo(ipv4(net4.address));
+}
+
+/**
+ * The original client X-Forwarded-For names: its left-most entry, as an
+ * IP (a port or brackets dropped), or undefined when there is none.
+ */
+export function forwardedClient(xff: string | undefined): string | undefined {
+  const first = xff?.split(",")[0]?.trim();
+  if (!first) return undefined;
+  let a = first;
+  const b = /^\[([^\]]+)\](?::\d+)?$/.exec(a);
+  if (b) a = b[1];
+  else if (/^\d+\.\d+\.\d+\.\d+:\d+$/.test(a)) a = a.replace(/:\d+$/, "");
+  a = normAddress(a);
+  return net.isIP(a) ? a : undefined;
+}
+
+/**
+ * The edge counts as local (0.4.3): whether an edge request (the edge
+ * hostname from an edge peer) comes from this machine, by the left-most
+ * X-Forwarded-For entry (the original client):
+ *  - loopback, or one of this machine's own interface addresses (its LAN
+ *    or VPN address, a Tailscale 100.x one included): local;
+ *  - missing, unreadable, or a container/VM network's address (the Docker
+ *    ranges isEdgePeer takes, a subnet of one of this machine's bridges,
+ *    one of the edge's own Docker networks, or OrbStack's 0.250.250.254):
+ *    we can't tell (Docker Desktop and OrbStack on macOS hand the
+ *    edge their gateway's address, and a TCP passthrough in front hides the
+ *    client), so local;
+ *  - anything else: another machine, beyond loopback (sign-in required).
+ * The edge's own page warns when it is reachable beyond this machine
+ * (edge-exposure.ts): with no sign-in, anyone who reaches it is local.
+ */
+export function edgeClientIsLocal(
+  xff: string | undefined,
+  local: LocalNet = { own: [], bridges: [] },
+): boolean {
+  const c = forwardedClient(xff);
+  if (!c || isEdgePeer(c) || local.own.includes(c)) return true;
+  // 0.0.0.0/8 ("this network") is never a client on another machine:
+  // OrbStack presents the host to its containers as 0.250.250.254.
+  if (net.isIPv4(c) && c.startsWith("0.")) return true;
+  return local.bridges.some((b) => inSubnet(c, b));
+}
+
 /**
  * Whether the request came over HTTPS: the socket's own encryption, or,
  * only for the edge hostname from an edge peer, `X-Forwarded-Proto: https`.
@@ -370,7 +479,13 @@ export function checkRequest(
         "127.0.0.1, [::1] with its port, or its edge hostname).",
     };
   const peerLoopback = ctx.peerIsLoopback ? ctx.peerIsLoopback(req) : true;
-  const beyond = via !== "loopback" || !peerLoopback;
+  // The edge from this machine (edgeClientIsLocal) is local, unless this
+  // server is deliberately exposed; a LAN name or peer is beyond.
+  const beyond =
+    via === "edge"
+      ? !!ctx.exposed ||
+        !edgeClientIsLocal(header(req, "x-forwarded-for"), ctx.localNet?.())
+      : via !== "loopback" || !peerLoopback;
 
   let principal: Principal | null = null;
   const auth = header(req, "authorization");
@@ -497,7 +612,7 @@ export const AGENT_FORBIDDEN: readonly string[] = [
 ];
 
 /**
- * Routes an agent's token may read but never change: the lock (R8).
+ * Routes an agent's token may read but never change: the admin password (R8).
  * Privileged actions stay with people (AG-5); its status is a read.
  */
 export const AGENT_READ_ONLY: readonly string[] = [

package/src/ui/server/route-classes.ts

@@ -145,6 +145,7 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/graph",
     "/api/applications",
     "/api/personas",
+    "/api/agents/runtimes",
     "/api/workspaces/:ws/agents",
   ].map((p) => R(p)),
   R(
@@ -209,8 +210,13 @@ export const ROUTES: readonly RouteEntry[] = [
   M(["POST", "DELETE"], "/api/release/deploy", "starts or dismisses a deploy"),
   M(["POST"], "/api/manifest/validate", "validates posted content (no write)"),
   M(["POST"], "/api/local-dev"),
-  M(["POST"], "/api/sudo-password", "opens the lock (R8)"),
-  M(["POST"], "/api/sudo-password/load-from-vault", "opens the lock (R8)"),
+  M(["POST"], "/api/sudo-password", "sets the admin password, for sudo (R8)"),
+  M(
+    ["POST"],
+    "/api/sudo-password/load-from-vault",
+    "sets the admin password from the vault, for sudo (R8)",
+  ),
+  M(["POST"], "/api/sudo-password/forget", "forgets the admin password (R8)"),
   M(["POST"], "/api/scope"),
   M(["POST"], "/api/settings"),
   M(
@@ -241,6 +247,11 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/workspaces/:ws/agents/:id/resume",
     "resumes an agent: a runtime in a PTY",
   ),
+  S(
+    ["POST"],
+    "/api/agents/runtimes/:id/path",
+    "runs the path given (its version command) before saving it as a runtime's CLI (AG-0.5)",
+  ),
   S(
     ["GET", "HEAD"],
     "/api/sessions/:id/io",
@@ -272,6 +283,7 @@ export const REGEX_ROUTES: Readonly<Record<string, readonly string[]>> = {
     "/api/workspaces/:ws/agents/:id/stop",
     "/api/workspaces/:ws/agents/:id/resume",
   ],
+  "agent-routes.ts:RUNTIME_PATH": ["/api/agents/runtimes/:id/path"],
   "session-routes.ts:IO_PATH": ["/api/sessions/:id/io"],
 };
 

package/src/ui/server/session-routes.ts

@@ -18,6 +18,10 @@
  *   - on attach, the scrollback replay, then live output: binary frames;
  *   - a text frame `{"type":"session",…}` first (what is attached), and
  *     `{"type":"exit","exitCode":n}` when the session ends;
+ *   - `{"type":"size","cols":c,"rows":r}`: the PTY's size, on attach and
+ *     each time any viewer (another browser, a CLI attach) resizes it. The
+ *     size is last-writer-wins; a pane that learns it is out of step says
+ *     its own again when it is used (focused, typed in, shown);
  *   - in: binary frames are input; a text frame is JSON control:
  *     `{"type":"resize","cols":c,"rows":r}` (or `{"type":"input","data":s}`).
  * Closing the socket detaches. Nothing here ever signals a session: leaving
@@ -391,6 +395,9 @@ export async function handleSessionUpgrade(
   let exited = s.exited === true;
   const att = client.attach(s.ref.id, {
     onData: (data) => ws.send(data),
+    onSize: (cols, rows) => {
+      if (ws.open) ws.send(JSON.stringify({ type: "size", cols, rows }));
+    },
     onExit: (exitCode) => {
       exited = true;
       ws.send(
@@ -417,8 +424,9 @@ export async function handleSessionUpgrade(
       return;
     }
     if (msg?.type === "resize") {
+      // Never below 2x2: a pane measured before it was laid out.
       const ok = (n: unknown): n is number =>
-        typeof n === "number" && Number.isInteger(n) && n >= 1 && n <= 1000;
+        typeof n === "number" && Number.isInteger(n) && n >= 2 && n <= 1000;
       if (!exited && ok(msg.cols) && ok(msg.rows))
         client.resize(s.ref.id, msg.cols, msg.rows);
     } else if (msg?.type === "input" && typeof msg.data === "string") {

package/src/ui/server/sudo-store.ts

@@ -4,6 +4,16 @@
  * Keeps the user's sudo password in memory so spawned service commands
  * (make up / down / etc.) can authenticate without a terminal.
  *
+ * LK-0 (Ward, 2026-11-06): the password is for sudo, and nothing else. It
+ * is never an access check. Den asks for it only at the moment a command
+ * it runs is about to run sudo: every service command gets a `sudo` shim
+ * first on its PATH (getSudoEnv). With a password held, the shim feeds it
+ * to the real sudo. Without one, sudo that needs no password (NOPASSWD, a
+ * warm cache) still runs; anything else never prompts, it prints one
+ * needs-sudo line naming the command and fails. The route turns that line
+ * (or sudo's own "a password is required") into a `needs-sudo` event
+ * (watchSudo), and the page asks for the password, then runs it again.
+ *
  * Strategy: pre-warm the sudo credential cache immediately before every
  * service spawn. This is more reliable than SUDO_ASKPASS env-var injection
  * because intermediate launchers (opctl, make, etc.) may reset the environment
@@ -45,22 +55,95 @@ export function lockClosedHere(): boolean {
   return lockScope.getStore()?.closed === true;
 }
 let _sudoDir: string | null = null;
+let _askDir: string | null = null;
+
+/** Den's own sudo shim dirs (never the real sudo). */
+function shimDirPrefix(): string {
+  return path.join(os.tmpdir(), `${product().cli}-sudo-`);
+}
+
+/**
+ * The real sudo: the first `sudo` on PATH that isn't one of Den's shims,
+ * else /usr/bin/sudo. Read when a shim is written.
+ */
+export function realSudoPath(envPath: string = process.env.PATH ?? ""): string {
+  const prefix = shimDirPrefix();
+  for (const dir of envPath.split(path.delimiter)) {
+    if (!dir || dir.startsWith(prefix)) continue;
+    const file = path.join(dir, "sudo");
+    try {
+      fs.accessSync(file, fs.constants.X_OK);
+      if (fs.statSync(file).isFile()) return file;
+    } catch {
+      /* not here */
+    }
+  }
+  return "/usr/bin/sudo";
+}
+
+/** A path inside single quotes, for a shim. */
+function shq(s: string): string {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
 
 export function setSudoPassword(password: string): void {
   _sudoPassword = password;
-  const dir = path.join(os.tmpdir(), `${product().cli}-sudo-${process.pid}`);
+  const dir = `${shimDirPrefix()}${process.pid}`;
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   const pwFile = path.join(dir, "pw");
   fs.writeFileSync(pwFile, password + "\n", { mode: 0o600 });
   const wrapper = path.join(dir, "sudo");
   fs.writeFileSync(
     wrapper,
-    `#!/bin/sh\nexec /usr/bin/sudo -S "$@" < '${pwFile}'\n`,
+    `#!/bin/sh\nexec ${shq(realSudoPath())} -S "$@" < ${shq(pwFile)}\n`,
     { mode: 0o700 },
   );
   _sudoDir = dir;
 }
 
+/** What the no-password shim prints before it fails (LK-0). */
+export const NEEDS_SUDO_MARK = "needs-sudo:";
+
+/**
+ * The shim for when no password is held (LK-0): sudo that needs none runs
+ * as it would; anything else prints `<cli>: needs-sudo: sudo <args>` and
+ * fails, never prompting. It holds no secret.
+ */
+function askShim(): string {
+  const real = shq(realSudoPath());
+  const mark = `${product().cli}: ${NEEDS_SUDO_MARK}`;
+  return [
+    "#!/bin/sh",
+    `# ${product().title}: no admin password is held (LK-0).`,
+    `REAL=${real}`,
+    // A caller feeding its own password, or a passwordless sudo: as is.
+    'case " $* " in *" -S "*) exec "$REAL" "$@";; esac',
+    'if "$REAL" -n true >/dev/null 2>&1; then exec "$REAL" -n "$@"; fi',
+    'err=$(mktemp "${TMPDIR:-/tmp}/sudo-err.XXXXXX") || exit 1',
+    '"$REAL" -n "$@" 2>"$err"; rc=$?',
+    'if [ "$rc" -ne 0 ] && grep -qi -e "password is required" -e "terminal is required" "$err"; then',
+    '  rm -f "$err"',
+    `  printf '%s sudo %s\\n' ${shq(mark)} "$*" >&2`,
+    "  exit 1",
+    "fi",
+    'cat "$err" >&2; rm -f "$err"; exit "$rc"',
+    "",
+  ].join("\n");
+}
+
+function ensureAskDir(): string | null {
+  if (_askDir) return _askDir;
+  try {
+    const dir = `${shimDirPrefix()}${process.pid}-ask`;
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(dir, "sudo"), askShim(), { mode: 0o700 });
+    _askDir = dir;
+  } catch {
+    return null;
+  }
+  return _askDir;
+}
+
 export function clearSudoPassword(): void {
   _sudoPassword = null;
   if (_sudoDir) {
@@ -73,14 +156,95 @@ export function clearSudoPassword(): void {
   }
 }
 
+/** On exit: the password and the shims go. */
+export function clearSudoShims(): void {
+  clearSudoPassword();
+  if (_askDir) {
+    try {
+      fs.rmSync(_askDir, { recursive: true });
+    } catch {
+      /* ignore */
+    }
+    _askDir = null;
+  }
+}
+
 /**
- * Returns env additions that prepend our sudo wrapper to PATH so that any
- * 'sudo' call in the spawned process tree uses the stored password.
+ * Returns env additions that prepend our sudo shim to PATH so that any
+ * 'sudo' call in the spawned process tree uses the stored password, or,
+ * with none, says it needs one instead of prompting (LK-0).
  */
 export function getSudoEnv(): NodeJS.ProcessEnv {
-  if (!_sudoDir || lockClosedHere()) return {};
+  if (lockClosedHere()) return {};
+  const dir = _sudoDir ?? ensureAskDir();
+  if (!dir) return {};
   const currentPath = process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin";
-  return { PATH: `${_sudoDir}:${currentPath}` };
+  return { PATH: `${dir}:${currentPath}` };
+}
+
+/** A run's needs-sudo event (LK-0): what needed sudo, and in which step. */
+export interface NeedsSudo {
+  type: "needs-sudo";
+  /** The sudo command, when the shim saw it (`sudo <args>`). */
+  command?: string;
+  /** The service address (or step) that ran it. */
+  step?: string;
+}
+
+const MAX_COMMAND = 200;
+const NATIVE_ASK =
+  /^\s*sudo: (?:a password is required|a terminal is required to read the password)/;
+
+/**
+ * Whether one output line says sudo needed the password: the shim's own
+ * line (with the command), or sudo's own refusal when a launcher reset the
+ * PATH (no command). Null otherwise.
+ */
+export function needsSudoOf(line: string): { command?: string } | null {
+  const i = line.indexOf(NEEDS_SUDO_MARK);
+  if (i >= 0) {
+    const command = line
+      .slice(i + NEEDS_SUDO_MARK.length)
+      .trim()
+      .slice(0, MAX_COMMAND);
+    return command ? { command } : {};
+  }
+  return NATIVE_ASK.test(line) ? {} : null;
+}
+
+/**
+ * Wrap a run's SSE `emit`: a `line` that says sudo needed the password is
+ * followed by one `needs-sudo` event (once per step and command). The step
+ * is the last `label` event's text (a workspace run's service), else
+ * `step`.
+ */
+export function watchSudo(
+  emit: (obj: unknown) => void,
+  step?: string,
+): (obj: unknown) => void {
+  let current = step;
+  const said = new Set<string>();
+  return (obj) => {
+    emit(obj);
+    const o = obj as { type?: unknown; text?: unknown } | null;
+    if (!o || typeof o.text !== "string") return;
+    if (o.type === "label") {
+      current = o.text;
+      return;
+    }
+    if (o.type !== "line" && o.type !== "error") return;
+    const hit = needsSudoOf(o.text);
+    if (!hit) return;
+    const key = `${current ?? ""}\u0000${hit.command ?? ""}`;
+    if (said.has(key)) return;
+    said.add(key);
+    const ev: NeedsSudo = {
+      type: "needs-sudo",
+      ...(hit.command ? { command: hit.command } : {}),
+      ...(current ? { step: current } : {}),
+    };
+    emit(ev);
+  };
 }
 
 /**

package/src/ui/server/ui-assets.ts

@@ -34,6 +34,8 @@ export const UI_MODULES: readonly string[] = [
   "/error-page.js",
   "/agents-section.js",
   "/agents-page.js",
+  // The Start agent form's choices, shared by both (AG-10.0).
+  "/agent-start.js",
   // The UI's catalogs other than English (R19; en is in shell.js).
   "/i18n/ja.js",
   "/i18n/es.js",

package/src/ui/server/workspace-routes.ts

@@ -97,7 +97,7 @@ import { getReposRoot, readUserConfig } from "../../shared/den-config.js";
 import { redactRemote } from "../../shared/environment-manager/git-remote.js";
 import { getDistRoot } from "../../shared/paths.js";
 import { recordRemovedFromWorkspace } from "../../shared/environment-manager/default-workspace.js";
-import { getSudoEnv, prewarmSudo } from "./sudo-store.js";
+import { getSudoEnv, prewarmSudo, watchSudo } from "./sudo-store.js";
 import {
   devManagedPaths,
   selectSyncTargets,
@@ -1155,7 +1155,9 @@ export async function handleWorkspaceRoutes(
       }
     });
 
-    const emit = (obj: unknown): void => {
+    // LK-0: a service's sudo without the password is a needs-sudo event,
+    // naming the command and the service (the last label).
+    const emit = watchSudo((obj: unknown): void => {
       if (cancelled) return;
       try {
         res.write(`data: ${JSON.stringify(obj)}\n\n`);
@@ -1163,7 +1165,7 @@ export async function handleWorkspaceRoutes(
         // Socket closed mid-write — mark cancelled so subsequent loops bail.
         cancelled = true;
       }
-    };
+    });
 
     const wsParam = url.searchParams.get("workspace");
     if (wsParam && !isWorkspaceActive(wsParam)) {
@@ -1959,6 +1961,8 @@ export async function handleWorkspaceRoutes(
     emit: (o: unknown) => void,
     isCancelled: () => boolean,
   ): Promise<boolean> {
+    // LK-0: this step's sudo without the password is a needs-sudo event.
+    emit = watchSudo(emit, `${repoName} ${command}`);
     emit({ type: "line", text: `  ${repoName}: ${command}…` });
     return new Promise<boolean>((resolve) => {
       let settled = false;
@@ -1972,6 +1976,9 @@ export async function handleWorkspaceRoutes(
         const result = runServiceCommand({
           address,
           command,
+          // The sudo shim (LK-0): the password when one is held, else a
+          // needs-sudo line instead of a prompt nobody can answer.
+          env: getSudoEnv(),
           onLine: (line) => {
             if (!isCancelled()) emit({ type: "line", text: `    ${line}` });
           },