@monster-orange/den 0.4.3 → 0.4.5

package/src/ui/server/request-guard.ts

@@ -26,10 +26,18 @@
  *    included (Ward, 2026-11-06: the lock, R8, is the only prompt there;
  *    Host, Origin and CSRF cover CSRF and DNS rebinding). SIGNIN_FREE
  *    routes never need one.
- *  - The edge counts as local (0.4.3, edgeClientIsLocal): the edge hostname
- *    from an edge peer gets loopback's treatment unless the edge's
- *    X-Forwarded-For names another machine, or this server is deliberately
- *    exposed (`exposed`: a non-loopback DEN_BIND_HOST bind).
+ *  - The edge (0.4.3, 0.4.5: edgeClient): the edge hostname from an edge
+ *    peer gets loopback's treatment when the edge attests the client is
+ *    this machine (the right-most X-Forwarded-For entry, the one the edge
+ *    itself appended, is loopback or one of this machine's addresses). A
+ *    client it can't place (none, or a Docker/VM gateway's address) signs
+ *    in unless `web.edge_unattested: local`; another machine always does,
+ *    as does every edge request when this server is deliberately exposed
+ *    (`exposed`: a non-loopback DEN_BIND_HOST bind). `localhost` (a
+ *    loopback Host from a loopback peer) never asks.
+ *  - Signing in with GitHub (SEC-2a): its start and poll are sign-in free,
+ *    and its start needs an allowed Origin but no CSRF token (a signed-out
+ *    page has none; route-classes.ts SIGNIN_CSRF_FREE).
  *  - Origin, on POST/PUT/PATCH/DELETE and every WebSocket upgrade: an
  *    allowed host (http or https). No Origin needs a valid bearer.
  *    Otherwise 403 `origin_rejected`.
@@ -40,7 +48,8 @@
  * GETs, pages and SSE streams on loopback pass with only the Host check
  * (§6), except the GETs route-classes.ts marks `mutating` or `shell-grade`
  * (a run, a service's lifecycle command): same-origin only, or a CLI's
- * bearer.
+ * bearer. A sign-in GET (SIGNIN_GETS: /auth, the GitHub sign-in poll) may
+ * also come with no fetch metadata at all, as a plain-http LAN origin's do.
  *
  * The audit actor (auditActorOf, principalOf) comes from the credential,
  * never from a header the caller sets: `agent:<id>` for an actor token,
@@ -61,7 +70,9 @@ import {
   isMutatingGet,
   pathMatches,
   routeClass,
+  SIGNIN_CSRF_FREE,
   SIGNIN_FREE,
+  SIGNIN_GETS,
   type RouteClass,
 } from "./route-classes.js";
 
@@ -143,6 +154,11 @@ export interface GuardContext {
    * needs a sign-in too, as before 0.4.3.
    */
   exposed?: boolean;
+  /**
+   * `web.edge_unattested` (SEC-2a): an edge client Den can't place signs
+   * in (`signin`, the default when unset) or counts as local (`local`).
+   */
+  edgeUnattested?: "local" | "signin";
 }
 
 export type GuardResult =
@@ -155,6 +171,8 @@ export type GuardResult =
       beyond: boolean;
       /** The signed-in session, when the cookie names a live one. */
       session: GuardSession | null;
+      /** The client's address when Den can attest it (SEC-2a: a device's record). */
+      client?: string;
     }
   | {
       ok: false;
@@ -329,14 +347,10 @@ function inSubnet(a: string, net4: { address: string; netmask: string }) {
   return m > 0 && lo(ipv4(a)) === lo(ipv4(net4.address));
 }
 
-/**
- * The original client X-Forwarded-For names: its left-most entry, as an
- * IP (a port or brackets dropped), or undefined when there is none.
- */
-export function forwardedClient(xff: string | undefined): string | undefined {
-  const first = xff?.split(",")[0]?.trim();
-  if (!first) return undefined;
-  let a = first;
+/** One X-Forwarded-For entry as an IP (a port or brackets dropped), or undefined. */
+function forwardedEntry(entry: string | undefined): string | undefined {
+  let a = entry?.trim();
+  if (!a) return undefined;
   const b = /^\[([^\]]+)\](?::\d+)?$/.exec(a);
   if (b) a = b[1];
   else if (/^\d+\.\d+\.\d+\.\d+:\d+$/.test(a)) a = a.replace(/:\d+$/, "");
@@ -345,31 +359,48 @@ export function forwardedClient(xff: string | undefined): string | undefined {
 }
 
 /**
- * The edge counts as local (0.4.3): whether an edge request (the edge
- * hostname from an edge peer) comes from this machine, by the left-most
- * X-Forwarded-For entry (the original client):
+ * The client the edge vouches for (SEC-2a): the right-most X-Forwarded-For
+ * entry, the one the edge's proxy appended itself (its TCP peer, or the
+ * client a trusted front passed on with the PROXY protocol). The entries
+ * left of it are whatever the client, or a hop the edge trusts, sent, so
+ * they are never believed (0.4.4 and earlier read the left-most: forgeable). Undefined
+ * when there is none, or it isn't an IP.
+ */
+export function forwardedClient(xff: string | undefined): string | undefined {
+  const all = xff?.split(",") ?? [];
+  return forwardedEntry(all[all.length - 1]);
+}
+
+/** Who an edge request's client is, as far as Den can tell (edgeClient). */
+export type EdgeClient = "local" | "unattested" | "foreign";
+
+/**
+ * Who an edge request (the edge hostname from an edge peer) comes from, by
+ * the client the edge vouches for (forwardedClient):
  *  - loopback, or one of this machine's own interface addresses (its LAN
- *    or VPN address, a Tailscale 100.x one included): local;
+ *    or VPN address, a Tailscale 100.x one included): `local`;
  *  - missing, unreadable, or a container/VM network's address (the Docker
  *    ranges isEdgePeer takes, a subnet of one of this machine's bridges,
  *    one of the edge's own Docker networks, or OrbStack's 0.250.250.254):
- *    we can't tell (Docker Desktop and OrbStack on macOS hand the
- *    edge their gateway's address, and a TCP passthrough in front hides the
- *    client), so local;
- *  - anything else: another machine, beyond loopback (sign-in required).
- * The edge's own page warns when it is reachable beyond this machine
- * (edge-exposure.ts): with no sign-in, anyone who reaches it is local.
+ *    `unattested`. Docker Desktop and OrbStack on macOS hand the edge
+ *    their gateway's address, and a TCP passthrough in front hides the
+ *    client, so Den can't tell. With SEC-2a it signs in, unless
+ *    `web.edge_unattested: local` (0.4.4's allow);
+ *  - anything else: `foreign`, another machine (sign-in required).
  */
-export function edgeClientIsLocal(
+export function edgeClient(
   xff: string | undefined,
   local: LocalNet = { own: [], bridges: [] },
-): boolean {
+): EdgeClient {
   const c = forwardedClient(xff);
-  if (!c || isEdgePeer(c) || local.own.includes(c)) return true;
+  if (!c) return "unattested";
+  if (isLoopbackAddress(c)) return "local";
+  if (isEdgePeer(c) || local.bridges.some((b) => inSubnet(c, b)))
+    return "unattested";
   // 0.0.0.0/8 ("this network") is never a client on another machine:
   // OrbStack presents the host to its containers as 0.250.250.254.
-  if (net.isIPv4(c) && c.startsWith("0.")) return true;
-  return local.bridges.some((b) => inSubnet(c, b));
+  if (net.isIPv4(c) && c.startsWith("0.")) return "unattested";
+  return local.own.includes(c) ? "local" : "foreign";
 }
 
 /**
@@ -479,13 +510,25 @@ export function checkRequest(
         "127.0.0.1, [::1] with its port, or its edge hostname).",
     };
   const peerLoopback = ctx.peerIsLoopback ? ctx.peerIsLoopback(req) : true;
-  // The edge from this machine (edgeClientIsLocal) is local, unless this
-  // server is deliberately exposed; a LAN name or peer is beyond.
+  // The edge: local when it attests this machine; a client it can't place
+  // signs in unless web.edge_unattested is local; never local when this
+  // server is deliberately exposed. A LAN name or peer is beyond.
+  const xff = header(req, "x-forwarded-for");
+  const who = via === "edge" ? edgeClient(xff, ctx.localNet?.()) : null;
   const beyond =
     via === "edge"
       ? !!ctx.exposed ||
-        !edgeClientIsLocal(header(req, "x-forwarded-for"), ctx.localNet?.())
+        who === "foreign" ||
+        (who === "unattested" && ctx.edgeUnattested !== "local")
       : via !== "loopback" || !peerLoopback;
+  // The address a device's record keeps: the edge's attested client, or
+  // the peer itself off the edge.
+  const client =
+    via === "edge"
+      ? who === "unattested"
+        ? undefined
+        : forwardedClient(xff)
+      : (req.socket?.remoteAddress ?? undefined);
 
   let principal: Principal | null = null;
   const auth = header(req, "authorization");
@@ -532,7 +575,8 @@ export function checkRequest(
   }
 
   // §4: a session (or a bearer) beyond loopback; on loopback, never.
-  if (!principal && !session && !SIGNIN_FREE.includes(pathname) && beyond) {
+  const signinFree = SIGNIN_FREE.some((r) => pathMatches(r, pathname));
+  if (!principal && !session && !signinFree && beyond) {
     const scope: SigninScope = "den";
     return {
       ok: false,
@@ -550,6 +594,7 @@ export function checkRequest(
     via,
     beyond,
     session,
+    ...(client ? { client: normAddress(client) } : {}),
   });
   const browser: Principal | null = session
     ? { kind: "person-browser", session: session.key }
@@ -557,7 +602,7 @@ export function checkRequest(
 
   if (!MUTATING.has(method) && !isUpgrade(req)) {
     if (isMutatingGet(method, pathname)) {
-      const refused = mutatingGetRefusal(req, ctx, principal, cli);
+      const refused = mutatingGetRefusal(req, ctx, pathname, principal, cli);
       if (refused) return refused;
     }
     return ok(principal ?? browser);
@@ -584,6 +629,10 @@ export function checkRequest(
     };
   // A valid bearer is a CLI's or an agent's call: no CSRF to prove.
   if (principal) return ok(principal);
+  // Starting a GitHub sign-in from the signed-out page (which holds no
+  // CSRF token): the allowed Origin above is the check.
+  if (!session && SIGNIN_CSRF_FREE.some((r) => pathMatches(r, pathname)))
+    return ok(null);
   // A browser's WebSocket can't send a header: on an upgrade the token
   // rides as a subprotocol, `den.csrf.<token>` (AG-4a-term's io).
   const csrf =
@@ -606,13 +655,15 @@ export function checkRequest(
 export const AGENT_FORBIDDEN: readonly string[] = [
   // web.secret's management and the browser sign-in: an agent mints nothing.
   "/api/web/*",
+  "/api/github/*",
+  "/api/signin/*",
   "/auth",
   "/signin",
   "/api/session/logout",
 ];
 
 /**
- * Routes an agent's token may read but never change: the lock (R8).
+ * Routes an agent's token may read but never change: the admin password (R8).
  * Privileged actions stay with people (AG-5); its status is a read.
  */
 export const AGENT_READ_ONLY: readonly string[] = [
@@ -673,13 +724,15 @@ function workspaceRefusal(_p: AgentPrincipal, _pathname: string): null {
  * is a GET too, so these pass only:
  *  - from this server's own pages: Sec-Fetch-Site same-origin (or none, a
  *    URL the person typed), and an Origin, if any, that is allowed;
- *  - or with neither header (the CLI, curl, MCP) and a valid bearer.
+ *  - or with neither header (the CLI, curl, MCP) and a valid bearer, or
+ *    (SIGNIN_GETS) a sign-in GET, which carries its own credential.
  * Sec-Fetch-Site same-site or cross-site: 403 `cross_site` (another port on
  * localhost is same-site, not same-origin).
  */
 function mutatingGetRefusal(
   req: http.IncomingMessage,
   ctx: GuardContext,
+  pathname: string,
   principal: Principal | null,
   cli: string,
 ): Extract<GuardResult, { ok: false }> | null {
@@ -699,7 +752,21 @@ function mutatingGetRefusal(
       code: "origin_rejected",
       error: "Requests from another site can't start or change anything here.",
     };
-  if (site === undefined && origin === undefined && !principal)
+  // A sign-in GET (route-classes.ts SIGNIN_GETS) may come with neither
+  // header. A plain-http origin that isn't localhost (a LAN bind with
+  // web.allow_plain_http_remote) is not "potentially trustworthy", so
+  // Chromium sends it no Sec-Fetch-* headers, and a top-level navigation
+  // sends no Origin: the person's own `web login --origin` link arrives
+  // bare. That is safe: the request carries its own unguessable credential
+  // (/auth a one-time code derived from web.secret, the poll its flow id),
+  // which another site can't know, and a cross-site request from a modern
+  // browser sends Sec-Fetch-Site or Origin, which the checks above refuse.
+  if (
+    site === undefined &&
+    origin === undefined &&
+    !principal &&
+    !SIGNIN_GETS.some((r) => pathMatches(r, pathname))
+  )
     return {
       ok: false,
       status: 403,

package/src/ui/server/route-classes.ts

@@ -145,6 +145,7 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/graph",
     "/api/applications",
     "/api/personas",
+    "/api/agents/runtimes",
     "/api/workspaces/:ws/agents",
   ].map((p) => R(p)),
   R(
@@ -182,9 +183,9 @@ export const ROUTES: readonly RouteEntry[] = [
 
   // ── Sign-in (SEC-1b, §2) ────────────────────────────────────────────────
   M(
-    ["GET", "HEAD"],
+    ["GET", "HEAD", "POST"],
     "/auth",
-    "swaps a one-time login code for a session cookie",
+    "swaps a one-time login code for a session cookie (POST: with the code `web login` printed)",
   ),
   R(
     "/signin",
@@ -201,6 +202,71 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/web/logout",
     "ends browser sessions, and rotates web.secret (`web logout`)",
   ),
+  // ── SEC-2a: GitHub sign-in, the owner, pairing ─────────────────────────
+  M(
+    ["POST"],
+    "/api/github/signin",
+    "starts a GitHub sign-in (a device flow the server runs)",
+  ),
+  M(
+    ["GET", "HEAD"],
+    "/api/github/signin/:id",
+    "a GitHub sign-in's outcome; once the owner approved it, sets the session cookie",
+  ),
+  R("/api/web/owner", "who the owner is (`web owner show`)"),
+  S(
+    ["POST"],
+    "/api/web/owner/link",
+    "links the owner's GitHub account (`web owner link`)",
+  ),
+  S(
+    ["GET", "HEAD"],
+    "/api/web/owner/link/:id",
+    "an owner link's device code and outcome",
+  ),
+  S(
+    ["POST"],
+    "/api/web/owner/unlink",
+    "unlinks the owner (`web owner unlink`)",
+  ),
+  R("/api/web/pair", "the edge hostnames a pairing link can be for"),
+  // ── SEC-2a: approve this computer with a code (pair-routes.ts) ─────────
+  M(
+    ["POST"],
+    "/api/signin/code",
+    "asks for a code the owner approves this browser with (in memory, 10 minutes)",
+  ),
+  M(
+    ["GET", "HEAD"],
+    "/api/signin/code/:id",
+    "a code request's state; once approved, sets the session cookie (once)",
+  ),
+  S(
+    ["GET", "HEAD"],
+    "/api/web/waiting",
+    "lists the devices waiting for approval (Settings › Access, `web approve --list`)",
+  ),
+  S(
+    ["POST"],
+    "/api/web/approve",
+    "approves a waiting device: it signs in (`web approve <code>`)",
+  ),
+  S(["POST"], "/api/web/deny", "denies a waiting device"),
+  S(
+    ["POST"],
+    "/api/web/logins",
+    "registers `web login`'s link and its code, to wait on",
+  ),
+  S(
+    ["GET", "HEAD"],
+    "/api/web/logins/:id",
+    "`web login`'s wait: whether its link was used, by which browser",
+  ),
+  S(
+    ["POST"],
+    "/api/web/pair",
+    "mints a one-time sign-in link for another device (Pair a device)",
+  ),
 
   // ── Mutations (checked by method) ───────────────────────────────────────
   M(["POST"], "/api/activity", "an agent's refused-call report"),
@@ -209,8 +275,13 @@ export const ROUTES: readonly RouteEntry[] = [
   M(["POST", "DELETE"], "/api/release/deploy", "starts or dismisses a deploy"),
   M(["POST"], "/api/manifest/validate", "validates posted content (no write)"),
   M(["POST"], "/api/local-dev"),
-  M(["POST"], "/api/sudo-password", "opens the lock (R8)"),
-  M(["POST"], "/api/sudo-password/load-from-vault", "opens the lock (R8)"),
+  M(["POST"], "/api/sudo-password", "sets the admin password, for sudo (R8)"),
+  M(
+    ["POST"],
+    "/api/sudo-password/load-from-vault",
+    "sets the admin password from the vault, for sudo (R8)",
+  ),
+  M(["POST"], "/api/sudo-password/forget", "forgets the admin password (R8)"),
   M(["POST"], "/api/scope"),
   M(["POST"], "/api/settings"),
   M(
@@ -241,6 +312,11 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/workspaces/:ws/agents/:id/resume",
     "resumes an agent: a runtime in a PTY",
   ),
+  S(
+    ["POST"],
+    "/api/agents/runtimes/:id/path",
+    "runs the path given (its version command) before saving it as a runtime's CLI (AG-0.5)",
+  ),
   S(
     ["GET", "HEAD"],
     "/api/sessions/:id/io",
@@ -263,6 +339,37 @@ export const SIGNIN_FREE: readonly string[] = [
   "/auth",
   "/signin",
   "/api/session",
+  // SEC-2a: Sign in with GitHub, from the signed-out page.
+  "/api/github/signin",
+  "/api/github/signin/:id",
+  // SEC-2a: approve this computer with a code, from the signed-out page.
+  "/api/signin/code",
+  "/api/signin/code/:id",
+];
+
+/**
+ * SIGNIN_FREE mutations a signed-out page makes, which holds no CSRF token:
+ * they need an allowed Origin only (SEC-2a: starting a GitHub sign-in, and
+ * asking for a code to be approved with).
+ */
+export const SIGNIN_CSRF_FREE: readonly string[] = [
+  "/api/github/signin",
+  "/api/signin/code",
+  // SEC-2a: a waited-on link's page posts the code `web login` printed.
+  "/auth",
+];
+
+/**
+ * Sign-in GETs that carry their own unguessable credential: /auth a one-time
+ * code derived from web.secret, the GitHub sign-in poll its flow id, the
+ * code request's poll its own id (never the code). They
+ * may come with no fetch metadata at all (request-guard.ts,
+ * mutatingGetRefusal): a plain-http LAN origin gets none from the browser.
+ */
+export const SIGNIN_GETS: readonly string[] = [
+  "/auth",
+  "/api/github/signin/:id",
+  "/api/signin/code/:id",
 ];
 
 /** The dispatchers' route regexes, by `<file>:<const>`, and their entries. */
@@ -272,7 +379,12 @@ export const REGEX_ROUTES: Readonly<Record<string, readonly string[]>> = {
     "/api/workspaces/:ws/agents/:id/stop",
     "/api/workspaces/:ws/agents/:id/resume",
   ],
+  "agent-routes.ts:RUNTIME_PATH": ["/api/agents/runtimes/:id/path"],
   "session-routes.ts:IO_PATH": ["/api/sessions/:id/io"],
+  "github-routes.ts:SIGNIN_PATH": ["/api/github/signin/:id"],
+  "github-routes.ts:LINK_PATH": ["/api/web/owner/link/:id"],
+  "pair-routes.ts:POLL_PATH": ["/api/signin/code/:id"],
+  "index.ts:LOGIN_WAIT_PATH": ["/api/web/logins/:id"],
 };
 
 /** Whether `pathname` matches a table path. */

package/src/ui/server/session-routes.ts

@@ -18,6 +18,10 @@
  *   - on attach, the scrollback replay, then live output: binary frames;
  *   - a text frame `{"type":"session",…}` first (what is attached), and
  *     `{"type":"exit","exitCode":n}` when the session ends;
+ *   - `{"type":"size","cols":c,"rows":r}`: the PTY's size, on attach and
+ *     each time any viewer (another browser, a CLI attach) resizes it. The
+ *     size is last-writer-wins; a pane that learns it is out of step says
+ *     its own again when it is used (focused, typed in, shown);
  *   - in: binary frames are input; a text frame is JSON control:
  *     `{"type":"resize","cols":c,"rows":r}` (or `{"type":"input","data":s}`).
  * Closing the socket detaches. Nothing here ever signals a session: leaving
@@ -391,6 +395,9 @@ export async function handleSessionUpgrade(
   let exited = s.exited === true;
   const att = client.attach(s.ref.id, {
     onData: (data) => ws.send(data),
+    onSize: (cols, rows) => {
+      if (ws.open) ws.send(JSON.stringify({ type: "size", cols, rows }));
+    },
     onExit: (exitCode) => {
       exited = true;
       ws.send(
@@ -417,8 +424,9 @@ export async function handleSessionUpgrade(
       return;
     }
     if (msg?.type === "resize") {
+      // Never below 2x2: a pane measured before it was laid out.
       const ok = (n: unknown): n is number =>
-        typeof n === "number" && Number.isInteger(n) && n >= 1 && n <= 1000;
+        typeof n === "number" && Number.isInteger(n) && n >= 2 && n <= 1000;
       if (!exited && ok(msg.cols) && ok(msg.rows))
         client.resize(s.ref.id, msg.cols, msg.rows);
     } else if (msg?.type === "input" && typeof msg.data === "string") {