@monster-orange/den 0.4.4 → 0.4.5

package/src/ui/server/public/workspace-picker.js

@@ -25,7 +25,7 @@ export const EN_FALLBACK = {
   "ws.viewTitle":
     "View: what every page shows ({ws}). A view filter only: it starts, stops and routes nothing.",
   "ws.viewTitleFocus":
-    "View: what every page shows ({ws}). A view filter only: it starts, stops and routes nothing, and focus ({focus}) stays the target for commands.",
+    "View: what every page shows ({ws}). A view filter only: it starts, stops and routes nothing, and the CLI default ({focus}) stays the target for commands.",
 };
 function enT(key, vars) {
   return String(EN_FALLBACK[key] ?? key).replace(/\{(\w+)\}/g, (m, k) =>

package/src/ui/server/request-guard.ts

@@ -26,10 +26,18 @@
  *    included (Ward, 2026-11-06: the lock, R8, is the only prompt there;
  *    Host, Origin and CSRF cover CSRF and DNS rebinding). SIGNIN_FREE
  *    routes never need one.
- *  - The edge counts as local (0.4.3, edgeClientIsLocal): the edge hostname
- *    from an edge peer gets loopback's treatment unless the edge's
- *    X-Forwarded-For names another machine, or this server is deliberately
- *    exposed (`exposed`: a non-loopback DEN_BIND_HOST bind).
+ *  - The edge (0.4.3, 0.4.5: edgeClient): the edge hostname from an edge
+ *    peer gets loopback's treatment when the edge attests the client is
+ *    this machine (the right-most X-Forwarded-For entry, the one the edge
+ *    itself appended, is loopback or one of this machine's addresses). A
+ *    client it can't place (none, or a Docker/VM gateway's address) signs
+ *    in unless `web.edge_unattested: local`; another machine always does,
+ *    as does every edge request when this server is deliberately exposed
+ *    (`exposed`: a non-loopback DEN_BIND_HOST bind). `localhost` (a
+ *    loopback Host from a loopback peer) never asks.
+ *  - Signing in with GitHub (SEC-2a): its start and poll are sign-in free,
+ *    and its start needs an allowed Origin but no CSRF token (a signed-out
+ *    page has none; route-classes.ts SIGNIN_CSRF_FREE).
  *  - Origin, on POST/PUT/PATCH/DELETE and every WebSocket upgrade: an
  *    allowed host (http or https). No Origin needs a valid bearer.
  *    Otherwise 403 `origin_rejected`.
@@ -40,7 +48,8 @@
  * GETs, pages and SSE streams on loopback pass with only the Host check
  * (§6), except the GETs route-classes.ts marks `mutating` or `shell-grade`
  * (a run, a service's lifecycle command): same-origin only, or a CLI's
- * bearer.
+ * bearer. A sign-in GET (SIGNIN_GETS: /auth, the GitHub sign-in poll) may
+ * also come with no fetch metadata at all, as a plain-http LAN origin's do.
  *
  * The audit actor (auditActorOf, principalOf) comes from the credential,
  * never from a header the caller sets: `agent:<id>` for an actor token,
@@ -61,7 +70,9 @@ import {
   isMutatingGet,
   pathMatches,
   routeClass,
+  SIGNIN_CSRF_FREE,
   SIGNIN_FREE,
+  SIGNIN_GETS,
   type RouteClass,
 } from "./route-classes.js";
 
@@ -143,6 +154,11 @@ export interface GuardContext {
    * needs a sign-in too, as before 0.4.3.
    */
   exposed?: boolean;
+  /**
+   * `web.edge_unattested` (SEC-2a): an edge client Den can't place signs
+   * in (`signin`, the default when unset) or counts as local (`local`).
+   */
+  edgeUnattested?: "local" | "signin";
 }
 
 export type GuardResult =
@@ -155,6 +171,8 @@ export type GuardResult =
       beyond: boolean;
       /** The signed-in session, when the cookie names a live one. */
       session: GuardSession | null;
+      /** The client's address when Den can attest it (SEC-2a: a device's record). */
+      client?: string;
     }
   | {
       ok: false;
@@ -329,14 +347,10 @@ function inSubnet(a: string, net4: { address: string; netmask: string }) {
   return m > 0 && lo(ipv4(a)) === lo(ipv4(net4.address));
 }
 
-/**
- * The original client X-Forwarded-For names: its left-most entry, as an
- * IP (a port or brackets dropped), or undefined when there is none.
- */
-export function forwardedClient(xff: string | undefined): string | undefined {
-  const first = xff?.split(",")[0]?.trim();
-  if (!first) return undefined;
-  let a = first;
+/** One X-Forwarded-For entry as an IP (a port or brackets dropped), or undefined. */
+function forwardedEntry(entry: string | undefined): string | undefined {
+  let a = entry?.trim();
+  if (!a) return undefined;
   const b = /^\[([^\]]+)\](?::\d+)?$/.exec(a);
   if (b) a = b[1];
   else if (/^\d+\.\d+\.\d+\.\d+:\d+$/.test(a)) a = a.replace(/:\d+$/, "");
@@ -345,31 +359,48 @@ export function forwardedClient(xff: string | undefined): string | undefined {
 }
 
 /**
- * The edge counts as local (0.4.3): whether an edge request (the edge
- * hostname from an edge peer) comes from this machine, by the left-most
- * X-Forwarded-For entry (the original client):
+ * The client the edge vouches for (SEC-2a): the right-most X-Forwarded-For
+ * entry, the one the edge's proxy appended itself (its TCP peer, or the
+ * client a trusted front passed on with the PROXY protocol). The entries
+ * left of it are whatever the client, or a hop the edge trusts, sent, so
+ * they are never believed (0.4.4 and earlier read the left-most: forgeable). Undefined
+ * when there is none, or it isn't an IP.
+ */
+export function forwardedClient(xff: string | undefined): string | undefined {
+  const all = xff?.split(",") ?? [];
+  return forwardedEntry(all[all.length - 1]);
+}
+
+/** Who an edge request's client is, as far as Den can tell (edgeClient). */
+export type EdgeClient = "local" | "unattested" | "foreign";
+
+/**
+ * Who an edge request (the edge hostname from an edge peer) comes from, by
+ * the client the edge vouches for (forwardedClient):
  *  - loopback, or one of this machine's own interface addresses (its LAN
- *    or VPN address, a Tailscale 100.x one included): local;
+ *    or VPN address, a Tailscale 100.x one included): `local`;
  *  - missing, unreadable, or a container/VM network's address (the Docker
  *    ranges isEdgePeer takes, a subnet of one of this machine's bridges,
  *    one of the edge's own Docker networks, or OrbStack's 0.250.250.254):
- *    we can't tell (Docker Desktop and OrbStack on macOS hand the
- *    edge their gateway's address, and a TCP passthrough in front hides the
- *    client), so local;
- *  - anything else: another machine, beyond loopback (sign-in required).
- * The edge's own page warns when it is reachable beyond this machine
- * (edge-exposure.ts): with no sign-in, anyone who reaches it is local.
+ *    `unattested`. Docker Desktop and OrbStack on macOS hand the edge
+ *    their gateway's address, and a TCP passthrough in front hides the
+ *    client, so Den can't tell. With SEC-2a it signs in, unless
+ *    `web.edge_unattested: local` (0.4.4's allow);
+ *  - anything else: `foreign`, another machine (sign-in required).
  */
-export function edgeClientIsLocal(
+export function edgeClient(
   xff: string | undefined,
   local: LocalNet = { own: [], bridges: [] },
-): boolean {
+): EdgeClient {
   const c = forwardedClient(xff);
-  if (!c || isEdgePeer(c) || local.own.includes(c)) return true;
+  if (!c) return "unattested";
+  if (isLoopbackAddress(c)) return "local";
+  if (isEdgePeer(c) || local.bridges.some((b) => inSubnet(c, b)))
+    return "unattested";
   // 0.0.0.0/8 ("this network") is never a client on another machine:
   // OrbStack presents the host to its containers as 0.250.250.254.
-  if (net.isIPv4(c) && c.startsWith("0.")) return true;
-  return local.bridges.some((b) => inSubnet(c, b));
+  if (net.isIPv4(c) && c.startsWith("0.")) return "unattested";
+  return local.own.includes(c) ? "local" : "foreign";
 }
 
 /**
@@ -479,13 +510,25 @@ export function checkRequest(
         "127.0.0.1, [::1] with its port, or its edge hostname).",
     };
   const peerLoopback = ctx.peerIsLoopback ? ctx.peerIsLoopback(req) : true;
-  // The edge from this machine (edgeClientIsLocal) is local, unless this
-  // server is deliberately exposed; a LAN name or peer is beyond.
+  // The edge: local when it attests this machine; a client it can't place
+  // signs in unless web.edge_unattested is local; never local when this
+  // server is deliberately exposed. A LAN name or peer is beyond.
+  const xff = header(req, "x-forwarded-for");
+  const who = via === "edge" ? edgeClient(xff, ctx.localNet?.()) : null;
   const beyond =
     via === "edge"
       ? !!ctx.exposed ||
-        !edgeClientIsLocal(header(req, "x-forwarded-for"), ctx.localNet?.())
+        who === "foreign" ||
+        (who === "unattested" && ctx.edgeUnattested !== "local")
       : via !== "loopback" || !peerLoopback;
+  // The address a device's record keeps: the edge's attested client, or
+  // the peer itself off the edge.
+  const client =
+    via === "edge"
+      ? who === "unattested"
+        ? undefined
+        : forwardedClient(xff)
+      : (req.socket?.remoteAddress ?? undefined);
 
   let principal: Principal | null = null;
   const auth = header(req, "authorization");
@@ -532,7 +575,8 @@ export function checkRequest(
   }
 
   // §4: a session (or a bearer) beyond loopback; on loopback, never.
-  if (!principal && !session && !SIGNIN_FREE.includes(pathname) && beyond) {
+  const signinFree = SIGNIN_FREE.some((r) => pathMatches(r, pathname));
+  if (!principal && !session && !signinFree && beyond) {
     const scope: SigninScope = "den";
     return {
       ok: false,
@@ -550,6 +594,7 @@ export function checkRequest(
     via,
     beyond,
     session,
+    ...(client ? { client: normAddress(client) } : {}),
   });
   const browser: Principal | null = session
     ? { kind: "person-browser", session: session.key }
@@ -557,7 +602,7 @@ export function checkRequest(
 
   if (!MUTATING.has(method) && !isUpgrade(req)) {
     if (isMutatingGet(method, pathname)) {
-      const refused = mutatingGetRefusal(req, ctx, principal, cli);
+      const refused = mutatingGetRefusal(req, ctx, pathname, principal, cli);
       if (refused) return refused;
     }
     return ok(principal ?? browser);
@@ -584,6 +629,10 @@ export function checkRequest(
     };
   // A valid bearer is a CLI's or an agent's call: no CSRF to prove.
   if (principal) return ok(principal);
+  // Starting a GitHub sign-in from the signed-out page (which holds no
+  // CSRF token): the allowed Origin above is the check.
+  if (!session && SIGNIN_CSRF_FREE.some((r) => pathMatches(r, pathname)))
+    return ok(null);
   // A browser's WebSocket can't send a header: on an upgrade the token
   // rides as a subprotocol, `den.csrf.<token>` (AG-4a-term's io).
   const csrf =
@@ -606,6 +655,8 @@ export function checkRequest(
 export const AGENT_FORBIDDEN: readonly string[] = [
   // web.secret's management and the browser sign-in: an agent mints nothing.
   "/api/web/*",
+  "/api/github/*",
+  "/api/signin/*",
   "/auth",
   "/signin",
   "/api/session/logout",
@@ -673,13 +724,15 @@ function workspaceRefusal(_p: AgentPrincipal, _pathname: string): null {
  * is a GET too, so these pass only:
  *  - from this server's own pages: Sec-Fetch-Site same-origin (or none, a
  *    URL the person typed), and an Origin, if any, that is allowed;
- *  - or with neither header (the CLI, curl, MCP) and a valid bearer.
+ *  - or with neither header (the CLI, curl, MCP) and a valid bearer, or
+ *    (SIGNIN_GETS) a sign-in GET, which carries its own credential.
  * Sec-Fetch-Site same-site or cross-site: 403 `cross_site` (another port on
  * localhost is same-site, not same-origin).
  */
 function mutatingGetRefusal(
   req: http.IncomingMessage,
   ctx: GuardContext,
+  pathname: string,
   principal: Principal | null,
   cli: string,
 ): Extract<GuardResult, { ok: false }> | null {
@@ -699,7 +752,21 @@ function mutatingGetRefusal(
       code: "origin_rejected",
       error: "Requests from another site can't start or change anything here.",
     };
-  if (site === undefined && origin === undefined && !principal)
+  // A sign-in GET (route-classes.ts SIGNIN_GETS) may come with neither
+  // header. A plain-http origin that isn't localhost (a LAN bind with
+  // web.allow_plain_http_remote) is not "potentially trustworthy", so
+  // Chromium sends it no Sec-Fetch-* headers, and a top-level navigation
+  // sends no Origin: the person's own `web login --origin` link arrives
+  // bare. That is safe: the request carries its own unguessable credential
+  // (/auth a one-time code derived from web.secret, the poll its flow id),
+  // which another site can't know, and a cross-site request from a modern
+  // browser sends Sec-Fetch-Site or Origin, which the checks above refuse.
+  if (
+    site === undefined &&
+    origin === undefined &&
+    !principal &&
+    !SIGNIN_GETS.some((r) => pathMatches(r, pathname))
+  )
     return {
       ok: false,
       status: 403,

package/src/ui/server/route-classes.ts

@@ -183,9 +183,9 @@ export const ROUTES: readonly RouteEntry[] = [
 
   // ── Sign-in (SEC-1b, §2) ────────────────────────────────────────────────
   M(
-    ["GET", "HEAD"],
+    ["GET", "HEAD", "POST"],
     "/auth",
-    "swaps a one-time login code for a session cookie",
+    "swaps a one-time login code for a session cookie (POST: with the code `web login` printed)",
   ),
   R(
     "/signin",
@@ -202,6 +202,71 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/web/logout",
     "ends browser sessions, and rotates web.secret (`web logout`)",
   ),
+  // ── SEC-2a: GitHub sign-in, the owner, pairing ─────────────────────────
+  M(
+    ["POST"],
+    "/api/github/signin",
+    "starts a GitHub sign-in (a device flow the server runs)",
+  ),
+  M(
+    ["GET", "HEAD"],
+    "/api/github/signin/:id",
+    "a GitHub sign-in's outcome; once the owner approved it, sets the session cookie",
+  ),
+  R("/api/web/owner", "who the owner is (`web owner show`)"),
+  S(
+    ["POST"],
+    "/api/web/owner/link",
+    "links the owner's GitHub account (`web owner link`)",
+  ),
+  S(
+    ["GET", "HEAD"],
+    "/api/web/owner/link/:id",
+    "an owner link's device code and outcome",
+  ),
+  S(
+    ["POST"],
+    "/api/web/owner/unlink",
+    "unlinks the owner (`web owner unlink`)",
+  ),
+  R("/api/web/pair", "the edge hostnames a pairing link can be for"),
+  // ── SEC-2a: approve this computer with a code (pair-routes.ts) ─────────
+  M(
+    ["POST"],
+    "/api/signin/code",
+    "asks for a code the owner approves this browser with (in memory, 10 minutes)",
+  ),
+  M(
+    ["GET", "HEAD"],
+    "/api/signin/code/:id",
+    "a code request's state; once approved, sets the session cookie (once)",
+  ),
+  S(
+    ["GET", "HEAD"],
+    "/api/web/waiting",
+    "lists the devices waiting for approval (Settings › Access, `web approve --list`)",
+  ),
+  S(
+    ["POST"],
+    "/api/web/approve",
+    "approves a waiting device: it signs in (`web approve <code>`)",
+  ),
+  S(["POST"], "/api/web/deny", "denies a waiting device"),
+  S(
+    ["POST"],
+    "/api/web/logins",
+    "registers `web login`'s link and its code, to wait on",
+  ),
+  S(
+    ["GET", "HEAD"],
+    "/api/web/logins/:id",
+    "`web login`'s wait: whether its link was used, by which browser",
+  ),
+  S(
+    ["POST"],
+    "/api/web/pair",
+    "mints a one-time sign-in link for another device (Pair a device)",
+  ),
 
   // ── Mutations (checked by method) ───────────────────────────────────────
   M(["POST"], "/api/activity", "an agent's refused-call report"),
@@ -274,6 +339,37 @@ export const SIGNIN_FREE: readonly string[] = [
   "/auth",
   "/signin",
   "/api/session",
+  // SEC-2a: Sign in with GitHub, from the signed-out page.
+  "/api/github/signin",
+  "/api/github/signin/:id",
+  // SEC-2a: approve this computer with a code, from the signed-out page.
+  "/api/signin/code",
+  "/api/signin/code/:id",
+];
+
+/**
+ * SIGNIN_FREE mutations a signed-out page makes, which holds no CSRF token:
+ * they need an allowed Origin only (SEC-2a: starting a GitHub sign-in, and
+ * asking for a code to be approved with).
+ */
+export const SIGNIN_CSRF_FREE: readonly string[] = [
+  "/api/github/signin",
+  "/api/signin/code",
+  // SEC-2a: a waited-on link's page posts the code `web login` printed.
+  "/auth",
+];
+
+/**
+ * Sign-in GETs that carry their own unguessable credential: /auth a one-time
+ * code derived from web.secret, the GitHub sign-in poll its flow id, the
+ * code request's poll its own id (never the code). They
+ * may come with no fetch metadata at all (request-guard.ts,
+ * mutatingGetRefusal): a plain-http LAN origin gets none from the browser.
+ */
+export const SIGNIN_GETS: readonly string[] = [
+  "/auth",
+  "/api/github/signin/:id",
+  "/api/signin/code/:id",
 ];
 
 /** The dispatchers' route regexes, by `<file>:<const>`, and their entries. */
@@ -285,6 +381,10 @@ export const REGEX_ROUTES: Readonly<Record<string, readonly string[]>> = {
   ],
   "agent-routes.ts:RUNTIME_PATH": ["/api/agents/runtimes/:id/path"],
   "session-routes.ts:IO_PATH": ["/api/sessions/:id/io"],
+  "github-routes.ts:SIGNIN_PATH": ["/api/github/signin/:id"],
+  "github-routes.ts:LINK_PATH": ["/api/web/owner/link/:id"],
+  "pair-routes.ts:POLL_PATH": ["/api/signin/code/:id"],
+  "index.ts:LOGIN_WAIT_PATH": ["/api/web/logins/:id"],
 };
 
 /** Whether `pathname` matches a table path. */

package/src/ui/server/ui-assets.ts

@@ -36,6 +36,8 @@ export const UI_MODULES: readonly string[] = [
   "/agents-page.js",
   // The Start agent form's choices, shared by both (AG-10.0).
   "/agent-start.js",
+  // SEC-2a: Pair a device's QR code (a tiny encoder of Den's own).
+  "/qr.js",
   // The UI's catalogs other than English (R19; en is in shell.js).
   "/i18n/ja.js",
   "/i18n/es.js",