@proagentstore/cli 0.4.155 → 0.4.157

package/dist/browser-runner/coding/runtime.js

@@ -1,3 +1,4 @@
+import { confineWorkDir } from "./workdir-guard.js";
 import { actDigest } from "./input-ledger.js";
 import { parkRestore, parkSnapshot } from "./park-snapshot.js";
 import { runObjective } from "./run-objective.js";
@@ -15,6 +16,13 @@ const MAX_PANE = 64 * 1024;
 export class CodingRuntime {
     reposBaseDir;
     sessions = new Map();
+    /**
+     * Which agent instance each session belongs to (#1164). One `pags up` serves every agent on the
+     * machine, and every relayed request names the instance whose socket it arrived on — so a session
+     * started by one agent must not be driven, read or ended through another's. Bound at `/coding/start`;
+     * a session with no binding (one started before this, or by a local caller) answers to anyone, as before.
+     */
+    owners = new Map();
     /**
      * Coding turns that are running here (#896, #1007).
      *
@@ -84,21 +92,26 @@ export class CodingRuntime {
      * workDir (authoritative even for managed clone dirs); fall back to an explicit path
      * (the cloud passes the D1 `repo.workdir` when the session map is empty after a runner
      * restart). Expands a leading `~` the same way start() does.
+     *
+     * An explicit path is CONFINED (#1165): never the home folder or above it, never inside a
+     * credential directory — so `{ workDir: "~", path: ".ssh/id_ed25519" }` is refused rather
+     * than a confined read of a private key. See `workdir-guard.ts`.
      */
     resolveWorkDir(input) {
         if (input.sessionId) {
             const s = this.sessions.get(input.sessionId);
+            // The session's own folder answers to the same rule: a session started in `~` must not reopen it.
             if (s)
-                return s.config.workDir;
+                return confineWorkDir(s.config.workDir, { allow: [this.reposBaseDir] });
         }
         if (input.workDir)
-            return resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()));
+            return confineWorkDir(input.workDir, { allow: [this.reposBaseDir] });
         throw new InspectError("no session or workDir to inspect");
     }
     /** Where a parked run's checkout is (#1077): its declared folder, else the managed clone dir `start()` uses. */
     parkWorkDir(input) {
         if (input.workDir)
-            return resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()));
+            return confineWorkDir(input.workDir, { allow: [this.reposBaseDir] });
         if (input.repoId)
             return join(this.reposBaseDir, sanitizeSessionName(input.repoId));
         throw new InspectError("no workDir or repoId for the parked checkout");
@@ -357,6 +370,22 @@ export class CodingRuntime {
         this.takeovers.delete(sessionId);
         return { ok: true, usage, acts, authResolved };
     }
+    /** Record the instance a session belongs to — the first one to start it (#1164). */
+    bindInstance(sessionId, instanceId) {
+        if (sessionId && instanceId && !this.owners.has(sessionId))
+            this.owners.set(sessionId, instanceId);
+    }
+    /** Why `instanceId` may not touch this session, or null (#1164). An unbound session, or no caller instance, is not refused. */
+    instanceRefusal(sessionId, instanceId) {
+        const owner = this.owners.get(sessionId);
+        if (!owner || !instanceId || owner === instanceId)
+            return null;
+        return `Coding session ${sessionId} belongs to another agent on this machine; a request from this agent cannot reach it.`;
+    }
+    /** Is this session visible to `instanceId` — its own, unbound, or no caller instance (#1164)? */
+    visibleTo(sessionId, instanceId) {
+        return this.instanceRefusal(sessionId, instanceId) === null;
+    }
     list() {
         return [...this.sessions.entries()].map(([sessionId, s]) => ({
             sessionId,

package/dist/browser-runner/coding/secret-file.js

@@ -1,7 +1,8 @@
-import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { RunnerInputError } from "../errors.js";
+import { isWithin, realPathOf } from "./workdir-guard.js";
 /**
  * The runner's half of the machine-to-machine secret handoff (#918): read a secret file so the
  * cloud can encrypt it, and write one back from the cloud's decrypted copy.
@@ -18,23 +19,44 @@ import { RunnerInputError } from "../errors.js";
  */
 /** Big enough for any `.env`, key file or credentials JSON; small enough that this is not a file-transfer tool. */
 export const SECRET_MAX_BYTES = 64 * 1024;
-/** `~` expanded; a relative path resolves against the home directory, which is where `pags up` users name things from. */
-function resolvePath(raw) {
+/**
+ * The ONE folder the secret handoff reads from and writes to (#1165).
+ *
+ * It used to take any path the owner's account could reach: `/secure/read` would hand over
+ * `~/.ssh/id_ed25519`, and `/secure/write` with `overwrite: true` could replace `~/.ssh/authorized_keys`.
+ * Now a relative path is relative to this folder, and an absolute or `~/…` path must already be inside
+ * it, resolved through symlinks, so a link planted in it cannot point back out. Moving a delivered
+ * file to where it is used is the operator's step, in the open.
+ */
+export function secureFilesDir(home = homedir()) {
+    return join(home, ".config", "proagentstore", "secure-files");
+}
+/** `~` expanded; relative to {@link secureFilesDir}; refused unless it stays inside that folder. */
+function resolvePath(raw, home = homedir()) {
     const p = String(raw ?? "").trim();
     if (!p)
         throw new RunnerInputError("A `path` is required.");
-    const expanded = p.replace(/^~(?=$|\/)/, homedir());
-    return isAbsolute(expanded) ? resolve(expanded) : resolve(homedir(), expanded);
+    const root = secureFilesDir(home);
+    const expanded = p.replace(/^~(?=$|\/)/, home);
+    const path = isAbsolute(expanded) ? resolve(expanded) : resolve(root, expanded);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    if (path === root || !isWithin(realPathOf(path, home), realPathOf(root, home))) {
+        throw new RunnerInputError(`${p} is outside ${root}. The secret handoff reads and writes only inside that folder — name a file there, e.g. \`app.env\`.`);
+    }
+    return path;
 }
-export function readSecretFile(input) {
-    const path = resolvePath(input.path);
+export function readSecretFile(input, home = homedir()) {
+    const path = resolvePath(input.path, home);
     let st;
     try {
-        st = statSync(path);
+        st = lstatSync(path);
     }
     catch {
         throw new RunnerInputError(`No file at ${path}.`);
     }
+    // Not followed (#1165): a symlink in the folder would read whatever it points at.
+    if (st.isSymbolicLink())
+        throw new RunnerInputError(`${path} is a symbolic link; the secret handoff reads regular files only.`);
     if (!st.isFile())
         throw new RunnerInputError(`${path} is not a regular file.`);
     if (st.size === 0)
@@ -63,8 +85,8 @@ function parseMode(raw) {
         throw new RunnerInputError(`mode ${s} is group/world-writable or executable; a secret file must not be.`);
     return mode;
 }
-export function writeSecretFile(input) {
-    const path = resolvePath(input.path);
+export function writeSecretFile(input, home = homedir()) {
+    const path = resolvePath(input.path, home);
     if (typeof input.value !== "string" || !input.value)
         throw new RunnerInputError("Nothing to write.");
     const mode = parseMode(input.mode);

package/dist/browser-runner/coding/workdir-guard.js

@@ -0,0 +1,80 @@
+/**
+ * What a caller-supplied `workDir` may be (#1165).
+ *
+ * The read-only inspection routes (`read-file`, `tree`, `search`, `git`) confine every PATH to the
+ * `workDir` — but took the `workDir` itself from the request. `{ workDir: "~", path: ".ssh/id_ed25519" }`
+ * was a perfectly confined read of a private key. The cloud sends the owner's registered repo folder
+ * (`coding_repos.workdir`), and registration accepts any local path, `~` included; this runner has no
+ * copy of that registry to check against. So it refuses what can never be a repository it should
+ * read inside, whoever asked:
+ *
+ *   • the filesystem root, the home folder, or any folder ABOVE the home folder — a root that holds
+ *     everything the owner has;
+ *   • a folder inside a credential directory ({@link CREDENTIAL_DIRS}) — `~/.ssh`, `~/.gnupg`, the
+ *     cloud CLIs' config, and ProAgentStore's own (`~/.config/proagentstore`, which holds the account
+ *     session), except the managed clones the runner itself makes there.
+ *
+ * Resolved through symlinks first (the nearest existing ancestor, for a folder a clone will create), so
+ * `~/dev/innocent -> ~/.ssh` is the credential directory it points at.
+ */
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { InspectError } from "./inspect.js";
+/** Folders under the home folder whose contents are credentials, never a repository to read. */
+export const CREDENTIAL_DIRS = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".azure",
+    ".kube",
+    ".docker",
+    ".password-store",
+    ".config/gcloud",
+    ".config/gh",
+    ".config/proagentstore",
+    "Library/Keychains",
+];
+/** `~` expanded; resolved through symlinks as far as the path exists. */
+export function realPathOf(raw, home = homedir()) {
+    const expanded = raw.trim().replace(/^~(?=$|[\\/])/, home);
+    let p = resolve(isAbsolute(expanded) ? expanded : join(home, expanded));
+    const tail = [];
+    while (!existsSync(p)) {
+        const up = dirname(p);
+        if (up === p)
+            break;
+        tail.unshift(basename(p));
+        p = up;
+    }
+    let real = p;
+    try {
+        real = realpathSync(p);
+    }
+    catch {
+        // Unreadable: judge the path as written.
+    }
+    return tail.length ? join(real, ...tail) : real;
+}
+/** Is `child` the same as `parent` or inside it? */
+export function isWithin(child, parent) {
+    const rel = relative(parent, child);
+    return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+/**
+ * The `workDir` a request may name, or an {@link InspectError} saying why not. `allow` lists folders the
+ * runner itself manages inside a credential directory — the managed clone root — which stay usable.
+ */
+export function confineWorkDir(raw, opts = {}) {
+    const home = realPathOf(opts.home ?? homedir(), opts.home ?? homedir());
+    const path = realPathOf(raw, opts.home ?? homedir());
+    if (isWithin(home, path)) {
+        throw new InspectError(`"${raw}" is ${path === home ? "the home folder" : "a folder that contains the home folder"}, not a repository — register the repository's own folder.`);
+    }
+    if ((opts.allow ?? []).some((a) => isWithin(path, realPathOf(a, home))))
+        return path;
+    const credential = CREDENTIAL_DIRS.find((d) => isWithin(path, realPathOf(join(home, d), home)));
+    if (credential)
+        throw new InspectError(`"${raw}" is inside ~/${credential}, which holds credentials — it cannot be read as a repository.`);
+    return path;
+}

package/dist/browser-runner/request-instance.js

@@ -0,0 +1,42 @@
+import { RunnerInputError } from "./errors.js";
+/** The relayed instance id header, or undefined. */
+export function instanceOf(req) {
+    const raw = req.headers["x-pags-instance-id"];
+    const id = (Array.isArray(raw) ? raw[0] : raw)?.trim();
+    return id || undefined;
+}
+/** The coding session a `/coding/*` request is about: its body's `sessionId`, or the takeover path's id. */
+export function codingSessionIdOf(path, body) {
+    const m = path.match(/^\/coding\/takeover\/([^/]+)\//);
+    if (m)
+        return decodeURIComponent(m[1]);
+    return typeof body?.sessionId === "string" && body.sessionId ? body.sessionId : null;
+}
+/** Why `caller` may not reach the coding session this request names, or null. */
+export async function codingSessionRefusal(coding, req, path, caller) {
+    if (!path.startsWith("/coding/"))
+        return null;
+    const sessionId = codingSessionIdOf(path, req.method === "POST" ? await readJson(req) : undefined);
+    return sessionId ? coding.instanceRefusal(sessionId, caller) : null;
+}
+/** A body read once and kept, so the session guard and the route handler both see it. */
+const bodies = new WeakMap();
+export async function readJson(req) {
+    if (bodies.has(req))
+        return bodies.get(req);
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(Buffer.from(chunk));
+    const raw = Buffer.concat(chunks).toString("utf-8");
+    let parsed = {};
+    if (raw) {
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new RunnerInputError("Request body must be valid JSON");
+        }
+    }
+    bodies.set(req, parsed);
+    return parsed;
+}

package/dist/browser-runner/server.js

@@ -1,3 +1,4 @@
+import { codingSessionRefusal, instanceOf, readJson } from "./request-instance.js";
 import { createServer, } from "node:http";
 import { URL } from "node:url";
 import { recordRequestFailure } from "./request-failure.js";
@@ -75,6 +76,11 @@ export async function startRunnerServer(config) {
 async function route(runner, req, res) {
     const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
     const path = url.pathname.replace(/\/$/, "") || "/";
+    // The agent this request came from, and whether it may touch the coding session it names (#1164, request-instance.ts).
+    const caller = instanceOf(req);
+    const refused = await codingSessionRefusal(runner.coding, req, path, caller);
+    if (refused)
+        return json(res, 403, { error: refused });
     if ((req.method === "GET" || req.method === "POST") && path === "/health") {
         // #896: a health check that cannot say WHO answered is not enough to decide anything with.
         // A contender for the single-instance lock has a pid and a port from the lock file; what it
@@ -290,7 +296,9 @@ async function route(runner, req, res) {
     }
     if (req.method === "POST" && path === "/coding/start") {
         const b = await readJson(req);
-        return json(res, 200, runner.coding.start(b));
+        const started = runner.coding.start(b);
+        runner.coding.bindInstance(b.sessionId, caller);
+        return json(res, 200, started);
     }
     if (req.method === "POST" && path === "/coding/capture") {
         // `drainUsage` opts this caller in to consuming the session's measured engine spend (#267).
@@ -308,7 +316,8 @@ async function route(runner, req, res) {
         return json(res, 200, runner.coding.end(b.sessionId));
     }
     if (req.method === "GET" && path === "/coding/sessions") {
-        return json(res, 200, { sessions: runner.coding.list() });
+        // Each agent sees its own sessions (#1164); a local caller (the update controller) sees them all.
+        return json(res, 200, { sessions: runner.coding.list().filter((s) => runner.coding.visibleTo(s.sessionId, caller)) });
     }
     // Per-session CPU and memory, for the heartbeat (#924): which agent is loading this machine.
     if (req.method === "GET" && path === "/coding/resources") {
@@ -827,20 +836,6 @@ function authorize(req, config) {
     const headerToken = req.headers["x-pags-runner-token"];
     return auth === `Bearer ${token}` || headerToken === token;
 }
-async function readJson(req) {
-    const chunks = [];
-    for await (const chunk of req)
-        chunks.push(Buffer.from(chunk));
-    const raw = Buffer.concat(chunks).toString("utf-8");
-    if (!raw)
-        return {};
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        throw new RunnerInputError("Request body must be valid JSON");
-    }
-}
 function clampLimit(value, fallback, max) {
     const parsed = Number(value || fallback);
     if (!Number.isFinite(parsed))

package/dist/index.js

@@ -1426,6 +1426,78 @@ function sampleResources(read = os, now = Date.now(), extra = {}) {
   };
 }
 
+// src/commands/runner/route-policy.ts
+var ALWAYS = ["/health", "/capabilities", "/events"];
+var READ_ALWAYS = ["/tasks"];
+var BROWSER = ["/tasks", "/browser/", "/takeover", "/sessions"];
+var BY_RUNTIME = {
+  // The coding engine, the website runtime builder's task, and the engine's own SIGN-IN: the cloud relays the
+  // login page through `/browser/act` + `/browser/handoff` and its card through `/takeover` (coding-sessions-open.ts).
+  coding: ["/coding/", "/tasks", "/browser/act", "/browser/handoff", "/takeover"],
+  browser: BROWSER,
+  local_browser: ["/local-browser/"],
+  local_artifact: ["/local-artifact/"],
+  local_apply: ["/local-apply/", ...BROWSER],
+  local_native: ["/native/"]
+};
+var TERMINAL = ["/tmux/", "/terminal/", "/secure/"];
+var REPO_READS = ["/coding/tree", "/coding/read-file", "/coding/git", "/coding/search", "/coding/git-remote", "/coding/repo-check"];
+var SIGN_IN_TMUX = /* @__PURE__ */ new Set(["/tmux/session", "/tmux/run", "/tmux/send", "/tmux/capture"]);
+var SIGN_IN_SESSION = /^pags-signin-[a-z0-9_-]+$/;
+function hasTerminal(caps) {
+  const tools = caps.tools ?? [];
+  return (caps.surfaces ?? []).includes("tmux") || tools.some((t) => t.startsWith("tmux_") || t.startsWith("terminal_"));
+}
+function allowedPrefixes(caps) {
+  const out = [...ALWAYS];
+  if (!caps) return out;
+  if (caps.runtime && BY_RUNTIME[caps.runtime]) out.push(...BY_RUNTIME[caps.runtime]);
+  const tools = caps.tools ?? [];
+  if (hasTerminal(caps)) out.push(...TERMINAL);
+  if (tools.some((t) => t.startsWith("browser_"))) out.push("/browser/");
+  if (tools.some((t) => t.startsWith("repo_"))) out.push(...REPO_READS);
+  return out;
+}
+function covers(prefix, path) {
+  if (prefix.endsWith("/")) return path.startsWith(prefix);
+  return path === prefix || path.startsWith(`${prefix}/`);
+}
+function routeRefusal(caps, path, method = "POST", body) {
+  const clean4 = path.split("?")[0] ?? path;
+  if (/(^|\/)\.\.(\/|$)/.test(clean4)) return `Refused ${clean4}: a relayed path may not climb out of its route.`;
+  if (allowedPrefixes(caps).some((p) => covers(p, clean4))) return null;
+  if ((method === "GET" || method === "HEAD") && READ_ALWAYS.some((p) => covers(p, clean4))) return null;
+  if (caps?.runtime === "coding" && SIGN_IN_TMUX.has(clean4)) {
+    const session = body?.session;
+    if (typeof session === "string" && SIGN_IN_SESSION.test(session)) return null;
+  }
+  return `Refused ${clean4}: this agent's declared capabilities do not include it, so this machine will not run it for this agent.`;
+}
+var AgentRoutePolicy = class {
+  constructor(fetchInstances) {
+    this.fetchInstances = fetchInstances;
+  }
+  fetchInstances;
+  declared = /* @__PURE__ */ new Map();
+  refreshing = null;
+  learn(instances) {
+    for (const inst of instances ?? []) this.declared.set(inst.id, inst.capabilities ?? null);
+  }
+  refresh() {
+    this.refreshing ??= this.fetchInstances().then((instances) => this.learn(instances)).catch(() => void 0).finally(() => {
+      this.refreshing = null;
+    });
+    return this.refreshing;
+  }
+  refusalFor(id) {
+    return (method, path, body) => {
+      const caps = this.declared.get(id);
+      if (caps === void 0) void this.refresh();
+      return routeRefusal(caps, path, method, body);
+    };
+  }
+};
+
 // src/commands/runner/self-update.ts
 import { spawn as spawn4 } from "child_process";
 var RUNNER_UPDATE_PATH = "/pags/runner/update";
@@ -2803,6 +2875,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
     if (plan.target && !attached.has(plan.target)) forceNext.delete(plan.target);
     return { status: 200, result: { attached: [...attached.keys()], ...plan.target ? { target: plan.target, holding: attached.has(plan.target) } : {} } };
   };
+  const routes = new AgentRoutePolicy(() => requestPags("GET", "/v1/instances/my/instances", { ...opts, pagsToken: pagsToken() }).then((r) => r.instances));
+  await routes.refresh();
   const attach = (id, label = `${id.slice(0, 8)}\u2026`) => {
     if (attached.has(id)) return;
     const mintToken = () => requestPags("POST", `/v1/relay/${apiPathSegment(id)}/token`, { ...opts, pagsToken: pagsToken() }, {}).then((r) => r.token);
@@ -2838,7 +2912,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
         runnerNode,
         // The final automatic-update drain is an admission gate, not merely another poll:
         // command work starts only when the old runner is still permitted to serve it.
-        () => relayMutationAdmission.begin()
+        () => relayMutationAdmission.begin(),
+        routes.refusalFor(id)
       )
     );
     if (label) writeLine(`Attached agent: ${label}`);
@@ -2934,6 +3009,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
         "/v1/instances/my/instances",
         { ...opts, pagsToken: pagsToken() }
       );
+      routes.learn(res.instances);
       const { attach: toAttach, detach: toDetach } = diffMembership(
         attached.keys(),
         res.instances ?? [],
@@ -2983,7 +3059,7 @@ async function readSessionResources(localUrl, runnerToken) {
 }
 var RTT_PROBE_PREFIX = "rtt:";
 var RTT_ECHO_PREFIX = "rtt-echo:";
-function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname5(), beginMutation = () => () => void 0) {
+function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname5(), beginMutation = () => () => void 0, routeRefusal2 = () => null) {
   let backoffMs = 1e3;
   let reconnecting = false;
   let closed = false;
@@ -3051,6 +3127,14 @@ function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, f
         return;
       }
       const method = (cmd.method || "POST").toUpperCase();
+      const refused = routeRefusal2(method, cmd.path, cmd.body);
+      if (refused) {
+        try {
+          ws.send(JSON.stringify({ id: cmd.id, status: 403, result: { error: refused } }));
+        } catch {
+        }
+        return;
+      }
       const releaseMutation = method !== "GET" && method !== "HEAD" ? beginMutation() : null;
       if (method !== "GET" && method !== "HEAD" && !releaseMutation) {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.155",
+  "version": "0.4.157",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",