@proagentstore/cli 0.4.156 → 0.4.157

package/dist/browser-runner/coding/runtime.js

@@ -16,6 +16,13 @@ const MAX_PANE = 64 * 1024;
 export class CodingRuntime {
     reposBaseDir;
     sessions = new Map();
+    /**
+     * Which agent instance each session belongs to (#1164). One `pags up` serves every agent on the
+     * machine, and every relayed request names the instance whose socket it arrived on — so a session
+     * started by one agent must not be driven, read or ended through another's. Bound at `/coding/start`;
+     * a session with no binding (one started before this, or by a local caller) answers to anyone, as before.
+     */
+    owners = new Map();
     /**
      * Coding turns that are running here (#896, #1007).
      *
@@ -363,6 +370,22 @@ export class CodingRuntime {
         this.takeovers.delete(sessionId);
         return { ok: true, usage, acts, authResolved };
     }
+    /** Record the instance a session belongs to — the first one to start it (#1164). */
+    bindInstance(sessionId, instanceId) {
+        if (sessionId && instanceId && !this.owners.has(sessionId))
+            this.owners.set(sessionId, instanceId);
+    }
+    /** Why `instanceId` may not touch this session, or null (#1164). An unbound session, or no caller instance, is not refused. */
+    instanceRefusal(sessionId, instanceId) {
+        const owner = this.owners.get(sessionId);
+        if (!owner || !instanceId || owner === instanceId)
+            return null;
+        return `Coding session ${sessionId} belongs to another agent on this machine; a request from this agent cannot reach it.`;
+    }
+    /** Is this session visible to `instanceId` — its own, unbound, or no caller instance (#1164)? */
+    visibleTo(sessionId, instanceId) {
+        return this.instanceRefusal(sessionId, instanceId) === null;
+    }
     list() {
         return [...this.sessions.entries()].map(([sessionId, s]) => ({
             sessionId,

package/dist/browser-runner/request-instance.js

@@ -0,0 +1,42 @@
+import { RunnerInputError } from "./errors.js";
+/** The relayed instance id header, or undefined. */
+export function instanceOf(req) {
+    const raw = req.headers["x-pags-instance-id"];
+    const id = (Array.isArray(raw) ? raw[0] : raw)?.trim();
+    return id || undefined;
+}
+/** The coding session a `/coding/*` request is about: its body's `sessionId`, or the takeover path's id. */
+export function codingSessionIdOf(path, body) {
+    const m = path.match(/^\/coding\/takeover\/([^/]+)\//);
+    if (m)
+        return decodeURIComponent(m[1]);
+    return typeof body?.sessionId === "string" && body.sessionId ? body.sessionId : null;
+}
+/** Why `caller` may not reach the coding session this request names, or null. */
+export async function codingSessionRefusal(coding, req, path, caller) {
+    if (!path.startsWith("/coding/"))
+        return null;
+    const sessionId = codingSessionIdOf(path, req.method === "POST" ? await readJson(req) : undefined);
+    return sessionId ? coding.instanceRefusal(sessionId, caller) : null;
+}
+/** A body read once and kept, so the session guard and the route handler both see it. */
+const bodies = new WeakMap();
+export async function readJson(req) {
+    if (bodies.has(req))
+        return bodies.get(req);
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(Buffer.from(chunk));
+    const raw = Buffer.concat(chunks).toString("utf-8");
+    let parsed = {};
+    if (raw) {
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new RunnerInputError("Request body must be valid JSON");
+        }
+    }
+    bodies.set(req, parsed);
+    return parsed;
+}

package/dist/browser-runner/server.js

@@ -1,3 +1,4 @@
+import { codingSessionRefusal, instanceOf, readJson } from "./request-instance.js";
 import { createServer, } from "node:http";
 import { URL } from "node:url";
 import { recordRequestFailure } from "./request-failure.js";
@@ -75,6 +76,11 @@ export async function startRunnerServer(config) {
 async function route(runner, req, res) {
     const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
     const path = url.pathname.replace(/\/$/, "") || "/";
+    // The agent this request came from, and whether it may touch the coding session it names (#1164, request-instance.ts).
+    const caller = instanceOf(req);
+    const refused = await codingSessionRefusal(runner.coding, req, path, caller);
+    if (refused)
+        return json(res, 403, { error: refused });
     if ((req.method === "GET" || req.method === "POST") && path === "/health") {
         // #896: a health check that cannot say WHO answered is not enough to decide anything with.
         // A contender for the single-instance lock has a pid and a port from the lock file; what it
@@ -290,7 +296,9 @@ async function route(runner, req, res) {
     }
     if (req.method === "POST" && path === "/coding/start") {
         const b = await readJson(req);
-        return json(res, 200, runner.coding.start(b));
+        const started = runner.coding.start(b);
+        runner.coding.bindInstance(b.sessionId, caller);
+        return json(res, 200, started);
     }
     if (req.method === "POST" && path === "/coding/capture") {
         // `drainUsage` opts this caller in to consuming the session's measured engine spend (#267).
@@ -308,7 +316,8 @@ async function route(runner, req, res) {
         return json(res, 200, runner.coding.end(b.sessionId));
     }
     if (req.method === "GET" && path === "/coding/sessions") {
-        return json(res, 200, { sessions: runner.coding.list() });
+        // Each agent sees its own sessions (#1164); a local caller (the update controller) sees them all.
+        return json(res, 200, { sessions: runner.coding.list().filter((s) => runner.coding.visibleTo(s.sessionId, caller)) });
     }
     // Per-session CPU and memory, for the heartbeat (#924): which agent is loading this machine.
     if (req.method === "GET" && path === "/coding/resources") {
@@ -827,20 +836,6 @@ function authorize(req, config) {
     const headerToken = req.headers["x-pags-runner-token"];
     return auth === `Bearer ${token}` || headerToken === token;
 }
-async function readJson(req) {
-    const chunks = [];
-    for await (const chunk of req)
-        chunks.push(Buffer.from(chunk));
-    const raw = Buffer.concat(chunks).toString("utf-8");
-    if (!raw)
-        return {};
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        throw new RunnerInputError("Request body must be valid JSON");
-    }
-}
 function clampLimit(value, fallback, max) {
     const parsed = Number(value || fallback);
     if (!Number.isFinite(parsed))

package/dist/index.js

@@ -1426,6 +1426,78 @@ function sampleResources(read = os, now = Date.now(), extra = {}) {
   };
 }
 
+// src/commands/runner/route-policy.ts
+var ALWAYS = ["/health", "/capabilities", "/events"];
+var READ_ALWAYS = ["/tasks"];
+var BROWSER = ["/tasks", "/browser/", "/takeover", "/sessions"];
+var BY_RUNTIME = {
+  // The coding engine, the website runtime builder's task, and the engine's own SIGN-IN: the cloud relays the
+  // login page through `/browser/act` + `/browser/handoff` and its card through `/takeover` (coding-sessions-open.ts).
+  coding: ["/coding/", "/tasks", "/browser/act", "/browser/handoff", "/takeover"],
+  browser: BROWSER,
+  local_browser: ["/local-browser/"],
+  local_artifact: ["/local-artifact/"],
+  local_apply: ["/local-apply/", ...BROWSER],
+  local_native: ["/native/"]
+};
+var TERMINAL = ["/tmux/", "/terminal/", "/secure/"];
+var REPO_READS = ["/coding/tree", "/coding/read-file", "/coding/git", "/coding/search", "/coding/git-remote", "/coding/repo-check"];
+var SIGN_IN_TMUX = /* @__PURE__ */ new Set(["/tmux/session", "/tmux/run", "/tmux/send", "/tmux/capture"]);
+var SIGN_IN_SESSION = /^pags-signin-[a-z0-9_-]+$/;
+function hasTerminal(caps) {
+  const tools = caps.tools ?? [];
+  return (caps.surfaces ?? []).includes("tmux") || tools.some((t) => t.startsWith("tmux_") || t.startsWith("terminal_"));
+}
+function allowedPrefixes(caps) {
+  const out = [...ALWAYS];
+  if (!caps) return out;
+  if (caps.runtime && BY_RUNTIME[caps.runtime]) out.push(...BY_RUNTIME[caps.runtime]);
+  const tools = caps.tools ?? [];
+  if (hasTerminal(caps)) out.push(...TERMINAL);
+  if (tools.some((t) => t.startsWith("browser_"))) out.push("/browser/");
+  if (tools.some((t) => t.startsWith("repo_"))) out.push(...REPO_READS);
+  return out;
+}
+function covers(prefix, path) {
+  if (prefix.endsWith("/")) return path.startsWith(prefix);
+  return path === prefix || path.startsWith(`${prefix}/`);
+}
+function routeRefusal(caps, path, method = "POST", body) {
+  const clean4 = path.split("?")[0] ?? path;
+  if (/(^|\/)\.\.(\/|$)/.test(clean4)) return `Refused ${clean4}: a relayed path may not climb out of its route.`;
+  if (allowedPrefixes(caps).some((p) => covers(p, clean4))) return null;
+  if ((method === "GET" || method === "HEAD") && READ_ALWAYS.some((p) => covers(p, clean4))) return null;
+  if (caps?.runtime === "coding" && SIGN_IN_TMUX.has(clean4)) {
+    const session = body?.session;
+    if (typeof session === "string" && SIGN_IN_SESSION.test(session)) return null;
+  }
+  return `Refused ${clean4}: this agent's declared capabilities do not include it, so this machine will not run it for this agent.`;
+}
+var AgentRoutePolicy = class {
+  constructor(fetchInstances) {
+    this.fetchInstances = fetchInstances;
+  }
+  fetchInstances;
+  declared = /* @__PURE__ */ new Map();
+  refreshing = null;
+  learn(instances) {
+    for (const inst of instances ?? []) this.declared.set(inst.id, inst.capabilities ?? null);
+  }
+  refresh() {
+    this.refreshing ??= this.fetchInstances().then((instances) => this.learn(instances)).catch(() => void 0).finally(() => {
+      this.refreshing = null;
+    });
+    return this.refreshing;
+  }
+  refusalFor(id) {
+    return (method, path, body) => {
+      const caps = this.declared.get(id);
+      if (caps === void 0) void this.refresh();
+      return routeRefusal(caps, path, method, body);
+    };
+  }
+};
+
 // src/commands/runner/self-update.ts
 import { spawn as spawn4 } from "child_process";
 var RUNNER_UPDATE_PATH = "/pags/runner/update";
@@ -2803,6 +2875,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
     if (plan.target && !attached.has(plan.target)) forceNext.delete(plan.target);
     return { status: 200, result: { attached: [...attached.keys()], ...plan.target ? { target: plan.target, holding: attached.has(plan.target) } : {} } };
   };
+  const routes = new AgentRoutePolicy(() => requestPags("GET", "/v1/instances/my/instances", { ...opts, pagsToken: pagsToken() }).then((r) => r.instances));
+  await routes.refresh();
   const attach = (id, label = `${id.slice(0, 8)}\u2026`) => {
     if (attached.has(id)) return;
     const mintToken = () => requestPags("POST", `/v1/relay/${apiPathSegment(id)}/token`, { ...opts, pagsToken: pagsToken() }, {}).then((r) => r.token);
@@ -2838,7 +2912,8 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
         runnerNode,
         // The final automatic-update drain is an admission gate, not merely another poll:
         // command work starts only when the old runner is still permitted to serve it.
-        () => relayMutationAdmission.begin()
+        () => relayMutationAdmission.begin(),
+        routes.refusalFor(id)
       )
     );
     if (label) writeLine(`Attached agent: ${label}`);
@@ -2934,6 +3009,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
         "/v1/instances/my/instances",
         { ...opts, pagsToken: pagsToken() }
       );
+      routes.learn(res.instances);
       const { attach: toAttach, detach: toDetach } = diffMembership(
         attached.keys(),
         res.instances ?? [],
@@ -2983,7 +3059,7 @@ async function readSessionResources(localUrl, runnerToken) {
 }
 var RTT_PROBE_PREFIX = "rtt:";
 var RTT_ECHO_PREFIX = "rtt-echo:";
-function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname5(), beginMutation = () => () => void 0) {
+function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname5(), beginMutation = () => () => void 0, routeRefusal2 = () => null) {
   let backoffMs = 1e3;
   let reconnecting = false;
   let closed = false;
@@ -3051,6 +3127,14 @@ function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, f
         return;
       }
       const method = (cmd.method || "POST").toUpperCase();
+      const refused = routeRefusal2(method, cmd.path, cmd.body);
+      if (refused) {
+        try {
+          ws.send(JSON.stringify({ id: cmd.id, status: 403, result: { error: refused } }));
+        } catch {
+        }
+        return;
+      }
       const releaseMutation = method !== "GET" && method !== "HEAD" ? beginMutation() : null;
       if (method !== "GET" && method !== "HEAD" && !releaseMutation) {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.156",
+  "version": "0.4.157",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",