@proagentstore/cli 0.4.31 → 0.4.32

package/dist/browser-runner/index.js

@@ -2,6 +2,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { startRunnerServer } from "./server.js";
+import { randomUUID } from "node:crypto";
 // Resilience: a stray error in any runtime must NOT take the whole runner down —
 // that drops the tunnel and forces the user to restart `pags up` (and lose their
 // session). Log it and keep serving. Per-component handlers catch most things;
@@ -29,7 +30,11 @@ function configFromArgs() {
         host: arg("--host", process.env.PAGS_RUNNER_HOST || "127.0.0.1") || "127.0.0.1",
         port: Number(arg("--port", process.env.PAGS_RUNNER_PORT || "49171")),
         dataDir,
-        token: arg("--token", process.env.PAGS_RUNNER_TOKEN),
+        // Never start unauthenticated (#245). This surface drives a coding CLI with permissions
+        // skipped, and `authorize` now fails closed — so a missing token would make the runner
+        // answer nothing rather than answer everyone. Generate one and print it, mirroring what
+        // `pags runner connect` has always done.
+        token: arg("--token", process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID()}`,
         instanceId: arg("--instance-id", process.env.PAGS_INSTANCE_ID),
         headless: flag("--headless") || process.env.PAGS_RUNNER_HEADLESS === "1",
     };

package/dist/browser-runner/server.js

@@ -391,13 +391,35 @@ async function route(runner, req, res) {
     }
     return json(res, 404, { error: "Not found" });
 }
+/**
+ * Authorize a request to the local runner (#245).
+ *
+ * This surface drives a coding CLI that `pags up` launches with
+ * `--dangerously-skip-permissions` / `--sandbox danger-full-access`, so "who may POST here" is
+ * the whole security boundary. Two things were the wrong way round:
+ *
+ * 1. **No token used to mean ALLOW.** `pags up` always generates one, so that path was safe —
+ *    but `pags-browser-runner` run directly (its own --help documents this) passes
+ *    `token: undefined`, and served the entire surface unauthenticated. Now it fails CLOSED;
+ *    the standalone entrypoint generates a token instead of starting open.
+ *
+ * 2. **A browser could reach it.** Binding to loopback is not isolation: a page the user is
+ *    visiting cannot READ a cross-origin response, but it can still SEND the POST, and the
+ *    server sets no CORS headers and did no Origin check. The token already made that
+ *    unguessable — but nothing legitimate that calls this runner is a browser (the cloud
+ *    dispatches over the relay; the CLI calls it directly), and neither sends `Origin`. So the
+ *    presence of that header is by itself proof the caller is a web page, and is refused before
+ *    the token is even considered. Also closes DNS-rebinding, which loopback does not.
+ */
 function authorize(req, config) {
+    if (req.headers.origin)
+        return false;
     const token = config.token;
     if (config.instanceId && req.headers["x-pags-instance-id"] !== config.instanceId) {
         return false;
     }
     if (!token)
-        return true;
+        return false;
     const auth = req.headers.authorization || "";
     const headerToken = req.headers["x-pags-runner-token"];
     return auth === `Bearer ${token}` || headerToken === token;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.31",
+  "version": "0.4.32",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",