@saadnvd1/agent-os 0.3.499 → 0.3.501

package/lib/chat/worker/protocol.ts

@@ -80,7 +80,14 @@ export type WorkerEvent =
   | Exclude<
       DriverEvent,
       {
-        type: "resume_id" | "usage" | "usage_start" | "suggestion" | "at_rest";
+        type:
+          | "resume_id"
+          | "usage"
+          | "usage_start"
+          | "call_usage"
+          | "rate_limit"
+          | "suggestion"
+          | "at_rest";
       }
     >
   // The agent's guess at the next message, or null once it's stale.

package/lib/connect/cli.ts

@@ -1,36 +1,34 @@
 /**
  * agent-os connect — turn Connect on for this machine.
  *
- *   agent-os connect [--name "Studio Mac"]   enrol: asks for the code from runagentos.com
+ *   agent-os connect [--name "Studio Mac"]   link: asks for the code from runagentos.com
  *     (or AGENTOS_CONNECT_CODE, or piped on stdin; --code works but lands in shell history)
- *   agent-os connect --renew                                  get a fresh certificate
- *   agent-os connect --on | --off                             (also: agent-os disconnect)
+ *   agent-os connect                         already linked: links its tunnel again
+ *   agent-os connect --on | --off            (also: agent-os disconnect)
  *
- * The machine key and the TLS key are made here and never leave this
- * machine. The certificate comes from Let's Encrypt over DNS-01, through
- * the Connect service's broker (which only touches this machine's name).
- * Operators may instead use a zone-scoped token: CONNECT_DNS_TOKEN with
- * AGENTOS_CONNECT_OPERATOR=1.
+ * The machine key is made here and never leaves this machine. The Connect
+ * service makes the machine's Cloudflare tunnel; a running AgentOS fetches
+ * a fresh connector token and runs cloudflared itself.
  */
 
-import fs from "fs";
 import os from "os";
-import path from "path";
 import readline from "readline/promises";
-import { connectDir, setConnectEnabled } from "./config";
-import { certify, enrol, type DnsChallenge } from "./enrol";
-import { cloudflareDns } from "./cloudflare-dns";
 import {
-  brokerDns,
+  connectDir,
+  connectTunnelPort,
+  readConnect,
+  saveConnect,
+  serverPort,
+  setConnectEnabled,
+} from "./config";
+import { enrol } from "./enrol";
+import {
   checkApiUrl,
   DEFAULT_API,
   registerWithCode,
+  requestTunnel,
 } from "./control-api";
 
-const ZONE = "runagentos.com";
-const domain = process.env.CONNECT_MACHINE_DOMAIN || `on.${ZONE}`;
-const relayUrl = process.env.CONNECT_RELAY_URL || `wss://relay.${ZONE}`;
-
 const arg = (flag: string) => {
   const i = process.argv.indexOf(flag);
   return i > -1 ? process.argv[i + 1] : undefined;
@@ -67,65 +65,46 @@ async function main() {
   }
 
   const dir = connectDir();
-  const token = process.env.CONNECT_DNS_TOKEN;
-  const isOperator = process.env.AGENTOS_CONNECT_OPERATOR === "1";
-  const operator = !!token && isOperator;
-  const apiUrl = checkApiUrl(
-    process.env.CONNECT_API_URL || DEFAULT_API,
-    isOperator
-  );
-  if (token && !operator) {
-    // A zone-wide DNS token can rewrite any machine's name. Only the operator's
-    // own machines may use one; everyone else enrols through the Connect service.
-    throw new Error(
-      "CONNECT_DNS_TOKEN needs AGENTOS_CONNECT_OPERATOR=1 (operators only)"
+  const operator = process.env.AGENTOS_CONNECT_OPERATOR === "1";
+  const port = connectTunnelPort(serverPort());
+  if (!port) throw new Error("AGENTOS_CONNECT_PORT isn't a usable port");
+
+  const read = readConnect(dir);
+  let config;
+  if (read.ok) {
+    // Linked already: the signed call keeps its id, name and tunnel.
+    config = read.files.config;
+    checkApiUrl(config.apiUrl, operator);
+    const { hostname } = await requestTunnel(
+      config,
+      read.files.machineKey,
+      port
     );
-  }
-  const enrolled = fs.existsSync(path.join(dir, "connect.json"));
-  const code = enrolled
-    ? undefined
-    : operator
-      ? process.env.AGENTOS_CONNECT_CODE || arg("--code")
-      : await linkCode();
-  if (!enrolled && !code && !operator) {
-    throw new Error(
-      "get a code from runagentos.com (Connect a machine), then run agent-os connect and paste it"
+    config = { ...config, hostname };
+    saveConnect(config, dir);
+  } else {
+    const apiUrl = checkApiUrl(
+      process.env.CONNECT_API_URL || DEFAULT_API,
+      operator
     );
+    const code = await linkCode();
+    if (!code)
+      throw new Error(
+        "get a code from runagentos.com (Connect a machine), then run agent-os connect and paste it"
+      );
+    config = await enrol({
+      dir,
+      register: registerWithCode(
+        apiUrl,
+        code,
+        arg("--name") || os.hostname(),
+        port
+      ),
+    });
   }
-
-  const { config, csr } = await enrol({
-    domain,
-    relayUrl,
-    register: code
-      ? registerWithCode(apiUrl, code, arg("--name") || os.hostname(), domain)
-      : undefined,
-  });
   console.log(`\n  Machine ${config.machineId}`);
   console.log(`  Address  https://${config.hostname}`);
-  console.log(`  Keys     ${dir} (private keys never leave this machine)`);
-
-  if (
-    fs.existsSync(path.join(dir, "tls.crt")) &&
-    !process.argv.includes("--renew")
-  ) {
-    console.log("  Cert     already present (--renew to get a new one)");
-  } else {
-    const dns: DnsChallenge = config.apiUrl
-      ? brokerDns(
-          config,
-          fs.readFileSync(path.join(dir, "machine.key"), "utf8")
-        )
-      : operator
-        ? cloudflareDns(token!, ZONE)
-        : (() => {
-            throw new Error(
-              "no way to prove this name: enrol with a link code"
-            );
-          })();
-    console.log("  Cert     asking Let's Encrypt (DNS-01)...");
-    await certify({ csr, dns });
-    console.log("  Cert     saved");
-  }
+  console.log(`  Keys     ${dir} (the private key never leaves this machine)`);
   console.log(
     "\n  AgentOS picks this up within seconds; the Devices page shows Connect.\n"
   );

package/lib/connect/cloudflared.ts

@@ -0,0 +1,172 @@
+/**
+ * The cloudflared that carries Connect's tunnel: one pinned release,
+ * downloaded into ~/.agent-os/connect/bin and checked against its SHA-256
+ * before it is ever made executable or run. Never one from PATH.
+ */
+
+import crypto from "crypto";
+import { execFile } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+export const CLOUDFLARED_VERSION = "2026.10.0";
+
+export interface Pin {
+  asset: string;
+  /** SHA-256 of the release asset as downloaded. */
+  assetSha256: string;
+  /** SHA-256 of the cloudflared binary (the asset itself unless it's a .tgz). */
+  binarySha256: string;
+}
+
+// From the release's asset digests, checked by downloading each one; the
+// darwin binaries' hashes are of the file inside each .tgz.
+const PINS: Record<string, Pin> = {
+  "darwin-arm64": {
+    asset: "cloudflared-darwin-arm64.tgz",
+    assetSha256:
+      "a2f79ff7b9420aa537d74af239f376da170bbabeb529aec416002adac6a72e70",
+    binarySha256:
+      "72edfd3eea463aef4d5cb89e2e209cecb048cc756c2b01915de2e0ad7cb39830",
+  },
+  "darwin-x64": {
+    asset: "cloudflared-darwin-amd64.tgz",
+    assetSha256:
+      "903845b81828c8cb3c5d13d816a2de71c06a3da5785469df8eb0e1b736d92f9f",
+    binarySha256:
+      "0560c9ab7281ac3f746055323623ed23bc0405b6dab9400474020cba33a978da",
+  },
+  "linux-x64": {
+    asset: "cloudflared-linux-amd64",
+    assetSha256:
+      "d33ff2d14475178d2012c2c56beba87389ac5ded27649519f198a7d3134a99db",
+    binarySha256:
+      "d33ff2d14475178d2012c2c56beba87389ac5ded27649519f198a7d3134a99db",
+  },
+  "linux-arm64": {
+    asset: "cloudflared-linux-arm64",
+    assetSha256:
+      "e6422b9d4f72d3194bc5a38676f13667c06666523217b842a877d72a80b5ac08",
+    binarySha256:
+      "e6422b9d4f72d3194bc5a38676f13667c06666523217b842a877d72a80b5ac08",
+  },
+};
+
+export function pinFor(
+  platform: string = process.platform,
+  arch: string = os.arch()
+): Pin | null {
+  return PINS[`${platform}-${arch}`] ?? null;
+}
+
+const RELEASES = "https://github.com/cloudflare/cloudflared/releases/download";
+// The real assets are ~40 MB; nothing legitimate comes near this.
+const MAX_BYTES = 150 * 1024 * 1024;
+const DOWNLOAD_MS = 5 * 60_000;
+
+const sha256 = (data: Buffer) =>
+  crypto.createHash("sha256").update(data).digest("hex");
+
+// Streamed: the binary is ~40 MB and this runs on every Connect start.
+async function sha256File(file: string): Promise<string | null> {
+  try {
+    const hash = crypto.createHash("sha256");
+    for await (const chunk of fs.createReadStream(file)) hash.update(chunk);
+    return hash.digest("hex");
+  } catch {
+    return null;
+  }
+}
+
+async function download(url: string, fetchImpl: typeof fetch) {
+  // Covers reading the body too, so a stalled download can't hang a start.
+  const res = await fetchImpl(url, {
+    signal: AbortSignal.timeout(DOWNLOAD_MS),
+  });
+  if (!res.ok || !res.body)
+    throw new Error(`downloading cloudflared failed: ${res.status}`);
+  const chunks: Buffer[] = [];
+  let size = 0;
+  const reader = res.body.getReader();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > MAX_BYTES) {
+      await reader.cancel();
+      throw new Error("downloading cloudflared failed: too large");
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks);
+}
+
+const untar = (archive: string, into: string) =>
+  new Promise<void>((resolve, reject) =>
+    execFile(
+      "tar",
+      ["-xzf", archive, "-C", into, "cloudflared"],
+      { timeout: 60_000 },
+      (err) =>
+        err
+          ? reject(new Error("unpacking cloudflared failed"))
+          : resolve(undefined)
+    )
+  );
+
+/**
+ * The path of a verified cloudflared, downloading it first if needed. The
+ * binary on disk is re-hashed every time, so a swapped file is replaced
+ * rather than run.
+ */
+export async function ensureCloudflared(opts: {
+  dir: string;
+  pin?: Pin | null;
+  fetchImpl?: typeof fetch;
+  baseUrl?: string;
+}): Promise<string> {
+  const pin = opts.pin === undefined ? pinFor() : opts.pin;
+  if (!pin)
+    throw new Error(
+      `cloudflared isn't available for ${process.platform}-${os.arch()}`
+    );
+  const binDir = path.join(opts.dir, "bin");
+  const target = path.join(binDir, `cloudflared-${CLOUDFLARED_VERSION}`);
+  if ((await sha256File(target)) === pin.binarySha256) {
+    fs.chmodSync(target, 0o700);
+    return target;
+  }
+  fs.mkdirSync(binDir, { recursive: true, mode: 0o700 });
+  fs.chmodSync(binDir, 0o700);
+  const data = await download(
+    `${opts.baseUrl ?? RELEASES}/${CLOUDFLARED_VERSION}/${pin.asset}`,
+    opts.fetchImpl ?? fetch
+  );
+  if (sha256(data) !== pin.assetSha256)
+    throw new Error("cloudflared download doesn't match its pinned SHA-256");
+
+  const work = fs.mkdtempSync(path.join(binDir, ".download-"));
+  try {
+    let binary = data;
+    if (pin.asset.endsWith(".tgz")) {
+      const archive = path.join(work, "cloudflared.tgz");
+      fs.writeFileSync(archive, data, { mode: 0o600 });
+      await untar(archive, work);
+      binary = fs.readFileSync(path.join(work, "cloudflared"));
+    }
+    if (sha256(binary) !== pin.binarySha256)
+      throw new Error("cloudflared binary doesn't match its pinned SHA-256");
+    // Written owner-only and not executable; made executable only once
+    // it's known to be the pinned binary, then moved into place.
+    const staged = path.join(work, "staged");
+    fs.writeFileSync(staged, binary, { mode: 0o600 });
+    if ((await sha256File(staged)) !== pin.binarySha256)
+      throw new Error("cloudflared binary doesn't match its pinned SHA-256");
+    fs.chmodSync(staged, 0o700);
+    fs.renameSync(staged, target);
+  } finally {
+    fs.rmSync(work, { recursive: true, force: true });
+  }
+  return target;
+}

package/lib/connect/config.ts

@@ -2,9 +2,13 @@
  * Connect's state on this machine, in ~/.agent-os/connect (or
  * AGENTOS_CONNECT_DIR). No connect.json means Connect is off.
  *
- *   connect.json  {machineId, hostname, relayUrl, relayServername?, relayCa?}
- *   machine.key   Ed25519 private key: proves this machine to the relay
- *   tls.key/.crt  the certificate phones see; the key never leaves here
+ *   connect.json  {machineId, hostname, apiUrl, enabled?}
+ *   machine.key   Ed25519 private key: proves this machine to the Connect
+ *                 service, and never leaves here
+ *   bin/          the pinned cloudflared, checked against its SHA-256
+ *
+ * The tunnel's connector token is never written down: it's fetched fresh
+ * each time the tunnel starts.
  */
 
 import fs from "fs";
@@ -13,22 +17,20 @@ import path from "path";
 
 export interface ConnectConfig {
   machineId: string;
+  /** m-<16 hex>.runagentos.com; empty until the service names it. */
   hostname: string;
-  relayUrl: string;
-  /** SNI to present to the relay when relayUrl is an IP (tests). */
-  relayServername?: string;
-  /** PEM of a private CA the relay's certificate chains to (tests). */
-  relayCa?: string;
   /** The Connect service this machine enrolled with (signed API calls). */
-  apiUrl?: string;
+  apiUrl: string;
 }
 
 export interface ConnectFiles {
   config: ConnectConfig;
   machineKey: string;
-  tls: { key: string; cert: string };
 }
 
+/** The only shape of name a machine is reached at. */
+export const MACHINE_HOST = /^m-[0-9a-f]{16}\.runagentos\.com$/;
+
 export const connectDir = () =>
   process.env.AGENTOS_CONNECT_DIR ||
   path.join(os.homedir(), ".agent-os", "connect");
@@ -42,35 +44,41 @@ export function readConnect(dir = connectDir()): ConnectRead {
   const file = (f: string) => path.join(dir, f);
   if (!fs.existsSync(file("connect.json")))
     return { ok: false, reason: "not enrolled" };
-  let config: ConnectConfig & { enabled?: boolean };
+  let raw: Partial<ConnectConfig> & { enabled?: boolean };
   try {
-    config = JSON.parse(fs.readFileSync(file("connect.json"), "utf8"));
+    raw = JSON.parse(fs.readFileSync(file("connect.json"), "utf8")) ?? {};
   } catch {
     return { ok: false, reason: `${file("connect.json")} is not valid JSON` };
   }
-  if (!config.machineId || !config.hostname || !config.relayUrl) {
+  if (typeof raw.machineId !== "string" || !raw.machineId) {
     return {
       ok: false,
-      reason: `${file("connect.json")} is missing machineId, hostname or relayUrl`,
+      reason: `${file("connect.json")} is missing machineId`,
     };
   }
-  for (const f of ["machine.key", "tls.key", "tls.crt"]) {
-    if (!fs.existsSync(file(f)))
-      return {
-        ok: false,
-        reason: `${file(f)} is missing (run agent-os connect)`,
-      };
+  if (typeof raw.apiUrl !== "string" || !raw.apiUrl) {
+    return {
+      ok: false,
+      reason: `${file("connect.json")} has no Connect service (run agent-os connect with a link code)`,
+    };
   }
+  if (!fs.existsSync(file("machine.key")))
+    return {
+      ok: false,
+      reason: `${file("machine.key")} is missing (run agent-os connect)`,
+    };
+  // A name from before the tunnel (or anything else) is dropped: the next
+  // start asks the service again.
+  const hostname =
+    typeof raw.hostname === "string" && MACHINE_HOST.test(raw.hostname)
+      ? raw.hostname
+      : "";
   return {
     ok: true,
-    enabled: config.enabled !== false,
+    enabled: raw.enabled !== false,
     files: {
-      config,
+      config: { machineId: raw.machineId, hostname, apiUrl: raw.apiUrl },
       machineKey: fs.readFileSync(file("machine.key"), "utf8"),
-      tls: {
-        key: fs.readFileSync(file("tls.key"), "utf8"),
-        cert: fs.readFileSync(file("tls.crt"), "utf8"),
-      },
     },
   };
 }
@@ -80,6 +88,23 @@ export function loadConnect(dir = connectDir()): ConnectFiles | null {
   return r.ok && r.enabled ? r.files : null;
 }
 
+/** Writes connect.json owner-only, keeping `enabled` as it was. */
+export function saveConnect(config: ConnectConfig, dir = connectDir()) {
+  const p = path.join(dir, "connect.json");
+  let enabled: boolean | undefined;
+  try {
+    enabled = JSON.parse(fs.readFileSync(p, "utf8"))?.enabled;
+  } catch {}
+  const next = {
+    machineId: config.machineId,
+    hostname: config.hostname,
+    apiUrl: config.apiUrl,
+    ...(enabled === false && { enabled }),
+  };
+  fs.writeFileSync(p, JSON.stringify(next, null, 2), { mode: 0o600 });
+  fs.chmodSync(p, 0o600);
+}
+
 /** Turns Connect on or off without touching the keys. */
 export function setConnectEnabled(
   enabled: boolean,
@@ -93,3 +118,27 @@ export function setConnectEnabled(
   });
   return true;
 }
+
+/** AgentOS's own port, read the way server.ts reads it: `-p <port>`, then PORT. */
+export function serverPort(
+  argv: string[] = process.argv,
+  env: Partial<NodeJS.ProcessEnv> = process.env
+): number {
+  const i = argv.indexOf("-p");
+  return parseInt(
+    (i !== -1 ? argv[i + 1] : undefined) || env.PORT || "3011",
+    10
+  );
+}
+
+/**
+ * The loopback port cloudflared delivers tunnel traffic to: AgentOS's port
+ * + 433 (3444), or AGENTOS_CONNECT_PORT. Null when it isn't usable.
+ */
+export function connectTunnelPort(
+  port: number,
+  env: Record<string, string | undefined> = process.env
+): number | null {
+  const p = Number(env.AGENTOS_CONNECT_PORT || port + 433);
+  return Number.isInteger(p) && p > 0 && p < 65536 && p !== port ? p : null;
+}