@saadnvd1/agent-os 0.3.499 → 0.3.501

package/lib/connect/control-api.ts

@@ -5,8 +5,8 @@
  */
 
 import crypto from "crypto";
-import type { ConnectConfig } from "./config";
-import type { DnsChallenge, Register } from "./enrol";
+import { MACHINE_HOST, type ConnectConfig } from "./config";
+import type { Register } from "./enrol";
 
 export const DEFAULT_API = "https://runagentos.com";
 export const MACHINE_ID = /^[a-z0-9]{8}$/;
@@ -68,51 +68,107 @@ export function signedHeaders(opts: {
   };
 }
 
+/** A refusal from the Connect service, with its status and answer. */
+export class ApiError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+    readonly body: Record<string, unknown>
+  ) {
+    super(message);
+  }
+}
+
 async function call(url: string, init: RequestInit): Promise<Response> {
   // Never follow a redirect: it would replay the link code or the signed
   // headers to whatever host the response names.
-  const res = await fetch(url, { ...init, redirect: "error" });
+  const res = await fetch(url, {
+    ...init,
+    redirect: "error",
+    signal: AbortSignal.timeout(30_000),
+  });
   if (res.ok) return res;
-  const body = (await res.json().catch(() => ({}))) as { error?: unknown };
-  throw new Error(
-    typeof body.error === "string"
+  const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+  throw new ApiError(
+    typeof body?.error === "string"
       ? clean(body.error)
-      : `${init.method} ${new URL(url).pathname}: ${res.status}`
+      : `${init.method} ${new URL(url).pathname}: ${res.status}`,
+    res.status,
+    body && typeof body === "object" ? body : {}
   );
 }
 
-/** Enrolment with a link code from "Connect a machine" in the web app. */
-export function registerWithCode(
-  apiUrl: string,
-  linkCode: string,
-  name: string,
-  domain: string
-): Register {
-  return async (publicKey) => {
-    const res = await call(`${apiUrl}/api/v1/machines/enrol`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        link_code: linkCode,
-        name,
-        public_key: publicKey,
-      }),
-    });
-    return { ...enrolled(await res.json(), domain), apiUrl };
-  };
+export interface Tunnel {
+  hostname: string;
+  /** The connector token: handed to cloudflared, never stored or logged. */
+  token: string;
 }
 
-/** What the service answered, refused unless it names exactly <id>.<domain>. */
-export function enrolled(m: unknown, domain: string): ConnectConfig {
+// Base64 of a small JSON object; anything else isn't a connector token.
+const TOKEN = /^[A-Za-z0-9+/=_-]{32,4096}$/;
+
+/** The service's answer, refused unless the name is exactly m-<16 hex>.runagentos.com. */
+export function hostnameFrom(r: Record<string, unknown>): string {
+  if (typeof r.hostname !== "string" || !MACHINE_HOST.test(r.hostname))
+    throw new Error(
+      "the Connect service sent a hostname that isn't m-<16 hex>.runagentos.com"
+    );
+  return r.hostname;
+}
+
+function tokenFrom(r: Record<string, unknown>): string {
+  if (typeof r.tunnel_token !== "string" || !TOKEN.test(r.tunnel_token))
+    throw new Error("the Connect service sent no usable tunnel token");
+  return r.tunnel_token;
+}
+
+/** What enrolment answered: the machine's id and name (its token is unused). */
+export function enrolled(m: unknown, apiUrl: string): ConnectConfig {
   const r = (m ?? {}) as Record<string, unknown>;
   const id = typeof r.machine_id === "string" ? r.machine_id : "";
   if (!MACHINE_ID.test(id))
     throw new Error("the Connect service sent an invalid machine id");
-  if (r.hostname !== `${id}.${domain}`)
-    throw new Error(`the Connect service sent a hostname outside ${domain}`);
-  if (typeof r.relay_url !== "string" || !r.relay_url.startsWith("wss://"))
-    throw new Error("the Connect service sent a relay URL that isn't wss://");
-  return { machineId: id, hostname: r.hostname, relayUrl: r.relay_url };
+  return { machineId: id, hostname: hostnameFrom(r), apiUrl };
+}
+
+/**
+ * Enrolment with a link code from "Connect a machine" in the web app. A key
+ * the account already has is refused (409, naming its machine): this
+ * machine then links again by signing for that id, keeping its name.
+ */
+export function registerWithCode(
+  apiUrl: string,
+  linkCode: string,
+  name: string,
+  port: number
+): Register {
+  return async ({ publicKey, privateKey }) => {
+    try {
+      const res = await call(`${apiUrl}/api/v1/machines/enrol`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          link_code: linkCode,
+          name,
+          public_key: publicKey,
+          port,
+        }),
+      });
+      return enrolled(await res.json(), apiUrl);
+    } catch (err) {
+      const id = err instanceof ApiError ? err.body.machine_id : undefined;
+      if (
+        !(err instanceof ApiError) ||
+        err.status !== 409 ||
+        typeof id !== "string" ||
+        !MACHINE_ID.test(id)
+      )
+        throw err;
+      const config = { machineId: id, hostname: "", apiUrl };
+      const { hostname } = await requestTunnel(config, privateKey, port);
+      return { ...config, hostname };
+    }
+  };
 }
 
 function signed(config: ConnectConfig, privateKey: string) {
@@ -137,22 +193,25 @@ function signed(config: ConnectConfig, privateKey: string) {
   };
 }
 
-/** The Connect service's DNS broker: it writes only this machine's challenge. */
-export function brokerDns(
+/**
+ * Links (or relinks) this machine's tunnel to `port` and gets a fresh
+ * connector token. Signed, so only the holder of machine.key can ask.
+ */
+export async function requestTunnel(
   config: ConnectConfig,
-  privateKey: string
-): DnsChallenge {
-  const send = signed(config, privateKey);
-  const path = `/api/v1/machines/${config.machineId}/acme-challenge`;
-  return {
-    async set(name, value) {
-      await send("POST", path, { name, value });
-      await new Promise((r) => setTimeout(r, 15_000)); // let DNS catch up
-    },
-    async clear(name, value) {
-      await send("DELETE", path, { name, value });
-    },
-  };
+  privateKey: string,
+  port: number
+): Promise<Tunnel> {
+  const res = await signed(config, privateKey)(
+    "POST",
+    `/api/v1/machines/${config.machineId}/tunnel`,
+    { port }
+  );
+  const r = ((await res.json().catch(() => null)) ?? {}) as Record<
+    string,
+    unknown
+  >;
+  return { hostname: hostnameFrom(r), token: tokenFrom(r) };
 }
 
 export async function heartbeat(

package/lib/connect/enrol.ts

@@ -1,25 +1,13 @@
 /**
- * Turning Connect on for this machine. Everything secret is generated here
- * and written only to the Connect folder (owner-only): the Ed25519 key that
- * proves the machine to the relay, and the TLS key for <id>.<domain> that
- * phones complete TLS with. Neither is ever sent anywhere; the certificate
- * authority only sees a signing request.
+ * Turning Connect on for this machine. The Ed25519 key that proves the
+ * machine to the Connect service is generated here and written only to the
+ * Connect folder (owner-only); only its public half is ever sent.
  */
 
 import crypto from "crypto";
 import fs from "fs";
 import path from "path";
-import acme from "acme-client";
-import { connectDir, type ConnectConfig } from "./config";
-import { generateMachineKey } from "./identity";
-
-const ID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
-
-export function newMachineId(): string {
-  return Array.from(crypto.randomBytes(8), (b) => ID_ALPHABET[b % 36]).join("");
-}
-
-const SECRETS = ["machine.key", "tls.key", "acme-account.key"];
+import { connectDir, saveConnect, type ConnectConfig } from "./config";
 
 const write = (dir: string, file: string, data: string) => {
   fs.writeFileSync(path.join(dir, file), data, { mode: 0o600 });
@@ -30,110 +18,48 @@ const write = (dir: string, file: string, data: string) => {
 function lockDown(dir: string) {
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   fs.chmodSync(dir, 0o700);
-  for (const f of SECRETS) {
-    if (fs.existsSync(path.join(dir, f)))
-      fs.chmodSync(path.join(dir, f), 0o600);
-  }
+  if (fs.existsSync(path.join(dir, "machine.key")))
+    fs.chmodSync(path.join(dir, "machine.key"), 0o600);
 }
 
-export interface Enrolment {
-  config: ConnectConfig;
-  machinePublicKey: string;
-  csr: Buffer;
+export interface MachineKeys {
+  publicKey: string;
+  privateKey: string;
 }
 
-/** Who names this machine: the Connect service (from a link code), or local (operators). */
-export type Register = (publicKey: string) => Promise<ConnectConfig>;
+/** Registers the public key with the Connect service; answers id and name. */
+export type Register = (keys: MachineKeys) => Promise<ConnectConfig>;
 
-/**
- * Creates the machine's identity and TLS key, or reuses them if present.
- * The machine key comes first: the Connect service registers its public
- * half and answers with the machine's id and address.
- */
-export async function enrol(opts: {
-  domain: string;
-  relayUrl: string;
-  dir?: string;
-  register?: Register;
-}): Promise<Enrolment> {
-  const dir = opts.dir ?? connectDir();
+/** The machine key, made on first use and reused after. */
+export function machineKeys(dir = connectDir()): MachineKeys {
   lockDown(dir);
   if (!fs.existsSync(path.join(dir, "machine.key"))) {
-    write(dir, "machine.key", generateMachineKey().privateKey);
-  }
-  const publicKey = crypto
-    .createPublicKey(fs.readFileSync(path.join(dir, "machine.key"), "utf8"))
-    .export({ type: "spki", format: "pem" })
-    .toString();
-  const configPath = path.join(dir, "connect.json");
-  let config: ConnectConfig;
-  if (fs.existsSync(configPath)) {
-    config = JSON.parse(fs.readFileSync(configPath, "utf8")) as ConnectConfig;
-  } else {
-    if (opts.register) {
-      config = await opts.register(publicKey);
-    } else {
-      const machineId = newMachineId();
-      config = {
-        machineId,
-        hostname: `${machineId}.${opts.domain}`,
-        relayUrl: opts.relayUrl,
-      };
-    }
-    // Saved before anything else can fail: the link code is single-use, so
-    // a rerun must resume with this id rather than ask for a new code.
-    write(dir, "connect.json", JSON.stringify(config, null, 2));
-  }
-  if (!fs.existsSync(path.join(dir, "tls.key"))) {
+    const { privateKey } = crypto.generateKeyPairSync("ed25519");
     write(
       dir,
-      "tls.key",
-      (await acme.crypto.createPrivateEcdsaKey()).toString()
+      "machine.key",
+      privateKey.export({ type: "pkcs8", format: "pem" }).toString()
     );
   }
-  const machinePublicKey = publicKey;
-  const [, csr] = await acme.crypto.createCsr(
-    { commonName: config.hostname, altNames: [config.hostname] },
-    fs.readFileSync(path.join(dir, "tls.key"))
-  );
-  return { config, machinePublicKey, csr };
-}
-
-/** Where DNS-01 TXT records get written: the control plane's broker, or (dev) a DNS API. */
-export interface DnsChallenge {
-  set(name: string, value: string): Promise<void>;
-  clear(name: string, value: string): Promise<void>;
+  const privateKey = fs.readFileSync(path.join(dir, "machine.key"), "utf8");
+  const publicKey = crypto
+    .createPublicKey(privateKey)
+    .export({ type: "spki", format: "pem" })
+    .toString();
+  return { publicKey, privateKey };
 }
 
-/** Gets a certificate for the CSR over ACME DNS-01 and stores it as tls.crt. */
-export async function certify(opts: {
-  csr: Buffer;
-  dns: DnsChallenge;
+/**
+ * Creates the machine's identity (or reuses it) and registers it. The
+ * service's answer is saved before anything else can fail: the link code
+ * is single-use, so a rerun must resume with this id.
+ */
+export async function enrol(opts: {
+  register: Register;
   dir?: string;
-  directoryUrl?: string;
-}): Promise<void> {
+}): Promise<ConnectConfig> {
   const dir = opts.dir ?? connectDir();
-  lockDown(dir);
-  const accountKeyPath = path.join(dir, "acme-account.key");
-  if (!fs.existsSync(accountKeyPath)) {
-    write(
-      dir,
-      "acme-account.key",
-      (await acme.crypto.createPrivateKey()).toString()
-    );
-  }
-  const client = new acme.Client({
-    directoryUrl: opts.directoryUrl ?? acme.directory.letsencrypt.production,
-    accountKey: fs.readFileSync(accountKeyPath),
-  });
-  const cert = await client.auto({
-    csr: opts.csr,
-    termsOfServiceAgreed: true,
-    challengePriority: ["dns-01"],
-    challengeCreateFn: async (authz, _c, keyAuth) =>
-      opts.dns.set(`_acme-challenge.${authz.identifier.value}`, keyAuth),
-    challengeRemoveFn: async (authz, _c, keyAuth) =>
-      opts.dns.clear(`_acme-challenge.${authz.identifier.value}`, keyAuth),
-  });
-  write(dir, "tls.crt", cert);
+  const config = await opts.register(machineKeys(dir));
+  saveConnect(config, dir);
+  return config;
 }