@saadnvd1/agent-os 0.3.514 → 0.3.516

package/README.md

@@ -1585,7 +1585,13 @@ device can use AgentOS but can't add devices or change access; only this
 machine and the tailnet can.
 
 AgentOS also refuses requests addressed to any other host name (DNS rebinding),
-and API calls or terminal connections made by another website's page.
+and API calls or terminal connections made by another website's page. That
+Origin check holds whatever `AGENTOS_BIND` says: a page may write to the API
+or open a terminal, chat or status socket only from this machine's own
+addresses (loopback, the addresses it listens on, its tailnet name, its own
+Connect address and `AGENTOS_ALLOWED_HOSTS`). Another Connect machine's page
+is always refused. With `AGENTOS_BIND=0.0.0.0`, reaching it by a DNS name
+other than these needs that name in `AGENTOS_ALLOWED_HOSTS`.
 
 | Variable                               | Effect                                                                                                 |
 | -------------------------------------- | ------------------------------------------------------------------------------------------------------ |
@@ -1613,6 +1619,12 @@ While Connect is on, the production server:
 - asks the Connect service for a fresh connector token on every start and hands
   it to `cloudflared tunnel run` in `TUNNEL_TOKEN` only, never in argv, a file
   or a log;
+- starts cloudflared only once AgentOS holds the tunnel port and has seen a
+  connection to it arrive on its own listener, and stops it if the listener
+  goes, so it never publishes something else on that port;
+- runs cloudflared in a process group of its own under a small watchdog that
+  kills it the moment AgentOS exits, however it exits, and kills one a crash
+  left behind (from `cloudflared.pid`) before starting another;
 - restarts cloudflared with backoff if it exits, and stops it when Connect is
   turned off. Devices shows its state.
 

package/app/api/devices/me/push/route.test.ts

@@ -0,0 +1,209 @@
+import { NextRequest } from "next/server";
+import { describe, expect, it } from "vitest";
+import { DELETE, PATCH, PUT } from "./route";
+import { DELETE as SELF_DELETE } from "../route";
+import {
+  deviceForToken,
+  getDevicePush,
+  mintDevice,
+  revokeDevice,
+} from "@/lib/security/devices";
+import { DEVICE_HEADER } from "@/lib/security/auth";
+import { getDb } from "@/lib/db";
+import { defaultCategories } from "@/lib/notify/copy";
+
+const call = (
+  fn: (r: NextRequest) => Promise<Response>,
+  method: string,
+  device: string | null,
+  body?: unknown
+) =>
+  fn(
+    new NextRequest("http://x/api/devices/me/push", {
+      method,
+      headers: device ? { [DEVICE_HEADER]: device } : {},
+      body: body === undefined ? undefined : JSON.stringify(body),
+    })
+  );
+
+const tok = (n: number) => "apns" + String(n).padStart(8, "0") + "ab".repeat(8);
+
+describe("/api/devices/me/push", () => {
+  it("refuses a request that isn't from a paired device", async () => {
+    for (const [fn, m] of [
+      [PUT, "PUT"],
+      [PATCH, "PATCH"],
+      [DELETE, "DELETE"],
+    ] as const)
+      expect((await call(fn, m, null, { token: tok(1) })).status).toBe(403);
+    expect(
+      (
+        await SELF_DELETE(
+          new NextRequest("http://x/api/devices/me", { method: "DELETE" })
+        )
+      ).status
+    ).toBe(403);
+  });
+
+  it("registers, defaults the categories, and is idempotent", async () => {
+    const { device } = mintDevice("phone");
+    const res = await call(PUT, "PUT", device.id, {
+      token: tok(2),
+      environment: "sandbox",
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toMatchObject({
+      deviceId: device.id,
+      enabled: true,
+      platform: "ios",
+      environment: "sandbox",
+      categories: defaultCategories(),
+    });
+    const again = await call(PUT, "PUT", device.id, {
+      token: tok(2),
+      environment: "sandbox",
+    });
+    expect(again.status).toBe(200);
+    expect(getDevicePush(device.id)?.token).toBe(tok(2));
+  });
+
+  it("a new token replaces the old and keeps saved categories", async () => {
+    const { device } = mintDevice("phone");
+    await call(PUT, "PUT", device.id, { token: tok(3) });
+    await call(PATCH, "PATCH", device.id, { categories: ["asks", "merged"] });
+    await call(PUT, "PUT", device.id, { token: tok(4) });
+    expect(getDevicePush(device.id)).toMatchObject({
+      token: tok(4),
+      categories: ["asks", "merged"],
+    });
+  });
+
+  it("moves a token from the device that held it", async () => {
+    const a = mintDevice("old pairing").device;
+    const b = mintDevice("new pairing").device;
+    await call(PUT, "PUT", a.id, { token: tok(5) });
+    await call(PUT, "PUT", b.id, { token: tok(5) });
+    expect(getDevicePush(a.id)).toBeNull();
+    expect(getDevicePush(b.id)?.token).toBe(tok(5));
+  });
+
+  it("rejects bad input", async () => {
+    const { device } = mintDevice("phone");
+    for (const b of [
+      {},
+      { token: "short" },
+      { token: "bad token with spaces!!" },
+      { token: tok(6), platform: "palm" },
+      { token: tok(6), environment: "staging" },
+      { token: tok(6), categories: ["asks", "nope"] },
+      { token: tok(6), categories: "asks" },
+    ])
+      expect((await call(PUT, "PUT", device.id, b)).status).toBe(400);
+    expect(getDevicePush(device.id)).toBeNull();
+  });
+
+  it("PATCH sets categories, needs a registration, and validates", async () => {
+    const { device } = mintDevice("phone");
+    expect(
+      (await call(PATCH, "PATCH", device.id, { categories: ["asks"] })).status
+    ).toBe(404);
+    await call(PUT, "PUT", device.id, { token: tok(7) });
+    expect(
+      (await call(PATCH, "PATCH", device.id, { categories: ["x"] })).status
+    ).toBe(400);
+    expect((await call(PATCH, "PATCH", device.id, {})).status).toBe(400);
+    const res = await call(PATCH, "PATCH", device.id, {
+      categories: ["ci", "ci"],
+    });
+    expect((await res.json()).categories).toEqual(["ci"]);
+    await call(PATCH, "PATCH", device.id, { categories: [] });
+    expect(getDevicePush(device.id)?.categories).toEqual([]);
+  });
+
+  it("DELETE clears push for this device only", async () => {
+    const a = mintDevice("a").device;
+    const b = mintDevice("b").device;
+    await call(PUT, "PUT", a.id, { token: tok(8) });
+    await call(PUT, "PUT", b.id, { token: tok(9) });
+    const res = await call(DELETE, "DELETE", a.id);
+    expect(await res.json()).toMatchObject({ enabled: false });
+    expect(getDevicePush(a.id)).toBeNull();
+    expect(getDevicePush(b.id)).not.toBeNull();
+  });
+
+  it("refuses an oversized body", async () => {
+    const { device } = mintDevice("phone");
+    const res = await call(PUT, "PUT", device.id, {
+      token: tok(14),
+      pad: "x".repeat(5000),
+    });
+    expect(res.status).toBe(413);
+    expect(getDevicePush(device.id)).toBeNull();
+  });
+
+  it("reads a corrupt saved category list as the defaults", async () => {
+    const { device } = mintDevice("phone");
+    await call(PUT, "PUT", device.id, { token: tok(15) });
+    for (const junk of ["{not json", '"asks"', "7"]) {
+      getDb()
+        .prepare(`UPDATE devices SET push_categories = ? WHERE id = ?`)
+        .run(junk, device.id);
+      expect(getDevicePush(device.id)?.categories).toEqual(defaultCategories());
+    }
+  });
+
+  it("never returns the token", async () => {
+    const { device } = mintDevice("phone");
+    const res = await call(PUT, "PUT", device.id, { token: tok(10) });
+    expect(JSON.stringify(await res.json())).not.toContain(tok(10));
+  });
+});
+
+describe("device revocation and push", () => {
+  it("revoking clears every push column", async () => {
+    const { device } = mintDevice("phone");
+    await call(PUT, "PUT", device.id, { token: tok(11), categories: ["asks"] });
+    expect(revokeDevice(device.id)).toBe(true);
+    const row = getDb()
+      .prepare(
+        `SELECT push_token, push_platform, push_environment, push_categories,
+                push_updated_at, push_last_error FROM devices WHERE id = ?`
+      )
+      .get(device.id);
+    expect(Object.values(row as object).every((v) => v === null)).toBe(true);
+    expect(getDevicePush(device.id)).toBeNull();
+  });
+
+  it("DELETE /api/devices/me revokes the caller and its push", async () => {
+    const { device, token } = mintDevice("phone");
+    await call(PUT, "PUT", device.id, { token: tok(12) });
+    const res = await SELF_DELETE(
+      new NextRequest("http://x/api/devices/me", {
+        method: "DELETE",
+        headers: { [DEVICE_HEADER]: device.id },
+      })
+    );
+    expect(res.status).toBe(200);
+    expect(deviceForToken(token)).toBeNull();
+    expect(getDevicePush(device.id)).toBeNull();
+    // A second sign-out finds nothing.
+    expect(
+      (
+        await SELF_DELETE(
+          new NextRequest("http://x/api/devices/me", {
+            method: "DELETE",
+            headers: { [DEVICE_HEADER]: device.id },
+          })
+        )
+      ).status
+    ).toBe(404);
+  });
+
+  it("a revoked device can't register push", async () => {
+    const { device } = mintDevice("phone");
+    revokeDevice(device.id);
+    expect((await call(PUT, "PUT", device.id, { token: tok(13) })).status).toBe(
+      404
+    );
+  });
+});

package/app/api/devices/me/push/route.ts

@@ -0,0 +1,115 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  clearDevicePush,
+  getDevicePush,
+  setDevicePush,
+  setDevicePushCategories,
+} from "@/lib/security/devices";
+import { callingDevice, needsDevice } from "@/lib/security/device-me";
+import { readCapped } from "@/lib/security/read-capped";
+import { isPushCategory } from "@/lib/notify/copy";
+import {
+  PUSH_ENVIRONMENTS,
+  PUSH_PLATFORMS,
+  type PushCategory,
+  type PushEnvironment,
+  type PushPlatform,
+} from "@/lib/notify/push-types";
+
+const bad = (error: string) => NextResponse.json({ error }, { status: 400 });
+
+const MAX_BODY_BYTES = 4096;
+
+/** The JSON body, or null when it's over the cap. Bad JSON reads as empty. */
+async function body(request: NextRequest) {
+  const text = await readCapped(request, MAX_BODY_BYTES);
+  if (text === null) return null;
+  try {
+    const v = JSON.parse(text || "{}");
+    return (v && typeof v === "object" ? v : {}) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+const tooBig = () => NextResponse.json({ error: "Too large" }, { status: 413 });
+
+/** Undefined if absent, null if present but invalid. */
+function categoriesOf(v: unknown): PushCategory[] | undefined | null {
+  if (v === undefined) return undefined;
+  if (!Array.isArray(v) || !v.every(isPushCategory)) return null;
+  return [...new Set(v)];
+}
+
+const view = (id: string) => {
+  const p = getDevicePush(id);
+  return {
+    deviceId: id,
+    enabled: !!p,
+    categories: p?.categories ?? [],
+    environment: p?.environment ?? null,
+    platform: p?.platform ?? null,
+    lastError: p?.lastError ?? null,
+  };
+};
+
+// PUT /api/devices/me/push - register or refresh this device's push token
+export async function PUT(request: NextRequest) {
+  const id = callingDevice(request);
+  if (!id) return needsDevice();
+  const b = await body(request);
+  if (!b) return tooBig();
+  const token = b.token;
+  if (
+    typeof token !== "string" ||
+    token.length < 8 ||
+    token.length > 512 ||
+    !/^[A-Za-z0-9:_.\-]+$/.test(token)
+  )
+    return bad("token must be a device push token");
+  const platform = b.platform ?? "ios";
+  const environment = b.environment ?? "production";
+  if (!PUSH_PLATFORMS.includes(platform as PushPlatform))
+    return bad("platform must be ios or android");
+  if (!PUSH_ENVIRONMENTS.includes(environment as PushEnvironment))
+    return bad("environment must be production or sandbox");
+  const categories = categoriesOf(b.categories);
+  if (categories === null) return bad("categories must be known names");
+  // Intended: a phone re-paired to this machine gets a new device row and the
+  // same APNs token, which must move to it so the old row stops getting sends.
+  // Only a holder of a valid device token can register one.
+  if (
+    !setDevicePush(id, {
+      token,
+      platform: platform as PushPlatform,
+      environment: environment as PushEnvironment,
+      categories,
+    })
+  )
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json(view(id));
+}
+
+// PATCH /api/devices/me/push - choose which categories to receive
+export async function PATCH(request: NextRequest) {
+  const id = callingDevice(request);
+  if (!id) return needsDevice();
+  const b = await body(request);
+  if (!b) return tooBig();
+  const categories = categoriesOf(b.categories);
+  if (!categories) return bad("categories must be a list of known names");
+  if (!setDevicePushCategories(id, categories))
+    return NextResponse.json(
+      { error: "Push isn't registered" },
+      { status: 404 }
+    );
+  return NextResponse.json(view(id));
+}
+
+// DELETE /api/devices/me/push - stop pushing to this device
+export async function DELETE(request: NextRequest) {
+  const id = callingDevice(request);
+  if (!id) return needsDevice();
+  clearDevicePush(id);
+  return NextResponse.json(view(id));
+}

package/app/api/devices/me/route.ts

@@ -0,0 +1,12 @@
+import { NextRequest, NextResponse } from "next/server";
+import { revokeDevice } from "@/lib/security/devices";
+import { callingDevice, needsDevice } from "@/lib/security/device-me";
+
+// DELETE /api/devices/me - the device signs itself out ("Forget machine")
+export async function DELETE(request: NextRequest) {
+  const id = callingDevice(request);
+  if (!id) return needsDevice();
+  if (!revokeDevice(id))
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  return NextResponse.json({ ok: true });
+}

package/lib/connect/serve.ts

@@ -8,6 +8,10 @@
  *   - takes only the machine's own Host (cloudflared pins it) and strips
  *     X-Forwarded-Host, Forwarded and X-Original-Host before any handler.
  *
+ * cloudflared starts only once that listener is bound and a connection to
+ * the port is seen to arrive on it, and stops if the listener goes: it must
+ * never publish whatever else holds the port.
+ *
  * Connect follows connect.json while running: `agent-os disconnect` or the
  * switch in Devices stops cloudflared and closes every tunnel connection at
  * once. Nothing here may stop AgentOS from starting.
@@ -15,6 +19,7 @@
 
 import fs from "fs";
 import http from "http";
+import net from "net";
 import path from "path";
 import type { IncomingMessage, ServerResponse } from "http";
 import type { Socket } from "net";
@@ -36,7 +41,13 @@ import {
 } from "./control-api";
 import { appVersion, startHeartbeat } from "./heartbeat";
 import { ensureCloudflared } from "./cloudflared";
-import { superviseTunnel, type Spawn, type TunnelState } from "./supervise";
+import {
+  reapTunnel,
+  superviseTunnel,
+  type ReapDeps,
+  type Spawn,
+  type TunnelState,
+} from "./supervise";
 
 export interface Handlers {
   onRequest: (req: IncomingMessage, res: ServerResponse) => void;
@@ -101,12 +112,51 @@ export interface ConnectDeps {
   delays?: Parameters<typeof superviseTunnel>[0]["delays"];
   heartbeat?: typeof sendHeartbeat;
   heartbeatMs?: number;
+  reap?: ReapDeps;
+}
+
+/**
+ * Whether connections to 127.0.0.1:<port> reach `server`: one is made and
+ * must show up on it. Never rejects.
+ */
+export function listenerIsOurs(
+  server: http.Server,
+  port: number,
+  timeoutMs = 3000
+): Promise<boolean> {
+  return new Promise((resolve) => {
+    const arrived = new Set<number>();
+    let probePort: number | undefined;
+    let done = false;
+    const finish = (ok: boolean) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      server.removeListener("connection", onConnection);
+      client.destroy();
+      resolve(ok);
+    };
+    const onConnection = (s: Socket) => {
+      if (s.remotePort === undefined) return;
+      arrived.add(s.remotePort);
+      if (s.remotePort === probePort) finish(true);
+    };
+    server.prependListener("connection", onConnection);
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    timer.unref?.();
+    const client = net.connect(port, "127.0.0.1", () => {
+      probePort = client.localPort;
+      // The server may have seen it before this callback ran.
+      if (probePort !== undefined && arrived.has(probePort)) finish(true);
+    });
+    client.on("error", () => finish(false));
+  });
 }
 
 interface Running {
   server: http.Server;
   sockets: Set<Socket>;
-  supervisor: ReturnType<typeof superviseTunnel>;
+  supervisor: ReturnType<typeof superviseTunnel> | null;
   heartbeat: ReturnType<typeof startHeartbeat>;
   release: () => void;
 }
@@ -131,12 +181,12 @@ export function startConnect(
   let bindError: string | undefined;
   g.__agentosConnect = () => {
     if (!running) return base;
-    const s: TunnelState = running.supervisor.state();
+    const s: TunnelState = running.supervisor?.state() ?? "connecting";
     return {
       ...base,
       hostname: hostname || base.hostname,
       state: bindError ? "error" : s === "stopped" ? "off" : s,
-      reason: bindError ?? running.supervisor.reason(),
+      reason: bindError ?? running.supervisor?.reason(),
     };
   };
 
@@ -153,7 +203,7 @@ export function startConnect(
     if (!running) return;
     bindError = undefined;
     running.heartbeat.stop();
-    running.supervisor.stop();
+    running.supervisor?.stop();
     running.sockets.forEach((s) => s.destroy());
     running.server.close();
     running.release();
@@ -200,19 +250,50 @@ export function startConnect(
       log(`connect: ${base.reason}`);
       return;
     }
+    // The lock is ours, so a cloudflared in the pid file belongs to an
+    // AgentOS that died: it goes before anything else happens.
+    const reaped = reapTunnel(dir, undefined, deps.reap).catch(() => false);
     const server = tunnelListener(() => hostname, handlers);
     const sockets = new Set<Socket>();
     server.on("connection", (s: Socket) => {
       sockets.add(s);
       s.once("close", () => sockets.delete(s));
     });
+    const ensure =
+      deps.ensureBinary ?? ((d: string) => ensureCloudflared({ dir: d }));
+    const ask = deps.requestTunnel ?? requestTunnel;
+    const startTunnel = () =>
+      superviseTunnel({
+        dir,
+        log,
+        spawn: deps.spawn,
+        delays: deps.delays,
+        prepare: async () => {
+          const bin = await ensure(dir);
+          // Fresh every start; the token lives only in this call and the child's env.
+          const tunnel = await ask(config, machineKey, tunnelPort);
+          if (tunnel.hostname !== hostname) {
+            hostname = tunnel.hostname;
+            saveConnect({ ...config, hostname }, dir);
+            log(`connect: reachable at https://${hostname}`);
+          }
+          return { bin, token: tunnel.token };
+        },
+      });
+    const stopTunnel = () => {
+      if (running?.server !== server || !running.supervisor) return;
+      running.supervisor.stop();
+      running.supervisor = null;
+    };
     // Something else may hold the port for a while (an AgentOS shutting
-    // down, say): keep trying with backoff rather than giving up.
+    // down, say): keep trying with backoff rather than giving up, with
+    // cloudflared stopped meanwhile.
     const bindDelays = deps.delays ?? { min: 1000, max: 60_000 };
     let bindDelay = bindDelays.min;
-    server.on("error", (err) => {
+    const rebind = (why: string) => {
       if (running?.server !== server) return;
-      bindError = `can't listen on 127.0.0.1:${tunnelPort}: ${err.message}`;
+      stopTunnel();
+      bindError = `can't listen on 127.0.0.1:${tunnelPort}: ${why}`;
       log(`connect: ${bindError}; trying again`);
       const t = setTimeout(() => {
         if (running?.server !== server) return;
@@ -221,30 +302,19 @@ export function startConnect(
       }, bindDelay);
       t.unref?.();
       bindDelay = Math.min(bindDelay * 2, bindDelays.max);
-    });
-    server.on("listening", () => {
+    };
+    server.on("error", (err) => rebind(err.message));
+    server.on("close", () => stopTunnel());
+    server.on("listening", async () => {
+      const [ours] = await Promise.all([
+        listenerIsOurs(server, tunnelPort),
+        reaped,
+      ]);
+      if (running?.server !== server || !server.listening) return;
+      if (!ours) return rebind("connections there don't reach AgentOS");
       bindError = undefined;
       bindDelay = bindDelays.min;
-    });
-    const ensure =
-      deps.ensureBinary ?? ((d: string) => ensureCloudflared({ dir: d }));
-    const ask = deps.requestTunnel ?? requestTunnel;
-    const supervisor = superviseTunnel({
-      dir,
-      log,
-      spawn: deps.spawn,
-      delays: deps.delays,
-      prepare: async () => {
-        const bin = await ensure(dir);
-        // Fresh every start; the token lives only in this call and the child's env.
-        const tunnel = await ask(config, machineKey, tunnelPort);
-        if (tunnel.hostname !== hostname) {
-          hostname = tunnel.hostname;
-          saveConnect({ ...config, hostname }, dir);
-          log(`connect: reachable at https://${hostname}`);
-        }
-        return { bin, token: tunnel.token };
-      },
+      if (!running.supervisor) running.supervisor = startTunnel();
     });
     const beat = deps.heartbeat ?? sendHeartbeat;
     const version = appVersion();
@@ -261,7 +331,13 @@ export function startConnect(
         down("machine no longer linked");
       },
     });
-    running = { server, sockets, supervisor, heartbeat, release: lock.release };
+    running = {
+      server,
+      sockets,
+      supervisor: null,
+      heartbeat,
+      release: lock.release,
+    };
     server.listen(tunnelPort, "127.0.0.1");
   };