@saadnvd1/agent-os 0.3.514 → 0.3.516

package/lib/security/devices.ts

@@ -5,6 +5,12 @@
 
 import crypto from "crypto";
 import { getDb } from "@/lib/db";
+import { enabledCategories } from "@/lib/notify/copy";
+import type {
+  PushCategory,
+  PushEnvironment,
+  PushPlatform,
+} from "@/lib/notify/push-types";
 
 export interface Device {
   id: string;
@@ -115,13 +121,162 @@ export function revokeDevice(id: string): boolean {
   const changed =
     getDb()
       .prepare(
-        `UPDATE devices SET revoked_at = datetime('now') WHERE id = ? AND revoked_at IS NULL`
+        `UPDATE devices SET revoked_at = datetime('now'),
+           push_token = NULL, push_platform = NULL, push_environment = NULL,
+           push_categories = NULL, push_updated_at = NULL, push_last_error = NULL
+         WHERE id = ? AND revoked_at IS NULL`
       )
       .run(id).changes > 0;
   if (changed) dropDeviceSockets(id);
   return changed;
 }
 
+export interface DevicePush {
+  token: string;
+  platform: PushPlatform;
+  environment: PushEnvironment;
+  /** What it receives: its saved list, or the defaults. */
+  categories: PushCategory[];
+  updatedAt: string;
+  lastError: string | null;
+}
+
+interface PushRow {
+  push_token: string | null;
+  push_platform: PushPlatform;
+  push_environment: PushEnvironment;
+  push_categories: string | null;
+  push_updated_at: string;
+  push_last_error: string | null;
+}
+
+// A corrupt saved list reads as "none saved", so the defaults apply.
+function parseCategories(raw: string | null): unknown[] | null {
+  if (!raw) return null;
+  try {
+    const v = JSON.parse(raw);
+    return Array.isArray(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+const pushOf = (r: PushRow | undefined): DevicePush | null =>
+  r?.push_token
+    ? {
+        token: r.push_token,
+        platform: r.push_platform,
+        environment: r.push_environment,
+        categories: enabledCategories(parseCategories(r.push_categories)),
+        updatedAt: r.push_updated_at,
+        lastError: r.push_last_error,
+      }
+    : null;
+
+const PUSH_COLS = `push_token, push_platform, push_environment, push_categories,
+  push_updated_at, push_last_error`;
+
+export function getDevicePush(id: string): DevicePush | null {
+  return pushOf(
+    getDb()
+      .prepare(
+        `SELECT ${PUSH_COLS} FROM devices WHERE id = ? AND revoked_at IS NULL`
+      )
+      .get(id) as PushRow | undefined
+  );
+}
+
+/** Every live device that can be sent a push, for the sender. */
+export function listPushDevices(): { id: string; push: DevicePush }[] {
+  const rows = getDb()
+    .prepare(
+      `SELECT id, ${PUSH_COLS} FROM devices
+       WHERE revoked_at IS NULL AND push_token IS NOT NULL`
+    )
+    .all() as (PushRow & { id: string })[];
+  return rows.flatMap((r) => {
+    const push = pushOf(r);
+    return push ? [{ id: r.id, push }] : [];
+  });
+}
+
+/**
+ * Registers or refreshes a device's push token. Idempotent. Saved categories
+ * are kept unless new ones are given. A token belongs to one device: if
+ * another row held it (a re-pair on the same phone), that row loses it so
+ * nothing is sent twice.
+ */
+export function setDevicePush(
+  id: string,
+  p: {
+    token: string;
+    platform: PushPlatform;
+    environment: PushEnvironment;
+    categories?: PushCategory[];
+  }
+): boolean {
+  const db = getDb();
+  return db.transaction(() => {
+    db.prepare(
+      `UPDATE devices SET push_token = NULL, push_platform = NULL,
+         push_environment = NULL, push_categories = NULL,
+         push_updated_at = NULL, push_last_error = NULL
+       WHERE push_token = ? AND id != ?`
+    ).run(p.token, id);
+    return (
+      db
+        .prepare(
+          `UPDATE devices SET push_token = ?, push_platform = ?, push_environment = ?,
+             push_categories = COALESCE(?, push_categories),
+             push_updated_at = datetime('now'), push_last_error = NULL
+           WHERE id = ? AND revoked_at IS NULL`
+        )
+        .run(
+          p.token,
+          p.platform,
+          p.environment,
+          p.categories ? JSON.stringify(p.categories) : null,
+          id
+        ).changes > 0
+    );
+  })();
+}
+
+/** False when the device has no push registered. */
+export function setDevicePushCategories(
+  id: string,
+  categories: PushCategory[]
+): boolean {
+  return (
+    getDb()
+      .prepare(
+        `UPDATE devices SET push_categories = ?, push_updated_at = datetime('now')
+         WHERE id = ? AND revoked_at IS NULL AND push_token IS NOT NULL`
+      )
+      .run(JSON.stringify(categories), id).changes > 0
+  );
+}
+
+/** The sender records why a send failed, so the Devices page can say. */
+export function setDevicePushError(id: string, error: string | null): void {
+  getDb()
+    .prepare(`UPDATE devices SET push_last_error = ? WHERE id = ?`)
+    .run(error ? error.slice(0, 200) : null, id);
+}
+
+export function clearDevicePush(id: string): boolean {
+  return (
+    getDb()
+      .prepare(
+        `UPDATE devices SET push_token = NULL, push_platform = NULL,
+           push_environment = NULL, push_categories = NULL,
+           push_updated_at = NULL, push_last_error = NULL
+         WHERE id = ? AND push_token IS NOT NULL`
+      )
+      .run(id).changes > 0
+  );
+}
+
 // Open WebSockets per device, so revoking one cuts its live terminal too.
 // On globalThis because server.ts and Next's route bundles load this module
 // separately.

package/lib/security/net.ts

@@ -5,6 +5,7 @@
  * another site's page (drive-by requests from any website the user visits).
  */
 
+import { isIP } from "net";
 import os from "os";
 
 const TAILSCALE_V4 = /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./; // 100.64.0.0/10
@@ -72,6 +73,8 @@ export function bindAddresses(
 export interface AccessPolicy {
   bound: string[];
   extraHosts: string[];
+  /** This machine's Connect address (connect.json), when it has one. */
+  machineHost?: () => string | null;
 }
 
 const LOCAL_NAMES = new Set(["localhost", "127.0.0.1", "::1"]);
@@ -82,6 +85,23 @@ function hostname(hostOrUrlHost: string): string {
   return h.replace(/:\d+$/, "");
 }
 
+// Every Connect machine is m-<16 hex>.runagentos.com, so all of them are
+// the same site: another machine's page is never one of ours.
+const MACHINE_HOST = /^m-[0-9a-f]{16}\.runagentos\.com$/;
+
+const machineHostOf = (policy: AccessPolicy) =>
+  policy.machineHost?.()?.toLowerCase() || null;
+
+/** Names that are this machine whatever it's bound to. */
+function ownHost(h: string, policy: AccessPolicy): boolean {
+  return (
+    LOCAL_NAMES.has(h) ||
+    (h !== "0.0.0.0" && policy.bound.includes(h)) ||
+    policy.extraHosts.includes(h) ||
+    machineHostOf(policy) === h
+  );
+}
+
 export function hostAllowed(
   host: string | undefined,
   policy: AccessPolicy
@@ -89,25 +109,39 @@ export function hostAllowed(
   if (!host) return false;
   if (policy.bound.includes("0.0.0.0")) return true;
   const h = hostname(host);
-  return (
-    LOCAL_NAMES.has(h) ||
-    policy.bound.includes(h) ||
-    h.endsWith(".ts.net") ||
-    policy.extraHosts.includes(h)
-  );
+  return ownHost(h, policy) || h.endsWith(".ts.net");
 }
 
+/**
+ * A page may talk to this machine only from one of this machine's own
+ * origins, whatever AGENTOS_BIND says: its loopback, bound and configured
+ * names, its own Connect address, or the host the request itself names when
+ * that is one of its addresses (a page served here on any of its ports; the
+ * mobile app's native socket sends that one). A wildcard bind widens the
+ * Host check, never this one: not another machine's m- address, not a name
+ * rebound to this machine's address.
+ */
 export function originAllowed(
   origin: string | undefined,
-  policy: AccessPolicy
+  policy: AccessPolicy,
+  requestHost?: string
 ): boolean {
-  if (!origin) return true; // not a browser page: curl, aos, server-side
+  if (!origin) return true; // not a browser page: curl, aos, peers, the app
   if (origin === "null") return false;
+  let h: string;
   try {
-    return hostAllowed(new URL(origin).host, policy);
+    h = hostname(new URL(origin).host);
   } catch {
     return false;
   }
+  if (!h) return false;
+  if (MACHINE_HOST.test(h)) return h === machineHostOf(policy);
+  if (ownHost(h, policy)) return true;
+  return (
+    !!requestHost &&
+    h === hostname(requestHost) &&
+    (h.endsWith(".ts.net") || isIP(h) !== 0)
+  );
 }
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
@@ -145,7 +179,7 @@ export function requestAllowed(
   if (!req.url?.startsWith("/api/")) return true;
   if (req.fetchSite === "cross-site") return crossSiteNavigationAllowed(req);
   if (!SAFE_METHODS.has((req.method ?? "GET").toUpperCase())) {
-    return originAllowed(req.origin, policy);
+    return originAllowed(req.origin, policy, req.host);
   }
   return true;
 }
@@ -154,5 +188,7 @@ export function upgradeAllowed(
   req: { host?: string; origin?: string },
   policy: AccessPolicy
 ): boolean {
-  return hostAllowed(req.host, policy) && originAllowed(req.origin, policy);
+  return (
+    hostAllowed(req.host, policy) && originAllowed(req.origin, policy, req.host)
+  );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.514",
+  "version": "0.3.516",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/server.ts

@@ -318,6 +318,7 @@ app.prepare().then(async () => {
   const connect = demo
     ? { hostname: () => null }
     : startConnect({ onRequest, onUpgrade }, port);
+  policy.machineHost = () => connect.hostname();
   // HTTPS on the tailnet (its own port) for passkeys and other secure-origin APIs.
   if (
     !demo &&