@saadnvd1/agent-os 0.3.548 → 0.3.549

package/app/api/pair/claim/route.ts

@@ -7,10 +7,12 @@ import { MAX_CLAIM_BYTES, readCapped } from "@/lib/security/read-capped";
 import {
   claimResponseBody,
   claimSetsCookie,
+  isNativeClaim,
 } from "@/lib/security/claim-response";
 
 // POST /api/pair/claim - reachable without a token; trades a code for one.
-// A client that isn't a browser sends `token: true` to get it in the body too.
+// A client that isn't a browser sends `token: true` to get it in the body too,
+// and starts with Can approve: it held a one-time code, as a browser does.
 export async function POST(request: NextRequest) {
   const raw = await readCapped(request, MAX_CLAIM_BYTES);
   if (raw === null)
@@ -23,6 +25,10 @@ export async function POST(request: NextRequest) {
   }
   if (!body.code)
     return NextResponse.json({ error: "code required" }, { status: 400 });
+  const native = isNativeClaim({
+    wantsToken: body.token,
+    origin: request.headers.get("origin"),
+  });
   const result = claimPairing({
     code: body.code,
     name: body.name ?? "",
@@ -31,6 +37,7 @@ export async function POST(request: NextRequest) {
       request.headers.get(REMOTE_HEADER),
       request.headers.get("x-forwarded-for")
     ),
+    native,
   });
   if (!result.ok) {
     const status = result.error === "rate_limited" ? 429 : 400;

package/lib/db/migrations.ts

@@ -1994,6 +1994,22 @@ const migrations: Migration[] = [
       );
     },
   },
+  {
+    id: 83,
+    name: "native_devices_can_approve",
+    up: (db) => {
+      // New native pairings start with Can approve; this gives it once to the
+      // ones paired before. The claim wasn't recorded, so the app is known by
+      // its user agent (`AgentOS/<build> CFNetwork/...` on iOS) or by an
+      // app push token. It only ever turns the flag on.
+      db.exec(
+        `UPDATE devices SET can_approve = 1
+         WHERE revoked_at IS NULL AND can_approve = 0
+           AND (user_agent LIKE 'AgentOS/% CFNetwork/%'
+                OR push_platform IN ('ios', 'android'))`
+      );
+    },
+  },
 ];
 
 // `upTo`: stop after this id (tests that start from an older database).

package/lib/security/approver.ts

@@ -1,6 +1,7 @@
 /**
  * Who may answer the orchestrator's asks or pause it: this machine, the
- * tailnet, or a paired device Saad has let approve (off by default). This
+ * tailnet, or a paired device with Can approve (the native app gets it at
+ * pairing; Saad can turn it off or on in Devices). This
  * is the coarse gate; approvals that matter also need a passkey (presence).
  */
 

package/lib/security/claim-response.ts

@@ -11,13 +11,19 @@ export interface ClaimBody {
   token?: string;
 }
 
+// The native app asks for its token and sends no Origin; a browser always
+// sends one on a POST, so a page can't pass for the app.
+export const isNativeClaim = (request: {
+  wantsToken?: unknown;
+  origin: string | null;
+}) => request.wantsToken === true && !request.origin;
+
 export function claimResponseBody(
   device: { id: string; name: string },
   token: string,
   request: { wantsToken?: unknown; origin: string | null }
 ): ClaimBody {
-  const native = request.wantsToken === true && !request.origin;
-  return { device, ...(native ? { token } : {}) };
+  return { device, ...(isNativeClaim(request) ? { token } : {}) };
 }
 
 // Whether the reply also sets the device cookie: only for a browser. A

package/lib/security/devices.ts

@@ -20,7 +20,8 @@ export interface Device {
   last_seen_at: string | null;
   last_address: string | null;
   revoked_at: string | null;
-  // Saad let it answer the orchestrator's asks (off by default).
+  // It may answer the orchestrator's asks: on for the native app at
+  // pairing, off for a browser; Saad can flip it either way in Devices.
   can_approve: number;
 }
 
@@ -32,19 +33,22 @@ export const hashToken = (token: string) =>
 
 export function mintDevice(
   name: string,
-  userAgent?: string | null
+  userAgent?: string | null,
+  canApprove = false
 ): { device: Device; token: string } {
   const id = crypto.randomUUID();
   const token = TOKEN_PREFIX + crypto.randomBytes(32).toString("base64url");
   getDb()
     .prepare(
-      `INSERT INTO devices (id, name, token_hash, user_agent) VALUES (?, ?, ?, ?)`
+      `INSERT INTO devices (id, name, token_hash, user_agent, can_approve)
+       VALUES (?, ?, ?, ?, ?)`
     )
     .run(
       id,
       name.trim().slice(0, 80) || "Device",
       hashToken(token),
-      userAgent ?? null
+      userAgent ?? null,
+      canApprove ? 1 : 0
     );
   return { device: getDevice(id)!, token };
 }

package/lib/security/pairing.ts

@@ -82,6 +82,8 @@ export function claimPairing(
     name: string;
     userAgent?: string | null;
     address: string;
+    // The native app (claimResponseBody's test): it may approve from the start.
+    native?: boolean;
   },
   now = Date.now()
 ): ClaimResult {
@@ -103,7 +105,11 @@ export function claimPairing(
   const p = state.codes.get(normalizeCode(input.code));
   if (!p || p.claimed || p.expiresAt < now)
     return { ok: false, error: "invalid" };
-  const { device, token } = mintDevice(input.name, input.userAgent);
+  const { device, token } = mintDevice(
+    input.name,
+    input.userAgent,
+    input.native === true
+  );
   p.claimed = { deviceId: device.id, name: device.name };
   return { ok: true, device, token };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.548",
+  "version": "0.3.549",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"