@saadnvd1/agent-os 0.3.560 → 0.3.564

package/README.md

@@ -20,6 +20,7 @@ and check on all of it from your phone.
 - **Built for your phone.** The whole app works on a phone; pair it with a QR code. [More](docs/guides/phone.md)
 - **Agents that talk to each other.** Sessions message each other with `aos`, and you see every conversation in Messages. [More](docs/guides/agent-network.md)
 - **Chat or terminal, same conversation.** Streaming replies, steps and diffs, plan mode, slash commands, `@file`, undo. [More](docs/guides/chat.md)
+- **Share a chat or a page.** A read-only snapshot link with secrets, home paths and machine names masked, and a preview before anything leaves your machine. [More](docs/guides/sharing.md)
 - **Project config.** `agentos.json` gives each session its own ports, environment, files and a private Postgres copy. [More](docs/reference/project-config.md)
 - **Schedules and recipes.** Start work on a timer, or save a job that comes up again. [More](docs/guides/schedules.md)
 - **Plans in pieces and stacks.** A plan splits into several PRs only for a real reason; a board can run as stacked PRs. [More](docs/guides/tasks.md#plans-in-pieces)

package/app/api/devices/[id]/route.ts

@@ -1,9 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
-import {
-  renameDevice,
-  revokeDevice,
-  setDeviceCanApprove,
-} from "@/lib/security/devices";
+import { renameDevice, setDeviceCanApprove } from "@/lib/security/devices";
+import { revokeDeviceAndKeys } from "@/lib/orchestrator/passkey-asks";
 import { requireLocalTrust } from "@/lib/security/route-guard";
 import { DEVICE_HEADER } from "@/lib/security/auth";
 import { demoMode } from "@/lib/security/demo";
@@ -43,7 +40,7 @@ export async function DELETE(request: NextRequest, { params }: Ctx) {
       { error: "Not available in the demo." },
       { status: 403 }
     );
-  if (!revokeDevice(id))
+  if (!revokeDeviceAndKeys(id, "Devices"))
     return NextResponse.json({ error: "Not found" }, { status: 404 });
   return NextResponse.json({ ok: true });
 }

package/app/api/devices/me/route.ts

@@ -1,12 +1,12 @@
 import { NextRequest, NextResponse } from "next/server";
-import { revokeDevice } from "@/lib/security/devices";
+import { revokeDeviceAndKeys } from "@/lib/orchestrator/passkey-asks";
 import { callingDevice, needsDevice } from "@/lib/security/device-me";
 
 // DELETE /api/devices/me - the device signs itself out ("Forget machine")
 export async function DELETE(request: NextRequest) {
   const id = callingDevice(request);
   if (!id) return needsDevice();
-  if (!revokeDevice(id))
+  if (!revokeDeviceAndKeys(id, "the device itself"))
     return NextResponse.json({ error: "Not found" }, { status: 404 });
   return NextResponse.json({ ok: true });
 }

package/app/api/presence/device-key/options/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApprover } from "@/lib/security/approver";
+import {
+  deviceRegistrationOptions,
+  PresenceError,
+} from "@/lib/security/presence";
+import { refusalResponse } from "@/lib/security/presence-http";
+import { passkeysBootstrapped } from "@/lib/security/passkeys";
+
+// A challenge for this paired device's new approval key to sign. The key is
+// the device's own, so only a paired device asks; with passkeys already set
+// up, it needs a code from one of them, like a browser passkey does.
+export async function POST(request: NextRequest) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  if (gate.approver.via !== "device" || !gate.approver.deviceId)
+    return NextResponse.json(
+      { error: "Only a paired device has its own key" },
+      { status: 403 }
+    );
+  try {
+    const { enrollCode } = (await request.json().catch(() => ({}))) as {
+      enrollCode?: string;
+    };
+    return NextResponse.json(
+      deviceRegistrationOptions(gate.approver.deviceId, enrollCode)
+    );
+  } catch (error) {
+    if (error instanceof PresenceError && error.code === "enroll")
+      return NextResponse.json({
+        needsCode: true,
+        canBootstrap: !passkeysBootstrapped(),
+      });
+    return refusalResponse(error);
+  }
+}

package/app/api/presence/device-key/route.ts

@@ -0,0 +1,55 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApprover } from "@/lib/security/approver";
+import { verifyDeviceRegistration } from "@/lib/security/presence";
+import { placeOf, refusalResponse } from "@/lib/security/presence-http";
+import { raisePasskeyAsks } from "@/lib/orchestrator/passkey-asks";
+import { resolvePasskeyAsks } from "@/lib/orchestrator/asks";
+
+// Stores the paired device's own approval key, and puts it on Saad's asks
+// list to confirm. A key it replaces (a reinstall) is revoked and noted.
+export async function POST(request: NextRequest) {
+  const gate = requireApprover(request);
+  if (!gate.ok) return gate.response;
+  if (gate.approver.via !== "device" || !gate.approver.deviceId)
+    return NextResponse.json(
+      { error: "Only a paired device has its own key" },
+      { status: 403 }
+    );
+  try {
+    const body = (await request.json().catch(() => ({}))) as {
+      publicKey?: string;
+      challenge?: string;
+      signature?: string;
+      name?: string;
+      hardware?: string;
+      enrollCode?: string;
+    };
+    if (!body.publicKey || !body.challenge || !body.signature)
+      return NextResponse.json({ error: "No key" }, { status: 400 });
+    const place = placeOf(gate.approver, request.headers);
+    const { key, replaced } = verifyDeviceRegistration(
+      gate.approver.deviceId,
+      {
+        publicKey: body.publicKey,
+        challenge: body.challenge,
+        signature: body.signature,
+        name: body.name || place,
+        hardware: body.hardware,
+      },
+      {
+        via: gate.approver.via,
+        from: place,
+        userAgent: request.headers.get("user-agent"),
+      },
+      body.enrollCode
+    );
+    for (const old of replaced) {
+      resolvePasskeyAsks(old.id, "replaced");
+      raisePasskeyAsks(old, place, "revoked");
+    }
+    raisePasskeyAsks(key, place);
+    return NextResponse.json({ passkey: { id: key.id, name: key.name } });
+  } catch (error) {
+    return refusalResponse(error);
+  }
+}

package/app/api/presence/enroll/route.ts

@@ -1,12 +1,11 @@
 import { NextRequest, NextResponse } from "next/server";
-import type { AuthenticationResponseJSON } from "@simplewebauthn/server";
 import { requireApprover } from "@/lib/security/approver";
+import { mintEnrollCode } from "@/lib/security/presence";
 import {
-  mintEnrollCode,
-  relyingParty,
-  verifyPresence,
-} from "@/lib/security/presence";
-import { refusalResponse } from "@/lib/security/presence-http";
+  refusalResponse,
+  requirePresence,
+  type PresenceProof,
+} from "@/lib/security/presence-http";
 
 // A one-time code (10 minutes) for adding a passkey on another device,
 // minted only on an assertion from an existing passkey.
@@ -14,15 +13,8 @@ export async function POST(request: NextRequest) {
   const gate = requireApprover(request);
   if (!gate.ok) return gate.response;
   try {
-    const { assertion } = (await request.json().catch(() => ({}))) as {
-      assertion?: AuthenticationResponseJSON;
-    };
-    await verifyPresence(
-      relyingParty(request.headers),
-      assertion,
-      "enroll",
-      "enroll"
-    );
+    const body = (await request.json().catch(() => ({}))) as PresenceProof;
+    await requirePresence(request, gate.approver, body, "enroll", "enroll");
     return NextResponse.json({ code: mintEnrollCode() });
   } catch (error) {
     return refusalResponse(error);

package/app/api/presence/options/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { requireApprover } from "@/lib/security/approver";
 import {
   assertionOptions,
+  deviceAssertionOptions,
   relyingParty,
   type PresencePurpose,
 } from "@/lib/security/presence";
@@ -21,8 +22,27 @@ export async function POST(request: NextRequest) {
       askId?: number;
       binding?: string;
       passkeyId?: string;
+      method?: "device";
     };
     const binding = presenceBinding(body);
+    if (body.method === "device") {
+      if (gate.approver.via !== "device" || !gate.approver.deviceId)
+        return NextResponse.json(
+          { error: "Only a paired device has its own key" },
+          { status: 403 }
+        );
+      const device = deviceAssertionOptions(
+        gate.approver.deviceId,
+        body.purpose!,
+        binding
+      );
+      if (!device)
+        return NextResponse.json({
+          needsDeviceKey: true,
+          canBootstrap: !passkeysBootstrapped(),
+        });
+      return NextResponse.json({ device });
+    }
     const rp = relyingParty(request.headers);
     const options = await assertionOptions(rp, body.purpose!, binding);
     if (!options)

package/app/api/presence/passkeys/[id]/route.ts

@@ -1,9 +1,12 @@
 import { NextRequest, NextResponse } from "next/server";
-import type { AuthenticationResponseJSON } from "@simplewebauthn/server";
 import { requireApprover } from "@/lib/security/approver";
 import { getPasskey, revokePasskey } from "@/lib/security/passkeys";
-import { relyingParty, verifyPresence } from "@/lib/security/presence";
-import { placeOf, refusalResponse } from "@/lib/security/presence-http";
+import {
+  placeOf,
+  refusalResponse,
+  requirePresence,
+  type PresenceProof,
+} from "@/lib/security/presence-http";
 import { raisePasskeyAsks } from "@/lib/orchestrator/passkey-asks";
 import { revokePresence } from "@/lib/orchestrator/presence-binding";
 import { resolvePasskeyAsks } from "@/lib/orchestrator/asks";
@@ -21,12 +24,11 @@ export async function DELETE(request: NextRequest, { params }: Ctx) {
     const key = getPasskey(id);
     if (!key || key.revoked_at)
       return NextResponse.json({ error: "Not found" }, { status: 404 });
-    const { assertion } = (await request.json().catch(() => ({}))) as {
-      assertion?: AuthenticationResponseJSON;
-    };
-    await verifyPresence(
-      relyingParty(request.headers),
-      assertion,
+    const body = (await request.json().catch(() => ({}))) as PresenceProof;
+    await requirePresence(
+      request,
+      gate.approver,
+      body,
       "revoke",
       revokePresence(id)
     );

package/app/api/shares/[id]/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { NOT_LINKED, linked, revokeRemote } from "@/lib/share/connect";
+import { fail, refuseDemo, toResponse } from "@/lib/share/route";
+import { getSharedLink, markRevoked } from "@/lib/share/store";
+
+// DELETE /api/shares/[id] - revoke a link: Connect deletes the page at once.
+export async function DELETE(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const refused = refuseDemo();
+  if (refused) return refused;
+  const { id } = await params;
+  if (!getSharedLink(id)) return fail("No such shared link.", 404);
+  if (!linked()) return fail(NOT_LINKED, 409);
+  try {
+    await revokeRemote(id);
+    markRevoked(id);
+    return NextResponse.json({ ok: true });
+  } catch (err) {
+    return toResponse(err);
+  }
+}

package/app/api/shares/preview/route.ts

@@ -0,0 +1,30 @@
+import { NextResponse } from "next/server";
+import { linked } from "@/lib/share/connect";
+import { readJson, refuseDemo, toResponse } from "@/lib/share/route";
+import { buildPage, parseRequest } from "@/lib/share/service";
+
+// POST /api/shares/preview - exactly what a share would upload, redacted.
+// Local work only: nothing goes to Connect until a share is created.
+export async function POST(request: Request) {
+  const refused = refuseDemo();
+  if (refused) return refused;
+  const read = await readJson(request);
+  if ("refused" in read) return read.refused;
+  try {
+    const req = parseRequest(read.body);
+    const page = await buildPage(req);
+    return NextResponse.json({
+      html: page.html,
+      title: page.title,
+      bytes: page.bytes,
+      hash: page.hash,
+      sharedAt: req.sharedAt,
+      items: page.items,
+      hits: page.hits,
+      tooBig: page.tooBig,
+      connectLinked: linked(),
+    });
+  } catch (err) {
+    return toResponse(err);
+  }
+}