@saadnvd1/agent-os 0.3.694 → 0.3.698

package/lib/peer/keys.ts

@@ -0,0 +1,122 @@
+/**
+ * The keys a machine uses with its linked peers. The signing key is
+ * Connect's machine.key (Ed25519); the box key (X25519) is peer.key next to
+ * it, made on first use, owner-only, and never sent to the Connect service.
+ * Public keys travel as base64url of their 32 raw bytes.
+ */
+
+import crypto, { type KeyObject } from "crypto";
+import fs from "fs";
+import path from "path";
+import { connectDir, readConnect } from "../connect/config";
+
+const RAW = /^[A-Za-z0-9_-]{43}$/;
+
+export const rawPublic = (key: KeyObject): string => {
+  const jwk = key.export({ format: "jwk" });
+  if (typeof jwk.x !== "string") throw new Error("not an OKP key");
+  return jwk.x;
+};
+
+function publicFromRaw(raw: string, crv: "Ed25519" | "X25519"): KeyObject {
+  if (!RAW.test(raw)) throw new Error(`bad ${crv} public key`);
+  const key = crypto.createPublicKey({
+    key: { kty: "OKP", crv, x: raw },
+    format: "jwk",
+  });
+  if (key.asymmetricKeyType !== crv.toLowerCase())
+    throw new Error(`bad ${crv} public key`);
+  return key;
+}
+
+export const signPublic = (raw: string) => publicFromRaw(raw, "Ed25519");
+export const boxPublic = (raw: string) => publicFromRaw(raw, "X25519");
+
+export interface BoxKey {
+  privateKey: KeyObject;
+  publicRaw: string;
+}
+
+/**
+ * Makes sure `p` is this user's and nobody else's: repairs group or other
+ * access, refuses one owned by someone else.
+ */
+function ownerOnly(p: string, mode: number) {
+  if (process.platform === "win32") return;
+  const st = fs.lstatSync(p);
+  if (st.isSymbolicLink()) throw new Error(`${p} is a symlink`);
+  if (typeof process.getuid === "function" && st.uid !== process.getuid())
+    throw new Error(`${p} belongs to another user`);
+  if (st.mode & 0o077) fs.chmodSync(p, mode);
+}
+
+/** peer.key, created owner-only if it isn't there yet. */
+export function loadBoxKey(dir = connectDir()): BoxKey {
+  const file = path.join(dir, "peer.key");
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  ownerOnly(dir, 0o700);
+  if (!fs.existsSync(file)) {
+    const { privateKey } = crypto.generateKeyPairSync("x25519");
+    const pem = privateKey.export({ format: "pem", type: "pkcs8" });
+    // Written whole under a temp name, then linked in: a crash never leaves
+    // a half-written key, and two starts racing keep whichever came first.
+    const tmp = `${file}.${process.pid}.${crypto.randomBytes(4).toString("hex")}`;
+    fs.writeFileSync(tmp, pem, { mode: 0o600, flag: "wx" });
+    try {
+      fs.linkSync(tmp, file);
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+    } finally {
+      fs.rmSync(tmp, { force: true });
+    }
+  }
+  ownerOnly(file, 0o600);
+  const privateKey = crypto.createPrivateKey(fs.readFileSync(file, "utf8"));
+  if (privateKey.asymmetricKeyType !== "x25519")
+    throw new Error(`${file} is not an X25519 key`);
+  return {
+    privateKey,
+    publicRaw: rawPublic(crypto.createPublicKey(privateKey)),
+  };
+}
+
+export interface Identity {
+  machineId: string;
+  signKey: KeyObject;
+  signPub: string;
+}
+
+/** This machine as Connect knows it, or null when it isn't enrolled. */
+export function loadIdentity(dir = connectDir()): Identity | null {
+  const read = readConnect(dir);
+  if (!read.ok) return null;
+  const signKey = crypto.createPrivateKey(read.files.machineKey);
+  if (signKey.asymmetricKeyType !== "ed25519") return null;
+  return {
+    machineId: read.files.config.machineId,
+    signKey,
+    signPub: rawPublic(crypto.createPublicKey(signKey)),
+  };
+}
+
+const g = globalThis as unknown as {
+  __agentosPeerIdentity?: {
+    at: number;
+    dir: string;
+    identity: Identity | null;
+  };
+};
+
+/** loadIdentity, re-read at most every 30 s (it's on every peer call). */
+export function currentIdentity(dir = connectDir()): Identity | null {
+  const c = g.__agentosPeerIdentity;
+  if (c && c.dir === dir && Date.now() - c.at < 30_000) return c.identity;
+  let identity: Identity | null = null;
+  try {
+    identity = loadIdentity(dir);
+  } catch {
+    identity = null;
+  }
+  g.__agentosPeerIdentity = { at: Date.now(), dir, identity };
+  return identity;
+}

package/lib/peer/links.ts

@@ -0,0 +1,96 @@
+/**
+ * Pinned peers: a machine linked through Connect, by its Connect id, with
+ * the keys it paired with. Nothing here talks to the network.
+ */
+
+import { getDb } from "../db";
+
+export type PinState = "active" | "suspended";
+
+export interface PeerPin {
+  hostId: string;
+  machineId: string;
+  hostname: string;
+  signPub: string;
+  boxPub: string;
+  state: PinState;
+  suspendedReason: string | null;
+}
+
+interface Row {
+  host_id: string;
+  machine_id: string;
+  hostname: string;
+  sign_pub: string;
+  box_pub: string;
+  state: string;
+  suspended_reason: string | null;
+}
+
+const toPin = (r: Row | undefined): PeerPin | null =>
+  r
+    ? {
+        hostId: r.host_id,
+        machineId: r.machine_id,
+        hostname: r.hostname,
+        signPub: r.sign_pub,
+        boxPub: r.box_pub,
+        state: r.state === "active" ? "active" : "suspended",
+        suspendedReason: r.suspended_reason,
+      }
+    : null;
+
+// Only a host created as a Connect machine counts: a pin on any other row
+// would be a second way in that nothing shows.
+const SELECT = `SELECT p.* FROM peer_links p JOIN hosts h ON h.id = p.host_id
+  WHERE h.kind = 'connect'`;
+
+export const pinForMachine = (machineId: string): PeerPin | null =>
+  toPin(
+    getDb().prepare(`${SELECT} AND p.machine_id = ?`).get(machineId) as
+      Row | undefined
+  );
+
+/** Whether any linked machine may call in at all. */
+export const hasActivePin = (): boolean =>
+  getDb().prepare(`${SELECT} AND p.state = 'active' LIMIT 1`).get() !==
+  undefined;
+
+export const pinForHost = (hostId: string): PeerPin | null =>
+  toPin(
+    getDb().prepare(`${SELECT} AND p.host_id = ?`).get(hostId) as
+      Row | undefined
+  );
+
+/** Pins a peer's keys to a Connect host. Pairing (S2) is the only caller. */
+export function savePin(pin: Omit<PeerPin, "state" | "suspendedReason">) {
+  getDb()
+    .prepare(
+      `INSERT INTO peer_links (host_id, machine_id, hostname, sign_pub, box_pub)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(host_id) DO UPDATE SET machine_id = excluded.machine_id,
+         hostname = excluded.hostname, sign_pub = excluded.sign_pub,
+         box_pub = excluded.box_pub, state = 'active', suspended_reason = NULL,
+         paired_at = datetime('now'), last_error = NULL`
+    )
+    .run(pin.hostId, pin.machineId, pin.hostname, pin.signPub, pin.boxPub);
+}
+
+export function suspendPin(hostId: string, reason: string) {
+  getDb()
+    .prepare(
+      `UPDATE peer_links SET state = 'suspended', suspended_reason = ? WHERE host_id = ?`
+    )
+    .run(reason, hostId);
+}
+
+/** Last outcome of a call to that peer, for Machines. */
+export function notePinResult(hostId: string, error: string | null) {
+  getDb()
+    .prepare(
+      error
+        ? `UPDATE peer_links SET last_error = ? WHERE host_id = ?`
+        : `UPDATE peer_links SET last_ok_at = datetime('now'), last_error = NULL WHERE host_id = ?`
+    )
+    .run(...(error ? [error.slice(0, 300), hostId] : [hostId]));
+}

package/lib/peer/nonce-store.ts

@@ -0,0 +1,23 @@
+/**
+ * The replay guard's nonces in SQLite, so they outlive a restart. One
+ * statement both checks and records, so two requests carrying the same nonce
+ * can't both pass.
+ */
+
+import { getDb } from "../db";
+import type { NonceStore } from "./replay";
+
+export function sqliteNonceStore(db = getDb): NonceStore {
+  return {
+    claim: (peer, nonce, until, now) =>
+      db()
+        .prepare(
+          `INSERT INTO peer_nonces (machine_id, nonce, until) VALUES (?, ?, ?)
+           ON CONFLICT (machine_id, nonce) DO UPDATE SET until = excluded.until
+             WHERE peer_nonces.until < ?`
+        )
+        .run(peer.slice(0, 64), nonce, until, now).changes === 1,
+    prune: (now) =>
+      void db().prepare(`DELETE FROM peer_nonces WHERE until < ?`).run(now),
+  };
+}

package/lib/peer/replay.ts

@@ -0,0 +1,81 @@
+/**
+ * Replay protection for peer envelopes: a timestamp within ±120 s, and each
+ * peer's nonces remembered for as long as their timestamp would still pass.
+ * A nonce is only ever forgotten once it's outside that window; a peer that
+ * fills its cache inside the window is told it's busy rather than letting an
+ * older nonce be replayed.
+ *
+ * The server's guard also writes each nonce to a NonceStore (SQLite,
+ * nonce-store.ts) before the call runs, so a restart doesn't forget the
+ * nonces still inside the window. Memory is only a cache in front of it; if
+ * the store can't be written the call is refused as busy.
+ */
+
+import { SKEW_MS } from "./envelope";
+
+export type Freshness = "ok" | "stale" | "replay" | "busy";
+
+export interface NonceStore {
+  /** Records the nonce until `until`; false if it's already recorded. */
+  claim(peer: string, nonce: string, until: number, now: number): boolean;
+  /** Forgets nonces whose time is up. */
+  prune(now: number): void;
+}
+
+export interface ReplayGuard {
+  check(peer: string, nonce: string, ts: number, now?: number): Freshness;
+}
+
+export function createReplayGuard(
+  opts: { windowMs?: number; maxPerPeer?: number; store?: NonceStore } = {}
+): ReplayGuard {
+  const { store } = opts;
+  const windowMs = opts.windowMs ?? SKEW_MS;
+  const maxPerPeer = opts.maxPerPeer ?? 50_000;
+  // nonce → the time after which its timestamp is stale anyway.
+  const seen = new Map<string, Map<string, number>>();
+  let sweptAt = 0;
+
+  const sweep = (nonces: Map<string, number>, now: number) => {
+    for (const [nonce, until] of nonces) if (until < now) nonces.delete(nonce);
+  };
+
+  return {
+    check(peer, nonce, ts, now = Date.now()) {
+      if (!Number.isFinite(ts) || Math.abs(now - ts) > windowMs) return "stale";
+      if (now - sweptAt > windowMs) {
+        sweptAt = now;
+        for (const nonces of seen.values()) sweep(nonces, now);
+        try {
+          store?.prune(now);
+        } catch {
+          // pruned again next window
+        }
+      }
+      let nonces = seen.get(peer);
+      if (!nonces) seen.set(peer, (nonces = new Map()));
+      const until = nonces.get(nonce);
+      if (until !== undefined && until >= now) return "replay";
+      if (nonces.size >= maxPerPeer) {
+        sweep(nonces, now);
+        if (nonces.size >= maxPerPeer) return "busy";
+      }
+      // Past ts + window the timestamp check refuses it on its own.
+      const expires = ts + windowMs;
+      if (store) {
+        let fresh: boolean;
+        try {
+          fresh = store.claim(peer, nonce, expires, now);
+        } catch {
+          return "busy";
+        }
+        if (!fresh) {
+          nonces.set(nonce, expires);
+          return "replay";
+        }
+      }
+      nonces.set(nonce, expires);
+      return "ok";
+    },
+  };
+}

package/lib/peer/rpc-intake.ts

@@ -0,0 +1,229 @@
+/**
+ * Reading an envelope off the wire: how much memory envelopes may hold
+ * before and after their sender is proven, and how slowly one may arrive.
+ * The sender is proven by the header's own signature, before any of the
+ * body is held for it. Every sender, linked or not, goes through exactly
+ * this, so neither the time to a refusal nor a `busy` says whether a machine
+ * is linked here.
+ */
+
+import type { IncomingMessage } from "http";
+import { isIP } from "net";
+import { isTunnelSocket } from "../security/auth";
+import {
+  HEADER_SIG,
+  MAX_HEADER,
+  MAX_REQUEST_ENVELOPE,
+  type Refusal,
+} from "./envelope";
+
+/**
+ * One request's share of the budget. Bytes are held against its source until
+ * prove() names the sender whose header signature held, then against that
+ * sender; close() gives back everything it took.
+ */
+export interface Ticket {
+  take(bytes: number): boolean;
+  prove(peer: string): boolean;
+  close(): void;
+}
+
+/**
+ * Bytes held by envelopes still arriving. Before the header's signature is
+ * checked they count against the source address, in a small pool of their
+ * own, so strangers can't touch what linked machines get; after, against
+ * the proven sender. Each share is well below its total, and one source may
+ * have only a few requests open.
+ */
+export interface BodyBudget {
+  open(source: string): Ticket | null;
+}
+
+export interface BudgetLimits {
+  /** Bytes of proven senders' envelopes, in all and per sender. */
+  total: number;
+  perPeer: number;
+  /** Bytes not yet proven, in all and per source. */
+  unverifiedTotal: number;
+  perSource: number;
+  requestsPerSource: number;
+}
+
+export const DEFAULT_BUDGET: BudgetLimits = {
+  total: 4 * MAX_REQUEST_ENVELOPE,
+  perPeer: MAX_REQUEST_ENVELOPE,
+  unverifiedTotal: 4 * 1024 * 1024,
+  perSource: 256 * 1024,
+  requestsPerSource: 4,
+};
+
+export function createBodyBudget(o: Partial<BudgetLimits> = {}): BodyBudget {
+  const lim = { ...DEFAULT_BUDGET, ...o };
+  let proven = 0;
+  let unproven = 0;
+  const byPeer = new Map<string, number>();
+  const bySource = new Map<string, number>();
+  const open = new Map<string, number>();
+  const add = (m: Map<string, number>, k: string, n: number) => {
+    const v = (m.get(k) ?? 0) + n;
+    if (v > 0) m.set(k, v);
+    else m.delete(k);
+  };
+  return {
+    open(source) {
+      if ((open.get(source) ?? 0) >= lim.requestsPerSource) return null;
+      add(open, source, 1);
+      let peer: string | null = null;
+      let held = 0;
+      let closed = false;
+      const fits = (who: string | null, bytes: number) =>
+        who === null
+          ? unproven + bytes <= lim.unverifiedTotal &&
+            (bySource.get(source) ?? 0) + bytes <= lim.perSource
+          : proven + bytes <= lim.total &&
+            (byPeer.get(who) ?? 0) + bytes <= lim.perPeer;
+      const charge = (who: string | null, bytes: number) => {
+        if (who === null) {
+          unproven += bytes;
+          add(bySource, source, bytes);
+        } else {
+          proven += bytes;
+          add(byPeer, who, bytes);
+        }
+      };
+      return {
+        take(bytes) {
+          if (closed || !fits(peer, bytes)) return false;
+          charge(peer, bytes);
+          held += bytes;
+          return true;
+        },
+        prove(who) {
+          if (closed || peer !== null || !fits(who, held)) return false;
+          charge(null, -held);
+          charge(who, held);
+          peer = who;
+          return true;
+        },
+        close() {
+          if (closed) return;
+          closed = true;
+          charge(peer, -held);
+          add(open, source, -1);
+        },
+      };
+    },
+  };
+}
+
+/**
+ * Where a request came from: the visitor's address Cloudflare stamps on a
+ * tunnel request (the socket there is always cloudflared), else the socket's.
+ */
+export function sourceOf(req: IncomingMessage): string {
+  if (isTunnelSocket(req.socket)) {
+    const cf = String(req.headers["cf-connecting-ip"] ?? "").trim();
+    if (isIP(cf)) return cf;
+  }
+  return req.socket.remoteAddress ?? "unknown";
+}
+
+export interface Pace {
+  /** How long the first bytes may take before a rate is required. */
+  graceMs: number;
+  /** Bytes per second the body must keep up after the grace period, */
+  minRate: number;
+  /** measured over each window this long, so a burst can't bank time. */
+  windowMs: number;
+}
+
+export const DEFAULT_PACE: Pace = {
+  graceMs: 10_000,
+  minRate: 512 * 1024,
+  windowMs: 5_000,
+};
+
+export type Read =
+  | { body: Buffer }
+  | { refusal: Refusal }
+  | { tooLarge: true }
+  | { tooSlow: true };
+
+/**
+ * The body, at most MAX_REQUEST_ENVELOPE bytes. `early` sees the header and
+ * its signature as soon as they've arrived, and returns the proven sender or
+ * a refusal. Every byte held must be granted by the ticket, or reading stops
+ * as busy; a body slower than `pace` stops as too slow.
+ */
+export function readEnvelope(
+  req: IncomingMessage,
+  o: {
+    early: (
+      headerBytes: Buffer,
+      headerSig: Buffer
+    ) => { peer: string } | { refusal: Refusal };
+    ticket: Ticket;
+    pace: Pace;
+  }
+): Promise<Read> {
+  return new Promise((resolve, reject) => {
+    if (Number(req.headers["content-length"]) > MAX_REQUEST_ENVELOPE)
+      return resolve({ tooLarge: true });
+    const chunks: Buffer[] = [];
+    const started = Date.now();
+    let total = 0;
+    let proven = false;
+    let done = false;
+    const finish = (v: Read | Error) => {
+      if (done) return;
+      done = true;
+      clearInterval(timer);
+      // An unread rest is dropped with the connection (Connection: close).
+      req.removeAllListeners("data");
+      if (v instanceof Error) reject(v);
+      else resolve(v);
+    };
+    const { graceMs, minRate, windowMs } = o.pace;
+    // (time, bytes so far), back to the start of the current window.
+    const samples = [{ t: started, total: 0 }];
+    const timer = setInterval(
+      () => {
+        const now = Date.now();
+        samples.push({ t: now, total });
+        while (samples.length > 1 && samples[1].t <= now - windowMs)
+          samples.shift();
+        if (now - started <= graceMs) return;
+        const base = samples[0];
+        if (total - base.total < ((now - base.t) / 1000) * minRate)
+          finish({ tooSlow: true });
+      },
+      Math.max(25, Math.min(1000, graceMs / 4, windowMs / 4))
+    );
+    req.on("data", (chunk: Buffer) => {
+      if (done) return;
+      total += chunk.length;
+      if (total > MAX_REQUEST_ENVELOPE) return finish({ tooLarge: true });
+      if (!o.ticket.take(chunk.length)) return finish({ refusal: "busy" });
+      chunks.push(chunk);
+      if (proven || total < 4) return;
+      const head = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks);
+      chunks.splice(0, chunks.length, head);
+      const len = head.readUInt32BE(0);
+      if (len > MAX_HEADER) return finish({ refusal: "bad_envelope" });
+      if (head.length < 4 + len + HEADER_SIG) return;
+      const seen = o.early(
+        head.subarray(4, 4 + len),
+        head.subarray(4 + len, 4 + len + HEADER_SIG)
+      );
+      if ("refusal" in seen) return finish({ refusal: seen.refusal });
+      if (!o.ticket.prove(seen.peer)) return finish({ refusal: "busy" });
+      proven = true;
+    });
+    req.on("end", () => {
+      if (total >= 4 && !proven && !done)
+        return finish({ refusal: "bad_envelope" });
+      finish({ body: Buffer.concat(chunks) });
+    });
+    req.on("error", (err) => finish(err));
+  });
+}