@saadnvd1/agent-os 0.3.694 → 0.3.698

package/lib/peer/rpc-server.ts

@@ -0,0 +1,351 @@
+/**
+ * POST /api/peer/rpc: a linked machine's call, served before Next on any
+ * listener (the envelope is the authentication, not where it came from).
+ *
+ *  0. with no active link, refuse before reading anything;
+ *  1. read the envelope under a byte budget and a minimum transfer rate
+ *     (rpc-intake.ts), proving the sender from the header's own signature
+ *     before any of the body is held for it;
+ *  2. verify and decrypt it against the sender's pinned keys (envelope.ts);
+ *  3. match the inner method, path and query against the allowlist;
+ *  4. re-issue it to this machine's own loopback listener with the per-boot
+ *     secret, so the gate stamps `peer` trust and every route and guard runs
+ *     exactly as it does for any other caller.
+ *
+ * Refusals before decryption are plain and fixed (`bad envelope`, `bad
+ * signature`, `stale`, `replay`, `busy`). An unknown sender, a suspended one
+ * and a bad signature all read `bad signature`, so a stranger can't tell
+ * which machines are linked here; the audit keeps the difference. Everything
+ * after is inside the envelope,
+ * always HTTP 200, so whoever carries the traffic never learns the route or
+ * its status.
+ */
+
+import crypto from "crypto";
+import http, { type IncomingMessage, type ServerResponse } from "http";
+import { PEER_HEADER, PEER_INTERNAL_HEADER } from "../security/auth";
+import { matchPeerRoute } from "./allowlist";
+import { recordPeerCall, type AuditEntry, type Outcome } from "./audit";
+import {
+  MAX_RESPONSE_BODY,
+  RPC_PATH,
+  SKEW_MS,
+  openRequest,
+  parseHeaderBytes,
+  sealResponse,
+  type PeerResponse,
+  type Refusal,
+  verifyHeader,
+} from "./envelope";
+import { peerSecret } from "./internal";
+import {
+  currentIdentity,
+  loadBoxKey,
+  signPublic,
+  type BoxKey,
+  type Identity,
+} from "./keys";
+import { hasActivePin, pinForMachine, type PeerPin } from "./links";
+import { sqliteNonceStore } from "./nonce-store";
+import { createReplayGuard, type ReplayGuard } from "./replay";
+import {
+  DEFAULT_PACE,
+  createBodyBudget,
+  readEnvelope,
+  sourceOf,
+  type BodyBudget,
+  type Pace,
+} from "./rpc-intake";
+
+export { createBodyBudget };
+
+export { RPC_PATH };
+const DISPATCH_TIMEOUT_MS = 10 * 60_000;
+
+export interface Dispatch {
+  hostId: string;
+  method: string;
+  path: string;
+  query: string;
+  contentType: string;
+  body: Buffer;
+}
+
+export interface RpcDeps {
+  identity: () => Identity | null;
+  boxKey: () => BoxKey;
+  pinForMachine: (machineId: string) => PeerPin | null;
+  /** False while no link is active: the route is closed to everyone. */
+  anyActive: () => boolean;
+  replay: ReplayGuard;
+  dispatch: (d: Dispatch) => Promise<PeerResponse>;
+  audit: (e: AuditEntry) => void;
+  budget: BodyBudget;
+  pace?: Pace;
+  now?: () => number;
+}
+
+// Stands in for an unknown or suspended sender's key, so its envelope takes
+// the same path, and the same time, to the same refusal as a bad signature.
+const DECOY_KEY = crypto.generateKeyPairSync("ed25519").publicKey;
+
+export const isPeerRpc = (req: IncomingMessage) =>
+  (req.url ?? "").split("?")[0] === RPC_PATH;
+
+const REFUSED: Record<Refusal, [number, string, Outcome]> = {
+  bad_envelope: [400, "bad envelope", "bad_envelope"],
+  wrong_machine: [401, "bad signature", "bad_sig"],
+  unknown_peer: [401, "bad signature", "unknown_peer"],
+  suspended: [401, "bad signature", "suspended"],
+  bad_sig: [401, "bad signature", "bad_sig"],
+  stale: [401, "stale", "stale"],
+  replay: [401, "replay", "replay"],
+  busy: [429, "busy", "busy"],
+};
+
+function plain(res: ServerResponse, status: number, text: string) {
+  if (res.headersSent) return;
+  res.statusCode = status;
+  res.setHeader("Content-Type", "text/plain");
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("Connection", "close");
+  res.end(text);
+}
+
+export async function handlePeerRpc(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: RpcDeps
+): Promise<void> {
+  const started = Date.now();
+  if (req.method !== "POST") {
+    res.setHeader("Allow", "POST");
+    return plain(res, 405, "method not allowed");
+  }
+  const self = deps.identity();
+  let fromMachine: string | null = null;
+  let pin: PeerPin | null = null;
+  const audit = (
+    outcome: Outcome,
+    status: number,
+    route = RPC_PATH,
+    method = "POST",
+    bytes = 0
+  ) =>
+    deps.audit({
+      hostId: pin?.hostId ?? null,
+      machineId: fromMachine,
+      direction: "in",
+      method,
+      route,
+      status,
+      ms: Date.now() - started,
+      bytes,
+      outcome,
+    });
+  const refuse = (refusal: Refusal): null => {
+    const [status, text, outcome] = REFUSED[refusal];
+    audit(outcome, status);
+    plain(res, status, text);
+    return null;
+  };
+  // The sender's pinned signing key, or a decoy that verifies nothing for an
+  // unknown or suspended one, so its refusal takes the same path and time
+  // as a bad signature; `hidden` keeps what the check would have said.
+  let hidden: "unknown_peer" | "suspended" | null = null;
+  const signKeyFor = (machineId: string) => {
+    fromMachine = machineId;
+    const found = (pin = deps.pinForMachine(machineId));
+    hidden = !found
+      ? "unknown_peer"
+      : found.state !== "active"
+        ? "suspended"
+        : null;
+    if (!found || hidden) return DECOY_KEY;
+    try {
+      return signPublic(found.signPub);
+    } catch {
+      hidden = "unknown_peer";
+      return DECOY_KEY;
+    }
+  };
+  const refuseHidden = (refusal: Refusal): null =>
+    refuse(refusal === "bad_sig" && hidden ? hidden : refusal);
+  const drop = (status: number, text: string, outcome: Outcome): null => {
+    audit(outcome, status);
+    plain(res, status, text);
+    return null;
+  };
+
+  if (!deps.anyActive()) return plain(res, 404, "not found");
+  const ticket = deps.budget.open(sourceOf(req));
+  if (!ticket) return void refuse("busy");
+  const readAndOpen = async () => {
+    let read;
+    try {
+      read = await readEnvelope(req, {
+        early: (headerBytes, headerSig) => {
+          const header = parseHeaderBytes(headerBytes);
+          if (!header) return { refusal: "bad_envelope" };
+          if (!self || header.to !== self.machineId)
+            return { refusal: "wrong_machine" };
+          if (!verifyHeader(headerBytes, headerSig, signKeyFor(header.from)))
+            return { refusal: "bad_sig" };
+          const now = deps.now?.() ?? Date.now();
+          if (Math.abs(now - header.ts) > SKEW_MS) return { refusal: "stale" };
+          return { peer: header.from };
+        },
+        ticket,
+        pace: deps.pace ?? DEFAULT_PACE,
+      });
+    } catch {
+      return drop(400, "bad envelope", "bad_envelope");
+    }
+    if ("tooLarge" in read) return drop(413, "too large", "too_large");
+    if ("tooSlow" in read) return drop(408, "too slow", "too_slow");
+    if ("refusal" in read) return refuseHidden(read.refusal);
+    if (!self) return refuse("wrong_machine");
+    return openRequest(read.body, {
+      self: self.machineId,
+      boxKey: deps.boxKey().privateKey,
+      signKeyFor,
+      replay: deps.replay,
+      now: deps.now?.(),
+    });
+  };
+  let opened;
+  try {
+    opened = await readAndOpen();
+  } finally {
+    ticket.close();
+  }
+  if (!opened || !self) return;
+  if (!opened.ok) return void refuseHidden(opened.refusal);
+  const host = pin as PeerPin | null;
+  if (!host) return void refuse("unknown_peer");
+
+  const answer = (response: PeerResponse, outcome: Outcome, route: string) => {
+    const sealed = sealResponse({
+      resKey: opened.resKey,
+      nonce: opened.nonce,
+      signKey: self.signKey,
+      response,
+    });
+    audit(
+      outcome,
+      response.status,
+      route,
+      opened.request.method.slice(0, 10),
+      opened.request.body.length + response.body.length
+    );
+    res.statusCode = 200;
+    res.setHeader("Content-Type", "application/octet-stream");
+    res.setHeader("Cache-Control", "no-store");
+    res.end(sealed);
+  };
+
+  const { request } = opened;
+  const match = matchPeerRoute(request.method, request.path, request.query);
+  if (!match.ok)
+    return answer(
+      jsonResponse(403, { error: "That route isn't open to linked machines." }),
+      "denied_route",
+      "(denied)"
+    );
+  let response: PeerResponse;
+  try {
+    response = await deps.dispatch({
+      hostId: host.hostId,
+      method: request.method,
+      path: match.path,
+      query: match.query,
+      contentType: request.contentType,
+      body: request.body,
+    });
+  } catch (err) {
+    response = jsonResponse(502, {
+      error:
+        `Couldn't run that here: ${err instanceof Error ? err.message : String(err)}`.slice(
+          0,
+          300
+        ),
+    });
+  }
+  answer(response, "ok", match.route);
+}
+
+const jsonResponse = (status: number, body: object): PeerResponse => ({
+  status,
+  contentType: "application/json",
+  body: Buffer.from(JSON.stringify(body)),
+});
+
+const CONTENT_TYPE = /^[\w.+-]+\/[\w.+-]+(;[ \w.+=\-"]*)?$/;
+
+/** Re-issues a verified call to this machine's own loopback listener. */
+export function loopbackDispatch(
+  port: number,
+  secret: () => string = peerSecret
+): (d: Dispatch) => Promise<PeerResponse> {
+  return (d) =>
+    new Promise((resolve, reject) => {
+      const contentType =
+        d.contentType.length <= 200 && CONTENT_TYPE.test(d.contentType)
+          ? d.contentType
+          : "application/octet-stream";
+      const out = http.request(
+        {
+          host: "127.0.0.1",
+          port,
+          method: d.method,
+          path: d.query ? `${d.path}?${d.query}` : d.path,
+          headers: {
+            host: `127.0.0.1:${port}`,
+            ...(d.body.length > 0 && { "content-type": contentType }),
+            "content-length": String(d.body.length),
+            [PEER_INTERNAL_HEADER]: secret(),
+            [PEER_HEADER]: d.hostId,
+          },
+          timeout: DISPATCH_TIMEOUT_MS,
+        },
+        (res) => {
+          const chunks: Buffer[] = [];
+          let total = 0;
+          res.on("data", (c: Buffer) => {
+            total += c.length;
+            if (total > MAX_RESPONSE_BODY) {
+              res.destroy();
+              return reject(new Error("its answer is too large"));
+            }
+            chunks.push(c);
+          });
+          res.on("end", () =>
+            resolve({
+              status: res.statusCode ?? 502,
+              contentType: String(res.headers["content-type"] ?? ""),
+              body: Buffer.concat(chunks),
+            })
+          );
+          res.on("error", reject);
+        }
+      );
+      out.on("timeout", () => out.destroy(new Error("timed out")));
+      out.on("error", reject);
+      out.end(d.body);
+    });
+}
+
+/** The real dependencies: this machine's keys, its pins and its listener. */
+export function rpcDeps(port: number): RpcDeps {
+  let box: BoxKey | null = null;
+  return {
+    identity: () => currentIdentity(),
+    boxKey: () => (box ??= loadBoxKey()),
+    pinForMachine,
+    anyActive: hasActivePin,
+    replay: createReplayGuard({ store: sqliteNonceStore() }),
+    dispatch: loopbackDispatch(port),
+    audit: recordPeerCall,
+    budget: createBodyBudget(),
+  };
+}

package/lib/security/auth.ts

@@ -10,20 +10,33 @@
  */
 
 import type { IncomingHttpHeaders } from "http";
+import { peerTargetAllowed } from "../peer/allowlist";
+import { secretMatches } from "../peer/internal";
 
 export const DEVICE_COOKIE = "aos_device";
 // Set by server.ts on every request after stripping any client-sent copy.
 export const DEVICE_HEADER = "x-agentos-device";
 export const TRUST_HEADER = "x-agentos-trust";
 export const REMOTE_HEADER = "x-agentos-remote";
+// The rpc server's loopback hop (lib/peer/rpc-server): the per-boot secret,
+// and the linked machine it verified. Never trusted from anywhere else.
+export const PEER_INTERNAL_HEADER = "x-agentos-peer-internal";
+export const PEER_HEADER = "x-agentos-peer";
 
-export type Trust = "loopback" | "tailnet" | "device" | "open";
+/**
+ * `peer`: a linked machine's verified call, re-issued by this machine. It is
+ * never local trust and never an approver, and only reaches its allowlist.
+ */
+export type Trust = "loopback" | "tailnet" | "device" | "open" | "peer";
 
 export type AuthResult =
-  { ok: true; via: Trust; deviceId?: string } | { ok: false };
+  | { ok: true; via: Trust; deviceId?: string; peerHost?: string }
+  // hard: refused outright, even on a path that is otherwise public.
+  | { ok: false; hard?: true };
 
 export interface AuthRequest {
   url?: string;
+  method?: string;
   headers: IncomingHttpHeaders;
   remoteAddress?: string;
   localAddress?: string;
@@ -47,11 +60,14 @@ export interface AuthPolicy {
   /** AGENTOS_AUTH=off: someone else's proxy does the login. */
   off?: boolean;
   lookup: (token: string) => { id: string } | null;
+  /** The rpc server's per-boot secret; without it no request is a peer. */
+  peerSecret?: () => string;
 }
 
 const TAILSCALE_V4 = /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./;
 const LOOPBACK = new Set(["127.0.0.1", "::1"]);
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
+const PEER_HOST_ID = /^[A-Za-z0-9_.-]{1,128}$/;
 // A proxy must send one of these, or it looks like this machine itself.
 // Proxies that send none need AGENTOS_AUTH, see docs/reference/security.md.
 const FORWARDING = new Set([
@@ -64,12 +80,13 @@ const FORWARDING = new Set([
 ]);
 const FORWARDING_PREFIXES = ["x-forwarded-", "cf-", "tailscale-"];
 
-// Reached without a token: the pairing page, what it needs to render, and
-// the claim it posts. Exact paths, plus a few static asset folders whose
+// Reached without a token: the pairing page, what it needs to render, the
+// claim it posts, and a linked machine's rpc (its envelope is the proof). Exact paths, plus a few static asset folders whose
 // paths may only use plain characters (no traversal, no encoding).
 const PUBLIC_EXACT = new Set([
   "/pair",
   "/api/pair/claim",
+  "/api/peer/rpc",
   "/manifest.webmanifest",
   "/manifest.json",
   "/favicon.ico",
@@ -155,11 +172,31 @@ export function authorize(req: AuthRequest, policy: AuthPolicy): AuthResult {
   try {
     return decide(req, policy);
   } catch {
-    return { ok: false };
+    return req.headers[PEER_INTERNAL_HEADER] !== undefined
+      ? { ok: false, hard: true }
+      : { ok: false };
   }
 }
 
+/**
+ * A request carrying the internal header is a peer call or nothing: it
+ * never falls back to loopback trust, whatever its address says.
+ */
+function peerTrust(req: AuthRequest, policy: AuthPolicy): AuthResult {
+  const refuse = { ok: false, hard: true } as const;
+  if (req.tunnel || !policy.peerSecret || proxied(req.headers)) return refuse;
+  if (!LOOPBACK.has(plainAddress(req.remoteAddress))) return refuse;
+  if (!secretMatches(req.headers[PEER_INTERNAL_HEADER], policy.peerSecret()))
+    return refuse;
+  const host = req.headers[PEER_HEADER];
+  if (typeof host !== "string" || !PEER_HOST_ID.test(host)) return refuse;
+  if (!peerTargetAllowed(req.method, req.url)) return refuse;
+  return { ok: true, via: "peer", deviceId: `peer:${host}`, peerHost: host };
+}
+
 function decide(req: AuthRequest, policy: AuthPolicy): AuthResult {
+  if (req.headers[PEER_INTERNAL_HEADER] !== undefined)
+    return peerTrust(req, policy);
   const trusted = req.tunnel ? null : networkTrust(req, policy);
   const token = readToken(req.headers);
   if (trusted) {

package/lib/security/gate.ts

@@ -14,6 +14,8 @@ import {
   DEVICE_HEADER,
   TRUST_HEADER,
   REMOTE_HEADER,
+  PEER_HEADER,
+  PEER_INTERNAL_HEADER,
   type AuthPolicy,
   type AuthResult,
 } from "./auth";
@@ -22,6 +24,7 @@ import { deviceForToken, touchDevice, trackDeviceSocket } from "./devices";
 import { tailscaleAddresses } from "./net";
 import { networkSetting } from "./network-settings";
 import { pairLocation } from "../session-url";
+import { peerSecret } from "../peer/internal";
 
 // Interface addresses change rarely; don't re-read them on every request.
 let tailnetCache = { at: 0, ips: [] as string[] };
@@ -42,6 +45,7 @@ export function authPolicy(env = process.env): AuthPolicy {
     },
     off: env.AGENTOS_AUTH === "off",
     lookup: deviceForToken,
+    peerSecret,
   };
 }
 
@@ -54,21 +58,36 @@ function decide(req: IncomingMessage, policy: AuthPolicy): AuthResult {
   // Never trust a client-supplied verdict.
   delete req.headers[DEVICE_HEADER];
   delete req.headers[TRUST_HEADER];
+  // A peer's identity only ever comes with the internal secret.
+  if (req.headers[PEER_INTERNAL_HEADER] === undefined)
+    delete req.headers[PEER_HEADER];
   const tunnel = isTunnelSocket(req.socket);
   req.headers[REMOTE_HEADER] = sourceLabel(req.socket.remoteAddress, tunnel);
-  const result = authorize(
-    {
-      url: req.url,
-      headers: req.headers,
-      remoteAddress: req.socket.remoteAddress,
-      localAddress: req.socket.localAddress,
-      tunnel,
-    },
-    policy
-  );
+  let result: AuthResult;
+  try {
+    result = authorize(
+      {
+        url: req.url,
+        method: req.method,
+        headers: req.headers,
+        remoteAddress: req.socket.remoteAddress,
+        localAddress: req.socket.localAddress,
+        tunnel,
+      },
+      policy
+    );
+  } finally {
+    // No route ever sees the secret.
+    delete req.headers[PEER_INTERNAL_HEADER];
+  }
+  delete req.headers[PEER_HEADER];
   if (result.ok) {
     req.headers[TRUST_HEADER] = result.via;
     if (result.deviceId) req.headers[DEVICE_HEADER] = result.deviceId;
+    if (result.peerHost) {
+      req.headers[PEER_HEADER] = result.peerHost;
+      req.headers[REMOTE_HEADER] = "peer";
+    }
   }
   return result;
 }
@@ -81,6 +100,8 @@ function check(req: IncomingMessage, policy: AuthPolicy): AuthResult {
     console.error("access check failed:", err);
     delete req.headers[TRUST_HEADER];
     delete req.headers[DEVICE_HEADER];
+    delete req.headers[PEER_HEADER];
+    delete req.headers[PEER_INTERNAL_HEADER];
     return { ok: false };
   }
 }
@@ -102,6 +123,7 @@ export function gateRequest(
 ): boolean {
   const result = check(req, policy);
   if (result.ok) {
+    if (result.via === "peer") return true;
     // Slide the cookie's expiry forward, at most once a minute per device.
     const cookie = result.deviceId ? cookieToken(req.headers) : null;
     if (result.deviceId && touch(req, result.deviceId) && cookie) {
@@ -114,7 +136,7 @@ export function gateRequest(
     }
     return true;
   }
-  if (isPublicPath(req.url)) return true;
+  if (!result.hard && isPublicPath(req.url)) return true;
   const path = (req.url ?? "/").split("?")[0];
   const wantsPage =
     !path.startsWith("/api/") &&
@@ -139,7 +161,8 @@ export function gateUpgrade(
   policy: AuthPolicy
 ): boolean {
   const result = check(req, policy);
-  if (!result.ok) {
+  // A peer reaches its allowlisted routes and never a socket.
+  if (!result.ok || result.via === "peer") {
     socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
     socket.destroy();
     return false;

package/lib/security/route-guard.ts

@@ -1,6 +1,8 @@
 /**
  * For actions a stolen device token must not be able to take (adding
- * devices, opening up the network): only this machine or the tailnet.
+ * devices, opening up the network): only this machine or the tailnet. A
+ * linked machine's call (`peer`) never passes, even though it arrives on
+ * loopback.
  */
 
 import { NextResponse, type NextRequest } from "next/server";

package/lib/session-artifacts/peer.ts

@@ -8,7 +8,12 @@
 import { ARTIFACT_HEADERS } from "../artifacts/serve";
 import { IMAGE_TYPES } from "../artifacts/image-paths";
 import { IMAGE_CSP } from "../artifacts/serve";
-import { cleanRemoteText, hostApi, type HostLink } from "../hosts/remote-api";
+import {
+  cleanRemoteText,
+  hostApi,
+  isConnectLink,
+  type HostLink,
+} from "../hosts/remote-api";
 import type {
   ArtifactKind,
   ArtifactPreview,
@@ -148,6 +153,12 @@ export async function peerContent(
 ): Promise<Content> {
   if (!ID.test(artifactId))
     return { ok: false, status: 404, error: "Not found" };
+  if (isConnectLink(link))
+    return {
+      ok: false,
+      status: 409,
+      error: `${link.hostName} is linked through Connect: artifacts need a Tailscale/ssh link for now`,
+    };
   let res: Response;
   try {
     res = await fetch(

package/lib/tasks/contract/authorize.ts

@@ -9,6 +9,10 @@
  *    (which sends no device) is never refused on them.
  *  - plan: open, and a plan another machine placed here is read and approved
  *    by that machine only.
+ *
+ * The caller is the gate's device id. A machine linked through Connect is
+ * `peer:<host id>` (lib/security/gate.ts), with no Can approve: the same
+ * standing a linked machine's device token has.
  */
 
 import { NextRequest, NextResponse } from "next/server";

package/lib/tasks/contract/plan.ts

@@ -16,10 +16,6 @@ import { isRemoteHost } from "../../hosts";
 import { peerSource } from "../../hosts/peer-load";
 import { hostLink, requireHostLink } from "../../hosts/remote-api";
 import { LOCAL, machineCapabilities } from "../../load/machines";
-import {
-  noApprovalsOn,
-  recordAutoApproval,
-} from "../../approvals/no-approvals";
 import { implementArrived, planNoteFor } from "../../models/plan-step";
 import { sessionWorkspace } from "../../models/resolve";
 import { queueEvent } from "../../orchestrator/events";
@@ -112,8 +108,7 @@ export async function planWritten(
   // As for a task planned here: a plan-first task goes on by itself, a
   // plan-only one waits unless no-approvals is on, and pieces that couldn't
   // be registered always hold it.
-  const auto = !!fresh.plan_only && noApprovalsOn();
-  const goOn = (!fresh.plan_only || auto) && !errors.length;
+  const goOn = !fresh.plan_only && !errors.length;
   const target = goOn ? implementTarget(fresh, split) : null;
   const next =
     target === "there"
@@ -148,14 +143,6 @@ export async function planWritten(
     return;
   }
   await continuePlanThere(fresh);
-  if (auto)
-    recordAutoApproval({
-      source: "plan",
-      workspaceId,
-      sessionId: s.id,
-      subject: `plan for ${s.name}`,
-      detail: "implementing without waiting for approve_plan",
-    });
 }
 
 /**

package/lib/worktree-sweep/testTemp.ts

@@ -37,6 +37,7 @@ export const TEST_TEMP_PREFIXES: readonly string[] = [
   "aos-kind-",
   "aos-launch-plain-",
   "aos-launch-repo-",
+  "aos-machine-",
   "aos-limits-",
   "aos-mcp-",
   "aos-merge-policy-",
@@ -66,6 +67,8 @@ export const TEST_TEMP_PREFIXES: readonly string[] = [
   "aos-orch-sweep-",
   "aos-origin-",
   "aos-path-",
+  "aos-peer-connect-",
+  "aos-peer-keys-",
   "aos-plain-",
   "aos-plan-",
   "aos-ports-",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.694",
+  "version": "0.3.698",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/install-deps

@@ -13,7 +13,12 @@ source scripts/lib/pnpm.sh
 if [ -s "$HOME/.nvm/nvm.sh" ]; then
   # shellcheck disable=SC1091
   source "$HOME/.nvm/nvm.sh" >/dev/null
-  nvm use >/dev/null
+  # A box with nvm but without .nvmrc's version (a CI runner) keeps the node on PATH.
+  nvm use >/dev/null 2>&1 || true
+fi
+if [ "$(node -p 'process.versions.node.split(".")[0]')" -lt 22 ]; then
+  echo "Node 22 or newer is required (found $(node -v)); run: nvm install" >&2
+  exit 1
 fi
 use_pnpm
 

package/scripts/lib/commands.sh

@@ -189,7 +189,7 @@ cmd_stop() {
     while ps -p "$pid" &> /dev/null && [[ $count -lt 10 ]]; do
         printf "."
         sleep 1
-        ((count++))
+        count=$((count + 1))
     done
     echo ""