@saadnvd1/agent-os 0.3.697 → 0.3.698

package/app/api/peer/ping/route.ts

@@ -0,0 +1,10 @@
+import { NextResponse } from "next/server";
+import { appVersion } from "@/lib/connect/heartbeat";
+
+export const dynamic = "force-dynamic";
+
+// What a linked machine asks first: which version answers, and which peer
+// features it speaks. Nothing about this machine's sessions or paths.
+export function GET() {
+  return NextResponse.json({ version: appVersion(), capabilities: ["rpc-v1"] });
+}

package/lib/__fixtures__/connect-transport.ts

@@ -0,0 +1,93 @@
+import { createConnectHost } from "../hosts";
+import { RPC_PATH, openRequest, sealResponse } from "../peer/envelope";
+import { signPublic } from "../peer/keys";
+import { savePin } from "../peer/links";
+import { createReplayGuard } from "../peer/replay";
+import { fakeMachine, writeConnectDir, type FakeMachine } from "./peer-machine";
+
+type Inner = (url: string, init: RequestInit) => Promise<Response>;
+
+/**
+ * The other machine's side of the Connect transport, for tests written
+ * against the token transport: it opens each envelope as that machine would
+ * and hands the inner call to `inner` as a plain `<baseUrl><path>` fetch, so
+ * the same mock answers either transport. Anything not a valid envelope to
+ * that machine is refused the way rpc-server refuses it; calls to any other
+ * machine go to `inner` unchanged.
+ */
+export function connectFetch(
+  inner: Inner,
+  o: { peer: FakeMachine; from: FakeMachine; baseUrl: string }
+): typeof fetch {
+  const replay = createReplayGuard();
+  return (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = new URL(String(input));
+    // Another machine on a token link answers as it always has.
+    if (url.hostname !== o.peer.hostname)
+      return inner(String(input), init ?? {});
+    if (url.pathname !== RPC_PATH) throw new Error(`unexpected fetch ${url}`);
+    const opened = openRequest(Buffer.from(init?.body as Uint8Array), {
+      self: o.peer.machineId,
+      boxKey: o.peer.box.privateKey,
+      signKeyFor: (id) =>
+        id === o.from.machineId ? signPublic(o.from.signPub) : "unknown_peer",
+      replay,
+    });
+    if (!opened.ok) return new Response(opened.refusal, { status: 401 });
+    const r = opened.request;
+    const res = await inner(
+      `${o.baseUrl}${r.path}${r.query ? `?${r.query}` : ""}`,
+      {
+        method: r.method,
+        headers: r.contentType ? { "Content-Type": r.contentType } : {},
+        body: r.body.length ? r.body.toString("utf8") : undefined,
+      }
+    );
+    const sealed = sealResponse({
+      resKey: opened.resKey,
+      nonce: opened.nonce,
+      signKey: o.peer.signKey,
+      response: {
+        status: res.status,
+        contentType: res.headers.get("content-type") ?? "",
+        body: Buffer.from(await res.arrayBuffer()),
+      },
+    });
+    return new Response(new Uint8Array(sealed), { status: 200 });
+  }) as typeof fetch;
+}
+
+/**
+ * A machine linked through Connect, named `name`, whose answers come from
+ * `inner` as if it were at `baseUrl`. This machine's Connect folder is
+ * pointed at a fresh identity.
+ */
+export function connectLinkedHost(
+  name: string,
+  inner: Inner,
+  baseUrl: string
+): {
+  hostId: string;
+  fetch: typeof fetch;
+  /** Every request this machine actually sent, before the peer opened it. */
+  sent: { url: string; init: RequestInit }[];
+} {
+  const self = fakeMachine("aaaa1111");
+  const peer = fakeMachine("bbbb2222");
+  process.env.AGENTOS_CONNECT_DIR = writeConnectDir(self);
+  const hostId = createConnectHost(name).id;
+  savePin({
+    hostId,
+    machineId: peer.machineId,
+    hostname: peer.hostname,
+    signPub: peer.signPub,
+    boxPub: peer.box.publicRaw,
+  });
+  const sent: { url: string; init: RequestInit }[] = [];
+  const answer = connectFetch(inner, { peer, from: self, baseUrl });
+  const outer = ((input: string | URL | Request, init?: RequestInit) => {
+    sent.push({ url: String(input), init: init ?? {} });
+    return answer(input, init);
+  }) as typeof fetch;
+  return { hostId, fetch: outer, sent };
+}

package/lib/__fixtures__/peer-machine.ts

@@ -0,0 +1,45 @@
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import { tempDir } from "../test-temp";
+import { rawPublic, type BoxKey, type Identity } from "../peer/keys";
+
+/** A Connect machine's keys, for tests: never on disk unless asked. */
+export interface FakeMachine extends Identity {
+  box: BoxKey;
+  hostname: string;
+}
+
+export function fakeMachine(machineId: string): FakeMachine {
+  const sign = crypto.generateKeyPairSync("ed25519");
+  const box = crypto.generateKeyPairSync("x25519");
+  return {
+    machineId,
+    signKey: sign.privateKey,
+    signPub: rawPublic(sign.publicKey),
+    box: { privateKey: box.privateKey, publicRaw: rawPublic(box.publicKey) },
+    hostname: `m-${crypto.randomBytes(8).toString("hex")}.runagentos.com`,
+  };
+}
+
+/** Writes the machine's Connect folder (connect.json, machine.key, peer.key). */
+export function writeConnectDir(m: FakeMachine): string {
+  const dir = tempDir("aos-peer-connect-");
+  fs.writeFileSync(
+    path.join(dir, "connect.json"),
+    JSON.stringify({
+      machineId: m.machineId,
+      hostname: m.hostname,
+      apiUrl: "https://connect.example.test",
+    })
+  );
+  fs.writeFileSync(
+    path.join(dir, "machine.key"),
+    m.signKey.export({ format: "pem", type: "pkcs8" })
+  );
+  fs.writeFileSync(
+    path.join(dir, "peer.key"),
+    m.box.privateKey.export({ format: "pem", type: "pkcs8" })
+  );
+  return dir;
+}

package/lib/__fixtures__/peer-rpc.ts

@@ -0,0 +1,224 @@
+/**
+ * Two AgentOS machines' rpc front ends for the peer tests: each with a
+ * loopback listener and a tunnel listener, a fake Next behind the gate, and
+ * an edge that routes https://<m- name>/… to the right tunnel.
+ */
+
+import http, { type IncomingMessage, type ServerResponse } from "http";
+import type { AddressInfo } from "net";
+import type { FakeMachine } from "@/lib/__fixtures__/peer-machine";
+import { tunnelListener } from "@/lib/connect/serve";
+import { getDb } from "@/lib/db";
+import { gateRequest, gateUpgrade } from "@/lib/security/gate";
+import type { AuthPolicy } from "@/lib/security/auth";
+import { recordPeerCall } from "@/lib/peer/audit";
+import { peerSecret } from "@/lib/peer/internal";
+import type { PeerPin } from "@/lib/peer/links";
+import { createReplayGuard } from "@/lib/peer/replay";
+import {
+  createBodyBudget,
+  handlePeerRpc,
+  isPeerRpc,
+  loopbackDispatch,
+  type RpcDeps,
+} from "@/lib/peer/rpc-server";
+
+export interface Seen {
+  method: string;
+  url: string;
+  headers: IncomingMessage["headers"];
+  body: string;
+}
+
+/** What Next would be: echoes how the gate saw the call. */
+function fakeNext(seen: Seen[]) {
+  return async (req: IncomingMessage, res: ServerResponse) => {
+    let body = "";
+    for await (const c of req) body += c;
+    seen.push({
+      method: req.method ?? "",
+      url: req.url ?? "",
+      headers: { ...req.headers },
+      body,
+    });
+    res.setHeader("Content-Type", "application/json");
+    res.setHeader("Set-Cookie", "aos_device=leak");
+    if (req.url?.startsWith("/api/tasks/t-9/merge")) {
+      res.statusCode = 409;
+      return res.end(JSON.stringify({ error: "not mergeable" }));
+    }
+    res.end(
+      JSON.stringify({
+        url: req.url,
+        method: req.method,
+        trust: req.headers["x-agentos-trust"],
+        device: req.headers["x-agentos-device"],
+        peer: req.headers["x-agentos-peer"],
+        internal: req.headers["x-agentos-peer-internal"] ?? null,
+        body: body ? JSON.parse(body) : null,
+      })
+    );
+  };
+}
+
+export interface Machine {
+  hostname: string;
+  tunnelPort: number;
+  seen: Seen[];
+  deps: RpcDeps;
+  close: () => Promise<void>;
+}
+
+const listen = (s: http.Server) =>
+  new Promise<number>((r) =>
+    s.listen(0, "127.0.0.1", () => r((s.address() as AddressInfo).port))
+  );
+
+/** One machine's AgentOS: its loopback listener and its tunnel listener. */
+export async function machine(
+  me: FakeMachine,
+  pinFor: (machineId: string) => PeerPin | null
+): Promise<Machine> {
+  const seen: Seen[] = [];
+  const policy: AuthPolicy = {
+    tailnet: [],
+    lookup: (t) => (t === "aosd_phone" ? { id: "phone" } : null),
+    peerSecret,
+  };
+  const next = fakeNext(seen);
+  let internalPort = 0;
+  const deps: RpcDeps = {
+    identity: () => me,
+    boxKey: () => me.box,
+    pinForMachine: pinFor,
+    anyActive: () => true,
+    replay: createReplayGuard(),
+    dispatch: (d: Parameters<ReturnType<typeof loopbackDispatch>>[0]) =>
+      loopbackDispatch(internalPort)(d),
+    audit: recordPeerCall,
+    budget: createBodyBudget(),
+  };
+  const onRequest = (req: IncomingMessage, res: ServerResponse) => {
+    if (!gateRequest(req, res, policy)) return;
+    if (isPeerRpc(req)) return void handlePeerRpc(req, res, deps);
+    void next(req, res);
+  };
+  const internal = http.createServer(onRequest);
+  internalPort = await listen(internal);
+  const tunnel = tunnelListener(() => me.hostname, {
+    onRequest,
+    onUpgrade: (req, socket) => {
+      if (!gateUpgrade(req, socket, policy)) return;
+      socket.end("HTTP/1.1 101 Switching Protocols\r\n\r\n");
+    },
+  });
+  const tunnelPort = await listen(tunnel);
+  return {
+    hostname: me.hostname,
+    tunnelPort,
+    seen,
+    deps,
+    close: async () => {
+      await new Promise((r) => internal.close(r));
+      await new Promise((r) => tunnel.close(r));
+    },
+  };
+}
+
+/** What Cloudflare does: https://<m- name>/… to that machine's tunnel. */
+export function edge(
+  machines: Machine[],
+  tamper?: (body: Buffer) => Buffer
+): typeof fetch {
+  return (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = new URL(String(input));
+    const m = machines.find((x) => x.hostname === url.hostname);
+    if (url.protocol !== "https:" || !m) throw new Error("no such host");
+    const body = init?.body ? Buffer.from(init.body as Uint8Array) : undefined;
+    const { status, buf } = await new Promise<{ status: number; buf: Buffer }>(
+      (resolve, reject) => {
+        const out = http.request(
+          {
+            host: "127.0.0.1",
+            port: m.tunnelPort,
+            method: init?.method ?? "GET",
+            path: url.pathname + url.search,
+            headers: {
+              ...(init?.headers as Record<string, string>),
+              host: url.hostname,
+              ...(body && { "content-length": String(body.length) }),
+            },
+          },
+          (res) => {
+            const chunks: Buffer[] = [];
+            res.on("data", (c) => chunks.push(c));
+            res.on("end", () =>
+              resolve({
+                status: res.statusCode ?? 0,
+                buf: Buffer.concat(chunks),
+              })
+            );
+          }
+        );
+        out.on("error", reject);
+        out.end(body);
+      }
+    );
+    return new Response(new Uint8Array(tamper ? tamper(buf) : buf), { status });
+  }) as typeof fetch;
+}
+
+/** Inbound audit outcomes on a route, oldest first. */
+export const outcomesOf = (route: string) =>
+  (
+    getDb()
+      .prepare(`SELECT outcome FROM peer_audit WHERE route = ? ORDER BY id`)
+      .all(route) as { outcome: string }[]
+  ).map((r) => r.outcome);
+
+/** A raw POST to a machine's rpc through the edge. */
+export async function post(m: Machine, body: Buffer) {
+  const res = await fetch(`https://${m.hostname}/api/peer/rpc`, {
+    method: "POST",
+    body: new Uint8Array(body),
+  });
+  return { status: res.status, text: await res.text() };
+}
+
+/** An envelope sent to the tunnel only up to `upTo` bytes, the rest held back. */
+export function partial(m: Machine, envelope: Buffer, upTo: number) {
+  const out = http.request({
+    host: "127.0.0.1",
+    port: m.tunnelPort,
+    method: "POST",
+    path: "/api/peer/rpc",
+    headers: { host: m.hostname, "content-length": String(envelope.length) },
+  });
+  let answered = false;
+  const response = new Promise<{ status: number; text: string }>(
+    (resolve, reject) => {
+      out.on("response", (res) => {
+        answered = true;
+        let text = "";
+        res.on("data", (c) => (text += c));
+        res.on("end", () => resolve({ status: res.statusCode ?? 0, text }));
+      });
+      out.on("error", (err) => (answered ? undefined : reject(err)));
+    }
+  );
+  response.catch(() => {});
+  const closed = new Promise((r) => out.on("close", r));
+  if (upTo > 0) out.write(envelope.subarray(0, upTo));
+  else out.flushHeaders();
+  return {
+    response,
+    closed,
+    within: (ms: number) =>
+      Promise.race([
+        response.then(() => "answered"),
+        new Promise((r) => setTimeout(() => r("pending"), ms)),
+      ]),
+    finish: () => out.end(envelope.subarray(upTo)),
+    destroy: () => out.destroy(),
+  };
+}

package/lib/db/migrations/20261020T1258_peer_links.ts

@@ -0,0 +1,49 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261020T1258_peer_links",
+  up: (db) => {
+    // A machine linked through Connect (lib/peer): its pinned keys, never a
+    // token. Foreign keys aren't enforced here, so deleteHost removes the pin.
+    db.exec(`CREATE TABLE IF NOT EXISTS peer_links (
+      host_id TEXT PRIMARY KEY REFERENCES hosts(id) ON DELETE CASCADE,
+      machine_id TEXT NOT NULL UNIQUE,
+      hostname TEXT NOT NULL,
+      sign_pub TEXT NOT NULL,
+      box_pub TEXT NOT NULL,
+      state TEXT NOT NULL DEFAULT 'active',
+      suspended_reason TEXT,
+      paired_at TEXT NOT NULL DEFAULT (datetime('now')),
+      last_ok_at TEXT,
+      last_error TEXT
+    )`);
+    // Every peer call, both directions. Successful polling reads fold into
+    // one row per route per hour (`bucket`, `count`).
+    db.exec(`CREATE TABLE IF NOT EXISTS peer_audit (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      at INTEGER NOT NULL,
+      host_id TEXT,
+      machine_id TEXT,
+      direction TEXT NOT NULL,
+      method TEXT NOT NULL,
+      route TEXT NOT NULL,
+      status INTEGER NOT NULL,
+      ms INTEGER NOT NULL DEFAULT 0,
+      bytes INTEGER NOT NULL DEFAULT 0,
+      outcome TEXT NOT NULL,
+      bucket TEXT,
+      count INTEGER NOT NULL DEFAULT 1
+    )`);
+    db.exec(
+      `CREATE INDEX IF NOT EXISTS idx_peer_audit_host_at ON peer_audit(host_id, at)`
+    );
+    db.exec(
+      `CREATE INDEX IF NOT EXISTS idx_peer_audit_bucket ON peer_audit(host_id, direction, route, bucket)`
+    );
+    const cols = db.prepare(`PRAGMA table_info(hosts)`).all() as {
+      name: string;
+    }[];
+    if (!cols.some((c) => c.name === "kind"))
+      db.exec(`ALTER TABLE hosts ADD COLUMN kind TEXT NOT NULL DEFAULT 'ssh'`);
+  },
+} satisfies Migration;

package/lib/db/migrations/20261020T1345_peer_nonces.ts

@@ -0,0 +1,18 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261020T1345_peer_nonces",
+  up: (db) => {
+    // Nonces of linked machines' envelopes (lib/peer/replay.ts), kept until
+    // their timestamp would be stale anyway, so a restart can't replay one.
+    db.exec(`CREATE TABLE IF NOT EXISTS peer_nonces (
+      machine_id TEXT NOT NULL,
+      nonce TEXT NOT NULL,
+      until INTEGER NOT NULL,
+      PRIMARY KEY (machine_id, nonce)
+    )`);
+    db.exec(
+      `CREATE INDEX IF NOT EXISTS idx_peer_nonces_until ON peer_nonces(until)`
+    );
+  },
+} satisfies Migration;

package/lib/db/types.ts

@@ -306,6 +306,8 @@ export interface Host {
   ssh_target: string;
   sort_order: number;
   created_at: string;
+  // 'connect': reached only through Connect (lib/peer), ssh_target is ''.
+  kind?: "ssh" | "connect";
   // Paired with that machine's own AgentOS (lib/hosts/link.ts); 0/1 from SQLite.
   linked?: boolean | number;
 }

package/lib/hosts/index.ts

@@ -14,6 +14,7 @@ export const LOCAL_HOST: Host = {
   id: LOCAL_HOST_ID,
   name: "This machine",
   ssh_target: "",
+  kind: "ssh",
   sort_order: -1,
   created_at: "",
 };
@@ -25,7 +26,10 @@ export function isRemoteHost(hostId: string | null | undefined): boolean {
 export function listRemoteHosts(): Host[] {
   return getDb()
     .prepare(
-      `SELECT h.*, EXISTS (SELECT 1 FROM host_links l WHERE l.host_id = h.id) AS linked
+      `SELECT h.*, CASE WHEN h.kind = 'connect'
+          THEN EXISTS (SELECT 1 FROM peer_links p WHERE p.host_id = h.id)
+          ELSE EXISTS (SELECT 1 FROM host_links l WHERE l.host_id = h.id)
+        END AS linked
          FROM hosts h ORDER BY sort_order, created_at`
     )
     .all() as Host[];
@@ -54,22 +58,34 @@ export function hostIdNamed(ref: string): string {
   return host.id;
 }
 
-export function createHost(name: string, sshTarget: string): Host {
+function insertHost(
+  name: string,
+  sshTarget: string,
+  kind: "ssh" | "connect"
+): Host {
   if (!name.trim()) throw new Error("Name is required");
-  if (!isValidSshTarget(sshTarget)) {
-    throw new Error("ssh target must look like user@host or an ssh alias");
-  }
   const db = getDb();
   const id = randomUUID();
   const { max } = db
     .prepare(`SELECT COALESCE(MAX(sort_order), 0) AS max FROM hosts`)
     .get() as { max: number };
   db.prepare(
-    `INSERT INTO hosts (id, name, ssh_target, sort_order) VALUES (?, ?, ?, ?)`
-  ).run(id, name.trim(), sshTarget, max + 1);
+    `INSERT INTO hosts (id, name, ssh_target, sort_order, kind) VALUES (?, ?, ?, ?, ?)`
+  ).run(id, name.trim(), sshTarget, max + 1, kind);
   return getHost(id)!;
 }
 
+export function createHost(name: string, sshTarget: string): Host {
+  if (!isValidSshTarget(sshTarget)) {
+    throw new Error("ssh target must look like user@host or an ssh alias");
+  }
+  return insertHost(name, sshTarget, "ssh");
+}
+
+/** A machine reached only through Connect; its keys are pinned separately. */
+export const createConnectHost = (name: string): Host =>
+  insertHost(name, "", "connect");
+
 export function deleteHost(hostId: string): void {
   if (!isRemoteHost(hostId)) throw new Error("Cannot remove this machine");
   const db = getDb();
@@ -83,6 +99,7 @@ export function deleteHost(hostId: string): void {
     throw new Error("Move or delete its projects and sessions first");
   }
   db.prepare(`DELETE FROM host_links WHERE host_id = ?`).run(hostId);
+  db.prepare(`DELETE FROM peer_links WHERE host_id = ?`).run(hostId);
   db.prepare(`DELETE FROM hosts WHERE id = ?`).run(hostId);
 }
 
@@ -90,6 +107,10 @@ export function sshTargetFor(hostId: string | null | undefined): string | null {
   if (!isRemoteHost(hostId)) return null;
   const host = getHost(hostId);
   if (!host) throw new Error(`Unknown host: ${hostId}`);
+  if (host.kind === "connect")
+    throw new Error(
+      `${host.name} is linked through Connect: this needs a Tailscale/ssh link`
+    );
   return host.ssh_target;
 }
 

package/lib/hosts/peer-socket.ts

@@ -7,7 +7,7 @@
  */
 
 import { WebSocket } from "ws";
-import type { HostLink } from "./remote-api";
+import { requireTokenLink, type HostLink } from "./remote-api";
 
 export const PEER_HANDSHAKE_MS = 10_000;
 // A long chat's (paged) snapshot is one message.
@@ -30,6 +30,8 @@ export function openPeerSocket(
   query: Record<string, string> = {},
   maxPayload = PEER_MAX_PAYLOAD
 ): WebSocket {
+  // A Connect link has no token, and sockets don't ride the envelope yet.
+  requireTokenLink(link);
   return new WebSocket(peerSocketUrl(link, path, query), {
     headers: { Authorization: `Bearer ${link.token}` },
     handshakeTimeout: PEER_HANDSHAKE_MS,

package/lib/hosts/read-capped-bytes.ts

@@ -0,0 +1,23 @@
+/** A response body, read no further than max bytes whatever it claims. */
+export async function readCappedBytes(
+  res: Response,
+  max: number
+): Promise<Buffer> {
+  if (Number(res.headers.get("content-length")) > max)
+    throw new Error("its answer is too large");
+  const reader = res.body?.getReader();
+  if (!reader) return Buffer.alloc(0);
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > max) {
+      await reader.cancel().catch(() => undefined);
+      throw new Error("its answer is too large");
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks);
+}