@saadnvd1/agent-os 0.3.697 → 0.3.698

package/lib/security/auth.ts

@@ -10,20 +10,33 @@
  */
 
 import type { IncomingHttpHeaders } from "http";
+import { peerTargetAllowed } from "../peer/allowlist";
+import { secretMatches } from "../peer/internal";
 
 export const DEVICE_COOKIE = "aos_device";
 // Set by server.ts on every request after stripping any client-sent copy.
 export const DEVICE_HEADER = "x-agentos-device";
 export const TRUST_HEADER = "x-agentos-trust";
 export const REMOTE_HEADER = "x-agentos-remote";
+// The rpc server's loopback hop (lib/peer/rpc-server): the per-boot secret,
+// and the linked machine it verified. Never trusted from anywhere else.
+export const PEER_INTERNAL_HEADER = "x-agentos-peer-internal";
+export const PEER_HEADER = "x-agentos-peer";
 
-export type Trust = "loopback" | "tailnet" | "device" | "open";
+/**
+ * `peer`: a linked machine's verified call, re-issued by this machine. It is
+ * never local trust and never an approver, and only reaches its allowlist.
+ */
+export type Trust = "loopback" | "tailnet" | "device" | "open" | "peer";
 
 export type AuthResult =
-  { ok: true; via: Trust; deviceId?: string } | { ok: false };
+  | { ok: true; via: Trust; deviceId?: string; peerHost?: string }
+  // hard: refused outright, even on a path that is otherwise public.
+  | { ok: false; hard?: true };
 
 export interface AuthRequest {
   url?: string;
+  method?: string;
   headers: IncomingHttpHeaders;
   remoteAddress?: string;
   localAddress?: string;
@@ -47,11 +60,14 @@ export interface AuthPolicy {
   /** AGENTOS_AUTH=off: someone else's proxy does the login. */
   off?: boolean;
   lookup: (token: string) => { id: string } | null;
+  /** The rpc server's per-boot secret; without it no request is a peer. */
+  peerSecret?: () => string;
 }
 
 const TAILSCALE_V4 = /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./;
 const LOOPBACK = new Set(["127.0.0.1", "::1"]);
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
+const PEER_HOST_ID = /^[A-Za-z0-9_.-]{1,128}$/;
 // A proxy must send one of these, or it looks like this machine itself.
 // Proxies that send none need AGENTOS_AUTH, see docs/reference/security.md.
 const FORWARDING = new Set([
@@ -64,12 +80,13 @@ const FORWARDING = new Set([
 ]);
 const FORWARDING_PREFIXES = ["x-forwarded-", "cf-", "tailscale-"];
 
-// Reached without a token: the pairing page, what it needs to render, and
-// the claim it posts. Exact paths, plus a few static asset folders whose
+// Reached without a token: the pairing page, what it needs to render, the
+// claim it posts, and a linked machine's rpc (its envelope is the proof). Exact paths, plus a few static asset folders whose
 // paths may only use plain characters (no traversal, no encoding).
 const PUBLIC_EXACT = new Set([
   "/pair",
   "/api/pair/claim",
+  "/api/peer/rpc",
   "/manifest.webmanifest",
   "/manifest.json",
   "/favicon.ico",
@@ -155,11 +172,31 @@ export function authorize(req: AuthRequest, policy: AuthPolicy): AuthResult {
   try {
     return decide(req, policy);
   } catch {
-    return { ok: false };
+    return req.headers[PEER_INTERNAL_HEADER] !== undefined
+      ? { ok: false, hard: true }
+      : { ok: false };
   }
 }
 
+/**
+ * A request carrying the internal header is a peer call or nothing: it
+ * never falls back to loopback trust, whatever its address says.
+ */
+function peerTrust(req: AuthRequest, policy: AuthPolicy): AuthResult {
+  const refuse = { ok: false, hard: true } as const;
+  if (req.tunnel || !policy.peerSecret || proxied(req.headers)) return refuse;
+  if (!LOOPBACK.has(plainAddress(req.remoteAddress))) return refuse;
+  if (!secretMatches(req.headers[PEER_INTERNAL_HEADER], policy.peerSecret()))
+    return refuse;
+  const host = req.headers[PEER_HEADER];
+  if (typeof host !== "string" || !PEER_HOST_ID.test(host)) return refuse;
+  if (!peerTargetAllowed(req.method, req.url)) return refuse;
+  return { ok: true, via: "peer", deviceId: `peer:${host}`, peerHost: host };
+}
+
 function decide(req: AuthRequest, policy: AuthPolicy): AuthResult {
+  if (req.headers[PEER_INTERNAL_HEADER] !== undefined)
+    return peerTrust(req, policy);
   const trusted = req.tunnel ? null : networkTrust(req, policy);
   const token = readToken(req.headers);
   if (trusted) {

package/lib/security/gate.ts

@@ -14,6 +14,8 @@ import {
   DEVICE_HEADER,
   TRUST_HEADER,
   REMOTE_HEADER,
+  PEER_HEADER,
+  PEER_INTERNAL_HEADER,
   type AuthPolicy,
   type AuthResult,
 } from "./auth";
@@ -22,6 +24,7 @@ import { deviceForToken, touchDevice, trackDeviceSocket } from "./devices";
 import { tailscaleAddresses } from "./net";
 import { networkSetting } from "./network-settings";
 import { pairLocation } from "../session-url";
+import { peerSecret } from "../peer/internal";
 
 // Interface addresses change rarely; don't re-read them on every request.
 let tailnetCache = { at: 0, ips: [] as string[] };
@@ -42,6 +45,7 @@ export function authPolicy(env = process.env): AuthPolicy {
     },
     off: env.AGENTOS_AUTH === "off",
     lookup: deviceForToken,
+    peerSecret,
   };
 }
 
@@ -54,21 +58,36 @@ function decide(req: IncomingMessage, policy: AuthPolicy): AuthResult {
   // Never trust a client-supplied verdict.
   delete req.headers[DEVICE_HEADER];
   delete req.headers[TRUST_HEADER];
+  // A peer's identity only ever comes with the internal secret.
+  if (req.headers[PEER_INTERNAL_HEADER] === undefined)
+    delete req.headers[PEER_HEADER];
   const tunnel = isTunnelSocket(req.socket);
   req.headers[REMOTE_HEADER] = sourceLabel(req.socket.remoteAddress, tunnel);
-  const result = authorize(
-    {
-      url: req.url,
-      headers: req.headers,
-      remoteAddress: req.socket.remoteAddress,
-      localAddress: req.socket.localAddress,
-      tunnel,
-    },
-    policy
-  );
+  let result: AuthResult;
+  try {
+    result = authorize(
+      {
+        url: req.url,
+        method: req.method,
+        headers: req.headers,
+        remoteAddress: req.socket.remoteAddress,
+        localAddress: req.socket.localAddress,
+        tunnel,
+      },
+      policy
+    );
+  } finally {
+    // No route ever sees the secret.
+    delete req.headers[PEER_INTERNAL_HEADER];
+  }
+  delete req.headers[PEER_HEADER];
   if (result.ok) {
     req.headers[TRUST_HEADER] = result.via;
     if (result.deviceId) req.headers[DEVICE_HEADER] = result.deviceId;
+    if (result.peerHost) {
+      req.headers[PEER_HEADER] = result.peerHost;
+      req.headers[REMOTE_HEADER] = "peer";
+    }
   }
   return result;
 }
@@ -81,6 +100,8 @@ function check(req: IncomingMessage, policy: AuthPolicy): AuthResult {
     console.error("access check failed:", err);
     delete req.headers[TRUST_HEADER];
     delete req.headers[DEVICE_HEADER];
+    delete req.headers[PEER_HEADER];
+    delete req.headers[PEER_INTERNAL_HEADER];
     return { ok: false };
   }
 }
@@ -102,6 +123,7 @@ export function gateRequest(
 ): boolean {
   const result = check(req, policy);
   if (result.ok) {
+    if (result.via === "peer") return true;
     // Slide the cookie's expiry forward, at most once a minute per device.
     const cookie = result.deviceId ? cookieToken(req.headers) : null;
     if (result.deviceId && touch(req, result.deviceId) && cookie) {
@@ -114,7 +136,7 @@ export function gateRequest(
     }
     return true;
   }
-  if (isPublicPath(req.url)) return true;
+  if (!result.hard && isPublicPath(req.url)) return true;
   const path = (req.url ?? "/").split("?")[0];
   const wantsPage =
     !path.startsWith("/api/") &&
@@ -139,7 +161,8 @@ export function gateUpgrade(
   policy: AuthPolicy
 ): boolean {
   const result = check(req, policy);
-  if (!result.ok) {
+  // A peer reaches its allowlisted routes and never a socket.
+  if (!result.ok || result.via === "peer") {
     socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
     socket.destroy();
     return false;

package/lib/security/route-guard.ts

@@ -1,6 +1,8 @@
 /**
  * For actions a stolen device token must not be able to take (adding
- * devices, opening up the network): only this machine or the tailnet.
+ * devices, opening up the network): only this machine or the tailnet. A
+ * linked machine's call (`peer`) never passes, even though it arrives on
+ * loopback.
  */
 
 import { NextResponse, type NextRequest } from "next/server";

package/lib/session-artifacts/peer.ts

@@ -8,7 +8,12 @@
 import { ARTIFACT_HEADERS } from "../artifacts/serve";
 import { IMAGE_TYPES } from "../artifacts/image-paths";
 import { IMAGE_CSP } from "../artifacts/serve";
-import { cleanRemoteText, hostApi, type HostLink } from "../hosts/remote-api";
+import {
+  cleanRemoteText,
+  hostApi,
+  isConnectLink,
+  type HostLink,
+} from "../hosts/remote-api";
 import type {
   ArtifactKind,
   ArtifactPreview,
@@ -148,6 +153,12 @@ export async function peerContent(
 ): Promise<Content> {
   if (!ID.test(artifactId))
     return { ok: false, status: 404, error: "Not found" };
+  if (isConnectLink(link))
+    return {
+      ok: false,
+      status: 409,
+      error: `${link.hostName} is linked through Connect: artifacts need a Tailscale/ssh link for now`,
+    };
   let res: Response;
   try {
     res = await fetch(

package/lib/tasks/contract/authorize.ts

@@ -9,6 +9,10 @@
  *    (which sends no device) is never refused on them.
  *  - plan: open, and a plan another machine placed here is read and approved
  *    by that machine only.
+ *
+ * The caller is the gate's device id. A machine linked through Connect is
+ * `peer:<host id>` (lib/security/gate.ts), with no Can approve: the same
+ * standing a linked machine's device token has.
  */
 
 import { NextRequest, NextResponse } from "next/server";

package/lib/worktree-sweep/testTemp.ts

@@ -67,6 +67,8 @@ export const TEST_TEMP_PREFIXES: readonly string[] = [
   "aos-orch-sweep-",
   "aos-origin-",
   "aos-path-",
+  "aos-peer-connect-",
+  "aos-peer-keys-",
   "aos-plain-",
   "aos-plan-",
   "aos-ports-",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.697",
+  "version": "0.3.698",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/server.ts

@@ -47,6 +47,7 @@ import {
   refuseNextInternal,
 } from "./lib/security/next-internals";
 import { lanEnabled } from "./lib/security/network-settings";
+import { handlePeerRpc, isPeerRpc, rpcDeps } from "./lib/peer/rpc-server";
 import { startConnect } from "./lib/connect/serve";
 import { serverPort } from "./lib/connect/config";
 import { startUpdateChecks, updateChecksEnabled } from "./lib/updates/check";
@@ -150,6 +151,7 @@ app.prepare().then(async () => {
     .map((h) => h.trim().toLowerCase())
     .filter(Boolean);
   const auth = authPolicy();
+  const peerRpc = rpcDeps(port);
   const header = (v: string | string[] | undefined) =>
     Array.isArray(v) ? v[0] : v;
 
@@ -177,6 +179,22 @@ app.prepare().then(async () => {
     if (refuseNextInternal(req, res)) return;
     if (!gateRequest(req, res, auth)) return;
     if (demo && !gateDemoRequest(req, res)) return;
+    // A linked machine's envelope: verified, then re-issued to loopback.
+    if (isPeerRpc(req)) {
+      if (demo) {
+        res.statusCode = 404;
+        res.end();
+        return;
+      }
+      try {
+        await handlePeerRpc(req, res, peerRpc);
+      } catch (err) {
+        console.error("peer rpc failed:", err);
+        if (!res.headersSent) res.statusCode = 500;
+        res.end();
+      }
+      return;
+    }
     try {
       await compressJson(req, res);
       const parsedUrl = parse(req.url!, true);