@saadnvd1/agent-os 0.3.697 → 0.3.700

package/lib/peer/link-cli.ts

@@ -0,0 +1,233 @@
+/**
+ * agent-os link: link machines on your AgentOS Connect account from a
+ * terminal, for boxes with no browser. Talks to the AgentOS running here
+ * over loopback, which counts as this machine (it may accept a code).
+ *
+ *   agent-os link                     the account's machines and requests waiting here
+ *   agent-os link <machine>           start a link; prints the code to type there,
+ *                                     then asks for the one it shows back
+ *   agent-os link accept <code> [--from <machine>]   prints the code to type back
+ *   agent-os link decline [<machine>]
+ *   agent-os unlink <machine>
+ */
+
+import type { AccountMachines } from "./machines";
+import type { PendingView } from "./pairing";
+import type { Outgoing } from "./pairing-out";
+import { showCode } from "./code";
+
+export interface CliIo {
+  base: string;
+  fetch: typeof fetch;
+  out: (line: string) => void;
+  sleep: (ms: number) => Promise<void>;
+  /** One line typed in the terminal, or null when there's none to read. */
+  ask: (prompt: string) => Promise<string | null>;
+}
+
+class CliError extends Error {}
+
+async function call<T>(
+  io: CliIo,
+  path: string,
+  init?: RequestInit
+): Promise<T> {
+  let res: Response;
+  try {
+    res = await io.fetch(`${io.base}${path}`, {
+      ...init,
+      headers: { "Content-Type": "application/json" },
+    });
+  } catch {
+    throw new CliError(
+      `Can't reach AgentOS at ${io.base}. Is it running? (agent-os status)`
+    );
+  }
+  const data = (await res.json().catch(() => ({}))) as T & { error?: string };
+  if (!res.ok) throw new CliError(data.error ?? `HTTP ${res.status}`);
+  return data;
+}
+
+const same = (a: string, b: string) =>
+  a.trim().toLowerCase() === b.trim().toLowerCase();
+
+function pick<T extends { name: string }>(
+  items: T[],
+  ref: string | undefined,
+  idOf: (t: T) => string,
+  what: string
+): T {
+  if (ref) {
+    const hit = items.filter((i) => same(i.name, ref) || idOf(i) === ref);
+    if (hit.length === 1) return hit[0];
+    throw new CliError(
+      hit.length
+        ? `More than one ${what} is called ${ref}; use its id.`
+        : `No ${what} called ${ref}.`
+    );
+  }
+  if (items.length === 1) return items[0];
+  throw new CliError(
+    items.length
+      ? `Several ${what}s: say which with --from (${items.map((i) => i.name).join(", ")}).`
+      : `No ${what} is waiting.`
+  );
+}
+
+async function list(io: CliIo) {
+  const account = await call<AccountMachines>(
+    io,
+    "/api/peers/account?refresh=1"
+  );
+  const { requests } = await call<{ requests: PendingView[] }>(
+    io,
+    "/api/peers/pending"
+  );
+  if (!account.enrolled) {
+    io.out(
+      "This machine isn't on AgentOS Connect yet: run agent-os connect first."
+    );
+    return;
+  }
+  if (account.entitlements && !account.entitlements.linkMachines)
+    io.out("Linking machines needs Pro: upgrade at runagentos.com.\n");
+  if (account.error) io.out(`${account.error}\n`);
+  if (account.machines.length === 0)
+    io.out("No other machines on your account yet.");
+  for (const m of account.machines)
+    io.out(
+      `  ${m.linkState === "active" ? "linked " : m.linkState === "suspended" ? "paused " : "       "} ${m.name}  (${m.online ? "online" : "offline"}, ${m.id})`
+    );
+  for (const r of requests)
+    io.out(
+      `\n${r.name} wants to link here: agent-os link accept <the code it shows>`
+    );
+  if (account.machines.some((m) => !m.linkState))
+    io.out("\nLink one with: agent-os link <name>");
+}
+
+async function start(io: CliIo, ref: string) {
+  const account = await call<AccountMachines>(
+    io,
+    "/api/peers/account?refresh=1"
+  );
+  const target = pick(
+    account.machines,
+    ref,
+    (m) => m.id,
+    "machine on your account"
+  );
+  const { link } = await call<{ link: Outgoing }>(io, "/api/peers/link", {
+    method: "POST",
+    body: JSON.stringify({ machineId: target.id }),
+  });
+  io.out(
+    `\n  Type this code on ${link.name}:\n\n      ${showCode(link.code)}\n`
+  );
+  io.out(
+    `  (its Machines screen, its banner, or agent-os link accept there)\n  Waiting...`
+  );
+  let state: Outgoing = link;
+  while (state.state === "pending") {
+    await io.sleep(1500);
+    state = (await call<{ link: Outgoing }>(io, `/api/peers/link/${link.id}`))
+      .link;
+  }
+  while (state.state === "confirm") {
+    const typed = await io.ask(
+      `\n  The code matched on ${state.name}. Type the code it shows now: `
+    );
+    if (typed === null)
+      throw new CliError("No code typed: nothing was linked.");
+    const res = await io.fetch(`${io.base}/api/peers/link/${link.id}/confirm`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code: typed }),
+    });
+    const data = (await res.json().catch(() => ({}))) as {
+      link?: Outgoing;
+      error?: string;
+      attemptsLeft?: number;
+    };
+    if (data.link) state = data.link;
+    else if (data.attemptsLeft)
+      io.out(`  ${data.error} ${data.attemptsLeft} left.`);
+    else throw new CliError(data.error ?? `HTTP ${res.status}`);
+  }
+  if (state.state !== "accepted")
+    throw new CliError(
+      state.state === "expired"
+        ? "The code expired. Run agent-os link again."
+        : `Not linked (${state.state}${state.error ? `: ${state.error}` : ""}).`
+    );
+  io.out(`\n  Linked with ${state.name}.\n`);
+}
+
+async function answer(io: CliIo, verb: "accept" | "decline", rest: string[]) {
+  const i = rest.indexOf("--from");
+  const from = i > -1 ? rest[i + 1] : verb === "decline" ? rest[0] : undefined;
+  // "482 913" arrives as two words.
+  const code =
+    verb === "accept"
+      ? rest.filter((_, j) => i < 0 || (j !== i && j !== i + 1)).join("")
+      : undefined;
+  if (verb === "accept" && !code)
+    throw new CliError("Usage: agent-os link accept <code> [--from <machine>]");
+  const { requests } = await call<{ requests: PendingView[] }>(
+    io,
+    "/api/peers/pending"
+  );
+  const req = pick(requests, from, (r) => r.machineId, "link request");
+  if (verb === "decline") {
+    await call(io, `/api/peers/pending/${req.id}/decline`, { method: "POST" });
+    io.out(`Declined ${req.name}.`);
+    return;
+  }
+  const r = await call<{ name: string; confirmCode: string }>(
+    io,
+    `/api/peers/pending/${req.id}/accept`,
+    {
+      method: "POST",
+      body: JSON.stringify({ code }),
+    }
+  );
+  io.out(
+    `Linked with ${r.name}. It can start agents and run code here; unlink with agent-os unlink "${r.name}".`
+  );
+  io.out(
+    `\n  To finish, type this code on ${r.name}:\n\n      ${showCode(r.confirmCode)}\n`
+  );
+}
+
+async function unlink(io: CliIo, ref: string | undefined) {
+  if (!ref) throw new CliError("Usage: agent-os unlink <machine>");
+  const { hosts } = await call<{
+    hosts: { id: string; name: string; kind?: string }[];
+  }>(io, "/api/hosts");
+  const host = pick(
+    hosts.filter((h) => h.kind === "connect"),
+    ref,
+    (h) => h.id,
+    "linked machine"
+  );
+  await call(io, `/api/hosts/${host.id}`, { method: "DELETE" });
+  io.out(
+    `Unlinked ${host.name} here. Remove this machine from its Machines too.`
+  );
+}
+
+/** Runs one command; returns the exit code. */
+export async function runLinkCli(args: string[], io: CliIo): Promise<number> {
+  try {
+    const [first, ...rest] = args;
+    if (first === "--unlink") await unlink(io, rest[0]);
+    else if (!first) await list(io);
+    else if (first === "accept" || first === "decline")
+      await answer(io, first, rest);
+    else await start(io, args.join(" "));
+    return 0;
+  } catch (err) {
+    io.out(`  link: ${err instanceof Error ? err.message : String(err)}`);
+    return 1;
+  }
+}

package/lib/peer/links.ts

@@ -0,0 +1,96 @@
+/**
+ * Pinned peers: a machine linked through Connect, by its Connect id, with
+ * the keys it paired with. Nothing here talks to the network.
+ */
+
+import { getDb } from "../db";
+
+export type PinState = "active" | "suspended";
+
+export interface PeerPin {
+  hostId: string;
+  machineId: string;
+  hostname: string;
+  signPub: string;
+  boxPub: string;
+  state: PinState;
+  suspendedReason: string | null;
+}
+
+interface Row {
+  host_id: string;
+  machine_id: string;
+  hostname: string;
+  sign_pub: string;
+  box_pub: string;
+  state: string;
+  suspended_reason: string | null;
+}
+
+const toPin = (r: Row | undefined): PeerPin | null =>
+  r
+    ? {
+        hostId: r.host_id,
+        machineId: r.machine_id,
+        hostname: r.hostname,
+        signPub: r.sign_pub,
+        boxPub: r.box_pub,
+        state: r.state === "active" ? "active" : "suspended",
+        suspendedReason: r.suspended_reason,
+      }
+    : null;
+
+// Only a host created as a Connect machine counts: a pin on any other row
+// would be a second way in that nothing shows.
+const SELECT = `SELECT p.* FROM peer_links p JOIN hosts h ON h.id = p.host_id
+  WHERE h.kind = 'connect'`;
+
+export const pinForMachine = (machineId: string): PeerPin | null =>
+  toPin(
+    getDb().prepare(`${SELECT} AND p.machine_id = ?`).get(machineId) as
+      Row | undefined
+  );
+
+/** Whether any linked machine may call in at all. */
+export const hasActivePin = (): boolean =>
+  getDb().prepare(`${SELECT} AND p.state = 'active' LIMIT 1`).get() !==
+  undefined;
+
+export const pinForHost = (hostId: string): PeerPin | null =>
+  toPin(
+    getDb().prepare(`${SELECT} AND p.host_id = ?`).get(hostId) as
+      Row | undefined
+  );
+
+/** Pins a peer's keys to a Connect host. Pairing (S2) is the only caller. */
+export function savePin(pin: Omit<PeerPin, "state" | "suspendedReason">) {
+  getDb()
+    .prepare(
+      `INSERT INTO peer_links (host_id, machine_id, hostname, sign_pub, box_pub)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(host_id) DO UPDATE SET machine_id = excluded.machine_id,
+         hostname = excluded.hostname, sign_pub = excluded.sign_pub,
+         box_pub = excluded.box_pub, state = 'active', suspended_reason = NULL,
+         paired_at = datetime('now'), last_error = NULL`
+    )
+    .run(pin.hostId, pin.machineId, pin.hostname, pin.signPub, pin.boxPub);
+}
+
+export function suspendPin(hostId: string, reason: string) {
+  getDb()
+    .prepare(
+      `UPDATE peer_links SET state = 'suspended', suspended_reason = ? WHERE host_id = ?`
+    )
+    .run(reason, hostId);
+}
+
+/** Last outcome of a call to that peer, for Machines. */
+export function notePinResult(hostId: string, error: string | null) {
+  getDb()
+    .prepare(
+      error
+        ? `UPDATE peer_links SET last_error = ? WHERE host_id = ?`
+        : `UPDATE peer_links SET last_ok_at = datetime('now'), last_error = NULL WHERE host_id = ?`
+    )
+    .run(...(error ? [error.slice(0, 300), hostId] : [hostId]));
+}

package/lib/peer/machines.ts

@@ -0,0 +1,72 @@
+/**
+ * What Machines shows under "On your AgentOS account": the account's other
+ * machines, each with whether it's linked here, and the plan.
+ */
+
+import { getDb } from "../db";
+import { accountView } from "./account";
+import type { Entitlements } from "../connect/control-api";
+
+export interface AccountMachine {
+  id: string;
+  name: string;
+  hostname: string;
+  online: boolean;
+  lastSeenAt: string | null;
+  version: string | null;
+  /** The Machines host it's linked as, when it is. */
+  hostId: string | null;
+  linkState: "active" | "suspended" | null;
+}
+
+export interface AccountMachines {
+  enrolled: boolean;
+  entitlements: Entitlements | null;
+  fetchedAt: number;
+  error: string | null;
+  machines: AccountMachine[];
+}
+
+// The service shows a machine online for three missed beats.
+const ONLINE_MS = 3 * 60_000;
+
+export async function accountMachines(
+  refresh = false,
+  now = Date.now()
+): Promise<AccountMachines> {
+  const view = await accountView(refresh ? 0 : undefined);
+  const pins = new Map(
+    (
+      getDb()
+        .prepare(
+          `SELECT p.machine_id, p.host_id, p.state FROM peer_links p
+           JOIN hosts h ON h.id = p.host_id WHERE h.kind = 'connect'`
+        )
+        .all() as { machine_id: string; host_id: string; state: string }[]
+    ).map((r) => [r.machine_id, r])
+  );
+  return {
+    enrolled: view.enrolled,
+    entitlements: view.entitlements,
+    fetchedAt: view.fetchedAt,
+    error: view.error,
+    machines: view.peers.map((p) => {
+      const pin = pins.get(p.id);
+      const seen = p.lastSeenAt ? Date.parse(p.lastSeenAt) : NaN;
+      return {
+        id: p.id,
+        name: p.name,
+        hostname: p.hostname,
+        online: Number.isFinite(seen) && now - seen < ONLINE_MS,
+        lastSeenAt: p.lastSeenAt,
+        version: p.version,
+        hostId: pin?.host_id ?? null,
+        linkState: pin
+          ? pin.state === "active"
+            ? "active"
+            : "suspended"
+          : null,
+      };
+    }),
+  };
+}

package/lib/peer/nonce-store.ts

@@ -0,0 +1,23 @@
+/**
+ * The replay guard's nonces in SQLite, so they outlive a restart. One
+ * statement both checks and records, so two requests carrying the same nonce
+ * can't both pass.
+ */
+
+import { getDb } from "../db";
+import type { NonceStore } from "./replay";
+
+export function sqliteNonceStore(db = getDb): NonceStore {
+  return {
+    claim: (peer, nonce, until, now) =>
+      db()
+        .prepare(
+          `INSERT INTO peer_nonces (machine_id, nonce, until) VALUES (?, ?, ?)
+           ON CONFLICT (machine_id, nonce) DO UPDATE SET until = excluded.until
+             WHERE peer_nonces.until < ?`
+        )
+        .run(peer.slice(0, 64), nonce, until, now).changes === 1,
+    prune: (now) =>
+      void db().prepare(`DELETE FROM peer_nonces WHERE until < ?`).run(now),
+  };
+}

package/lib/peer/notify.ts

@@ -0,0 +1,32 @@
+/**
+ * What pairing tells the person: a request waiting for its code here, and a
+ * machine linked. Pushed to paired phones (or Telegram); never throws.
+ */
+
+import { notifyPhone } from "../notify";
+
+const short = (name: string) => name.replace(/\s+/g, " ").slice(0, 60);
+
+export function notifyLinkRequest(name: string) {
+  notifyPhone(
+    "peer-link",
+    `${short(name)} wants to link to this machine. Type the code it shows in Machines to allow it.`,
+    {
+      category: "system",
+      key: `peer-link:${Date.now()}`,
+      collapse: "peer-link",
+    }
+  );
+}
+
+export function notifyLinked(name: string) {
+  notifyPhone(
+    "peer-link",
+    `New machine linked: ${short(name)}. It can start agents and run code here; unlink it in Machines.`,
+    {
+      category: "system",
+      key: `peer-linked:${Date.now()}`,
+      collapse: "peer-link",
+    }
+  );
+}