@saadnvd1/agent-os 0.3.697 → 0.3.700

package/lib/security/auth.ts

@@ -10,20 +10,36 @@
  */
 
 import type { IncomingHttpHeaders } from "http";
+import { peerTargetAllowed } from "../peer/allowlist";
+import { secretMatches } from "../peer/internal";
 
 export const DEVICE_COOKIE = "aos_device";
 // Set by server.ts on every request after stripping any client-sent copy.
 export const DEVICE_HEADER = "x-agentos-device";
 export const TRUST_HEADER = "x-agentos-trust";
 export const REMOTE_HEADER = "x-agentos-remote";
+// Who sent it, for per-sender limits: the visitor's address on a Connect
+// request (lib/peer/rpc-intake sourceOf), an IPv6 address by its /64.
+export const SOURCE_HEADER = "x-agentos-source";
+// The rpc server's loopback hop (lib/peer/rpc-server): the per-boot secret,
+// and the linked machine it verified. Never trusted from anywhere else.
+export const PEER_INTERNAL_HEADER = "x-agentos-peer-internal";
+export const PEER_HEADER = "x-agentos-peer";
 
-export type Trust = "loopback" | "tailnet" | "device" | "open";
+/**
+ * `peer`: a linked machine's verified call, re-issued by this machine. It is
+ * never local trust and never an approver, and only reaches its allowlist.
+ */
+export type Trust = "loopback" | "tailnet" | "device" | "open" | "peer";
 
 export type AuthResult =
-  { ok: true; via: Trust; deviceId?: string } | { ok: false };
+  | { ok: true; via: Trust; deviceId?: string; peerHost?: string }
+  // hard: refused outright, even on a path that is otherwise public.
+  | { ok: false; hard?: true };
 
 export interface AuthRequest {
   url?: string;
+  method?: string;
   headers: IncomingHttpHeaders;
   remoteAddress?: string;
   localAddress?: string;
@@ -47,11 +63,14 @@ export interface AuthPolicy {
   /** AGENTOS_AUTH=off: someone else's proxy does the login. */
   off?: boolean;
   lookup: (token: string) => { id: string } | null;
+  /** The rpc server's per-boot secret; without it no request is a peer. */
+  peerSecret?: () => string;
 }
 
 const TAILSCALE_V4 = /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./;
 const LOOPBACK = new Set(["127.0.0.1", "::1"]);
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
+const PEER_HOST_ID = /^[A-Za-z0-9_.-]{1,128}$/;
 // A proxy must send one of these, or it looks like this machine itself.
 // Proxies that send none need AGENTOS_AUTH, see docs/reference/security.md.
 const FORWARDING = new Set([
@@ -64,12 +83,18 @@ const FORWARDING = new Set([
 ]);
 const FORWARDING_PREFIXES = ["x-forwarded-", "cf-", "tailscale-"];
 
-// Reached without a token: the pairing page, what it needs to render, and
-// the claim it posts. Exact paths, plus a few static asset folders whose
-// paths may only use plain characters (no traversal, no encoding).
+// Reached without a token: the pairing page, what it needs to render, the
+// claim it posts, a linked machine's rpc (its envelope is the proof) and
+// the pairing hellos (signed by a key the account lists). Exact paths, plus
+// a few static asset folders whose paths may only use plain characters (no
+// traversal, no encoding).
 const PUBLIC_EXACT = new Set([
   "/pair",
   "/api/pair/claim",
+  "/api/peer/rpc",
+  "/api/peer/hello",
+  "/api/peer/hello/reveal",
+  "/api/peer/hello/status",
   "/manifest.webmanifest",
   "/manifest.json",
   "/favicon.ico",
@@ -155,11 +180,31 @@ export function authorize(req: AuthRequest, policy: AuthPolicy): AuthResult {
   try {
     return decide(req, policy);
   } catch {
-    return { ok: false };
+    return req.headers[PEER_INTERNAL_HEADER] !== undefined
+      ? { ok: false, hard: true }
+      : { ok: false };
   }
 }
 
+/**
+ * A request carrying the internal header is a peer call or nothing: it
+ * never falls back to loopback trust, whatever its address says.
+ */
+function peerTrust(req: AuthRequest, policy: AuthPolicy): AuthResult {
+  const refuse = { ok: false, hard: true } as const;
+  if (req.tunnel || !policy.peerSecret || proxied(req.headers)) return refuse;
+  if (!LOOPBACK.has(plainAddress(req.remoteAddress))) return refuse;
+  if (!secretMatches(req.headers[PEER_INTERNAL_HEADER], policy.peerSecret()))
+    return refuse;
+  const host = req.headers[PEER_HEADER];
+  if (typeof host !== "string" || !PEER_HOST_ID.test(host)) return refuse;
+  if (!peerTargetAllowed(req.method, req.url)) return refuse;
+  return { ok: true, via: "peer", deviceId: `peer:${host}`, peerHost: host };
+}
+
 function decide(req: AuthRequest, policy: AuthPolicy): AuthResult {
+  if (req.headers[PEER_INTERNAL_HEADER] !== undefined)
+    return peerTrust(req, policy);
   const trusted = req.tunnel ? null : networkTrust(req, policy);
   const token = readToken(req.headers);
   if (trusted) {

package/lib/security/gate.ts

@@ -14,6 +14,9 @@ import {
   DEVICE_HEADER,
   TRUST_HEADER,
   REMOTE_HEADER,
+  SOURCE_HEADER,
+  PEER_HEADER,
+  PEER_INTERNAL_HEADER,
   type AuthPolicy,
   type AuthResult,
 } from "./auth";
@@ -22,6 +25,8 @@ import { deviceForToken, touchDevice, trackDeviceSocket } from "./devices";
 import { tailscaleAddresses } from "./net";
 import { networkSetting } from "./network-settings";
 import { pairLocation } from "../session-url";
+import { peerSecret } from "../peer/internal";
+import { sourceOf } from "../peer/rpc-intake";
 
 // Interface addresses change rarely; don't re-read them on every request.
 let tailnetCache = { at: 0, ips: [] as string[] };
@@ -42,6 +47,7 @@ export function authPolicy(env = process.env): AuthPolicy {
     },
     off: env.AGENTOS_AUTH === "off",
     lookup: deviceForToken,
+    peerSecret,
   };
 }
 
@@ -54,21 +60,37 @@ function decide(req: IncomingMessage, policy: AuthPolicy): AuthResult {
   // Never trust a client-supplied verdict.
   delete req.headers[DEVICE_HEADER];
   delete req.headers[TRUST_HEADER];
+  // A peer's identity only ever comes with the internal secret.
+  if (req.headers[PEER_INTERNAL_HEADER] === undefined)
+    delete req.headers[PEER_HEADER];
   const tunnel = isTunnelSocket(req.socket);
   req.headers[REMOTE_HEADER] = sourceLabel(req.socket.remoteAddress, tunnel);
-  const result = authorize(
-    {
-      url: req.url,
-      headers: req.headers,
-      remoteAddress: req.socket.remoteAddress,
-      localAddress: req.socket.localAddress,
-      tunnel,
-    },
-    policy
-  );
+  req.headers[SOURCE_HEADER] = sourceOf(req);
+  let result: AuthResult;
+  try {
+    result = authorize(
+      {
+        url: req.url,
+        method: req.method,
+        headers: req.headers,
+        remoteAddress: req.socket.remoteAddress,
+        localAddress: req.socket.localAddress,
+        tunnel,
+      },
+      policy
+    );
+  } finally {
+    // No route ever sees the secret.
+    delete req.headers[PEER_INTERNAL_HEADER];
+  }
+  delete req.headers[PEER_HEADER];
   if (result.ok) {
     req.headers[TRUST_HEADER] = result.via;
     if (result.deviceId) req.headers[DEVICE_HEADER] = result.deviceId;
+    if (result.peerHost) {
+      req.headers[PEER_HEADER] = result.peerHost;
+      req.headers[REMOTE_HEADER] = "peer";
+    }
   }
   return result;
 }
@@ -81,6 +103,8 @@ function check(req: IncomingMessage, policy: AuthPolicy): AuthResult {
     console.error("access check failed:", err);
     delete req.headers[TRUST_HEADER];
     delete req.headers[DEVICE_HEADER];
+    delete req.headers[PEER_HEADER];
+    delete req.headers[PEER_INTERNAL_HEADER];
     return { ok: false };
   }
 }
@@ -102,6 +126,7 @@ export function gateRequest(
 ): boolean {
   const result = check(req, policy);
   if (result.ok) {
+    if (result.via === "peer") return true;
     // Slide the cookie's expiry forward, at most once a minute per device.
     const cookie = result.deviceId ? cookieToken(req.headers) : null;
     if (result.deviceId && touch(req, result.deviceId) && cookie) {
@@ -114,7 +139,7 @@ export function gateRequest(
     }
     return true;
   }
-  if (isPublicPath(req.url)) return true;
+  if (!result.hard && isPublicPath(req.url)) return true;
   const path = (req.url ?? "/").split("?")[0];
   const wantsPage =
     !path.startsWith("/api/") &&
@@ -139,7 +164,8 @@ export function gateUpgrade(
   policy: AuthPolicy
 ): boolean {
   const result = check(req, policy);
-  if (!result.ok) {
+  // A peer reaches its allowlisted routes and never a socket.
+  if (!result.ok || result.via === "peer") {
     socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
     socket.destroy();
     return false;

package/lib/security/route-guard.ts

@@ -1,6 +1,8 @@
 /**
  * For actions a stolen device token must not be able to take (adding
- * devices, opening up the network): only this machine or the tailnet.
+ * devices, opening up the network): only this machine or the tailnet. A
+ * linked machine's call (`peer`) never passes, even though it arrives on
+ * loopback.
  */
 
 import { NextResponse, type NextRequest } from "next/server";

package/lib/session-artifacts/peer.ts

@@ -8,7 +8,12 @@
 import { ARTIFACT_HEADERS } from "../artifacts/serve";
 import { IMAGE_TYPES } from "../artifacts/image-paths";
 import { IMAGE_CSP } from "../artifacts/serve";
-import { cleanRemoteText, hostApi, type HostLink } from "../hosts/remote-api";
+import {
+  cleanRemoteText,
+  hostApi,
+  isConnectLink,
+  type HostLink,
+} from "../hosts/remote-api";
 import type {
   ArtifactKind,
   ArtifactPreview,
@@ -148,6 +153,12 @@ export async function peerContent(
 ): Promise<Content> {
   if (!ID.test(artifactId))
     return { ok: false, status: 404, error: "Not found" };
+  if (isConnectLink(link))
+    return {
+      ok: false,
+      status: 409,
+      error: `${link.hostName} is linked through Connect: artifacts need a Tailscale/ssh link for now`,
+    };
   let res: Response;
   try {
     res = await fetch(

package/lib/sessions/end.ts

@@ -4,6 +4,7 @@ import { waitForExit } from "../chat/worker/client";
 import { endTmuxSession } from "../tmux/end";
 import { releaseOnEnd, shutTaskSimulators } from "../simulator";
 import { forgetPlanWait } from "../models/plan-step";
+import { kickWaits } from "../bus/waits/kick";
 
 type Agent = Pick<Session, "id" | "host_id" | "tmux_name"> &
   Partial<Pick<Session, "worktree_path" | "branch_name">>;
@@ -20,4 +21,6 @@ export async function endSessionAgent(s: Agent): Promise<void> {
   shutTaskSimulators(s);
   void waitForExit(s.id).catch(() => {});
   await endTmuxSession(s.host_id, s.tmux_name);
+  // Whoever waits on it is told now, not at the next sweep.
+  kickWaits();
 }

package/lib/tasks/contract/authorize.ts

@@ -9,6 +9,10 @@
  *    (which sends no device) is never refused on them.
  *  - plan: open, and a plan another machine placed here is read and approved
  *    by that machine only.
+ *
+ * The caller is the gate's device id. A machine linked through Connect is
+ * `peer:<host id>` (lib/security/gate.ts), with no Can approve: the same
+ * standing a linked machine's device token has.
  */
 
 import { NextRequest, NextResponse } from "next/server";

package/lib/worktree-sweep/testTemp.ts

@@ -67,6 +67,8 @@ export const TEST_TEMP_PREFIXES: readonly string[] = [
   "aos-orch-sweep-",
   "aos-origin-",
   "aos-path-",
+  "aos-peer-connect-",
+  "aos-peer-keys-",
   "aos-plain-",
   "aos-plan-",
   "aos-ports-",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.697",
+  "version": "0.3.700",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/agent-os

@@ -83,6 +83,8 @@ case "${1:-}" in
     pair)             node "$SCRIPT_DIR/pair.mjs" "$PORT" ;;
     connect)          shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/connect/cli.ts "$@") ;;
     disconnect)       (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/connect/cli.ts --off) ;;
+    link)             shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/peer/cli.ts "$PORT" "$@") ;;
+    unlink)           shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/peer/cli.ts "$PORT" --unlink "$@") ;;
     passkeys)         shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/security/passkeys-cli.ts "$@") ;;
     logs)             cmd_logs ;;
     update)           cmd_update ;;

package/scripts/lib/commands.sh

@@ -558,6 +558,8 @@ cmd_help() {
     echo "  pair        Add a phone, tablet or laptop (prints a QR code)"
     echo "  connect     Turn on AgentOS Connect for this machine (in development)"
     echo "  disconnect  Turn Connect off; the tunnel closes within seconds"
+    echo "  link        Link machines on your Connect account (link <name>, link accept <code>)"
+    echo "  unlink      Unlink a machine linked through Connect"
     echo "  passkeys reset  Revoke every passkey (recovery; asks you to confirm)"
     echo "  logs        Tail server logs"
     echo "  update      Update to latest version"

package/server.ts

@@ -14,6 +14,7 @@ import { setStartGate } from "./lib/stacks/tick";
 import { stackStartGate } from "./lib/orchestrator/brakes";
 import { buildId } from "./lib/build";
 import { startOrchestratorWatcher } from "./lib/orchestrator/watcher";
+import { startWaitWatcher } from "./lib/bus/waits/tick";
 import { installErrorCounter } from "./lib/health/errors";
 import { recordBoot } from "./lib/health/boots";
 import { realDeps, schedulesEnabled, startScheduler } from "./lib/schedules";
@@ -47,6 +48,7 @@ import {
   refuseNextInternal,
 } from "./lib/security/next-internals";
 import { lanEnabled } from "./lib/security/network-settings";
+import { handlePeerRpc, isPeerRpc, rpcDeps } from "./lib/peer/rpc-server";
 import { startConnect } from "./lib/connect/serve";
 import { serverPort } from "./lib/connect/config";
 import { startUpdateChecks, updateChecksEnabled } from "./lib/updates/check";
@@ -150,6 +152,7 @@ app.prepare().then(async () => {
     .map((h) => h.trim().toLowerCase())
     .filter(Boolean);
   const auth = authPolicy();
+  const peerRpc = rpcDeps(port);
   const header = (v: string | string[] | undefined) =>
     Array.isArray(v) ? v[0] : v;
 
@@ -177,6 +180,22 @@ app.prepare().then(async () => {
     if (refuseNextInternal(req, res)) return;
     if (!gateRequest(req, res, auth)) return;
     if (demo && !gateDemoRequest(req, res)) return;
+    // A linked machine's envelope: verified, then re-issued to loopback.
+    if (isPeerRpc(req)) {
+      if (demo) {
+        res.statusCode = 404;
+        res.end();
+        return;
+      }
+      try {
+        await handlePeerRpc(req, res, peerRpc);
+      } catch (err) {
+        console.error("peer rpc failed:", err);
+        if (!res.headersSent) res.statusCode = 500;
+        res.end();
+      }
+      return;
+    }
     try {
       await compressJson(req, res);
       const parsedUrl = parse(req.url!, true);
@@ -458,6 +477,8 @@ app.prepare().then(async () => {
   if (process.env.AGENTOS_STACKS !== "off") startStackWatcher();
   // Each workspace's orchestrator hears about its sessions as events.
   if (process.env.AGENTOS_ORCHESTRATOR !== "off") startOrchestratorWatcher();
+  // Sessions waiting on each other (aos send --await, aos wait).
+  startWaitWatcher();
   // Schedules tick here, once a minute, and nowhere else.
   if (schedulesEnabled(process.env)) startScheduler(realDeps);
   // Looking for a newer version, and running an update only when one is