@saadnvd1/agent-os 0.3.698 → 0.3.700

package/lib/peer/pairing.ts

@@ -0,0 +1,403 @@
+/**
+ * Pairing, on the machine being asked (B). A hello is taken only from a key
+ * the Connect account lists for its sender, and only while the plan
+ * includes linking; it then waits, in memory, for the sender to reveal the
+ * nonce it committed to, and then for a person here to type the code the
+ * sender shows. Nothing is trusted until that code matches: B pins A then
+ * and shows a second code, which the person types on A before A pins B.
+ * A machine linked here already keeps its keys: one that comes back with
+ * other keys is refused until a person unlinks it.
+ *
+ * Limits: hellos 5 per sender and 20 in all per 10 minutes, at most 3
+ * requests open and one per sender (a newer one replaces it), each for 5
+ * minutes, and 3 wrong codes void a request.
+ * A server restart forgets every open request (the sender sees "expired").
+ */
+
+import { currentIdentity, loadBoxKey, type Identity } from "./keys";
+import { linkingAllowed, listedPeer, type AccountPeer } from "./account";
+import {
+  commitTo,
+  deriveCode,
+  parseHello,
+  parseReveal,
+  parseStatusAsk,
+  randomNonce,
+  sameCode,
+  signAck,
+  signAnswer,
+  typedCode,
+  verifyHello,
+  verifyReveal,
+  verifyStatusAsk,
+  withinSkew,
+  SKEW_MS,
+  type LinkState,
+} from "./hello";
+import { KEY_CHANGED, keysChanged, pinPeer } from "./pin";
+import { notifyLinked, notifyLinkRequest } from "./notify";
+
+export const REQUEST_TTL_MS = 5 * 60_000;
+export const MAX_OPEN = 3;
+export const MAX_WRONG = 3;
+const WINDOW_MS = 10 * 60_000;
+const PER_SENDER = 5;
+const GLOBAL = 20;
+// Hellos that get as far as the account list, from anyone: bounds the
+// signature checks and list fetches a stranger can cause. One address (an
+// IPv6 /64) is held to a share of it first, so it can't use it all up.
+const UNPROVEN = 120;
+const PER_SOURCE = 20;
+
+interface Incoming {
+  id: string;
+  peer: AccountPeer;
+  aSign: string;
+  aBox: string;
+  commit: string;
+  bNonce: string;
+  code: string | null;
+  confirm: string | null;
+  state: "revealing" | LinkState;
+  why: string | null;
+  wrong: number;
+  createdAt: number;
+}
+
+export interface PairingDeps {
+  identity: () => Identity | null;
+  boxPub: () => string;
+  listed: (machineId: string) => Promise<AccountPeer | null>;
+  allowed: () => Promise<boolean | null>;
+  pin: (p: AccountPeer & { boxPub: string }) => string;
+  onRequest: (name: string) => void;
+  onLinked: (name: string) => void;
+  now: () => number;
+}
+
+interface Store {
+  requests: Map<string, Incoming>;
+  hellos: { at: number; from: string | null; source: string }[];
+  seen: Map<string, number>;
+}
+
+const g = globalThis as unknown as { __agentosPairingIn?: Store };
+const store = (): Store =>
+  (g.__agentosPairingIn ??= {
+    requests: new Map(),
+    hellos: [],
+    seen: new Map(),
+  });
+
+/** Tests: forget every request and every limit. */
+export const resetIncoming = () => {
+  g.__agentosPairingIn = undefined;
+};
+
+let box: string | null = null;
+export const realPairingDeps = (): PairingDeps => ({
+  identity: () => currentIdentity(),
+  boxPub: () => (box ??= loadBoxKey().publicRaw),
+  listed: listedPeer,
+  allowed: linkingAllowed,
+  pin: pinPeer,
+  onRequest: notifyLinkRequest,
+  onLinked: notifyLinked,
+  now: Date.now,
+});
+
+export interface Reply {
+  status: number;
+  body: Record<string, unknown>;
+}
+
+const no = (status: number, error: string): Reply => ({
+  status,
+  body: { error },
+});
+
+function sweep(s: Store, now: number) {
+  for (const r of s.requests.values()) {
+    if (r.state !== "accepted" && now - r.createdAt > REQUEST_TTL_MS) {
+      if (r.state === "revealing" || r.state === "pending") r.state = "expired";
+    }
+    // Finished ones are kept a little so the sender can learn how it ended.
+    if (now - r.createdAt > 2 * REQUEST_TTL_MS) s.requests.delete(r.id);
+  }
+  s.hellos = s.hellos.filter((h) => now - h.at < WINDOW_MS);
+  for (const [k, until] of s.seen) if (until < now) s.seen.delete(k);
+}
+
+const open = (r: Incoming) => r.state === "revealing" || r.state === "pending";
+
+/** A nonce, once per sender, for as long as its timestamp would pass. */
+function fresh(s: Store, from: string, nonce: string, ts: number): boolean {
+  const k = `${from}:${nonce}`;
+  if (s.seen.has(k)) return false;
+  s.seen.set(k, ts + SKEW_MS);
+  return true;
+}
+
+/** POST /api/peer/hello */
+export async function receiveHello(
+  body: unknown,
+  deps: PairingDeps = realPairingDeps(),
+  source = "unknown"
+): Promise<Reply> {
+  const s = store();
+  const now = deps.now();
+  sweep(s, now);
+  const hello = parseHello(body);
+  if (!hello) return no(400, "bad hello");
+  const self = deps.identity();
+  if (!self || hello.to !== self.machineId)
+    return no(403, "this isn't the machine you meant");
+  if (!withinSkew(hello.ts, now))
+    return no(401, "stale: the clocks on the two machines differ");
+  if (
+    s.hellos.filter((h) => h.source === source).length >= PER_SOURCE ||
+    s.hellos.length >= UNPROVEN
+  )
+    return no(429, "too many requests");
+  s.hellos.push({ at: now, from: null, source });
+  const allowed = await deps.allowed();
+  if (allowed !== true)
+    return no(402, "Linking machines needs AgentOS Connect Pro");
+  const listed = await deps.listed(hello.from);
+  // Only a key this machine's own account lists for that machine may ask.
+  if (!listed || listed.signPub !== hello.sign_pub)
+    return no(403, "that machine isn't on this account");
+  if (!verifyHello(hello)) return no(401, "bad signature");
+  if (!fresh(s, hello.from, hello.nonce, hello.ts)) return no(401, "replay");
+  if (
+    keysChanged(hello.from, { signPub: hello.sign_pub, boxPub: hello.box_pub })
+  )
+    return no(409, KEY_CHANGED);
+  const proven = s.hellos.filter((h) => h.from !== null);
+  if (
+    proven.length >= GLOBAL ||
+    proven.filter((h) => h.from === hello.from).length >= PER_SENDER
+  )
+    return no(429, "too many link requests; wait a few minutes");
+  s.hellos[s.hellos.length - 1].from = hello.from;
+  for (const old of s.requests.values())
+    if (old.peer.id === hello.from && open(old)) {
+      old.state = "declined";
+      old.why = "replaced by a newer request";
+    }
+  if ([...s.requests.values()].filter(open).length >= MAX_OPEN)
+    return no(429, "too many link requests waiting here");
+
+  const r: Incoming = {
+    id: randomNonce(16),
+    peer: listed,
+    aSign: hello.sign_pub,
+    aBox: hello.box_pub,
+    commit: hello.commit,
+    bNonce: randomNonce(32),
+    code: null,
+    confirm: null,
+    state: "revealing",
+    why: null,
+    wrong: 0,
+    createdAt: now,
+  };
+  s.requests.set(r.id, r);
+  const ack = signAck(
+    self.signKey,
+    {
+      request_id: r.id,
+      sign_pub: self.signPub,
+      box_pub: deps.boxPub(),
+      b_nonce: r.bNonce,
+    },
+    hello
+  );
+  return { status: 200, body: { ...ack } };
+}
+
+/** Finds the request a signed reveal or status call is about. */
+function askedAbout(
+  s: Store,
+  ask: {
+    from: string;
+    to: string;
+    ts: number;
+    nonce: string;
+    request_id: string;
+  },
+  self: Identity | null,
+  now: number
+): Incoming | Reply {
+  if (!self || ask.to !== self.machineId)
+    return no(403, "this isn't the machine you meant");
+  if (!withinSkew(ask.ts, now)) return no(401, "stale");
+  const r = s.requests.get(ask.request_id);
+  if (!r || r.peer.id !== ask.from) return no(404, "no such request");
+  return r;
+}
+
+/** POST /api/peer/hello/reveal */
+export function receiveReveal(
+  body: unknown,
+  deps: PairingDeps = realPairingDeps()
+): Reply {
+  const s = store();
+  const now = deps.now();
+  sweep(s, now);
+  const reveal = parseReveal(body);
+  if (!reveal) return no(400, "bad reveal");
+  const self = deps.identity();
+  const r = askedAbout(s, reveal, self, now);
+  if (!("id" in r)) return r;
+  if (!verifyReveal(reveal, r.aSign)) return no(401, "bad signature");
+  if (!fresh(s, reveal.from, reveal.nonce, reveal.ts)) return no(401, "replay");
+  if (r.state !== "revealing")
+    return {
+      status: 200,
+      body: { ...signAnswer(self!.signKey, r.state, reveal) },
+    };
+  if (commitTo(r.aBox, r.aSign, reveal.a_nonce) !== r.commit) {
+    // Whoever sent this chose its keys after seeing ours: void it.
+    r.state = "declined";
+    r.why = "its keys didn't match what it committed to";
+    return no(403, "that doesn't match the hello");
+  }
+  const transcript = {
+    from: r.peer.id,
+    to: self!.machineId,
+    aSign: r.aSign,
+    aBox: r.aBox,
+    bSign: self!.signPub,
+    bBox: deps.boxPub(),
+    aNonce: reveal.a_nonce,
+    bNonce: r.bNonce,
+  };
+  r.code = deriveCode(transcript);
+  r.confirm = deriveCode(transcript, "confirm");
+  r.state = "pending";
+  deps.onRequest(r.peer.name);
+  return {
+    status: 200,
+    body: { ...signAnswer(self!.signKey, "pending", reveal) },
+  };
+}
+
+/** POST /api/peer/hello/status */
+export function receiveStatus(
+  body: unknown,
+  deps: PairingDeps = realPairingDeps()
+): Reply {
+  const s = store();
+  const now = deps.now();
+  sweep(s, now);
+  const ask = parseStatusAsk(body);
+  if (!ask) return no(400, "bad status request");
+  const self = deps.identity();
+  const r = askedAbout(s, ask, self, now);
+  if (!("id" in r)) return r;
+  if (!verifyStatusAsk(ask, r.aSign)) return no(401, "bad signature");
+  if (!fresh(s, ask.from, ask.nonce, ask.ts)) return no(401, "replay");
+  const state: LinkState = r.state === "revealing" ? "pending" : r.state;
+  return { status: 200, body: { ...signAnswer(self!.signKey, state, ask) } };
+}
+
+export interface PendingView {
+  id: string;
+  machineId: string;
+  name: string;
+  lastSeenAt: string | null;
+  expiresAt: number;
+  attemptsLeft: number;
+}
+
+/** Requests waiting for a person here to type the code. */
+export function pendingRequests(now = Date.now()): PendingView[] {
+  const s = store();
+  sweep(s, now);
+  return [...s.requests.values()]
+    .filter((r) => r.state === "pending")
+    .map((r) => ({
+      id: r.id,
+      machineId: r.peer.id,
+      name: r.peer.name,
+      lastSeenAt: r.peer.lastSeenAt,
+      expiresAt: r.createdAt + REQUEST_TTL_MS,
+      attemptsLeft: MAX_WRONG - r.wrong,
+    }));
+}
+
+export type AcceptResult =
+  | { ok: true; hostId: string; name: string; confirmCode: string }
+  | { ok: false; status: number; error: string; attemptsLeft?: number };
+
+/** The code a person typed here, from a trusted device (the route checks). */
+export async function acceptRequest(
+  id: string,
+  input: unknown,
+  deps: PairingDeps = realPairingDeps()
+): Promise<AcceptResult> {
+  const s = store();
+  sweep(s, deps.now());
+  const r = s.requests.get(id);
+  if (!r || r.state !== "pending" || !r.code || !r.confirm)
+    return {
+      ok: false,
+      status: 404,
+      error: "That request has ended. Start again from the other machine.",
+    };
+  const code = typedCode(input);
+  if (!code)
+    return {
+      ok: false,
+      status: 400,
+      error: "Type the 6 digits the other machine shows.",
+    };
+  if (!sameCode(code, r.code)) {
+    r.wrong += 1;
+    if (r.wrong >= MAX_WRONG) {
+      r.state = "declined";
+      r.why = "wrong code 3 times";
+      return {
+        ok: false,
+        status: 403,
+        error:
+          "Wrong code 3 times: the request is void. Start again from the other machine.",
+        attemptsLeft: 0,
+      };
+    }
+    return {
+      ok: false,
+      status: 403,
+      error: "That code doesn't match.",
+      attemptsLeft: MAX_WRONG - r.wrong,
+    };
+  }
+  if ((await deps.allowed()) !== true)
+    return {
+      ok: false,
+      status: 402,
+      error: "Linking machines needs AgentOS Connect Pro.",
+    };
+  let hostId: string;
+  try {
+    hostId = deps.pin({ ...r.peer, signPub: r.aSign, boxPub: r.aBox });
+  } catch (err) {
+    r.state = "declined";
+    r.why = "it couldn't be linked here";
+    const error = err instanceof Error ? err.message : String(err);
+    return { ok: false, status: 409, error };
+  }
+  r.state = "accepted";
+  deps.onLinked(r.peer.name);
+  // The person types this on the other machine, which pins this one then.
+  return { ok: true, hostId, name: r.peer.name, confirmCode: r.confirm };
+}
+
+export function declineRequest(id: string): boolean {
+  const r = store().requests.get(id);
+  if (!r || !open(r)) return false;
+  r.state = "declined";
+  r.why = "declined here";
+  return true;
+}

package/lib/peer/pin.ts

@@ -0,0 +1,55 @@
+/**
+ * Pins a machine after pairing: its keys on a Connect host of its own, the
+ * one it already has if it paired before. A re-pair never changes the keys
+ * of a pin: a machine whose keys changed is unlinked first, by a person.
+ */
+
+import { createConnectHost, listRemoteHosts } from "../hosts";
+import { pinForMachine, savePin } from "./links";
+
+export interface Paired {
+  id: string;
+  name: string;
+  hostname: string;
+  signPub: string;
+  boxPub: string;
+}
+
+/** A name no other machine here has, so `aos move <name>` stays clear. */
+function freeName(name: string): string {
+  const taken = new Set(listRemoteHosts().map((h) => h.name.toLowerCase()));
+  if (!taken.has(name.toLowerCase()) && name.toLowerCase() !== "local")
+    return name;
+  for (let n = 2; ; n++)
+    if (!taken.has(`${name} (${n})`.toLowerCase())) return `${name} (${n})`;
+}
+
+export const KEY_CHANGED =
+  "This machine's keys changed since it was linked. Unlink it here first, then link it again.";
+
+/** Whether a machine already linked here holds other keys than these. */
+export function keysChanged(
+  machineId: string,
+  keys: { signPub: string; boxPub?: string }
+): boolean {
+  const pin = pinForMachine(machineId);
+  return (
+    !!pin &&
+    (pin.signPub !== keys.signPub ||
+      (keys.boxPub !== undefined && pin.boxPub !== keys.boxPub))
+  );
+}
+
+export function pinPeer(p: Paired): string {
+  const pinned = pinForMachine(p.id);
+  if (keysChanged(p.id, p)) throw new Error(KEY_CHANGED);
+  const hostId = pinned?.hostId ?? createConnectHost(freeName(p.name)).id;
+  savePin({
+    hostId,
+    machineId: p.id,
+    hostname: p.hostname,
+    signPub: p.signPub,
+    boxPub: p.boxPub,
+  });
+  return hostId;
+}

package/lib/peer/rpc-intake.ts

@@ -119,16 +119,35 @@ export function createBodyBudget(o: Partial<BudgetLimits> = {}): BodyBudget {
 /**
  * Where a request came from: the visitor's address Cloudflare stamps on a
  * tunnel request (the socket there is always cloudflared), else the socket's.
+ * An IPv6 address counts by its /64: one host is usually handed a whole one.
  */
 export function sourceOf(req: IncomingMessage): string {
+  let addr = req.socket.remoteAddress ?? "unknown";
   if (isTunnelSocket(req.socket)) {
     const cf = String(req.headers["cf-connecting-ip"] ?? "").trim();
-    if (isIP(cf)) return cf;
+    if (isIP(cf)) addr = cf;
   }
-  return req.socket.remoteAddress ?? "unknown";
+  return isIP(addr) === 6 ? ipv6Prefix64(addr) : addr;
+}
+
+/** The first four groups of an IPv6 address, expanded: its /64. */
+export function ipv6Prefix64(addr: string): string {
+  const plain = addr.split("%")[0].toLowerCase();
+  if (/^::ffff:\d+\.\d+\.\d+\.\d+$/.test(plain)) return plain.slice(7);
+  const [head, tail = ""] = plain.split("::");
+  const a = head ? head.split(":") : [];
+  const b = plain.includes("::") && tail ? tail.split(":") : [];
+  // An embedded IPv4 tail takes two groups; it never reaches the first four
+  // unless the address is mostly zeros, which then pads them.
+  const fill = Array(Math.max(0, 8 - a.length - b.length)).fill("0");
+  const groups = [...a, ...fill, ...b].slice(0, 4);
+  return `${groups.map((g) => g.replace(/^0+(?=.)/, "")).join(":")}::/64`;
 }
 
 export interface Pace {
+  /** How long the header and its signature may take: they fit in the
+   * first packet, so a sender that holds them back is stalling. */
+  headerMs: number;
   /** How long the first bytes may take before a rate is required. */
   graceMs: number;
   /** Bytes per second the body must keep up after the grace period, */
@@ -138,6 +157,7 @@ export interface Pace {
 }
 
 export const DEFAULT_PACE: Pace = {
+  headerMs: 3_000,
   graceMs: 10_000,
   minRate: 512 * 1024,
   windowMs: 5_000,
@@ -183,7 +203,7 @@ export function readEnvelope(
       if (v instanceof Error) reject(v);
       else resolve(v);
     };
-    const { graceMs, minRate, windowMs } = o.pace;
+    const { headerMs, graceMs, minRate, windowMs } = o.pace;
     // (time, bytes so far), back to the start of the current window.
     const samples = [{ t: started, total: 0 }];
     const timer = setInterval(
@@ -192,12 +212,14 @@ export function readEnvelope(
         samples.push({ t: now, total });
         while (samples.length > 1 && samples[1].t <= now - windowMs)
           samples.shift();
+        if (!proven && now - started > headerMs)
+          return finish({ tooSlow: true });
         if (now - started <= graceMs) return;
         const base = samples[0];
         if (total - base.total < ((now - base.t) / 1000) * minRate)
           finish({ tooSlow: true });
       },
-      Math.max(25, Math.min(1000, graceMs / 4, windowMs / 4))
+      Math.max(25, Math.min(1000, headerMs / 4, graceMs / 4, windowMs / 4))
     );
     req.on("data", (chunk: Buffer) => {
       if (done) return;
@@ -211,10 +233,17 @@ export function readEnvelope(
       const len = head.readUInt32BE(0);
       if (len > MAX_HEADER) return finish({ refusal: "bad_envelope" });
       if (head.length < 4 + len + HEADER_SIG) return;
-      const seen = o.early(
-        head.subarray(4, 4 + len),
-        head.subarray(4 + len, 4 + len + HEADER_SIG)
-      );
+      let seen;
+      try {
+        seen = o.early(
+          head.subarray(4, 4 + len),
+          head.subarray(4 + len, 4 + len + HEADER_SIG)
+        );
+      } catch {
+        // A throw here would escape the 'data' handler and take the server
+        // down; whatever failed (the database, say), the caller is told busy.
+        return finish({ refusal: "busy" });
+      }
       if ("refusal" in seen) return finish({ refusal: seen.refusal });
       if (!o.ticket.prove(seen.peer)) return finish({ refusal: "busy" });
       proven = true;

package/lib/peer/rpc-server.ts

@@ -177,6 +177,13 @@ export async function handlePeerRpc(
     return null;
   };
 
+  // The one nonce the header claimed: the whole envelope must carry it.
+  let claimed: string | null = null;
+  const spent: ReplayGuard = {
+    check: (peer, nonce) =>
+      claimed !== null && claimed === `${peer}:${nonce}` ? "ok" : "replay",
+  };
+
   if (!deps.anyActive()) return plain(res, 404, "not found");
   const ticket = deps.budget.open(sourceOf(req));
   if (!ticket) return void refuse("busy");
@@ -193,6 +200,17 @@ export async function handlePeerRpc(
             return { refusal: "bad_sig" };
           const now = deps.now?.() ?? Date.now();
           if (Math.abs(now - header.ts) > SKEW_MS) return { refusal: "stale" };
+          // The nonce is spent the moment its header is proven, so a header
+          // seen on the wire can't be sent again with junk bodies to hold
+          // the sender's share while the first is still arriving.
+          const fresh = deps.replay.check(
+            header.from,
+            header.nonce,
+            header.ts,
+            now
+          );
+          if (fresh !== "ok") return { refusal: fresh };
+          claimed = `${header.from}:${header.nonce}`;
           return { peer: header.from };
         },
         ticket,
@@ -209,7 +227,7 @@ export async function handlePeerRpc(
       self: self.machineId,
       boxKey: deps.boxKey().privateKey,
       signKeyFor,
-      replay: deps.replay,
+      replay: spent,
       now: deps.now?.(),
     });
   };

package/lib/schedules/when.ts

@@ -26,7 +26,7 @@ const UNIT_MS: Record<string, number> = {
   d: 86_400_000,
 };
 
-function duration(text: string): number | null {
+export function duration(text: string): number | null {
   let total = 0;
   const rest = text.replace(
     /(\d+(?:\.\d+)?|an?)\s*(minutes?|mins?|m|hours?|hrs?|h|days?|d)\b/g,

package/lib/security/auth.ts

@@ -18,6 +18,9 @@ export const DEVICE_COOKIE = "aos_device";
 export const DEVICE_HEADER = "x-agentos-device";
 export const TRUST_HEADER = "x-agentos-trust";
 export const REMOTE_HEADER = "x-agentos-remote";
+// Who sent it, for per-sender limits: the visitor's address on a Connect
+// request (lib/peer/rpc-intake sourceOf), an IPv6 address by its /64.
+export const SOURCE_HEADER = "x-agentos-source";
 // The rpc server's loopback hop (lib/peer/rpc-server): the per-boot secret,
 // and the linked machine it verified. Never trusted from anywhere else.
 export const PEER_INTERNAL_HEADER = "x-agentos-peer-internal";
@@ -81,12 +84,17 @@ const FORWARDING = new Set([
 const FORWARDING_PREFIXES = ["x-forwarded-", "cf-", "tailscale-"];
 
 // Reached without a token: the pairing page, what it needs to render, the
-// claim it posts, and a linked machine's rpc (its envelope is the proof). Exact paths, plus a few static asset folders whose
-// paths may only use plain characters (no traversal, no encoding).
+// claim it posts, a linked machine's rpc (its envelope is the proof) and
+// the pairing hellos (signed by a key the account lists). Exact paths, plus
+// a few static asset folders whose paths may only use plain characters (no
+// traversal, no encoding).
 const PUBLIC_EXACT = new Set([
   "/pair",
   "/api/pair/claim",
   "/api/peer/rpc",
+  "/api/peer/hello",
+  "/api/peer/hello/reveal",
+  "/api/peer/hello/status",
   "/manifest.webmanifest",
   "/manifest.json",
   "/favicon.ico",

package/lib/security/gate.ts

@@ -14,6 +14,7 @@ import {
   DEVICE_HEADER,
   TRUST_HEADER,
   REMOTE_HEADER,
+  SOURCE_HEADER,
   PEER_HEADER,
   PEER_INTERNAL_HEADER,
   type AuthPolicy,
@@ -25,6 +26,7 @@ import { tailscaleAddresses } from "./net";
 import { networkSetting } from "./network-settings";
 import { pairLocation } from "../session-url";
 import { peerSecret } from "../peer/internal";
+import { sourceOf } from "../peer/rpc-intake";
 
 // Interface addresses change rarely; don't re-read them on every request.
 let tailnetCache = { at: 0, ips: [] as string[] };
@@ -63,6 +65,7 @@ function decide(req: IncomingMessage, policy: AuthPolicy): AuthResult {
     delete req.headers[PEER_HEADER];
   const tunnel = isTunnelSocket(req.socket);
   req.headers[REMOTE_HEADER] = sourceLabel(req.socket.remoteAddress, tunnel);
+  req.headers[SOURCE_HEADER] = sourceOf(req);
   let result: AuthResult;
   try {
     result = authorize(

package/lib/sessions/end.ts

@@ -4,6 +4,7 @@ import { waitForExit } from "../chat/worker/client";
 import { endTmuxSession } from "../tmux/end";
 import { releaseOnEnd, shutTaskSimulators } from "../simulator";
 import { forgetPlanWait } from "../models/plan-step";
+import { kickWaits } from "../bus/waits/kick";
 
 type Agent = Pick<Session, "id" | "host_id" | "tmux_name"> &
   Partial<Pick<Session, "worktree_path" | "branch_name">>;
@@ -20,4 +21,6 @@ export async function endSessionAgent(s: Agent): Promise<void> {
   shutTaskSimulators(s);
   void waitForExit(s.id).catch(() => {});
   await endTmuxSession(s.host_id, s.tmux_name);
+  // Whoever waits on it is told now, not at the next sweep.
+  kickWaits();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.698",
+  "version": "0.3.700",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/agent-os

@@ -83,6 +83,8 @@ case "${1:-}" in
     pair)             node "$SCRIPT_DIR/pair.mjs" "$PORT" ;;
     connect)          shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/connect/cli.ts "$@") ;;
     disconnect)       (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/connect/cli.ts --off) ;;
+    link)             shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/peer/cli.ts "$PORT" "$@") ;;
+    unlink)           shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/peer/cli.ts "$PORT" --unlink "$@") ;;
     passkeys)         shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/security/passkeys-cli.ts "$@") ;;
     logs)             cmd_logs ;;
     update)           cmd_update ;;