@songsid/agend 2.1.9 → 2.1.10-beta.1

package/dist/fleet-manager.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, constants as fsConstants } from "node:fs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { freemem, totalmem, cpus } from "node:os";
+import { freemem, totalmem, cpus, homedir } from "node:os";
 import { createServer } from "node:http";
 import { Worker } from "node:worker_threads";
 import { join, dirname, basename, delimiter, isAbsolute } from "node:path";
@@ -77,6 +77,7 @@ import { buildToolPermissionsNotice } from "./tool-permissions-notice.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
 import { decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
+import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
 import { fleetLevelDifferences, fleetLevelSignature } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
 import { SecretStore } from "./secret-store.js";
@@ -593,7 +594,7 @@ export class FleetManager {
             if (event.deliveryId && (event.state === "failed" || event.state === "uncertain")) {
                 const row = outbox.get(event.deliveryId);
                 if (row && row.kind !== "delivery_outcome_notice" && row.kind !== "post_restart_outcome_notice") {
-                    const notice = `Durable delivery ${row.state}: operation_id=${row.operationId}; target=${row.targetInstance}; delivery_id=${row.deliveryId}.`;
+                    const notice = t(`delivery.fleet_${row.state}`, row.targetInstance, row.operationId, row.deliveryId);
                     this.logger.error({ deliveryId: row.deliveryId, operationId: row.operationId, target: row.targetInstance, state: row.state }, notice);
                     this.notifyFleetError(notice);
                 }
@@ -614,7 +615,7 @@ export class FleetManager {
             this.scheduleDeliveryOutboxPump();
             this.wakeCoordinator?.kick();
             if (event.count)
-                this.notifyFleetError(`${event.count} durable delivery row(s) reached the 24-hour outbox bound; ${event.uncertain ?? 0} unresolved submissions are uncertain and sender notices were queued.`);
+                this.notifyFleetError(t("delivery.expired", event.count, event.uncertain ?? 0));
         });
         this.scheduleDeliveryOutboxPump();
     }
@@ -926,7 +927,7 @@ export class FleetManager {
                 if ((current?.state === "delivering" || current?.state === "submission_started")
                     && current.targetDaemonBootId === claimed.targetDaemonBootId
                     && current.managerBootId === claimed.managerBootId) {
-                    this.notifyFleetError(`Durable delivery to ${claimed.targetInstance} is still waiting after ${Math.round(DURABLE_DELIVERY_LANE_ALERT_MS / 60_000)} minutes; the same daemon generation retains delivery ${deliveryId}'s lane until it reports or is replaced.`);
+                    this.notifyFleetError(t("delivery.lane_waiting", claimed.targetInstance, Math.round(DURABLE_DELIVERY_LANE_ALERT_MS / 60_000), deliveryId));
                 }
             }, DURABLE_DELIVERY_LANE_ALERT_MS);
             alertTimer.unref?.();
@@ -4773,6 +4774,7 @@ export class FleetManager {
                     const targetInstance = String(msg.targetInstance ?? name);
                     const correlationId = String(msg.correlationId ?? "unknown");
                     const error = String(msg.error ?? "unknown delivery failure");
+                    const displayError = error.replace(/^delivery failed: phase=(.*); proof=(.*)$/, (_match, phase, proof) => t("delivery.pane_failure", phase, proof));
                     const senderInstance = this.instanceIpcClients.has(senderSession)
                         ? senderSession
                         : this.sessionRegistry.get(senderSession);
@@ -4781,11 +4783,11 @@ export class FleetManager {
                         from: senderSession, correlation_id: correlationId, error,
                     });
                     if (senderInstance) {
-                        this.notifyInstanceTopic(senderInstance, t("cross_instance.delivery_failed_notice", targetInstance, error, correlationId));
+                        this.notifyInstanceTopic(senderInstance, t("cross_instance.delivery_failed_notice", targetInstance, displayError, correlationId));
                         void this.deliverToInstance(senderInstance, {
                             type: "fleet_inbound",
                             targetSession: senderSession,
-                            content: t("cross_instance.delivery_failed_agent", targetInstance, error, correlationId),
+                            content: t("cross_instance.delivery_failed_agent", targetInstance, displayError, correlationId),
                             meta: {
                                 chat_id: "",
                                 message_id: `delivery-failed-${Date.now()}`,
@@ -5061,7 +5063,7 @@ export class FleetManager {
      */
     governingAccess(msg, threadId) {
         if (threadId && !this.classicChannels?.hasChannel(threadId)) {
-            const target = this.routing.resolve(threadId);
+            const target = this.resolveInboundTarget(msg, threadId);
             if (target) {
                 const owner = this.getInstanceAdapterId(target.name);
                 if (owner)
@@ -5097,7 +5099,7 @@ export class FleetManager {
             return null;
         if (this.classicChannels?.hasChannel(threadId))
             return null;
-        const target = this.routing.resolve(threadId);
+        const target = this.resolveInboundTarget(msg, threadId);
         if (!target)
             return null;
         const ownerAdapterId = this.getInstanceAdapterId(target.name);
@@ -5129,7 +5131,7 @@ export class FleetManager {
                 return "classic: collab off";
             return null;
         }
-        const target = this.routing.resolve(threadId);
+        const target = this.resolveInboundTarget(msg, threadId);
         if (!target)
             return "fleet topic: no instance routed for this thread";
         // Fleet topic: this gate lets the copy through when the adapter is open OR
@@ -5162,8 +5164,42 @@ export class FleetManager {
             return;
         this.logger.warn({ statePath, configured, inEffect: accessManager.getMode() }, `access mode "${accessManager.getMode()}" comes from the state file and overrides "${configured}" in fleet.yaml; delete ${statePath} to go back to the configured value`);
     }
+    /**
+     * #1085: the thread id inbound routing may use. Telegram topic ids are small
+     * integers numbered per group, but the routing table is keyed by topic id
+     * alone — so a message in topic 30 of ANY group the bot is in resolved to
+     * the fleet instance that owns topic 30 of the fleet's own group (and a group
+     * that never ran /start was bound by coincidence). A Telegram topic counts
+     * as a fleet topic only in the fleet's group: `chat_id == group_id` of the
+     * receiving bot's channel. From any other group the message is a ClassicBot
+     * candidate keyed by its chat id (served only if /start registered it,
+     * ignored otherwise). Discord channel ids are global, so they are unaffected.
+     */
+    inboundRouteThreadId(msg) {
+        const raw = msg.threadId || undefined;
+        if (!raw || msg.source !== "telegram")
+            return raw;
+        const fleetGroupId = this.getChannelConfig(msg.adapterId)?.group_id;
+        if (fleetGroupId != null && String(fleetGroupId) === msg.chatId)
+            return raw;
+        this.logger.debug({ adapterId: msg.adapterId, chatId: msg.chatId, threadId: raw }, "Telegram topic outside the fleet group — not a fleet topic (#1085)");
+        return undefined;
+    }
+    /**
+     * #1085, defense in depth: a routed Telegram target must belong to the group
+     * the message came from — its own world's group_id. Two Telegram fleet
+     * worlds can number topics alike; a coincidence is dropped, never delivered.
+     */
+    resolveInboundTarget(msg, threadId) {
+        if (msg.source !== "telegram")
+            return this.routing.resolve(threadId);
+        return this.routing.resolveAll(threadId).find(target => {
+            const ownerGroupId = this.getChannelConfig(this.getInstanceAdapterId(target.name))?.group_id;
+            return ownerGroupId != null && String(ownerGroupId) === msg.chatId;
+        });
+    }
     async handleInboundMessage(msg) {
-        const threadId = msg.threadId || undefined;
+        const threadId = this.inboundRouteThreadId(msg);
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
         // Ownership and per-adapter filtering both run before the dedup claim below.
         // When several bots share a guild they all receive the same message; a copy
@@ -5219,7 +5255,7 @@ export class FleetManager {
         // the message (the @mention filter downstream decides who actually forwards).
         // Key the dedup per-adapter there so a sibling bot's copy isn't dropped.
         if (msg.messageId) {
-            const classicCid = msg.threadId || msg.chatId;
+            const classicCid = threadId || msg.chatId;
             const isClassicMsg = this.classicChannels?.hasChannel(classicCid) ?? false;
             const dedupKey = isClassicMsg
                 ? `${msg.source}:${msg.chatId}:${msg.messageId}:${msg.adapterId ?? ""}`
@@ -5508,7 +5544,7 @@ export class FleetManager {
                     // TG ClassicBot: group requires @mention, private chat forwards directly.
                     if (!isPrivateChat && !isBotMentioned) {
                         // No trigger: save attachments + react, log, but don't forward to agent
-                        const syntheticMsg = { ...msg, threadId: chatId, text: rawText.startsWith("/") ? "" : rawText };
+                        const syntheticMsg = { ...msg, threadId: chatId, transportThreadId: msg.threadId || undefined, text: rawText.startsWith("/") ? "" : rawText };
                         await this.handleClassicChannelMessage(classicName, syntheticMsg);
                         return;
                     }
@@ -5522,7 +5558,7 @@ export class FleetManager {
                         await msgAdapter?.sendText(chatId, t("cmd.admin_required", "/raw"));
                         return;
                     }
-                    const syntheticMsg = { ...msg, threadId: chatId, text: `/chat ${cleanText}` };
+                    const syntheticMsg = { ...msg, threadId: chatId, transportThreadId: msg.threadId || undefined, text: `/chat ${cleanText}` };
                     await this.handleClassicChannelMessage(classicName, syntheticMsg);
                     return;
                 }
@@ -5609,7 +5645,7 @@ export class FleetManager {
             await this.handleClassicChannelMessage(classicName, msg);
             return;
         }
-        const target = this.routing.resolve(threadId);
+        const target = this.resolveInboundTarget(msg, threadId);
         if (!target) {
             // Only show unbound message for actual forum topics (same group, has threadId)
             const adapterGroupId = String(this.getChannelConfig(msg.adapterId)?.group_id ?? "");
@@ -5849,8 +5885,18 @@ export class FleetManager {
         const classicChannelId = this.classicChannels?.getChannelIdByInstance(senderInstanceName ?? instanceName);
         if (classicChannelId) {
             args.chat_id = classicChannelId;
-            delete args.thread_id;
-            threadId = undefined;
+            // #1085: a Telegram forum ClassicBot replies in the topic it was asked
+            // in. Any other thread_id (threadless Telegram, where it echoes the chat
+            // id, or a Discord channel) is still cleared, as before.
+            const topic = typeof args.thread_id === "string" ? args.thread_id : "";
+            const telegram = (contextWorld?.adapter ?? outAdapter)?.type === "telegram";
+            if (telegram && topic && topic !== classicChannelId) {
+                threadId = topic;
+            }
+            else {
+                delete args.thread_id;
+                threadId = undefined;
+            }
         }
         // Reply dedup: retries land here when the agent was told a send failed
         // (daemon budget elapsed, shell tool killed) while the adapter send was
@@ -6922,7 +6968,7 @@ export class FleetManager {
     quarantineMissingTopic(threadId, target, evidence) {
         if (!isProbeableRouteTarget(target) || this.routing.resolve(threadId) !== target)
             return;
-        this.routing.unregister(threadId);
+        this.routing.unregister(threadId, target.name);
         this.logger.error({ instanceName: target.name, threadId, ...evidence }, "Topic is confirmed missing — route quarantined; instance configuration and user data were retained");
         this.notifyFleetError(t("fleet.topic_quarantined", target.name, threadId));
     }
@@ -9375,6 +9421,7 @@ export class FleetManager {
                 releaseWindow: claim => { this.loginWindow.release(claim); },
                 isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
                 windowBusyMessage: () => this.loginWindow.busyMessage(),
+                tunnelDataDir: () => this.dataDir,
                 postButtons: async ({ prefix, instanceName, chat, message, choices, expiredText }) => {
                     await this.postNonceButtonPrompt({
                         prefix, alertType: "login", instanceName,
@@ -9892,7 +9939,7 @@ export class FleetManager {
     }
     /** Re-login confirmation (auth pre-check said credentials still work). */
     async handleLoginConfirm(data, callbackAdapterId, receivingAdapter) {
-        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|go-relogin|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|go-relogin|go-tunnel|go-relogin-tunnel|cancel)$/, data, callbackAdapterId, receivingAdapter);
         if (claimed === null)
             return false;
         if (claimed === "consumed")
@@ -9910,7 +9957,12 @@ export class FleetManager {
             chatId: entry.chatId,
             threadId: entry.threadId,
             userId: data.userId,
-        }, { skipAuthCheck: true, tokenPresent: action === "go-relogin" });
+        }, {
+            skipAuthCheck: true,
+            tokenPresent: action === "go-relogin" || action === "go-relogin-tunnel",
+            // The consent is the button itself: only the explicit "Open public link" actions carry it.
+            tunnel: action === "go-tunnel" || action === "go-relogin-tunnel",
+        });
         if (text)
             await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
         return true;
@@ -10005,7 +10057,7 @@ export class FleetManager {
                 }
                 // The installer may only have added the binary to a profile PATH; a
                 // fresh login shell sees that, the fleet process's PATH may not.
-                const installedAt = this.locateBinaryOnLoginShell(info.binary);
+                const installedAt = this.locateBinaryOnLoginShell(info.binary) ?? this.locateInInstallerBinDirs(info);
                 if (!installedAt) {
                     await chat.adapter.sendText(chat.chatId, t("install.verify_failed", backend, info.binary), { threadId: chat.threadId }).catch(() => { });
                     return;
@@ -10094,6 +10146,26 @@ export class FleetManager {
             return null;
         }
     }
+    /**
+     * #1092: the binary in one of the directories its own installer installs to,
+     * when no login shell can see it (the installer recorded its PATH in an
+     * interactive-only rc file). The same executable-file check as the login
+     * shell lookup; a symlink to an executable counts, as codex's launcher is one.
+     */
+    locateInInstallerBinDirs(info) {
+        for (const dir of info.binDirs?.(process.env, homedir()) ?? []) {
+            if (!isAbsolute(dir))
+                continue;
+            const path = join(dir, info.binary);
+            try {
+                accessSync(path, fsConstants.X_OK);
+                if (statSync(path).isFile())
+                    return path;
+            }
+            catch { /* not there */ }
+        }
+        return null;
+    }
     /** Put an installed binary's directory on the fleet's PATH (#1059), once. */
     adoptBinaryDirectory(binaryPath, backend) {
         const dir = dirname(binaryPath);
@@ -10854,6 +10926,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     /** Forward a message to a classic channel instance with chat log context */
     async forwardToClassicInstance(instanceName, text, msg, extraMeta) {
+        // #1085: a Telegram forum ClassicBot is keyed by chat id (threadId), but the
+        // reply context must carry the topic the message was really asked in.
+        const replyThreadId = msg.transportThreadId ?? msg.threadId;
         // Resolve the channel/adapter from the instance itself so per-channel context
         // config is correct even for a same-channel second bot.
         const ctxAdapterId = this.classicChannels?.getAdapterIdByInstance(instanceName);
@@ -10869,7 +10944,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             user: msg.username,
             user_id: msg.userId,
             ts: msg.timestamp.toISOString(),
-            thread_id: msg.threadId ?? "",
+            thread_id: replyThreadId ?? "",
             ...(msg.adapterId ? { adapter_id: msg.adapterId } : {}),
             source: msg.source,
             ...extraMeta,
@@ -10906,7 +10981,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         this.lastInboundUser.set(instanceName, msg.username);
         this.logger.info(`${msg.username} → ${instanceName} (classic): ${text.slice(0, 100)}`);
-        this.trackInboundMsg(instanceName, msg);
+        this.trackInboundMsg(instanceName, { ...msg, threadId: replyThreadId });
         void this.sendCancelButton(instanceName);
     }
     /** Paste raw text directly to a classic instance's CLI (no [user:] wrapping) */
@@ -14106,6 +14181,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return false; // identical
     }
     // ── Health HTTP endpoint ─────────────────────────────────────────────
+    /** Distinct rejected Host names already logged; bounded so a scanner cannot grow it. */
+    rejectedHostsLogged = new Set();
+    /**
+     * Say once per name why a request was refused, so a reverse-proxy deployment
+     * that stopped working after the Host check is diagnosable from fleet.log.
+     * Only the parsed host name is logged, never the raw header.
+     */
+    noteRejectedHost(header) {
+        const name = typeof header === "string" ? (hostnameOf(header) ?? "(malformed)") : "(missing)";
+        if (this.rejectedHostsLogged.has(name) || this.rejectedHostsLogged.size >= 32)
+            return;
+        this.rejectedHostsLogged.add(name);
+        this.logger.warn({ host: name }, "Web request refused: Host is not allowed (add it to web.allowed_hosts if this is a proxy you run)");
+    }
     startHealthServer(port) {
         this.startedAt = Date.now();
         this.healthServerListening = false;
@@ -14121,6 +14210,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // Authorization now depends on a cookie, so a shared cache (a tunnel, a
             // corporate proxy) must not serve one visitor's response to another.
             res.setHeader("Vary", "Cookie");
+            applyWebSecurityHeaders(res);
+            // Before any route, /health and /agent included: loopback binding does not
+            // stop DNS rebinding, and the Host the browser sends is the one thing a
+            // rebinding page cannot change.
+            if (!isHostAllowed(req.headers.host, allowedHostNames(this.fleetConfig))) {
+                this.noteRejectedHost(req.headers.host);
+                res.writeHead(403);
+                res.end(JSON.stringify({ error: WEB_HOST_REJECTED_MESSAGE }));
+                return;
+            }
             const requestPath = new URL(req.url ?? "/", `http://localhost:${port}`).pathname;
             // Browsers request this automatically and AgEnD does not ship an icon.
             // It is neither user data nor an API route, so do not turn the harmless