@tea-agent/loop-agent 0.18.1 → 0.19.0

package/dist/worker/console/security.js

@@ -51,8 +51,8 @@ function safeEqualToken(a, b) {
 }
 /**
  * Minimum mutation challenge (design §9):
- * cookie boot token AND custom confirmation header/token + Host loopback +
- * Origin matches Console + Sec-Fetch-Site not cross-site.
+ * cookie boot token AND custom confirmation header/token + Host/Origin checks +
+ * Sec-Fetch-Site not cross-site.
  */
 export function evaluateMutationGate(req, ctx) {
     const cookieToken = parseCookieHeader(req.headers.cookie, BOOT_CAPABILITY_COOKIE);
@@ -92,7 +92,16 @@ export function evaluateMutationGate(req, ctx) {
     }
     const hostHeader = req.headers.host ?? "";
     const hostOnly = hostHeader.split(":")[0] ?? "";
-    if (!isLoopbackHost(hostOnly)) {
+    if (ctx.allowNonLoopbackAccess) {
+        if (!hostHeader.trim()) {
+            return {
+                status: 403,
+                code: "host-not-loopback",
+                message: "Host header is required for non-loopback Console binds",
+            };
+        }
+    }
+    else if (!isLoopbackHost(hostOnly)) {
         return {
             status: 403,
             code: "host-not-loopback",
@@ -100,7 +109,23 @@ export function evaluateMutationGate(req, ctx) {
         };
     }
     const origin = req.headers.origin;
-    if (typeof origin !== "string" ||
+    if (ctx.allowNonLoopbackAccess) {
+        const expectedFromHost = hostHeader.trim()
+            ? `http://${hostHeader.trim()}`
+            : "";
+        const originOk = typeof origin === "string" &&
+            origin.length > 0 &&
+            (origin === ctx.consoleOrigin ||
+                (Boolean(expectedFromHost) && origin === expectedFromHost));
+        if (!originOk) {
+            return {
+                status: 403,
+                code: "origin-mismatch",
+                message: "Origin does not match Console access URL",
+            };
+        }
+    }
+    else if (typeof origin !== "string" ||
         origin.length === 0 ||
         origin !== ctx.consoleOrigin) {
         return {

package/dist/worker/console/server.js

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
 import { createServer } from "node:http";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -12,25 +13,35 @@ import { isLoopbackHost } from "./loopback.js";
 import { createOperationEventStore, } from "./operation-sse.js";
 import { OperationStore } from "./operation-store.js";
 import { probePiReadiness, } from "./pi-readiness.js";
-import { handleConsoleRequest, serveConsoleStatic, } from "./routes.js";
+import { handleConsoleHealthRequest, handleConsoleOperatorRequest, sendJson, serveConsoleStatic, } from "./routes.js";
 import { issueBootCapabilityToken } from "./security.js";
 import { resolveSiblingLoopAgentBin } from "./sibling-controller.js";
+import { deriveObserveRouteCapabilities } from "../observe/health.js";
+import { createObserveRouteContext, defaultObserveStaticDir, handleMatchedObserveRoute, matchObserveGetRoute, ROUTES, serveObserveStatic, } from "../observe/routes.js";
 /** Built static assets live next to the compiled server under dist/worker/console/static. */
 export function defaultConsoleStaticDir(fromFileUrl = import.meta.url) {
     return path.join(path.dirname(fileURLToPath(fromFileUrl)), "static");
 }
 /**
  * Create Loop Operator Console HTTP server.
- * Non-loopback host throws before listen (fail closed).
+ * Default bind is loopback; non-loopback hosts warn and stay allowed for LAN,
+ * matching Observe serve (mutations still require cookie + confirmation + Origin).
  */
 export async function createConsoleServer(options) {
     const host = options.host ?? "127.0.0.1";
-    if (!isLoopbackHost(host)) {
-        throw new Error(`console serve: non-loopback host "${host}" is not allowed (fail closed; use 127.0.0.1 or localhost)`);
+    const loopbackBind = isLoopbackHost(host);
+    if (!loopbackBind) {
+        process.stderr.write(`console serve: binding non-loopback host ${host} (Operator mutations enabled; no network auth — expose only on trusted networks)\n`);
     }
     const repoRoot = path.resolve(options.repoRoot);
     const port = options.port ?? 8790;
+    const debug = options.debug === true;
+    const keepAliveTimeoutMs = options.keepAliveTimeoutMs ?? 65_000;
     const staticDir = options.staticDir ?? defaultConsoleStaticDir();
+    const inspectStaticDir = options.inspectStaticDir ?? defaultObserveStaticDir();
+    const observeRouteContext = createObserveRouteContext(repoRoot, {
+        staticDir: inspectStaticDir,
+    });
     const bootToken = issueBootCapabilityToken();
     const operatorSessionId = `sess_${randomBytes(16).toString("hex")}`;
     const appData = openConsoleAppData({
@@ -83,6 +94,7 @@ export async function createConsoleServer(options) {
         refreshReadiness,
         observeBaseUrl: options.observeBaseUrl,
         fetchImpl: options.fetchImpl,
+        getConsoleOrigin: () => `http://${boundHost}:${boundPort}`,
     };
     let boundHost = host;
     let boundPort = port;
@@ -92,6 +104,11 @@ export async function createConsoleServer(options) {
         staticDir,
         bootToken,
         getConsoleOrigin,
+        allowNonLoopbackAccess: !loopbackBind,
+        inspect: {
+            ready: existsSync(path.join(inspectStaticDir, "index.html")),
+            routeCapabilities: deriveObserveRouteCapabilities(ROUTES),
+        },
         operator: {
             actionContext,
             operations,
@@ -101,6 +118,21 @@ export async function createConsoleServer(options) {
     };
     return new Promise((resolve, reject) => {
         const server = createServer((req, res) => {
+            const startedAt = Date.now();
+            if (debug) {
+                let logged = false;
+                const onceLog = (note) => {
+                    if (logged)
+                        return;
+                    logged = true;
+                    logConsoleRequest(req, res, startedAt, note);
+                };
+                res.on("finish", () => onceLog());
+                res.on("close", () => {
+                    if (!res.writableFinished)
+                        onceLog("aborted");
+                });
+            }
             void dispatch(req, res).catch((error) => {
                 if (!res.headersSent) {
                     const payload = JSON.stringify({
@@ -114,13 +146,54 @@ export async function createConsoleServer(options) {
                 }
             });
         });
+        server.keepAliveTimeout = keepAliveTimeoutMs;
+        server.headersTimeout = keepAliveTimeoutMs + 5_000;
+        server.requestTimeout = 0;
+        server.on("connection", (socket) => {
+            socket.on("error", () => {
+                // Ignore client resets while retaining one listener per connection.
+            });
+        });
+        server.on("clientError", (err, socket) => {
+            if (debug) {
+                process.stderr.write(`[console] ${new Date().toISOString()} clientError ${err.message}\n`);
+            }
+            if (!socket.destroyed) {
+                socket.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+            }
+        });
         async function dispatch(req, res) {
             // Refresh readiness pointer on each request surface
             actionContext.readiness = getReadiness();
-            const handled = await handleConsoleRequest(req, res, routeContext);
-            if (!handled) {
-                await serveConsoleStatic(req, res, routeContext);
+            const method = (req.method ?? "GET").toUpperCase();
+            const pathname = decodeURIComponent(new URL(req.url ?? "/", "http://localhost").pathname);
+            if (method === "GET" && pathname === "/api/health") {
+                await handleConsoleHealthRequest(req, res, routeContext);
+                return;
             }
+            if (pathname.startsWith("/api/operator/v1/") ||
+                pathname.startsWith("/api/session/")) {
+                await handleConsoleOperatorRequest(req, res, routeContext);
+                return;
+            }
+            if (method === "GET" && pathname.startsWith("/api/")) {
+                const match = matchObserveGetRoute(pathname);
+                if (match) {
+                    await handleMatchedObserveRoute(req, res, match, observeRouteContext);
+                    return;
+                }
+            }
+            if (pathname.startsWith("/inspect")) {
+                await serveObserveStatic(req, res, inspectStaticDir, {
+                    urlPrefix: "/inspect",
+                });
+                return;
+            }
+            if (pathname.startsWith("/api/")) {
+                sendJson(res, 404, { error: "Not found" });
+                return;
+            }
+            await serveConsoleStatic(req, res, routeContext);
         }
         server.on("error", reject);
         server.listen(port, host, () => {
@@ -132,7 +205,12 @@ export async function createConsoleServer(options) {
             boundHost = host;
             boundPort = addr.port;
             const url = `http://${host}:${addr.port}`;
-            process.stderr.write(`[console] Loop Operator Console listening on ${url} (loopback only)\n`);
+            if (debug) {
+                process.stderr.write(`[console] debug logging enabled; keepAliveTimeout=${keepAliveTimeoutMs}ms\n`);
+            }
+            process.stderr.write(`[console] Loop Operator Console listening on ${url}${loopbackBind
+                ? " (loopback)"
+                : " (non-loopback; trusted networks only)"}\n`);
             resolve({
                 url,
                 host,
@@ -149,6 +227,26 @@ export async function createConsoleServer(options) {
         });
     });
 }
+function requestSource(req) {
+    const forwarded = req.headers["x-forwarded-for"];
+    if (typeof forwarded === "string" && forwarded.trim()) {
+        return forwarded.split(",")[0]?.trim() || forwarded.trim();
+    }
+    if (Array.isArray(forwarded) && forwarded[0]) {
+        return forwarded[0].split(",")[0]?.trim() || forwarded[0];
+    }
+    const realIp = req.headers["x-real-ip"];
+    if (typeof realIp === "string" && realIp.trim()) {
+        return realIp.trim();
+    }
+    return req.socket.remoteAddress ?? "-";
+}
+function logConsoleRequest(req, res, startedAt, note) {
+    const ms = Date.now() - startedAt;
+    const ua = String(req.headers["user-agent"] ?? "-").slice(0, 120);
+    const suffix = note ? ` ${note}` : "";
+    process.stderr.write(`[console] ${new Date().toISOString()} ${req.method ?? "?"} ${req.url ?? "/"} ${res.statusCode} ${ms}ms from=${requestSource(req)} ua=${JSON.stringify(ua)}${suffix}\n`);
+}
 /** Test helper: replace readiness report in-process. */
 export function setConsoleReadinessForTests(server, report) {
     if (!server.getReadiness)