agent-dag 1.33.69 → 1.33.71

package/dist/web/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>agents-deck</title>
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Ctext y='84' font-size='84'%3E%E2%97%89%3C/text%3E%3C/svg%3E" />
-    <script type="module" crossorigin src="/assets/index-D5TRuAbe.js"></script>
+    <script type="module" crossorigin src="/assets/index-BlsUOLDL.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-CF2yG9oG.css">
   </head>
   <body>

package/hook/hook.js

@@ -2,14 +2,16 @@
 // agent-dag hook forwarder. Invoked by Claude Code or Codex CLI as a command
 // hook. Reads stdin (event JSON), tags it with the provider passed via
 // `--provider <name>`, finds the matching agent-dag server via per-workspace
-// discovery files in <claude config dir>/agent-dag/, and POSTs the payload.
-// Dead instances are cleaned up.
+// discovery files in <claude config dir>/agent-dag/, makes that server prove it
+// is the deck the file describes, and POSTs the payload. Dead instances are
+// cleaned up.
 "use strict";
 
 const fs = require("fs");
 const path = require("path");
 const http = require("http");
 const os = require("os");
+const crypto = require("crypto");
 
 // Single shared discovery dir — Claude Code and Codex CLI both register here
 // via the installer. Lets one running agent-dag server receive both providers.
@@ -89,6 +91,111 @@ function isAlive(pid) {
   catch (e) { return e && e.code === "EPERM"; }
 }
 
+/**
+ * The answer a deck must give to be handed a session payload.
+ *
+ * Liveness of the recorded pid is not evidence that the thing listening on the
+ * recorded port is a deck. A deck killed with SIGKILL or lost to a power cut
+ * leaves its discovery file behind — nothing unlinks it — and every cleanup
+ * path here and in the server probes the same pid. Once the OS hands that
+ * number to some other long-lived process the file passes forever, and the
+ * port it names may by then belong to anything at all (4317, the deck's own
+ * default, is also the standard OTLP collector port). What was POSTed there is
+ * the whole hook event: prompt text, tool inputs, tool results, cwd.
+ *
+ * So the port has to prove itself before it is told anything. The deck writes a
+ * fresh random token into its discovery file at startup; this hook asks the
+ * listener to hash that token against a nonce it has never seen, and sends the
+ * payload only if the answer matches. A stranger on the port cannot answer
+ * without the token, and the nonce is new every time, so an answer overheard
+ * earlier is worth nothing. Note the direction: the hook never transmits the
+ * token itself, only a challenge, so a wrong listener learns nothing it could
+ * replay against the next event.
+ *
+ * Both sides must derive the proof identically — src/server/index.mjs exports
+ * the same function under the same name, and the pair is pinned by a test.
+ */
+function challengeProof(token, nonce) {
+  return crypto.createHash("sha256").update(`${token}:${nonce}`).digest("hex");
+}
+
+// Constant-time compare, purely so a hostile listener cannot walk the expected
+// proof out of us one byte at a time by timing how long we take to hang up. The
+// lengths are public (64 hex chars) and a mismatched one is rejected outright,
+// which is what timingSafeEqual requires of its arguments anyway.
+function sameProof(got, want) {
+  if (typeof got !== "string") return false;
+  const a = Buffer.from(got, "utf8");
+  const b = Buffer.from(want, "utf8");
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+// Two round trips now happen per target, and main()'s hard cap is 1500ms, so
+// the pair has to fit inside it with room to spare. The challenge is a bodyless
+// GET to a loopback port — sub-millisecond when a deck is there, and instant
+// ECONNREFUSED when nothing is.
+const CHALLENGE_TIMEOUT_MS = 400;
+const POST_TIMEOUT_MS = 1000;
+
+/**
+ * Ask the listener to prove it is the deck that wrote `d`, and POST the payload
+ * only once it has. `done` runs exactly once, whatever the outcome — a refused
+ * connection, a silent port, a wrong answer and a delivered event all just mean
+ * this target is finished.
+ */
+function deliver(d, body, done) {
+  let settled = false;
+  const finish = () => { if (settled) return; settled = true; done(); };
+
+  const nonce = crypto.randomBytes(16).toString("hex");
+  const want = challengeProof(d.token, nonce);
+
+  const req = http.request({
+    hostname: "127.0.0.1",
+    port: d.port,
+    path: `/api/hook-challenge?nonce=${nonce}`,
+    method: "GET",
+    timeout: CHALLENGE_TIMEOUT_MS,
+  }, res => {
+    if (res.statusCode !== 200) { res.resume(); return res.on("end", finish); }
+    let answer = "";
+    res.setEncoding("utf8");
+    res.on("data", c => {
+      answer += c;
+      // A deck answers in ~100 bytes. Anything pouring data at us is not one,
+      // and must not be allowed to grow this buffer without bound.
+      if (answer.length > 4096) { req.destroy(); finish(); }
+    });
+    res.on("end", () => {
+      // Already given up on this target — a flood we cut off above. Whatever
+      // arrived before that is not an answer we are going to act on.
+      if (settled) return;
+      let proof;
+      try { proof = JSON.parse(answer).proof; } catch { return finish(); }
+      if (!sameProof(proof, want)) return finish();
+      post(d, body, finish);
+    });
+  });
+  req.on("error", finish);
+  req.on("timeout", () => req.destroy());
+  req.end();
+}
+
+function post(d, body, finish) {
+  const req = http.request({
+    hostname: "127.0.0.1",
+    port: d.port,
+    path: "/api/event",
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    timeout: POST_TIMEOUT_MS,
+  }, res => { res.resume(); res.on("end", finish); });
+  req.on("error", finish);
+  req.on("timeout", () => req.destroy());
+  req.write(body);
+  req.end();
+}
+
 function main() {
   // Hard cap so a stuck server can never wedge the host CLI.
   setTimeout(() => process.exit(0), 1500);
@@ -129,6 +236,12 @@ function main() {
       let d;
       try { d = JSON.parse(fs.readFileSync(path.join(DIR, file), "utf8")); } catch { continue; }
       if (typeof d.workspace !== "string" || !d.pid || !d.port) continue;
+      // No token, no payload. A file this old was written by a deck from before
+      // the handshake existed; that deck rewrites its file with a token the
+      // moment it restarts, so the cost of refusing is a blind deck until the
+      // next start, against the cost of trusting an unauthenticated port with
+      // every prompt the user types.
+      if (typeof d.token !== "string" || d.token === "") continue;
 
       if (!isAlive(d.pid)) {
         try { fs.unlinkSync(path.join(DIR, file)); } catch {}
@@ -154,22 +267,7 @@ function main() {
     let pending = targets.length;
     const done = () => { if (--pending <= 0) process.exit(0); };
 
-    for (const { d } of targets) {
-      let settled = false;
-      const finish = () => { if (settled) return; settled = true; done(); };
-      const req = http.request({
-        hostname: "127.0.0.1",
-        port: d.port,
-        path: "/api/event",
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        timeout: 1000,
-      }, res => { res.resume(); res.on("end", finish); });
-      req.on("error", finish);
-      req.on("timeout", () => req.destroy());
-      req.write(taggedInput);
-      req.end();
-    }
+    for (const { d } of targets) deliver(d, taggedInput, done);
   });
 }
 
@@ -177,5 +275,5 @@ function main() {
 // the installer writes is `"<node>" "<...>/hook.js" --provider <name>`. Under a
 // require() it exports the matching rule and starts nothing, which is what lets
 // the rule be tested without a 1.5s exit timer in the test runner.
-module.exports = { cwdInWorkspace, foldsCase };
+module.exports = { cwdInWorkspace, foldsCase, challengeProof };
 if (require.main === module) main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "1.33.69",
+  "version": "1.33.71",
   "description": "Live deck of Claude Code and Codex agents — watch parallel subagents fork, call tools, and return on one calm canvas. Also available as npx ccdeck and npx agent-dag.",
   "type": "module",
   "bin": {

package/src/server/index.mjs

@@ -8,6 +8,7 @@ import { extname, join, resolve, dirname as pdirname, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname } from "node:path";
 import { createInterface } from "node:readline";
+import { createHash, randomBytes } from "node:crypto";
 import { claudeConfigDir } from "./claude-dir.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -1343,6 +1344,46 @@ function handleHealth(_req, res) {
   });
 }
 
+// A secret this process, and only this process, knows. It goes into the
+// discovery file bin/deck.js writes (mode 0600) and is never sent anywhere:
+// hook/hook.js reads it from that file and asks us to hash it against a nonce
+// before it will send us a single session payload.
+//
+// Fresh per start, deliberately. A discovery file that outlives its deck —
+// SIGKILL and power cuts both leave one behind — names a pid the OS is free to
+// hand to something else and a port that by then may belong to anything. The
+// pid probe below cannot tell that apart from a running deck, so the token is
+// what actually distinguishes us: the replacement process does not have it, and
+// neither does the next deck, so a stale file authenticates nothing.
+const HOOK_TOKEN = randomBytes(32).toString("hex");
+
+/** The token this deck expects to be challenged on. Written by writeDiscovery. */
+export function hookToken() { return HOOK_TOKEN; }
+
+/**
+ * The proof of knowing `token`, for a nonce the challenger chose.
+ *
+ * hook/hook.js spells this out a second time — it is installed outside the
+ * package and cannot import from here — and a test pins the two against each
+ * other. Changing one without the other silently blinds the deck.
+ */
+export function challengeProof(token, nonce) {
+  return createHash("sha256").update(`${token}:${nonce}`).digest("hex");
+}
+
+// GET /api/hook-challenge?nonce=… — answer a hook's challenge.
+//
+// The nonce is the caller's, so the answer proves knowledge of the token
+// without disclosing it, and proves it for this exchange only. Answering
+// freely is safe: a caller that can reach this port can already read the
+// discovery file that holds the token, being the same user on the same
+// machine, and the response is a hash the browser cannot read cross-origin.
+function handleHookChallenge(_req, res, url) {
+  const nonce = url.searchParams.get("nonce") ?? "";
+  if (!nonce || nonce.length > 256) return send(res, 400, { error: "bad nonce" });
+  send(res, 200, { proof: challengeProof(HOOK_TOKEN, nonce) });
+}
+
 function isProcessAlive(pid) {
   try { process.kill(pid, 0); return true; }
   catch (e) { return e && e.code === "EPERM"; }
@@ -1517,6 +1558,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
 
     if (req.method === "POST" && url.pathname === "/api/event") return guard(handleEventIngest(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/health") return handleHealth(req, res);
+    if (req.method === "GET"  && url.pathname === "/api/hook-challenge") return handleHookChallenge(req, res, url);
     if (req.method === "GET"  && url.pathname === "/events")     return handleSse(req, res);
     if (req.method === "GET"  && url.pathname === "/api/version")     return guard(handleVersion(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/upgrade")     return guard(handleUpgrade(req, res), res);

package/src/server/installer.mjs

@@ -300,16 +300,25 @@ export function hasCodexInstalled() {
   return existsSync(CODEX_DIR);
 }
 
-export async function writeDiscovery({ port, workspace }) {
+// The token is the deck's proof of identity, so the file holding it is the
+// deck's key material: readable and writable by its owner, nobody else. Windows
+// ignores the mode (NTFS ACLs inherit from the profile directory, which is
+// already per-user), and a file left over from an earlier run under a recycled
+// pid keeps its old mode through writeFile, hence the explicit chmod.
+export async function writeDiscovery({ port, workspace, token }) {
   await ensureDir(AGENT_DAG_DIR);
   const file = join(AGENT_DAG_DIR, `${process.pid}.json`);
   const data = {
     pid: process.pid,
     port,
     workspace: workspace ?? "",
+    // Without this the hooks refuse to post: a file naming a port it cannot
+    // authenticate is exactly the stale-file case they now decline to trust.
+    token: token ?? "",
     startedAt: new Date().toISOString(),
   };
-  await writeFile(file, JSON.stringify(data, null, 2) + "\n", "utf8");
+  await writeFile(file, JSON.stringify(data, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  await chmod(file, 0o600).catch(() => {});
   return file;
 }