agent-dag 3.9.0 → 3.11.0

package/src/server/browser-watch.mjs

@@ -37,7 +37,7 @@ import { classify, toEpisodes, defaultExclusions, isProgramNavigation } from "./
 import { appendLog, logPath, mergeEpisodes, readStore, undismissed, updateStore, writeStore } from "./browser-watch-store.mjs";
 import { browserSurvey } from "./browser-presence.mjs";
 import { available, performable, react } from "./browser-react.mjs";
-import { RELAY_HOST } from "./relay-guard.mjs";
+import { RELAY_HOST, hostsPath, readKillswitch, extensionReport, killswitchCommand, verdict } from "./relay-guard.mjs";
 
 /**
  * The moment this deck started, and the only floor any read uses.
@@ -77,6 +77,106 @@ function mtimeMs(file, deps) {
   try { return (deps.statSync ?? statSync)(file).mtimeMs; } catch { return null; }
 }
 
+/** Secure Preferences reports, keyed on the file and its mtime — see
+ *  `relayGuard` for why this one needs a cache more than the History read
+ *  does. */
+const extCache = new Map();
+
+/**
+ * What relay-guard can say about this machine, from two reads it does not do
+ * itself.
+ *
+ * THE MODULE WAS BUILT AND NEVER PLUGGED IN (#799). Every export but
+ * `RELAY_HOST` greped to its own declaration and its test, so the header's
+ * promise — "the one command that closes it … hands back the command that would
+ * change it, as text, for the user to paste" — reached no surface. A reader
+ * auditing this repo's security posture would have believed the killswitch and
+ * the grant report ship. This is that promise kept: the panel now renders both.
+ *
+ * relay-guard imports node:path and nothing else, on purpose, so the reading is
+ * here. Two sources:
+ *
+ *   THE HOSTS FILE, once. Small, and the same file for every profile.
+ *
+ *   EACH PROFILE'S "Secure Preferences", only where `hasExtension` already said
+ *   the directory is there. This one is why there is a cache: it is a single
+ *   JSON document holding every extension's settings and it runs to megabytes
+ *   on a profile with a few installed, while the panel polls every ten seconds.
+ *   Keyed on mtime like the History cache above, and for the same reason — a
+ *   browser that is closed cannot invalidate it.
+ *
+ * A read that fails is not a report of "nothing installed": `null` for that
+ * profile, and the aggregate says so. The difference matters here more than
+ * anywhere else in this file, because the reassuring answer and the unreadable
+ * answer are the same shape.
+ */
+async function relayGuard(profiles, { platform, env, deps }) {
+  const readOne = async (file) => {
+    const stamp = mtimeMs(file, deps);
+    if (stamp === null) return null;
+    const hit = extCache.get(file);
+    if (hit && hit.stamp === stamp) return hit.report;
+    let report = null;
+    try {
+      report = extensionReport(JSON.parse(await (deps.readFile ?? readFile)(file, "utf8")));
+    } catch {
+      // Unreadable or not JSON — a profile being written as we looked, a
+      // hardened profile we cannot open. Not cached, so the next poll retries.
+      return null;
+    }
+    extCache.set(file, { stamp, report });
+    return report;
+  };
+
+  const seen = [];
+  for (const profile of profiles) {
+    // `hasClaudeExt` is an existsSync on `Extensions/<id>` and is already
+    // computed; it cannot see `enabled`, `allUrls` or `sensitiveApis`, which is
+    // the whole reason this reads the preferences at all. But it is a free way
+    // to skip every profile that has no extension to report on.
+    if (!profile.hasClaudeExt) continue;
+    const report = await readOne(profile.securePrefsPath);
+    seen.push({
+      browser: profile.browser,
+      name: profile.name,
+      profile: profile.profile,
+      // Null when the file could not be read, which the panel says out loud
+      // rather than rendering as an absence of permissions.
+      report,
+    });
+  }
+
+  let hostsText = null;
+  const hosts = (deps.hostsPath ?? hostsPath)(platform, env);
+  try { hostsText = await (deps.readFile ?? readFile)(hosts, "utf8"); } catch { /* no file, or no permission to read it */ }
+  const killswitch = readKillswitch(hostsText);
+
+  // ONE ENABLED COPY ANYWHERE IS ENOUGH, which is `verdict`'s own rule: the
+  // relay is registered per ANTHROPIC ACCOUNT, not per profile, so a second
+  // profile with the extension switched off protects nothing.
+  const anyExtension = seen.some(p => p.report?.present === true && p.report.enabled === true);
+
+  return {
+    relayHost: RELAY_HOST,
+    hostsPath: hosts,
+    // Whether the hosts file could be read at all. `blocked: false` from an
+    // unreadable file and `blocked: false` from a file with no entry are the
+    // same value and not the same fact.
+    hostsRead: typeof hostsText === "string",
+    profiles: seen,
+    anyExtension,
+    killswitch,
+    verdict: verdict({ anyExtension, blocked: killswitch.blocked }),
+    // Both, always, so the panel can offer the one that matches the state
+    // without having to know how either is spelled. Text only — nothing here
+    // runs it, and relay-guard could not if it tried.
+    command: {
+      block: killswitchCommand(platform, { on: true }),
+      unblock: killswitchCommand(platform, { on: false }),
+    },
+  };
+}
+
 /**
  * Visits for one profile, re-reading only when the browser has written since
  * the last look.
@@ -503,6 +603,10 @@ export async function browserWatchSnapshot({
       log: watchLog(),
       profiles: [],
       browsers: [],
+      // Null rather than an empty report: this poll read no browser at all, and
+      // "the extension is not installed" is not something it is in a position
+      // to say. The panel renders the difference.
+      relay: null,
       episodes: archived,
       coverage: {
         startedMs: STARTED_MS,
@@ -753,10 +857,14 @@ export async function browserWatchSnapshot({
   _checkedMs = now;
 
   const browsers = await surveyBrowsers(platform, env, now, deps);
+  // Two small reads, and the answer to the one question this panel exists
+  // beside: whether somebody else's Claude Code can drive this browser (#799).
+  const relay = await relayGuard(profiles, { platform, env, deps }).catch(() => null);
 
   return {
     ok: true,
     settings: store.settings,
+    relay,
     // What this platform can actually do, so the panel never offers a mode
     // that would silently do nothing. See browser-react.mjs.
     reactions: available(platform),

package/src/server/index.mjs

@@ -788,7 +788,7 @@ const AGENT_NAME_MARK = '"agent-name"';
 /** Fold one line's naming records into `out`. Last value wins. Pure: `out` is
  *  the only thing written, and a line that is not one of the two records — or
  *  is a truncated fragment of one — leaves it untouched. */
-function foldSessionNamingLine(out, line) {
+export function foldSessionNamingLine(out, line) {
   if (!line) return;
   const hasTitle = line.includes(AI_TITLE_MARK);
   const hasName = line.includes(AGENT_NAME_MARK);
@@ -803,22 +803,6 @@ function foldSessionNamingLine(out, line) {
   }
 }
 
-/**
- * The session naming carried by a chunk of transcript text, newest wins.
- *
- * Pure and text-in, so the suite can pin the parsing against a handful of lines
- * instead of a 46 MB fixture. Returns `{aiTitle: null, agentName: null}` for a
- * chunk holding neither — a young session, or a stretch of the file that is all
- * tool output — and the caller keeps whatever it already knew rather than
- * clearing a name it has already shown.
- */
-export function readSessionNaming(text) {
-  const out = { aiTitle: null, agentName: null };
-  if (!text || typeof text !== "string") return out;
-  for (const line of text.split("\n")) foldSessionNamingLine(out, line);
-  return out;
-}
-
 /** Fold one transcript line into the running state. Every fact the three
  *  scanners need lives on a single line, so line-at-a-time folding sees
  *  exactly what a whole-file pass would. */
@@ -1459,8 +1443,13 @@ const lastNameReadAt = new Map();       // sid -> ms timestamp
 const pendingNameReads = new Set();     // sid currently being read
 
 /** The naming the cursor has folded so far, or null when the scan has nothing.
- *  Exported beside readContextFromTranscript for the same reason: the rule is
- *  worth pinning directly rather than through a live server. */
+ *
+ *  NOT exported, and the comment here used to say it was — "beside
+ *  readContextFromTranscript … the rule is worth pinning directly rather than
+ *  through a live server" — which stated a test contract no test had (#798).
+ *  What is worth pinning is the parsing, and that is `foldSessionNamingLine`,
+ *  which IS exported and which session-name.test.ts drives line at a time the
+ *  way `foldTranscriptLine` does. This wrapper is a scan and two null checks. */
 async function readSessionNamingFromTranscript(path) {
   const state = await scanTranscript(path);
   if (!state) return null;

package/src/server/open-url.mjs

@@ -158,19 +158,14 @@ export function startCommand(url, env = process.env, comspec) {
 }
 
 /**
- * Refuse anything that is not an http(s) URL.
+ * The address to actually hand the desktop, or null when it is not one — and
+ * the ONLY guard, since #798 removed the `isOpenable` boolean that sat in front
+ * of it with no caller but the suite.
  *
- * The one caller passes a localhost address it built itself, so this is not
- * guarding against a hostile input today — it is guarding against the day a
- * second caller passes a path, because every launcher above would happily open
- * it and `start` would run it.
- */
-export function isOpenable(url) {
-  return normalizeOpenable(url) !== null;
-}
-
-/**
- * The address to actually hand the desktop, or null when it is not one.
+ * Refuse anything that is not an http(s) URL: today's one caller passes a
+ * loopback address this deck built itself, so this is not guarding against a
+ * hostile input — it is guarding against the day a second caller passes a path,
+ * because every launcher above would happily open it and `start` would run it.
  *
  * The guard used to parse into a local `u`, check its protocol and throw the
  * parse away — so what reached `launchers` was the RAW string. `new URL()`

package/src/server/relay-guard.mjs

@@ -12,6 +12,11 @@
 // the one holding the user's logged-in sessions, so the question is worth a
 // panel rather than a footnote.
 //
+// WHERE IT SURFACES. The Browser Watch panel, under "Can this browser be
+// driven": the verdict, the grants each profile actually holds, and the
+// killswitch command as text to copy. `browser-watch.mjs`'s `relayGuard` does
+// the two reads this module refuses to do and calls everything below.
+//
 // WHAT THIS MODULE DOES. Two reads and a string. It says whether the extension
 // is installed and what it was granted (from a profile's "Secure Preferences",
 // which the caller parses), and whether the hosts file already black-holes the

package/src/server/system-metrics.mjs

@@ -1463,6 +1463,23 @@ export function startSystemMetrics() {
   thermalTimer.unref?.();
 }
 
+/**
+ * Stop the three timers and reset every reading this module holds.
+ *
+ * THE SUITE'S, AND SAID PLAINLY (#798). Production starts the loop once at boot
+ * and never stops it — the process ending is what stops it — so an audit
+ * grepping for callers finds none, and the honest answer is not to delete this
+ * but to name what it is for. It is a RESET as much as a stop: `history`,
+ * `thermal`, the CPU baselines and the miss counters all go back to their
+ * initial values, which is exactly what a case needs between two runs of
+ * `startSystemMetrics` in one process, and what nothing else in this module
+ * offers. Deleting it would leave the suite leaking intervals into the values
+ * the next case reads.
+ *
+ * That is also why it is safe as a test-only export where the four removed in
+ * #798 were not: there is no shipped counterpart for it to drift away from. The
+ * state it clears IS the state every other assertion here reads.
+ */
 export function stopSystemMetrics() {
   if (cpuTimer) clearInterval(cpuTimer);
   if (memTimer) clearInterval(memTimer);