ragent-cli 1.7.3 → 1.8.0

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "ragent-cli",
-      version: "1.7.3",
+      version: "1.8.0",
       description: "CLI agent for rAgent Live \u2014 browser-first terminal control plane for AI coding agents",
       main: "dist/index.js",
       bin: {
@@ -89,7 +89,7 @@ var require_package = __commonJS({
         "@changesets/cli": "^2.29.8",
         "@eslint/js": "^10.0.1",
         "@types/figlet": "^1.7.0",
-        "@types/node": "^25.3.0",
+        "@types/node": "^20.17.0",
         "@types/ws": "^8.5.13",
         eslint: "^10.0.2",
         tsup: "^8.4.0",
@@ -950,7 +950,7 @@ var SECRET_PATTERNS = [
   /eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g
   // JWT
 ];
-var redactionEnabled = false;
+var redactionEnabled = true;
 function setRedactionEnabled(enabled) {
   redactionEnabled = enabled;
 }
@@ -1045,6 +1045,7 @@ var import_node_os = require("os");
 var import_node_string_decoder = require("string_decoder");
 var pty = __toESM(require("node-pty"));
 var STOP_DEBOUNCE_MS = 2e3;
+var MAX_CONCURRENT_STREAMS = 20;
 var MAX_SESSION_BUFFER_BYTES = 64 * 1024;
 function parsePaneTarget(sessionId) {
   if (!sessionId.startsWith("tmux:")) return null;
@@ -1151,6 +1152,12 @@ var SessionStreamer = class {
     if (this.active.has(sessionId)) {
       return true;
     }
+    if (this.active.size >= MAX_CONCURRENT_STREAMS) {
+      console.warn(
+        `[rAgent] Stream limit reached (${MAX_CONCURRENT_STREAMS}). Rejecting: ${sessionId}`
+      );
+      return false;
+    }
     if (sessionId.startsWith("tmux:")) {
       return this.startTmuxStream(sessionId);
     }
@@ -2702,6 +2709,10 @@ var ControlDispatcher = class {
       console.warn("[rAgent] Control message missing HMAC signature.");
       return false;
     }
+    if (!/^[0-9a-f]{64}$/i.test(receivedHmac)) {
+      console.warn("[rAgent] Control message has malformed HMAC signature.");
+      return false;
+    }
     const { hmac: _, ...payloadWithoutHmac } = payload;
     const canonical = JSON.stringify(payloadWithoutHmac, Object.keys(payloadWithoutHmac).sort());
     const expected = crypto2.createHmac("sha256", sessionKey).update(canonical).digest("hex");
@@ -2718,7 +2729,9 @@ var ControlDispatcher = class {
       "stop-session",
       "stop-detached",
       "disconnect",
-      "kill-process"
+      "kill-process",
+      "start-agent",
+      "provision"
     ]);
     if (dangerousActions.has(action) && this.connection.sessionKey) {
       if (!this.verifyMessageHmac(payload)) {
@@ -2798,6 +2811,9 @@ var ControlDispatcher = class {
       case "start-agent":
         await this.handleStartAgent(payload);
         return;
+      case "provision":
+        await this.handleProvision(payload);
+        return;
       case "stream-session":
         this.handleStreamSession(sessionId);
         return;
@@ -2837,8 +2853,11 @@ var ControlDispatcher = class {
   }
   /** Handle provision request from dashboard. */
   async handleProvision(payload) {
-    const provReq = payload;
-    if (!provReq.provisionId || !provReq.manifest) return;
+    const provReq = validateProvisionRequest(payload);
+    if (!provReq) {
+      console.warn("[rAgent] Rejecting provision request \u2014 malformed payload.");
+      return;
+    }
     console.log(`[rAgent] Provision request: ${provReq.manifest.name} (${provReq.provisionId})`);
     const sendProgress = (progress) => {
       const ws = this.connection.activeSocket;
@@ -2980,6 +2999,56 @@ var ControlDispatcher = class {
     }
   }
 };
+var VALID_INSTALL_METHODS = /* @__PURE__ */ new Set(["npm", "pip", "binary", "custom"]);
+var VALID_RUNTIMES = /* @__PURE__ */ new Set(["node", "python", "none"]);
+function validateProvisionRequest(payload) {
+  if (typeof payload.provisionId !== "string" || !payload.provisionId) return null;
+  if (typeof payload.sessionName !== "string" || !payload.sessionName) return null;
+  if (typeof payload.command !== "string" || !payload.command) return null;
+  const manifest = payload.manifest;
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) return null;
+  const m = manifest;
+  if (typeof m.id !== "string" || !m.id) return null;
+  if (typeof m.name !== "string" || !m.name) return null;
+  if (typeof m.installMethod !== "string" || !VALID_INSTALL_METHODS.has(m.installMethod)) return null;
+  if (typeof m.installCommand !== "string") return null;
+  if (typeof m.checkCommand !== "string") return null;
+  let prerequisites;
+  if (m.prerequisites !== void 0 && m.prerequisites !== null) {
+    if (typeof m.prerequisites !== "object" || Array.isArray(m.prerequisites)) return null;
+    const p = m.prerequisites;
+    if (typeof p.runtime !== "string" || !VALID_RUNTIMES.has(p.runtime)) return null;
+    prerequisites = {
+      runtime: p.runtime,
+      minVersion: typeof p.minVersion === "string" ? p.minVersion : void 0
+    };
+  }
+  if (payload.workingDir !== void 0 && typeof payload.workingDir !== "string") return null;
+  if (payload.envVars !== void 0 && (typeof payload.envVars !== "object" || payload.envVars === null || Array.isArray(payload.envVars))) return null;
+  let validatedEnvVars;
+  if (payload.envVars && typeof payload.envVars === "object") {
+    const entries = Object.entries(payload.envVars);
+    for (const [, v] of entries) {
+      if (typeof v !== "string") return null;
+    }
+    validatedEnvVars = payload.envVars;
+  }
+  return {
+    provisionId: payload.provisionId,
+    sessionName: payload.sessionName,
+    command: payload.command,
+    workingDir: typeof payload.workingDir === "string" ? payload.workingDir : void 0,
+    envVars: validatedEnvVars,
+    manifest: {
+      id: m.id,
+      name: m.name,
+      installMethod: m.installMethod,
+      installCommand: m.installCommand,
+      checkCommand: m.checkCommand,
+      prerequisites
+    }
+  };
+}
 
 // src/transcript-watcher.ts
 var fs3 = __toESM(require("fs"));
@@ -3576,9 +3645,9 @@ async function runAgent(rawOptions) {
   }
   const lockPath = acquirePidLock(options.hostId);
   const config = loadConfig();
-  if (config.redaction?.enabled) {
-    setRedactionEnabled(true);
-    console.log("[rAgent] Secret redaction enabled.");
+  if (config.redaction?.enabled === false || rawOptions.redact === false) {
+    setRedactionEnabled(false);
+    console.log("[rAgent] Secret redaction disabled.");
   }
   console.log(`[rAgent] Connector started for ${options.hostName} (${options.hostId})`);
   console.log(`[rAgent] Portal: ${options.portal}`);
@@ -3763,7 +3832,7 @@ async function runAgent(rawOptions) {
               } else if (payload.type === "start-agent") {
                 await dispatcher.handleControlAction({ ...payload, action: "start-agent" });
               } else if (payload.type === "provision") {
-                await dispatcher.handleProvision(payload);
+                await dispatcher.handleControlAction({ ...payload, action: "provision" });
               }
             }
             if (msg.type === "message" && msg.group === groups.registryGroup) {
@@ -3985,7 +4054,7 @@ function registerConnectCommand(program2) {
 
 // src/commands/run.ts
 function registerRunCommand(program2) {
-  program2.command("run").description("Run connector for a connected machine").option("--portal <url>", "Portal base URL").option("--agent-token <token>", "Connector token").option("-i, --id <id>", "Machine ID").option("-n, --name <name>", "Machine name").option("-c, --command <command>", "CLI command to run").action(async (opts) => {
+  program2.command("run").description("Run connector for a connected machine").option("--portal <url>", "Portal base URL").option("--agent-token <token>", "Connector token").option("-i, --id <id>", "Machine ID").option("-n, --name <name>", "Machine name").option("-c, --command <command>", "CLI command to run").option("--no-redact", "Disable secret redaction in terminal output").action(async (opts) => {
     try {
       printCommandArt("Run Connector", "streaming terminal session to portal");
       await runAgent(opts);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ragent-cli",
-  "version": "1.7.3",
+  "version": "1.8.0",
   "description": "CLI agent for rAgent Live — browser-first terminal control plane for AI coding agents",
   "main": "dist/index.js",
   "bin": {
@@ -58,7 +58,7 @@
     "@changesets/cli": "^2.29.8",
     "@eslint/js": "^10.0.1",
     "@types/figlet": "^1.7.0",
-    "@types/node": "^25.3.0",
+    "@types/node": "^20.17.0",
     "@types/ws": "^8.5.13",
     "eslint": "^10.0.2",
     "tsup": "^8.4.0",