thinknagent 0.1.11 → 0.1.13

package/Readme.md

@@ -45,6 +45,7 @@ chmod +x (which thinknagent)
 | `--room <roomId>` | ✅ | Room ID to connect to |
 | `--gpu` | ❌ | Enable GPU metrics (requires nvidia-smi) |
 | `--logs <paths>` | ❌ | Comma-separated log file paths to stream |
+| `--app-path <path>` | ❌ | Path to the deployed application folder (to track and display version) |
 
 ---
 
@@ -78,14 +79,15 @@ thinknagent init \
   --logs <YOUR_PM2_LOG_FILE> 
 ```
 
-**With GPU metrics:**
+**With GPU metrics & application version tracking:**
 ```bash
 thinknagent init \
   --server YOUR_APP_SERVER \
   --name my-server \
   --room <roomId> \
   --gpu \
-  --logs <YOUR_SYS_LOG_FILE> 
+  --logs <YOUR_SYS_LOG_FILE> \
+  --app-path /var/www/my-node-app
 ```
 
 Get your `roomId` from the room URL:
@@ -98,24 +100,40 @@ thinknagent start
 ```
 
 Output:
+```
 Starting thinknagent — my-server
 Status: PENDING — waiting for Owner approval
 [agent] Connecting to https://thinkncollab.com...
 [thinknagent] Registered as <agentId> — waiting for Owner approval...
+```
 
 ### Step 3 — Approve in Browser
 
-Go to your room's DevOps Wall:
-https://thinkncollab.com/devops/<roomId>/devops
-
-Click **Approve** on the pending agent in the sidebar.
+1. Go to your room's DevOps Wall:
+   `https://thinkncollab.com/devops/<roomId>/devops`
+2. Click **Approve** on the pending agent in the sidebar.
 
 Once approved:
+```
 [thinknagent] Approved! Role: monitor | Room: <roomId>
 [agent] Active. Role: monitor | Room: <roomId>
 [metrics] Poller started
 [logs] Watching 2 file(s)
 [shell] Bridge ready
+```
+
+### Step 4 — Run with PM2 (Keep Alive)
+
+To run the agent in the background so that all features (metrics, logs, shell) stay permanently active and accessible after you disconnect your terminal session:
+
+```bash
+# Start the agent using PM2
+pm2 start thinknagent --name "thinknagent_logs" -- start
+
+# Save PM2 process list and configure startup
+pm2 save
+pm2 startup
+```
 
 ---
 
@@ -181,6 +199,17 @@ Role is assigned by the room Owner at approval time and can be changed anytime f
 
 ---
 
+## Security & Privacy
+
+The agent is designed with a "zero-trust" approach to protect your server's credentials, logs, and shell sessions.
+
+- 🔒 **Double-Gate Authorization**: New agents connect in `PENDING` mode. They cannot stream metrics or logs until explicitly approved by the room Owner. Upon approval, they receive a signed HMAC `agentToken` for secure reconnection.
+- 🛡️ **Remote Shell Environment Insulation**: Spawning a shell strips all server environment variables, passing only a safe allowlist (`PATH`, `HOME`, `SHELL`, `TERM`, `LANG`). Your database credentials, cloud API keys, and environment secrets remain completely safe.
+- 🚫 **Path Traversal & Sensitive File Blocks**: Log files are verified using absolute path checking. They must belong to allowed directories (`/var/log`, `/home`, `/root`, `/tmp`) and are explicitly blocked if they contain sensitive directories or files like `.ssh/id_rsa`, `.env`, `/etc/passwd`, `/etc/shadow`, etc.
+- 💬 **SSL Transport**: All WebSocket and HTTP traffic between the agent and the server is encrypted using HTTPS/WSS.
+
+---
+
 ## Auth Flow
 thinknagent init
 → generates agentId
@@ -241,7 +270,7 @@ pm2 startup
 
 **Using systemd:**
 ```bash
-sudo nano /etc/systemd/system/app.service
+sudo nano /etc/systemd/system/thinknagent.service
 ```
 
 ```ini

package/bin/thinknagent.js

@@ -24,6 +24,7 @@ program
   .option('--room <roomId>', 'Room ID to connect to')
   .option('--gpu',                  'Enable GPU metrics (requires nvidia-smi)')
   .option('--logs <paths>',         'Comma-separated log file paths to stream')
+  .option('--app-path <path>',      'Path to the deployed application folder (to track version)')
   .action(async (opts) => {
     const existing = store.get('agentToken');
     if (existing) {
@@ -40,6 +41,7 @@ program
       gpu:       !!opts.gpu,
       logs:      opts.logs ? opts.logs.split(',').map(s => s.trim()) : [],
       roomId:    opts.room,
+      appPath:   opts.appPath || null,
       alerts:    [
         // sensible defaults — Owner can edit in browser
         { id: 'cpu-high',  metric: 'cpu.usage',      op: 'gt', value: 85, for: 60, severity: 'warning'  },
@@ -58,6 +60,7 @@ program
     console.log(`  Agent ID: ${chalk.white(agentId)}`);
     console.log(`  GPU     : ${cfg.gpu ? chalk.green('enabled') : chalk.gray('disabled')}`);
     console.log(`  Logs    : ${cfg.logs.length ? chalk.white(cfg.logs.join(', ')) : chalk.gray('none')}`);
+    console.log(`  App Path: ${cfg.appPath ? chalk.white(cfg.appPath) : chalk.gray('none')}`);
     console.log(chalk.gray('  ─────────────────────────────────────────'));
     console.log(chalk.yellow('\n  Next step:'));
     console.log('  1. Run: ' + chalk.cyan('thinknagent start'));
@@ -109,6 +112,7 @@ program
     console.log(`  Status  : ${cfg.agentToken ? chalk.green('APPROVED') : chalk.yellow('PENDING')}`);
     console.log(`  GPU     : ${cfg.gpu ? chalk.green('enabled') : chalk.gray('disabled')}`);
     console.log(`  Logs    : ${(cfg.logs||[]).length ? cfg.logs.join(', ') : chalk.gray('none')}`);
+    console.log(`  App Path: ${cfg.appPath ? chalk.white(cfg.appPath) : chalk.gray('none')}`);
     console.log(`  Alerts  : ${(cfg.alerts||[]).length} rule(s)`);
     console.log(chalk.gray('  ────────────────────────────────\n'));
   });

package/lib/connect.js

@@ -2,6 +2,45 @@
 
 const { io }   = require('socket.io-client');
 const store    = require('./store');
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+function getDeployedAppVersion(appPath) {
+  try {
+    const resolvedPath = path.resolve(appPath || process.cwd());
+    let pkgVersion = '';
+    let gitCommit = '';
+
+    const pkgJsonPath = path.join(resolvedPath, 'package.json');
+    if (fs.existsSync(pkgJsonPath)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
+        pkgVersion = pkg.version || '';
+      } catch (e) {}
+    }
+
+    try {
+      gitCommit = execSync('git log -n 1 --format="%h - %s" --no-color', {
+        cwd: resolvedPath,
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 2000,
+        encoding: 'utf8'
+      }).trim();
+    } catch (e) {}
+
+    if (pkgVersion && gitCommit) {
+      return `v${pkgVersion} (${gitCommit})`;
+    } else if (pkgVersion) {
+      return `v${pkgVersion}`;
+    } else if (gitCommit) {
+      return gitCommit;
+    }
+    return 'unknown';
+  } catch (err) {
+    return 'unknown';
+  }
+}
 
 const NAMESPACE = '/devops';
 const RECONNECT_DELAY = 5000;
@@ -34,18 +73,19 @@ class Connection {
     reconnection: true,
     reconnectionDelay: RECONNECT_DELAY,
     reconnectionAttempts: Infinity,
-   auth: (cb) => {
-  const freshCfg = store.read();
-  console.log('[debug] Reconnecting with token:', !!freshCfg.agentToken, 'agentId:', freshCfg.agentId);
-  cb({
-    agentId:    freshCfg.agentId,
-    agentToken: freshCfg.agentToken || null,
-    name:       freshCfg.name,
-    hostname:   require('os').hostname(),
-    version:    require('../package.json').version,
-    roomId:     freshCfg.roomId || null,
-  });
-}
+    auth: (cb) => {
+      const freshCfg = store.read();
+      console.log('[debug] Reconnecting with token:', !!freshCfg.agentToken, 'agentId:', freshCfg.agentId);
+      cb({
+        agentId:    freshCfg.agentId,
+        agentToken: freshCfg.agentToken || null,
+        name:       freshCfg.name,
+        hostname:   require('os').hostname(),
+        version:    require('../package.json').version,
+        roomId:     freshCfg.roomId || null,
+        appVersion: getDeployedAppVersion(freshCfg.appPath),
+      });
+    }
   });
 
   this._bind();

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "thinknagent",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "ThinkNCollab server agent — metrics, logs, alerts, shell bridge",
   "main": "lib/agent.js",
-  "author": "ThinkNCollab Team <team@thinkncollab.com>",
+  "author": "ThinkNCollab Team <raman@thinkncollab.com>",
   "bin": {
-    "thinknagent": "./bin/thinknagent.js"
+    "thinknagent": "bin/thinknagent.js"
   },
   "scripts": {
     "start": "node bin/thinknagent.js start",
@@ -25,6 +25,11 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "keywords": ["thinkncollab", "devops", "monitoring", "agent"],
+  "keywords": [
+    "thinkncollab",
+    "devops",
+    "monitoring",
+    "agent"
+  ],
   "license": "MIT"
 }