agentd 0.9.2__tar.gz → 0.9.4__tar.gz

{agentd-0.9.2 → agentd-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentd
-Version: 0.9.2
+Version: 0.9.4
 Summary: agent daemon
 License-File: LICENSE
 Requires-Python: >=3.10

{agentd-0.9.2 → agentd-0.9.4}/agentd/devices/browser.py

@@ -50,6 +50,7 @@ from pathlib import Path
 from typing import Any
 from urllib.parse import urlsplit
 
+from agentd import fnox
 from agentd import secrets as host_secrets
 
 CHROME_PATHS = (
@@ -64,6 +65,34 @@ CHROME_PATHS = (
 STEALTH_FLAGS = ("--disable-blink-features=AutomationControlled", "--no-first-run",
                  "--no-default-browser-check", "--disable-features=Translate", "--window-size=1280,900")
 LOGIN_FORM_WAIT = 10.0  # seconds browser_login waits for a password field to appear
+_AUTO_ATTACH = {"autoAttach": True, "waitForDebuggerOnStart": True, "flatten": True}
+_POLICED_TARGETS = ("page", "iframe", "worker", "shared_worker", "service_worker")
+
+# "Accept" buttons of common cookie-consent banners, clicked when a page opens and before
+# a login (they steal focus and cover forms). Accepting is fine: every session's profile,
+# cookies included, is deleted when it ends.
+CONSENT_ACCEPT = (
+    "#onetrust-accept-btn-handler",                                  # OneTrust ("I understand", "Accept all")
+    "#CybotCookiebotDialogBodyLevelButtonLevelOptinAllowAll",        # Cookiebot
+    "#CybotCookiebotDialogBodyButtonAccept",
+    "#truste-consent-button",                                        # TrustArc
+    "#didomi-notice-agree-button",                                   # Didomi
+    ".osano-cm-accept-all",                                          # Osano
+    ".cky-btn-accept",                                               # CookieYes
+    ".cmplz-btn.cmplz-accept",                                       # Complianz
+    "[data-testid='uc-accept-all-button']",                          # Usercentrics
+    ".fc-cta-consent",                                               # Google consent (Funding Choices)
+    ".cc-window .cc-allow, .cc-window .cc-dismiss",                  # Insites Cookie Consent
+)
+_CONSENT_JS = """(() => {
+  const roots = [document, ...[...document.querySelectorAll('*')].filter(e => e.shadowRoot).map(e => e.shadowRoot)];
+  for (const sel of %s) for (const root of roots) for (const el of root.querySelectorAll(sel)) {
+    const r = el.getBoundingClientRect(), st = getComputedStyle(el);
+    if (r.width > 2 && r.height > 2 && st.visibility !== 'hidden' && st.display !== 'none')
+      return {x: r.left + r.width / 2, y: r.top + r.height / 2, sel};
+  }
+  return null;
+})()""" % json.dumps(list(CONSENT_ACCEPT))
 
 # Read the page from an isolated world: interactive elements with what a person sees.
 _SNAPSHOT_JS = r"""
@@ -197,6 +226,7 @@ class Browser:
     _session: str | None = field(default=None, repr=False)
     _profile: Path | None = field(default=None, repr=False)
     _pending: str | None = field(default=None, repr=False)
+    _page_target: str | None = field(default=None, repr=False)
     _login_pending: dict[str, str] = field(default_factory=dict, repr=False)   # site -> approval id
     _login_grants: set[str] = field(default_factory=set, repr=False)          # sites approved for this session
     _elements: list[int] = field(default_factory=list, repr=False)   # ref -> backendNodeId
@@ -243,7 +273,8 @@ class Browser:
         host = (urlsplit(conf["url"]).hostname or "").lower() if conf.get("url") else ""
         if not host:
             raise ValueError(f"login {site!r} needs a url or hosts (where its credentials may be typed)")
-        # The url's site and its subdomains: delta.com/custlogin redirects to www.delta.com/skymiles/login.
+        # The url's site and its subdomains, so a saved example.com/login that redirects to
+        # www.example.com/signin still counts.
         base = host[4:] if host.startswith("www.") else host
         return [base, f"*.{base}"]
 
@@ -260,13 +291,47 @@ class Browser:
             return {"status": "allowed"}
         if self.approvals is None:
             raise BrowserAccessError("logins need an approver (none is configured)")
-        conf = self.logins[site]
+        names = self._login_secrets(site)
+        missing = self._uncached(names)  # locked in fnox: approving will need the master password
         approval = self.approvals.request("browser_login", "", {
-            "site": site, "host": hosts[0], "hosts": hosts,
-            "secrets": [conf[k] for k in ("username", "password", "totp") if conf.get(k)]}, reason)
+            "site": site, "host": hosts[0], "hosts": hosts, "secrets": names}, reason,
+            unlock=(missing, self._fill) if missing else None)
         self._login_pending[site] = approval.id
         return {"id": approval.id, "status": approval.status}
 
+    def _login_secrets(self, site: str) -> list[str]:
+        conf = self.logins[site]
+        return [conf[k] for k in ("username", "password", "totp") if conf.get(k)]
+
+    def _fnox_dir(self) -> Path:
+        return Path(self.fnox_cwd or os.getcwd()).resolve()
+
+    def _uncached(self, names: list[str]) -> list[str]:
+        return fnox.uncached(names, self._fnox_dir())
+
+    def _fill(self, names: list[str], password: bytearray) -> dict[str, str]:
+        return fnox.fill(names, password, cwd=self._fnox_dir())
+
+    async def _ensure_unlocked(self, site: str) -> None:
+        """A login approved earlier (always, session, by host code) whose secrets are locked in
+        fnox asks for an unlock (the human's master password) and waits for it."""
+        missing = await asyncio.to_thread(self._uncached, self._login_secrets(site))
+        if not missing:
+            return
+        if self.approvals is None:
+            raise BrowserAccessError(f"{site}'s credentials ({', '.join(missing)}) are locked in fnox, "
+                                     "and no approver is configured to unlock them")
+        approval = self.approvals.request("unlock", "", {"site": site, "host": self._login_hosts(site)[0],
+                                                         "secrets": missing}, f"log in to {site}",
+                                          unlock=(missing, self._fill))
+        status = await self.approvals.wait(approval.id)
+        if status not in ("once", "session", "always"):
+            raise BrowserAccessError(f"{site}'s credentials are locked in fnox: unlock approval {approval.id} is "
+                                     f"{status}" + ("" if status == "deny" else "; call browser_login again once "
+                                                    "it's approved"))
+        if await asyncio.to_thread(self._uncached, missing):
+            raise BrowserAccessError(f"{site}'s credentials are still locked in fnox")
+
     def _use_login(self, site: str, spend: bool = True) -> None:
         """Raise unless ``site``'s login is approved; a 'once' approval is spent here (with ``spend``)."""
         if self._login_granted(site):
@@ -327,11 +392,34 @@ class Browser:
         page = next((t for t in targets if t["type"] == "page"), None)
         if page is None:
             page = {"targetId": (await self._pipe.send("Target.createTarget", {"url": "about:blank"}))["targetId"]}
+        self._page_target = page["targetId"]
         self._session = (await self._pipe.send("Target.attachToTarget",
                                                {"targetId": page["targetId"], "flatten": True}))["sessionId"]
         await self._send("Page.enable")  # lifecycle only; never Runtime.enable
-        await self._send("Fetch.enable", {"patterns": [{"urlPattern": "*", "requestStage": "Request"}]})
         self._pipe.handlers["Fetch.requestPaused"] = self._on_request
+        self._pipe.handlers["Target.attachedToTarget"] = self._on_attached
+        await self._send("Fetch.enable", {"patterns": [{"urlPattern": "*", "requestStage": "Request"}]})
+        # Every other target (new tabs and popups, iframes in their own process, workers) is held
+        # at start until its requests are intercepted too, so none gets past the allowlist.
+        await self._pipe.send("Target.setAutoAttach", _AUTO_ATTACH)
+        await self._send("Target.setAutoAttach", _AUTO_ATTACH)
+
+    async def _on_attached(self, params: dict, session: str | None) -> None:
+        info, child = params.get("targetInfo", {}), params.get("sessionId")
+        try:
+            if info.get("targetId") != self._page_target and info.get("type") in _POLICED_TARGETS:
+                await self._pipe.send("Fetch.enable", {"patterns": [{"urlPattern": "*", "requestStage": "Request"}]},
+                                      child)
+                if info.get("type") in ("page", "iframe"):
+                    await self._pipe.send("Target.setAutoAttach", _AUTO_ATTACH, child)
+        except (RuntimeError, ConnectionError, asyncio.TimeoutError):
+            pass
+        finally:
+            if params.get("waitingForDebugger"):
+                try:
+                    await self._pipe.send("Runtime.runIfWaitingForDebugger", {}, child)
+                except (RuntimeError, ConnectionError, asyncio.TimeoutError):
+                    pass
 
     async def _send(self, method: str, params: dict | None = None, timeout: float = 30) -> dict:
         assert self._pipe is not None
@@ -405,8 +493,32 @@ class Browser:
             if state.get("result", {}).get("value") == "complete":
                 break
             await asyncio.sleep(0.25)
+        await self._dismiss_consent()
         return await self.snapshot()
 
+    async def _dismiss_consent(self, rounds: int = 2) -> list[str]:
+        """Click a known cookie-consent banner's accept button (real mouse events), up to ``rounds``
+        times for two-step banners. Returns the selectors clicked."""
+        clicked = []
+        for _ in range(rounds):
+            hit = (await self._isolated(_CONSENT_JS))["result"].get("value")
+            if not hit:
+                break
+            await self._click_at(hit["x"], hit["y"])
+            clicked.append(hit["sel"])
+            await asyncio.sleep(0.6)
+        return clicked
+
+    async def _click_at(self, x: float, y: float) -> None:
+        x += random.uniform(-2, 2)
+        y += random.uniform(-2, 2)
+        await self._send("Input.dispatchMouseEvent", {"type": "mouseMoved", "x": x, "y": y})
+        await asyncio.sleep(random.uniform(0.05, 0.15))
+        for kind in ("mousePressed", "mouseReleased"):
+            await self._send("Input.dispatchMouseEvent", {"type": kind, "x": x, "y": y, "button": "left",
+                                                          "clickCount": 1})
+            await asyncio.sleep(random.uniform(0.04, 0.12))
+
     async def snapshot(self) -> dict[str, Any]:
         """The page: URL, title, visible text (trimmed) and numbered interactive elements."""
         await self._ready()
@@ -439,25 +551,55 @@ class Browser:
 
     async def click(self, ref: int) -> dict[str, Any]:
         await self._ready()
-        x, y = await self._center(ref)
-        x += random.uniform(-2, 2)
-        y += random.uniform(-2, 2)
-        await self._send("Input.dispatchMouseEvent", {"type": "mouseMoved", "x": x, "y": y})
-        await asyncio.sleep(random.uniform(0.05, 0.15))
-        for kind in ("mousePressed", "mouseReleased"):
-            await self._send("Input.dispatchMouseEvent", {"type": kind, "x": x, "y": y, "button": "left",
-                                                          "clickCount": 1})
-            await asyncio.sleep(random.uniform(0.04, 0.12))
+        await self._click_at(*await self._center(ref))
         await asyncio.sleep(0.5)
         return await self.snapshot()
 
-    async def _type_into(self, ref: int, text: str) -> None:
+    async def _node(self, ref: int) -> str:
+        """A handle on element ``ref`` in agentd's isolated world (the page's scripts can't see our calls)."""
+        tree = await self._send("Page.getFrameTree")
+        world = await self._send("Page.createIsolatedWorld", {"frameId": tree["frameTree"]["frame"]["id"],
+                                                              "worldName": "agentd"})
+        obj = await self._send("DOM.resolveNode", {"backendNodeId": self._elements[ref],
+                                                   "executionContextId": world["executionContextId"]})
+        return obj["object"]["objectId"]
+
+    async def _on(self, handle: str, function: str) -> Any:
+        r = await self._send("Runtime.callFunctionOn", {"objectId": handle, "functionDeclaration": function,
+                                                        "returnByValue": True})
+        return r.get("result", {}).get("value")
+
+    async def _type_into(self, ref: int, text: str, *, clear: bool = False) -> None:
+        """Type ``text`` into element ``ref``. Before each character, focus goes back to it if
+        the page moved it (a cookie banner, a chat widget), so no keystroke lands elsewhere."""
         node = self._elements[ref]
+        handle = await self._node(ref)
+        focused = "function() { const r = this.getRootNode(); return (r.activeElement || document.activeElement) === this; }"
         await self._send("DOM.focus", {"backendNodeId": node})
+        if clear:  # select what's there and delete it with a real key press (frameworks see the change)
+            await self._on(handle, "function() { if (this.select) this.select(); else document.execCommand('selectAll'); }")
+            for kind in ("keyDown", "keyUp"):
+                await self._send("Input.dispatchKeyEvent", {"type": kind, "key": "Backspace", "code": "Backspace",
+                                                            "windowsVirtualKeyCode": 8})
         for ch in text:
+            if not await self._on(handle, focused):
+                await self._send("DOM.focus", {"backendNodeId": node})
             await self._send("Input.dispatchKeyEvent", {"type": "char", "text": ch})
             await asyncio.sleep(random.uniform(0.03, 0.09))
 
+    async def _fill_field(self, ref: int, text: str) -> None:
+        """Type a credential into ``ref``, verify the box got every character (by length only: the
+        value is never read back), retype once if not, else fail rather than submit."""
+        await self._dismiss_consent(rounds=1)  # banners often appear while the form is being filled
+        handle = await self._node(ref)
+        length = "function() { return (this.value !== undefined ? this.value : this.textContent || '').length; }"
+        for attempt in range(2):
+            await self._type_into(ref, text, clear=True)
+            if (await self._on(handle, length) or 0) >= len(text):  # >=: some fields format what's typed
+                return
+        raise BrowserAccessError("the page took focus while typing (or the field doesn't take the whole "
+                                 "credential): not submitting")
+
     async def type(self, ref: int, text: str, submit: bool = False) -> dict[str, Any]:
         await self._ready()
         if not 0 <= ref < len(self._elements):
@@ -486,6 +628,7 @@ class Browser:
         """Fill and submit a site's login form from fnox, on the host (only on its login hosts)."""
         await self._ready()
         self._use_login(site, spend=False)  # a 'once' is spent only when credentials are typed
+        await self._ensure_unlocked(site)
         conf = self.logins[site]
         kw = {"cwd": self.fnox_cwd} if self.fnox_cwd else {}
         # Already on the site's login form (the agent got there itself): stay. Otherwise
@@ -494,9 +637,11 @@ class Browser:
                                     and any(e.get("password") for e in (await self.snapshot())["elements"])):
             await self.open(conf["url"])
         await self._on_login_host(site)
-        # Many login pages build the form with JavaScript after the load: wait for it.
+        # Many login pages build the form with JavaScript after the load: wait for it. Consent
+        # banners (which cover the form or grab focus mid-typing) often load late too.
         deadline = time.monotonic() + LOGIN_FORM_WAIT
         while True:
+            await self._dismiss_consent(rounds=1)
             page = await self.snapshot()
             elements = page["elements"]
             password = next((e["ref"] for e in elements if e.get("password")), None)
@@ -508,9 +653,9 @@ class Browser:
         user = next((e["ref"] for e in reversed(elements[:password]) if e.get("tag") == "input"
                      and e.get("type") in (None, "text", "email", "tel")), None)
         if user is not None and conf.get("username"):
-            await self._type_into(user, host_secrets.secret(conf["username"], **kw))
+            await self._fill_field(user, host_secrets.secret(conf["username"], **kw))
         await self._on_login_host(site)  # still there, right before the password
-        await self._type_into(password, host_secrets.secret(conf["password"], **kw))
+        await self._fill_field(password, host_secrets.secret(conf["password"], **kw))
         self._use_login(site)  # credentials typed: a 'once' approval is now used
         await self._press_enter()
         await asyncio.sleep(1.5)
@@ -520,7 +665,9 @@ class Browser:
             code_field = next((e["ref"] for e in page["elements"] if e.get("tag") == "input"
                                and e.get("type") in (None, "text", "number", "tel")), None)
             if code_field is not None:
-                await self._type_into(code_field, totp(host_secrets.secret(conf["totp"], **kw)))
+                code = totp(host_secrets.secret(conf["totp"], **kw))
+                host_secrets.remember(code)  # derived, not read from fnox: scrub it from snapshots too
+                await self._fill_field(code_field, code)
                 await self._press_enter()
                 await asyncio.sleep(1.5)
         return await self.snapshot()

{agentd-0.9.2 → agentd-0.9.4}/agentd/egress/__init__.py

@@ -17,10 +17,12 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
+from agentd import fnox
 from agentd.egress.ca import SessionCA
 from agentd.egress.policy import (Allow, Policy, SecretRule, fnox_config_files, fnox_get, load_rules,
                                   load_secret_names, make_placeholder, opaque_placeholder)
 from agentd.egress.proxy import EgressProxy
+from agentd.fnox import SecretMissing
 from agentd.sandbox.base import DEFAULT_HOME
 
 logger = logging.getLogger(__name__)
@@ -84,13 +86,18 @@ class EgressSession:
             self.config_files = await asyncio.to_thread(
                 fnox_config_files, self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile)
             rules = load_rules(self.config_files)
+            locked: set[str] = set()
             for name in dict.fromkeys(r.secret for r in rules):
+                # Read now only what fnox has unlocked (for format-preserving placeholders);
+                # a locked secret is read, or unlocked, when a request first needs it.
                 try:
                     secrets[name] = await asyncio.to_thread(
                         fnox_get, name, self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile)
+                except SecretMissing:
+                    locked.add(name)
                 except (RuntimeError, OSError) as err:
                     logger.warning("egress: %s (its rules are disabled)", err)
-            rules = [r for r in rules if r.secret in secrets]
+            rules = [r for r in rules if r.secret in secrets or r.secret in locked]
             # Every other secret the sandbox may ask for gets a placeholder now; its
             # value is read from fnox only once a rule or approval lets it be sent.
             names = load_secret_names(self.config_files, e.fnox_profile)
@@ -98,7 +105,8 @@ class EgressSession:
                 self.descriptions[name] = names[name]
         for r in rules:
             if r.secret not in self.placeholders:
-                ph = r.placeholder or make_placeholder(secrets[r.secret])
+                ph = r.placeholder or (make_placeholder(secrets[r.secret]) if r.secret in secrets
+                                       else opaque_placeholder())
                 self.placeholders[r.secret] = ph
             self.descriptions.setdefault(r.secret, "")
         for name in self.descriptions:
@@ -113,7 +121,8 @@ class EgressSession:
         await self.proxy.start()
 
     async def _load(self, name: str) -> None:
-        """Read a secret from fnox for the proxy, the first time it may be sent."""
+        """Read a secret from fnox for the proxy, the first time it may be sent
+        (:class:`SecretMissing` if it's locked in fnox)."""
         e = self.egress
         try:
             value = await asyncio.to_thread(fnox_get, name, self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile)
@@ -123,6 +132,19 @@ class EgressSession:
         if self.proxy is not None:
             self.proxy.add_secret(name, value)
 
+    def loaded(self, name: str) -> bool:
+        return self.proxy is not None and name in self.proxy.secrets
+
+    def uncached(self, names: list[str]) -> list[str]:
+        """Which of ``names`` fnox can't read without an unlock (blocking)."""
+        e = self.egress
+        return fnox.uncached(names, self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile) if e.fnox else []
+
+    def fill(self, names: list[str], password: bytearray) -> dict[str, str]:
+        """Unlock ``names`` in fnox with the master password (blocking; zeroes it)."""
+        e = self.egress
+        return fnox.fill(names, password, cwd=self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile)
+
     def list_secrets(self) -> list[dict[str, Any]]:
         """What the sandbox can use or ask for: names, descriptions, env vars and rules (never values)."""
         policy = self.proxy.policy if self.proxy is not None else Policy()

{agentd-0.9.2 → agentd-0.9.4}/agentd/egress/approvals.py

@@ -10,11 +10,19 @@ sha256=<HMAC of the body>``). The proxy holds the request for ``hold``
 seconds: approved in time, it goes through; otherwise the agent gets a 403
 saying the approval is pending (``id``, ``retry_after``) and retries later.
 
+Secrets locked in fnox (a vault whose master password fnox's daemon doesn't
+have yet) are listed in the approval's ``details["unlock"]``; allowing it then
+needs the master password (``{"decision": ..., "password": ...}``), which
+unlocks them (:func:`agentd.fnox.fill`) before the decision applies. A wrong
+password leaves the approval pending. A pre-approved use that finds its secret
+locked asks with an approval of kind ``unlock``.
+
 Decisions (``agentd serve``: ``POST /v1/approvals/{id}``, or :meth:`decide`):
 ``once`` (the held request, or if none is held, the next matching one),
 ``session`` (until the sandbox stops), ``always``
-(persisted: secret rules into the fnox config they came from, host
-allowances and browser logins into ``~/.agentd/egress/allow.toml``), or ``deny``.
+(persisted in ``~/.agentd/egress/allow.toml``: host allowances, secret rules
+and browser logins; not in the fnox config, whose contents are part of fnox's
+cache key, so editing it would re-lock every unlocked secret), or ``deny``.
 """
 from __future__ import annotations
 
@@ -27,9 +35,10 @@ import os
 import time
 from dataclasses import asdict, dataclass, field
 from pathlib import Path
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Callable
 
-from agentd.egress.policy import Allow, Policy, SecretRule, add_rule_to_fnox
+from agentd import fnox
+from agentd.egress.policy import Allow, Policy, SecretRule
 from agentd.sandbox.base import DEFAULT_HOME
 
 if TYPE_CHECKING:
@@ -44,7 +53,7 @@ DECISIONS = ("once", "session", "always", "deny")
 @dataclass
 class Approval:
     id: str
-    kind: str                         # "connect" | "secret"
+    kind: str                         # connect | secret | unlock | browser | browser_login | device
     session: str
     details: dict[str, Any]
     reason: str = ""
@@ -71,12 +80,13 @@ class Approvals:
         self._holding: dict[str, int] = {}  # approval id -> requests held for it right now
         self._sessions: dict[str, tuple["EgressSession", Policy]] = {}
         self._dedupe: dict[tuple, str] = {}
+        self._fillers: dict[str, Callable[[list[str], bytearray], dict[str, str]]] = {}  # approval id -> unlock
 
     # ------------------------------------------------------------------ #
-    # Persistent allowances (host grants that fnox can't hold)
+    # Persistent grants ("always")
     # ------------------------------------------------------------------ #
 
-    def _saved(self) -> dict[str, list[str]]:
+    def _saved(self) -> dict[str, list]:
         try:
             import tomllib
         except ModuleNotFoundError:
@@ -94,14 +104,27 @@ class Approvals:
         """Browser logins approved "always", as ``site@host``."""
         return self._saved().get("browser_logins", [])
 
-    def _save(self, key: str, value: str) -> None:
+    def saved_rules(self) -> list[SecretRule]:
+        """Secret rules approved "always" (``[[secret_rules]]``: secret, domain, header, methods, paths)."""
+        rules = []
+        for r in self._saved().get("secret_rules", []):
+            if isinstance(r, dict) and r.get("secret") and r.get("domain"):
+                rules.append(SecretRule(secret=r["secret"], domain=str(r["domain"]).lower(),
+                                        header=str(r.get("header", "authorization")).lower(),
+                                        methods=tuple(r.get("methods") or ()), paths=tuple(r.get("paths") or ())))
+        return rules
+
+    def _save(self, key: str, value: str | dict) -> None:
         saved = self._saved()
         if value in saved.get(key, []):
             return
         saved.setdefault(key, []).append(value)
+        lists = [f"{k} = [" + ", ".join(json.dumps(s) for s in v) + "]\n"
+                 for k, v in saved.items() if all(isinstance(s, str) for s in v)]
+        tables = [f"\n[[{k}]]\n" + "".join(f"{f} = {json.dumps(x)}\n" for f, x in t.items())
+                  for k, v in saved.items() if not all(isinstance(s, str) for s in v) for t in v]
         self.allow_file.parent.mkdir(parents=True, exist_ok=True)
-        self.allow_file.write_text("".join(f"{k} = [" + ", ".join(json.dumps(s) for s in v) + "]\n"
-                                           for k, v in saved.items()))
+        self.allow_file.write_text("".join(lists + tables))
 
     def _save_allow(self, spec: str) -> None:
         self._save("allow", spec)
@@ -114,9 +137,18 @@ class Approvals:
         """The proxy's hook for one session: ``await ask(kind, **details) -> (approved, approval id, status)``."""
         self._sessions[egress.session] = (egress, policy)
         policy.allows.extend(Allow.parse(s) for s in self.saved_allows())
+        policy.rules.extend(r for r in self.saved_rules() if r.secret in egress.placeholders)
 
         async def ask(kind: str, **details: Any) -> tuple[bool, str]:
-            approval = self.request(kind, egress.session, details)
+            names = details.get("secrets") if kind == "unlock" else \
+                [details["secret"]] if kind == "secret" and details.get("secret") else []
+            unlock = None
+            if names:
+                missing = await asyncio.to_thread(egress.uncached, [n for n in names if not egress.loaded(n)])
+                if kind == "unlock" and not missing:
+                    return True, "", "unlocked"  # unlocked meanwhile: nothing to ask
+                unlock = (missing, egress.fill) if missing else None
+            approval = self.request(kind, egress.session, details, unlock=unlock)
             if approval.status != "pending":
                 return approval.status != "deny", approval.id, approval.status
             fut = self._waiters.setdefault(approval.id, asyncio.get_running_loop().create_future())
@@ -140,9 +172,15 @@ class Approvals:
     # Requests and decisions
     # ------------------------------------------------------------------ #
 
-    def request(self, kind: str, session: str, details: dict[str, Any], reason: str = "") -> Approval:
-        """A pending approval (an identical pending one is reused) announced to the webhook."""
+    def request(self, kind: str, session: str, details: dict[str, Any], reason: str = "",
+                unlock: tuple[list[str], Callable[[list[str], bytearray], dict[str, str]]] | None = None) -> Approval:
+        """A pending approval (an identical pending one is reused) announced to the webhook.
+
+        ``unlock``: (secret names locked in fnox, a function that unlocks them with
+        the master password); allowing the approval will need that password."""
         self._expire_old()
+        if unlock and unlock[0]:
+            details = {**details, "unlock": list(unlock[0])}
         key = (kind, session, json.dumps(details, sort_keys=True))
         existing = self._dedupe.get(key)
         if existing and existing in self.items and self.items[existing].status == "pending":
@@ -151,10 +189,43 @@ class Approvals:
                             reason=reason)
         self.items[approval.id] = approval
         self._dedupe[key] = approval.id
+        if unlock and unlock[0]:
+            self._fillers[approval.id] = unlock[1]
         self._notify(approval)
         return approval
 
-    def decide(self, approval_id: str, decision: str, by: str = "local") -> Approval:
+    def unlock(self, approval_id: str, password: bytearray | str) -> None:
+        """Unlock the approval's locked secrets with the master password (zeroed afterwards).
+
+        The approval stays pending if it fails: :class:`agentd.fnox.WrongPassword` (a
+        ValueError: ask again) or :class:`agentd.fnox.UnlockFailed` (unlocked, but fnox
+        couldn't read a secret: fix the vault or the fnox config, or deny). Blocking:
+        fnox derives the vault key per secret; agentd serve runs it in a thread."""
+        pw = password if isinstance(password, bytearray) else bytearray(str(password).encode())
+        try:
+            approval = self.items.get(approval_id)
+            if approval is None:
+                raise KeyError(approval_id)
+            names = approval.details.get("unlock") or []
+            if not names:
+                return
+            failed = self._fillers[approval_id](names, pw)
+            if any(why == fnox.WRONG_PASSWORD for why in failed.values()):
+                raise fnox.WrongPassword("master password didn't unlock the vault")
+            if failed:
+                raise fnox.UnlockFailed("the vault unlocked, but fnox couldn't read "
+                                        + "; ".join(f"{name}: {why}" for name, why in failed.items())
+                                        + " (renamed or deleted in the vault? fix it there or in the fnox config, "
+                                        "or deny)")
+            approval.details["unlock"] = []
+            self._fillers.pop(approval_id, None)
+        finally:
+            for i in range(len(pw)):
+                pw[i] = 0
+
+    def decide(self, approval_id: str, decision: str, by: str = "local",
+               password: bytearray | str | None = None) -> Approval:
+        """Decide an approval. One that lists secrets to unlock needs ``password`` to be allowed."""
         if decision not in DECISIONS:
             raise ValueError(f"decision must be one of {DECISIONS}")
         approval = self.items.get(approval_id)
@@ -162,6 +233,13 @@ class Approvals:
             raise KeyError(approval_id)
         if approval.status != "pending":
             return approval
+        if decision != "deny" and approval.details.get("unlock"):
+            if password is None:
+                raise ValueError(f"approving this unlocks {', '.join(approval.details['unlock'])} in fnox: "
+                                 "it needs the master password")
+            self.unlock(approval_id, password)
+        elif isinstance(password, bytearray):
+            password[:] = bytes(len(password))
         approval.status, approval.decided_by, approval.decided = decision, by, time.time()
         if decision in ("session", "always"):
             self._grant(approval, persist=decision == "always")
@@ -195,9 +273,9 @@ class Approvals:
             for egress, policy in targets:
                 if rule.secret in egress.placeholders:
                     (policy.once_rules if once else policy.rules).append(rule)
-                    if persist and egress.config_files:
-                        add_rule_to_fnox(egress.config_files[-1], rule)
-                        persist = False  # once
+            if persist:
+                self._save("secret_rules", {"secret": rule.secret, "domain": rule.domain, "header": rule.header,
+                                            "methods": list(rule.methods), "paths": list(rule.paths)})
 
     def _expire_old(self) -> None:
         now = time.time()
@@ -349,7 +427,11 @@ async def request_access(host: str, reason: str, port: int = 443, secret: str =
     if secret:
         details = {"secret": secret, "host": host.lower(), "method": method.upper(), "path": path,
                    "header": "authorization"}
-        approval = _ACTIVE.request("secret", session, details, reason)
+        unlock = None
+        if egress is not None and not egress.loaded(secret):
+            missing = await asyncio.to_thread(egress.uncached, [secret])
+            unlock = (missing, egress.fill) if missing else None
+        approval = _ACTIVE.request("secret", session, details, reason, unlock=unlock)
     else:
         approval = _ACTIVE.request("connect", session, {"host": host.lower(), "ip": "", "port": port}, reason)
     return {"id": approval.id, "status": await _ACTIVE.wait(approval.id)}

{agentd-0.9.2 → agentd-0.9.4}/agentd/egress/policy.py

@@ -124,14 +124,9 @@ class Policy:
 
 def fnox_config_files(cwd: Path, *, fnox: str = "fnox", profile: str | None = None) -> list[Path]:
     """The config files fnox would load from ``cwd`` (its own discovery)."""
-    argv = [fnox] + (["-P", profile] if profile else []) + ["config-files"]
-    try:
-        r = subprocess.run(argv, cwd=cwd, capture_output=True, text=True, timeout=30)
-    except (OSError, subprocess.SubprocessError):
-        return []
-    if r.returncode != 0:
-        return []
-    return [Path(line.strip()) for line in r.stdout.splitlines() if line.strip().endswith(".toml")]
+    from agentd import fnox as _fnox
+
+    return _fnox.config_files(cwd, fnox=fnox, profile=profile)
 
 
 def load_rules(files: list[Path]) -> list[SecretRule]:
@@ -175,13 +170,10 @@ def load_secret_names(files: list[Path], profile: str | None = None) -> dict[str
 
 
 def fnox_get(name: str, cwd: Path, *, fnox: str = "fnox", profile: str | None = None) -> str:
-    """One secret's value, from fnox on the host (no prompts)."""
-    argv = [fnox, "--non-interactive"] + (["-P", profile] if profile else []) + ["get", name]
-    r = subprocess.run(argv, cwd=cwd, capture_output=True, text=True, timeout=60,
-                       env={**os.environ, "FNOX_NON_INTERACTIVE": "1"})
-    if r.returncode != 0:
-        raise RuntimeError(f"fnox couldn't get {name}: {(r.stderr or r.stdout).strip()[:300]}")
-    return r.stdout.rstrip("\n")
+    """One secret's value, from fnox on the host (no prompts; :class:`agentd.fnox.SecretMissing` if locked)."""
+    from agentd import fnox as _fnox
+
+    return _fnox.get(name, cwd, fnox=fnox, profile=profile)
 
 
 def make_placeholder(value: str) -> str:
@@ -201,23 +193,6 @@ def opaque_placeholder() -> str:
     return "agentd_ph_" + "".join(_secrets.choice(alphabet) for _ in range(24))
 
 
-def add_rule_to_fnox(config: Path, rule: SecretRule) -> None:
-    """Append a rule to a fnox config ("always" grants live in fnox's config)."""
-    def q(s: str) -> str:
-        return '"' + s.replace("\\", "\\\\").replace('"', '\\"') + '"'
-
-    lines = ["", "[[proxy.rules]]", f"secret = {q(rule.secret)}", f"domain = {q(rule.domain)}",
-             f"header = {q(rule.header)}"]
-    if rule.methods:
-        lines.append("methods = [" + ", ".join(q(m) for m in rule.methods) + "]")
-    if rule.paths:
-        lines.append("paths = [" + ", ".join(q(p) for p in rule.paths) + "]")
-    if rule.placeholder:
-        lines.append(f"placeholder = {q(rule.placeholder)}")
-    with open(config, "a") as f:
-        f.write("\n".join(lines) + "\n")
-
-
 def rules_summary(rules: list[SecretRule]) -> list[dict[str, Any]]:
     return [{"secret": r.secret, "domain": r.domain, "header": r.header, "methods": list(r.methods) or ["*"],
              "paths": list(r.paths) or ["*"]} for r in rules]